As agencies look to improve their cybersecurity with adoption of Homeland Security’s Einstein 3 firewall, an important private-sector partner finally signed on to participate.
AT&T — one of the three major Internet service providers, along with Verizon and CenturyLink — signed a contract with DHS to provide intrusion prevention services through Einstein 3, allowing DHS to deploy the sophisticated firewall at agencies that use AT&T as their ISP.
Verizon and CenturyLink signed on to the program years ago, however, negotiations with AT&T stalled over questions of liability, according to a former DHS official.
“They were not interested in participating in E3A without 2511 protection,” a kind of liability protection that would have to come from the Department of Justice, said Chris Cummiskey, former DHS acting undersecretary for management, who was involved in those initial discussions.
Without AT&T’s participation in the program, large swaths of the federal government would be left out.
“It’s really essential to the whole strategy — to basically build protection using the Internet service providers as the aggregation points for government traffic, you have to have the largest providers participating in that,” Cummiskey said, noting AT&T serves 30-35 percent of federal civilian networks. “It’s a positive indicator of the pressure that’s been brought to bear to get this program jumpstarted.”
After the high-profile breaches of the Office of Personnel Management networks were revealed earlier this year, DHS officials announced plans to accelerate the program, dubbing the third phase Einstein 3 Accelerated (E3A).
The third phase of the Einstein program is designed to actively identify and block malicious traffic as it enters the network before it can infiltrate and do damage. Earlier phases enabled detection and mitigation of known threats while E3 is intended to block such attacks at the ISP level.
A DHS spokesman declined to comment on the negotiation process, including whether AT&T was granted liability protection or the scope of the final contract.
In a Nov. 11 blog post announcing the contract, Chris Smith, vice president of technology for AT&T Government Solutions, noted the partnership is an important step to protecting the .gov domain.
“Today, information is currency, power and advantage,” he wrote. “The combination of government threat information and commercial threat indicators boosts our ability to help the federal government and businesses in their ongoing fight against cyber threats.”
