In an event that brought two Cabinet secretaries and around 50 top federal and state officials together for three days of discussion on cybersecurity and critical infrastructure, one question remained: Who has the lead on information security issues in the United States?<\/p>\n\n\n\n
It was an issue pondered aloud by Sen. Ron Johnson, R-Wisc., the chairman of the Senate\u2019s Homeland Security committee. Johnson said Sept. 19 he had recently sat through a classified 5G briefing with cabinet officials and had a similar inquiry then.<\/p>\n\n\n\n
\u201cThe No. 1 question I [had] is \u2018who\u2019s in charge? Who is actually doing the problem definition when it comes to our challenge with 5G?,\u2019\u201d Johnson said at the Cybersecurity and Infrastructure Security Agency\u2019s second annual national cybersecurity summit at National Harbor. \u201cAnd nobody would really answer the question.\u201d<\/p>\n\n\n\n
\u201cThis is constant. This is common across the federal government,\u201d Johnson added.<\/p>\n\n\n\n
Government officials consistently argue that no single agency could take responsibility for the cybersecurity of the federal government. But, in today\u2019s current arrangement, one challenge is that several organizations work on cybersecurity issues in silos, particularly when it comes to election security or protecting the power grid.<\/p>\n\n\n\n
In addition, state and local governments control their elections. Private utilities largely manage the power grid. And with cyberthreats launched remotely and crossing international borders, this means there\u2019s a need for coordination and collaboration between organizations \u2014 a task that can be made difficult by jurisdictions.<\/p>\n\n\n\n
\u201cInternational boundaries dissolve away,\u201d said CISA Director Chris Krebs in his opening speech Sept. 18. \u201cJurisdictions do not, but the boundaries seemingly do.\u201d<\/p>\n\n\n\n
The summit brought together top state election and cybersecurity officials; federal officials from agencies such as the Pentagon, the Department of Homeland Security, the National Security Agency and the Department of Commerce; top congressional aides, along with some industry experts. In a rarity, several panels were exclusively government officials, even with a government moderator. At the outset, Krebs said he was ready to move beyond the boilerplate \u201cinformation sharing\u201d conversation.<\/p>\n\n\n\n
\u201cI\u2019m sick of hearing about information sharing and how that\u2019s going to solve the problem. It\u2019s not,\u201d Krebs said. \u201cWe have to get beyond information sharing. We have to work together to understand what our respective advantages are.\u201d<\/p>\n\n\n\n
Looking at the stature of the officials participating in this year\u2019s summit, it\u2019s clear that CISA is serious about finding the best ways to protect government systems.<\/p>\n\n\n\n
Coordinating with big players<\/b><\/p>\n\n\n\n
Consider the government leadership that sat for the summit\u2019s first panel. It included Anne Neuberger, director of the NSA\u2019s new Cybersecurity Directorate; Suzette Kent, federal chief information officer; Tonya Ugoretz, deputy assistant director of the FBI\u2019s cybersecurity division; Jack Wilmer, deputy CIO and chief information security officer at the Pentagon \u2014 all moderated by CISA\u2019s Assistant Director for Cybersecurity Jeanette Manfra. Outside of a congressional hearing, it was an unusual display of top officials.<\/p>\n\n\n\n
The significance of the leaders CISA pulled together wasn\u2019t lost on some in industry.<\/p>\n\n\n\n
\u201cThey\u2019re linking the players together, and so when you start creating that kind of collaboration, information sharing, where we can create an outcome and execute behind \u2014 that is where you actually start seeing transformational change,\u201d said Travis Reese, president of FireEye, a threat intelligence company. \u201cAnd to me, it starts here, it starts with getting people from different backgrounds, different components, different sides of the political world, into a place where they can share ideas, be very transparent [and] have some debates.\u201d<\/p>\n\n\n\n
Agency leaders made clear that they were exploring their responsibilities in relation to other entities in the federal government.<\/p>\n\n\n\n
\u201cWe spend a lot of time at FBI thinking about our role as it relates to others in this constellation of entities that have a piece of this mission \u2014 especially CISA and CYBERCOM and other organizations [that] have been developing,\u201d said Ugoretz. \u201cWhat we keep coming back to \u2026 is that it requires such a blend of mission and authorities and capabilities to tackle all the different aspects of what we\u2019re looking at in the cyber mission space. We agree that there really can\u2019t be one entity, realistically, that does it all. But it\u2019s all about, \u2018how do we come together?\u2019\u201d<\/p>\n\n\n\n
Krebs made increased coordination a point in his opening speech, comparing the role of the Federal Emergency Management Agency as the lead in disaster response to the state of affairs in cybersecurity.<\/p>\n\n\n\n
\u201cWe don\u2019t have that same doctrine built out for a large-scale cyber event,\u201d Krebs said.<\/p>\n\n\n\n
That missing doctrine worried Krebs, who said the government \u201cgot pretty close this summer\u201d to a large cybersecurity event, referencing the ransomware attacks against parishes in Louisiana and school districts in Texas. At the summit, Jared Maples, homeland security adviser for the state of New Jersey, said that he guesses he receives as many as 10 ransomware alerts from organizations throughout his state each week.<\/p>\n\n\n\n
Maples explained to Fifth Domain how CISA is helping states defend against these ransomware attacks by providing them with threat analysis of ransomware strains.<\/p>\n\n\n\n
\u201cWe can get it out to the smaller constituencies, which we do have direct access to. [For] the feds, it\u2019s tough to get out to 376 million people, but we can get it out to all 9 million of our people very quickly,\u201d Maples told Fifth Domain.<\/p>\n\n\n\n
Mac Warner, the Republican secretary of state in West Virginia, said that DHS and CISA are providing localities in his states with incident response plans to events like natural disasters and providing other training to country clerks.<\/p>\n\n\n\n
\u201cThere\u2019s a lot of activity going on from the federal government, DHS, CISA, and others to help us get the message across \u2014 not only training our own people but then the public part,\u201d Warner said in response to a question from Fifth Domain.<\/p>\n\n\n\n
CISA\u2019s not the only group assisting state officials in cyberspace. For ransomware attacks, the Maples said his agency also gets help from the FBI.<\/p>\n\n\n\n
\u201cThe federal government \u2014 CISA, for example, and a lot of our partners, FBI \u2014 there\u2019s a lot of capabilities to help overcome those if you are attacked and respond to them,\u201d Maples said.<\/p>\n\n\n\n
CISA also manages a handful of cybersecurity programs for federal agencies, such as the trusted internet connection (TIC) program, which provides safe internet connection, and the Continuous Diagnostics and Mitigation (CDM) program, which provides insight into agencies\u2019 cybersecurity posture.<\/p>\n\n\n\n
\u201c[This is] really the first time we had an agency really focused on security, with a major focus on cybersecurity,\u201d said Grant Schneider, the federal chief information security officer. \u201cSomething that has really galvanized \u2026 efforts across the federal government.\u201d<\/p>\n\n\n\n
Johnson praised Krebs\u2019 leadership at CISA and said that the overall structure of issue governance made sense, but added that there needed to be identified leadership over the individual issues.<\/p>\n\n\n\n
\u201cIn some of these subproblems, like 5G \u2026 we do need to understand that we need individuals within government to be in charge of all the different operations,\u201d he said.<\/p>\n","protected":false},"excerpt":{"rendered":"
Government officials consistently argue that no single agency could take responsibility for the cybersecurity of the federal government. But a Wisconsin senator recently pushed officials to answer the question of who takes the lead for information security.<\/p>\n","protected":false},"author":7,"featured_media":16785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["home","daily-brief","newsletters","it-cloud-report"],"primary_category":"home"}}},"categories":[4109,106,29,32],"tags":[],"coauthors":[3252],"class_list":["post-17611","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-congress","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"ENI2VSWYXFHRZA4C24CVVGEZIY","arc_canonical_url":"\/civilian\/dhs\/2019\/09\/25\/but-whos-in-charge-is-the-question-for-feds-in-cybersecurity\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n