The agency branding itself as the nation\u2019s \u201crisk adviser\u201d now has a strategic plan. But to fulfill that role, an organization with minimal power now has to prove its value to its target customers.<\/p>\n\n\n\n
In a speech at Auburn University Aug. 22, Chris Krebs, the director of the Cybersecurity and Infrastructure Security Agency, laid out his vision for the next few years, with responsibilities ranging from election security to supply chain security, as well as physical security.<\/p>\n\n\n\n
But there are significant challenges in achieving its missions, which Krebs summed up in an appeal to federal, state, local and academics to cooperate with his agency.<\/p>\n\n\n\n
\u201cI don\u2019t have mandatory or compulsory or regulatory authorities, generally speaking, to make anyone do things,\u201d Krebs said. \u201cWhatever we do has to be done together, and in cybersecurity that is the only way we\u2019re going to get it done. It has to be a collective defense approach.\u201d<\/p>\n\n\n\n
Now, CISA, which was established as its own agency late last year and is responsible for protecting critical infrastructure form cyberattacks, has to figure out how to operate effectively in a broad docket of spaces where the federal government has minimal authority \u2014 particularly in election security, where revelations from 2016 have shown the state and local governments have a pained relationship working with the federal government.<\/p>\n\n\n\n
\u201cFirstly, they need to genuinely be good partners with state, local and others and deliver what they promise,\u201d Frank Cilluffo, director of the McCrary Institute for Cybersecurity and Critical Infrastructure Protection at Auburn University, told Fifth Domain. \u201cWhile the flip side is obviously, the stakeholders need to be open to assistance, so that\u2019s something that obviously is going to take some time.\u201d<\/p>\n\n\n\n
To be successful, CISA must build trust with state and local governments, several cybersecurity experts told Fifth Domain. CISA has been working toward strengthening its partnerships, with field staff in all 50 states.<\/p>\n\n\n\n
\u201cThey need to lead through ideas and influence,\u201d said Brad Medairy, executive vice president and cyber and engineering lead at Booz Allen Hamilton. \u201cAnd so, because it\u2019s not a mandate, I think that they can still be successful, but they\u2019ve got to produce hard, crisp, meaningful and valuable recommendations that can be adopted.\u201d<\/p>\n\n\n\n
A common complaint from states in a Senate report on the 2016 election was that the warnings they received from the federal government did not provide the proper context about the threats they faced. Medairy said CISA needs to produce \u201cmeaningful and actionable information,” which will result in a \u201cgroundswell of credibility.\u201d<\/p>\n\n\n\n
\u201cThe more that you do that, then the more folks will be [willing] to accept it and adopt it,\u201d Medairy said.<\/p>\n\n\n\n
CISA\u2019s strategic intent document laid out a doctrine of \u201cdefend today; secure tomorrow\u201d and identified five of the most pressing issues in the countryfor the next few years: China, supply chain and 5G; election security; soft target security; federal cybersecurity; and industrial control systems.<\/p>\n\n\n\n
\u201cThey cannot do it alone; there\u2019s never enough funding available for any one organization to tackle these kind of problems,\u201d said Brett Scarborough, director of business strategy for cyber services at Raytheon Intelligence, Information and Services. \u201cSo they\u2019ve got to leverage partnerships \u2026 they have to grow and with trust, those partnerships will grow.\u201d<\/p>\n\n\n\n
CISA leadership chooses their words with caution, carefully considering the semantics of each word it puts in documents or what officials say publicly. Ultimately, they settled on their role as \u201crisk adviser,\u201d not risk manager.<\/p>\n\n\n\n
\u201cThey were wise to go with adviser over manager,\u201d Cilluffo said. \u201cBecause when you\u2019re the manager, that assumes you have control. \u2026 The truth is they don\u2019t. But they do have some capabilities that others desperately need.\u201d<\/p>\n\n\n\n
For federal cybersecurity, the challenge for CISA, much like the challenge it faces with states, is that each agency is in charge of its cybersecurity. In order to achieve its goals, CISA has to ensure that stakeholders know that CISA is there to help.<\/p>\n\n\n\n
CISA re-branded itself last year, changing its name from the National Protection and Programs Directorate to its current name. Several people interviewed for this story said that the change is an important step for raising its profile. But a former senior federal cybersecurity official with knowledge of CISA\u2019s operation said that CISA now has to make sure that stakeholders outside of DHS know that it\u2019s the agency to come to for cybersecurity needs.<\/p>\n\n\n\n
For example, the federal government needs to figure out what role CISA plays with sector-specific agencies that have critical infrastructure jurisdiction, like the Department of Energy, the official said. In areas where users have to voluntarily use CISA, the agency has to demonstrate the value of participating. The former official said that CISA hasn\u2019t laid out in the strategic intent document how it plans to do that.<\/p>\n\n\n\n
Krebs said in his speech that, down the road, he\u2019s looking at CISA potentially being used \u201cas a service.\u201d<\/p>\n\n\n\n
\u201cWe need to make sure that we are understanding what\u2019s happening across the entirety of the federal government so that we can manage risk,\u201d Krebs said. \u201cSo if we see something hitting one department, we can look for it in other departments and agencies. The way historically it\u2019s been managed, that capability is not been in place.\u201d<\/p>\n\n\n\n
CISA currently manages two cybersecurity programs for agencies. The first, known as the Continuous Diagnostics and Mitigation (CDM) program, helps agencies with the management of data protection, asset management, identity and access management and network security. CISA also runs EINSTEIN, a program that detects and blocks cyberattacks on federal civilian agencies and gives DHS the ability to use attack information to help protect other agencies.<\/p>\n\n\n\n
To reinforce its programs and agency support, however, CISA faces the same problem that challenge private industry and federal departments: finding people to work there.<\/p>\n\n\n\n
CISA, of course, also has to directly compete for cyber talent with other agencies and private industry, which makes it harder for them to recruit talent. Several experts pointed to this problem as a hindrance for CISA in its mission. But some also pointed to the \u201cCISA-as-a-service\u201d model as one that could solve ease this hardship.<\/p>\n\n\n\n
\u201cThere\u2019s not enough technical cyber talent to go around, so if everyone is trying to replicate the same capabilities it not only costs more, but you\u2019re not going to be able to get the same talent because everyone is in this competition for top talent,\u201d Medairy said. \u201cSo I think if you could have this one elite cell that\u2019s providing that capability as a service, you\u2019re just going to get a lot better results.\u201d<\/p>\n\n\n\n
Taking on such a large swath of threats, from cybersecurity to physical security, is a broad range of oversight. But it\u2019s one that some experts told Fifth Domain makes sense.<\/p>\n\n\n\n
\u201cI don\u2019t think any event is going to be exclusively physical or cyber,\u201d said Cilluffo. \u201cMany events will not be one domain or the other. Technology enables and enhances physical attacks from the perpetrator \u2026 and from the defender [perspective] you\u2019ve got to be able to integrate both of those siloes that have historically been treated separately.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Without regulatory authority, the Cybersecurity and Infrastructure Security Agency needs to gain the trust of agencies and state and local partners.<\/p>\n","protected":false},"author":7,"featured_media":55586,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["leadership","management","it-networks","it-cloud-report","newsletters","home","daily-brief","acquisition-update"],"primary_category":"leadership"}}},"categories":[10],"tags":[],"coauthors":[3252],"class_list":["post-18581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"USH2YOH7ZFDORFVZJAMD3ZMTD4","arc_canonical_url":"\/civilian\/dhs\/2019\/09\/04\/how-the-risk-adviser-agency-can-be-successful\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n