The new assistant director for cybersecurity within the Department of Homeland Security has outlined his top priorities for making the agency more \u201ceffective and efficient.\u201d<\/p>\n\n\n\n
Bryan Ware, who replaced Jeanette Manfra as assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency, said Jan. 14 at FedScoop\u2019s Data Cloud Summit that CISA Director Chris Krebs tasked him with modernizing CISA\u2019s legacy infrastructure and tackling some of the challenges the agency has with the data it collects.<\/p>\n\n\n\n
At the heart of that is modernizing artificial intelligence and tools it uses to sift through data. There are big implications in that effort for CISA \u2014 charged with protecting critical infrastructure and federal networks from cyberattack \u2014 as the agency is already collecting significant net flow records every day: 55 billion, or almost two terabytes of data, Ware said. On top of that, he\u2019s sharing millions of threat indicators weekly with intelligence companies and other industry stakeholders.<\/p>\n\n\n\n
But there\u2019s another new problem CISA is facing associated with its data: it\u2019s finding more false positives, or files or activities that\u2019s been incorrectly identified as malicious, in its cybersecurity data.<\/p>\n\n\n\n
\u201cAs we\u2019ve been able to collect and share indicators, our adversaries have adapted their strategies and tactics,\u201d said Ware. \u201cAnd so now we have to provide a lot more enrichment to those indicators.\u201d<\/p>\n\n\n\n
This presents significant data challenges for CISA, he said, which now has to supplement its data with more context for the indicators in response.<\/p>\n\n\n\n
But Ware said CISA needs more data and more visibility into civilian government networks, adding that their visibility is \u201cfairly limited\u201d because CISA\u2019s tools sit on the edge of the agency networks.<\/p>\n\n\n\n
\u201cWe see trends increasingly where more and more visibility is required sooner,” he said, without going into details.<\/p>\n\n\n\n
Ware also will focus on improving CISA\u2019s ability to share information. Information sharing is the centerpiece of CISA\u2019s mission, but it is \u201ctechnically hard,\u201d he said, because the agency has to share across different classification levels and across sectors while accounting for privacy.<\/p>\n\n\n\n
For example, CISA has partnerships with critical infrastructure providers that gives them access to a lot of personally identifiable information, Ware said. But when CISA turns around to share information with the intelligence community, it has to remove the PII. Furthermore, the information that CISA gets from the IC has to be declassified to disperse out to threat indicators out to industry.<\/p>\n\n\n\n
\u201cSo avoiding stovepipes there is really, really hard because there are containers and separations that must exist, but there\u2019s tremendous value when we can see across those things,\u201d Ware said.<\/p>\n\n\n\n
Ware\u2019s third priority is \u201caligning\u201d data use across mission areas. CISA scans millions of IP addresses every day for vulnerabilities, he said, and it needs to use that vulnerability data when starting threat hunts for an organization \u201cso that we don\u2019t start that hunt cold … but the data is there to inform what we hunt for.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The new Cybersecurity and Infrastructure Security Agency assistant director shared that adversaries switching up tactics are challenging CISA, which is looking to evolve how it collects and shares threat indicators.<\/p>\n","protected":false},"author":7,"featured_media":55044,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["it-networks","home","it-cloud-report","newsletters","daily-brief"],"primary_category":"it-networks"}}},"categories":[106,29,32],"tags":[],"coauthors":[3252],"class_list":["post-20066","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"B455TIGZQ5DUZBPDMJD7PZZJ5M","arc_canonical_url":"\/civilian\/dhs\/2020\/01\/14\/how-one-official-wants-to-increase-dhs-cyber-efficiency\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n