Department of Homeland Security Keynote
April 21, 2015, RSA Conference, San Francisco—Jeh Johnson from the US Department of Homeland Security gave an update on the government’s efforts in cyber security. The growing number of breaches and increasing links to state-directed activities calls for new efforts at the national level.
Our current society is becoming more bipolar as the younger people are looking for less security and more sharing while the older folks are becoming more worries about data breaches. Johnson’s daughter is attending college where Yik Yak, an anonymous texting app, is popular. When he arrived for a visit, the text service lit up with comments on someone important was on campus with a large security force.
Now, cyber security is becoming a concern for many people up to the President and his administration. DHS is starting to move from counter-terrorism to cyber functions. They acknowledge that they do not have all the answers nor talent to address this issue, so are proposing a larger partnership with the private sector. DHS envisions themselves as a service provider to clients, like a lawyer, and are building up capabilities to support this new direction.
A part of the effort is going to be through the National Cyber Intelligence Center (NCIC). This new group will have access to the NSA, FBI and other existing government resources who will help with evaluations and enforcement tasks. Last year, the center recorded 97,000 incidents, and expect this to grow. The NCIC plans to grow to address more issues and is in direct contact with DHS for many issues.
Their immediate goal is to provide automated cyber security information to companies to share indicators. Later they will this information from participating companies. Along this line, DHS will be opening a satellite office in silicon valley for sharing R & D. they want to recruit more technical people from the valley to go to Washington, D.C. and have more people rotate between private and government sectors.
Congress is also addressing some issues with the National Cyber Security Act. This act includes protection from liabilities for sharing information with the government and its intelligence integration center or other agencies. The President has issued an executive order for information sharing on cyber threats. Another change is that the Secret Service is becoming the lead agency on cyber crimes. They are assisted by the Coast Guard as a supplement, while they all work with DHS. The government know that we have issues with China and is working on getting better cooperation between the countries on cyber issues.
DHS is working on the weakest links, social attacks like spear-phishing. These links to businesses and their interconnections creates a cyber risk in the supply chain, so the emphasis is on developing and spreading best practices. Because the issues are larger than can be handled by a single entity, the government is trying to take responsibility for activity coordination.
The new environment is trying to rule out turf battles and increase sharing and cooperation across Treasury, Justice, and Commerce. One relatively easy path of all is to increase the use of encryption, even though deeper encryption will be a challenge for law enforcement and national security. The government understands the importance to business. The public safety challenges are exacerbated since increased data security can help the criminals more and hinders law enforcement. Nevertheless, we still have to address privacy and personal safety. We need to find solutions to this dilemma and balance liberty and security.
