Posted by: Lee Rock, Acting Director of US-CERT

Today, I participated in the Cyber Atlantic 2011 tabletop exercise, an innovative joint U.S.–European Union (EU) cybersecurity effort to expand international collaboration efforts geared toward incident management and response. The outcomes of today’s activities will strengthen the Nation’s capacity to respond to a cyber incident through mutual support systems and help officials to better understand the common cyber operating picture. 

The Cyber Atlantic exercise is part of the ongoing EU-U.S. partnership to strengthen mutual capabilities for addressing emerging threats to global networks. Through the EU-U.S. Working Group on Cybersecurity – including representatives from DHS’ National Cyber Security Division (NCSD), the Department of Justice, EU member states and the European Commission – stakeholders focus on cyber incident management, enhancing public-private partnerships, and raising awareness about cyber threats, and combating cybercrime. 

In addition to working with the European Union to better understand and mitigate cyber threats,  DHS is enhancing collaboration in the cyber arena with other international partners through bilateral and multilateral engagement.   In accordance with various agreements, the United States Computer Emergency Readiness Team (US-CERT) supports international partners and the broader cybersecurity communities in both the United States and abroad on a range of technical and operational cyber issues.

By: Joe Jarzombek, Director for SwA, National Cyber Security Division

At a major IT conference earlier this year, Sec. Napolitano challenged the industry to monitor the integrity of their manufacturing processes.  “I am asking you today to redouble your efforts to increase the security, reliability and quality of the products that enter the global supply chain,” she said.  “We must have more secure hardware and software, and using that to create an information technology ecosystem that is fundamentally more resilient.”

Earlier this month, the IEEE Computer Society, the world’s leading organization of computing professionals, took a step in that direction by formally recognizing the Master of Software Assurance (MSwA) Reference Curriculum as a certified master’s degree program in software assurance—the first curriculum of its kind to focus on assuring the functionality, dependability, and security of software and systems. 

Researchers in the Computer Emergency Response Team (CERT) Program at Carnegie Mellon University’s Software Engineering Institute collaborated with a team of educators from Embry-Riddle Aeronautical University, Monmouth University, and Stevens Institute of Technology to develop this software assurance program, which DHS-sponsored through its Software Assurance (SwA) Curriculum Project.  The MSwA Reference Curriculum materials are available at http://www.cert.org/mswa/.

This project recognizes the emergence of software assurance as an important multi-discipline body of knowledge, and the IEEE seal of approval is a testament to the significance of the public-private collaboration that DHS, along with our government, industry, and academic partners, have put into the effort.

The SwA Curriculum Project, which produced the MSwA curriculum and undergraduate course outlines, is a recent NCSD effort to co-sponsor public-private collaboration for government, industry, and academia through its SwA Forum.  The forum also sponsors working groups, including one on Workforce Education and Training that has provided foundational, peer-reviewed material, such as the SwA Common Body of Knowledge. 

To facilitate implementation, the MSwA project team is offering assistance, free of charge, to educational institutions looking to launch an MSwA degree program.  For more information on the SwA Curriculum Project and the MSwA, log on to https://buildsecurityin.us-cert.gov/bsi/1165-BSI.html.

We’re taking a moment today to feature an important conference coming up at the end of the month. Yes, there are a lot of government conferences every year, and truthfully, we don’t spend a lot of time highlighting them. This blog wouldn’t be a blog anymore if we did; it would be a…well I don’t know, it would just be someplace where conferences are posted. The GFIRST National Conference, however, stands out as one we want to get on the radar for folks outside of the general government conference circuit.

GFIRST focuses on cybersecurity, and brings together dedicated professionals to participate in information-sharing groups, learn about the latest trends and preemptive measures, and listen to expert speakers discuss the latest in cybersecurity news. GFIRST organizers and speakers will use five pillars to communicate the conference’s message. They are:

• Threat
• Vulnerability
• Attack & Detection
• Mitigation
• Reflection

Click here to learn more about how these five pillars guide the discussion on cybersecurity. If you’re a cybersecurity professional, think about coming to the GFIRST conference – you can register onsite. The 5th Annual GFIRST National Conference takes place in Atlanta, Georgia this year from August 23rd-28th, and is hosted by US-CERT, the United States Computer Emergency Readiness Team. US-CERT is a partnership between DHS and the public and private sectors, and charged with protecting the nation's Internet infrastructure by coordinating defense against and response to cyber attacks.

The conference will have nearly 100 sessions with six seminar tracks, based on the GFIRST5 pillars, plus one more: Computer Hacking and Intellectual Property (CHIP). This is the third consecutive year that the GFIRST Conference will serve as a venue for the Justice Department’s CHIP to hold its Coordinators’ Conference.

Senior cybersecurity officials from DHS and the private sector will speak at the conference, including: Philip Reitinger, Deputy Undersecretary of the National Protection and Programs Directorate and Director of the National Cybersecurity Center, and Greg Schaffer, Assistant Secretary of the Office of Cybersecurity and Communications. Dave DeWalt, President and Chief Executive Officer of McAfee, Inc. will also address the conference.

For more information on the 5th Annual GFIRST National Conference, please visit: http://www.us-cert.gov/GFIRST.

Yesterday I had the opportunity to speak at the World Affairs Council Global Education Dinner about our Department’s increasing focus on the issue of cybersecurity.

Of all the threats America faces, the integrity of our cyber infrastructure demands special attention. These are no longer emerging threats. They are with us now, and are happening every day. Over the past two years, for example, cyber crime has cost Americans more than $8 billion.

Any victim of identity theft understands the damage and permanent harm that this can cause to personal finances, credit, and reputation. Cyber threats also pose clear national security risks to major public and government networks and systems – from banking and energy to communications and transportation.

For this reason, President Obama has made cybersecurity the object of one of his first executive actions, declaring our nation’s cyber infrastructure as a strategic national asset and outlining a comprehensive plan for how our nation will prepare for and respond to cyber threats.

Our Department is playing a key role in this effort. For example, we are taking the lead in defending federal executive branch networks and systems – the “dot-gov” domain – as well as coordination with the private sector to protect the nation’s critical infrastructure and key resources.

What the Department is Doing

This is a top priority for us. Accordingly, I have centralized all of the Department’s cybersecurity functions under a new deputy undersecretary for the National Protection and Programs Directorate, Philip Reitinger. This individual will coordinate cyber security across the Department, including our U.S. Computer Emergency Readiness Team (US-CERT) and our National Cyber Security Center.

We’re also in the process of recruiting some of the best and brightest to lend their talents to our Department. We recently asked a well-known former computer hacker to join the Homeland Security Advisory Council to help us better understand the kind of threats that can come from hackers seeking to do harm.

Because cyber threats are not limited by international boundaries, we are also working with our overseas partners. For example, we are part of a coalition called the “International Watch and Warning Network” where 15 countries collaborate on policy issues, and response to cyber attacks.

Of course, the government can’t do this work alone. Everyone has a role to play in making cybersecurity a regular habit. For more information on that front, I encourage you to visit the U.S. CERT website to learn about how you can help.

By taking prudent, common-sense measures, we can reduce our individual and collective vulnerability to cyber threats and increase our resiliency as a nation. Because cybersecurity is not an end point, but rather an ongoing set of efforts, this will continue to be a major priority for our Department in the weeks and months ahead.

Janet Napolitano