Blog

Over the last seven years, our nation has experienced increasingly severe and significant cyber incidents affecting both the private sector and Federal Government. The U.S. government’s experience responding to cyber incidents such as those that affected Sony Pictures Entertainment and the Office of Personnel Management has taught us valuable lessons and highlighted areas of growth.

To codify those lessons learned, in July, President Obama issued Presidential Policy Directive 41 (PPD-41): United States Cyber Incident Coordination. The directive called for a National Cyber Incident Response Plan (NCIRP) that defines a nationwide approach to cyber incidents and outlines the roles of both federal and non-federal entities. It also outlines how the U.S. government prepares for, responds to, and recovers from significant cyber incidents. And it responds to calls we’ve heard from the private sector to provide clarity and guidance about the Federal Government’s roles and responsibilities, including an answer to the question, “who do I call to report cyber incidents and get help?”

No single federal agency possesses all of the authorities, capabilities, and expertise to deal unilaterally with a significant cyber incident, so PPD-41 breaks down cyber incident response into three roles: asset response, threat response, and intelligence support to both of those activities. Asset response focuses on helping the organization affected by malicious cyber activity find the bad guys on their network, kick them off, and recover. Threat response focuses on identifying, pursuing, and disrupting the bad guys and their activity. As an analogy, think of a significant cyber incident as an arson: when you have a fire caused by arson, you want both the firefighters and the police to be present. The firefighters’ role is to put out the fire: that’s asset response. The police’s role is to determine who set the fire and bring them to justice: that’s threat response.

The Department of Homeland Security’s (DHS) National Cybersecurity and Communications Integration Center (NCCIC) is the designated lead for asset response during a significant cyber incident. They are the firefighters: they will find the bad guy on the affected organization’s system and help remove them, determine how they gained access, assess the damage, and provide guidance to the organization on how to make their system more secure. The NCCIC will also identify and alert other organizations that may be at risk from this particular bad guy, share anonymized information about the incident as broadly as possible so that other organizations can protect themselves, and distribute threat indicators related to the incident through our Automated Indicator Sharing capability so that our partners can immediately mitigate this particular threat.

The Department of Justice—specifically, the Federal Bureau of Investigation (FBI) and the National Cyber Investigative Joint Task Force (NCIJTF)—is the lead federal agency responsible for threat response in the event of a significant cyber incident. The FBI and NCIJTF are like the police in our arson analogy: they will conduct appropriate law enforcement and national security investigative activity; identify, pursue, and attempt to apprehend the bad guy; and disrupt and deter malicious cyber activity. DHS also plays a role in threat response: our U.S. Secret Service investigates financial crimes, and Immigration and Customs Enforcement’s Homeland Security Investigations provides threat response for cyber-enabled crimes.

Finally, intelligence support efforts involve creating situational awareness about cyber threats. The Office of the Director of National Intelligence (ODNI), through its Cyber Threat

Intelligence Integration Center (CTIIC), is the lead federal agency for intelligence support during significant cyber incidents. The CTIIC does not work directly with organizations that experience cyber incidents, rather it supports the government effort.

Recognizing that cybersecurity is a shared responsibility and effective cyber incident response must involve all levels of government as well as the private sector, PPD-41 directs DHS to develop an NCIRP. Over the past few months, DHS has coordinated with stakeholders from across the Federal Government; state, local, tribal and territorial governments; and the private sector to develop a draft NCIRP. Today, that draft is available for a 30-day public comment period, and can be viewed at www.us-cert.gov/ncirp.

Building upon PPD-41, the NCIRP outlines the roles and responsibilities of federal, state, local, tribal, territorial, private sector, and international stakeholders during a cyber incident; identifies the core capabilities required in the event of a cyber incident; and describes the coordination structure the Federal Government will use to coordinate its activities with affected stakeholders.

We welcome and encourage feedback on the draft NCIRP and are excited to promote it during National Cyber Security Awareness Month this October. Comments and questions will be accepted through October 31, 2016 and information about providing feedback accompanies the draft plan.. We will adjudicate public comments in November and December and plan to submit the final draft of the NCIRP to the White House in January 2017.

For information on who to contact if you experience a cyber incident, please click here.

At the U.S. Department of Homeland Security (DHS), we fight against the world’s toughest cyber adversaries. They attack at the speed of light, rapidly changing their tactics -- and targets -- to exploit new vulnerabilities and new technology. We are constantly challenged to keep up with these adversaries and defend the safety and security of the American people – the highest stakes.

Our best weapon is our people. So today, we are sharing two videos with you to help us meet this mission.

The first we call “Months to Milliseconds” because it depicts how we are moving to fight at the speed of the machines and networks we protect. It shows the work my team does inside our National Cybersecurity and Communications Integration Center to protect federal networks and provides a realistic scenario that captures our daily life in cybersecurity operations at DHS.

A full transcript of the Months to Milliseconds video, including all audio and visual information, can be found here.

In the second, Homeland Security Secretary Jeh Johnson and I discuss the importance of public service and the challenges and opportunities of our work at DHS on cybersecurity.

A full transcript of the DHS Cybersecurity Jobs video, including all audio and visual information, can be found here.

To keep up with the adversary, we need talented public servants to deploy cutting edge technology, focus on emerging threats, and develop innovative solutions with partners inside and outside government.

If you are a cybersecurity professional, if you have energy, creativity, and passion, we want you to join us. 

Through the DHS Cybersecurity Workforce Initiative, the Department is hiring a diverse group of cybersecurity professionals to secure the nation’s digital assets and critical infrastructure. That includes computer engineers, scientists, analysts, and Information Technology specialists.

We need the best and brightest to do a tour of duty at DHS. The work we do and the ideas you will bring are essential to our nation’s way of life. At DHS, we work on all parts of the security process – from penetration testing to malware analysis to network clean-up. Here, you can do things that will put you at the forefront of our nation’s security – working on projects you will not see anywhere else - and have access to cutting-edge technology and challenges from all of our components such as the U.S. Coast Guard, Immigration and Customs Enforcement Homeland Security Investigations, and the U.S. Secret Service.

Working at DHS is a great career move. I know because I got my start working for a private company, and I have learned volumes from my time at DHS. Every day, every level of my team is working side-by-side with partners in law enforcement, top-tier research institutions, and major private sector companies. Regardless of where your career takes you, this shared experience will make you stronger and take your skills to new heights.  And it is good for the nation as a whole.

At DHS, we are at the frontlines of cyberspace, defending the homeland and our connected world.   Whether you want to have a career in government, the private sector or both, join us as we say: “With honor and integrity, we will safeguard the American people, our homeland, and our values.”

The Department of Homeland Security is honoring the retirement of U.S. Secret Service canine Hurricane.

U.S. Citizenship and Immigration Services (USCIS) is celebrating Constitution Day and Citizenship Day, observed on Sept. 17, and Constitution Week, with nearly 240 naturalization ceremonies across the country. From the steps of the Lincoln memorial to the shores of Ellis Island, more than 38,000 candidates will be, for the first time, addressed as fellow Americans.

Constitution Week is being recognized this year from Sept. 16-23. The annual commemoration honors the signing of the Constitution on Sept. 17, 1787, and an observance that began in 1940 as “I Am an American Day.”

During Constitution Week, we celebrate the connection between the Constitution and citizenship and reflect on what it means to be a citizen of the United States. A chorus of voices rang out today through the main chamber of Ellis Island, where over 12 million immigrants entered the United States between 1892 and 1954, and recited the Preamble from memory during a naturalization ceremony for 45 candidates for citizenship.

We the People of the United States, in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity, do ordain and establish this Constitution for the United States of America.

The Constitution plays a meaningful role in the lives of new Americans. It not only establishes the rule of law, but also creates the framework for an immigration system that enables immigrants to become full citizens with the same rights, privileges and responsibilities as any other.

USCIS has partnered with NPS to hold more than 100 naturalization ceremonies in national parks and historic sites this year as a part of NPS’ centennial celebration. The partnership with NPS was established in 2006 to honor our nation’s history and the places NPS is charged to protect. Picturesque and quintessentially American places where naturalization ceremonies were held this Constitution Week inspire new citizens and those who witness naturalization ceremonies to celebrate and experience our country’s history and natural beauty, and to protect it for future generations.

To view a complete list of 2016 Constitution Week naturalization ceremonies, visit uscis.gov/news.

DHS photo by Aaron Rodriguez, Office of Public Affairs