6.1 U.S. Government's Civilian Cybersecurity Organization

The U.S. federal government does not have a single agency or department that is responsible for nationwide cybersecurity, as it does for health, education, housing, and other key policy issues. Due to the unique nature of cybersecurity, the responsibilities are scattered throughout the federal government.

Much of the federal government's proactive cybersecurity programs are centered in the U.S. Department of Homeland Security (DHS), which has primary responsibility for the civilian (nonmilitary) cybersecurity. Over the years, statutes and presidential orders have increasingly consolidated civilian cybersecurity responsibilities within DHS.

DHS's cybersecurity operations are housed in the Office of Cybersecurity and Communications, which is part of DHS's National Protection and Programs Directorate (a broad organization that also includes programs to protect federal property and critical infrastructure from terrorism and natural disasters). The Office of Cybersecurity and Communications operates EINSTEIN, a broad program that protects civilian federal government computers from cybersecurity threats, by monitoring and deterring threats in real time. The Office also operates the National Cybersecurity and Communications Integration Center (NCCIC). Within NCCIC is the U.S. Computer Emergency Readiness Team (US-CERT), which provides round-the-clock monitoring for emerging cybersecurity threats, and issues alerts about significant cybersecurity issues that it has detected.

In recent years, Congress and other officials have made clear that DHS plays a central role in coordinating civilian cybersecurity. In 2015, Congress passed the Cybersecurity Act of 2015, which, as described below, provided limited legal immunity to encourage the private sector to share information about cybersecurity threats and defensive measures with the federal government. A lesser-publicized provision in that law significantly expanded the cybersecurity authorities of NCCIC. The provision, entitled the National Cybersecurity Protection Advancement Act of 2015, centralized the responsibility for cyber-threat information sharing within NCCIC. The statute also provides NCCIC and DHS with significant responsibility for nationwide cybersecurity planning.

DHS, however, is far from the only federal agency or department that has taken some ownership of cybersecurity. For instance, in 2016, President Obama formed the White House's Commission on Enhancing National Cybersecurity, which is comprised of public and private sector representatives and is charged with advising the government on cybersecurity.¹ The President also has advisers dedicated to cybersecurity, as does the President's National Security Council.

The U.S. State Department has additionally a cybersecurity coordinator who is dedicated to representing the nation on international cybersecurity issues. Among the issues that the State Department frequently discusses with other nations are export controls (discussed in Chapter 4 of this book), international cybercrime standards, and cyber-threat sharing and incident response programs.

The U.S. Department of Commerce also is quite involved in helping U.S. businesses reduce the risk of data breaches and other incidents. The Commerce Department's National Institute of Standards and Technology has developed a number of voluntary, nonbinding cybersecurity standards, including the Cybersecurity Framework discussed later in this chapter.

The U.S. Justice Department's Computer Crimes and Intellectual Property Section leads the government's efforts on prosecuting cybercrimes. Among the many responsibilities of the section is partnering with the private sector and educating the sector about emerging cybercrime issues.

Departments that focus on a particular industry often have attempted to help those industries ensure that they have adequate cybersecurity. For instance, the Food and Drug Administration has issued guidelines for the cybersecurity of medical devices, an issue that has long been seen as a serious national security concern. The U.S. Energy Department, discussed later in this chapter, has listed cybersecurity of the electric grid among its top priorities, and has started a threat-sharing information exchange for utilities. The Federal Communications Commission has offered cybersecurity resources to assist telecommunications providers in shoring up their network security. The National Highway Traffic Safety Administration, part of the U.S. Department of Transportation, has been researching the cybersecurity risks associated with connected automobiles.

6.2 Department of Homeland Security Information Sharing under the Cybersecurity Act of 2015

DHS has long operated the NCCIC and US-CERT, but the private sector has been hesitant to provide real-time threat information to the federal government because of concerns about liability under a wide range of laws, including antitrust and privacy. Recognizing this barrier, after years of heated debate, Congress in late 2015 passed, and President Obama signed, the Cybersecurity Act of 2015. The Cybersecurity Act has a number of components, including the creation of new processes by which companies can monitor and defend their networks, provisions that are discussed in Chapter 7 of this book. The new law also creates a greatly expanded platform by which private companies and the government can exchange information about cyber-threat indicators and defensive measures.

The information sharing – and limited immunity – applies only for the sharing or receipt of cyber-threat indicators or defensive measures. The statute broadly defines “cyber-threat indicator” as information that is necessary to describe or identify:

• malicious reconnaissance, including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability;
• a method of defeating a security control or exploitation of a security vulnerability;
• a security vulnerability, including anomalous activity that appears to indicate the existence of a security vulnerability;
• a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability;
• malicious cyber command and control;
• the actual or potential harm caused by an incident including a description of the information exfiltrated as a result of a particular cybersecurity threat;
• any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or
• any combination thereof.

The statute defines “defensive measure” as “an action, device, procedure, signature, technique, or other measure applied to an information system or information that is stored on, processed by, or transiting an information system that detects, prevents, or mitigates a known or suspected threat or security vulnerability.” The statute explicitly states that “defensive measure” does not include “a measure that destroys, renders unusable, provides unauthorized access to, or substantially harms an information system or information stored on, processed by, or transiting such information system” that is neither owned by the private entity that is operating the defensive measure or another entity that is “authorized to provide consent and has provided consent to that private entity for operation of the measure.”

To encourage sharing of information regarding cyber-threat indicators and defensive measures, the law provides limited immunity for companies that share information with the federal government, via specific procedures promulgated by the Attorney General and Secretary of Homeland Security. If a private entity complies with the requirements of the Cybersecurity Act of 2015 and accompanying regulations, it will not be held liable for monitoring its systems for cyber threats. Moreover, private entities are not liable for properly sharing or receiving cyber-threat indicators under the Cybersecurity Act of 2015.

The immunity only applies for sharing information for a “cybersecurity purpose,” which the statute defines as “the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability.” The statute defines “cybersecurity threat” as “an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.” “Cybersecurity threat” does not include a violation of a consumer terms of service or licensing agreement. This relatively narrow definition is intended to ensure that companies cannot gather and share private information with the government for reasons entirely unrelated to cybersecurity.

The limited immunity only applies if the private companies comply with DHS procedures – required under the Cybersecurity Act of 2015 – to adequately secure the information from unauthorized access, and to review cyber-threat indicators before sharing and remove any information that is not directly related to the cybersecurity threat. For instance, imagine that a retailer has seen a specific type of attack resulting in the theft of its customers' payment card information. That retailer should not actually transmit to DHS the list of compromised customer names and payment card numbers, as it is difficult to imagine that such information would be directly related to the cybersecurity threat. Instead, the company should either describe the attack, or redact the personally identifiable information from the data that it sends to DHS.

The Cybersecurity Act of 2015 explicitly states that it does not create a duty for the private sector to share cyber threats, nor does it create a duty for the private sector to warn or act due to its receipt of cyber-threat information.² The Cybersecurity Act of 2015 requires DHS to create an information system that:

• accepts cyber-threat indicators and defensive measures from any non-federal entity;
• ensures that federal entities receive the cyber-threat indicators in real time; and
• ensures that the sharing protects privacy rights and complies with other regulations.

In 2016, DHS unveiled its Automated Indicator Sharing (AIS) system, operated by NCCIC and US-CERT as required by the new cybersecurity law. Private entities voluntarily receive and share indicators through AIS, typically anonymously unless they choose to have their name associated with the cyber-threat indicator. DHS states that it does not validate the cyber-threat indicators; instead, it shares indicators based on the volume and velocity of the tips that it receives, as quickly as possible.

DHS does not require companies to go through an extensive vetting process to use AIS. Instead, they must agree to a Terms of Use and connect to DHS's managed system.

As required by the Cybersecurity Act of 2015, DHS has built in a number of functions to protect privacy in AIS. Among the protections are:

• using automated technology to delete unnecessary personally identifiable information;
• using human review of certain data to ensure privacy and proper functions;
• minimizing the data that DHS includes in cyber-threat indicator reports;
• only retaining the information that is necessary to combat cyber threats; and
• only collecting information that is used either for network defense or law enforcement.

Even if companies do not participate in AIS, they may share cyber-threat indicators and defensive measures with DHS via its website or email.

Because the law was recently added to the books, as of publication of this book, we do not have any court opinions that interpret the terms “cyber-threat indicator” or “cybersecurity threat.” However, the broad language of the definitions suggest that if a service provider reasonably believes that email messages or other Internet traffic might help companies understand a cybersecurity threat, such as malware, then the service provider would be immune from lawsuits under the SCA – or any other federal or state laws, for that matter.

6.3 Energy Department's Cyber-Threat Information Sharing

A frequent concern that cybersecurity experts and policy makers raise relates to an attack on the U.S. electric grid. Such an attack could not only cause widespread economic disruption, not to mention the potential for serious physical harm.

The primary challenge for cybersecurity in the power grid is that the grid is comprised of the infrastructure of a number of private companies. The grid is interconnected, so a cyberattack on one company could have a spiral attack across the grid, even if some of the other utilities had taken steps that would have prevented such an attack.

In 2013, the U.S. Department of Energy attempted to address this, in part, with the Cybersecurity Risk Information Sharing Program (CRISP), a voluntary program through which utilities could share classified and unclassified cyber-threat data, with the Energy Department as the intermediary. The Energy Department operates CRISP with the Electricity Sector Information Sharing and Analysis Center, an industry group that also exchanges cyber-threat data.

Much of the CRISP data is classified, so it is difficult to know how effective CRISP has been so far. In a 2014 letter to the North American Electric Reliability Corporation, Patricia Hoffman, the U.S. Assistant Secretary for the Energy Department's Office of Electricity Delivery and Energy Reliability, stated that the Department envisions CRISP eventually being operated by the private sector, collaborating with the government, to “serve as the primary communications channel for the Electricity Subsector and enhance the ability of the sector to prepare for and respond to cyber and physical threats, vulnerabilities, and incidents.”

The Energy Department's deep involvement in the development and roll-out of an industry-specific threat-sharing program demonstrates the grave threat that cyberattacks on the power grid could pose for the nation. Rather than simply delegating responsibility to the private sector or assuming that DHS would handle electric grid cyber threats through US-CERT, the Energy Department recognized the special need for industry-specific information sharing with government involvement.

6.4 Critical Infrastructure Executive Order and the National Institute of Standards and Technology's Cybersecurity Framework

Over the past decade, policy makers have become increasingly concerned that companies have not developed adequate procedures and policies to guard against cyber threats. This is particularly concerning because private companies operate a great deal of the power grids, communications networks, and other infrastructure that is central to the U.S. economy and national security.

In 2013, President Obama recognized this concern in an executive order regarding the cybersecurity of “critical infrastructure,” which he broadly defined as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”³

In the Executive Order, President Obama articulated a national policy “to enhance the security and resilience of the Nation's critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties.” The Executive Order calls for achieving those goals through a “partnership” with the private sector. This overall approach is noteworthy because it does not call for new regulations or laws to force companies to adopt specific safeguards. The Executive Order appears to recognize that strong cybersecurity is in companies' best interests, and that the government can help companies achieve those goals.

The Executive Order directed the Attorney General, Secretary of Homeland Security, and Director of National Intelligence to establish a process for sharing information about cyber threats – a process that was later codified and expanded upon in the Cybersecurity Act of 2015 information-sharing program (described above). The executive order also directed the Commerce Department's National Institute of Standards and Technology (NIST) to develop a voluntary cybersecurity framework for operators of critical infrastructure. The Executive Order directs NIST to incorporate industry feedback and align “policy, business and technological approaches to address cyber risks.”

In February 2014, in response to the Executive Order, NIST released the Framework for Improving Critical Infrastructure Cybersecurity. The 39-page document draws on a number of existing security standards. The NIST Framework does not proscribe specific technological solutions; rather, as its drafters state, it “provides organization and structure to today's multiple approaches to cybersecurity by assembling standards, guidelines, and practices that are working effectively in industry today.” NIST emphasizes that its Framework is not a “one-size-fits-all” cybersecurity solution, and that companies have a wide range of risks and are best suited to “determine activities that are important to critical service delivery and can prioritize investments to maximize the impact of each dollar spent.”

The NIST Framework core consists of five key principles for cybersecurity risk management. Below are the principles as stated by NIST, along with the implementation factors listed in the Framework, edited slightly. The NIST Framework is presented in multiple charts; this book consolidates those principles into a single list for clarity and brevity:

• Identify. Understand the organization and the cybersecurity risks to its systems, assets, data, and capabilities. Among the components of this function:
  • Inventory software platforms and physical devices and systems.
  • Map organizational communications and data flows.
  • Catalogue external information systems.
  • Prioritize hardware, devices, data, and software based on their classification, criticality, and business value.
  • Establish cybersecurity roles and responsibilities for the workforce and third-party stakeholders, such as suppliers and customers.
  • Identify and communicate the organization's role in the supply chain, critical infrastructure, and industry sector.
  • Establish and communicate priorities for organizational mission, objectives, and activities.
  • Establish dependencies and critical functions for delivery of critical services.
  • Establish resilience requirements to support delivery of critical services.
  • Establish organizational information security policy.
  • Coordinate information security roles and responsibilities with internal roles and external partners.
  • Understand and manage legal and regulatory requirements for cybersecurity, including privacy.
  • Address cybersecurity risks in governance and risk management processes.
  • Document and identify asset vulnerabilities.
  • Receive threat and vulnerability information from information-sharing forums.
  • Identify and document threats.
  • Identify potential business impacts.
  • Use threats, vulnerabilities, likelihoods, and impacts to determine risk.
  • Identify and prioritize risk responses.
  • Establish and run risk management processes.
  • Determine and clearly express organizational risk tolerance, in considering the organization's role in critical infrastructure and its sectoral risks.
• Protect. Implement safeguards to deliver services:
  • Manage identities and credentials for authorized devices, physical access to assets, and remote access.
  • Manage access permissions, with the principles of least privilege and separation of duties.
  • Protect network integrity, incorporating network segregation when possible.
  • Inform and train all users, and ensure that privileged users, senior executives, security personnel and third-party stakeholders understand roles and responsibilities.
  • Protect data at rest and in transit.
  • Formally manage assets throughout removal, transfers, and disposition.
  • Maintain adequate capacity to ensure data availability.
  • Implement protections against data leaks.
  • Use integrity-checking mechanisms to verify software, firmware, and information integrity.
  • Separate development and testing from the protection environment.
  • Create and maintain a baseline configuration of information technology and industrial control systems.
  • Implement a system development life cycle.
  • Implement configuration change control processes.
  • Periodically conduct, maintain, and test backups of information.
  • Meet policy and regulations regarding physical operating environment.
  • Destroy data according to policy.
  • Continuously improve protection processes.
  • Share effectiveness of protection technologies with appropriate parties.
  • Implement, manage, and test response and recovery plans.
  • Include cybersecurity in human resources practices.
  • Develop and implement a vulnerability management plan.
  • Perform and log maintenance and repair of assets, and approve remote maintenance in a manner that prevents unauthorized access.
  • Develop and review audit logs.
  • Protect and restrict use of removable media.
  • Control access to systems according to the principle of least functionality.
  • Protect communications and control networks.
• Detect. Continuously monitor the organization's systems and networks to more quickly become aware of cybersecurity incidents:
  1. Establish and manage a baseline of network operations and expected data flows.
  2. Analyze detected events to understand attack targets and methods.
  3. Aggregate and correlate event data from multiple sources.
  4. Determine impact of events.
  5. Establish incident alert thresholds.
  6. Monitor network, physical environment, and personnel activity to detect cybersecurity events.
  7. Detect malicious code and unauthorized mobile code.
  8. Monitor external service provider activity.
  9. Monitor for unauthorized personnel, connections, devices, and software.
  10. Perform vulnerability scans.
  11. Define roles and responsibilities to ensure accountability.
  12. Ensure that detection activities comply with all applicable requirements.
  13. Test detection processes.
  14. Communicate event detection information to appropriate parties.
  15. Continuously improve detection processes.
• Respond. Develop and implement a cybersecurity incident response program:
  1. Execute response plan during or after an event.
  2. Ensure that personnel know their roles and order of operations when a response is needed.
  3. Report events consistent with established criteria.
  4. Share information consistent with response plans.
  5. Coordinate with stakeholders consistent with response plans.
  6. Voluntarily share information with external stakeholders.
  7. Investigate notifications from detection systems.
  8. Understand the impact of an incident.
  9. Perform forensics.
  10. Categorize incidents consistent with response plans.
  11. Contain and mitigate incidents.
  12. Mitigate and document newly identified vulnerabilities as accepted risks.
  13. Incorporate lessons learned into response plans and update response strategies.
• Recover. Develop and implement a plan to restore networks and systems after a cybersecurity incident:
  1. Execute a recovery plan during or after an event.
  2. Incorporate lessons learned into a response plan and update recovery strategy.
  3. Manage public relations.
  4. Repair reputation after an event.
  5. Communicate recovery activities to internal stakeholders and executive and management team.

Keep in mind that the NIST Cybersecurity Framework is entirely voluntary, even for operators of the most critical infrastructure. NIST did not intend to create binding requirements, nor does it have the authority to do so.

However, companies are increasingly adopting the Framework, in the manner they see fit, to strengthen their cybersecurity processes. The Cybersecurity Framework is increasingly becoming a de facto standard of care that companies expect their business partners to follow. Accordingly, it is in a company's best interests to demonstrate that it complies, to some extent, with the general principles articulated in the Framework. Moreover, if a company experienced a breach or other cybersecurity incident, and subsequently faces a lawsuit or regulatory action, it might reduce the likelihood of liability if it could demonstrate the steps that it took to integrate the NIST Cybersecurity Framework into its operations.

Government agencies have recognized the value of the Cybersecurity Framework and have integrated it into their operations. For instance, in October 2015, the federal Office of Management and Budget, which is partly responsible for setting government-wide information technology policies, required federal agencies and departments to adopt the Framework. Similarly, in 2014, the state of Virginia began requiring its agencies to adopt the Framework. The Cybersecurity Framework is a good example of a public–private partnership that seeks to improve cybersecurity in the private sector without imposing regulations or the fear of costly litigation.