The participants welcomed the landmark consensus of the 2012–2013 Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, including its affirmation of the applicability of existing international law to cyberspace.

The two sides reiterated that no single entity, company, organisation or government should seek to control the Internet, and expressed their full support for multi-stakeholder governance structures of the Internet that are inclusive, transparent, accountable and technically sound….

Initiative 1. Manage the Federal Enterprise Network as a single network enterprise with Trusted Internet Connections (TIC). The TIC initiative, headed by the Office of Management and Budget and the DHS, covers the consolidation of the federal government’s external access points (including those to the Internet). This consolidation will result in a common security solution, which includes facilitating the reduction of external access points, establishing baseline security capabilities, and validating agency adherence to those security capabilities. Agencies participate in the TIC initiative either as TIC access providers (a limited number of agencies that operate their own capabilities) or by contracting with commercial Managed Trusted IP Service providers through the GSA-managed Networx contract vehicle.

Initiative 2. Deploy an intrusion detection system of sensors across the federal enterprise. Intrusion detection systems using passive sensors form a vital part of U.S. government network defenses by identifying when unauthorized users attempt to gain access to those networks. The DHS is deploying, as part of its EINSTEIN 2 activities, signature-based sensors capable of inspecting Internet traffic entering federal systems for unauthorized accesses and malicious content. The EINSTEIN 2 capability enables analysis of network flow of information to identify potential malicious activity while conducting automatic full packet inspection of traffic entering or exiting U.S. government networks for malicious activity using signature-based intrusion detection technology. Associated with this investment in technology is a parallel investment in manpower with the expertise required to accomplish the DHS’s expanded network security mission. EINSTEIN 2 is capable of alerting US-CERT in real time to the presence of malicious or potentially harmful activity in federal network traffic and provides correlation and visualization of the derived data. Owing to the capabilities within EINSTEIN 2, US-CERT analysts have a greatly improved understanding of the network environment and an increased ability to address the weaknesses and vulnerabilities in federal network security. As a result, US-CERT has greater situational awareness and can more effectively develop and more readily share security-relevant information with network defenders across the U.S. government, as well as with security professionals in the private sector and the American public. The DHS’s Privacy Office has conducted and published a Privacy Impact Assessment for the EINSTEIN 2 program.

Initiative 3. Pursue deployment of intrusion prevention systems across the federal enterprise. This initiative represents the next evolution of protection for civilian departments and agencies of the federal Executive Branch. This approach, called EINSTEIN 3, will draw on commercial technology and specialized government technology to conduct real-time full packet inspection and threat-based decision-making on network traffic entering or leaving these Executive Branch networks. The goal of EINSTEIN 3 is to identify and characterize malicious network traffic to enhance cyber security analysis, situational awareness, and security response. It will have the ability to automatically detect and respond appropriately to cyber threats before harm is done, providing an intrusion prevention system supporting dynamic defense. EINSTEIN 3 will assist the DHS US-CERT in defending, protecting, and reducing vulnerabilities of federal Executive Branch networks and systems. The EINSTEIN 3 system will also support enhanced information sharing by US-CERT with federal departments and agencies by giving the DHS the ability to automate alerting of detected network intrusion attempts and, when deemed necessary by the DHS, to send alerts that do not contain the content of communications to the National Security Agency (NSA) so that DHS efforts may be supported by NSA exercising its lawfully authorized missions. This initiative makes substantial and long-term investments to increase national intelligence capabilities to discover critical information about foreign cyber threats and use this insight to inform EINSTEIN 3 systems in real time. The DHS will be able to adapt threat signatures determined by the NSA in the course of its foreign intelligence and Department of Defense information assurance missions for use in the EINSTEIN 3 system in support of the DHS’s federal system security mission. Information sharing on cyber intrusions will be conducted in accordance with the laws and oversight for activities related to homeland security, intelligence, and defense to protect the privacy and rights of U.S. citizens.

As of this writing, the DHS is conducting a exercise to pilot the EINSTEIN 3 capabilities described in this initiative based on technology developed by the NSA and to solidify processes for managing and protecting information gleaned from observed cyber intrusions against civilian Executive Branch systems. Government civil liberties and privacy officials are working closely with the DHS and US-CERT to build appropriate and necessary privacy protections into the design and operational deployment of EINSTEIN 3.

Initiative 4. Coordinate and redirect research and development (R&D) efforts. No single individual or organization is aware of all of the cyber-related R&D activities being funded by the government. This initiative is aimed at developing strategies and structures for coordinating all cyber R&D sponsored or conducted by the U.S. government, both classified and unclassified, and redirecting that R&D where needed. This initiative is critical to eliminate redundancies in federally funded cyber security research and to identify research gaps, prioritize R&D efforts, and ensure the taxpayers are getting full value for their money as we shape our strategic investments.

Initiative 5. Connect current cyber operations centers to enhance situational awareness. There is a pressing need to ensure that government information security offices and strategic operations centers share data regarding malicious activities against federal systems, consistent with privacy protections for personally identifiable and other protected information and as legally appropriate, to have a better understanding of the entire threat to government systems and to take maximum advantage of each organization’s unique capabilities to produce the best overall national cyber defense possible. This initiative provides the key means necessary to enable and support shared situational awareness and collaboration across six centers that are responsible for carrying out U.S. cyber activities. This effort focuses on key aspects necessary to enable practical mission bridging across the elements of U.S. cyber activities: foundational capabilities and investments, such as upgraded infrastructure, increased bandwidth, and integrated operational capabilities; enhanced collaboration, including common technology, tools, and procedures; and enhanced shared situational awareness through shared analytic and collaborative technologies.

The National Cybersecurity Center within the DHS will play a key role in securing U.S. government networks and systems under this initiative by coordinating and integrating information from the six centers to provide cross-domain situational awareness, analyzing and reporting on the state of U.S. networks and systems, and fostering interagency collaboration and coordination.

Initiative 6. Develop and implement a government-wide cyber counterintelligence (CI) plan. A government-wide cyber CI plan is necessary to coordinate activities across all federal agencies to detect, deter, and mitigate the foreign-sponsored cyber intelligence threat to U.S. and private sector information systems. To accomplish these goals, the plan establishes and expands cyber CI education and awareness programs and workforce development to integrate CI into all cyber operations and analysis, increase employee awareness of the cyber CI threat, and increase CI collaboration across the government. The Cyber CI Plan is aligned with the National Counterintelligence Strategy of the United States of America (2007) and supports the other programmatic elements of the CNCI.

Initiative 7. Increase the security of our classified networks. Classified networks house the federal government’s most sensitive information and enable crucial war-fighting, diplomatic, counterterrorism, law enforcement, intelligence, and homeland security operations. Successful penetration or disruption of these networks could cause exceptionally grave damage to our national security. We need to exercise due diligence in ensuring the integrity of these networks and the data they contain.

Initiative 8. Expand cyber education. While billions of dollars are being spent on new technologies to secure the U.S. government in cyberspace, it is the people with the right knowledge, skills, and abilities to implement those technologies who will determine success. However, there are not enough cyber security experts within the federal government or private sector to implement the CNCI, nor is there an adequately established federal cyber security career field. Existing cyber security training and personnel development programs, while good, are limited in focus and lack unity of effort. To effectively ensure our continued technical advantage and future cyber security, we must develop a technologically skilled and cyber-savvy workforce and an effective pipeline of future employees. It will take a national strategy, similar to the effort to upgrade science and mathematics education in the 1950s, to meet this challenge.

Initiative 9. Define and develop enduring “leap-ahead” technology, strategies, and programs. One goal of the CNCI is to develop technologies that provide increases in cyber security by orders of magnitude above current systems and that can be deployed within 5–10 years. This initiative seeks to develop strategies and programs to enhance the component of the government R&D portfolio that pursues high-risk/high-payoff solutions to critical cyber security problems. The federal government has begun to outline Grand Challenges for the research community to help solve these difficult problems that require “out-of-the-box” thinking. In dealing with the private sector, the government is identifying and communicating common needs that should drive mutual investment in key research areas.

Initiative 10. Define and develop enduring deterrence strategies and programs. Our nation’s senior policy makers must think through the long-range strategic options available to the United States in a world that depends on ensuring the use of cyberspace. As of this writing, the U.S. government has been implementing traditional approaches to the cyber security problem—and these measures have not achieved the level of security needed. This initiative is aimed at building an approach to cyber defense strategy that deters interference and attack in cyberspace by improving warning capabilities, articulating roles for the private sector and international partners, and developing appropriate responses for both state and nonstate actors.

Initiative 11. Develop a multipronged approach for global supply chain risk management. Globalization of the commercial information and communications technology marketplace provides increased opportunities for those intent on harming the United States by penetrating the supply chain to gain unauthorized access to data, alter data, or interrupt communications. Risks stemming from both the domestic and the globalized supply chain must be managed in a strategic and comprehensive way over the entire life cycle of products, systems, and services. Managing this risk will require a greater awareness of the threats, vulnerabilities, and consequences associated with acquisition decisions; the development and employment of tools and resources to technically and operationally mitigate risk across the life cycle of products (from design through retirement); the development of new acquisition policies and practices that reflect the complex global marketplace; and partnership with industry to develop and adopt supply chain and risk management standards and best practices. This initiative will enhance federal government skills, policies, and processes to provide departments and agencies with a robust tool set to better manage and mitigate supply chain risk at levels commensurate with the criticality of, and risks to, their systems and networks.

Initiative 12. Define the federal role in extending cyber security into critical infrastructure domains. The U.S. government depends on a variety of privately owned and operated critical infrastructures to carry out the public’s business. In turn, these critical infrastructures rely on the efficient operation of information systems and networks that are vulnerable to malicious cyber threats. This initiative builds on the existing and ongoing partnership between the federal government and the public and private sector owners and operators of critical infrastructure and key resources (CIKR). The DHS and its private sector partners have developed a plan of shared action with an aggressive series of milestones and activities. It includes both short-term and long-term recommendations, specifically incorporating and leveraging previous accomplishments and activities that are already under way. It addresses security and information assurance efforts across the cyber infrastructure to increase resiliency and operational capabilities throughout the CIKR sectors. It includes a focus on public–private sharing of information regarding cyber threats and incidents in both government and CIKR.