Who Receives Hacker Threat Info From DHS?

Health care, banking and other key sectors at risk of cyberattacks have not joined a Department of Homeland Security program required to offer these industries protections against a potential catastrophic hack, according to federal inspectors.

President Obama ordered in early 2013 that DHS expand an information-sharing program once restricted to Pentagon contractors to the 16 so-called critical infrastructure industries.

The Enhanced Cybersecurity Services program feeds confidential alerts about the digital hallmarks, or "indicators," of threats so companies and their Internet service providers can load them into network-protection systems. The sometimes-classified information is culled from National Security Agency intelligence and other government agencies. 

Obama issued the executive order after Congress failed to pass cybersecurity legislation.

Only three of the 16 industries -- energy, communications services and the defense industrial base – are part of the program, according to a DHS inspector general report released Monday. And just two ISPs, termed "communications service providers" or CSPs, are authorized to receive and load the indicators. The pair, CenturyLink and AT&T, has been the only approved ISPs since the program’s launch.

When asked if he had heard of the program, Scott Jensen, communications director for the American Chemistry Council, which represents the chemical sector, told Nextgov, “We're not familiar with the specific program you mentioned, but there are other ways that DHS communicates with our industry regarding cyber threats.”

DHS does not directly communicate with companies to promote the program, relying instead on CenturyLink and AT&T to advertise their services to businesses, according to the report, which is dated July 29. Companies must pay for equipment and expertise from one of the ISPs or use their own in-house security specialists. The government information is free. 

Such information includes, for example, suspicious IP addresses, domains, email headers, and files.

Energy, Defense and Communications Sectors Are In

About 40 companies from the energy, defense and communications sectors are participating right now. DHS officials say they have signed memorandums of agreement with another 22 interested in joining.

A chicken-and-egg problem is partially responsible for the slow rollout.

The "program should include all 16 critical infrastructure sectors by increasing the number of operational CSPs," writes Richard Harsche, acting assistant IG for information technology audits.

But CSPs might not have a financial incentive to operate, until more critical sectors enroll.

"Without improving communication and outreach to increase critical infrastructure sector entities’ interest, CSPs may not have the financial means or incentive to participate in the [cyber] program due to the lack of new critical infrastructure entity customers,” Harsche said.

Most corporate technology workers and company facilities do not have the proper security clearances and secure equipment to handle the government data. And DHS has only finished validating one additional ISP, the report states. The entire vetting process for ISPs can take eight months.

"Enrollment in the [Enhanced Cybersecurity Services] program has been slow because of limited communication and outreach and a necessary in-depth security validation and accreditation process for potential program participants,” Harsche said.

Who Wants to Buy Free Information?

The inspector general also found the hacker information is not always unique. DHS distributes about 60 threat hallmarks a week, but some of them were redundant and a "majority of the information provided was unclassified and available through other sources," he said. 

Typically, the data exchange works as follows: DHS transmits threat indicators to the cleared ISPs and specially equipped critical companies about three times a week. The alerts include directions to scan emails for the indicators, such as malicious attachments, and quarantine flagged messages, so they do not reach employee inboxes.

Some sectors have their own industry-specific cyber programs and don’t want to pay communications providers to receive similar information. Many banks, for instance, rely on the Financial Services Information Sharing and Analysis Center, for cyber warnings and receive alerts from the Treasury Department, a financial services industry leader told Nextgov.

Obtaining clearances and building secure communications space to receive the DHS alerts is not an option for many financial institutions. And some of them already spend $250 million a year on network security, Treasury Secretary Jack Lew said last month.

The financial services advocate said the FS-ISAC is among the best sources of information and commended Lew’s work on safeguarding the sector’s networks.

Lew announced last month the creation of a cyber information sharing and analysis unit within Treasury that delivers network protection instructions to financial companies.

In response to a draft report, DHS officials said in a July 2 letter they are working to enlarge the program and improve the quality of the information provided.

The department will boost the number of cyber experts who vet ISPs using fiscal 2014 and 2015 job openings. Homeland Security also expects to award a contract for security engineering services by December, to further expedite enrollment.

"These measures will significantly increase the number of assessment activities that can be accomplished at one time, resulting in the timely completion of the security validation and accreditation processes," wrote Andy Ozment, assistant secretary for the DHS Office of Cybersecurity and Communications.  

By October, DHS plans to have an outreach strategy for publicizing program benefits to critical industry companies. The strategy will highlight "the value of the sensitive and classified federal government data" and authorized ISP services, Ozment said. 

On Monday, DHS officials said their program is meant to play a supporting role to cyber tools that firms already are using.

The program “is a voluntary initiative intended to augment, not replace, existing security services operated by or available to critical infrastructure companies,” DHS spokesman S.Y. Lee said in an email. It “automates the use of cyber threat indicators – up to and including classified information – by commercial service providers to assist participating critical infrastructure companies in their cyber protection efforts.”