Focusing on the long tail of cybersecurity

When the Department of Homeland Security announced the formation of a new National Risk Management Center in July to handle cybersecurity threats and engage with the private sector, some wondered how the center's mission would overlap or conflict with another DHS organ, the National Cybersecurity and Communications Integration Center.

Matthew Travis, deputy undersecretary of the National Protections and Programs Directorate, elaborated further on how DHS views the differing missions of the NCCIC and the NRMC while giving a speech at an Aug. 28 conference in Washington D.C.

The NCCIC, Travis said, will still serve as a threat and information sharing hub designed to react to problems and facilitate cooperation with state, local, private and critical infrastructure sectors in the face of immediate threats, like the ransomware attack that hit Atlanta earlier this year or the 2017 WannaCry attacks. The center will continue its role sharing threat indicators, conducting trainings, providing malware analysis for specific incidents and sending out technical advisories about emerging threats.

"With NCCIC…we have situational awareness of what is going on in cyberspace, what's going on in the dot gov domain through programs like EINSTEIN and the federal dashboard, and through liaisons who sit on the NCCIC floor to share information when something happens," Travis said. "There's nothing trivial about ransomware attacks or other types of attacks…but some of them are not going to rise to the level of national critical functions."

The NRMC, Travis said, will be more geared toward tackling longer-term, systemic cyber threats that affect the public, private and critical infrastructure sectors. He pointed to issues like shoddy technology supply chain protocols and formulating long-term strategies for protecting the electrical grid and election infrastructure as examples of issues that will define the center's purview. The NRMC is currently developing a list of national critical functions.

While the NCCIC floor has made use of liaisons from the private sector, their participation is often limited to facilitating communication between their respective industry and government in the immediate wake of an attack. The NMRC will take that a step further, detailing analysts from different private and critical infrastructures with federal agency personnel using "whiteboards and advanced analytics" to map out solutions to longer-term problems.

"We're going to be taking analysts from the private sector, from those banks on Wall Street that are targets of these nation states, from electric companies that help maintain the power grid," Travis said. Those experts will then work with "our analysts at DHS or the Pentagon or [Department of Energy] or Treasury, sit in the same room, roll up our sleeves and... try to understand those interdependencies across sectors."

Scott Tousley, deputy director of the Cyber Security Division of the DHS Advanced Research Projects Agency, said U.S. organizations focus too much on addressing the pressing threats of the day at the expense of more niche or systemic issues that will leave them exposed down the line. Those are the problems the NRMC was created for.

"Think about a major organization," Tousey said. "You're fighting today's issue, today's challenge, today's hack, today's vulnerability risk, today's IG finding, but everything else that others are seeing…will come back to find you."

After the event, Travis told FCW that creating a distinct mission for the NRMC was easy. Without operational or regulatory powers, the challenge lies in figuring out ways to nudge industry and critical infrastructure towards better security practices without some of the traditional carrots and sticks that most agencies rely on. One way to make an impact is using that collaboration to identify gaps in legal or policy authorities to pass on to Congress.

"We don't have any [reorganization] authorities … but we do have the authorities to bring in private sector analysts, which we weren't really doing," he said. "That [process] is still being worked out but I think surely as we get into some of these issues like supply chain risk management, there may be authorities we think we need, or industry may say we think we need to do this and it will be a collaborative effort."