Risk
4/27/2010
01:11 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

CIA Boosting Cybersecurity Investment

Preventing and fighting cyber threats is one of three priorities in the agency's five-year plan.

The CIA has made investing in technology to prevent and fight cyber threats as one of its three main priorities in a five-year strategic plan unveiled this week.

The move is in line with a government-wide ramp-up in cybersecurity efforts across all agencies that have responsibility for protecting critical infrastructure in the United States, such as the Department of Homeland Security and the National Security Agency.

CIA 2015, released this week, is a three-pillar blueprint for the agency's next five years. The goal of the plan is to ensure that the agency remains in step with current national security challenges, such as cyber threats and so-called "dangerous technology," according to a press statement.

Indeed, industry experts agree that the threat of cyber attacks on the U.S. is on the rise, and a recent survey found that a majority of federal CIOs believe a major attack is imminent.

The federal government so far has been relatively lax on addressing the threat with policy -- no major cybersecurity legislation is yet in place -- but individual agencies are taking their own steps to invest more in cybersecurity.

In addition to helping increase security in what the agency calls a "rapidly changing global information environment," new technology investments also will extend the CIA's operational and analytic reach and help it become more efficient, the agency said.

Managing the large volume of intelligence data CIA officers and agents must deal with on a day-to-day basis will also be a priority, and the agency plans to purchase and deploy new software for data management, it said.

The other two pillars of CIA 2015 call for the agency to invest in a more highly trained, multilingual staff at home and abroad and to achieve business agility to better maintain a global presence and be better prepared for emergencies. The latter will include a transformation of global support platforms and a consolidation of some business activities, the agency said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web