12:32 PM
Connect Directly

DHS Secretary Asserts Cybersecurity Leadership

Cybersecurity should be led by the Department of Homeland Security and not left to the market or the military, Janet Napolitano said.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
Cybersecurity should be left neither to the free market nor to the military to solve, Department of Homeland Security (DHS) secretary Janet Napolitano said in a speech in Washington, D.C., last week as she reasserted her agency's role as the locus of cybersecurity authority in the federal government.

"Cyberspace is fundamentally a civilian space," Napolitano said. "There are some who say cybersecurity should be left to the market, and there are some who characterize the Internet as a battlefield. Both the market and the battlefield analogies are the wrong ones to use. We should be talking about this as, fundamentally, a civilian space and a civilian benefit that employs partnerships with the private sector and across the globe."

The DHS has taken the lead in the federal government on cybersecurity measures via its National Cyber Security Division. That group this year headed up a major international and inter-governmental cyber exercise, Cyber Storm III, and continued ramping up efforts to protect federal systems and critical infrastructure like power plants.

Napolitano has been an ardent supporter of DHS' leadership role, but while she implied a DHS-centered view of cybersecurity, she did admit that DHS can't do it alone. "It is our goal to build one of the very best teams that we can to tackle the cybersecurity challenge," she added. "No single industry or agency, quite frankly, can manage it. Cybersecurity is about effective partnerships and shared security."

This year, DHS has expanded partnerships with private industry, for example doing a substantial amount of investigative work on the Stuxnet worm that infiltrated power plant control systems earlier this year and working to build up liaisons with private sector industries it deems to be "critical."

DHS has also improved its partnerships with military and military intelligence this year. In October, DHS and the Department of Defense signed a cybersecurity pact to improve collaboration between the agencies and boost DHS' encryption and decryption capabilities by comingling National Security Agency (NSA) cryptologic analysts and DHS cybersecurity leadership in a move that signaled progress in a sometimes uneasy relationship with the military.

"We're working very closely along and across the federal family, particularly having worked out really the thorny issues involving how the NSA is to be used in a civilian context for protection and prevention, as well as in a military context," Napolitano said last week.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.