Risk
12/20/2010
12:32 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

DHS Secretary Asserts Cybersecurity Leadership

Cybersecurity should be led by the Department of Homeland Security and not left to the market or the military, Janet Napolitano said.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
Cybersecurity should be left neither to the free market nor to the military to solve, Department of Homeland Security (DHS) secretary Janet Napolitano said in a speech in Washington, D.C., last week as she reasserted her agency's role as the locus of cybersecurity authority in the federal government.

"Cyberspace is fundamentally a civilian space," Napolitano said. "There are some who say cybersecurity should be left to the market, and there are some who characterize the Internet as a battlefield. Both the market and the battlefield analogies are the wrong ones to use. We should be talking about this as, fundamentally, a civilian space and a civilian benefit that employs partnerships with the private sector and across the globe."

The DHS has taken the lead in the federal government on cybersecurity measures via its National Cyber Security Division. That group this year headed up a major international and inter-governmental cyber exercise, Cyber Storm III, and continued ramping up efforts to protect federal systems and critical infrastructure like power plants.

Napolitano has been an ardent supporter of DHS' leadership role, but while she implied a DHS-centered view of cybersecurity, she did admit that DHS can't do it alone. "It is our goal to build one of the very best teams that we can to tackle the cybersecurity challenge," she added. "No single industry or agency, quite frankly, can manage it. Cybersecurity is about effective partnerships and shared security."

This year, DHS has expanded partnerships with private industry, for example doing a substantial amount of investigative work on the Stuxnet worm that infiltrated power plant control systems earlier this year and working to build up liaisons with private sector industries it deems to be "critical."

DHS has also improved its partnerships with military and military intelligence this year. In October, DHS and the Department of Defense signed a cybersecurity pact to improve collaboration between the agencies and boost DHS' encryption and decryption capabilities by comingling National Security Agency (NSA) cryptologic analysts and DHS cybersecurity leadership in a move that signaled progress in a sometimes uneasy relationship with the military.

"We're working very closely along and across the federal family, particularly having worked out really the thorny issues involving how the NSA is to be used in a civilian context for protection and prevention, as well as in a military context," Napolitano said last week.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0121
Published: 2015-05-30
IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation (RDNG) 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management (RM) session upon LTPA token ...

CVE-2015-0191
Published: 2015-05-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0191. Reason: This candidate is a duplicate of CVE-2014-0191. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-0191 instead of this candidate. All references and descriptions in this candid...

CVE-2015-0193
Published: 2015-05-30
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0733
Published: 2015-05-30
CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID ...

CVE-2015-0743
Published: 2015-05-30
Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?