| Top nominees for President Biden's Department of Homeland Security vowed to prioritize protecting critical infrastructure after SolarWinds and Colonial Pipeline cyberattacks. The confirmation hearing for Biden's picks for the department's deputy secretary, general counsel and undersecretary for strategy, policy and plans — John Tien, Jonathan Meyer and Robert Silvers, respectively — came just weeks after a ransomware attack aimed at a major U.S. pipeline. The emphasis on cybersecurity was a marked difference for senators, which asked those nominees' predecessors cybersecurity-related questions only in passing during their confirmation hearings for the Trump administration. By contrast, cyber issues were mentioned dozens of times at Thursday's hearing, with a handful of lawmakers asking cybersecurity-related questions that touched on recent cyberattacks, including a breach of SolarWinds software affecting at least nine federal agencies, as well as the recent breach of Colonial Pipeline. "Recent incidents from SolarWinds to Colonial Pipeline have only further highlighted the urgency to secure critical infrastructure and federal networks from cyber attacks," Silvers said. "If confirmed, I will focus closely on fortifying DHS efforts on this critical work." Several cybersecurity-related agencies lie within DHS, including the Cybersecurity and Infrastructure Security Agency, or CISA, the U.S. government's top civilian cybersecurity agency; the Transportation Security Agency, or TSA, which oversees pipeline security; and the Secret Service, which conducts some cybersecurity investigations. Silvers also said he envisions the office he'd lead as the hub within the department that would coordinate the department's approach to cybersecurity across those agencies. DHS's cyber mission is expanding as it responds to 21st century threats. "The threats facing our nation today are very different from those that we faced when the department was created in the aftermath of the 9/11 terrorist attacks," said Senate Homeland Security and Governmental Affairs Committee Chairman Gary Peters (D-Mich.). "However, DHS's mission remains the same — that's to safeguard the American people." With the Colonial Pipeline breach, Silvers said, everyone saw "the devastating and cascading effects that a cyberattack even just on a single organization can have and the impacts that can be felt downstream by many innocent parties." The department has changed its cyber posture as recently as this week, when the TSA issued a new cybersecurity directive for pipelines being pitched as the "first step" in preventing such a pipeline cyberattack from happening again. The mandatory cybersecurity requirements would require pipeline companies to notify CISA within 12 hours of a breach. The directive's utilization of the best of both worlds — the TSA's ability to regulate pipelines and CISA's cybersecurity expertise — is "extremely promising," Silvers said. Initial priorities, he said, "certainly include enhancing the department's work to elevate the cybersecurity of federal civilian agencies," noting the sophistication of the SolarWinds cyberattack, which leveraged vulnerabilities in the software. And a recently issued executive order aiming to strengthen federal cybersecurity furthers, according to Silvers, will "strongly bolster the ability to do that critical work." DHS Secretary Alejandro Mayorkas, meanwhile, has said that elevating CISA and cyber issues is a priority. Mayorkas formed a ransomware task force as part of what he's calling a 60-day sprint to combat the scourge of hacks-for-ransom. The next sprint will focus on the cybersecurity workforce, Mayorkas said. Responding to Sen. Jacky Rosen (D-Nev.), who has introduced a bill to boost the workforce by building a cybersecurity reserve corps, Silvers called the shortage of cybersecurity professionals a "national security issue." He added that he'd work with Congress to form "pipelines of cyber talent" that could help DHS and the private sector. | Share The Cybersecurity 202 |  |  |  | | | 
Email 
No comments:
Post a Comment