recommended reading

Who Receives Hacker Threat Info From DHS?

Jeff Gentner/AP File Photo

Health care, banking and other key sectors at risk of cyberattacks have not joined a Department of Homeland Security program required to offer these industries protections against a potential catastrophic hack, according to federal inspectors.

President Obama ordered in early 2013 that DHS expand an information-sharing program once restricted to Pentagon contractors to the 16 so-called critical infrastructure industries.

The Enhanced Cybersecurity Services program feeds confidential alerts about the digital hallmarks, or "indicators," of threats so companies and their Internet service providers can load them into network-protection systems. The sometimes-classified information is culled from National Security Agency intelligence and other government agencies. 

Obama issued the executive order after Congress failed to pass cybersecurity legislation.

Only three of the 16 industries -- energy, communications services and the defense industrial base – are part of the program, according to a DHS inspector general report released Monday. And just two ISPs, termed "communications service providers" or CSPs, are authorized to receive and load the indicators. The pair, CenturyLink and AT&T, has been the only approved ISPs since the program’s launch.

When asked if he had heard of the program, Scott Jensen, communications director for the American Chemistry Council, which represents the chemical sector, told Nextgov, “We're not familiar with the specific program you mentioned, but there are other ways that DHS communicates with our industry regarding cyber threats.”

DHS does not directly communicate with companies to promote the program, relying instead on CenturyLink and AT&T to advertise their services to businesses, according to the report, which is dated July 29. Companies must pay for equipment and expertise from one of the ISPs or use their own in-house security specialists. The government information is free. 

Such information includes, for example, suspicious IP addresses, domains, email headers, and files.

Energy, Defense and Communications Sectors Are In

About 40 companies from the energy, defense and communications sectors are participating right now. DHS officials say they have signed memorandums of agreement with another 22 interested in joining.

A chicken-and-egg problem is partially responsible for the slow rollout.

The "program should include all 16 critical infrastructure sectors by increasing the number of operational CSPs," writes Richard Harsche, acting assistant IG for information technology audits.

But CSPs might not have a financial incentive to operate, until more critical sectors enroll.

"Without improving communication and outreach to increase critical infrastructure sector entities’ interest, CSPs may not have the financial means or incentive to participate in the [cyber] program due to the lack of new critical infrastructure entity customers,” Harsche said.

Most corporate technology workers and company facilities do not have the proper security clearances and secure equipment to handle the government data. And DHS has only finished validating one additional ISP, the report states. The entire vetting process for ISPs can take eight months.

"Enrollment in the [Enhanced Cybersecurity Services] program has been slow because of limited communication and outreach and a necessary in-depth security validation and accreditation process for potential program participants,” Harsche said.

Who Wants to Buy Free Information?

The inspector general also found the hacker information is not always unique. DHS distributes about 60 threat hallmarks a week, but some of them were redundant and a "majority of the information provided was unclassified and available through other sources," he said. 

Typically, the data exchange works as follows: DHS transmits threat indicators to the cleared ISPs and specially equipped critical companies about three times a week. The alerts include directions to scan emails for the indicators, such as malicious attachments, and quarantine flagged messages, so they do not reach employee inboxes.

Some sectors have their own industry-specific cyber programs and don’t want to pay communications providers to receive similar information. Many banks, for instance, rely on the Financial Services Information Sharing and Analysis Center, for cyber warnings and receive alerts from the Treasury Department, a financial services industry leader told Nextgov.

Obtaining clearances and building secure communications space to receive the DHS alerts is not an option for many financial institutions. And some of them already spend $250 million a year on network security, Treasury Secretary Jack Lew said last month.

The financial services advocate said the FS-ISAC is among the best sources of information and commended Lew’s work on safeguarding the sector’s networks.

Lew announced last month the creation of a cyber information sharing and analysis unit within Treasury that delivers network protection instructions to financial companies.

In response to a draft report, DHS officials said in a July 2 letter they are working to enlarge the program and improve the quality of the information provided.

The department will boost the number of cyber experts who vet ISPs using fiscal 2014 and 2015 job openings. Homeland Security also expects to award a contract for security engineering services by December, to further expedite enrollment.

"These measures will significantly increase the number of assessment activities that can be accomplished at one time, resulting in the timely completion of the security validation and accreditation processes," wrote Andy Ozment, assistant secretary for the DHS Office of Cybersecurity and Communications.  

By October, DHS plans to have an outreach strategy for publicizing program benefits to critical industry companies. The strategy will highlight "the value of the sensitive and classified federal government data" and authorized ISP services, Ozment said. 

On Monday, DHS officials said their program is meant to play a supporting role to cyber tools that firms already are using.

The program “is a voluntary initiative intended to augment, not replace, existing security services operated by or available to critical infrastructure companies,” DHS spokesman S.Y. Lee said in an email. It “automates the use of cyber threat indicators – up to and including classified information – by commercial service providers to assist participating critical infrastructure companies in their cyber protection efforts.”

Threatwatch Alert

Software vulnerability

Malware Has a New Hiding Place: Subtitles

See threatwatch report


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.