The challenges of collective cyber defense

The recently released national cybersecurity strategy recognizes that robust collaboration is needed across the federal government, and between the public and private sectors, to secure cyberspace.

However, collective defense is complex and nuanced.

Currently, federal civilian executive branch agencies are responsible for managing and securing their own information technology and operational technology systems. With different agency structures, missions, capabilities and resourcing, cybersecurity outcomes can vary, the strategy notes.

To address those challenges, the Office of Management and Budget, in coordination with the Homeland Security Department's Cybersecurity and Infrastructure Security Agency, will develop a plan to secure civilian agency systems "through collective operational defense, expanded availability of centralized shared services, and software supply chain risk mitigation."

This approach marks a shift towards a more focused and targeted defensive posture, and in theory could lead to greater security and budgetary savings. However, this approach also contains several challenges for the agencies and missions that are part of this "collective defense."  

The government ran into heavy headwinds when the Defense Information Systems Agency attempted to deploy the Joint Regional Security Stacks. JRSS was initially established in 2013 to shrink the cyberattack surface by consolidating innumerable entry points around the world to 25 sites. However, the program faced multiple setbacks, experiencing operational and technical problems. JRSS is now being phased out as the DoD implements Thunderdome, one of the components enabling the Defense Department's zero trust strategy.

Overcoming operational and technological headwinds in a future civilian collective defense will take a high level of inter-agency collaboration. OMB and CISA can draw on lessons learned from the JRSS deployment. Moreover, they can glean insights derived from CISA's Joint Cyber Defense Collaborative. JCDC leads development and implementation of joint cyber defense plans and operations with partners from the private sector, the federal government, as well as state, local, tribal, and territorial governments. For instance, CISA's partnerships within the JCDC have built true operational collaboration because agencies and the private sector better understand and manage the threat posed by Log4Shell and related vulnerabilities.

Harmonize reporting requirements

The harmonization of reporting and cyber hygiene standards across critical infrastructure centers is another aspect of the strategy that will be extremely challenging. The lack of a standard set of tools, telemetry, and reporting requirements across the various centers of critical infrastructure, makes reporting in a standardized way difficult. 

CISA has done an excellent job of laying the foundations for civilian agencies that are using the Continuous Diagnostics and Mitigation Program's dashboard. The CDM Dashboard Ecosystem is a collection of complementary tools and services that agencies can use to better understand, prioritize, and mitigate cyber risks. The dashboard collects and displays information gathered from sensors and tools for each participating agency.

CISA has given agencies guidance on the types of incidents that should be reported to CISA.

• Unauthorized access to your system
• Denial of Service attacks that last more than 12 hours
• Malicious code on your systems, including variants if known
• Targeted and repeated scans against services on your systems
• Repeated attempts to gain unauthorized access to your system
• Email or mobile messages associated with phishing attempts or successes 
• Ransomware against critical infrastructure, including variant and ransom details if known

The CDM Dashboard could help provide standardized reporting in each of the critical infrastructure sectors, such as Communications, the Defense Industrial Base, Energy, and Transportation, as well as others. This reporting must cross traditional IT, internet of things, operational technology  and other networks. 

The federal government must work with private industry to understand the foundational reporting requirements of each sector by gathering and assessing what critical data is needed. Then they must collaborate to harmonize that data, and to report on critical infrastructure as a whole.

The baseline for this is already in place with the CDM Dashboard.

CISA officials will have to decide whether it is more feasible to create a compliance and reporting dashboard for the critical infrastructure community, or leverage the current CDM Dashboard.

As the strategy states, deep and enduring collaboration between all stakeholders across the nation's digital ecosystem "will be the foundation upon which we make it more inherently defensible, resilient, and aligned with U.S. values."