Mr. Eric Goldstein, the Executive Assistant Director for Cybersecurity for the Cybersecurity and Infrastructure Security Agency (CISA) at DHS, emphasized his organization’s drive to assist government and private sector entities more proactively in reducing their cyber risks during a spirited conversation with Dr. Matthew McFadden, Vice President of Cyber for General Dynamics Information Technology (GDIT) at a 10 March Billington Fireside virtual event. McFadden’s excellent questions and Goldstein’s obvious enthusiasm helped articulate CISA’s primary goal of moving away from simply being an incident response group to one providing more preventative cybersecurity measures to both the public and private sectors.
When asked to identify key CISA priorities, Goldstein clearly highlighted two key CISA efforts. First, he emphasized CISA’s continued goal to provide a one-stop shop for every organization to get what they need for better defense, highlighting CISA’s Shields Up webpage (https://www.cisa.gov/shields-up) and their efforts to provide free cyber security services to “target rich, but resource poor” organizations. Second, he highlighted the organization’s increasing commitment to broadening their engagement efforts with the cyber community—both inside and outside of the Federal Government—to include actively producing more threat summaries, increasing the number of CISA operators working side by side with US companies, increasing the number and quality of proactive planning exercises (like the recent Cyber Storm exercise—see the results on their 8th and most recent exercise on CISA’s webpage), and increasing efforts to help software developers bake in cyber security from the start.
Goldstein also emphasized CISA’ continued and growing role in helping the Federal Government move towards implementing a Zero Trust framework. The organization has worked to help Federal Agencies better understand the components of the networks that they manage and to set realistic benchmarks to move them forward in continuously monitoring what they have. He pointed towards CISA’s role in helping to draft the Zero Trust Maturity Model and their efforts to garner feedback from the entire cyber community to ensure understanding and transparency in getting it right. He also reemphasized CISA’s expert service provider role in assisting other federal agencies in improving their cyber security as well as CISA’s growing role in incident response and continual monitoring.
Goldstein pointed out CISA’s growing role in assisting other DHS components to help meet Secretary Mayorkas’ aggressive cyber program throughout the department (for more details on this, please see the multiple articles that emerged from last year’s Mayorkas opening of the Billington Cybersecurity Conference). This is most prevalent in the critical infrastructure and transportation worlds particularly as the threats emanating out of the Ukrainian conflict are pointing out. He was keen to point out the power of integrating the Department’s deep expertise across multiple business sectors and leveraging its multiple authorities to more effectively elevate its game to enhance security. Key to this effort were the Department’s use of “cyber sprints:” quick strike expert groups designed to focus on identifying and driving key security initiatives working with the private sector.
McFadden was keen to also ask Goldstein about CISA future priorities. He highlighted that one clear CISA goal was to improve their visibility across the entire US spectrum to gain a better understanding of what adversaries were doing and how, and quickly building an environment where they can share this understanding with the entire cyber eco-system to help mitigate these threats. This effort included better cyber incident reporting efforts; legislation that was baked into the new federal budget signed by Biden in mid-March. This effort also included elevating a better cyber risk understanding beyond organization’s CISO and CIO worlds to their Board Rooms and Front Office Suites. Goldstein pointed out that more informed resource and business ethos decisions can also have an incredible effect on improving cybersecurity within an organization’s eco-system.
Overall, the conversation provided a useful overview of where CISA is, what they want to be, and identifying the steps they are taking to getting there.