CybersecurityProposed bill would formalize DHS role in securing government networks
The hacking of the federal Office of Personnel Management (OPM), which resulted in the theft of records of twenty-two million federal employees and their families, has prompted a Senate response. A bipartisan group of U.S. senators has introduced a bill on the heels of that event, updating the original Federal Information Security Management Act (FISMA) and formalizing the role of DHS in securing government networks and Web sites.
The hacking of the federal Office of Personnel Management (OPM), which resulted in the theft of records of twenty-two million federal employees and their families, has prompted a Senate response. The pilfered data included notes, forms, and interview results pertaining to the background investigations conducted for security clearances. Most of this material is highly sensitive, and was obtained with the assurance the information would be kept confidential.
According to The Hill, a bipartisan group of U.S. senators has introduced a bill on the heels of that event. The bill, updating the original Federal Information Security Management Act (FISMA), and is titled FISMA Reform Act, is a legislative move to formalize the role of the Department of Homeland Security (DHS) in securing government networks and Web sites.
The revision of the 12-year-old FISMA would clear some of the obstacles preventing the DHS from inspecting other agencies’ networks and hardening them against hackers. Currently, DHS must obtain permission to evaluate or monitor networks, and legal impediments have also hindered the agency’s function.
Over time, DHS has taken on the role of security manager, as much as agency and department heads allow. The Hill quotes Senator Mark Warner (D-Virginia) as saying, “This is all done on a voluntary basis. And every agency has got their reason why they, in particular, can’t comply. This voluntary system has resulted in an inconsistent patchwork of security across the whole federal government.”
Senator Warner and Senator Susan Collins (R-Maine) take lead sponsorship, with Senators Claire McCaskill (D-Missouti), Barbara Mikulski (D-Maryland), Dan Coats (R-Indiana), and Kelly Ayotte (R-New Hampshire) completing the group.
The OPM breach has thrust into the spotlight the torpid reaction to digital theft and the rising threat of domestic and foreign hackers.
DHS administers Einstein, software designed to find and remove known digital threats. The DHS also oversees the Continuous Diagnostics and Mitigation (CDM) program, which searches for malicious agents once they’ve already breached the networks.
Einstein (also known as the EINSTEIN Program) is software which monitors the network gateways of government agenciesfor unauthorized traffic. The software is an intrusion detection system, monitoring the network gateways of government departments and agencies to sense anomalies in the network traffic. The software was developed by the United States Computer Readiness Team (US-CERT), the operational arm of the National Computer Security Division (NCSD) of DHS. The program was originally developed to provide “situational awareness” of network traffic. Later, an expanded version was implimented, adding to the original program by the additional capability of examining content as well as traffic.
The FISMA Reform Act attempts to formalize DHS responsibility by giving the department legal authority to deploy tools which search for intrusions on government networks at any agency, without a formal request. It is a power which the National Security Agency (NSA) already has in its mandate to protect the military’s digital domain.
