From: HSToday.us

By: Mickey McCarter

As many cyberattacks occur just as easily across international borders as they do domestically, the Department of Homeland Security (DHS) must work with international partners to fully safeguard cyberspace.

But the DHS directorate charged with supporting cybersecurity goals could do more to strengthen and streamline its international activities, advised the DHS inspector general (IG) in a report Friday.

The White House produced an International Strategy for Cyberspace in May 2011 and DHS developed the Blueprint for a Secure Cyber Future: The Cybersecurity Strategy for the Homeland Security Enterprise as a result in November 2011. But the DHS blueprint does not specify roles and responsibilities for the National Protection and Programs Directorate (NPPD), the DHS division managing the department’s cybersecurity missions, noted the IG report, DHS Can Strengthen Its International Cybersecurity Programs.

As such, NPPD operates without an overall plan to guide its international cybersecurity activities, the IG report said.

“While continuing to build upon existing partnerships, NPPD’s Office of Cybersecurity and Communications (CS&C) needs to establish and implement a plan and goals to further its international affairs program with other countries, international industry and the private sector to protect global cyberspace and critical infrastructure,” the report recommended. “For more efficient and effective operations, NPPD should streamline its international affairs functions to better coordinate foreign relations and consolidate resources. Finally, the United States Computer Emergency Readiness Team (US-CERT) needs to strengthen its communications and information-sharing activities with and among its counterparts to promote international incident response and the sharing of best practices.”

As of the end of last year, NPPD had been working on a draft DHS Implementation of the President’s Strategy, but it remained incomplete as of the IG audit. The IG faulted, in part, “constant management turnover” at CS&C as an obstacle to completing the plan, noting that roughly half a dozen top NPPD officials left DHS within the past 10 months alone.

NPPD Undersecretary Rand Beers agreed with the IG recommendations to finish a strategic plan and to streamline NPPD international affairs activities. He further acknowledged US-CERT must dedicate sufficient resources to maintaining and building international relationships.

Moreover, NPPD will develop and implement policies and procedures for open dialogue with international partners on cyberthreats and vulnerabilities, Beers vowed, as well as assess information-sharing efforts for gaps.

In a written response to the report, however, Beers did not specify timeframes for when NPPD would complete these tasks.

Beers objected to shortcomings in the IG survey of CS&C’s international activities, citing examples of who his directorate does more than acknowledged in the IG report.

“However, NPPD/CS&C is concerned that the report does not provide sufficient context for readers to fully appreciate NPPD’s international cybersecurity mission and activities,” Beers stated.

He added, “NPPD activities cited in the report are not fully representative of the breadth of NPPD’s international cybersecurity activities. For example, CS&C contributes to international cybersecurity policy development as part of a broader US government effort.

“Officials within CS&C’s Research and Standards Integration Program and the Software Assurance Program participate in international standards bodies to drive the adoption of cybersecurity standards that benefit the United States and its international partners. Similarly, the Control Systems Security Program collaborates with foreign countries and international organizations to improve the security of industrial control systems,” he said.

The NPPD participates in “international cyberexercises, capacity-building workshops and multilateral and bilateral engagements” as well as information sharing of cyberdata with other nations, the IG report said.