Feeds

Securing cyberspace against war, terror and red tape

DHS's Greg Garcia in the hot seat

Combat fraud and increase customer satisfaction

You mentioned the important thing being protecting ourselves against an attack wherever it may come from and whoever may be behind it. Are offensive cyber attacks, sort of counter DDoSes, counter unleashing of malware - are those things included in the way DHS should go about protecting the country?

Our mission is protective, so we're protecting the homeland, we're protecting our networks. You've seen articles recently where the Air Force cyber command is talking about stepping up its offensive capabilities. DOD is really the most active in that area, but DHS we're protective.

If you see a botnet attacking important infrastructure, is taking that botnet out or attacking it one way of protecting ourselves?

There are some things we don't want to talk about in open forums, but we do partner with various agencies across the government who have different equities in cyber security, different activities in cyber security and we work together to help each other, particularly making sure that DHS knows what's coming into federal networks so we can take protective actions.

There's been some discussion about how to deal with radical jihadi groups that are online and websites that perhaps are spreading jihadi propaganda. One idea is shut them down and another idea is don't shut them down [but rather] study them, monitor them. Shutting them down only drives them underground and then you don't know what the enemy is thinking or doing. Where do you stand on that?

DHS's mission is about protecting our networks. We're not engaged in shutting down other networks. That's the purview of other agencies.

Does DHS consider the monitoring of groups like that part of its purview, in gathering intelligence and knowing if people are thinking about attacking or doing other things like that?

DHS is not an intelligence gatherer, so the effort that we have in the cyber initiative is helping federal agencies monitor what's going in and out of their own networks. We're not monitoring or gathering intelligence.

There has been a lot of evidence that attacks on national labs are using very sophisticated spear phishing. Is this something that's within DHS's purview to try to prevent, and if so what exactly are you doing?

The US CERT is the focal point for the information sharing about attacks. Last year US Cert received 37,000 incident reports, which is about a 55 per cent increase over FY 07 and most of those were phishing attacks just as you described. So it's our ability to receive that information, watch what's happening across federal networks using our Einstein intrusion detection capabilities and correlating, seeing what the patterns are.

As to that collection of anomalous traffic across networks that we're able to push the information back out to our to our federal agencies, to our state governments and to our private sector saying this is what we're seeing. Most recently, last fall, we were able to communicate through notices to our partners a variety of IP addresses that they need to be watching out for for that kind of attack. This is the primary role of the US CERT, which is to both receive information from all sources about what's happening on our networks, analyze it, synthesize it, correlate it, and then push it back out again in actionable formats that people can actually take action and say, OK got it, I'm going to plug this port and apply this patch. That's our value add.

SANS - Survey on application security programs

More from The Register

next story
EU: Let's cost financial traders $400m a day, because EVIL BANKERS. Right?
Wait 'til this one hits your pension fund where it hurts
Systems meltdown plunges US immigration courts into pen-and-paper stone age
Massive outage could last four weeks, sources claim
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
UK.gov chucks £28m at F1 tech for buses and diggers plan
Well, not really F1 but who's heard of LMP and VLN*?
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.