Who’s in Charge When US Suffers A Cyberattack?

One of the Pentagon’s key missions is to lend a hand—or a drone—during natural disasters or other domestic emergencies. But it is unclear, in the event of a massive data breach, which element of the Defense Department is in charge of military support, according to Congress’ watchdog agency.

In other words: When there is an Ebola virus epidemic, for example, the assistant secretary of defense for health affairs steps in to help the civilian government. But it’s not clear what military official should organize forces when there is, for instance, a hospital computer virus unleashed by Iran.

US Northern Command says it is the main Pentagon support arm that fends off foreign hackers in the United States, a position at odds with policies and some top brass who say Cyber Command plays the lead in addressing stateside cyberthreats from abroad when asked.

Joseph W. Kirschbaum, Government Accountability Office director for defense capabilities and management, warned that until the Pentagon “clarifies the roles and responsibilities of its components,” the military “may not be positioned to effectively employ its forces and capabilities to support civil authorities in a cyber incident.”

In recent years, CYBERCOM and National Security Agency resources have been deployed to deal with privacy breaches at the Office of Personnel Management perpetrated by Chinese hackers, as well as a destructive attack against Sony Pictures Entertainment allegedly orchestrated by North Korea.
 
“DOD officials stated that the department had not yet determined the approach it would take to support a civil authority in a cyber incident and, as of January 2016, DOD had not begun efforts to issue or update guidance and did not have an estimate on when the guidance will be finalized,” Kirschbaum said.

The Pentagon is required by law to develop a plan by next month for CYBERCOM to support civil authorities in the event of a nation-state cyber strike.

But a NORTHCOM concept plan, which is already Defense secretary-approved, states its commander would coordinate a civilian mission that “may include cyber domain incidents or activities — with other DOD components supporting in conducting the missions,” Kirschbaum said in an audit made public recently.

At the same time, other guidance directs Cyber Command to be responsible for supporting civil authorities during a cyber incident, the report noted.

Specifically, Robert Salesses, a deputy assistant secretary for homeland defense integration, testified in June 2015 CYBERCOM would oversee cyber incident troubleshooting. Likewise, a 2010 formal agreement between DOD and Homeland Security Department names CYBERCOM as the Pentagon component that would respond to a civilian network disaster.
 
For its part, Cyber Command says the Defense secretary likely would call on CYBERCOM, not NORTHCOM, to provide help during a civilian cyber emergency.

Northern Command told a different story. As of September 2015, NORTHCOM officials said, “Their command had not delegated this responsibility to another command.”

Meanwhile, Pacific Command officials told GAO it would take center stage responding to a cyber incident within its area of responsibility with CYBERCOM playing a supporting role, Kirschbaum said. The reasons for the discrepancies in roles and duties are due to the recent emergence of the Cyberthreat, according to the report.

NORTHCOM officials said Defense so far has never received a request for assistance from DHS or any lead federal agency for military support, under a civil authority, for a cyber incident. An official within the office of the deputy assistant secretary for cyber policy said the military “expects to receive more requests to support civil authorities in cyber incidents and acknowledged the need to clarify roles and responsibilities in advance of any requests given the growing focus on cybersecurity,” the audit states.

In reaction to a draft audit, the Pentagon on March 14 said it will spell out the officials and components that will aid, as needed, in the event of a U.S. cyber episode.

Defense will release or update guidelines “that clarify DOD roles and responsibilities regarding civil support for domestic cyber incidents,” said a response sent by Aaron Hughes, deputy assistant secretary for cyber policy.

DefenseOne: http://bit.ly/1Wn5umb

« FBI Says A Mysterious Hacking Group Has Had Access To US Government Networks For Years
Boardroom: Elevating Cybersecurity Discussions »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CERT.AZ

CERT.AZ

The national Cyber Security Center of the Republic of Azerbaijan.

National Cybersecurity and Communications Integration Center (NCCIC)

National Cybersecurity and Communications Integration Center (NCCIC)

NCCIC is a cyber situational awareness, incident response, and management center for the US Government, intelligence community, and law enforcement.

Kapalya

Kapalya

Kapalya empowers businesses and their employees to securely store sensitive files at-rest and in-transit across multiple platforms through a user-friendly desktop and mobile application.

Taoglas

Taoglas

Taoglas Next Gen IoT Edge software provides a pay as you go platform for customers to connect, manage and maintain their edge devices in an efficient and secure way.

Critical Insight

Critical Insight

Critical Insight provide Managed Detection and Response, Vulnerability Detection, and Consulting Services to help you secure your mission-critical systems.

Cybersecurity Innovation Hub

Cybersecurity Innovation Hub

Cybersecurity Innovation Hub is a non-profit network organization focused on cooperation, information sharing, research and implementation of cutting-edge technologies in cybersecurity.

CyberCube

CyberCube

CyberCube provide world-leading cyber risk analytics for the cyber insurance market.

BlackRidge Technology

BlackRidge Technology

BlackRidge Technology develops, markets and supports a family of products that provide a next generation cyber security solution for protecting enterprise networks and cloud services.

SafeTech Informatics & Consulting

SafeTech Informatics & Consulting

Safetech's OTShield detects, prevents and analyses cyber-attacks in SCADA and Industrial IoT systems by utilising state of the art deception techniques.

Sygnia

Sygnia

Sygnia is a cyber technology and services company, providing high-end consulting and incident response support for organizations worldwide.

Kalima Systems

Kalima Systems

Kalima’s mission is to securely collect, transport, store and share Industrial IoT (IIoT) trusted data in real time with devices, services and mobile workers.

KT Secure

KT Secure

KTSecure’s mission is to provide proven and productive cyber security solutions and managed services, backed by our highly qualified and passionate team of experts.

Tryaq

Tryaq

Tryaq are a group of cybersecurity experts and enthusiasts who share the mission to make the world feel safer online.

CyFlare

CyFlare

CyFlare’s security platform integrates your tools with ours – delivering true positives, automated remediation, and interactive analytics built for security management teams.

Francisco Partners

Francisco Partners

Francisco Partners provide capital, expertise, and support for growth-aspiring technology companies.

Amnet Technology Solutions (Amnet Systems)

Amnet Technology Solutions (Amnet Systems)

Amnet Systems is a technology services organization that provides Managed IT, Cloud Computing, Cyber Security, Data Center and Audio Visual services since 1995.