Securing the Department of Homeland Security Way

Homeland security was not a thing much on the minds of anyone prior to Sept. 11, 2001. That changed with the successful terrorist attacks and shined a rather large spotlight on an ever-growing threat through cyber channels.

In addition to creation of a new federal agency and cabinet position, this started an era where every Chief Information Security Officer and IT Security professional looked for new and more effective ways to prevent cybercrimes and/or damage to their IT infrastructures.

Who is the Department of Homeland Security?

The United States Department of Homeland Security (DHS) was created in response to the September 11 attacks via the Homeland Security Act on Nov. 25, 2002 and made a cabinet level position with the appointment of Tom Ridge as the first Secretary in January 2003.

The DHS was created specifically to address anti-terrorism, border security, immigration and customs, cybersecurity, and disaster prevention and management. According to the DHS’s website, this department’s mission is:

“to secure the nation from the many threats we face. This requires the dedication of more than 240,000 employees in jobs that range from aviation and border security to emergency response, from cybersecurity analyst to chemical facility inspector. Our duties are wide-ranging, and our goal is clear - keeping America safe.”

Fostering a more secure and reliable cyber ecosystem across the nation requires a dedicated strategy to meet the ever-changing threat landscape.

DHS Threat Reduction

The DHS developed a framework to execute on cybersecurity responsibilities in order to keep pace with the evolving cyber risk landscape by reducing vulnerabilities and building resilience. According to a Department of Homeland Security Cybersecurity Strategy brief, the seven goals of this initiative include:

1. Assess evolving cybersecurity risks: The primary focus here is to understand the evolving national cybersecurity risk posture to inform and prioritize risk management activities accordingly.
2. Protect federal government Information systems: The primary focus here is to reduce vulnerabilities of federal agencies to ensure they achieve an adequate level of cybersecurity across all IT infrastructure.
3. Protect critical infrastructure: The primary focus here is to partner with key stakeholders to ensure that national cybersecurity risks are adequately managed across all federal agencies and public infrastructures.
4. Prevent and disrupt criminal use of cyberspace: The primary focus here is to reduce cyber threats by countering transnational criminal organizations and sophisticated cyber criminals.
5. Respond effectively to cyber incidents: The primary focus here is to minimize consequences from potentially significant cyber incidents through coordinated community-wide response efforts.
6. Strengthen the security and reliability of the cyber ecosystem: The primary focus here is to support policies and activities that enable improved global cybersecurity risk management.
7. Improve management of DHS cybersecurity activities: The primary focus here is to execute DHS departmental cybersecurity efforts in an integrated and prioritized way.

While these goals are specific to DHS, they are also a great model for what individual security teams should adopt to ensure their own protection.

Reducing Cyber Threats

The core to success in adopting variations of these seven goals is the reduction of cyber threats. Today’s CISO sets the strategy for technology selection and these technologies must evaluate every line of code, making well-documented evasion techniques ineffective.

Effective solutions should be agnostic to file type, client-side application type, or the client operating system used within the organization. It should provide protection regardless of operating system, CPU architecture and function (client, server) of the targeted machine.

Strengthen your cyber defenses dramatically by preventing attacks before they enter and harm your organization, your customers and your brand. Remediation is costly, prevention is not. Learn more here.