Department of Energy FY 2012 Congressional ... - The FIRE Place

Detailed Justification
(dollars in thousands)
FY 2010
Actual
Approp
FY 2011
Request
FY 2012
Request
Infrastructure Program 99,838 97,849 107,618
The infrastructure program supports the cyber security operations and activities at NNSA M&O
sites. The cyber security operations and infrastructure program is built around a defense-in-depth
approach for achieving cyber security in a highly networked environment. The defense-in-depth
approach is a combination of known best practices and cost strategy that relies on the intelligent
application of techniques and technologies which exist today. The defense-in-depth approach
consists of three major components: people, processes and technology. This approach
recommends a balance between the protection capability and cost, performance, and operational
considerations. The implementation of this approach will enable maintenance of a cyber security
posture that complies with all DOE and NNSA policies and processes, while addressing the
increasing number and complexity of cyber security threats, vulnerabilities and risks.
For FY 2012, the request will provide for the implementation of enhanced cyber security
capability, daily operations, cyber security infrastructure, and risk management as outlined under
the newly implemented risk management approach for cyber security. During FY 2012, the Cyber
Security program will ensure the development and deployment of cyber security technologies for
enhancement in incident management, infrastructure protection and the reduction of insider threat
capabilities. During this period, Cyber Security funding will support research, development and
deployment of the following capabilities enterprise-wide:
• Cyber Tracer – This will provide the department with the capability to handle cyber security
incidents enterprise-wide. The developed technology will provide each site with the capability
to share incident information in real time within that site and allow for enterprise-wide
corrective actions to take place.
• Insider Threat Capability – This develops an insider threat solution that integrates monitoring,
investigation, and forensics capabilities that protect against insider threats. This tool is an
agent-based insider threat protection that provides visibility and control of desktops and
laptops, whether connected to the network, at home, or completely offline.
• Data Leakage Capability – This is a two-tiered architecture that consists of multiple policy
sensors placed around the network to detect and/or prevent data leakage, and a central
management console to distribute policies and collect/organize alerts.
• Data Loss Prevention Capability – This provides the capability to quickly discover exposed
confidential data wherever it is stored, with the broadest coverage of enterprise data
repositories, and web content and applications.
• Continuous Monitoring – Cyber Security will seek to implement a continuous monitoring
program at the enterprise level for all critical cyber security assets by September 30, 2012.
Weapons Activities/
Cyber Security Page 306
FY 2012 Congressional Budget