2014 Digital Yearbook of Homeland Security Awards

fully so, countering biological threats remains a high priority
at DHS. As our experiences in Afghanistan and Iraq
have shown, man portable improvised explosive devices
(IEDS) and vehicle-borne IEDS are still a major concern,
especially against soft targets.
Other threats such as chemical and radiological
substance releases, and natural disasters from floods, hurricanes
and earthquakes all still pose plausible and dire
threats to the homeland. Unfortunately, it is likely that the
nation’s preparedness will be tested again in the coming
decade.
One area where DHS has taken on an increasingly
larger role is in cybersecurity. Presidential Directives have
mandated DHS to play the primary role in the civilian side
of government for cybersecurity. A major reason for the
new focus on cybersecurity has been the rapid changes
in the information technology landscape. Since 2003, the
capabilities and connectivity of cyber devices and communications
has grown exponentially. Concurrently, so
have the cyber intrusions and threats from malware and
hackers. This has required restructuring of priorities and
the cybersecurity missions at DHS. The cyber threat to the
homeland reaches far beyond terrorists and includes various
criminal enterprises and adversarial nation states.
What do government and industry perceive
to be the main cybersecurity threats and
required responses?
CB: Both government and industry have prioritized
critical infrastructure as a focus of threat and hardened
response. There is a growing understanding of the seriousness
and sophistication of the cyber threats, especially
denial of service. In terms of preparation, the financial and
13
retail communities have been at the forefront of addressing
these threats with significant investment in technologies
and in training. However, 43% of companies had
breaches last year (including companies such as Home
Depot, JPMorgan, and Target) and the intrusion threats
are not diminishing.
According to the think tank Center For Strategic
and International Studies (CSIS), cyber related crime now
costs the global economy about $445-billion every year.
These breaches demonstrate that there is a continued
need for protocols and enhanced collaboration between
government and industry.
Last year, The Council on CyberSecurity, an influential
not-for–profit organization, formed a “20 Critical Security
Controls list” with collaboration between the public
and private sectors. The list provides an emerging working
framework for protecting the critical infrastructure and
provides a recommended set of actions for cyber defense
that includes specific and actionable ways to stop today’s
most pervasive attacks. I was honored to participate in
that working group.
Indeed, cyber security controls are very important.
In the U.S., most (approximately 85%) of the cybersecurity
critical infrastructure including defense, oil and gas,
electric power grids, healthcare, utilities, communications,
transportation, banking, and finance is owned by the
private sector and regulated by the public sector. DHS has
recognized the importance for private sector input into
cybersecurity requirements across these verticals and has
played a major part in bringing government and industry
together to develop a strategy to protect critical infrastructure.