CybersecurityProgram aiming to facilitate cyberthreat information sharing is slow to take off

President Barack Obama’s 2013 executive order to improve critical infrastructure cybersecurity allows DHS to expand an information-sharing program, once restricted to Pentagon contractors, to sixteen critical infrastructure industries. The Enhanced Cybersecurity Services program transmits cyber threat indicators to selected companies so they may prepare their network protection systems to scan for those indicators.

The program “is a voluntary initiative intended to augment, not replace, existing security services operated by or available to critical infrastructure companies,” DHS spokesman S. Y. Lee said. It “automates the use of cyber threat indicators – up to and including classified information – by commercial service providers to assist participating critical infrastructure companies in their cyber protection efforts.”

A DHS inspector general (IG) report released on Monday has found that just about forty companies from three of the sixteen industries — energy, communications services, and defense — are part of the program. Furthermore, only two ISPs or communications service providers (CSPs), CenturyLink and AT&T, are authorized to receive the indicators. DHS relies on CSPs to receive the threat information and use it to offer specialized services to approved critical infrastructure customers. DHS sends the threat alerts about three times a week, along with instructions to scan emails for indicators, which may include malicious attachments, and quarantine flagged messages.

DHS hopes to increase the number of CSPs participating in the program, as those companies are expected to promote the service to potential critical infrastructure clients; however, CSPs might not have a financial incentive to offer the program’s services until more critical sectors enroll.

The “program should include all 16 critical infrastructure sectors by increasing the number of operational CSPs,” writes Richard Harsche, acting assistant IG for information technology audits. “Without improving communication and outreach to increase critical infrastructure sector entities’ interest, CSPs may not have the financial means or incentive to participate in the (cyber) program due to the lack of new critical infrastructure entity customers,” Harsche added.

NextGovsuggests that some companies see little value in the information released from DHS’s cybersecurity program as many already receive threat information from other sources including industry associations, and prefer not to pay CSPs to receive similar information. For example, many banks rely on the Financial Services Information Sharing and Analysis Center, and receive alerts from the Treasury Department. When NextGov asked Scott Jensen, communications director for the American Chemistry Council, whether he has heard of the program, he replied, “we’re not familiar with the specific program you mentioned, but there are other ways that DHS communicates with our industry regarding cyber threats.” Furthermore, DHS has only finished validating one more ISP. The vetting process for ISPs can take eight months. “Enrollment in the (Enhanced Cybersecurity Services) program has been slow because of limited communication and outreach and a necessary in-depth security validation and accreditation process for potential program participants,” Harsche explained.

Based on recommendations from the IG report, DHS will increase the number of cyber analysts who vet ISPs, and enroll companies in the program. “These measures will significantly increase the number of assessment activities that can be accomplished at one time, resulting in the timely completion of the security validation and accreditation processes,” wrote Andy Ozment, assistant secretary for the DHS Office of Cybersecurity and Communications.