Goldman's CISO Andy Ozment Balks at Tangle of Cyber Regulations

CNBC reports on CISO Andy Ozment's take on the current chaotic and cumbersome patchwork of cybersecurity laws.

Such interesting insight from @GoldmanSachs CISO Andy Ozment today. Thank you for joining me on this panel at #WSJCyber! Photo: @AdamJanofsky pic.twitter.com/CKW7e67Ggz

— Sara Castellanos (@SCastellWSJ) December 11, 2018

Hearing Key Points: "Interagency Cyber Cooperation: Roles, Responsibilities and Authorities of the Department of Defense & the Department of Homeland Security"

(Working Draft)

"Interagency Cyber Cooperation: Roles, Responsibilities and Authorities of the Department of Defense & the Department of Homeland Security"

Hearing held on November 14, 2018 before the:

U.S. House Armed Services Committee
Subcommittee on Emerging Threats

U.S. House Homeland Security Committee
Subcommittee on Cybersecurity and Infrastructure Protection


Witnesses:

Ms. Jeanette Manfra, Assistant Secretary, Office of Cybersecurity and Communications, National Protection Programs Directorate, U.S. Department of Homeland Security

Written Testimony Key Points:

• Intro
• Threat Assessment
• Joint DoD and DHS Cybersecurity Efforts
• Cybersecurity Priorities
• In May of this year DHS published a Cybersecurity Strategy
• In September the President released the National Cyber Strategy
• Last year President signed Executive Order (EO) 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• Under EO 13800, DHS and DOE, in consultation with ODNI, assessed potential impact and response readiness for a power outage associated with a significant cyber incident
• Department of Homeland Security's Cybersecurity Responsibilities
• National Risk Management
• Secretary Nielsen announced rebranding of the Office of Cyber and Infrastructure Analysis as the National Risk Management Center (NRMC)
• Enables private and public sector to assess and mitigate risks
• NRMC's core mission focuses on systems or functions that cut across sectors
• The NRMC will support the NCCIC and the NICC
• Conclusion

Gov's Cyber Performance: 10 Key Metrics

Performance.gov published the Federal government's Cybersecurity Key Performance Indicator report for Q3 FY 2018. 10 key metrics were measured for 23 agencies.

Key Performance Indicators for Federal Cybersecurity
Source: Performance.gov

Performance.gov was created to fulfill the statutory requirements of the Government Performance and Results Act of 1993 and the GPRA Modernization Act of 2010 legislating the creation of an online performance reporting portal. The portal provides information about the President's Management Agenda (PMA), the Federal performance management framework, and the federal goal-setting process.

Here is a good article on the report.

DOE's New Office of Cybersecurity, Energy Security, and Emergency Response (CESER)

Office of Cybersecurity, Energy Security, and Emergency Response website
Source: energy.gov/ceser

On February 14, 2018, U.S. Secretary of Energy Rick Perry established a new office called the Office of Cybersecurity, Energy Security, and Emergency Response (CESER) to handle the Department of Energy's (DOE) security and emergency response operations. The office will oversee preparedness planning and emergency response for cyber threats, physical attacks, and natural disasters impacting the energy sector.

DOE was designated the cybersecurity Sector-Specific Agency (SSA) for the energy sector, meaning that it is responsible for overseeing the security and resilience of this designated critical infrastructure. By creating CESER, the Department’s role will be strengthened.

On August 28, 2018, Karen Evans was confirmed by the Senate to lead CESER as Assistant Secretary. Evans previously served as a top IT official, the position now known as the federal CIO, at the Office of Management and Budget under President George W. Bush. She also previously served as DOE's CIO. Most recently, she was the National Director of the U.S. Cyber Challenge, a program dedicated to building the U.S. cybersecurity workforce.

In her new role, she testified before Congress for the hearing “DOE Modernization: The Office of Cybersecurity, Energy Security, and Emergency Response."

Here is DOE's updated organizational chart. Plus some really beautiful photos on Instagram from Energy.gov...