Cybersecurity and Infrastructure Security Agency

From USApedia
Cybersecurity and Infrastructure Security Agency
Type: Independent Agencies
Parent organization: Department of Homeland Security (DHS)
Employees: 3000
Executive: Director
Budget: $2.7 billion (fiscal year 2024)
Address: 1110 N Glebe Rd, Arlington, VA 22201
Website: https://www.cisa.gov
Creation Legislation: Cybersecurity and Infrastructure Security Agency Act of 2018
Wikipedia: Cybersecurity and Infrastructure Security AgencyWikipedia Logo.png
Cybersecurity and Infrastructure Security Agency
This map created from a Cargo query (Purge)
Mission
CISA leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. It works to ensure the security and resilience of the nation's critical infrastructure by providing cybersecurity guidance, sharing threat information, and coordinating response efforts.
Services

Cybersecurity assessments; Incident response; Infrastructure protection; Training; Information sharing

Regulations
This article is about CISA. For CSIAC, see Cyber Security and Information Systems Information Analysis Center.
Cybersecurity and Infrastructure Security Agency
File:Seal of Cybersecurity and Infrastructure Security Agency.svg
Seal of CISA
Overview
Formed November 26, 2018; 6 years ago (2018-11-26)
Preceding National Protection and Programs Directorate
Jurisdiction United States Federal Government
Headquarters Washington, DC, United States
Employees 3,161 (2023)[1]
Annual budget $2.9 billion (2023)
Executives Jen Easterly, Director[2]
Nitin Natarajan, Deputy Director[3]
Parent department Department of Homeland Security
Website
cisa.gov

The Cybersecurity and Infrastructure Security Agency (CISA) is a component of the United States Department of Homeland Security (DHS) responsible for cybersecurity and infrastructure protection across all levels of government, coordinating cybersecurity programs with U.S. states, and improving the government's cybersecurity protections against private and nation-state hackers.[4]

The agency began in 2007 as the DHS National Protection and Programs Directorate.[4][5] With the Cybersecurity and Infrastructure Security Agency Act of 2018, CISA's footprint grew to include roles in securing elections and the census, managing National Special Security Events, and the U.S. response to the COVID-19 pandemic.[6] It has also been involved in 5G network security and hardening the US grid against electromagnetic pulses (EMPs).[6] The Office for Bombing Prevention leads the national counter-IED effort.[7]

Currently headquartered in Arlington, Virginia, in 2025 CISA is planning to move its headquarters along with 6,500 employees to a new 10 story, 620,000 sq ft building on the consolidated DHS St. Elizabeths campus headquarters.[8]

History

The National Protection and Programs Directorate (NPPD) was formed in 2007 as a component of the United States Department of Homeland Security.[9] NPPD's goal was to advance the Department's national security mission by reducing and eliminating threats to U.S. critical physical and cyber infrastructure.

On November 16, 2018, President Trump signed into law the Cybersecurity and Infrastructure Security Agency Act of 2018, which elevated the mission of the former NPPD within DHS, establishing the Cybersecurity and Infrastructure Security Agency (CISA).[10] CISA is a successor agency to NPPD, and assists both other government agencies and private sector organizations in addressing cybersecurity issues.[11] Former NPPD Under-Secretary Christopher Krebs was CISA's first Director, and former Deputy Under-Secretary Matthew Travis was its first deputy director.[12][13]

On January 22, 2019, CISA issued its first Emergency Directive (19-01: Mitigate DNS Infrastructure Tampering)[14] warning that "an active attacker is targeting government organizations" using DNS spoofing techniques to perform man-in-the-middle attacks.[15] Research group FireEye stated that "initial research suggests the actor or actors responsible have a nexus to Iran."[16]

In 2020, CISA created a website, titled Rumor Control, to rebut disinformation associated with the 2020 United States presidential election.[17] On November 12, 2020, CISA issued a press release asserting, "There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised."[18] On the same day, Director Krebs indicated that he expected to be dismissed from his post by the Trump administration.[19] Krebs was subsequently fired by President Trump on November 17, 2020[20] via tweet for his comments regarding the security of the election.[21]

File:DHS Secretary Alejandro Mayorkas Participates in CISA Swearing In Ceremony - 51369641326.jpg
Secretary of Homeland Security Alejandro Mayorkas at CISA's current headquarters in Arlington, Virginia in 2021.

On July 12, 2021, the Senate confirmed Jen Easterly by a voice vote.[22] Easterly's nomination had been reported favorably out of Senate Committee on Homeland Security and Governmental Affairs on June 16, but a floor vote had been reportedly held (delayed) by Senator Rick Scott over broader national security concerns, until the President or Vice President had visited the southern border with Mexico.[23] Easterly hired new staff to monitor online disinformation to enhance what she called the nation's "cognitive infrastructure" and utilized the existing rumor control website during the 2021 elections.[24]

In September 2022, CISA released their 2023–2025 CISA Strategic Plan, the first comprehensive strategy document since the agency was established in 2018.[25]

Organization

File:Resilience Series 01 Real Fake.pdf
Real Fake, a 2020 graphic novel from CISA about disinformation and misinformation campaigns

CISA divisions include the:[26]

  • Cybersecurity Division
  • Infrastructure Security Division
    • Bombing Prevention
    • Chemical Security
    • Exercises
    • Infrastructure Assessment & Analysis
    • School Safety
    • Strategy, Performance & Resources
  • Emergency Communications Division
  • National Risk Management Center
  • Integrated Operations Division
    • Regions 1 through 10[27]
  • Stakeholder Engagement Division
    • Council Management
    • International
    • Sector Management
    • Strategic Relations

Programs

The Continuous Diagnostics and Mitigations program provides cybersecurity tools and services to federal agencies.[28][29]

CISA issues "binding operational directives" that require federal government agencies to take action against specific cybersecurity risks.[30]

In March 2021, CISA assumed control of the .gov top-level domain (TLD) from the General Services Administration. CISA manages the approval of domains and operates the TLD Domain Name System nameservers. In April 2021, CISA removed the fee for registering domains.[31] In January 2023, Cloudflare received a $7.2M contract to provide DNS registry and hosting services for the TLD.[32]

CISA provides incident response services to the federal executive branch and US-based entities.

CISA manages the EINSTEIN intrusion detection system to detect malicious activity on federal government agency networks.

The National Defense Authorization Act for Fiscal Year 2021 granted CISA the authority to issue administrative subpoenas in order to identify the owners of internet connected critical infrastructure related devices with specific vulnerabilities. In 2021, CISA issued 47 subpoenas.[33]

In August 2021, Easterly stated "One could argue we’re in the business of critical infrastructure, and the most critical infrastructure is our cognitive infrastructure, so building that resilience to misinformation and disinformation, I think, is incredibly important."[34]

In 2021, CISA released a report that provided guidance for how to navigate and prevent ransomware incidents. This was due to a significant jump in recent attacks related to ransomware.[35]

Committees

Cybersecurity Advisory Committee

In 2021, the Agency created the Cybersecurity Advisory Committee with the following members:[36]

  • Steve Adler, Mayor, City of Austin, Texas
  • Marene Allison, Chief Information Security Officer, Johnson & Johnson
  • Lori Beer, Chief Information Officer, JPMorgan Chase
  • Robert Chesney, James A. Baker III Chair in the Rule of Law and World Affairs, University of Texas School of Law
  • Thomas Fanning, Chairman, President and CEO, Southern Company
  • Vijaya Gadde
  • Patrick D. Gallagher, Chancellor, University of Pittsburgh
  • Ronald Green, Executive Vice President and Chief Security Officer, Mastercard
  • Niloofar Razi Howe, Board Member, Tenable
  • Kevin Mandia, Chief Executive Officer, Mandiant
  • Jeff Moss, President, DEF CON Communications
  • Nuala O’Connor, Senior Vice President & Chief Counsel, Digital Citizenship, Walmart
  • Nicole Perlroth, Cybersecurity journalist
  • Matthew Prince, Chief Executive Officer, Cloudflare
  • Ted Schlein, General Partner, Kleiner Perkins; and Caufield & Byers
  • Stephen Schmidt, Chief Information Security Officer, Amazon Web Services
  • Suzanne Spaulding, Senior Advisor for Homeland Security, CSIS
  • Alex Stamos, Partner, Krebs Stamos Group
  • Kate Starbird, Associate Professor, Human Centered Design & Engineering, University of Washington
  • George Stathakopoulos, Vice President of Corporate Information Security, Apple
  • Alicia Tate-Nadeau (ARNG-Ret.), Director, Illinois Emergency Management Agency
  • Nicole Wong, Principal, NWong Strategies
  • Chris Young, Executive Vice President of Business Development, Strategy, and Ventures, Microsoft

Directors

Main article: Director of the Cybersecurity and Infrastructure Security Agency
No. Director Term
Portrait Name Took office Left office Term length
1Krebs, Chris C.Chris C. Krebs16 November 201817 November 20202 years, 1 day
2Easterly, Jen M.Jen M. Easterly13 July 2021Incumbent3 years, 193 days

See also

References

  1. ↑ "CISA Hiring Hits High Score, and We're Not Done!!". 21 August 2023. https://www.cisa.gov/news-events/news/cisa-hiring-hits-high-score-and-were-not-done. 
  2. ↑ "Leadership". US Department of Homeland Security. September 7, 2006. https://www.dhs.gov/leadership. 
  3. ↑ "NITIN NATARAJAN". Department of Homeland Security. February 16, 2021. https://www.cisa.gov/nitin-natarajan. 
  4. ↑ 4.0 4.1 Cimpanu, Catalin (November 16, 2018). "Trump signs bill that creates the Cybersecurity and Infrastructure Security Agency". ZDNet. https://www.zdnet.com/article/trump-signs-bill-that-creates-the-cybersecurity-and-infrastructure-security-agency/. 
  5. ↑ "About CISA". Department of Homeland Security. 19 November 2018. https://www.dhs.gov/cisa/about-cisa.  Public Domain This article incorporates text from this source, which is in the public domain.
  6. ↑ 6.0 6.1 "National Risk Management Center | Cybersecurity and Infrastructure Security Agency CISA". https://www.cisa.gov/about/divisions-offices/national-risk-management-center. 
  7. ↑ "OBP Fact Sheet | CISA" (in en). 2023-06-08. https://www.cisa.gov/resources-tools/resources/obp-fact-sheet. 
  8. ↑ Weisner, Molly (2023-08-17). "Homeland Security to break ground on new CISA, ICE offices" (in en). https://www.federaltimes.com/acquisition/gsa/2023/08/17/homeland-security-to-break-ground-on-new-cisa-ice-offices/. 
  9. ↑ "DHS | About the National Protection and Programs Directorate". Dhs.gov. 2011-08-26. https://www.dhs.gov/xabout/structure/editorial_0794.shtm. 
  10. ↑ "Cybersecurity and Infrastructure Security Agency". https://www.dhs.gov/CISA. 
  11. ↑ Ropek, Lucas (2020-07-28). "Will CISA Be the Savior of State and Local Cybersecurity?" (in en). https://www.govtech.com/security/Will-CISA-Be-the-Savior-of-State-and-Local-Cybersecurity.html. 
  12. ↑ Johnson, Derek B. (2018-03-18). "NPPD taps vendor for No. 2 role" (in en). https://fcw.com/articles/2018/03/20/travis-nppd-deputy-cyber.aspx. 
  13. ↑ Rockwell, Mark (2018-12-20). "Standing up CISA" (in en). https://fcw.com/articles/2018/12/20/standing-up-cisa-rockwell.aspx. 
  14. ↑ "Emergency Directive 19-01". Department of Homeland Security. 22 January 2019. https://cyber.dhs.gov/ed/19-01/. 
  15. ↑ Krebs, Christopher. "Why CISA issued our first Emergency Directive". Department of Homeland Security. https://cyber.dhs.gov/blog/#why-cisa-issued-our-first-emergency-directive. 
  16. ↑ Hirani, Muks; Jones, Sarah; Read, Ben. "Global DNS Hijacking Campaign: DNS Record Manipulation at Scale". https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html. 
  17. ↑ Courtney, Shaun; Sebenius, Alysa; Wadhams, Nick (2020-11-12). "Turmoil Hits Cyber Agency Engaged in Election as Staff Leave" (in en). Bloomberg News. https://www.bloomberg.com/news/articles/2020-11-12/senior-u-s-cyber-official-involved-in-election-leaves-agency. 
  18. ↑ "Federal cybersecurity agency calls election 'most secure in American history'" (in en). 13 November 2020. https://www.engadget.com/cisa-2020-election-security-022224313.html. 
  19. ↑ Geller, Eric; Bertrand, Natasha (2020-11-12). "Top cyber official expecting to be fired as White House frustrations hit agency protecting elections" (in en). Politico. https://www.politico.com/news/2020/11/12/cyber-official-chris-krebs-likely-out-436342. 
  20. ↑ "Trump fires head of U.S. election cybersecurity who debunked conspiracy theories" (in en). 18 November 2020. https://www.nbcnews.com/tech/security/trump-fires-head-u-s-election-cybersecurity-after-he-debunked-n1248063. 
  21. ↑ Kaitlan Collins and Paul LeBlanc (18 November 2020). "Trump fires director of Homeland Security agency who had rejected President's election conspiracy theories". https://www.cnn.com/2020/11/17/politics/chris-krebs-fired-by-trump/index.html. 
  22. ↑ "PN420 - Nomination of Jen Easterly for Department of Homeland Security, 117th Congress (2021-2022)". 2021-06-16. https://www.congress.gov/nomination/117th-congress/420. 
  23. ↑ Miller, Maggie (2021-06-23). "Rick Scott blocks Senate vote on top cyber nominee until Harris visits border" (in en). https://thehill.com/policy/cybersecurity/559936-rick-scott-blocks-senate-vote-on-top-cyber-nominee-until-harris-visits. 
  24. ↑ Maggie Miller. (10 November 2021). "Cyber agency beefing up disinformation, misinformation team". The Hill website Retrieved 18 December 2023.
  25. ↑ "Strategic Plan | CISA". https://www.cisa.gov/strategy. 
  26. ↑ "Cybersecurity and Infrastructure Security Agency Divisions & Offices" (in en). https://www.cisa.gov/about/divisions-offices. 
  27. ↑ Cybersecurity and Infrastructure Security Agency. "CISA Regions". https://www.cisa.gov/about/regions. 
  28. ↑ Miller, Jason (7 November 2022). "CISA signature federal cyber program warrants more than a passing anniversary nod". https://federalnewsnetwork.com/reporters-notebook-jason-miller/2022/11/cisa-signature-federal-cyber-program-warrants-more-than-a-passing-anniversary-nod/. 
  29. ↑ Cybersecurity and Infrastructure Security Agency. "Continuous Diagnostics and Mitigations Program". https://www.cisa.gov/resources-tools/programs/continuous-diagnostics-and-mitigation-cdm-program. 
  30. ↑ Cybersecurity and Infrastructure Security Agency (18 May 2022). "Cybersecurity Directives". https://www.cisa.gov/news-events/directives. 
  31. ↑ Cybersecurity and Infrastructure Security Agency (27 April 2021). "A new day for .gov". https://get.gov/posts/2021-04-27-a-new-day-for-.gov/. 
  32. ↑ Cloudflare (13 January 2023). "Cloudflare Wins CISA Contract for Registry and Authoritative Domain Name System (DNS) Services". https://cloudflare.net/news/news-details/2023/Cloudflare-Wins-CISA-Contract-for-Registry-and-Authoritative-Domain-Name-System-DNS-Services/default.aspx. 
  33. ↑ "CY2021 ADMINISTRATIVE SUBPOENA FOR VULNERABILITY NOTIFICATION YEAR IN REVIEW". https://www.cisa.gov/sites/default/files/2023-01/CY2021_Admin_Subpoena_Summary_Factsheet_FINAL.pdf. 
  34. ↑ Klippenstein, Ken; Fang, Lee (October 31, 2022). "Leaked Documents Outline DHS's Plans to Police Disinformation" (in en). https://theintercept.com/2022/10/31/social-media-disinformation-dhs/. 
  35. ↑ Piper, D L A (July 2021). "Cybersecurity and infrastructure security agency releases guidance regarding ransomware". Journal of Internet Law 25 (1): 1–17. https://csu-sfsu.primo.exlibrisgroup.com/discovery/fulldisplay?docid=cdi_proquest_reports_2630356925&context=PC&vid=01CALS_SFR:01CALS_SFR&lang=en&search_scope=Everything_RAPIDO&adaptor=Primo%20Central&tab=Everything&query=any,contains,Cybersecurity%20and%20Infrastructure%20Security%20Agency&offset=0. 
  36. ↑ "CISA Names 23 Members to New Cybersecurity Advisory Committee | CISA". December 2021. https://www.cisa.gov/news/2021/12/01/cisa-names-23-members-new-cybersecurity-advisory-committee. 

External links

  • Lua error in Module:Official_website at line 90: attempt to index field 'wikibase' (a nil value).
v · d · e
United States Department of Homeland Security
* Headquarters: St. Elizabeths West Campus
Deputy SecretaryFile:Seal of the United States Department of Homeland Security.svg
Science and
Technology
Intelligence and Analysis
Management
* Law enforcement in the United States
  • Terrorism in the United States

    • Lua error in Module:Authority_control at line 158: attempt to index field 'wikibase' (a nil value).

    Retrieved from ‘https://openusaproject.com/w/index.php?title=Cybersecurity_and_Infrastructure_Security_Agency&oldid=20071’