Leading Cyber Experts Agree: Centralized .Gov Authority with CISA is Badly Needed

WASHINGTON, DC – In testimony before the House Committee on Homeland Security, a distinguished panel of cybersecurity experts confirmed what has become a central pillar of Ranking Member John Katko’s (R-NY) proposed policy response to the SolarWinds cyber espionage campaign – that the Cybersecurity and Infrastructure Security Agency (CISA) needs more resources, better-defined authorities, and centralized visibility over the .gov space.

Better-Resourced CISA

Offering recommendations to strengthen our cyber defenses, Dmitri Alperovitch, Executive Chairman of Silverado Policy Accelerator, noted that CISA needs the authorities and resources to one day become an operational federal Chief Information Security Officer (CISO) for the civilian federal government.

Alperovitch stated, “Ultimately, CISA should have the operational responsibility for defending civilian government networks, just as Cyber Command does for DoD networks. The recent NDAA, which vested CISA with the authority to hunt on agencies’ networks without the explicit permission of those agencies, was a critical move in that direction. CISA will now need additional funding to build a 24/7 threat hunting operations center to fulfill the requirements of that mission.”

Better-Defined CISA Authorities 

Christopher Krebs, former Director of CISA, noted that federal cybersecurity posture can be improved through enhanced governance, increased funding, and centralized services offered by CISA.

“Recently, NDAA Section 1705 authorized CISA to conduct proactive threat hunting across civilian networks, a key development in improving visibility across the 101 agencies,” said Krebs. “For this advancement to be successful, CISA will need to deploy detection capabilities, hire analysts to conduct the activities, gain access to the appropriate data, and the buy-in and cooperation from the agencies CISA is hunting across.”

Centralized .Gov Visibility

Krebs also noted that “the most logically defensible arrangement for civilian agencies” is a centrally managed and secured “Govnet.” “Common services that touch the public internet, including email, should be consolidated as much as possible, ideally by CISA’s Quality Service Management Office (QSMO),” he said.

Opportunity for Bipartisan Collaboration

As Ranking Member Katko reinforced in his opening statement, cybersecurity is very much a “team sport,” and he looks forward to working with all interested stakeholders to advance these important policy conversations in the months ahead. In addition to the longer-term policy imperatives around .gov roles and responsibilities, he believes it’s critical that we don’t delay in providing CISA any supplemental resources it needs today for the immediate SolarWinds response.

Ranking Member Katko has made cybersecurity a top priority of his as the lead Republican on the House Homeland Security Committee. He was active in driving progress on these issues last Congress where six Katko authored measures stemming from Cyberspace Solarium recommendations were ultimately enacted in the FY2021 National Defense Authorization Act.

###