The Office of Inspector General (OIG) says the Cybersecurity and Infrastructure Security Agency (CISA) made limited progress improving the overall quality of threat information but has addressed basic information sharing requirements.
OIG recently published the findings of its evaluation of CISAs progress in meeting the Cybersecurity Act of 2015s requirements for 2019 and 2020. The Act requires the Department of Homeland Security (DHS) to establish a capability and process for Federal entities to receive cyber threat information from non-Federal entities. The Act also requires Inspectors General from the Intelligence Community and appropriate agencies to submit a joint report to Congress every two years on Federal Government actions to share cyber threat information.
CISA created an Automated Indicator Sharing (AIS) capability in 2016 to enable the real-time exchange of unclassified cyber threat information and defensive measures to participants of the AIS community. According to OIG, in 2019 and 2020 CISA continued to leverage its AIS capability to share cyber threat information between the Federal Government and the private sector. During that time, CISA reportedly increased the number of Federal participants by more than 15 percent and increased the number of non-Federal participants by 13 percent. CISA asserted it increased the overall number of cyber threat indicators it shared and received by more than 162 percent, but it could not validate this number.
OIG determined that the quality of information shared with AIS participants was not always adequate to identify and mitigate cyber threats.
Cyber threat information must contain enough contextual information to help decision makers take necessary and appropriate actions. Examples of contextual information may include Internet Protocol addresses, domain names, hash files, uniform resource locators, or anomalies in the network traffic. Real-time access to the right information is critical for mitigating risks. For example, recent sharing of cyber threat indicators, including malware information, related to the 2021 SolarWinds Orion supply chain compromise led CISA and the Department of Defense Cyber National Mission Force to analyze these malware variants and trace their origins to prevent future cyber incidents.
However, according to the Federal and private sector entities the watchdog interviewed, most of the cyber threat indicators did not contain enough contextual information to help decision makers take action.
Stakeholders also stated that the cyber threat indicators contained false positives, which could mislead entities into believing threats were malicious, resulting in unnecessary upgrades or security protocols. Federal agency officials also noted that some participants had shared unconfirmed malware cyber threat indicator information, or low confidence threat information, that resulted in false positive alerting within security tools. Additionally, private sector feedback identified concerns with AIS customers experiencing false positives from the AIS Public Feed that were later identified as known good indicators. CISA responded to this by improving the AIS allow list to ensure that these types of known good indicators are not distributed via AIS to stakeholders. Federal stakeholders can filter out some of these lower confidence indicators while others may not have the expertise or intermediate tools to further refine relevant cyber threat indicators and defensive measures.
OIG has attributed the shortcomings to limited AIS functionality, inadequate staffing, and external factors challenges it previously reported on in its Cybersecurity Act evaluation for 2017 and 2018.
Following this most recent evaluation, OIG made four recommendations to CISA: improve information quality by increasing participants sharing of cyber information, complete AIS upgrades, conduct additional training and outreach, and hire the staff needed to improve the AIS programs operational effectiveness.
DHS concurred and reminded OIG that since the watchdogs fieldwork CISAs Cybersecurity Division launched its next generation version of AIS, AIS 2.0, which created the capability to apply a CISA opinion score to cyber threat indicators. This score provides an assessment of whether the information can be corroborated with other sources available to the entity submitting the opinion to AIS. AIS 2.0 addresses some of the weaknesses found in OIGs evaluation. In addition, DHS told OIG that during the past 18 months, CISAs Cybersecurity Division has added additional contractual resources to better support its efforts and is also assessing a longer-term approach to allocate resources to fully support the cyber risk mission area.
Read the full report at OIG
Read more:
OIG Wants More Progress from CISA on Cyber Threat Information Sharing - HS Today - HSToday
- Progress Lighting - Home - December 22nd, 2016 [December 22nd, 2016]
- Home - Progress Lighting Outlet - Authorized Progress Dealer - January 13th, 2017 [January 13th, 2017]
- What does progress mean? - Definitions.net - January 13th, 2017 [January 13th, 2017]
- Progress Fire Company Harrisburg, PA - January 13th, 2017 [January 13th, 2017]
- Homepage Center for American Progress - January 13th, 2017 [January 13th, 2017]
- Progress being made on possible grocery store co-op in Winston-Salem - myfox8.com - February 7th, 2017 [February 7th, 2017]
- Nioh Review-in-Progress: FromSoftware's Formula Evolved - Shacknews - February 7th, 2017 [February 7th, 2017]
- Deutsche Bundesbank Cites Progress With Blockchain-Based Settlement - CryptoCoinsNews - February 7th, 2017 [February 7th, 2017]
- IMF: Greece's debts are still unsustainable despite progress - The Seattle Times - February 7th, 2017 [February 7th, 2017]
- Think Progress Editor Mocks Audi for Equal Pay Super Bowl Ad - Breitbart News - February 7th, 2017 [February 7th, 2017]
- Progress apparent on defense - Pittsburgh Steelers - Steelers.com - February 7th, 2017 [February 7th, 2017]
- IMF: Greece's Debts are Still Unsustainable, Despite Progress - Voice of America - February 7th, 2017 [February 7th, 2017]
- Can US disrupter-in-chief trigger some progress? - Jerusalem Post Israel News - February 7th, 2017 [February 7th, 2017]
- The Cost of Progress - Slate Magazine - February 7th, 2017 [February 7th, 2017]
- Cavaliers' pitching rotation a work in progress | Cavalier Insider ... - The Daily Progress - February 8th, 2017 [February 8th, 2017]
- High schoolers create 'zines for progress' with WolfsonianFIU - FIU News - February 8th, 2017 [February 8th, 2017]
- Cries of 'dictator' show Pope Francis is making progress - Crux: Covering all things Catholic - February 8th, 2017 [February 8th, 2017]
- Officials: City is making progress in effort to address opioid crisis - The Union Leader - February 8th, 2017 [February 8th, 2017]
- IN OUR VIEW: Work Ready in Progress for Carter - The Independent - February 8th, 2017 [February 8th, 2017]
- BP's Earnings Keep Showing Progress, Even if the Headline Results Don't Say So - Motley Fool - February 8th, 2017 [February 8th, 2017]
- Women's Progress in the Boardroom Took a Hit in 2016 - Inc.com - February 9th, 2017 [February 9th, 2017]
- Blight Elimination Progress, Uplifting - MyWabashValley - February 9th, 2017 [February 9th, 2017]
- Rauner 'heartened' by progress in Springfield - Bloomington Pantagraph - February 9th, 2017 [February 9th, 2017]
- David Johnson showed off the insane progress he's making in rehab from his knee injury - USA TODAY - February 9th, 2017 [February 9th, 2017]
- Through the looking glass: Tower view showcases progress on Amazon's unique biospheres - GeekWire - February 9th, 2017 [February 9th, 2017]
- Britney Spears Says Niece Maddie Is 'Making Progress' After ATV Accident: 'Let's All Keep Praying' - PEOPLE.com - February 9th, 2017 [February 9th, 2017]
- Progress on vet's Mustang to be unveiled - Indianapolis Star - February 9th, 2017 [February 9th, 2017]
- Evgeni Malkin making 'progress,' could return Saturday in Arizona - Pittsburgh Post-Gazette - February 9th, 2017 [February 9th, 2017]
- Forecasters See Slow Progress in Labor-Market Measures Favored by Trump Administration - Wall Street Journal - February 9th, 2017 [February 9th, 2017]
- 'Paper boys' were the lifeblood of The Daily Progress - The Daily Progress - February 10th, 2017 [February 10th, 2017]
- Cliffs Natural Resources Is Showing a Lot of Progress on Its Return to Profitability - Motley Fool - February 10th, 2017 [February 10th, 2017]
- ATA says states' telemedicine progress a mixed bag ... - FierceHealthcare - February 10th, 2017 [February 10th, 2017]
- Seltzer's Notebook | Colangelo Encouraged by Sixers' Progress - Sixers.com - February 10th, 2017 [February 10th, 2017]
- The Trump administration can't entirely roll back progress on climate change here's why - Washington Post - February 10th, 2017 [February 10th, 2017]
- Colts position review: OL showed legit progress, but work remains - Indianapolis Star - February 10th, 2017 [February 10th, 2017]
- Egyptian Economy Making Slow, Tentative Progress - Voice of America - February 10th, 2017 [February 10th, 2017]
- ATA: States show mixed progress with telemedicine | Healthcare Dive - Healthcare Dive - February 11th, 2017 [February 11th, 2017]
- Louisville City notes: McCabe making progress - The Courier-Journal - February 11th, 2017 [February 11th, 2017]
- Jeremy Lin: Progress but no timetable - NetsDaily - February 11th, 2017 [February 11th, 2017]
- Marginal progress for Turkish-backed forces in north Syria - LA Daily News - February 11th, 2017 [February 11th, 2017]
- Jimmy Cheek: UT chancellor appreciative of hard work, progress on journey - Knoxville News Sentinel - February 12th, 2017 [February 12th, 2017]
- Syria Regional Crisis 2016 Emergency Appeal - Progress Report - Reliefweb - February 12th, 2017 [February 12th, 2017]
- CWLP officials: Bailout repayment would set back progress - The State Journal-Register - February 12th, 2017 [February 12th, 2017]
- Pistons' Johnson making halting but definite progress - The Detroit News - February 12th, 2017 [February 12th, 2017]
- Clairton works: Real progress is coming to the former steel town - Pittsburgh Post-Gazette - February 12th, 2017 [February 12th, 2017]
- The Democrats' Strategy: Hindering Progress For Partisan Politics - Daily Caller - February 13th, 2017 [February 13th, 2017]
- The surprising progress stoppers on the Dallas Cowboys defensive line - Cowboys Wire - February 13th, 2017 [February 13th, 2017]
- Gender Progress in Ballet - Huffington Post - February 13th, 2017 [February 13th, 2017]
- Foyt pleased with progress, regrets lack of time - Motorsport.com, Edition: Global - February 13th, 2017 [February 13th, 2017]
- Progress Made, but Threat Lingers at California's Oroville Dam - Wall Street Journal - February 13th, 2017 [February 13th, 2017]
- Adele, Beyonc, and the Grammys' Fear of Progress - The Atlantic - February 13th, 2017 [February 13th, 2017]
- North Korea Claims Progress on Long-Range Goal With Missile Test - New York Times - February 13th, 2017 [February 13th, 2017]
- How Travel Bans Can Impede America's Progress - Forbes - Forbes - February 13th, 2017 [February 13th, 2017]
- Jeff Sessions' appointment threatens decades of civil rights progress - The Hill (blog) - February 14th, 2017 [February 14th, 2017]
- Ionis Earns $75M Milestone from Bayer for Progress of Antisense Drug Program - Genetic Engineering & Biotechnology News (press release) - February 14th, 2017 [February 14th, 2017]
- Guilford Schools annual report shows mixed results on progress - Greensboro News & Record (blog) - February 14th, 2017 [February 14th, 2017]
- Sniper Elite 4 review in progress - PC Gamer - February 14th, 2017 [February 14th, 2017]
- For Honor Review In Progress - GameSpot - February 14th, 2017 [February 14th, 2017]
- China's military progress challenges Western dominance, says IISS - Deutsche Welle - February 15th, 2017 [February 15th, 2017]
- PFW in Progress Recap 2/14: Patriots Offseason Outlook | New ... - Patriots.com - February 15th, 2017 [February 15th, 2017]
- Daily Progress, chamber establish regional business Hall of Fame - The Daily Progress - February 15th, 2017 [February 15th, 2017]
- Huntsville-based Progress Bank to acquire Birmingham's First Partners Bank - Birmingham Business Journal - February 15th, 2017 [February 15th, 2017]
- City, UF sign partnership for progress - Gainesville Sun - February 15th, 2017 [February 15th, 2017]
- California officials lift evacuation order for 200000 threatened by damaged dam - CBS News - February 15th, 2017 [February 15th, 2017]
- 5G progress at Ericsson could help enterprises work worldwide - Computerworld - February 16th, 2017 [February 16th, 2017]
- Officials making 'great progress' on California dam repairs, remind residents to stay vigilant - Fox News - February 16th, 2017 [February 16th, 2017]
- Halo Wars 2 Review in Progress - IGN - February 16th, 2017 [February 16th, 2017]
- CUGNON: Forward progress - Yale Daily News (blog) - February 16th, 2017 [February 16th, 2017]
- F-35 Program Makes Significant, Solid Progress, Official Says - Department of Defense - February 16th, 2017 [February 16th, 2017]
- Lenovo's data center ambitions remain work in progress following Q3 results - ZDNet - February 16th, 2017 [February 16th, 2017]
- PFW in Progress Recap 2/16: Free Agency and Potential Patriots - Patriots.com - February 16th, 2017 [February 16th, 2017]
- S&P 500: 'Blow-off' Phase in Progress - DailyFX - February 16th, 2017 [February 16th, 2017]
- Combine invites are another sign of progress at Michigan - Big Ten ... - ESPN (blog) - February 16th, 2017 [February 16th, 2017]
- Halo Wars 2 review in progress - PC Gamer - February 17th, 2017 [February 17th, 2017]
- 'Hero' film produced just for Charlottesville featured the mayor, The Daily Progress - The Daily Progress - February 17th, 2017 [February 17th, 2017]
- Republicans' health care overhaul still a work in progress - Press Herald - February 17th, 2017 [February 17th, 2017]
- Trump Boasts Of 'Incredible Progress' In 4 Weeks Of Presidency - NPR - February 17th, 2017 [February 17th, 2017]
- Donald Trump touts promise progress at press conference - PolitiFact - February 17th, 2017 [February 17th, 2017]
- Mild winter helping crews make significant progress on East End Connector - WRAL.com - February 18th, 2017 [February 18th, 2017]
- Committee updates Legislature on precinct consolidation progress - Chicago Tribune - February 18th, 2017 [February 18th, 2017]