DHS Cybersecurity Strategy and New California eCrime Unit

Image by Getty Images via @daylife

A couple of interesting items within the information security world...

I. The Department of Homeland Security has released a new cybersecurity strategy document with a two-pronged approach:

1. Protecting critical infrastructure today
2. Building a more secure cybersecurity ecosystem for the future

Download the Blueprint for a Secure Cyber Future document (PDF).

II. California Attorney General Kamala D. Harris has announced the creation of a new eCrime Unit to investigate and prosecute technology crime.

"The primary mission of the eCrime Unit is to investigate and prosecute multi-jurisdictional criminal organizations, networks, and groups that perpetrate identity theft crimes, use an electronic device or network to facilitate a crime, or commit a crime targeting an electronic device, network or intellectual property." READ MORE

Related articles

• Blueprint for a Secure Cyber Future: The Cybersecurity Strategy for the Homeland Security Enterprise (bespacific.com)
• DHS Releases Blueprint for Cybersecurity (govsellingsolutions.com)
• California targets cybercrime, identity theft (sfgate.com)
• State attorney general launches eCrime Unit (sfgate.com)
• California unveils new unit to fight cybercrime (news.cnet.com)
• California Creates Special Unit to Fight Computer Crimes (bits.blogs.nytimes.com)
• California Forms Cyber Crime Unit (informationweek.com)

Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523)

Image via Wikipedia

The House Intelligence Committee held a closed-door markup of a bill (HR 3523) with the intention to improve cybersecurity through enabling the federal government to share classified cyber threat information with businesses. To quote two of the primary proponents:

"There is an economic cyber war going on today against US companies." ... "There are two types of companies in this country, those who know they've been hacked, and those who don't know they've been hacked. Economic predators, including nation-states, are blatantly stealing business secrets and innovation from private companies. This cybersecurity bill goes a long way in helping American businesses better protect their networks and their intellectual property." -- Chairman of The Permanent Select Committee on Intelligence, Congressman Mike Rogers (R-MI)

"We simply can't stand by if we have the ability to help American companies protect themselves. Sharing information about cyber threats is a critical step to preventing them. This bill is a good start toward helping the private sector safeguard its intellectual property and critical cyber networks, including those that power our electrical, water and banking systems. The bill maintains vital protections for privacy and civil liberties without any new federal spending, regulations or unfunded mandates." -- The committee's ranking member, Congressman Dutch Ruppersberger (D-MD)

Related articles

• Article (Homeland Security Today)
• Text of the Bill (Library of Congress)
• Track status of the Bill (GovTrack.us)
• Press Release, Repr. Mike Rogers (House of Representatives)
• Press Release, Repr. Dutch Ruppersberger (House of Representatives)

Free Security Awareness Training - Part 1 of 5

Image via Wikipedia

As a security profesional I believe it's essential that we maintain security awareness and an understanding of the threats we face. Education often isn't cheap and the reality is that for many employers funding for training and education is very limited.

Fortunately, we're entering into the holiday season, which is a time of giving, and what I'm giving you are 25 security awareness courses and videos that are publicly available. Okay - maybe not the most exciting gift, but it fits the budget.

I will publish a series of five posts and each post will have links to five training resources. The security awareness courses may be completed online (or on CD-ROM) and are provided without cost to you. This study program is designed to provide you with a broad security awareness. There will be overlap in training that will help you to build depth of knowledge and to emphasize important areas. I emphasize "broad". The material covers many of the domains within security, some of it IT Security, and some of the material may seem a bit Rambo'esque or even doom-and-gloom.

There are several separate agencies and organizations that are offering the courses. Certificates of training can be printed following completion of the courses. You can enroll in any individual course, or if you're more highly motivated, aim for completing all of them. Personally, I believe that anyone who completes all of the courses will become a much more valuable security asset to their employer as well as their community.

Bring out the leftover turkey, stuffing and cranberry sauce ... it's time to cram in some free security awareness classes!

1. Phishing Awareness (Defense Information Systems Agency - US DoD)
2. Personally Identifiable Information (PII) (Defense Information Systems Agency - US DoD)
3. Security & Privacy Awareness Training (National Institute of Health Information)
4. Information Assurance Awareness (Defense Information Systems Agency - US DoD)
5. Information Assurance Awareness shorts (Defense Information Systems Agency - US DoD)

FCC Small Biz Cyber Planner

Image via Wikipedia

The FCC has launched a Small Biz Cyber Planner, an online resource to help small businesses create customized cybersecurity plans in conjunction with DHS, NCSA, NIST, The U.S. Chamber of Commerce, The Chertoff Group, Symantec, Sophos, Visa, Microsoft, HP, McAfee, The Identity Theft Council, ADP and others. The complete set of guidance can be downloaded as a PDF at fcc.gov/cyber/cyberplanner.pdf while the interactive online tool is available at FCC.gov/cyberplanner.

"The Small Biz Cyber Planner will be of particular value for businesses that lack the resources to hire a dedicated staff member to protect themselves from cyber-threats. Even a business with one computer or one credit card terminal can benefit from this important guidance.  The tool will walk users through a series of questions to determine what cybersecurity strategies should be included in the planning guide. Then a customized PDF is created that will serve as a cybersecurity strategy template for a small business. 

This effort is part of an ongoing program to raise awareness about the cybersecurity risks to small businesses and to help these businesses become cyber-secure. Earlier this year, the FCC and a coalition of public and private-sector partners developed a cybersecurity tip sheet, which includes tips to educate business owners about basic steps they can take immediately to protect their companies. The tip sheet is available at FCC.gov/cyberforsmallbiz."

Sections in the complete set of guidance are:

• Privacy and Data Security
• Scams and Fraud
• Network Security
• Website Security
• Email
• Mobile Devices
• Employees
• Facility Security
• Operational Security
• Payment Cards
• Incident Response and Reporting
• Policy Development, Management
• Cyber Security Glossary
• Cyber Security Links

Related articles

• FCC Launches the Small Biz Cyber Planner (bespacific.com)