DHS outlines cyber priorities in release of delayed review

The Department of Homeland Security is working to deter cyberattacks targeting the nation’s critical infrastructure systems by prioritizing enhanced public-private collaboration, expanding its pool of high-skilled cyber talent and partnering with international allies to mitigate threats, according to a long-delayed strategy document released on April 20.

The Quadrennial Homeland Security Review—which was last released in 2014—outlined how the department is responding to a host of challenges facing the homeland, including the rise in cyberattacks targeting public and private sector entities. DHS said in a press release that the review “assesses the ways homeland security has evolved since the department was formed over 20 years ago and the significant changes to the threats and challenges facing the nation since the last report was issued nearly a decade ago.”

The report warned that “threats to the homeland have become more complex and have arisen on new fronts,” noting that “the convergence of cyber-physical technologies and systems underpinning our critical functions—from manufacturing, to healthcare, to transportation—means that single events can have a cascading impact on multiple industries, sectors and national critical functions.” 

The review referenced, in part, the 2021 ransomware attack on the Colonial Pipeline, which it said “quickly had cascading supply chain impacts” on the “distribution of gasoline and jet fuel to the Eastern United States—becoming a logistics problem more often experienced in response to natural disasters.”

“As commercial network technologies are woven increasingly into our businesses, personal lives and federal as well as [state, local, tribal and territorial] government functions to provide the most critical services upon which we depend, there remain cyber risks and vulnerabilities that leave networks and systems at risk of exploitation and disruption,” the review said. “The ransomware attack on Colonial Pipeline illustrated that the real-world impacts of software vulnerabilities are not hypothetical.”

The document reiterated DHS’s commitment to “protect the American people by preventing and mitigating active threats,” including the ongoing work of the department’s cyber-focused agency—the Cybersecurity and Infrastructure Security Agency—to “continue advancing national efforts to secure and protect against critical infrastructure risks, including implementing a national plan that recognizes both the expanding scale of terrorism and other threats and the emerging cybersecurity challenge of increasingly networked and internet-enabled infrastructure systems.” 

Given the fact that “the majority of the nation’s critical infrastructure is owned by the private sector,” DHS said close collaboration between industry and government remains critical. The department noted that it “is investing in initiatives to enhance public-private collaboration,” such as “the Cybersecurity Advisory Committee for pre-event strategic planning, the [Joint Cyber Defense Collaborative] for planning and real-time event coordination and the Cyber Safety Review Board for after-action analysis.” 

The document also outlined a number of steps that the Biden administration, DHS and CISA have taken to strengthen the cyber resilience of both federal agencies and critical infrastructure systems. These include, in part, ensuring “that infrastructure projects funded by the Infrastructure Investment and Jobs Act are built with cybersecurity in mind,” pushing federal agencies “to remediate vulnerabilities on aggressive timelines” and working to support “the development of secure software and technologies.” 

To enhance the department’s digital capabilities, DHS has also focused in recent years on expanding its pool of high-skilled cyber talent. The report said DHS launched the Cybersecurity Talent Management System in 2021 “to grow the future cybersecurity workforce.” As of the document’s release, the department said it “has processed over 5,000 applicants across a wide range of experience levels for an initial cohort of positions in both CISA and the Office of the Chief Information Officer.” 

The review also noted the impact that global events and international partnerships have had on DHS’s work, particularly when it comes to shoring up the security of critical infrastructure systems and guarding against the possibility of retaliatory cyberattacks from adversarial nations. 

The department said, for example, that “when it became clear that Russia was planning its 2022 invasion of Ukraine, DHS and CISA mobilized the private sector to harden its cyber defenses proactively against disruptive Russian retaliatory or spillover actions through a public awareness campaign called Shields Up, the largest effort of its kind in history.” 

“DHS shared threat information broadly and in real time with our public and private sector partners, and we identified and mitigated vulnerabilities,” the review added. “These ongoing efforts are important for the homeland security enterprise to reduce the likelihood of a damaging cyber intrusion, including taking steps to detect a potential intrusion quickly, ensuring that the organization is prepared to respond if an intrusion occurs and maximizing the organization’s resilience to a destructive cyber incident.” 

The department said that international partnerships, such as the recent expansion of the Abraham Accords “to include cybersecurity,” have also provided officials with “actionable technical information on shared cyber threats and vulnerabilities, including on specific cyber activity targeting critical infrastructure.”

During a speech at the Council on Foreign Relations on Friday following the report’s release, Homeland Security Secretary Alejandro Mayorkas noted that the review also outlined DHS’s new focus on “combating crimes of exploitation—such as human trafficking, child exploitation and labor exploitation—as a dedicated homeland security mission alongside our work countering terrorism, securing our borders, administering our immigration system, securing cyberspace and critical infrastructure and building resilience and responding to disasters.”

During the same event, Mayorkas also said that DHS was undertaking a 90-day sprint to assess how the U.S. could more effectively counter the threat posed by the Chinese government—particularly if Beijing decides to launch an invasion of Taiwan. He said a critical component of this review will include an examination of “the defense of our critical infrastructure against [the People's Republic of China] or PRC-sponsored attacks designed to disrupt or degrade provision of national critical functions, sow discord and panic and prevent mobilization of U.S. military capabilities.”

“A PRC invasion of Taiwan would have profound reverberations in the homeland, putting our civilian critical infrastructure at risk of a disruptive cyberattack,” Mayorkas added. “We must ensure we are poised to guard against this threat today and into the future.”