May 21, 2018 By David Bisson 2 min read

The Department of Homeland security (DHS) has a new plan to reduce software vulnerabilities, counter malicious actors, respond to incidents and build resiliency. The DHS released a national cybersecurity strategy on May 15, which focused on addressing the evolving digital threat landscape. The unveiled plan is part of the organization’s commitment to implement these cybersecurity responsibilities over the next five years.

DHS Cybersecurity: ‘A Historic Turning Point’

Kirstjen Michele Nielsen, the DHS secretary, explained that the new national cybersecurity strategy responds to changes in the threat landscape. She found the convergence of digital security with personal and private security particularly remarkable — calling this a “historic turning point” that necessitates a reevaluation of her department’s approach to cybersecurity.

“In an age of brand-name breaches, we must think beyond the defense of specific assets — and confront systemic risks that affect everyone from tech giants to homeowners,” Nielsen said in a DHS press release. “Our strategy outlines how DHS will leverage its unique capabilities on the digital battlefield to defend American networks and get ahead of emerging cyberthreats.”

5 Security Objectives of the DHS

The DHS divided its strategy into five pillars:

  1. Bolster risk identification: Understand the department’s posture concerning national cybersecurity risk and prioritize responsive risk management efforts.
  2. Reduce vulnerabilities: Help federal agencies patch up weak points in their networks so they can achieve a reasonable level of cybersecurity.
  3. Diminish threats: Combat transnational criminal organizations and individual actors who abuse the digital space.
  4. Mitigate consequences: Minimize the effects of potentially significant security incidents through the cooperation of the entire community.
  5. Enable cybersecurity outcomes: Support activities and efforts that promote global risk management activities while making the department’s cybersecurity efforts more integrated and streamlined.

The DHS explained it intends to pursue these objectives while upholding the national values of the U.S. and protecting the civil liberties of Americans.

Collaboration in the Name of a Safer World

In its national cybersecurity strategy, the DHS revealed that it would not be able to tackle the majority of its goals alone. It said it would need to draw from the strength of the international community to track down criminals, prepare for attacks (on the scale of WannaCry or NotPetya) and promote risk management worldwide. Toward that end, it expressed its commitment to support research into security innovations that help better protect its networks as well as other organizations’ systems.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today