5: JD Henry on DHS/CISA Cybersecurity Resources for Nation’s Critical Infrastructure

### Overview In this talk, JD Henry, a Cybersecurity Advisor (CSA) with the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS), outlines the free resources and technical assistance provided to the nation's critical infrastructure sectors and state, local, and tribal governments. CISA, established relatively recently after transitioning from the National Programs and Protections Directorate, focuses on both cyber and physical security. Henry explains that CSAs serve as regional embedded advisors across FEMA regions (with Henry covering FEMA Region 7) providing non-regulatory, voluntary guidance, risk assessments, and incident coordination at no cost.

### Key Topics - **Role of CISA and Regional CSAs**: CSAs act as local conduits to federal cybersecurity resources, operating on an invitation-only basis. They have no regulatory or auditing authority and provide actionable options for consideration rather than mandatory directives. - **Legal Protections for Shared Data**: Under the Critical Infrastructure Information Act of 2002, information shared voluntarily with DHS is strictly protected under criminal penalties. This protection supersedes FOIA requests, state and local sunshine laws, and civil litigation discovery. - **Sector-Specific Challenges**: Henry discusses challenges across critical sectors (e.g., election infrastructure, water, power, healthcare, and pipelines). He specifically highlights the energy sector's heavy regulatory burden under NERC/FERC standards (NERC CIP), noting how stringent compliance and severe financial penalties can paradoxically deter organizations from implementing additional voluntary cybersecurity measures.

### Technical Details Henry details multiple assessments and technical services provided directly or through partners: - **Cybersecurity Evaluation Program**: Control-based, interview-driven assessments across five domains mapped directly to the NIST Cybersecurity Framework (CSF) and Carnegie Mellon University maturity models. The deliverable is a dashboard comparing organizations against peer high-water marks and modeling investments against stressors like natural disasters or denial-of-service attacks. - **External Dependencies Management**: Focuses on evaluating risks tied to managed service providers (MSPs), cloud providers, third-party contractors, and telecom/utility links across onboarding, SLA enforcement, and accountability. - **Cyber Resilience Review (CRR)**: A comprehensive 10-domain assessment (available as an assisted 6–8 hour review or a self-assessment download) emphasizing foundational asset management. - **Technical Assistance via NCATS & Partners**: External uncredentialed Nessus vulnerability scans providing weekly vulnerability reports; multi-week simulated phishing campaigns tracking click rates and employee reporting behavior; Industrial Control Systems (ICS) architectural design evaluations led by Idaho National Laboratory personnel; and two-week full-scale penetration tests focusing on active real-world adversary tactics. - **Training & Awareness**: Training access via platforms like FedVTE (over 30 courses and 800+ hours available for government personnel and veterans), public resources via Stop.Think.Connect, and support for Cybersecurity Awareness Month.

### Takeaways & Incident Reporting Henry urges organizations to focus on foundational processes, policies, and network segmentation rather than solely purchasing expensive tools. When incidents occur, organizations are urged to report quickly to the operations center (NCCIC, transitioning to the CISA Integrated Operations Coordination Center / CIOPS). For issues like wire fraud, immediate action is necessary to disrupt the kill chain within 72 hours. Unlike law enforcement agencies primarily focused on prosecution, CISA's Computer Emergency Readiness Team (CERT) focuses on technical recovery, forensic analysis, and restoring operations.