Securing America: Readiness, Response, and Resilience for Critical Infrastructure Defense

## Overview

In this panel session, Frank Cilluffo (Director of the McCrary Institute at Auburn University) sits down with Chris Butera (Acting Executive Director of the Cybersecurity Division at CISA) and Bob Costello (Chief Information Officer at CISA). The discussion highlights CISA’s operational mission, response tempo, evolving threat landscape, internal technical modernization, and deep collaborative relationships with private industry and critical infrastructure operators. Despite personnel departures from voluntary government separations, CISA leadership emphasized maintaining an aggressive pace of defense and delivering new operational capabilities weekly.

---

## Operational Tempo and Rapid Vulnerability Response

CISA leadership emphasized the necessity of matching adversary speed through innovation, automation, and compressed remediation windows:

- **Emergency Directives & Alerts:** On the day of the discussion, CISA released an Emergency Directive to the Federal Civilian Executive Branch (FCEB) concerning Microsoft Exchange, alongside 10 Industrial Control Systems (ICS) alerts. - **24-Hour Patching Timelines:** In response to adversaries exploiting vulnerabilities faster than ever, CISA compressed federal patching mandates to 24-hour response windows, specifically utilized for the Citrix Bleed vulnerability and a Microsoft SharePoint vulnerability. - **Known Exploited Vulnerabilities (KEV) Catalog:** Maintained in coordination with security researchers and industry, the KEV catalog saw rapid turnaround times, including an entry added in under 24 hours. - **Incident Response Coordination:** When alerted to SharePoint exploitation over a weekend, CISA engaged directly with Microsoft to develop remediation guidance, collaborated with regional personnel to notify affected asset owners with internet-exposed instances, and integrated the vulnerability into the KEV catalog.

---

## Adversary Tactics and Defensive Realities

The panel analyzed shifts in threat behaviors, noting how traditional remediation timeframes are no longer viable:

- **Shifting from 30-Day Cycles:** Defenses cannot rely on traditional 30-day patching windows for high-severity vulnerabilities. - **Scattered Spider & Social Engineering:** A joint interagency publication highlighted threat group Scattered Spider utilizing artificial intelligence (AI) to enhance social engineering as an initial access vector, followed by standard cybersecurity techniques for privilege escalation and lateral movement. - **Exploitation Methodologies:** Attackers frequently chain multiple vulnerabilities (e.g., compounding low-severity flaws into deeper access) and deploy living-off-the-land techniques to evade detection. - **Assume-Breach Mentality:** Defensive operations focus on assuming breach and avoiding internal blame to optimize containment, rapid response, and resilience.

---

## Internal Modernization and Community Tools

Costello described efforts to "heed CISA's own advice" by eliminating technical debt and hardening internal agency architecture:

- **Cloud Migration:** CISA set an operational deadline of September 30 (end of the fiscal year) to fully decommission its on-premises environments and migrate completely to the cloud. - **Thorium:** CISA deployed and released an open-source tool called *Thorium* for malware and forensic analysis. - **Cyber Hygiene Access:** CISA is issuing new portal releases over the coming months to streamline enrollment for critical infrastructure entities signing up for agency cyber hygiene services. - **Internal Beta Testing:** The CIO's office acts as an operational testbed for security guidance developed by the Cybersecurity Division to verify that CISA-recommended architectures and baselines are implementable in enterprise settings.

---

## Operational Collaboration and Information Sharing

The speakers reiterated that cybersecurity is a collective effort requiring active collaboration across private and public sectors:

- **Syndicated Visibility:** No individual organization possesses complete visibility across the threat ecosystem. - **Central Coordination Role:** Positioned outside the Intelligence Community and traditional law enforcement, CISA acts as an information synthesis hub, correlating data streams from Information Sharing and Analysis Centers (ISACs), interagency partners, and commercial threat researchers to produce unified defense insights.