Legislatures Are Pushing to Strengthen CISA

With technology advancing, one of the biggest threats the United States faces is cyberattacks. The Cybersecurity and Infrastructure Security Agency (CISA) is a federal government agency that works to prevent cyberattacks, operating under the Department of Homeland Security. Their primary initiative is to work with partners to defend the United States from cyberthreats by inputting stronger and more secure cyber infrastructure.

The world of cybersecurity continues to advance, and the government is currently weighing options on how to improve the CISA. One idea was to form an entire cyber department, though it was ultimately decided that the government would work to strengthen the agency under the Department of Homeland Security. One thing is clear though: there is an urgency from legislatures to strengthen the CISA to better protect Americans and their devices.

CISA Has Been Making Changes to Improve Its Effectiveness

The U.S. government has been making systematic changes to CISA to increase its efficiency and ability to protect against cyber attacks.

“[We’ve made] organizational changes like designating the federal cyber center at CISA,” said Representative Jim Langevin of Rhode Island. “Basically we domesticized cybersecurity operations and created a joint cyber planning office to work with critical infrastructure owners and operators. Before a cyber incident actually occurs, [we] play these things out and determine what the appropriate response is.”

“It also means programmatic changes, like ensuring interoperability between public and private sector analysis so that they can work together in a joint collaborative environment to make sense of cyber threats,” he added.

Implementing Administrative Subpoena Will Help Protect People and Their Business

“Our adversaries … move very quickly when a new vulnerability is identified to scan the internet broadly for the existence of that vulnerability so that they can target it,” said Bryan Ware, former assistant director of the cybersecurity division at CISA. “We can do the same thing, but currently we don't have the ability, in many cases, to inform that entity that they have a vulnerability that could be targeted by an adversary.”

This is because the internet service providers (ISPs) are prohibited, under the Electronic Communications Privacy Act, from disclosing necessary information to the federal government without a compulsory legal process, he explained.

“We're finding these vulnerabilities now, but in many cases, we're unable to notify the actual affected entity,” Ware continued. “This administrative subpoena gives us the ability to work with the internet service provider so that they can identify just who that company is and then we notify them.”