Showing results by author "Cybersecurity-and-Infrastructure-Security-Agency" in All Categories

The Cybersecurity and Infrastructure Security Agency (CISA) is committed to leading the response to cybersecurity incidents and vulnerabilities to safeguard the nation's critical assets. Section 6 of Executive Order 14028 directed DHS, via CISA, to “develop a standard set of operational procedures (playbook) to be used in planning and conducting cybersecurity vulnerability and incident response activity respecting Federal Civilian Executive Branch (FCEB) Information Systems.

Every organization in the United States is at risk from cyber threats that can disrupt essential services and potentially result in impacts to public safety. Over the past year, cyber incidents have impacted many companies, nonprofits, and other organizations, large and small, across multiple sectors of the economy. The identification of destructive malware is particularly alarming given that similar malware has been deployed in the past - e.g., NotPetya and WannaCry ransomware - to cause significant, widespread damage to critical infrastructure.

Reducing your organization’s cyber risks requires a holistic approach - similar to the approach you would take to address other operational risks. As with other risks, cyber risks can threaten. Managing cyber risks requires building a culture of cyber readiness. 

As a leader, you need to drive your organization’s approach to cybersecurity as you would any other hazard (e.g. how you identify risk, reduce vulnerabilities, and plan for contingencies). This requires an investment of time and money, as well as the collective buy-in of your management team. Your investment drives actions and activities, and these build and sustain a culture of cybersecurity.

Pursuing a career in cybersecurity is not as straightforward as other more traditional professions. Doctors and lawyers serve as great examples. In most countries, including the United States, an advanced academic degree is required for each, along with an occupational license. Although there are exceptions to the rule, the general process includes completion of high school, earning a bachelor’s degree, entrance exams and completion of a master or doctoral program, on-the-job training (residencies and internships), and state or multi-state license examinations. 

Determine how much of your organization’s operations are dependent on IT. Consider how much your organization relies on information technology to conduct business and make it a part of your culture to plan for contingencies in the event of a cyber incident. Identify and prioritize your organization’s critical assets and the associated impacts to operations if an incident were to occur.