2019 Cybersecurity and Infrastructure Security: Risks Introduced by 5G Adoption in U.S.; Insider Threat Programs for Critical Manufacturing Sector; St

This is a compilation of three important 2019 cybersecurity papers: (a) Overview of Risks Introduced by 5G Adoption in the United States; (b) Insider Threat Programs for the Critical Manufacturing Sector Implementation Guide; and (c) Strategic Intent: "Defend Today, Secure Tomorrow".(a) The Department of Homeland Security (DHS) / Cybersecurity and Infrastructure Security Agency (CISA) assesses that Fifth Generation Mobile Network (5G) will present opportunities and challenges, and its implementation will introduce vulnerabilities related to supply chains, deployment, network security, and the loss of competition and trusted options. Use of 5G components manufactured by untrusted companies could expose U.S. entities to risks introduced by malicious software and hardware, counterfeit components, and component flaws caused by poor manufacturing processes and maintenance procedures. 5G hardware, software, and services provided by untrusted entities could increase the risk of compromise to the confidentiality, integrity, and availability of network assets. Even if U.S. networks are secure, U.S. data that travels overseas through untrusted telecommunication networks is potentially at risk of interception, manipulation, disruption, and destruction. 5G will use more components than previous generations of wireless networks, and the proliferation of 5G infrastructure may provide malicious actors more attack vectors. The effectiveness of 5G's security enhancements will in part depend on proper implementation and configuration.(b) The Insider Threat Programs for the Critical Manufacturing Sector Implementation Guide was developed to provide guidance and information for critical manufacturing organizations to establish insider threat programs. These programs serve to gather, monitor, and assess information for insider threat detection and mitigation strategies. Insider threat programs are designed to detect, deter, and mitigate the risks associated with trusted insiders and protect the privacy of the workforce while reducing potential harm to the organization. Effective insider threat programs deploy risk management strategies that identify the assets or resources to be protected, identify potential threats, determine vulnerabilities, assess risk, and deploy countermeasures.(c) CISA is necessary because the twenty-first century brings with it an array of challenges that are often difficult to grasp and even more difficult to address. We immediately think of our reliance on networked technologies, or perhaps our interdependent supply chain, as significant risk factors-how well do we really know the things we're relying on and do we understand what happens when we lose them? Making matters more complicated, it's not just human-driven threats; we must also plan and prepare for Mother Nature, as well as for the fact that sometimes technology just fails and bad things happen as a result. In no arena is this framing of the CISA mission more relevant than our election security work. The CISA team engaged in the defense of the 2018 elections across every organizational division, working with all 50 states and across the Federal Government. Our focused efforts to defend democracy clearly demonstrate that CISA is capable of surging to confront emerging threats and support our partners, wherever and whomever they may be.This compilation includes a reproduction of the 2019 Worldwide Threat Assessment of the U.S. Intelligence Community.