American Association of State Highway and Transportation OfficialsSpecial Committee on Transportation Security and Emergency Management

2017 Critical Infrastructure Committee Joint Annual Meeting

Department of Homeland Security Updates

Monday, July 31, 2017

Houston, Texas

Presenter’s Name June 17, 2003 2

Prevent Terrorism/Enhance Security

National Terrorism Advisory System advisories (Alerts and Bulletins) Follow local guidance and to report suspicious activity.

The “If You See Something, Say Something TM” campaign Report suspicious activity to local law enforcement.

2011

Presenter’s Name June 17, 2003 3

Hometown Security ToolsHelp Your Community Prepare in advance of an incident / attack Encourages businesses to Connect, Plan, Train, and Report

Helps prepare businesses and their employees to proactively think about the role they play in safety and security of their businesses and communities.

Presenter’s Name June 17, 2003 4

Active Shooter PreparednessEnhance preparedness through A "whole community" approach

Offer free Active Shooter training courses, materials, and workshops for a broad range of stakeholders to address issues such as: Active Shooter awareness (IS-907) Workplace Violence (IS-906) Incident Response (ISC Planning & Response Guide)

Better prepare you to deal with an active shooter situation Raise awareness of pre-incident behaviors, indicators, and

characteristics of active shooters.

Presenter’s Name June 17, 2003 5

Countering Violent Extremism (CVE)Violent extremist threats U.S. domestic terrorists and homegrown violent extremists International terrorist groups like al-Qaeda and ISIL Lone offenders or small groups become radicalized To commit violence at home, or abroad as foreign fighters

Internet and social media Used to recruit and radicalize

individuals to violence Conventional approaches are unlikely

to identify and disrupt all terrorist plots

Presenter’s Name June 17, 2003 6

Presidential Policy Directive 41 and Annex: United States Cyber Incident Coordination“Recognizes the leading role that DHS plays during cyber incidents,” DHS/S1

PPD-41, “United States Cyber Incident Coordination,” released July 26, 2016: Sets forth principles governing the Federal Government’s response

to any cyber incident Establishes lead Federal agencies and an architecture for

coordinating the broader Federal Government response Requires the Departments of Justice and Homeland Security to

maintain updated contact information

PPD-41 Annex, “Cyber Incident Reporting,” released the same day A Unified Message for Reporting to the Federal Government

Presenter’s Name June 17, 2003 7

Federal Cyber Incident Response Two types of Federal Incident Response (Threat and Asset)Threat Response -- Lead: Department of Justice (FBI) Attributing, pursuing and disrupting malicious cyber

actors and activity Conducting criminal investigations and

other actions to counter the malicious cyber activity

FBI will work with their National Cyber Investigative Joint Task Force, and Department of Homeland Security’s U.S. Secret Service and U.S. Immigration and customs Enforcement/Homeland

Security Investigations Cyber Crimes Center (C3)

Presenter’s Name June 17, 2003

Federal Cyber Incident Response

Tactical

Continue to help affected entities: Find the adversary on its systems, Learn how the adversary broke in, Remove the adversary from its

systems, and Rebuild its systems to be more

secure moving forward.

Strategic

Coordinate the asset response Coordinate all government

assistance to the victim, Share anonymized lessons

learned information broadly, Distribute threat indicators through

its Automated Indicator Sharing system, and

Identify and alert other entities at risk from this attack.

8

Asset Response -- Lead: Department of Homeland Security National Cybersecurity and Communications Integration Center (NCCIC), Cyber Unified Coordination Group (UCG)

Presenter’s Name June 17, 2003

Federal Cyber Incident Response Department of Homeland Security’s support role in:Threat Response -- Lead: Department of Justice (FBI) National Cyber Investigative Joint Task Force

DHS law enforcement components (USSS and HSI) will Coordinate with other law enforcement agencies Continue to conduct criminal investigations into cyber

incidents, and From within the Cyber Unified Coordination Group (UCG) Coordinate with the FBI’s National Cyber Investigative

Joint Task Force

Presenter’s Name June 17, 2003 10

National Cyber Incident Response Plan (NCIRP)DHS is leading the effort to write the Plan to Formalize the incident response practices, Detail organizational roles, responsibilities,

and actions to Prepare for, respond to, and coordinate

the recovery from a significant cyber incident, Build upon PPD-41, and Include the private sector and other levels of governmentThe Plan will be written in collaboration with partners, including: All critical infrastructure sectors, sector coordinating councils,

government coordinating councils, Sector Specific Agencies, states, and private sector organizations.

Presenter’s Name June 17, 2003 11

The National Initiative for Cybersecurity Careers and Studies (NICCS) Training CatalogManaged by the Office of Cybersecurity and Communications (CS&C) Cybersecurity Education and Awareness Branch (CEA)

A key resource of cybersecurity information directly focused on: Enhancing awareness, Expanding the pipeline and Evolving the field

National resource for cybersecurity and opportunities available to: Government, Industry, Academia, and the general public

Presenter’s Name June 17, 2003 12

Homeland Security Information Network (HSIN) Capabilities for CISR Community Members

Host Your meetings via Webinar using HSIN Connect Saves time, money, and other resources Connect with remote employees, partners, & CISR community Available FREE to all HSIN-CI membersLearn how at HSIN Learn The HSIN Training Team has developed a series of courses to

help you get the most out of HSIN

Presenter’s Name June 17, 2003 13

IP’s Stakeholder Education and Training Program Just achieved

Over 1 Million Course Completions Critical Infrastructure Stakeholder FREE Training Offerings include: Security Awareness, Foundational, and Sector-Specific Series

Independent Study courses delivered publicly through FEMA/EMI. Limited-distribution courses via controlled access on HSIN-CI Instructor-led classes taught in-house and regionally Facilitated workshops delivered via regional outreach tours Critical Infrastructure Learning Series Webinars on DHS.gov, and Collaboratively-developed courses delivered by partners nation-wideExtensive new CISR Training Portal now available on HSIN-CI

Presenter’s Name June 17, 2003

Science & Technology Resources

14

DHS Centers of Excellence …Partnering with Universities Infrastructure Resilience Maritime Security Coastal Resilience Artic Domain AwarenessFunding Opportunities, Projects and Technical Expertise Adaptive Real-Time Seaport Security (DynaPortSec) -

Integrated PortSec, Game Theory and Adaptive Adversary

Nancy M. Pomerleau

Team Lead and Infrastructure Analyst (Highways, Mass Transit, Rail) in Transportation SystemsNational Protection and Programs DirectorateOffice of Infrastructure Protection | Sector Outreach and Programs Division

Desk: (703) 603-5044 Email: nancy.pomerleau@hq.dhs.gov