Gov 2

 

(IT)/Cyber Sector

As required by Presidential Policy Directive 21 (PPD-21), the current version of the National Infrastructure Protection Plan (NIPP 2013—also referred to as the National Plan) provides a unifying structure to define a single program for integrating critical infrastructure and key resources (CI/KR) protection. PPD-21 also assigned a federal agency as the lead Sector-Specific Agency (SAA) for each of the 16 critical infrastructures identified in PPD-21. Each SSA is responsible for developing and implementing an updated Sector-Specific Plan (SSP) for its sector. The original SSPs were published in 2010 based on a Letter of Agreement in the 2009 version of the NIPP, but were updated in 2015. The SSPs detail the application of the NIPP concepts to the unique characteristics and conditions of each sector.

A growing number of hacking incidents or cyber attacks in recent years has raised concerns about the adequacy of the SSP to address major threats or hazards in our IT sector and cyber space. This includes major hacking into credit card records or other IT/data systems at Lockheed Martin (a major defense contractor), RSA the security division of a major data storage company for financial institutions), SONY, major banking institutions, Target Stores, and the even the U.S. State Department. In fact, in 2010 alone, the U.S. government was subject to over 300,000 cyber attacks on its infrastructure. There were also suspicions that hacking into Google e-mail (gmail) accounts for high-ranking U.S. officials could be traced to China, and the CIA Web site was hacked. Many other incidents have occurred since then. There are also ongoing investigations about Russian hacking into the 2016 Presidential election process.

The IT sector is inextricably linked with the Communications sector, and interdependencies exist with all other CI/KR sectors. Technological advances and rapid development or modernization of a wide variety of systems and processes that depend on a secure IT system, including the Internet and the “cloud,” ensure that IT/cyber security will demand increasing attention in the future. Ensuring IT and cybersecurity is incredibly complex and challenging due to technological complexities and our global interconnectedness, which make it very difficult to detect, deter, trace, defend against, prosecute or counter cyber attacks and hacking.

You and the members of your team should assume the role of senior government officials representing DHS and other federal agencies and entities with responsibilities for ensuring the security of the U.S. IT sector and cyber space. Threats and hazards in this vital CI/KR sector carry potentially enormous consequences to our national economy, to national security and defense, to privacy, and to confidence in our government.

President Trump has asked about the security of our IT sector and cyber space and protection from intentional terrorist or espionage attacks, criminal or malicious hackers, or from disruptions due to technological failures or natural disasters. Our modern industrial society and economy have become absolutely dependent information technology, the Internet and cyber space. It is therefore imperative that our IT sector be protected.

Could terrorists, foreign governments or criminal hackers exploit vulnerabilities in our IT system, the Internet or cyber space to steal vital government or corporate records, sensitive defense or security information, or other data that could disrupt our society, economy and national defense? Could they introduce “worms,” computer viruses or other spyware or malware that could lead to devastating IT system failures and compromise national security? Are there effective risk assessment, risk management or mitigation measures that can reduce the threat or the consequences of hacking and cyber attacks? This crisis situation illustrates how our critical infrastructures are interrelated and interdependent.  

President Obama issued a Presidential Policy Directive #21 for Critical Infrastructure Security and Resilience, and an Executive Order for improving Critical Infrastructure Cybersecurity in 2013, and President Trump issued an Executive Order in 2017 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. However, to follow up and promote faster progress in this area of concern, he has requested a study of the Federal government's role to ensure IT security and cybersecurity. Senior DHS and national security officials are concerned that terrorists will escalate efforts to attack us through this sector. Your team has been invited to participate on the Presidential Action Team, which has an opportunity to help shape the President's agenda to further improve the protection of this particular CI/KR sector.

Your presentation should address the roles, responsibilities, capabilities and challenges or limitations of the Federal government in ensuring a secure IT system and cyber space. Is the SSP an adequate guide to prevent future major incidents, either from natural/accidental causes or from terrorist activity? Does the SSP need changes to account for lessons learned from recent hacking or cyber attack incidents? Are linkages needed between the IT SSP and the others to address the cybersecurity issue? How does the IT SSP relate to the Executive Orders and PPD-21? If actions are necessary beyond those in the SSP, provide specific recommendations with supporting evidence or logical argument for the President. Is the government organized effectively to address the threats, risks and vulnerabilities in this sector?

The actual output of the Project is a PowerPoint presentation for the President.

GUIDELINES

CONTENT

Your presentation might address the following for the U.S. Information Technology (IT) sector and cyber space:

· What is included in the U.S. IT System?

· Does the SSP limit its actions to specific or narrowly focused elements or aspects of the IT system, such as the Internet?

· Does the SSP address potential impacts on other critical infrastructures?

· Analysis of the IT system and cyber space using the SSP template for protecting the critical infrastructure:

· Define the IT sector and cyber space vulnerabilities.

· Specify protective measures to address these threats.

· Discuss risk management considerations (threats vs. vulnerabilities).

· Identify dependencies with other agencies, departments, and other organizations.

· Identify shortfalls in the current system.

· Are there lessons to be learned from any major hacking or cyber attack incidents that could drive changes to the SSP?

· Does the SSP need better linkages to the other SSPs?

· How does the IT SSP relate to President Obama’s Executive Order and PPD-21 of 2013, or President Trump’s Executive Order of 2017?

· Provide specific recommendations to the President for actions to improve the security posture of the U.S. in the context of this sector.

· Recommend any changes or elements that should be included in the updated version of the SSP for the IT sector.

Bottom line: This is your opportunity in about 20 slides/viewgraphs to inform the President on how to improve the security and protection of the U.S. IT sector and cyber space. The successful project will advise the President on how to improve the IT/cyber security using the SSP as a framework for defining the solutions.

FORMAT

Each team will prepare a short PowerPoint (or Prezi or Google Docs) presentation (approximately 20 slides) along with any relevant notes – either as notes on the slides or as a separate Word document.

DELIVERY

Each team should designate a leader/coordinator who will assume responsibility for posting the presentation. I’ll give further details as the due date gets closer. 

Your completed Group Project is due (posted as an attachment in the Group Project public discussion forum) March 20, the beginning of Week 9.

GRADING

Following are the holistic grading rubrics with criteria for each scoring level: Score Rubrics and Ratings 90- 100% Excellent. Exceeds expectations in terms of quality of analysis and critical thinking, with conclusions, recommendations or assertions strongly supported by sound evidence and logical argument. Succinctly synthesizes and applies key concepts and demonstrates mastery of the issues from multiple perspectives. Clearly and comprehensively addresses all the main points and sub-questions in each overall question. Thoroughly responds to one question from each module. Demonstrates substantive research and sound organization of the material. Superbly written, clear, coherent, and concise, with impeccable grammar, spelling, punctuation and sentence structure. Response demonstrates a high proportion of original work with limited reliance on direct quotes and paraphrasing. All acronyms, abbreviations or technical terms are clearly defined. Substantive in terms of length and content. Formatting and style comply with guidelines and instructions. Source citations consistently use proper APA style. Submitted early, or by the due date, or by the date indicated for an approved extension. 80-89% Good. Generally meets expectations in terms of quality of analysis and critical thinking, with conclusions, recommendations or assertions generally supported by evidence and logical argument. Synthesizes and applies key concepts and demonstrates grasp of the issues from a balanced perspective. Addresses most main points and sub-questions in each overall question. Satisfactorily responds to one question from each module. Demonstrates competent research and organization of material. Generally clear, coherent, and concise, with a few minor errors in grammar, spelling, punctuation or sentence structure. Response demonstrates a reasonable proportion of original work with some use of direct quotes or paraphrasing. Most acronyms, abbreviations or technical terms are defined. Sufficient in terms of length and substance. Formatting and style generally follow course guidelines, expectations and requirements. Source citations generally follow proper APA style, with few minor technical errors or inconsistencies. Submitted by the due date, or by the date indicated for an approved extension. 5 70-79% Satisfactory. Meets some, but not all, expectations in terms of quality of analysis and critical thinking, with conclusions, recommendations or assertions sometimes supported by evidence and logical argument. Generally synthesizes and applies key concepts and demonstrates some grasp of the issues. Addresses some, but not all, main points and sub-questions in each overall question. Responds to one question from each module Demonstrates satisfactory research and organization of material. Generally clear, coherent, and concise, but requires further editing to correct minor errors in grammar, spelling, punctuation or sentence structure. Response demonstrates some original work, but with heavy reliance on direct quotes or paraphrasing. Some, but not all, acronyms, abbreviations or technical terms are defined. Response meets only minimum expectations in terms of length and substance. Formatting and style comply with some, but not all, guidelines or instructions. Source citations do not consistently follow proper APA style. Responds to the required number of questions. Submitted by the due date, or by the date indicated for an approved extension. 60-69% Needs Improvement. Meets some, but not all, minimum expectations. Demonstrates limited analysis and critical thinking, but missing some elements, key points, or supporting evidence. Synthesis and application of key concepts is weak or inconsistent. Demonstrates superficial or minimal research, or incoherent organization of material. Not responsive to the main points and sub-questions in each overall question. Does not respond to one question from each module. Requires substantial editing to correct numerous errors in grammar, word choice, sentence structure, spelling or punctuation. Response demonstrates overreliance on direct quotes or paraphrasing in proportion to original work. Acronyms, abbreviations and technical terms are misused or not defined. Overly brief or incomplete, and only meets some of the minimum guidelines, expectations and instructions in terms of formatting and style. Missing some source citations, or the citations are not consistent with APA guidelines. Submitted late without an approved extension. 0-59% Unsatisfactory (Failure). Failed to respond to the question, or failed to meet expectations at a minimally acceptable level according to guidelines, instructions and requirements for this assignment. Excessive reliance on direct quotes or paraphrasing, with little evidence of original work. Little or no evidence of analysis, critical thinking, synthesis or grasp of issues. Poor written communications skills. Failed to follow instructions in terms of formatting, style, or source attribution. Response is very brief or demonstrates no evidence of research in appropriate sources to support assertions and conclusions. Evidence of plagiarism.