Following the introduction of two similar bills in the Senate in July, Rep. Michael McCaul (R-Texas) on July 30 introduced legislation to give the Department of Homeland Security (DHS) authority for strengthening the cyber security of federal civilian agency networks.
“In light of the massive OPM hacks, it’s clear that our nation’s federal digital infrastructure isn’t capable of effectively detecting and defending against these cyber threats,” McCaul, chairman of the House Homeland Security Committee, said in a statement. “Currently, the Department of Homeland Security’s hands are tied in responding to ever growing cyber threats. Providing DHS with similar abilities to defend federal networks that the Department of Defense uses to protect military networks is commonsense legislation.”
The Cyber Defense of Federal Networks Act of 2015 (H.R. 3313) provides similar authorities granted in two new bipartisan bills introduced in the Senate, the Federal Cybersecurity Enhancement Act (S. 1869) and the Federal Information Security Management Reform Act (S. 1828). McCaul’s bill sets a one-year deadline for DHS, working with the Office of Management and Budget (OMB), to “develop and implement an intrusion detection and response plan to detect, identify, and remove intruders in agency information systems.”
The bills come close on the heels of the disclosure in June that the federal Office of Personnel Management (OPM) had more than 21 million digital personnel records stolen—possibly by cyber hackers in China—including background checks, biometric and other records.
McCaul’s bill would also give DHS authority to deploy cyber security tools at federal agencies and ensure these agencies are prioritizing the use of these tools. Currently DHS manages the EINSTEIN intrusion detection and prevention system to protect federal civilian networks but it is only deployed across about 45 percent of agencies. Civilian agencies have to give permission to DHS to monitor their networks and deploy cyber security tools but there is uncertainty around DHS’s authorities and whether agencies can participate.
McCaul’s legislation, which includes Rep. John Ratcliffe (R-Texas) as a co-sponsor, also directs DHS and OMB to assess and require best practices for agencies to protect against network intrusions and prevent data from being exfiltrated. The bill also allows DHS to do targeted risk assessments and operational evaluations of agency information and information systems.
Moreover, if an incident has occurred or is suspected, DHS “may issue a directive to a head of an agency to take any lawful action with respect to the operation of the information system, including such systems owned or operated by another entity on behalf of the agency,” the bill says.