U.S. CISO wants to lean on freelance hackers to improve .gov security

The U.S.’ first Chief Information Security Officer outlined a series of strategic plans he hopes to execute during his tenure, including the possible expansion of a bug bounty program across all .gov domains.

The U.S.’ first Chief Information Security Officer outlined Tuesday a series of strategic plans he hopes to execute during his tenure including the possible expansion of a massive bug bounty program across all .gov domains.

Gregory Touhill, formerly the deputy assistant secretary for cybersecurity and communications in the Department of Homeland Security’s Office of Cybersecurity and Communications, was named to the CISO position roughly six months after the White House first announced plans — via the Cybersecurity National Action Plan, or CNAP — to create such an office. He is primarily responsible for leading cyber practices across federal agencies.

“You’re going to see us do an increased push to field and use the tools and capabilities of CDM, continuous diagnostic and mitigation, so we can better do the right things the right way. It’s not just the technology, it’s also creating some new capabilities that have not been there before; such as actively looking with hunt teams through .gov for hackers, it’s improve our pen testing, it’s incorporating software assurance and perhaps a bug bounty across the federal government,” Touhill said during a speech at the 2016 AFCEA DC Cybersecurity Summit.

He added, “frankly, if I had it my way, we would do a bug bounty across .gov and the program office in charge of the source code would reimburse the bug bounty pool once a bug is discovered.”

Key to improving the government’s digital security, according to Touhill, is the establishment of fixed, transparent metrics to judge the progress and performance of different agencies over time. In this vein, a federal CISO Council — much like the existing CIO Council, which brings together federal chief information officers from different agencies to collaborate and share best practices — is in the works.

Touhill, in recent weeks, has also been in touch with the Department of Education. He is working on a broad effort to help build the U.S.’ future cybersecurity workforce by, among other things, advocating for the inclusion of computer science-related educational opportunities at earlier ages in the public schooling system. One of his related ideas in this space is a cybersecurity awareness campaign aimed at children, which centers on a McGruff the Crime Dog-like mascot named “Byte.”

In the short-term, Touhill said a cyber.gov website will be launched in the coming months to provide basic digital security educational resources, best practices and tips for keeping good cyber hygiene. This online platform will become a centerpiece for free, updated cybersecurity recommendations and information for both federal agencies and private sector partners.

Touhill, who was named to the position on Sept. 8, said he fully expects to continue in his role as CISO beyond the upcoming election and into the next administration regardless of who becomes president. 

HackerOne urges U.S. to advocate for research protections in UN cybercrime treaty

The company responsible for bug bounty platforms warns in a letter to top U.S. officials that the treaty’s vague language could undermine ethical security research.

HackerOne, Verizon Media weigh pros and cons of making live hacking contests virtual

As FireEye grapples with breach investigation, questions remain

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure