Eric Geller

Eric Geller @ericgeller

@HowellONeill thank you Pat — PolitiTweet.org

Eric Geller @ericgeller

@kevincollier ty for sharing — PolitiTweet.org

Eric Geller @ericgeller

@AndrewCouts thanks Andrew! — PolitiTweet.org

Eric Geller @ericgeller

@mastersonmv @CISAgov thanks Matt! — PolitiTweet.org

Eric Geller @ericgeller

@ASankin thank you friend — PolitiTweet.org

Eric Geller @ericgeller

Rex!!!!! Saw!! — PolitiTweet.org

Eric Geller @ericgeller

On the Q of new authorities, the officials said the Biden administration wants to work with Congress "to examine possible options, like mandatory incident reporting in some cases and for some entities," that would help CISA gather the data it needs to assess threats. — PolitiTweet.org

Eric Geller @ericgeller

"Where possible we do want to make sure that the public understands the impact of a given attack," sr official said, but "it is equally if not more important to convey the strategic view" of the hackers' goals, esp if those goals include "damaging attacks with physical impact." — PolitiTweet.org

Eric Geller @ericgeller

Hacks like this often produce "a level of ambiguity about what a particular adversary accessed or what their intent was," one senior official said, so discussing "impacts as individualized as a given user account would likely be speculative." — PolitiTweet.org

Eric Geller @ericgeller

Multiple reporters asked officials for more transparency about the specific impacts of SolarWinds, amid reports of specific Trump Cabinet secretaries being hacked. Officials declined to get that specific, saying the hackers' exact movements aren't crystal clear. — PolitiTweet.org

Eric Geller @ericgeller

DHS is in the middle of "an in-depth lessons-learned exercise" about SolarWinds and Exchange that will lead to "a set of recommendations that will guide our work for the administration moving forward," one senior official said. Unclear how that will overlap with the imminent EO. — PolitiTweet.org

Eric Geller @ericgeller

But sr official noted that things could get even worse and that CISA wants to be ready. "We do have capacity yet to deploy, but recognizing the evolving environment, we want to make sure that we are moving ahead of the point where we may see capacity constraint." — PolitiTweet.org

Eric Geller @ericgeller

“Our capacity remains within the parameters of our demand signal at this point in time," sr official said. "At no point during [SW/Exchange] did CISA need to turn away a compromised entity that was seeking help." — PolitiTweet.org

Eric Geller @ericgeller

Not sure if it's b/c they saw my story this morning https://t.co/GIXpY11Hdj but one senior DHS official was adamant that CISA has enough resources to respond to the requests for help that it's getting right now. Quote in next tweet. — PolitiTweet.org

Eric Geller @ericgeller

DHS Sec Mayorkas will be discussing cyber tomorrow during an RSA event. Per sr official, he will offer a "comprehensive vision" for using DHS/CISA to defend the country, incl through several "cybersecurity sprints" that he previously teased. 1st sprint will focus on ransomware. — PolitiTweet.org

Eric Geller @ericgeller

We've previously heard from Anne Neuberger that the Biden administration has an EO coming with mitigations related to the SolarWinds/Exchange vulnerabilities. Today, a senior DHS official told us that it will contain "close to a dozen actions." — PolitiTweet.org

Eric Geller @ericgeller

DHS just wrapped up a background briefing with senior officials on the department's cybersecurity agenda. Nothing earth-shattering, but I'll share a few comments that stood out to me. — PolitiTweet.org

Eric Geller @ericgeller

Great question! One thing I wasn't able to get into my story is that, in the FY21 NDAA, Congress allowed CISA to proactively hunt for threats on other agencies' networks without being invited in. This should greatly increase their visibility. It was their big recent ask. — PolitiTweet.org

Eric Geller @ericgeller

CISA is in a difficult spot. Its reputation suffers with every major breach it misses — even if it's not realistic to expect it to catch everything; certainly its foreign-focused counterparts don't — and every reputational hit jeopardizes its partners' all-important trust. — PolitiTweet.org

Eric Geller @ericgeller

As @CostelloJK pointed out, CISA has unique advantages. Companies and state/local govts trust it in a way they don't trust NSA/FBI. As a result, it gets unique domestic cyber threat insights. If it falters, other agencies won't be able to pick up its slack. — PolitiTweet.org

Eric Geller @ericgeller

CISA is in the process of fixing some of these problems. It's investing in new network sensors and data analysis capabilities so it can spot and understand problems before they blossom into crises. But it needs more $ & a more mature hiring process to sustain growth & progress. — PolitiTweet.org

Eric Geller @ericgeller

One of CISA's biggest problems: its two main programs for monitoring federal networks, CDM and the National Cybersecurity Protection System, are out of date. They'll need major upgrades to handle novel malware, ubiquitous encryption, cloud services, and identity-based attacks. — PolitiTweet.org

Eric Geller @ericgeller

There's bipartisan support for boosting CISA's budget. Both @BennieGThompson and @RepJohnKatko told me that CISA needs more money to meet policymakers' expectations. https://t.co/112Ho8n73H — PolitiTweet.org

Eric Geller @ericgeller

CISA Cyber Division chief Eric Goldstein, one of those new political appointees, told me that CISA isn't yet "having to make triaging decisions" about what cyber aid to offer, and to whom — but he added that regular funding boosts would ensure that that remains the case. — PolitiTweet.org

Eric Geller @ericgeller

Even though many employees are "exhausted," as one put it, they're still optimistic about their agency's future. They love their mission and hope new Biden admin leadership will get them what they need. — PolitiTweet.org

Eric Geller @ericgeller

I talked to 15 people familiar with CISA’s work, including 4 current employees and 5 former CISA officials. Some of the problems they described: * Far too few hunt & incident response teams * Not enough $ for risk management center * Not enough data analysis capabilities https://t.co/BXGQJsplzM — PolitiTweet.org

Eric Geller @ericgeller

New: The U.S.' cyber agency is underfunded, overwhelmed, and struggling to keep up with evolving threats. @CISAgov got $650m in the Covid-19 bill, but experts say it'll need a lot more support to have a chance of stopping the next SolarWinds. My story: https://t.co/GIXpY11Hdj https://t.co/Xx5qQUoE4O — PolitiTweet.org

Eric Geller @ericgeller

"The participants conceded that the bill...was so popular that it wasn’t worth trying to mount a public-advocacy campaign to shift opinion. Instead, a senior Koch operative said that opponents would be better off ignoring...American voters & trying to kill the bill in Congress." — PolitiTweet.org

Eric Geller @ericgeller

https://t.co/BRgSf0ajBL — PolitiTweet.org

Eric Geller @ericgeller

It turns out that one of the best times to visit the Tidal Basin during cherry blossom season is when all the tourists are afraid of a rain forecast that turns out to be inaccurate. 🌸 https://t.co/U5ptORWGp7 — PolitiTweet.org