70RSAT19RB00000001_-_3_NRMC_Brief_5-16-2019.pdf

Presenter’s Name May 21, 2019

C I S A | C Y B E R S E C U R I T Y A N D I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y

NATIONAL RISK

MANAGEMENT CENTER

(NRMC) OVERVIEW AND

KEY EFFORTS

May 16, 2019

National Risk Management Center (NRMC)

The NRMC is CISA’s planning, analysis, and collaboration center working to identify and address the most significant risks to the Nation’s critical infrastructure.

The NRMC works in close coordination with other divisions and components of CISA including the Cybersecurity Division, Infrastructure Security Division, Emergency Communications Division, and National Cybersecurity and Communications Integration Center.

TLP:WHITE

National Critical Functions

The functions of government and the private sector so vital to the United States that their disruption, corruption, or dysfunction would have a debilitating impact on either the Nation’s security, economic security, public health or safety, or any combination thereof.

National Critical Functions

Better captures cross-cutting risks and associated dependencies.

It’s not who you are. It’s the functions you produce or enable.

Featured prominently in the National Cyber Strategy and DHS Cybersecurity Strategy.

National Critical Functions set the stage for:

1. Support for Infrastructure

Prioritization

2. Conducting Subordinate Analysis

3. Informing Intelligence Collection

Requirements

4. Setting Incident Management Priorities

5. Supporting Investments in Security and Resilience

6. Countering Foreign Influence

National Critical Functions

SUPPLY DISTRIBUTE MANAGE CONNECT

Exploration and Extraction Of

Fuels Fuel Refining and Processing

Fuels Generate Electricity Manufacture Equipment Produce and Provide Agricultural

Products and Services Produce and Provide Human and

Animal Food Products and Services

Produce Chemicals Provide Metals and Materials Provide Housing Provide Information Technology

Products and Services Provide Materiel and Operational

Support to Defense Research and Development Supply Water

Distribute Electricity Maintain the Supply Chain Transmit Electricity Transport Cargo and Passengers by Air Transport Cargo and Passengers by Rail Transport Cargo and Passengers by Road Transport Cargo and Passengers by Vessel Transport Materials by Pipeline Transport Passengers by Mass

Transit

Conduct Elections Develop and Maintain Public Works and Services Educate and Train Enforce Law Maintain Access to Medical Records Manage Hazardous Materials Manage Wastewater Operate Government Perform Cyber Incident

Management Capabilities Prepare For and Manage Emergencies Preserve Constitutional Rights Protect Sensitive Information Provide and Maintain Infrastructure Provide Capital Markets and

Investment Activities Provide Consumer and Commercial

Banking Services Provide Funding and Liquidity Services Provide Identity Management and

Associated Trust Support Services Provide Insurance Services Provide Medical Care Provide Payment, Clearing, and

Settlement Services Provide Public Safety Provide Wholesale Funding Store Fuel and Maintain Reserves Support Community Health

Operate Core Network Provide Cable Network Services Provide Internet Based Content, Information, and Communication Services

Provide Internet Routing, Access and Connection Services

Provide Positioning, Navigation, and Timing Services

Provide Radio Broadcast Access Network Services

Provide Satellite Access Network Services

Provide Wireless Access Network Services

Provide Wireline Access Network Services

ICT Supply Chain Risk Management Task Force

NRMC Director serves as the government co-chair.

Task Force includes 20 members each from the IT Sector, Communications

Sector, and the interagency.

Task Force recently launched four main work streams:

Developing a common framework for the bi-directional sharing of supply chain risk information between government and industry.

Identification of processes and criteria for threat-based evaluation of ICT supplies, products, and services.

Identification of market segment(s) and evaluation criteria for Qualified Bidder and

Manufacturer List(s).

Producing policy recommendations to incentivize the purchase of ICT from original equipment manufacturers or authorized resellers.

Task Force intends to be one of the primary touch points between government and industry for the newly created Federal Acquisition Security Council.

May 16, 2019 7

ICT Supply Chain Assessment

CISA is coordinating with industry to develop an ICT Supply Chain Risk Assessment that will analyze a number of key questions that will enable better contextualization of ICT risks.

CISA is assessing ICT supply chain risk with a phased approach.

The first phase will look to develop a common taxonomy for ICT hardware, software, and services.

The next phase will explore what entities, hardware, software, and services present the greatest vulnerabilities in U.S. infrastructure. Specifically:

Identifying and assessing the most critical classes of ICT hardware, software, and services (ICT elements).

Identifying and assessing the most critical manufacturers and providers of critical

ICT elements.

Identifying and assessing the most critical U.S. entities whose use of compromised

ICT elements would pose the greatest potential consequences.

5G Risk Characterization

CISA is coordinating with industry and federal partners to assess 5G risk.

CISA is working to characterize and analyze the opportunities and risks 5G adoption may introduce, and help inform risk management decisions regarding 5G development and implementation.

CISA's analysis includes reviewing 5G supply chain risk, but also goes deeper into 5G specific challenges such as network architecture and integration with legacy cellular networks.

CISA has conducted an initial review of the potential vulnerabilities of 5G, and the likelihood of those vulnerabilities being exploited.

Potential 5G Vulnerabilities

Supply Chain Risk Management - Use of 5G components that contain vulnerabilities could expose the U.S. to supply chain risks.

Network vulnerabilities - 5G builds upon previous generations of wireless networks and will be integrated with 4G LTE networks that contain some legacy vulnerabilities.

Interoperability - Interoperability of 5G technologies will be a key factor in how quickly and securely 5G is deployed.

Security Enhancements – Security features are being built into 5G to mitigate vulnerabilities and manage risks, but without proper implementation, some of these security features will be less effective.

5G Big Questions

How can we secure the supply chain and ensure we are using secure components?

How will network security be impacted, both positively and negatively, by the move to the edge with 5G?

How will legacy vulnerabilities in the telecommunication infrastructure impact the deployment of 5G? What new vulnerabilities are introduced by 5G?

What new security features are introduced by 5G?

How is vulnerable equipment being used both domestically and abroad? What are the consequence from their use?

What will the consequences be if and when 5G is unavailable? What fail-safes will be required for critical, 5G-dependent technologies?

May 16, 2019 12

For more information:

cisa.gov