Cybersecurity "lanes in the road" for the Department of Homeland Security

Abstract

The roles and responsibilities for cybersecurity within the national government are not clearly delineated. This thesis asks if the current allocations of cybersecurity responsibilities to DHS are optimal for achieving national cybersecurity objectives. To answer this question, the evolution of cybersecurity policies within the United States is evaluated, looking specifically at DHS. Additionally, FBI, NSA/DOD, and DNI cybersecurity roles are identified. The Sony Pictures Entertainment cyber-attack is examined as a case study for how a real-world event is handled, and to determine the pros and cons of the current allocation of responsibilities. The evidence from the Sony cyber-attack suggests that the Secret Service, under DHS, is not ready to conduct a proper investigation for a cyber-attack but that the FBI is. This thesis identifies numerous responsibility allocation changes that would streamline cybersecurity at the national level. The main recommendations are that DHS should be the lead agency for improving and strengthening cybersecurity, while the FBI should be the lead agency for investigating cyber-attacks, unless the attack is against one of the people that the Secret Service protects, in which case they should become the lead investigator with direct support from the FBI.