1. UNCLASSIFIED Homeland Security Introduction to the National Cybersecurity & Communications Integration Center (NCCIC) “A Partnership for Strength” 1

2. UNCLASSIFIED Homeland Security NATIONAL CYBER SECURITY AWARENESS MONTH A collaborative effort, celebrated each October, between government and industry to raise awareness about staying safe online Formally recognized by the President, Congress, and leaders from industry and academia International reach and support from partners such as Canada, the European Union, and Japan 2015 marks National Cyber Security Awareness Month’s (NCSAM) 12th year, spreading cybersecurity awareness across the nation

3. UNCLASSIFIED Homeland Security NCSAM 2015 Each week in October is dedicated to a specific cybersecurity theme. The five themes listed below offer the opportunity for government and industry to get involved in cybersecurity activities most relevant to them. Week 1, October 1-2 – General Cybersecurity Awareness: 5 Years of Stop.Think.Connect.™ Week 2, October 5-9 – Creating a Culture of Cybersecurity at Work Week 3, October 12-16 – Connected Communities: Staying Protected While Always Connected Week 4, October 19-23 – Your Evolving Digital Life Week 5, October 26-30 – Building the Next Generation of Cyber Professionals

4. UNCLASSIFIED Homeland Security GET INVOLVED Join us this NCSAM by educating and empowering your community to take steps to protect themselves and their families online: –Promote NCSAM in your organization or community –Become a NCSAM Champion –Participate in NCSAM 2015 Twitter chats For more info: http://www.stopthinkconnect.org/get- involved/twitter-chats/ –Attend a NCSAM event in your area –Use the NCSAM hashtag – #CyberAware – to promote your organization’s involvement in raising cybersecurity awareness Learn more at: www.dhs.gov/national-cyber-security-awareness-month www.StaySafeOnline.org/ncsam

5. UNCLASSIFIED Homeland Security STAY INVOLVED Stay involved with DHS’s Stop.Think.Connect. Campaign year-round: –Become a Stop.Think.Connect. Campaign partner to formally adopt the Campaign messaging and share materials and resources from DHS with your organization –Sign up to become a Friend of the Campaign and receive regular updates Learn more at: www.dhs.gov/StopThinkConnect Email: stopthinkconnect@dhs.gov

6. UNCLASSIFIED Homeland Security NCCIC Overview and Mission NCCIC Overview - -Operates at the intersection of the network defense, private sector, civilian, law enforcement, intelligence, and defense communities - cybersecurity and communications domains NCCIC Mission – -Apply unique analytic perspectives -Ensure shared situational awareness -Orchestrate synchronized response efforts -Protect the Constitutional and privacy rights of Americans 6

7. UNCLASSIFIED Homeland Security We NEED to Think Differently - A New Paradigm for Security Security breaches are inevitable Leadership must OWN the problem Manage Risk – build into security – threat centric Situational Awareness - vital Resilience is ESSENTIAL - operate through compromise Compliance is NOT security Partnership between government and industry is critical Culture Shift – Reactive to PROACTIVE!!! 3

8. UNCLASSIFIED Homeland Security Dynamic cyber defense SOC, CSIRC, C&A, Policy Traditional Cyber Security SOC, CSIRC, C&A, Policy IT/Network Mission Security User Behavior Deep Net Awareness Information Sharing Intelligence Leadership Resilience 4

9. UNCLASSIFIED Homeland Security When should it be used?TLP ColorHow may it be shared? Sources may use TLP: RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party’s privacy, reputation, or operations if misused. RED Recipients may not share TLP: RED information with any parties outside of the specific exchange, meeting or conversation in which it is originally disclosed. Sources may use TLP: AMBER when information requires support to be effectively acted upon, but carries risks to privacy, reputation, or operations if shared outside of the organizations involved. AMBER Recipients may only share TLP: AMBER information with members of their own organization, and only as widely as necessary to act on that information. Sources may use TLP: GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. GREEN Recipients may share TLP: GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Sources may use TLP: WHITE when information carries minimal or no risk of misuse, in accordance with applicable rules and procedures for public release. WHITE TLP: WHITE information may be distributed without restriction, subject to copyright controls. Traffic-Light Protocol (TLP): Originator-controlled classification system developed to encourage greater sharing of sensitive (but unclassified) information with external entities. Protection of Information 9

10. UNCLASSIFIED Homeland Security Protection of Information (cont.) Protected Critical Infrastructure Information (PCII) Information-protection program –enhances voluntary information sharing between infrastructure owners and operators and the government PCII protections –Guarantee shared information will not lead to the exposure of sensitive or proprietary data 10

11. UNCLASSIFIED Homeland Security So What? -Understand Threat Landscape -Leadership OWNS a New Paradigm! -Consider Cybersecurity Framework -Implement 20 Critical Security Controls -Change – Reactive to Proactive – Intelligence & Information Sharing 7

12. UNCLASSIFIED Homeland Security 12