How CISA Is Charting a Path Toward Defensible Infrastructure
summary
CISA maps the CISA Services Catalog into the Cyber Defense Matrix to spot gaps, then evaluates agency posture with five layers: recipes, pantry, grocery store, allergies, nutritional needs and recommends concrete fixes — require SBOMs and coordinated vulnerability disclosure, enforce MFA or 90‑day credentials, rebuild compromised Exchange hosts as ephemeral VMs/containers, and prefer cloud/serverless to eliminate pets. The proof‑of‑concept CISA stack is testing agencies and commercial vendors to prioritize adopting the D.I.E. (distributed immutable ephemeral) model to reduce attack impact.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:36Rugged DevOps and Defensible Infrastructure
- 6:28Qualities of Rugged DevOps
- 10:05CISA's Mission
- 10:33We Defend Today through CIA-centric countermeasures to address deficiencies from indefensible infrastructure
- 11:17The "CISA Stack" and the Cyber QSMO
- 13:07The Cyber Defense Matrix serves as a foundation of the CISA Stack...
- 13:55and enable easier discovery of gaps and opportunities
- 14:05Mapping the existing CISA Services Catalog...
- 15:04The revised CISA Stack is made up of several layers that enable CISA to profile each Federal Agency's needs Foundation
- 17:53Each layer is mapped to the Cyber Defense Matrix
- 18:43A combined view of all the layers provides a way to understand how our constraints affect our options
- 21:43Qualities of Defensible Infrastructure: The DIE Triad A
- 23:01The CIA Alternative: An Endless Conveyor Belt of Vulnerabilities and Threats
- 24:16Pets vs Cattle
- 26:15Applying DIE to Move Towards Defensible Infrastructure
- 27:50Adding Adversary Constraints
- 29:00Applying DIE to Build Back Better
- 32:01Exchanging Pets for Cattle Creative Interpretation Emergency Directive 21-02
- 39:53Applying What You Have Learned Today Next week - Identify your pets and indefensible Infrastructure Make sure you have cyber veterinarians for your cyber pets
related talks
52mData-Driven Cyber Policy: From Dream to Reality
01h 05mWhat It Takes to Lead America’s Vulnerability Management Team
45mFrom Attacks to Action: An Open Community Model to Drive Defensive Choices
26mHow CISA is approaching authentication and cloud security in the era of great power competition?
01h 03mEvery CISO’s First 90 Days on the Job
29mCreating an Information Security/Information Assurance Program - Lessons Learned
40mUnsafe At Any Speed: CISA's Plan to Foster Tech Ecosystem Security
37mMore Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19