Einstein (US-CERT program)

From Wikipedia, the free encyclopedia

EINSTEIN
Developed by	US-CERT
Initial release	2004
Genre	network security and computer security
Website	Analytical Tools and Programs at US-CERT for government users

Einstein also known as the EINSTEIN Program is an intrusion detection system that monitors the network gateways of government departments and agencies in the United States for unauthorized traffic. The software was developed by the United States Computer Emergency Readiness Team (US-CERT),^[1] which is the operational arm of the National Cyber Security Division^[2] (NCSD) of the United States Department of Homeland Security (DHS).^[3] The first version examined network traffic while the expansion in development could look at content.^[4]

Contents 1 Mandate 2 Adoption 3 Features 4 Presidential directive NSPD 54 5 Expansion 6 Privacy 7 Notes 8 External links

[edit] Mandate

Einstein is the product of U.S. congressional and presidential actions of the early 2000s including the E-Government Act of 2002 which sought to improve U.S. government services on the Internet. Originating at the National Institute of Standards and Technology and subsequently moved to the General Services Administration, FedCirc was one of four watch centers that were protecting federal information technology^[6] when the act designated it the primary incident response center.^[7] With FedCirc at its core, US-CERT formed in 2003 as a partnership between the newly created DHS and the CERT Coordination Center which is funded at Carnegie Mellon University by the U.S. Department of Defense.^[6] US-CERT delivered Einstein to meet statutory and administrative requirements that DHS help protect federal computer networks and the delivery of essential government services.^[1] Its mandate originated in the Homeland Security Act and the Federal Information Security Management Act, both in 2002, and the presidential directive named Homeland Security Presidential Directive (HSPD) 7^[1] which was issued on December 17, 2003.^[8]

[edit] Adoption

Einstein was deployed in 2004^[1] and until 2008 was voluntary.^[9] By 2005, three federal agencies participated and funding was available for six additional deployments. By December 2006, eight agencies participated in Einstein and by 2007, DHS itself was adopting the program department-wide.^[10] By 2008, Einstein was deployed at fifteen^[11] of the nearly six hundred agencies, departments and Web resources in the U.S. government.^[12]

[edit] Features

When it was created, Einstein was "an automated process for collecting, correlating, analyzing, and sharing computer security information across the Federal civilian government."^[1] Einstein does not protect the network infrastructure of the private sector.^[13] As described in 2004, its purpose is to "facilitate identifying and responding to cyber threats and attacks, improve network security, increase the resiliency of critical, electronically delivered government services, and enhance the survivability of the Internet."^[1]

Einstein was designed to resolve the six common security weaknesses^[1] that were collected from federal agency reports and identified by the OMB in or before its report for 2001 to the U.S. Congress.^[14] In addition, the program addresses detection of computer worms, anomalies in inbound and outbound traffic, configuration management as well as real-time trends analysis which US-CERT offers to U.S. departments and agencies on the "health of the Federal.gov domain".^[1] Einstein was designed to collect session data including:^[1]

• Autonomous system numbers (ASN)
• ICMP type and code
• Packet length
• Protocol
• Sensor identification and connection status (the location of the source of the data)
• Source and destination IP address
• Source and destination port
• TCP flag information
• Timestamp and duration information

US-CERT may ask for additional information in order to find the cause of anomalies Einstein finds. The results of US-CERT's analysis are then given to the agency for disposition.^[1]

[edit] Presidential directive NSPD 54

As the number of actual attacks as well as perceived threats to U.S. networks increased during the mid-2000s, Einstein became mandatory. U.S. departments and agencies had reported a large increase in security incidents for 2007.^[15] The U.S. Department of State, Department of Commerce, Department of Defense and Department of Homeland Security itself experienced attacks during late 2006 and early 2007.^[13] A presidential directive was discussed in 2007 and issued on January 8, 2008 and is known by three names: National Security Presidential Directive (NSPD) 54, HSPD 23 and the Cyber Initiative.^[16][13] Although the directive and its details are classified, it is public information that Einstein is no longer optional.^[9]

Following NSPD 54, three agencies were authorized to conduct domestic intrusion detection in addition to DHS: the National Security Agency (NSA), Central Intelligence Agency (CIA) and the Cyber Division of the Federal Bureau of Investigation (FBI).^[13] The NSA has a "twofold mission" to protect U.S. information systems and to produce foreign signals intelligence information, but previously had been "authorized by law to collect only foreign intelligence information".^[17] A task force led by the office of the Director of National Intelligence became responsible for efforts to identify the source of attacks, and the Pentagon was authorized to develop counterattacks.^[13]

It was decided that DHS lacked the "expertise and authority" to lead the effort, for example, the Office of Management and Budget (OMB) had assessed a Federal Emergency Management Agency/DHS division as not demonstrating results.^[18] DHS was directed to protect systems^[13] and as of 2008 remained the lead "for assuring the security, resiliency and reliability" of the nation's information technology and "communications infrastructure".^[19] US-CERT remained the department's response center responsible for the nation's "Internet infrastructure".^[19] DHS continued to promote Einstein and the goal of its use in all federal agencies and departments.^[19]

[edit] Expansion

Three constraints on Einstein that the DHS is trying to address are the large number of access points to U.S. agencies, the low number of agencies participating, and the program's "backward-looking architecture".^[20] A "Trusted Internet Connections" initiative was expected to reduce the government's 4,000 access points to 50 or fewer by June 2008.^[21] A new version of Einstein in 2008 in addition would "collect network traffic flow data in real time and also analyze the content of some communications, looking for malicious code, for example in e-mail attachments."^[22] The expansion is known to be one of at least nine measures to protect federal networks.^[19] Einstein could be enhanced to create an early warning system to predict intrusions.^[20]

[edit] Privacy

A Privacy Impact Assessment (PIA) for the first version is available from 2004,^[1] and a new PIA is expected before deployment of the expanded Einstein.^[9][4] According to the DHS privacy assessment for US-CERT's 24x7 Incident Handling and Response Center in 2007, US-CERT data is provided only to those authorized users who "need to know such data for business and security purposes" including security analysts, system administrators and certain DHS contractors. Incident data and contact information are never shared outside of US-CERT and contact information is not analyzed. To secure its data, US-CERT's center began a DHS certification and accreditation process in May 2006 and expected to complete it by the first quarter of fiscal year 2007. As of March 2007, the center had no retention schedule approved by the National Archives and Records Administration and until it does, has no "disposition schedule"—its "records must be considered permanent and nothing may be deleted".^[23]

[edit] Notes

[edit] External links

• US-CERT (September 2004). Privacy Impact Assessment: EINSTEIN Program (PDF). U.S. Department of Homeland Security, National Cyber Security Division. Retrieved on 2008-05-13.
• Privacy Impact Assessment for the 24x7 Incident Handling and Response Center (PDF). U.S. Department of Homeland Security (March 29, 2007). Retrieved on 2008-05-14.
• Einstein. TechTarget. Retrieved on 2008-05-14.