The Federal Information Security Management Act requires agencies to report cyber incidents, which are defined as acts that violate computer security or acceptable-use policies.
Mischel Kwon, US-CERT’s director, said that the numbers represent both an increase in malware and improvements in the capabilities of US-CERT and agencies to detect and report cyber incidents. “Both parts of the story are true: There is an increase in mal events, and there is an increase in capabilities in order to detect those mal events.” Kwon added that the numbers were a bit deceiving because the reports are based on manual reporting by agencies and that there are few security operations centers that monitor federal agency networks.
US-CERT, the operational arm of DHS’ National Cyber Security Division, works to analyze and reduce threat capabilities throughout government and industry, disseminate warning information and coordinate incident response activities. US-CERT also runs Einstein, a federal network-monitoring system. It is in the process of deploying a second version of the system with enhanced capabilities.
Kwon added that visibility across the federal network and incident reporting will improve as the second version of Einstein is deployed and agencies continue to reduce the number of connections they have to Internet under the Trusted Internet Connection project.
http://fcw.com/Articles/2009/02/17/CERT-cyber-incidents.aspx