Just a few months after taking over the helm as the executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA), Jeff Greene laid out his priorities on Tuesday with partnerships topping the list.
Greene joined CISA in June, taking over the position after Eric Goldstein resigned. Greene said one of the first things he did when he stepped into his new role was to ask the CISA team: “What is something that we can change now where we think we’d have a significant impact that will have the maximum benefit as we look towards October, November, and December.”
The answer, he said, was partnerships – in particular CISA’s Joint Cyber Defense Collaborative (JCDC) program.
The JCDC – established by Congress in 2021 – aims to reduce cyber risk through continuous operational collaboration between trusted partners in the public and private sectors.
“This is really working. We’re sharing information. It’s created a platform, so that I think is working well,” Greene explained during an Oct. 1 event hosted by Federal News Network. “Where I’ve heard some confusion, and frankly, internally, folks agree we need to focus on is really defining what it means to be a long-term partner, and figuring out what different types of partners we have with JCDC.”
Greene said this means creating clear expectations of the partnership for both the external partners and CISA. For example, he said CISA understands that some partners are going to sign up for JCDC because it’s valuable to them and they might not engage fully – but that should be communicated between the two organizations.
“That is all okay, but there’s going to come a time when we’re going to need to engage with some partners a little more heavily, depending upon specific incidents,” Greene explained.
Nevertheless, Greene said that cybersecurity information sharing is in “a fundamentally different place than we were even just a few years ago.”
“The days of, ‘if only the government had shared,’ if they ever existed, are gone now,” he said. “And I don’t say that to be pushing hard at the private sector, but I say that to say, we all are our own best defenders now. We need to own our defenses and count on us, come to us.”
Another big priority for Greene is Volt Typhoon – the People’s Republic of China (PRC) state-sponsored cyber actor that is targeting critical infrastructure sectors in the United States and overseas.
“I worry about Volt Typhoon coming to be seen as a ‘flavor of the month’ kind of problem,” Greene said. “This is a generational long-term problem, whether it’s called Volt or something else, both the adversary and the techniques and the type of vulnerabilities that they’re taking advantage of … we need to make sure that that is a steady state, long-term effort.”
“So, I’m trying to think about it with the team, how we both address that from a technical standpoint, countering the adversary, fixing the problems, but also from a public standpoint, to make sure individual citizens understand it and think about what they can do, but also companies,” he added.
That sentiment is similar to Greene’s final priority he shared, which is leaning into CISA’s Secure by Design initiative.
The Secure by Design principles aim to keep Americans safe in today’s technology ecosystem by putting more cybersecurity responsibilities on technology manufacturers instead of on technology users.
“I don’t know why we accept a world where human frailty can lead to the compromise of massive networks or critical infrastructure or the theft of your wallet,” Greene said. “We need to not blame the victim for clicking on a wrong link … It’s a long-term fix, but institutionalizing that thinking is another priority of mine.”
