Cyber Defense of Federal Networks Act of 2015

To amend the Homeland Security Act of 2002 to strengthen the ability of the Secretary of Homeland Security to detect and prevent intrusions against, and to use countermeasures to protect, agency information systems, and for other purposes. 1. Short title This Act may be cited as the Cyber Defense of Federal Networks Act of 2015 2. Cyber defense of Federal networks (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. 230. Cybersecurity plans (a) Intrusion detection and response plan Not later than one year after the date of the enactment of this section, the Secretary, in coordination with the Director of the Office of Management and Budget, shall develop and implement an intrusion detection and response plan to detect, identify, and remove intruders in agency information systems. The Secretary, in coordination with the Director, shall update such plan as necessary. (b) Exception The intrusion detection and response plan required under subsection (a) shall not apply to the Department of Defense or an element of the intelligence community. (c) Definitions In this section and sections 231, 232, and 233: (1) Agency The term agency (2) Cybersecurity risk The term cybersecurity risk (3) Information system The term information system (4) Intelligence community The term intelligence community 50 U.S.C. 3003(4) 231. Advanced internal defenses (a) Advanced network security tools (1) In general The Secretary shall include in the Department’s efforts to continuously diagnose and mitigate cybersecurity risks advanced network security tools to improve visibility of network activity, including through the use of commercial and free or open source tools, to detect and mitigate intrusions and anomalous activity in agencies’ information systems. (2) Development of plan The Secretary, in coordination with the Director of the Office of Management and Budget, shall develop and implement a plan to ensure advanced network security tools, including tools described in paragraph (1), to detect and mitigate intrusions and anomalous activity are available for use by each agency. (b) Prioritizing advanced security tools The Secretary, in coordination with the Director of the Office of Management and Budget, and in consultation with the heads of appropriate agencies, shall— (1) review and update operational capabilities to ensure appropriate prioritization and use of network security monitoring tools within such agency networks; and (2) brief the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate on such prioritization and use. (c) Improved metrics The Secretary, in coordination with the Director of the Office of Management and Budget, shall review and update the metrics used to measure security under section 3554 of title 44, United States Code, to include measures of intrusion and incident detection and response times. (d) Transparency and accountability The Secretary, in coordination with the Director of the Office of Management and Budget, shall increase transparency to the public on agency cybersecurity postures, including by increasing the number of metrics available on Federal Government performance websites and, to the greatest extent practicable, displaying metrics for agencies. (e) Maintenance of technologies Subparagraph (B) of section 3553(b)(6) of title 44, United States Code, is amended by inserting , operating, and maintaining deploying 232. Federal cybersecurity best practices The Secretary, in consultation with the Director of the Office of Management and Budget, shall regularly assess and require implementation of best practices for— (1) securing agency information systems against intrusion; and (2) preventing data exfiltration from such systems in the event of an intrusion. 233. Assessment; reports (a) Definitions In this section: (1) Appropriate congressional committees The term appropriate congressional committees (2) Intrusion assessments The term intrusion assessments (3) Intrusion detection and response plan The term intrusion detection and response plan (b) GAO assessment Not later than three years after the date of the enactment of this section, the Comptroller General of the United States shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Department’s capabilities and plans in securing agency information systems, including in the plans and assessments under sections 230, 231, and 232. (c) Report to Congress The Secretary, in coordination with the Director of the Office of Management and Budget, shall— (1) not later than six months after the date of the enactment of this section and 30 days after any update thereto, submit to the appropriate congressional committees the intrusion detection and response plan described in section 230; and (2) not later than one year after the date of the enactment of this section and annually thereafter, submit to Congress— (A) a description of the implementation of such intrusion detection and response plan; (B) the findings of the intrusion assessments conducted pursuant to such intrusion detection and response plan; (C) a description of the advanced network security tools referred to in section 231; (D) information relating to the results of the assessment of the Secretary of Federal cybersecurity best practices under section 232; and (E) the improved metrics referred to in section 231. . (b) Definitions Paragraphs (1) and (2) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 (1) (A) except as provided in subparagraph (B), the term cybersecurity risk (B) such term does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement; (2) the term incident . (c) Clerical amendments The table of contents for subtitle C of title II of the Homeland Security Act of 2002 is amended by adding at the end the following new items: Sec. 230. Cybersecurity plans. Sec. 231. Advanced internal defenses. Sec. 232. Federal cybersecurity best practices. Sec. 233. Assessment; reports. . 3. Duties of the Secretary of Homeland Security related to information security Section 3553(b)(6) of title 44, United States Code, is amended by striking subparagraphs (C) and (D) and inserting the following: (C) providing incident detection, analysis, mitigation, and response information, disseminating related homeland security information, and providing remote or onsite technical assistance to the head of an agency; (D) compiling and analyzing data on agency information security and disseminating related homeland security information; (E) developing and conducting targeted risk assessments, including assessments of the risk of terrorism, and operational evaluations for agency information and information systems in consultation with the heads of other agencies or governmental and private entities that own and operate such systems, that may include threat, vulnerability, and impact assessments; (F) in conjunction with other agencies and the private sector, assessing and fostering the development of information security technologies and capabilities for use across multiple agencies; and (G) coordinating with appropriate agencies and officials to ensure, to the maximum extent feasible, that policies and directives issued under paragraph (2) are complementary with— (i) standards and guidelines developed for national security systems; and (ii) policies and directives issued by the Secretary of Defense and the Director of National Intelligence under subsection (e)(1); and . 4. Directives and imminent threats Section 3553 of title 44, United States Code, is amended by adding at the end the following: (h) Direction to agencies (1) Authority (A) In general Notwithstanding section 3554, and subject to subparagraph (B), in response to a known or reasonably suspected information security threat, vulnerability, risk, or incident, including an act of terrorism, that represents a substantial threat to the information security of an agency, the Secretary may issue a directive to the head of an agency to take any lawful action with respect to the operation of the information system, including such systems owned or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information, for the purpose of protecting the information system from, or mitigating, an information security threat or an act of terrorism. (B) Exception The authorities of the Secretary under this subsection shall not apply to a system described in paragraph (2) or (3) of subsection (e). (2) Procedures for use of authority The Secretary shall— (A) in coordination with the Director and in consultation with Federal contractors, as appropriate, establish procedures under which a directive may be issued under this subsection, which shall include— (i) thresholds and other criteria; (ii) privacy and civil liberties protections; and (iii) providing notice to potentially affected third parties; (B) specify the reasons for the required action and the duration of the directive; (C) minimize the impact of a directive under this subsection by— (i) adopting the least intrusive means possible under the circumstances to secure the agency information systems; and (ii) limiting the directive to the shortest period practicable; and (D) notify the Director and the head of any affected agency immediately upon the issuance of a directive under this subsection. (3) Imminent threats (A) In general If the Secretary determines that there is an imminent threat, including a threat of terrorism, to agency information systems and a directive under this subsection is not reasonably likely to result in a timely response to the threat, the Secretary may authorize the use of protective capabilities under the control of the Secretary for communications or other system traffic transiting to or from or stored on an agency information system without prior consultation with the affected agency for the purpose of ensuring the security of the information, information system, or other agency information systems. (B) Limitation on delegation The authority under this paragraph may not be delegated to an official in a position lower than an Assistant Secretary of the Department of Homeland Security. (C) Notice The Secretary shall immediately notify the Director and the head and chief information officer (or equivalent official) of each affected agency of— (i) any action taken under this subsection; and (ii) the reasons for and duration and nature of the action. (D) Other law Any action of the Secretary under this paragraph shall be consistent with applicable law. (4) Limitation The Secretary may direct or authorize lawful action or protective capability under this subsection only to— (A) protect agency information from unauthorized access, use, disclosure, disruption, modification, or destruction; or (B) require the remediation of or protect against identified information security risks, including acts of terrorism, with respect to— (i) information collected or maintained by or on behalf of an agency; or (ii) that portion of an information system used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. . 5. Report to Congress regarding DHS functions Section 3553 of title 44, United States Code, as amended by section 3, is further amended by adding at the end the following new subsection: (i) Annual report to Congress Not later than February 1 of every year, the Secretary shall report to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate, regarding the specific actions the Secretary has taken pursuant to subsections (b) and (h). .

Summary: Cyber Defense of Federal Networks Act of 2015 Amends the Homeland Security Act of 2002 to require the Department of Homeland Security (DHS), in coordination with the Office of Management and Budget (OMB), to implement plans to: (1) detect, identify, and remove intruders in federal agencies' information systems; and (2) make advanced network security tools available for agencies to improve visibility of network activity to detect and mitigate intrusions and anomalous activity. Directs DHS to coordinate with the OMB to: (1) update government information security metrics to include measures of intrusion and incident detection and response times, and (2) display additional metrics about agency cybersecurity postures on federal government performance websites. Authorizes DHS, upon an agency's request, to operate and maintain technology that is deployed to agencies to diagnose and mitigate cyber threats and vulnerabilities. Requires DHS to regularly assess and require implementation of best practices for securing agency information systems and preventing data exfiltration. Redefines for purposes of DHS's national cybersecurity and communications integration center: (1) "cybersecurity risk" to exclude actions that solely involve a violation of a consumer term of service or a consumer licensing agreement; and (2) "incident" to include occurrences that actually or imminently jeopardize, without lawful authority, an information system, thereby replacing a standard that currently includes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. Requires DHS to assist agencies in implementing information security practices by: (1) providing incident detection, analysis, mitigation, and response information, disseminating related homeland security information, and providing remote or onsite technical assistance; (2) developing and conducting impact assessments in consultation with other governmental and private entities; (3) assessing and fostering technologies for use across multiple agencies; and (4) ensuring that policies are coordinated with standards for national security systems and policies of the Department of Defense (DOD) and the Director of National Intelligence. Authorizes the DHS Secretary to: (1) issue a directive to an agency to take any lawful action with respect to the operation of an agency's information system in response to a known or reasonably suspected information security threat, vulnerability, risk, or incident, including an act of terrorism, that represents a substantial threat to information security; or (2) authorize, without prior consultation with the affected agency, the use of protective capabilities under the Secretary's control for communications or system traffic transiting to or from or stored on an agency information system if there is an imminent threat and a directive is unlikely to be timely. Exempts DOD and the intelligence community from such procedures.