## 8 Cyber-Defense
Since Stuxnet, DHS issued the Blueprint for a Secure Cyber Future: The Cybersecurity Strategy for the Homeland Security Enterprise [36]. Released in November 2011, the Blueprint addresses two areas of concern: protecting critical infrastructures and strengthening cyber-ecosystems. Among its goals are to strengthen cyber-defenses for ICS/SCADA systems in order to protect against attacks that could harm the general public. However, it is difficult to assess the influence, if any, of Stuxnet on the Blueprint given the earlier efforts to strengthen cyber-security. The NSSC was issued in 2003, the CNCI in 2008 (as NSPD-54/HSPD-23 under the [PERSON] administration) and again in 2009 (under the [PERSON] administration), and the Strategy for Securing Control Systems (SSCS) in 2009. These all preceded the public disclosure of Stuxnet in July 2010. However, the case is not so straightforward, as some US government officials would have been aware of Stuxnet as early as 2009 if indeed the US was involved in the operation, as the malware appears to have infected Natanz that year [37]. Indeed, some would have been aware of the effort even earlier, as the impetus behind it reportedly goes back to 2006 [6]. Still, the government's drive for greater ICS security was likely motivated more by a growing awareness of the threats and risks than by Stuxnet specifically. According to [PERSON], deputy undersecretary for cybersecurity at NPPD, they were \"seeing a troubling increase in the threats and the vulnerabilities\" associated with ICSs [38]. Since Stuxnet, there have also been several new legislative proposals addressing cyber-security. At least one of these, Senate bill S.2015, The Cybersecurity Act of 2012, has several provisions aimed at strengthening the cyber-security of critical infrastructures. But again, it is difficult to assess the influence of Stuxnet on the introduction of this bill, given the earlier attempts at legislation. For example, S.773, the Cybersecurity Act of 2009, also addressed critical infrastructure security. However, the details of the two bills vary, so Stuxnet--along with all the other cyber-security threats that occurred in the interim--may have had some impact on the 2012 bill. Even if Stuxnet has had little impact on the strategic direction of the US government's cyber-security program, it has impacted day-to-day operations. Testifying before the US House Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies on 16 March 2011, [PERSON], then deputy undersecretary of NPPD, reported that his division had taken several steps to help combat the Stuxnet threat [39]. Among others, the NPPD's ICS-CERT had analyzed the Stuxnet code, briefed government and industry organizations about the threat, and issued several advisories and updates about detecting and mitigating the threat. Companies and individuals in the security field have taken similar steps to understand, publicize, and mitigate the threat. In addition to affecting day-to-day operations, Stuxnet has influenced the cyber-security conversation. It is frequently mentioned in news stories, presentations, reports, and articles relating to cyber-threats, legislation, and developments. I have cited it in other papers and discussed it in classes at NPS and in outside presentations. It has raised awareness of ICS cyber-threats and the dangers of worms and other forms of malware. It could further inspire the development of cyber-security requirements, standards, products, practices, and regulations. But these activities are not indicative of a game change so much as an already growing concern over cyber-threats, not only to control systems, but to all targets.