Executive Order 13636: Improving Critical Infrastructure Cybersecurity Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
20 pages
For Official Use Only
March 11, 2013Executive Order 13636: Improving Critical Infrastructure Cybersecurity Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
20 pages
For Official Use Only
March 11, 2013
Executive Order 13636: Improving Critical Infrastructure Cybersecurity Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
20 pages
For Official Use Only
March 11, 2013
Download
Overview of Executive Order 13636
– Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity was released on February 12, 2013
– Relies on public-private collaboration to improve critical infrastructure cyber posture
– Includes elements to enhance information sharing, develop a cybersecurity framework, and create a voluntary cybersecurity program
– Requires the Department of Homeland Security (DHS) to identify the “critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security”
DHS will work with CIPAC to execute Section 9 of the EO
“Within 150 days of the date of this order, the Secretary shall use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.” (EO 13636, Section 9)
Apply consistent, objective criteria
Stakeholders include:
– Critical Infrastructure Partnership Advisory Council (CIPAC)
– Sector Specific Agencies (SSA)
– Sector Coordinating Councils (SCC)
– Government Coordinating Councils (GCC)
– Critical infrastructure owners and operators
The list of identified critical infrastructure will be reviewed and updated on an annual basis
Execution of Section 9 will be led by the Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
Overview of CDII Approach (1 of 2)
Only a small subset of U.S. infrastructure will fall under the focus of the EO activity
– Owners and operators will have the opportunity to provide relevant information
– A review process will be established for the identification as critical infrastructure
Focus is on critical infrastructure that could be compromised through cyber exploitation and which, if incapacitated, could result in catastrophic national, public health, or economic consequences
– Higher standard than debilitating, which is what is used in the base definition to define critical infrastructure
– The Secretary of DHS will provide a list of critical infrastructure most at risk in the context of a cyber incident within 150 days of EO release
– Commercial IT products and consumer information technology services will not be directly designated under the EO as infrastructure most at risk
All sectors will be engaged –through engagement and initial analysis it may be determined that a sector does not have any infrastructure that meets the threshold, the focus of the initial list will not be on that sector(s)
Sectors with existing CI identification processes and lists should be leveraged where appropriate
Functions-based approach to identify critical infrastructure
– Accounts for the virtual and distributed nature of cyber infrastructure
– Focuses on the critical activities, services, or products being produced or provided by a sector, subsector, or mode
– Functions are identified based on the national or regional level consequences that can result from a disruption or exploitation of the infrastructure
– Does not identify a specific organization’s assets, networks, or systems; focus is on sector functions and the types of systems that support them
Requires the application of criteria that will be used to screen the infrastructure that aligns to the critical functions
– Consistently applied within sectors and, where possible, across sectors as well
Stakeholder engagement will be conducted throughout this effort
– CDIIWG will work with sectors (SSAs, SCCs, GCCs) via the CIPAC partnership framework
…
Download
Overview of Executive Order 13636
– Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity was released on February 12, 2013
– Relies on public-private collaboration to improve critical infrastructure cyber posture
– Includes elements to enhance information sharing, develop a cybersecurity framework, and create a voluntary cybersecurity program
– Requires the Department of Homeland Security (DHS) to identify the “critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security”
DHS will work with CIPAC to execute Section 9 of the EO
“Within 150 days of the date of this order, the Secretary shall use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.” (EO 13636, Section 9)
Apply consistent, objective criteria
Stakeholders include:
– Critical Infrastructure Partnership Advisory Council (CIPAC)
– Sector Specific Agencies (SSA)
– Sector Coordinating Councils (SCC)
– Government Coordinating Councils (GCC)
– Critical infrastructure owners and operators
The list of identified critical infrastructure will be reviewed and updated on an annual basis
Execution of Section 9 will be led by the Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
Overview of CDII Approach (1 of 2)
Only a small subset of U.S. infrastructure will fall under the focus of the EO activity
– Owners and operators will have the opportunity to provide relevant information
– A review process will be established for the identification as critical infrastructure
Focus is on critical infrastructure that could be compromised through cyber exploitation and which, if incapacitated, could result in catastrophic national, public health, or economic consequences
– Higher standard than debilitating, which is what is used in the base definition to define critical infrastructure
– The Secretary of DHS will provide a list of critical infrastructure most at risk in the context of a cyber incident within 150 days of EO release
– Commercial IT products and consumer information technology services will not be directly designated under the EO as infrastructure most at risk
All sectors will be engaged –through engagement and initial analysis it may be determined that a sector does not have any infrastructure that meets the threshold, the focus of the initial list will not be on that sector(s)
Sectors with existing CI identification processes and lists should be leveraged where appropriate
Functions-based approach to identify critical infrastructure
– Accounts for the virtual and distributed nature of cyber infrastructure
– Focuses on the critical activities, services, or products being produced or provided by a sector, subsector, or mode
– Functions are identified based on the national or regional level consequences that can result from a disruption or exploitation of the infrastructure
– Does not identify a specific organization’s assets, networks, or systems; focus is on sector functions and the types of systems that support them
Requires the application of criteria that will be used to screen the infrastructure that aligns to the critical functions
– Consistently applied within sectors and, where possible, across sectors as well
Stakeholder engagement will be conducted throughout this effort
– CDIIWG will work with sectors (SSAs, SCCs, GCCs) via the CIPAC partnership framework
…
DownloadExecutive Order 13636: Improving Critical Infrastructure Cybersecurity Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
20 pages
For Official Use Only
March 11, 2013
Download
Overview of Executive Order 13636
– Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity was released on February 12, 2013
– Relies on public-private collaboration to improve critical infrastructure cyber posture
– Includes elements to enhance information sharing, develop a cybersecurity framework, and create a voluntary cybersecurity program
– Requires the Department of Homeland Security (DHS) to identify the “critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security”
DHS will work with CIPAC to execute Section 9 of the EO
“Within 150 days of the date of this order, the Secretary shall use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.” (EO 13636, Section 9)
Apply consistent, objective criteria
Stakeholders include:
– Critical Infrastructure Partnership Advisory Council (CIPAC)
– Sector Specific Agencies (SSA)
– Sector Coordinating Councils (SCC)
– Government Coordinating Councils (GCC)
– Critical infrastructure owners and operators
The list of identified critical infrastructure will be reviewed and updated on an annual basis
Execution of Section 9 will be led by the Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
Overview of CDII Approach (1 of 2)
Only a small subset of U.S. infrastructure will fall under the focus of the EO activity
– Owners and operators will have the opportunity to provide relevant information
– A review process will be established for the identification as critical infrastructure
Focus is on critical infrastructure that could be compromised through cyber exploitation and which, if incapacitated, could result in catastrophic national, public health, or economic consequences
– Higher standard than debilitating, which is what is used in the base definition to define critical infrastructure
– The Secretary of DHS will provide a list of critical infrastructure most at risk in the context of a cyber incident within 150 days of EO release
– Commercial IT products and consumer information technology services will not be directly designated under the EO as infrastructure most at risk
All sectors will be engaged –through engagement and initial analysis it may be determined that a sector does not have any infrastructure that meets the threshold, the focus of the initial list will not be on that sector(s)
Sectors with existing CI identification processes and lists should be leveraged where appropriate
Functions-based approach to identify critical infrastructure
– Accounts for the virtual and distributed nature of cyber infrastructure
– Focuses on the critical activities, services, or products being produced or provided by a sector, subsector, or mode
– Functions are identified based on the national or regional level consequences that can result from a disruption or exploitation of the infrastructure
– Does not identify a specific organization’s assets, networks, or systems; focus is on sector functions and the types of systems that support them
Requires the application of criteria that will be used to screen the infrastructure that aligns to the critical functions
– Consistently applied within sectors and, where possible, across sectors as well
Stakeholder engagement will be conducted throughout this effort
– CDIIWG will work with sectors (SSAs, SCCs, GCCs) via the CIPAC partnership framework
…
Overview of Executive Order 13636
– Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity was released on February 12, 2013
– Relies on public-private collaboration to improve critical infrastructure cyber posture
– Includes elements to enhance information sharing, develop a cybersecurity framework, and create a voluntary cybersecurity program
– Requires the Department of Homeland Security (DHS) to identify the “critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security”
DHS will work with CIPAC to execute Section 9 of the EO
“Within 150 days of the date of this order, the Secretary shall use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.” (EO 13636, Section 9)
Apply consistent, objective criteria
Stakeholders include:
– Critical Infrastructure Partnership Advisory Council (CIPAC)
– Sector Specific Agencies (SSA)
– Sector Coordinating Councils (SCC)
– Government Coordinating Councils (GCC)
– Critical infrastructure owners and operators
The list of identified critical infrastructure will be reviewed and updated on an annual basis
Execution of Section 9 will be led by the Cyber-Dependent Infrastructure Identification Working Group (CDIIWG)
Overview of CDII Approach (1 of 2)
Only a small subset of U.S. infrastructure will fall under the focus of the EO activity
– Owners and operators will have the opportunity to provide relevant information
– A review process will be established for the identification as critical infrastructure
Focus is on critical infrastructure that could be compromised through cyber exploitation and which, if incapacitated, could result in catastrophic national, public health, or economic consequences
– Higher standard than debilitating, which is what is used in the base definition to define critical infrastructure
– The Secretary of DHS will provide a list of critical infrastructure most at risk in the context of a cyber incident within 150 days of EO release
– Commercial IT products and consumer information technology services will not be directly designated under the EO as infrastructure most at risk
All sectors will be engaged –through engagement and initial analysis it may be determined that a sector does not have any infrastructure that meets the threshold, the focus of the initial list will not be on that sector(s)
Sectors with existing CI identification processes and lists should be leveraged where appropriate
Functions-based approach to identify critical infrastructure
– Accounts for the virtual and distributed nature of cyber infrastructure
– Focuses on the critical activities, services, or products being produced or provided by a sector, subsector, or mode
– Functions are identified based on the national or regional level consequences that can result from a disruption or exploitation of the infrastructure
– Does not identify a specific organization’s assets, networks, or systems; focus is on sector functions and the types of systems that support them
Requires the application of criteria that will be used to screen the infrastructure that aligns to the critical functions
– Consistently applied within sectors and, where possible, across sectors as well
Stakeholder engagement will be conducted throughout this effort
– CDIIWG will work with sectors (SSAs, SCCs, GCCs) via the CIPAC partnership framework
…









Philibert Aspairt, considered by some the first cataphile, becomes lost while exploring the Parisian catacombs by candlelight. His body is found 11 years later.
In Australia, Melbourne cave enthusiasts Doug, Sloth and Woody found the Cave Clan, and soon begin exploring storm drains and other man-made caves as well as natural ones. Over the next decade, the Cave Clan absorbs other, smaller draining groups.
In Australia, Doug publishes the first issue of Il Draino, the Cave Clan newsletter.
After finding a Cave Clan sticker in a drain under Sydney, Predator forms the group’s first official interstate branch, the
In the US, Dug Song and Greg Shewchuk publish the first issue of Samizdat, a zine featuring urban stunts involving tunnels and rooftops. They publish two issues before going on permanent hiatus.


In the US, Max Action and his fellow University of Minnesota explorers form the group “Adventure Squad”, which they later rename Action Squad.
Ninjalicious publishes the first issue of the paper zine Infiltration. In the editorial of the first issue, he coins the term “urban exploration” and introduces the idea of exploring off-limits areas of all types as a hobby.
With the third issue of their magazine Jinx, long-time New York City explorers Lefty Leibowitz and L.B. Deyo begin featuring articles on urban mountaineering and exploration. Jinx goes online at planetjinx.com (later 

In Scotland, the Milk Grate Gang forms with the purpose of exploring the Glaswegian underworld, and places its adventures online at Subterranean Glasgow.


Julia Solis and her explorer friends stage an event called “Dark Passage” in the subway tunnels beneath New York City.
Members of the Sydney Cave Clan publish the first issue of the zine Urbex. They publish three more issues on paper before switching to an electronic format.




Doug launches a full-colour publication called The Cave Clan Magazine and prints 100 copies of the premiere issue. 



Roughly 65 explorers from across North America and a couple from beyond converge on Toronto for a successful four-day exploration convention trickily-titled Office Products Expo 94.








![[Image]](https://i0.wp.com/cryptome.org/2013/03/iran-cyber-offense-01.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013/03/iran-cyber-offense-02.jpg)












![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/casey/pict0.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/casey/pict1.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/casey/pict2.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/casey/pict4.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/casey/pict5.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/casey/pict23.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict25.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict32.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict26.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict33.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict28.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict35.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict27.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict34.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict31.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict36.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict29.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict37.jpg)
![[Image]](https://i0.wp.com/cryptome.org/2013-info/03/shabak-sites/pict24.jpg)












![Al-Qaeda spokesman Sulaiman Bu Ghaith speaks in an undated video message carried on Qatar's al-Jazeera television October 9, 2001 saying that the militant group believed in "terrorism against oppressors". [Osama bin Laden's] al-Qaeda group said on Tuesday that hijacked plane attacks on the United States would continue and that the "battle" would not end until America withdraws from Muslim lands. The station did not explain the origin of the statement but it appeared to be a video recording. Sulaiman Bu Ghaith had appeared with [bin Laden] on a recorded statement issued via Jazeera last Sunday. REUTERS Al-Qaeda spokesman Sulaiman Bu Ghaith speaks in an undated video message carried on Qatar's al-Jazeera television October 9, 2001 saying that the militant group believed in "terrorism against oppressors". [Osama bin Laden's] al-Qaeda group said on Tuesday that hijacked plane attacks on the United States would continue and that the "battle" would not end until America withdraws from Muslim lands. The station did not explain the origin of the statement but it appeared to be a video recording. Sulaiman Bu Ghaith had appeared with [bin Laden] on a recorded statement issued via Jazeera last Sunday. REUTERS](https://i0.wp.com/l.yimg.com/bt/api/res/1.2/6PHfuXbNTDw1J1_ovdOYJQ--/YXBwaWQ9eW5ld3M7Y2g9MTUyNjtjcj0xO2N3PTIwNDg7ZHg9MDtkeT0wO2ZpPXVsY3JvcDtoPTQ3MDtxPTg1O3c9NjMw/http%3A//l.yimg.com/os/152/2013/03/07/RTXKTJE-jpg_180736.jpg)

















You must be logged in to post a comment.