Jen Easterly, Director of the US Cybersecurity and Infrastructure Security Agency (CISA), raises fresh concerns about increasing cyber threats to critical infrastructure.
Easterly, an intelligence officer and former military official who was appointed as director of CISA by the Biden administration in 2021, is calling for urgent steps to bolster the resilience of critical infrastructure and emphasises the importance of collaboration with private and international partners in the face of growing international threats.
Revelations around Chinese threat actors and their campaigns – dubbed “Volt Typhoon,” “Flax Typhoon,” and “Salt Typhoon” – have exposed the risks posed by Beijing’s pre-positioning of destructive capabilities in key critical infrastructure sectors.
Providing an assessment of the scale of the problem, Easterly warned: “We do think that’s the tip of the iceberg … these are PRC cyber actors. And to be honest, some of the reporting around these actors has led to it being more difficult to find them because they’ve gone dormant or they’ve gone dark.”
Critical infrastructure at risk
Easterly highlighted the highly strategic intent of Chinese cyber actors in pre-positioning capabilities to launch disruptive or destructive attacks targeting critical sectors such as water, transportation, power, and telecoms. She explicitly linked these efforts to Beijing’s ambitions surrounding Taiwan.
“We know that Xi himself is intent on reunification of Taiwan. Whether that’s militarily or peacefully, we know that analysts believe that this will happen sometime—before the end of the decade, if not sooner.
“There are moves afoot by the PRC to be able to hold our critical infrastructure at risk, not for espionage – although we are seeing espionage operations – but what I’ve been more concerned about are the efforts to burrow deeply into our most sensitive critical infrastructure, whether that’s water or transportation or power or communications, for the purposes of launching disruptive or destructive attacks in the event of a major crisis in the Taiwan Strait.”
Easterly cautioned that a crisis in Asia could result in “massive disruptions here in the US,” intended to paralyse societal functions and erode governmental and military response capabilities.
Easterly stressed the need for a paradigm shift in how the nation approaches cybersecurity and critical infrastructure defence. While acknowledging the inevitability of disruption, she maintained the focus must shift towards resilience, preparation, and rapid recovery.
“At the end of the day, we need to be prepared for disruption. It’s not about preventing [every cyber attack,] it is really about architecting our systems, structures, and training and exercising our people to be prepared for this disruption so we can respond and recover as rapidly as possible.”
According to Easterly, this necessitates an operational focus guided by three core lines of effort: denial, resilience, and punishment. CISA’s recently established Joint Cyber Defense Collaborative (JCDC) has been working on bolstering public-private collaboration while improving visibility, detection, and eradication capabilities across federal and critical infrastructure networks.
Deterrence and punishment
When asked why deterrence isn’t effectively countering state-sponsored cyber aggression from China, Easterly offered a candid analysis, speaking from her experience as a retired military officer who helped establish US Cyber Command. She advocated for a mix of defensive and offensive measures.
Expressing scepticism about the effectiveness of traditional norms-based deterrence, Easterly instead stressed, “You’re left with deterrence by denial and resilience. And really, that’s our world—to ensure people understand what needs to be done to drive down risk to their networks.”
On the offensive side, she didn’t shy away from discussing America’s capability to hold adversaries’ critical infrastructure at risk, stating: “We need to be able to use the full power of the US government to include our military power and offensive capabilities to bring to bear deterrence in a really meaningful way.”
Easterly positioned CISA as the nation’s “Civilian Cyber Defence Agency.” Her vision involves close integration with all stakeholders, alongside the expansion of capabilities for proactive defence. She credits much of CISA’s recent advancements to directives contained in the National Defense Authorization Act (NDAA), which provided the agency with persistent threat-hunting powers, red team operations, and joint operational authorities.
Reflecting on these milestones, she described CISA’s “Secure Our World” campaign as pivotal to embedding basic cyber hygiene practices into everyday life, comparing such measures to “washing your hands and brushing your teeth.”
However, Easterly acknowledged there is significant room to grow CISA. “Look at the FBI or the Defence Department. You think about us as America’s Civilian Cyber Defence Agency, but we are much, much smaller than those entities. I do hope we can continue to grow.”
The recruitment and retention of top cybersecurity talent also remain fundamental to CISA’s success, a significant challenge in the face of higher compensation offered in the private sector. Under her tenure, CISA has leveraged tailored hiring authorities to recruit world-class talent committed to the mission.
Addressing regulatory and sectoral gaps
Easterly expressed frustration at the complexity created by conflicting cybersecurity reporting requirements between federal regulatory bodies, such as the Securities and Exchange Commission (SEC) and CISA, which she noted can create confusion for critical infrastructure operators.
To tackle this, she advocated for a harmonisation of regulatory frameworks rooted in simplicity and usability. Highlighting her collaboration with the National Cyber Director (NCD), she said, “Simplicity is your friend. Efficiency prevails against operational risk reduction.”
She also underscored the importance of targeting less-resourced sectors – including water utilities and rural hospitals – which are often prime targets for cyber adversaries due to their lack of robust cybersecurity defences and funding. Easterly highlighted the critical roles Sector Risk Management Agencies (SRMAs) and grant programmes play in bridging these gaps.
“The government needs to continue to resource those SRMAs to enable them to work with their sectors to reduce risk. I don’t think they should replicate the activities or the capabilities we have at CISA – like the threat hunt teams, the incident response teams, the vulnerability management teams, the red teams – but they do bring incredible expertise in that sector.”
Adversaries thwarted
In the face of adversarial influence attempts – particularly from Russia, China, and Iran – Easterly praised the collaborative efforts between federal, state, and local partners during the midterm elections. She credits the “multi-state ISAC (Information Sharing and Analysis Center)” and robust partnerships for thwarting these attempts and called maintaining trust in election infrastructure paramount.
Reflecting on the outcomes, she stated: “We’ve created a very strong community of state and local officials, federal government, and the election vendor community … and I think you saw the success: safe, secure, free, and fair elections in November.
“As we predicted, we did see those foreign malicious influence activities. Some of it was inflamed by artificial intelligence, but most of it was the capabilities of our most sophisticated foreign adversaries—Russia in particular, but also Iran and China.”
Easterly pointed to the role international collaboration now plays, citing the seamlessness achieved between CISA, the FBI, private entities, and international partners in jointly addressing incidents. Such collaboration has enabled more timely action, including identifying and attributing campaigns like Salt Typhoon.
On the broader mission of building coherence and driving down risk, Easterly reiterated the urgency of securing tomorrow’s systems today. She also highlights the need to attract and retain talent that receive much higher private sector offers.
“Continuing to hire and retain talent that could be making a hell of a lot more money in the private sector I think will be the key to enabling us to grow in a way that we can really have an impact on driving down risk to the American people,” Easterly concludes.
See also: Spectrum auction urged to remove Chinese telecoms equipment
Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Digital Transformation Week, IoT Tech Expo, Blockchain Expo, and AI & Big Data Expo.
Explore other upcoming enterprise technology events and webinars powered by TechForge here.
