CISO Perspectives: The Einstein Program
- By Special to GCN
- Sep 12, 2008
On Jan. 8, President Bush issued the Cyber Initiative order,
otherwise known as National Security Presidential Directive 54
(HSPD-54)/Homeland Security Presidential Directive 23 (HSPD-23).
The order, issued in response to increasingly complex and
aggressive cyberattacks against U.S. government and civilian
network infrastructures, outlined dramatic measures to improve the
security of government networks.
Among other measures, the order authorized the National Security
Agency to monitor federal computer networks. The joint directive
also required that the government dramatically scale back the
number of points at which federal networks connect to the public
Included among the publicly
disclosed components of the Cyber
Initiative is the deployment of Einstein sensors on approved
federal government Internet access points. The Einstein Program,
managed by Homeland Security Department’s National
Preparedness and Policy Directorate, will capture certain segments
of federal network traffic in near real time, in order to perform
analysis and provide federal agencies with situational awareness
concerning the state of Internet traffic across the federal .gov
domain. This passive collection of data needed for analysis will
not interfere with the communications to and from agencies.
Targeted data collection is strictly limited and is determined
based on criteria for anomaly detection and other information
technology risks. This data may include:
- Autonomous System Numbers (ASN). An ASN identifies the
autonomous system and networks using the same specified routing
policy and enables the systems to exchange information.
- Internet Control Message Protocol (ICMP) Type/Code. ICMP is
used to communicate control messages on the Internet between
- Packet Length. A packet is a specially formatted group of bits
containing data, an Internet Protocol (IP) address and control
information that is transmitted over a network as a collective
- Protocol. A protocol is a standardized means of communication
among machines across a network.
- Sensor identification and connection status. Sensor
identification is the description of where the sensor is located as
to clearly identify which network, system or agency the data is
- Source and Destination IP Address. IP addresses are four octet
(32-bit) source or destination addresses that uniquely identify
computers either on a given network or on the Internet.
- Source and Destination Port. In the networking world, the term
“port” is a number that identifies the beginning or
endpoint of a logical connection.
- Transmission Control Protocol (TCP) flag information. Simply
stated, a TCP flag is information that is added to packets
traveling between computers that describes the status of the
connection between the computers.
- Timestamp and duration information. A time that is printed to a
file (such as e-mail) or other location to help keep track of when
data is added, removed, sent, received, etc.
- Payload Information.
The intent is that Einstein’s automated collection,
correlation, analysis and sharing of the above network flow data
from the various federal civilian government agencies will be
- Determining the scope and effect of any specific worm across
the federal government and how it relates to the Internet community
- Detecting anomalous network behavior or activities against the
federal government and determining whether it’s a focused
attack or part of a larger Internet-related activity.
- Determining the level of impact and any damage associated with
cyberattacks against the federal government.
- Diagnosing specific federal agency Internet traffic problems as
they relate to the much larger Internet backbone
- Pinpointing the apparent source responsible for any
- Determining the cyber state of the federal government in near
real-time and its interaction with the global Internet
- Compiling an overall situational awareness of trends and
traffic patterns for all participating federal agencies.
- Detecting early warning and indications of emerging attacks and
malicious reconnaissance activities and adverse impact on federal
- Correlating system compromises across the federal
Though some may argue that Einstein technology is a little too
late, the obvious benefits of a fully implemented and robust
program that provides a cyber weather map for the federal
government are hard to deny. Interestingly though, despite its
promises, the program does pose major challenges for several
federal chief information security officers (CISOs) who would
otherwise benefit greatly from the program’s capabilities.
The program makes several underlying assumptions about the
pre-existence of a number of key infrastructures within federal
agencies that may not be correct in all cases. Looming large among
these are the assumptions that all targeted agencies have incident
response personnel trained and cleared at the appropriate levels
and with the capabilities to discuss classified detects via phone
(Secure Telephone Equipment) or e-mail (Secret Internet Protocol
Router Network, SIPRNet). There are, of course, wide variances
between departments and agencies because there has been no
requirement for such capability.
The program also makes an implicit assumption regarding the
robustness of the incident response capabilities of federal
agencies. Here too, we find major variances across departments and
agencies with capabilities ranging from fully outsourced cyber
response activities, minimally staffed lights-out operations, to
fully staffed 24x7 operations.
On the more technical front, it still isn’t clear the
degree to which DHS Einstein technology will be capable of true
active mode configuration employing underlying Deep Packet
Inspection to “unwrap and inspect” packets. The ability
to detect attacks is one thing, preventing network-based attacks
and malware at wire speeds is another.
Consequently, the perceived passivity of the Einstein sensor
technology itself becomes another area of concern. The bare-bones
staff at operational incident response centers is already
sufficiently overwhelmed with alerts from enterprise anti-virus,
deployed network and host-based intrusion detection and firewall
and router log analysis. One could argue that adding another
passive data source to include in an already bandwidth-constricted
triage process isn’t helping complete the
The Einstein Program and its promise to deliver a federal cyber
weather map is greatly needed to improve the cyber early warnings
and indicators across the federal government and to enhance overall
federal cyber situational awareness. The program however, is not
without a number of challenges, which if overlooked by DHS program
directors, could degrade the program’s overall