America’s PrepareAthon! National  Day of Action is being held today, April 30, to provide a national focus for individuals, organizations, and communities to participate through drills, group discussions, and exercises to practice for relevant local hazards.

Across the nation, over five million people are participating in events to increase emergency preparedness and resilience through hazard-specific drills, group discussions and exercises. Secretary Johnson and Federal Emergency Management Agency Administrator Fugate encourage you to take part in America’s PrepareAthon!, a nationwide, community-based campaign for action to increase local preparedness and resilience through hazard-specific drills, group discussions, and exercises.

The goal of this new campaign is to increase the number of individuals who understand which disasters could happen in their community, know what to do to be safe and mitigate damage, take action to increase their preparedness, and participate in community resilience planning.

Research shows that communities are better prepared to withstand a disaster and can recover more quickly if the entire community is involved.

The America's PrepareAthon! campaign offers easy steps that you can take to get prepared now so you are able to take immediate action and recover more quickly during and after a disaster. These actions include:

• Practicing going to your protective location if you live in tornado-prone areas
• Signing up for local text alerts/warnings and downloading hazard-related apps to your smartphone
• Gathering all of your important documents and keeping them in a safe place
• Creating a family communications plan so that everyone knows how to reach each other and meet each other if separated during an emergency

While participating in PrepareAthon! events today,  we encourage you to share information about your PrepareAthon! events by using #PrepareAthon in your social media postings. We’re proud of you for taking action; it shows the spirit of individual and community preparedness is continuing to reach new heights.

We encourage you to learn more about how you can play a role in your community’s preparedness by visiting www.ready.gov/prepare.

Unfortunately, Heartbleed has become a familiar term to many people across the country.  It is a serious vulnerability, a weakness in the widely-used OpenSSL encryption software that protects the electronic traffic on a large number of websites and in scores of devices. Although new computer “bugs” and malware crop up almost daily, this vulnerability is unusual in how widespread it is, it’s ease of use, the potentially damaging information it allows malicious actors to obtain, and the length of time before it was discovered.  As the administration has said, the Federal government was not aware of the vulnerability until it was made public in press reports.  

It is important to note that it takes time to address this issue properly.  As with the private sector, government agencies must analyze their systems to identify where they have the Heartbleed vulnerability, determine how to implement the appropriate response, and then ensure that they can implement the response without disrupting critical operations.  Finally, the scope and scale of this vulnerability may continue to evolve as researchers and companies discover new places or devices that may be susceptible. 

This analysis has informed how the Federal government has responded to this vulnerability since its public disclosure, working at an aggressive yet appropriate pace in our response and acting out of an abundance of caution.   Working with other agencies, we have:

• Enabled our network defenses across the Executive branch to detect someone trying to use the exploit and in many cases to block those attempts
• Begun scanning government networks for this vulnerability to ensure that we know where it exists
• Issued technical alerts and mitigation steps through the our National Communications and Cybersecurity Integration Center
• Engaged with our industry partners to discuss the threat posed by the vulnerability

As we conduct the scans of government systems and agencies conduct their own reviews, many government websites turn out to have never been vulnerable to Heartbleed because they did not use OpenSSL; in those cases, no further action is needed at this time.  However, in those cases where agencies determine that a website or system could have been vulnerable to Heartbleed, they are taking the same steps as the private sector:

• Updating to secure versions of OpenSSL
• Re-issuing certificates for the website
• Requiring or asking users to reset their passwords, if the website permits users to login, and alerting users on a website’s homepage to this fact.
• Reminding users not to use a new password on any site that has not clearly been patched.

We will continue to focus on this issue until government agencies have mitigated the vulnerability in their systems.  And we will continue to adapt our response if we learn about additional issues created by the vulnerability. The government remains committed to protecting any personally identifiable information it holds and to upholding high standards of cybersecurity.

Posted by Dr. Phyllis Schneck, Deputy Under Secretary of Homeland Security for Cybersecurity and Communications

Posted by NCCIC Director Larry Zelvin

Information sharing is a key part of the Department of Homeland Security’s (DHS) important mission to create shared situational awareness of potential cybersecurity vulnerabilities. DHS, through our National Cybersecurity & Communications Integration Center (NCCIC), actively collaborates with public and private sector partners every day to make sure they have the information and tools they need to protect the systems we all rely on.

When a cybersecurity industry report was published three days ago about a vulnerability known as “Heartbleed” – affecting websites, email, and instant messaging – that can potentially impact internet logins and personal information online by undermining the encryption process, the Department’s U.S.-Computer Emergency Readiness Team (US-CERT) immediately issued an alert  to share actionable information with the public and suggested mitigation steps.  Subsequently, our Industrial Control System-Cyber Emergency Response Team (ICS-CERT) published information and reached out to vendors and asset owners to determine the potential vulnerabilities to computer systems that control essential systems – like critical infrastructure, user-facing, and financial systems.  The National Coordinating Center for Communications (NCC) also provided situational awareness to communications sector partners for their review and action. Importantly, the Federal government’s core citizen-facing websites are not exposed to risks from this cybersecurity threat. We are continuing to coordinate across agencies to ensure that all Federal government websites are protected from this threat.

While there have not been any reported attacks or malicious incidents involving this particular vulnerability confirmed at this time, it is still possible that malicious actors in cyberspace could exploit un-patched systems. That is why everyone has a role to play to ensuring our nation’s cybersecurity. We have been and continue to work closely with federal, state, local and private sector partners to determine any potential impacts and help implement mitigation strategies as necessary.

Today we’re also sharing some tips on steps you can take to protect your own personal cybersecurity and information online:

• Many commonly used websites are taking steps to ensure they are not affected by this vulnerability and letting the public know. Once you know the website is secure, change your passwords.
• Closely monitor your email accounts, bank accounts, social media accounts, and other online assets for irregular or suspicious activity, such as abnormal purchases or messages
• After a website you are visiting has addressed the vulnerability, ensure that if it requires personal information such as login credentials or credit card information, it is secure with the HTTPS identifier in the address bar. Look out for the “s”, as it means secure.

Cybersecurity is a shared responsibility and when we take steps to ensure our own cyber safety, we are also helping to create a safer Internet for others.

For more cyber resources and tips, please visit www.dhs.gov/stopthinkconnect

Last week marked the 100^th day in office for Secretary of Homeland Security Jeh Johnson. Tomorrow Secretary Johnson will host a Twitter chat to discuss what he has seen his first 100 days and highlight his priorities moving forward.

From travel to the southwest border, to meeting with international partners abroad on common homeland security issues, to his recent trip to Washington to view the ongoing response to the tragic mudslide last month, Secretary Johnson has been deeply engaged in the diverse missions of the Department. On top of all that, he also recently threw out the first pitch at Citifield.

Tomorrow he looks forward to discussing these efforts and answering your questions.

Here's how you can participate:

• Starting now, ask questions Secretary of Homeland Security Jeh Johnson on Twitter using the hashtag #DHSchat.
• On Wednesday, April 9, at 1:00 p.m. EDT Secretary Johnson will begin to answer your questions.
• Follow the chat live on Twitter through the Department’s official Twitter account, @DHSgov and by following #DHSchat. Secretary Johnson’s responses will be tweeted from the @DHSgov account.

Be sure to follow @DHSgov on Twitter for the latest from the Department of Homeland Security and our component agencies. I hope you’ll join the conversation tomorrow at 1:00 PM Eastern.