DHS detailed the plans in a privacy impact statement — required for new IT systems in government — that it published last Thursday, along with some of the deepest detail yet of the partially classified system, the technology for which has largely been developed by the National Security Agency.
Einstein 3 will follow up on the Einstein 2 intrusion detection system, which is currently readying for operational deployment, and the first Einstein system, which collects network traffic data. It has been the subject of some controversy as observers have expressed privacy concerns in the media and on Capitol Hill about the government’s use of data it collects.
According to the privacy impact statement, the pilot program will solidify the processes required to "manage and protect information gleaned from observing cyber intrusions" and will help DHS map out its path for implementing Einstein 3 more widely.
Einstein 3 will do real-time, deep packet inspection and "threat-based decision making" on network traffic at the edge of federal agency networks. The effort will redirect agency Internet traffic to DHS cybersecurity systems, which will apply pre-defined signatures to the traffic to determine which traffic might be associated with cyber threats and how to respond.
Click here for the full story