By Justin Katz Feb 24, 2021 Einstein, a core component of the government's National Cybersecurity Protection System, was unable to stop the Solarwinds compromise because it focuses on attacks coming from outside the network, according to the acting director of the Cybersecurity and Infrastructure Security Agency. CISA is exploring ways to monitor internal "anomalous activities," such as a network management system communicating through an encrypted channel to an entity outside the network, Brandon Wales, acting CISA chief, said at a Feb. 18 event hosted by the Business Council for International Understanding. "There are things that clearly need to be done to enhance our ability to stop attacks like this in the future. One that we are working on is better insights and visibility into the end points," he said.