"We have to start thinking about people and data, and not necessarily infrastructure,” Matt Moynahan said at the Cybersecurity Leadership Forum.

The DHS office charged with protecting critical infrastructure needs to get better at assessing cyber risk rather than chasing threats, according to a top agency official.