WH’s new cybersecurity policy has received praise and caveats
WH’s new cybersecurity policy has received praise and caveats
The White House released its long-awaited national cybersecurity strategy on Thursday. The new federal policy assigns much of the responsibility for digital security to tech companies rather than more federal regulations.
The policy document urges more mandates from the companies that control most of the country’s digital infrastructure. He also preaches an expanded government role in disrupting hackers and state-sponsored entities.
But this strategy creates a cybersecurity roadmap for new laws and regulations over the next few years to help the United States prepare for and combat emerging cyber threats. It sets the tone for long-term government action that:
- Explore a national catastrophic cyberattack insurance backstop to complement the existing cyberinsurance market;
- Focus on defending critical infrastructure by expanding minimum security requirements in specific sectors and streamlining regulations;
- Treat ransomware as a national security threat, not just a criminal problem.
This triggers a fundamental shift in the government’s view of cybersecurity. The shift in focus reflects how the United States distributes roles, responsibilities, and resources in cyberspace.
It also rebalances the responsibility of defending cyberspace by shifting the cybersecurity burden away from individuals, small businesses and local governments. Instead, it falls to the most capable and best-positioned organizations to reduce risk to us all, according to political statements.
“The strategy recognizes that government must use all tools of national power in a coordinated manner to protect our national security, public safety, and economic prosperity,” the White House said in its announcement.
The new approach
The Biden-Harris strategy aims to build and strengthen collaboration around five pillars:
- Defend critical infrastructure;
- disrupt and dismantle threat actors;
- Shaping market forces to foster security and resilience;
- Invest in a resilient future through strategic investments and coordinated, collaborative action to lead the world in innovating secure and resilient next-generation technologies and infrastructure;
- Forging international partnerships to pursue common goals
With these standards in place, newly tapped global allies and partners will make America’s digital ecosystem defensible, resilient and values-aligned, according to the policy statement.
Federal cybersecurity requirements, application
The federal government is making a visible and significant commitment to expanding mandatory minimum cybersecurity requirements in critical sectors, proposed Eric Noonan, CEO of CyberSheath.
He added that this is a refreshing acknowledgment of the role of the federal government and a complete departure from the original 2003 strategy, which stated that federal regulation would not be the primary means of securing cyberspace.
“It may have taken 20 years, but now the feds are saying the quiet part out loud. The lack of mandatory cybersecurity minimums has failed and regulatory mandates are coming, so get your house in order,” Noonan told TechNewsWorld.
The strategy also makes clear that where the government lacks the power to impose minimum standards, the administration will work with Congress to fill those gaps and regulate what is unregulated, he observed.
Noonan predicted that a sea change is coming in our ability to detect and defend against cyber threats. But that only happens if agencies like the DOD, SEC, FCC, and the rest of the federal government use the full weight of their regulatory powers to establish and enforce mandatory cybersecurity minimums at their respective contractors and vendors.
“It’s the most impactful thing the federal government can do for our nation’s cyber defense, and this strategy does just that,” he said.
Positive EU support
Martin Riley, director of managed security services at cyber firm Bridewel, is pleased with the change in the attitude of the United States towards cybersecurity.
“It is great to see these measures come into force. In Europe, we have found ourselves in a leadership position in many of these areas with regulations such as NIS and GDPR dictating the agenda for years” , Riley told TechNewsWorld.
This puts the European Union in an excellent position to help its American allies and move them forward in the goal of cyber resilience, he added. “I look forward to digging into the details to see what incentives the U.S. government will apply to ensure these practices are adopted equally across all affected states and sectors.”
Use updated technology Crucial
The report focuses on modernizing federal security. A crucial part of this must be accelerating the government’s ability to integrate modern, next-generation security technologies, advised Marcus Fowler, CEO of Darktrace.
“Government agencies must be able to effectively test technologies in dynamic environments that reflect, in both scale and complexity, the environment they will be expected to defend,” Fowler told TechNewsWorld.
He proposed that US officials would also benefit from moving validated security solutions to the frontline and accelerating mandatory audit timelines. Ultimately, when the federal government has faster access to advanced security solutions, it can force attackers to adapt quickly to try to keep up.
“It’s positive to see that the new strategy emphasizes the importance of mandating ‘safety by design’ as well as a focus on robust technologies and creating a better workforce. cybernetic work,” Fowler said.
technology critical element
Technology will also be key to improving the speed and scale of threat intelligence sharing, as the report calls for. Threat intelligence is essential, but the threat landscape is large and growing.
“Organizations need technology that cuts through intelligence and identifies the impact of a particular vulnerability on their unique environment. They need this information fast,” Fowler recommended.
Distilling this information and translating it into a bespoke organizational risk-based strategy is work for technology. We can no longer impose responsibility on humans because they must be freed up for strategy and remediation, he said.
The future is one where a hybrid human-AI approach to cyber is essential. The goal is to meet a stronger, more robust and better equipped cyber workforce, Fowler noted.
“This needs to be executed with innovative and accessible programs that grow and invest in and augment the next generation of security practitioners to move faster and increase workload efficiency and accelerate response times,” did he declare.
Continuing education, preparation required
The administration’s new cybersecurity efforts, unfortunately, are not moving the needle on what needs to be done to bolster the security workforce we have today, warned Debbie Gordon, Founder and CEO of Cloud. Range, a live OT/ICS cyberattack simulation training company. .
“In any type of life security field — and that’s exactly what critical infrastructure cybersecurity stands for — the need for ongoing training and preparation is integral,” Gordon told TechNewsWorld.
The cyber threat landscape is changing daily, with critical infrastructure sectors being the targets of the most advanced and state-backed Advanced Persistent Threats (APTs). We cannot depend on an annual training certificate to be sure that our infrastructure is protected, she advised.
“Continuing education requirements that can be measured against industry standard frameworks to validate their effectiveness can not only help organizations ensure they have the right people with the right skills to prevent and respond attacks in place. They can also provide cybersecurity professionals with a clear path to develop their careers with cyber skills unique to operational technology (OT) cybersecurity,” Gordon said.