By Gregory Hale
Now that the dust has settled from the initial release of the National Cybersecurity Strategy, everyone can see the document talks about key issues and what the government wants to see happen to ensure a secure digital future.
No one will deny this will be a monumental effort. Now, of course, since the strategy is out there, one thought that comes to mind: Talk is cheap. Now the real work begins with how the government and private sector can execute on the strategy – or if they will execute on the strategy.
They talk about topics where “we will ensure that resilience is not a discretionary element of new technical capabilities but a commercially viable element of the innovation and deployment process.”
Resilience is a key for any organization moving forward, but how any organization gets there seems like it would be a very individual thing for that company – and how the government will play a part remains to be seen.
Collaborative Process
In a similar vein, the strategy also said, “a collaborative process between industry and regulators will produce regulatory requirements that are operationally and commercially viable and will ensure the free and resilient operation of critical infrastructure. The most effective and effective regulatory frameworks will be those put in place well before a crisis, rather than through the imposition of emergency regulations after a crisis occurs.”
In a perfect world that works, but let’s fall back to the Colonial Pipeline incident a few years ago that caused a panic on the East Coast after a ransomware attack shut down the pipeline for a few days and then look at the government’s reaction to it, and it would be easy to have doubts as to that part of the strategy coming to fruition.
“I am not hiding my opinions of the U.S. Government (USG) and both their capability and ability to address the exponentially rising rate of cyber threats hitting not only critical sector assets, but the assets of every organization that relies on information and operational technologies to generate revenue and supply their customers with goods and/or services,” said Joel Langill, founder and managing member of the Industrial Control System Cyber Security Institute LLC. “It is also important to understand that not only does the USG have little responsibility for operating infrastructure, but also are staffed by individuals who have little if any experience working in these industries.
“The problem I see with the National Cyber Security Strategy is that it is based on the assumption that the USG has the answer and knows how to ‘establish cybersecurity regulations to secure critical infrastructure.’ What would lead anyone to think that they have the credentials and staff resources to develop such policy? Instead, they will likely lean on external private sector resources that will start to push technology rather than policy.”
More Regulation
What this all means is the government seems to be leaning toward more regulation, which could be a good or bad thing for the private sector. Clearly, what is happening now needs reigning in, but how far that goes is not necessarily clear in the strategy and will surely need ironing out when more details emerge.
“The National Cybersecurity Strategy is clearly signaling that the government is planning legislation around cyber liability,” said Eric Byres, chief technology officer at software bill of material (SBOM) provider, aDolus. “Nobody wants to be the ‘I told you so’ guy, but back in May 2021 when Executive Order 14028 was announced, I predicted its directives mandating cybersecurity measures for federal agencies were going to bleed into the private sector as well. You don’t make the nation any safer by only focusing on one side of the equation.
“This is a good thing. Software providers should be liable if they knowingly or negligently ship dangerous products. And the government is clearly preparing to use legislation to focus accountability where it will make a difference just as they have in many areas that affect people’s lives.
“Software providers, especially for critical infrastructure, need both a carrot and a stick to prevent tempting shortcuts and embedding third party code of questionable provenance into their products. The strategy recognizes ‘…market forces alone have not been enough to drive broad adoption of best practices in cybersecurity and resilience.’ So, the stick it is.
“To be clear, the liability for secure code needs to fall on the companies selling the systems (and making the money), not the open-source developer,” Byres said. “According to a comment from a government official quoted in CyberScoop, the government understands this: ‘The company that is building and selling the software, they need to be liable for what they put in it and work to reduce vulnerabilities and use best practices,’ the official said. Let’s hope that the government follows up on that.”
Government Follow Through
That is the issue in terms of government following up and following through on issues. That always remains the key question when one administration leaves and another walks in, what will happen to these types of measures?
“My career has exposed me to standards, regulations and policies that address security of critical infrastructure from countries around the world, yet the USG believes that they have the answers and rarely utilize the lessons learned from other such organizations,” Langill said. “This is compounded by their myopic view of technical standards that all revolve around NIST Special Publications that are and have always been ‘developed to address and support the security and privacy needs of U.S. Federal Government information and information systems.’ This premise is flawed from the git-go because it does not address the unique nature of cyber-physical systems and consideration from credible threat scenarios that leverage blended attacks against cyber and physical controls to reach their objective via chained exploits.
“One perfect example of this failure to have an agnostic global view of operational security is the failure of the Cybersecurity and Infrastructure Security Agency (CISA) to even acknowledge the existence the exceptional work of the Australian Cyber Security Centre. The Australian document from its first release in 2011 provides recommendations that have been valid and credible in preventing impact from targeted attacks that have never been a part of the CIS Critical Controls from which the USG seems to depend upon.
“Since our awakening in 2011, I have been a strong opponent of policy because it leads to a compliance mindset rather than a risk-based one. There are organizations that are years ahead of any existing USG positions and policy tends to cause more harm than good in these situations. A lot of lessons were learned with the NERC CIP evolution, and I would only hope that some of these will be documented before we are faced with a lot of regulations that completely miss the mark.”
On paper the National Cybersecurity Strategy is a good thing and if executed properly could help ensure a secure digital workplace. And, yes, you have to start someplace to get the ball rolling, but the skeptic would say we have seen this before, and the U.S. government just does not have staying power to keep this up. Time will tell.