The President of the United States recently signed an executive order to improve cybersecurity measures inside the country.
The order included items to review the cybersecurity of federal companies and to improve critical infrastructure.
Initially, President Donald Trump was supposed to have signed the executive order soon after his inauguration in January, but after a press conference he delayed pushing forward the action.
Fulfilling a Promise
Tom Bossert, the president’s advisor for Homeland Security, stated to the media that the new cybersecurity order would be a fulfillment of Trump’s promise to keep the country safe everywhere, even in cyberspace.
According to Bossert, recent trends with regard to cyberspace were “going in the wrong direction” and these trends had to be stopped and reversed for the safety of the country’s people.
This new executive move will offer protection to critical infrastructure in the U.S. and will bring in cybersecurity improvements.
Bossert added that several attacks in the past had succeeded, but they should be prevented in the future with new cybersecurity advancements.
The order involves governmental departments following a protocol created by the National Institute of Standards and Technology (NIST).
The framework is designed to reduce risks of a cyberattack.
Though all departments and heads of agencies can continue to play key roles, the risk has been centralized as a result of the executive order, for the purpose of cybersecurity.
Cybersecurity Methods
The executive order comprises of three important aspects of the president’s attempts at implementing cybersecurity.
It involves the protection of federal networks and updating old or outdated systems, as well as bringing all departmental and agency leaders to work in unison, with a purpose of keeping federal IT as a single business network, according to Bossert.
If this is not done, the government will not be able to understand the cybersecurity risks present, nor find ways to mitigate them.
Bossert stated that the country has seen several attacks made by friends and enemies, mostly from actors of nation states but also from non-nation states.
There is no longer the option to avoid taking action to boost cybersecurity measures, according to Bossert.
Russian Involvement?
When asked whether the Russian hacking had resulted in this new executive order for cybersecurity, Bossert stated that this was not the case.
The action was rather initiated by the U.S. itself towards cybersecurity.
He went on to state that the first aspect of the cybersecurity order relates to protecting networks.
This includes an action to hold agency leaders responsible for the implementation of risk management measures.
It also includes procuring IT services and moving to cloud services by federal networks.
United Approach
Bossert stated that in a scenario where there were no shared services, they would have 190 agencies attempting to create defenses on their own, which is not advisable.
The second aspect of the new executive order aims to protect the country’s critical infrastructure.
This entails the submission of reports within three months on any cybersecurity related vulnerabilities the defense industry is facing, such as risks in supply chain, military platforms, national networks and so on.
It also adds suggestions for solving these vulnerabilities and eliminating them.
The cybersecurity order states that government entities, like the departments of Homeland Security, Treasury, Defense, Attorney General and others, should submit joint reports on the options available for stopping hacks and protecting U.S. citizens from cyber attacks.
After the cybersecurity reports are submitted, the Management and Budget Office should then send these reports to the president within 90 days.
Feasibility
Many cybersecurity experts have described the executive order as unfeasible and that it relies too much on the military.
According to Dan Tentler, founder of tech security company Phobos Group, the government might have to reissue this order.
The advocacy group Access Now noted in a public statement that the executive order did not tackle problems related to data breach.
It also meant a reversal of the cybersecurity-related stand taken by the previous Obama administration to not involve the military in the protection of critical infrastructures such as water, government and commercial infrastructure and facilities.