One of President Joe Biden’s final acts while in the White House could be seen as a critical step in providing greater cybersecurity innovation. The president issued a sweeping cybersecurity directive in the form of a 40-page executive order on Thursday. It will mark his administration’s final effort to foster a greater focus on emerging cyber technologies including artificial intelligence.
However, it shouldn’t be the final word on the matter said experts.
The 11th-hour order follows a previous one that Mr. Biden issued in his first year in the Oval Office while incorporating the lessons learned over the past four years. It described the cyber campaigns targeting the United States and Americans – notably those directed by China – were the “most active and persistent cyber threat to United States Government, private sector, and critical infrastructure networks.”
The order further called for greater transparency and security in third-party software supply chains, and to improve the security and integrity of software deemed “critical to the Federal Government’s ability to function.” It also called for the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to have the responsibility to hunt for known vulnerabilities across federal systems, while it will make it easier for the U.S. to impose sanctions on groups that conduct ransomware attacks against critical American infrastructure.
A Necessary Move – Too Long in Coming
Cybersecurity researchers have praised the executive order but also cautioned that the Trump administration should also make cybersecurity a priority.
Chris Hauk, consumer privacy champion at Pixel Privacy told ClearanceJobs that the incoming administration “should take a look at the executive order and determine what other steps can be taken to further secure systems”
Even as this is a strong step forward, there’s always more to be done.
“The next administration should build on this momentum by further highlighting practical next steps that eventually every organization should comply with, as well as nurturing such initiatives with dedicated budgets,” Dr. Marc Manzano, general manager for cybersecurity at SandboxAQ, told ClearanceJob, “Cybersecurity is critical to protecting national infrastructure, economic stability, and public safety.”
The executive order highlights the need for U.S. national policy priority to be in line with private sector trends.
Karl Mattson, CISO at Endor Labs told ClearanceJobs that software security is at the very top of the list of priorities.
“It’s more important than ever that our software and our software development practices aim towards new levels of sophistication, transparency, and accountability,” Mattson explained. “These practices must be improved, they must be required, and they must be continuous to counter the cyber risks ahead of us.”
More To Come?
Biden’s executive order calls for actions that will be made after he leaves the White House. The hope now is that this doesn’t wither on the vine. At the same time, these efforts should be allowed to take root before more actions are directed suggested Roger Grimes, data-driven defense evangelist at KnowBe4.
“This is a very comprehensive EO with all very good advice and recommendations. I don’t think the next incoming administration is going to be overturning anything it requires,” said Grimes.
“But it is pretty comprehensive and wide-ranging enough, so I think we need to wait a bit to see how all the existing requests – each with 90-, 180-, and 270-day responses required – turn out before we pile more requests. You can always add more things you’d like to see,” Grimes told ClearanceJobs. “I’ve got 10 things I can think of off the top of my head. But it’s pretty comprehensive already.”
Attacks Will Continue
It would also be unwise to assume that these actions, or even any made by President-elect Trump, will be enough to stop attacks. Words can only do so much, and it will be how the U.S. responds to future attacks that may matter more.
“It certainly won’t prevent all cyberattacks or software vulnerabilities. But it could prevent some, and when attacks do happen, organizations can react and take steps to protect themselves more quickly,” explained Paul Bischoff, consumer privacy advocate at Comparitech.
“Whether we’re talking about ransomware gangs or state-sponsored threat actors, most of our digital adversaries are foreign, and the U.S. is the biggest target of cyberattacks worldwide. Americans and American corporations have no other recourse to defend themselves,” Bischoff continued Making cybersecurity part of our national security strategy is doubly important for protecting critical infrastructure.”
That is especially true as it isn’t just criminal gangs that have been conducting the attacks.
“Numerous cyberattacks that we’ve seen over the last few years have been by state-sponsored hackers from Russia, North Korea, and China,” Hauk added. “This makes cybersecurity one of the top concerns that the U.S. and its allies should be addressing.”
