recommended reading

Expect a Cyber Budget Boost But Stay Tuned for that Executive Order, Homeland Adviser Says

Andrea Izzotti/Shutterstock.com

President Donald Trump’s budget, due out Thursday, will include early indications of a broad plan to upgrade the security of federal networks, Trump’s top homeland security adviser said Wednesday.

Don’t expect a multibillion-dollar investment that will modernize government cybersecurity in one fell swoop, though, Homeland Security Adviser Tom Bossert said during an address at the Center for Strategic and International Studies think tank.

Also, don’t expect a long-rumored executive order that outlines Trump’s cybersecurity plan in the near future, he said, suggesting it will be weeks or months before the order is released in its final form.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Trump’s broad plan to improve government security will include holding top government officials accountable for breaches and vulnerabilities at their agencies, and improving the way federal agencies share cybersecurity services provided by the Homeland Security Department and others, Bossert said.

Protecting federal networks is something Trump views as “an absolutely solemn responsibility,” he said, and the president “doesn’t view it kindly that we have bureaucrats viewing this as a responsibility among others and questions about priorities.”

Bossert spoke for about 45 minutes at CSIS’ Cyber Disrupt conference and did not take audience questions. It was the first formal address on the Trump administration’s cybersecurity priorities since the president took office.

Bossert described the nation’s cybersecurity as in a state of general crisis.

“As I come back to this world, I feel like I have re-awoken from a long 8-year nap and I found a world that is on fire,” he said.

In addition to outlining Trump’s broad cyber priorities, Bossert confirmed the National Security Agency's top hacker, Rob Joyce, will become White House cybersecurity coordinator.

He also confirmed the Trump administration will follow the Obama administration’s practice of pressing other nations to adopt norms of good behavior in cyberspace and will hold them accountable when they fail to live by those norms, Bossert said. He declined to call out specific nations.

Bossert’s address came the same day the Justice Department indicted two members of Russia’s intelligence service for hacking at least 500 million Yahoo email accounts. U.S. intelligence agencies have also concluded the Russian government hacked Democratic political groups during the 2016 election in an effort to help Trump’s electoral chances.

Trump has declined to criticize Russia for those breaches.

Bossert also swung against leakers of classified information during his address, saying, “people that have taken in the past—[Edward] Snowden and other people—things that they shouldn’t, are absolute enemies to our state. Period. They need to be caught and punished.”

Other elements of Trump’s cyber executive order will focus on protecting the “most critical” of critical infrastructure, Bossert said, and on combating botnets—armies of compromised computers and other devices hackers harness to attack websites.

Agencies will also be held responsible for reporting “known unmitigated risks” in their systems going forward and agencies will be assessed based on a range of cybersecurity metrics that will likely not be made public, he said.

“We all now know that antiquated hardware systems and antiquated … software systems holding millions and millions of important records for our national security was a bad approach,” Bossert said, referring to more than 20 million sensitive security clearance documents compromised in Office of Personnel Management systems. “That was a known and unmitigated risk.”

Agencies will also be required to adopt a cybersecurity framework developed by the National Institute of Standards and Technology, he said.

That requirement, which was included in an earlier leaked version of the executive order, was greeted with some skepticism at NIST, which has always insisted the framework should be a voluntary document.

Bossert pledged not to diminish the administration’s commitment to combating cyber crime and asked Americans to trust the administration’s commitment to protecting citizens’ privacy in the process.

“There will be people that don’t trust me and don’t trust the administration,” he said. “I think that’s something they should keep to themselves and hold and reserve judgment until they have some reason not to.”

Threatwatch Alert

Stolen laptop

Wireless Heart Monitor Maker to Pay $2.5M Settlement to HHS After Laptop Stolen

See threatwatch report

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download

When you download a report, your information may be shared with the underwriters of that document.