recommended reading

Priorities for Enhancing National Cybersecurity



By Jamie Brown January 4, 2017

recent posts

Jamie Brown is the director of global government relations for CA Technologies.

Presidential transitions are a time of considerable change in government, including new agency leaders and evolving policy priorities. But many issues persist, and this is certainly the case with cybersecurity. Advancing our nation’s cybersecurity posture must be a key priority for the Trump administration, especially if we are to maximize the benefits of digital transformation.

The nonpartisan Commission on Enhancing National Cybersecurity—which includes cybersecurity experts from industry, academia and government—recently delivered policy recommendations and action items for consideration by the new president and Congress. The comprehensiveness of the report reflects the public-private approach the commission took in seeking input on what our nation’s cybersecurity priorities should be in the years ahead.

Still, there are several areas that should be prioritized and improved upon.

First, the report rightly recognizes the critical role of identity-centric security in the digital economy, given identity is a key attack vector. The report recommends the launch of a national public-private initiative to increase the use of strong authentication to improve identity management.

The commission also stresses the importance of authenticating devices in an internet of things environment. But there needs to be significant emphasis now on managing privileged users and those accounts and credentials that hold the “keys to the kingdom.” In the medium and longer term, there should be greater focus on continuous authentication, using risk-factor and behavioral-based analysis to enhance security and reduce friction for users.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Second, the report recommends building on the success of the NIST Cybersecurity Framework by actively sustaining and increasing its adoption by federal agencies and private organizations. Many technology companies—including my employer—have been using the framework to help prioritize cybersecurity investments to improve technology processes.

To the extent we are able to use common terminology and risk management-based approaches, this will help improve the information security outcomes across the entire security ecosystem. Further, state and local governments interested in aligning their information security practices with the framework could benefit from additional federal government guidance or incentives.

Third, the report stresses the importance of technology adoption and of accelerating technology refreshes. According to the Government Accountability Office, the federal government spends over 75 percent of its IT budget on operations and maintenance rather than on expenditures for new technologies. This puts IT infrastructure at risk.

While the modernization of legacy IT is critical, we also need to extend modernization to deployment because, ultimately, federal agencies will not be able to realize the security benefits of new technologies unless they are actively in use.

Finally, the report recognizes the global context of the cybersecurity ecosystem and that the adoption of cybersecurity norms can help strengthen stability throughout our digital world. And while there are many potential benefits of a more active role for the federal government in the global standards arena, this activity should be closely tied to the promotion of international, industry-driven standards.

Using market-based approaches allows technology companies to focus resources on enhancing innovative security solutions for the global market, rather than on compliance with distinct requirements in different countries.

Cybersecurity is a shared responsibility. Hackers and bad actors aren’t going away; the attacks against government agencies, critical infrastructure industries and consumers continue to escalate with alarming frequency and volume.

Collectively—government, industry and consumers—we need to find a way to stay one step ahead. With this report, the commission created a promising road map, but it’s up to everyone to take the actions necessary to build a stronger cyber ecosystem and enhance our national cybersecurity posture.


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.