recommended reading

Priorities for Enhancing National Cybersecurity

mozakim/Shutterstock.com

ARCHIVES

By Jamie Brown January 4, 2017

recent posts

Jamie Brown is the director of global government relations for CA Technologies.

Presidential transitions are a time of considerable change in government, including new agency leaders and evolving policy priorities. But many issues persist, and this is certainly the case with cybersecurity. Advancing our nation’s cybersecurity posture must be a key priority for the Trump administration, especially if we are to maximize the benefits of digital transformation.

The nonpartisan Commission on Enhancing National Cybersecurity—which includes cybersecurity experts from industry, academia and government—recently delivered policy recommendations and action items for consideration by the new president and Congress. The comprehensiveness of the report reflects the public-private approach the commission took in seeking input on what our nation’s cybersecurity priorities should be in the years ahead.

Still, there are several areas that should be prioritized and improved upon.

First, the report rightly recognizes the critical role of identity-centric security in the digital economy, given identity is a key attack vector. The report recommends the launch of a national public-private initiative to increase the use of strong authentication to improve identity management.

The commission also stresses the importance of authenticating devices in an internet of things environment. But there needs to be significant emphasis now on managing privileged users and those accounts and credentials that hold the “keys to the kingdom.” In the medium and longer term, there should be greater focus on continuous authentication, using risk-factor and behavioral-based analysis to enhance security and reduce friction for users.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Second, the report recommends building on the success of the NIST Cybersecurity Framework by actively sustaining and increasing its adoption by federal agencies and private organizations. Many technology companies—including my employer—have been using the framework to help prioritize cybersecurity investments to improve technology processes.

To the extent we are able to use common terminology and risk management-based approaches, this will help improve the information security outcomes across the entire security ecosystem. Further, state and local governments interested in aligning their information security practices with the framework could benefit from additional federal government guidance or incentives.

Third, the report stresses the importance of technology adoption and of accelerating technology refreshes. According to the Government Accountability Office, the federal government spends over 75 percent of its IT budget on operations and maintenance rather than on expenditures for new technologies. This puts IT infrastructure at risk.

While the modernization of legacy IT is critical, we also need to extend modernization to deployment because, ultimately, federal agencies will not be able to realize the security benefits of new technologies unless they are actively in use.

Finally, the report recognizes the global context of the cybersecurity ecosystem and that the adoption of cybersecurity norms can help strengthen stability throughout our digital world. And while there are many potential benefits of a more active role for the federal government in the global standards arena, this activity should be closely tied to the promotion of international, industry-driven standards.

Using market-based approaches allows technology companies to focus resources on enhancing innovative security solutions for the global market, rather than on compliance with distinct requirements in different countries.

Cybersecurity is a shared responsibility. Hackers and bad actors aren’t going away; the attacks against government agencies, critical infrastructure industries and consumers continue to escalate with alarming frequency and volume.

Collectively—government, industry and consumers—we need to find a way to stay one step ahead. With this report, the commission created a promising road map, but it’s up to everyone to take the actions necessary to build a stronger cyber ecosystem and enhance our national cybersecurity posture.

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

    Download
  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

    Download
  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

    Download
  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

    Download
  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

    Download
  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.

    Download

When you download a report, your information may be shared with the underwriters of that document.