014 - Appendix 1 Imperatives Recommendations and Action Items

Section thirteen of Report on Securing and Growing the Digital Economy. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or a volunteer, please visit LibriVox dot org.

Recording by Jennifer Henry. Report on Securing and Growing the Digital Economy by the Commission on Enhancing National Cybersecurity. Appendix one Imperatives, Recommendations, and action items. Note some recommendations apply to more than the single imperative under which they first appear.

Imperative one, Protect, defend, and secure today's information infrastructure and Digital networks Recommendation one point one. The private sector and the administration should collaborate on a road map for improving the security of digital networks, in particular by achieving robustness against the denials of service, spoofing, and other attacks on users and the nation's network infrastructure. Action Item one point one point one. The President should direct senior federal executives to launch a private public initiative, including provisions to undertake, monitor, track, and report on measurable progress in enabling agile, coordinated responses and mitigation of attacks on the users and the nation's network infrastructure.

Short term Recommendation one point two. As our cyber and physical worlds increasingly converge, the federal government should work closely with the private sector to define and implement a new model for how to defend and secure this infrastructure. Action Item one point two point one. The President should create through Executive Order the National cyber Security Private Public Program NCP three as a forum for addressing cyber secure issues through a high level joint public private collaboration.

Short term Action Item one point two point two. The private sector and administration should launch a joint cybersecurity Operation program for the public and private sectors to collaborate on cybersecurity activities in order to identify, protect from, detect, respond to, and recover from cyber incidents affecting critical infrastructure SEI Medium term Action Item one point two point three. The federal government should provide companies the option to engage proactively and candidly informal collaboration with the government to advance cyber risk management practices and to establish a well coordinated joint defense plan based on the principles of the Cybersecurity Framework.

Short term Action Item one point two point four. Federal agencies should expand the current implementation of the information Sharing strategy to include exchange of information on organizational interdependencies within the cyber supply chain. Short term action item one point two point five. With the increase in wireless network communications across all organizations and the nation's growing reliance on the Global Positioning System GPS to provide positioning, navigation, and timing, PNT cybersecurity strategies must specifically address the full range of risks across the electromagnetic spectrum.

An immediate goal should be enhancing the nation's ability to detect and resolve purposeful wireless disruptions and to improve the resilience and reliability of wireless communications and PNT data. Short term Recommendation one point three. The next administration should launch a national public private initiative to achieve major security and privacy improvements by increasing the use of strong authentication. To improve identity management, Action Item one point three point one, the next administration should require that all Internet based federal government services provided directly to citizens require the use of appropriately strong authentication.

Short term Action Item one point three point two. The next administration should direct that all federal agencies require the use of strong authentication by their employees contractors and others using federal systems. Short Term Action Item one point three point three. The government should serve as a source to validate identity attributes to address online identity challenges.

Medium Term Action Item one point three point four, The next administration should convene a body of experts from the private and public sectors to develop identity management requirements for devices and processes in support of specifying the sources of data. Short term Recommendation one point four. The next administration should build on the success of the Cybersecurity Framework to reduce risk both within and outside of critical infrastructure by actively working to sustain and increase use of the framework.

Action Item one point four point one. NISTS, in coordination with the NCP three should establish a cyber Security Framework Metrics Working Group CFMWG to develop industry led consensus based metrics that may be used by one industry to voluntarily assess relative corporate risk, to the Department of Treasury and insurers to understand insurance coverage needs and standardize premiums, and three dhs to implement a nationwide voluntary incident reporting program for identifying cybersecurity gaps.

This reporting program should include a cyber Incident Data and Analysis Repository CIDAR. Short term Action item one point four point two. All federal agencies should be required to use the Cybersecurity Framework. Short term Action item one point four point three.

Regulatory agencies should harmonize existing and future regulations with the Cybersecurity Framework to focus on risk management, reducing industry's cost of complying with prescriptive or conflicting regulations that may not aid cybersecurity and may unintentionally discourage rather than incentivize innovation. Short term Action item one point four point four. The private sector should develop conformity assessment programs that are effective and efficient and that support the international trade and business activities of US companies.

Short term Action item one point four point five. The government should extend additional incentives to companies that have implemented cyber risk management principles and demonstrated collaborative engagement. Short term recommendation one point five. The next administration should develop concrete efforts to support and strengthen the cybersecurity of Small and medium sized Businesses SMBs.

Action item one point five point one. The National Institute of Standards and Technology NIST should expand its support of SMBs in using the Cybersecurity framework and should assess its cost effectiveness specifically for SMBs. Short Term Action Item one point five point two. DHS and NISS, through the National Cybersecurity Center of Excellence and CCoE, in collaboration with the private sector, should develop blueprints for how to integrate and use existing cybersecurity technologies with a focus on meeting the needs of SMBs.

Short Term Action Item one point five point three. Sector specific Agencies ssas and industry associations and organizations should collaborate to develop a program to review past public cyber attacks to identify lessons learned from the event, including a focus on application to SMBs. Short Term Imperative two Innovate and accelerate investment for the security and growth of digital networks and the digital economy Recommendation two point one. The federal government and private sector partners must join forces rapidly and purposefully to improve the security of the Internet of Things IoT Action Item two point one point one.

To facilitate the development of secure IoT devices and systems within sixty days, the President should issue an executive order directingnists to work with industry and voluntary standards organizations to identify existing standards, best practices, and gaps for deployments ranging from critical systems to consumer commercial uses, and to jointly and rapidly agree on a comprehensive set of risk based security standards, developing new standards where necessary. Short term action Item two point one point two.

Regulatory agencies should assess whether effective cybersecurity practices and technologies that are identified by the stated and its process in Action Item two point one point one are being effectively and promptly implemented to improve cybersecurity, and should initiate any appropriate rulemaking to address the gaps. Medium term Action Item two point one point three. The Department of Justice should lead an inter agency study with the Departments of Commerce and Homeland Security and work with the Federal Trade Commission, the Consumer Product Safety Commission, and interested private sector parties to assess the current state of the law with regard to liability for harm caused by faulty IoT devices and provide recommendations within one hundred eighty days.

Short term action item two point one point four. The Industrial Control System's Cyber Emergency Response Team ICSCERT should develop and communicate guidelines for IoT cybersecurity and privacy best practices for rapid deployment and use. Short term Recommendation two point two. The federal government should make the development of usable, affordable, inherently secure, defensible, and resilient recoverable systems its top priority for cybersecurity research and development R and D as a part of the overall R and D Agenda.

Action Item two point two point one, The Director of the Office of Science and Technology Policy OSTP should lead the development of an integrated government private sector cybersecurity roadmap for developing usable, affordable, inherently secure, resilient, recoverable privacy, protecting functional and defensible systems. This effort should be backed by a significant R and D funding increase in the President's budget request for agencies support awarding this roadmap. Short term Action Item two point two point two.

The US government should support cybersecurity focused research into traditionally underfunded areas including human factors and usability policy, law metrics, and the social impacts of privacy and security technologies, as well as issue specific to small and medium sized businesses where research can provide practical solutions. Short term Imperative three. Prepare consumers to thrive in a digital age Recommendation three point one. Business leaders in the information, technology and communications sectors need to work with consumer organizations and the Federal Trade Commission FTC to provide consumers with better information so that they can make informed decisions when purchasing and using connected products and services.

Action Item three point one point one. To improve consumers purchasing decisions, an independent organization should develop the equivalent of a cyber security nutritional label for technology products and services, ideally linked to a rating system of understandable, impartial third party assessment that consumers will intuitively trust and understand. Short and medium term Action Item three point one point two. Within the first one hundred days of the new administration, the White House should convene a summit of business, education, consumer and government leaders at all levels to plan for the launch of a new national cybersecurity Awareness and Engagement campaign.

Short term Action Item three point one point three, the FTC should convene consumer organizations and industry stakeholders in an initiative to develop a standard template for documents that inform consumers of their cybersecurity rules and rest responsibilities as citizens in the digital economy, along with a consumer's bill of rights and responsibilities for the digital age. Medium term Recommendation three point two. The federal government should establish, strengthen and broaden investments in research programs to improve the cybersecurity and usability of consumer products and digital technologies through greater understanding of human behaviors and their interactions with the Internet of Things, IoT and other connected technologies.

Action Item three point two point one. The next administration and Congress should prioritize research on human behavior and cybersecurity on the basis of the twenty sixteen Federal Cybersecurity Research and Development Strategic Plan. Short Term Imperative four Build Cybersecurity Workforce Capabilities Recommendation four point one. The nation should proactively address workforce gaps through capacity building while simultaneously investing in innovations such as automation, machine learning, and artificial intelligence that will redistribute the future required workforce.

Action Item four point one point one. The next president should initiate a national Cybersecurity Workforce program to train one hundred thousand new cybersecurity practitioners by twenty twenty. Short Term Action Item four point one point two. The next president should initiate a National Cybersecurity Apprenticeship program to train fifty thousand new cybersecurity practitioners by twenty twenty.

Medium turn Action item four point one point three. To better prepare students as individuals and future employees, federal programs supporting education at all levels should incorporate cybersecurity awareness for students as they are introduced to and provided with Internet based devices. Short term action item four point one point four. The federal government should develop a mandatory training program to introduce managers and executives to cybersecurity risk management topics, even if their role is not focused on a cybersecurity mission area, so that they can create a culture of cybersecurity in their organizations.

Short term action item four point one point five. The federal government SLTT, governments and private sector organizations should create and exchange program aimed at increasing the cybersecurity experience and capabilities of mid level and senior level employees. Short term action item four point one point six. The Office of Personnel Management o PM should establish a Presidential cyber Security Fellows program for federal civilian in agencies, with the goal of bringing on two hundred cybersecurity specialists by twenty twenty.

Short term Action item four point one point seven NIST, the National Science Foundation NSF, the National Security Agency, NSA and the Department of Education should work with private sector organizations, universities, and professional societies to develop, standardize, interdisciplinary cybersecurity curricula that integrate with and expand existing efforts and programs. Medium term Action Item four point one point eight. In order to attract more students to pursue cybersecurity degree programs and enter the cybersecurity workforce in both the public and private sectors, incentives should be offered to reduce student debt or subsidize the cost of education through a public private partnership.

Medium term Imperative five. Better equip government to function effectively and securely in the digital age Recommendation five point one. The federal government should take advantage of its ability to share components of the information technology IT infrastructure by consolidating basic network operations. Action Item five point one point one.

The Administration should establish a program to consolidate all civilian agency's network connections, as well as those of appropriate government contractors, into a single consolidated network. This program and the consolidated network should be administered by the newly established Cybersecurity and Infrastructure Protection Agency described in Action Item five point five point two. Medium Term Recommendation five point two, The President and Congress should promote technology adoption and accelerate the pace at which technology is refreshed within the federal sector.

Action Item five point two point one, the Administration should expand on the recently proposed Information Technology Modernization Fund ITMF to enable agencies to fund technology investments by spreading costs over a predetermined period of time. The investments made under this fund should be integrated into a rolling ten year strategic investment plan as part of a budget planning process similar to the Department of Defense DoD approach. Short Term Action Item five point two point two, the General Services Administration GSA should lead efforts on integrating technology more effectively into government operations, working with Congress to reform federal procurement requirements and expanding the use of sharing standard service platforms.

Medium Term Recommendation five point three move federal agencies from a cybersecurity requirements management approach to one based on enterprise risks disk management ERM. Action Item five point three point one. The Office of Management and Budget OMB should require federal agencies to use the Cybersecurity Framework for any cybersecurity related reporting, oversight, and policy review or creation. Short Term Action Item five point three point two.

In the first one hundred days of the administration, OMB should work with NIST and DHS to clarify agency and OMB responsibilities under the Federal Information Security Modernization Act FISMA to align with the Cybersecurity Framework. Short Term Action Item five point three point three. OMB should integrate cybersecurity metrics with agency performance metrics, review these metrics bi annually, and integrate metrics and associated performance with the annual budget process. Short term Recommendation five point four.

The federal government should better match cybersecurity responsibilities with the structure of and positions in the Executive Office of the President. Action Item five point four point one. The President should appoint and empower an Assistant to the President for cybersecurity reporting through the National Security Advisor, to lead national cybersecurity policy and coordinate implementation of cyber protection programs. Short term Action Item five point four point two.

The administration should clarify omb's role and specifically that of the Federal Chief Information Officer CIO, the Federal Chief Information Security Officer CISO, and the Senior Advisor for Privacy in managing cybersecurity related operations in all agencies. Short term Recommendation five point five. Government at all levels must clarify its cybersecurity mission responsibilities across departments and agencies to protect and defend against, respond to, and recover from cyber incidents.

Action Item five point five point one. The President should issue a national cybersecurity strategy within the first one hundred eighty days of his administration. Short term Action Item five point five point two. Congress should consolidate cybersecurity and infrastructure protection functions under the oversight of a single federal agency and ensure this agency has the appropriate capabilities and responsibilities to execute its mission.

Short term Action Item five point five point three. The governors in each state should consider seeking necessary legislative authority and resources to train and equip the National Guard to serve as part of the nation's cyber security defense. Short medium term Imperative six Ensure and open, fair, competitive, and secure or global Digital Economy Recommendation six point one. The Administration should encourage and actively coordinate with the international community in creating and harmonizing cybersecurity policies and practices and common international agreements on cybersecurity law and global norms of behavior.

Action Item six point one point one. Within the first one hundred eighty days of the next administration. The President should appoint an Ambassador for Cybersecurity to lead US engagement with the international community on cybersecurity strategies, standards, and practices. Short Term Action Item six point one point two.

The federal government should increase its engagement in the International Standards Arena to garner consensus from other nations and promote the use of sound, harmonized cybersecurity standards. Medium term Action Item six point one point three. The Department of State should go continue its work with like minded nations to promote peacetime cybersecurity norms of behavior. Short term Action Item six point one point four.

Congress should provide sufficient resources to the Department of Justice DOJ to fully staff and modernize the Mutual Legal Assistance Treaty MLAT process, including hiring engineers and investing in technology that enables efficiency. It should also amend US law to facilitate transborder access to electronic evidence for limited legitimate investigative purposes, and should provide resources for the development of a broader framework and standards to enable this transborder access.

Medium Term Action Item six point one point five. NIST and the Department of State should proactively seek international partners to extend the Cybersecurity Framework's approach to risk management to a broader international market. Short Term Action Item six point one point six. The Department of State DHS and other agencies should continue to assist countries with cybersecurity capacity building in light of growing needs and recent developments.

Short term end of Section thirteen.