016 - Appendix 5 Cybersecurity Policy Overview

Speaker 1: Section fifteen of Report on Securing and Growing the Digital Economy. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox dot org. Recording by Colleen McMahon. Report on Securing and Growing the Digital Economy by the Commission on Enhancing National Cybersecurity. Appendix five Cybersecurity Policy Overview. This appendix provides an overview of selected cybersecurity policies established by recent administrations to address our nation's cybersecurity challenges. Clinton Administration Policies one. Executive Order EO one three zero one zero Critical Infrastructure Protection July fifteenth, nineteen ninety six. EO thirteen oh one OH established the President's Commission on Critical Infrastructure Protection, also known as the MARSH Commission. The purpose of this commission was to assess the vulnerabilities of critical infrastructures and develop recommendations for better protecting them. S two The Report of the President's Commission on Critical Infrastructure Protection Critical Foundations Protecting America's Infrastructures, October nineteen ninety seven. This report from the MARSH Commission concluded that our nation's critical infrastructure was facing increasing risks and that current defenses were minimal. The Commission recommended a joint effort between the public and private sectors to improve security. Section three Presidential Decision Directive sixty three p d D sixty three Critical Infrastructure Protection Sector Coordinators, August fourth, nineteen ninety eight, produced in response to the recommendations of the Marsh Commission. Pd D sixty three was the first U S policy statement on critical infrastructure, and it highlighted the need to better protect critical infrastructure from physical and cyber threats. PDD sixty three was revoked and replaced by Homeland Security Presidential Directive seven in two thousand three. Section four Defending America's Cyberspace National Plan for Information Systems Protection, Version one point zero two thousand This plan, which was created in support of PDD sixty three, proposed ten programs to aid the federal government in protecting critical US systems and networks. These programs include identifying critical infrastructure assets and vulnerabilities, detecting attacks, sharing attack information, training security specialists, strengthening research and development efforts, and increasing public outreach Bush Administration policies. Section five, The National Strategy to Secure Cyberspace February two thousand three. This document provided a framework for ensuring that our nation's efforts to improve cybersecurity are effectively organized and US prioritized. The strategy emphasized the need for a wide range of Americans to have roles in cybersecurity. Six Homeland Security Presidential Directive seven HSPD seven Critical Infrastructure Identification, Prioritization and Protection December seventeenth, two thousand three. HSPD seven changed federal agency responsibilities related to critical infrastructure protection. Its policy statements included designating an agency to lead protection activities for each critical infrastructure sector. HSPD seven was revoked and replaced by Presidential Policy Directive twenty one in twenty thirteen. Seven National Infrastructure Protection Plan NIPP two thousand and six. The NIPP was created to address requirements from HSPD seven. The NIPP defined the federal government's approach to identify quote national priorities, goals and requirements for CI protection end of quote. Other information provided by the NIPP included the identification of federal agency responsibilities for critical infrastructure protection and the definition of the risk management framework to be used for assessing, prioritizing, and addressing risks to critical Infrastructure. Eight National Security Presidential Directive fifty four NSPD fifty four slash Homeland Security Presidential Directive twenty three HSPD twenty three Cybersecurity Policy January two thousand and eight. NSPD fifty four HSPD twenty three started the Comprehensive National Cybersecurity Initiative CNCI. The primary goals of the CNCI were quote to establish a front line of defense against today's immediate threats, to defend against the full spectrum of FA threats, and to strengthen the future cybersecurity environment end of quote. Obama Administration Policies nine NIPP two thousand and nine February two thousand and nine. This document refined the original NIPP from two thousand and six. Its changes included adding critical manufacturing as a critical infrastructure sector and merging education into the government facilities sector. Ten Cyberspace Policy Review Assuring a Trusted and Resilient Information and Communications Infrastructure, May two thousand and nine. This report documented the results of a sixty day review of the federal government's efforts regarding cybersecurity. It also made several recommendations, including the following quote The nation needs to develop the policies, processes, people, and technology required to mitigate cybersecurity related risks. End of quote. Addressing network security issues require wires, a public private partnership, as well as international cooperation and norms. The United States needs a comprehensive framework to ensure coordinated response and recovery by the government, the private sector, and our allies to a significant incident or threat. End of quote quote. The United States needs to conduct a national dialogue on cybersecurity to develop more public awareness of the threat and risks, and to ensure an integrated approach toward the nation's need for security and the national commitment to privacy rights and civil liberties guaranteed by the Constitution and law. End of quote. The government needs to increase investment in research that will help address cybersecurity vulnerabilities while also meeting our economic needs and national security requirements. End of quote. Eleven National Strategy for Trusted Identities in Cyberspace Enhancing online choice, efficiency, security, and privacy. April two thousand and eleven. The National Strategy for Trusted Identities in Cyberspace NSTIC was created to improve the security of online transactions by encouraging the private sector to develop tools for securing the identities of individuals and other entities involved in online transactions. Twelve International Strategy for Cyberspace Prosperity, Security, and Openness in a Networked World, May twenty eleven. This strategy complemented other Obama administration cybersecurity policies by emphasizing the need for international cooperation to achieve technology reliability and security. Principles from the strategy include strengthening partnerships with a wide variety of stakeholders, implementing measures to dissuade and deter adversaries, and facilitating the development of global cybersecurity capabilities. Thirteen Executive Order one three five eight seven Structural Reforms to improve the secure purity of classified networks and the responsible sharing and safeguarding of classified information. October seven, twenty eleven. EO one three five eight seven directed federal agencies to better protect the security of their classified information and for such information involving people, to also protect the individual's privacy and civil liberties. Fourteen Executive Order one three six three six Improving Critical Infrastructure Cybersecurity February twelve, twenty thirteen. EO one three six three six initiated the development of a voluntary cybersecurity framework for organizations to use in reducing cyber risk to critical infrastructure. EO one three six three six also directed the Department of Homeland Security DHS to produce a list of critical infrastructure systems and assets that could be disrupted by a cyber attack, and directed federal agencies to notify private organizations if they were the target or victim of malicious cyberactivity. Fifteen Presidential Policy Directive twenty one PPD twenty one Critical Infrastructure Security and Resilience, February twelfth, twenty thirteen. This directive recognized the importance of strengthening critical infrastructure security and resilience, and it recommended accomplishing such strengthening through collaboration among federal, state, local, tribal, and territorial government agencies, as well as public and private sector organizations. PPD twenty one detailed federal agency roles and responsibilities related to critical infrastructure security and resilience, and it triggered several actions by these agencies in consequence. Sixteen NIPP twenty thirteen, December twenty thirteen, as directed by PPD twenty one, The two thousand nine version of the NIPP was revised and re released. The changes were more much more extensive than those made in two thousand and nine to the two thousand and six version. The twenty thirteen version of the NIPP quote reflects changes in the critical infrastructure risk policy and operating environments, and is informed by the need to integrate the cyber, physical, and human elements of critical infrastructure in managing risk. End of quote seventeen Framework for Improving Critical Infrastructure Cybersecurity, February twenty fourteen, commonly known as the Cybersecurity Framework. This document quote enables organizations, regardless of size, degree of cybersecurity risk, or cybersecurity sophistication, to apply the principles and best practices of risk management to improving the security and resilience of critical infrastructure. End of quote eighteen Office of Management and Budget omb M fifteen oh one Fiscal Year twenty fourteen twenty fifteen Guidance on Improving Federal invs. Information Security and Privacy Management Practices, October third, twenty fourteen. This memorandum made several changes to federal cybersecurity practices, including a shift from periodic to continuous risk assessment and cybersecurity monitoring. It also authorized DHS to scan federal agency's publicly accessible networks for the presence of vulnerabilities. Nineteen Executive Order one three six nine one Promoting Private Sector Cybersecurity Information Sharing February thirteenth, twenty fifteen. This EO promoted the creation of entities such as Information Sharing and Analysis Organizations issaos that enable businesses, government agencies, and other organizations to share cybersecurity information with each other. Twenty fact sheet Enhancing and Strengthening the Federal Government's Cybersecurity June twelfth, twenty fifteen. This effort, better known as the thirty Day Cybersecurity Sprint, directed federal agencies to make several immediate improvements to their cybersecurity policies and processes. It also formed a Cybersecurity Sprint team to review federal cybersecurity policies and processes, identify shortcomings and priorities, and recommend how to address them. In addition, the Sprint directed the development of a federal cybersecurity strategy based on the following key principles. Protecting data, improving situational awareness, increasing cybersecurity proficiency, increasing awareness, Standardizing and automating processes, controlling, containing, and recovering from incidents, Strengthening systems life cycle security, reducing attack surfaces twenty one. Office of Management and Budget M sixteen four. Cybersecurity Strategy and Implementation Plan CSIP for the Federal Civilian Government, October thirty, twenty fifteen. The CSIP resulted from the thirty Day Cybersecurity Sprint. The CSIP established five objectives for Federal Civilian agencies a quote Prioritized identification and protection of high value information and assets. B Timely detection of and rapid response to cyber incidents. C Rapid recovery from incidents when they occur, and accelerated adoption of lessons learned from the Sprint assessment. D Recruitment and retention of the most highly qualified cybersecurity workforce talent the federal government can bring to bear, and E Efficient and effective acquisition and deployment of existing and emerging technology end of quote. Twenty two fact sheet Cybersecurity National Action Plan, February ninth, twenty sixteen. This plan initiated several actions to improve cybersecurity for the federal government, the private sector, and individuals, including the following A. Establish the Commission on Enhancing National Cybersecurity. B Propose an IT modernization fund for the replacement of legacy technologies. C. Encourage users to adopt multi factor authentication. D. Propose a significant budget increase for federal cybersecurity efforts. Twenty three Federal Cybersecurity Research and Development Strategic Plan, February ninth, twenty sixteen. The plan defined three cybersecurity R and D goals. One Within the next one to three years, achieve the science and technology advances needed to quote counter adversaries asymmetrical advantages with effective and efficient risk management end of quote, meaning the ability to identify, assess, and respond to cybersecurity risks. Two Over the next three to seven years, achieve advances to quote reverse adversaries asymmetrical advantages through sustainably secure systems development and operation end of quote. And three over the next seven to fifteen years, achieve advances quote for effective and efficient de terrance of malicious cyberactivities via denial of results and likely attribution end of quote. Twenty four Executive Order one three seven one eight Commission on Enhancing National Cybersecurity, February ninth, twenty sixteen. This EO established the commission that produced the present report. See Appendix four for a copy of EO one three seven one eight's text. Twenty five Presidential Policy Directive forty one United States Cyber Incident Coordination July twenty sixth, twenty sixteen APD forty one clarified roles and responsibilities related to cybersecurity incident handling. It also directed the formation of a Cyber Unified Coordination Group UCG to coordinate incident response efforts for the most serious incidents. Policy themes. Common themes among these cybersecurity policies include the following Improving the security of our nation's critical infrastructure, Encouraging joint efforts involving a wide variety of public and private sector organizations to improve global cybersecurity, Improving federal cybersecurity policies and practices, especially in terms of incident response capabilities, using risk management principles to assess vulnerabilities and select mitigations. Encouraging cybersecurity information sharing among public and private sector organizations, Increasing public awareness of cybersecurity, and increasing investments in cybersecurity research. Notably absent from these themes is regulation. Except for a brief period in the Obama administration, the past three administrations have consistently eschewed regulation as a policy solution for cybersecurity policy criticisms. Fault has been found with the cybersecurity policies proposed by recent administrations, as well as with how those policies have been implemented. Here are examples of well supported criticism from the past few years. In February twenty thirteen, the Government Accountability Office GOO released a report GAOSH one three DEASH one eight seven titled Cybersecurity National Strategy Roles and Responsibilities need to be Better defined and more effectively implemented. It criticized federal cybersecurity strategy documents as follows. Although the federal strategy to address cybersecurity issues has been described in a number of documents, no integrated, overarching strategy has been developed that synthesizes these documents to provide a comprehensive description of the current strategy, including priority actions, responsibilities for performing them, and timeframes for their completion. Existing strategy documents have not always addressed key elements of the desirable characteristics of a strategic approach. Among the items generally not included in cybersecurity strategy documents are mechanisms such as milestones and performance measures, costs and resource allocations. Clear delineations of roles and responsibilities, and explanations of how the documents integrate with other national strategies. The items that have generally been missing are key to helping ensure that the vision and priorities outlined in the documents are effectively implemented. Without an overarching strategy that includes such mechanisms, the government is less able to determine the progress it is made in reaching its objectives and to hold key organizations accountable for carrying out planned activities. End of December twenty thirteen saw the release of Liberty and Security in a Changing World Report and Recommendations of the President's Review Group on Intelligence and Communications Technologies regarding E one three five eight seven. This report issued the following findings and recommendations quote. In recognition of the need to improve security on government networks with classified data, President Obama issued Executive Order one three five eight seven to improve the security of classified networks against the insider threat. We have found that the implementation of that directive has been at best uneven and far too slow. Every day that it remained unimplemented, sensitive data and therefore potentially lives are at risk. Interagency implementation monitoring was not performed at a sufficiently high level in OMB or the NSS National Security Staff. The administration did not direct the reprogramming of adequate funds. Officials who were tardy in compliance were not held accountable. No central staff was created to enforce implementation or share best practices and lessons learned. End of quote. We believe that the implementation of Executive Order one three, five, seven eight should be greatly excelledlerated. The deadlines should be moved up and enforced, and the adequate funding should be made available within agency budget sealings. And a Deputy Assistant to the President might be directed to enforce implementation. The interagency process might be co led by the Deputy Director of OMB. End of section fifteen. Recording by Collie McMahon