DELUSIONS OF ADEQUACY: WHY PRESIDENTIAL POLICY DIRECTIVE 41 FALLS SHORT

Daren Glenister

Delusions of Adequacy

President Obama’s recent policy directive on cybersecurity was eight years in the making. Unfortunately, its proposed actions are barely adequate to the massive task of defending against the onslaught of daily cyber attacks on U.S. companies and government agencies.

The new document, Presidential Policy Directive 41, is supposed to improve government and private-sector coordination in dealing with major cyberattacks. Among other things, the directive lays out which agencies will handle tasks related to a major cyber breach.

For example, the FBI gets tasked with conducting breach investigations, while DHS has the lead for providing “technical assistance” to breach victims “to protect their assets, mitigate vulnerabilities, and reduce impacts of cyber incidents.”

The White House’s Office of the Director of National Intelligence takes the lead for “intelligence support and related activities.” And of course there will be lots of “coordination” among these agencies through a newly set up Cyber Unified Coordination Group.

New Color Scheme for Cyberattacks

In addition to the directive, the administration released a five-level cyber incident severity schema, setting up a common framework for assessing the severity of cyber attacks, similar to the DHS’s national terrorism advisory system threat-level matrix. There is an attractive color pallet of white, green, yellow, orange, red, and black to categorize everything from an “inconsequential event” to a cyber event that “poses an imminent threat” to critical infrastructure, federal government stability, or to the lives of U.S. citizens.

Unfortunately, the U.S. government has zero credibility when it comes to establishing effective policies and procedures on cybersecurity. Just look at the number and scope of federal agency breaches over the last few years – the Office of Personnel Management, the Internal Revenue Service (twice), the State Department, the U.S. Postal Service, the Department of Commerce, and the Federal Deposit Insurance Corp, not to mention the recent Democratic National Committee email hack and Hillary Clinton’s questionable handling of government email while she was secretary of state.

While highly regulated industries must provide strong data security or face government fines or other regulatory action, no one is keeping the government itself honest; no one is threatening the government with fines or any other actions. Accountability forces the private sector to be proactive about data security, but the government can do anything it wants.

Securing Data Before It Is Breached

But the directive and schemata beg the question: What are you going to do to secure your data before it is breached?

This directive does nothing to help CIOs, whether in the government or in the private sector, prevent these breaches in the first place. The guidelines are too focused on what to do after an attack – there is no mention of any type of preventative measures improving user behavior.

Instead, public and private entities should be asking: What kind of sensitive data do we have, and who needs to access it? What is our plan for controlling who has access to data? What are more secure ways people can share this sensitive data other than email? Does our current security plan have provisions for data at rest and data in motion?

Most companies have strong protection of data at rest when it is stored on their servers. But when data is in motion, within the company or to outside individuals or vendors, protections are often weak. The weak link in your data security plan is when data is in motion and/or outside of your control.

Instead of expecting the federal government to do something, it is up to the private sector to take action to protect data at rest and in motion before the data is stolen by cyber criminals or nation-states.

By Daren Glenister

Kip Compton

What’s Ahead for Cloud in 2019

The Cloud In 2019 2018 was an incredible time for cloud. Its impact on customer experiences, business processes and models, and workforce innovations was undeniable ...
Gopan

The Economics, Concepts and Fundamentals of Cloud Computing

Fundamentals of Cloud Computing Addressing security concerns of the Public Cloud Enthusiasm for cloud computing has as much to do with economics as technology. Growth ...
Kaylamatthews

What You Need to Know – IoT and Real-Time Operating Systems

Real-Time Operating Systems A real-time operating system, or real-time OS, appears to execute tasks while using a single processing core simultaneously.  However, what's really happening ...
Brad Thies

A Quick and Dirty Guide to GDPR Compliance

GDPR Compliance Set a reminder: On May 25, 2018, the new General Data Protection Regulation directive from the European Union will go into effect. Although ...
Roy Headshot Dome9

Four Cloud Security Mega Trends

Cloud Security Trends Last year was a big year for the cloud. Cloud adoption continued to grow at a rapid clip, even as executives from ...