When compared to recent Presidential Administrations, the present one has taken great efforts and strides to help mitigate the threats of Cyber threats, especially given the recent wave of Ransomware attacks. In this article, we take a closer look at some of the provisions of the recent Cyber Executive Order, and what it means to you.
Any software product that is used in any contractual work for any agency must now adhere to a much stricter set of security requirements, as well as when it comes to the accessing and processing of shared resources (such as that of data sets). Also, the source code of any application that is created for the Federal Government must be thoroughly tested for any gaps and vulnerabilities, and this also includes the use of open-source APIs. Even before they can be released into the production environment, these APIs must first be tested in a sand boxed environment and be updated with the latest patches and/or upgrades.
The Key Takeaways
- The supply chain security risk will be addressed: This has been fueled in large part by the recent Solar Winds security breach. This has been classified as a “Supply Chain Attack” in the sense that the Cyber attacker group used just a couple of the tools from Solar Winds in order to spread their malicious payload to the hundreds of customers that were dependent upon its use. A big chunk of these victims also included the major departments of the Federal Government, especially that of the Department of Defense (DoD). What does this mean to you? Any software product that is used in any contractual work for any agency must now adhere to a much stricter set of security requirements, as well as when it comes to the accessing and processing of shared resources (such as that of data sets). Also, the source code of any application that is created for the Federal Government must be thoroughly tested for any gaps and vulnerabilities, and this also includes the use of open-source APIs. Even before they can be released into the production environment, these APIs must first be tested in a sand boxed environment and be updated with the latest patches and/or upgrades.
- There will be more a more proactive mindset: The US Federal Government has been known to use out of date technology, most notably that of the Internal Revenue Service. But upon the execution of this Executive Order, all agencies will now be required to completely upgrade their IT and Network Infrastructures, by adopting the following: – A total migration to a 100% Cloud based infrastructure, using a platform such as that of the AWS or Microsoft Azure; – Adopting the Zero Trust Framework; – The breaking up of network infrastructures into smaller ones, known technically as “Subnets”. Each one of them will have Multi-factor Authentication (MFA) across all levels when access to confidential information and data needs to be accessed. What does this mean to you? The Federal Government possesses a lot of confidential data about American citizens, especially that of Social Security numbers. Given the current state of technology, all of this is prone to data leakage, whether it is intentional or not. But by taking the steps just reviewed, you will have greater assurances that your Personal Identifiable Information (PII) datasets will be much more secure, especially when it comes to the electronic filing of tax returns. This is one of the peak times when cases of Identity Theft occur, when many fraudulent tax returns are filed.
- Greater access to threat intel: In the past, there have been strong barriers between the sharing of information and data with the US Federal Government and the private sector, namely the Cybersecurity vendors. As a result of this, many threat vectors that could have been potentially mitigated were not. What does this mean to you? All barriers are intended to come down, so there that the exchange of information/data will become a much more transparent process. As a result, your internal IT team or IT Vendor should have a greater access to the latest intel on the threat variants that are out there, and do an even better job of protecting your business and employees from them.
- The establishment of a national Cyber playbook: The use of playbooks is starting to become common with many of the Cybersecurity vendors., as well as for their own clients. With a playbook, you are modeling the various threat vectors, and creating a set of rules and procedures to mitigate the risk of them impacting your business. But many vendors view this as their own Intellectual Property (IP) and do not want to share them with the public. What does this mean to you? With this new Executive Order, a framework for a national Cyber Playbook will become available, in which any public or private entity can adopt and use for its own security environment. Also, this is deemed to become the forerunner for the establishment of a Federal Data Privacy Law. For example, at the present the time, each of the 50 states have either come up with or are in the process of coming up with their own Data Privacy Laws. One of the best examples of this is the CCPA, which was recently passed by California. But unfortunately, with each state coming up with their own set of standards, there is a great deal of confusion as to which business is impacted by what state law, if they have offices and/or production facilities scattered throughout the United States. But with the eventual passage of a Federal Data Privacy Law, all states will have to adhere to one set of best practices, thus making it much easier to protect the PII datasets of American consumers.
Other Impacts Of Biden Executive Order
These include the following:
- A rewards program: Currently, the Biden Administration will soon start to offer financial rewards of up to $10 million for any information that will lead to the apprehension of Cyber attackers and their counterparts. This is particularly applicable to those that are responsible for launching Ransomware threat variants, and other attacks to Critical Infrastructure. This effort will be led by the Department of Justice’s “Rewards for Justice” initiative. More information about this can be seen here.
- A central resource for Ransomware: A new website has been launched by the Federal Government, which is entitled “StopRansomware.gov”, and more information about that can be seen here. This has been designed to be a central repository for all sorts of information and data about Ransomware, for both the individual, and business entities. Updates to this website are done on a regular basis, by the following government agencies: – Cybersecurity and Infrastructure Security Agency (CISA); – The Secret Service; – The National Institute of Standards & Technology (NIST).
Conclusions
Although the efforts taken by the Biden Administration is a huge step forward, keep in mind that implementing all of this will take a long time to come. But that should not stop you from being proactive about the protection of your digital assets.
Reach out today to talk with one of our security experts to learn how the President’s Cybersecurity Executive Order affects your organization.
