US government doubles down on cybersecurity

The US has long been a primary target for cyber-criminals, whether it be the rich potential pickings of corporate IP or the vast quantities of data traversing public and private networks. More recently, it has also become the focus of cyber-terrorism, with private or state-funded groups targeting everything from national elections to critical infrastructure.

In its annual cost of a data breach report, IBM identifies the US as the territory with the highest cost of a data breach. Whilst the global average stands at $3.86 million (US dollars) the average in the US is a staggering $8.64 million (2020 figures). This is a 5.5% rise on the previous year’s figure.

A national and economic security imperative

The 2020 SolarWinds attack brought cybersecurity into sharp focus for the Biden administration as thousands of organisations, including multiple departments within the US Government, fell victim to the supply chain attack. Although the attack began long before the current administration took power, the aftermath is having a major influence on national policy.

US Government structure, and the role of state legislation, has traditionally made the development of national standards for cybersecurity, data protection and breach notification difficult. As early as 2002 California introduced mandatory breach notifications. Since then, other state have been playing catch-up and introducing their own regulations. However, there is little or no agreement as to what type of breach qualifies, what type of data should be covered and how notification should be given.

In May 2021, the Biden administration introduced an executive order title Improving the Nation’s Cybersecurity. Recognizing that incremental changes would not provide sufficient defense against the increasingly sophisticated and persistent attacks targeting the US, the order states “the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security”.

The order includes wide-ranging policy implications but emphasizes the importance of removing barriers to the sharing of threat information and calls for a wholesale modernization of federal government cybersecurity. Acknowledging the role of cloud infrastructure in modern government, it also calls for the implementation of zero-trust architecture to help protect both network infrastructure and data.

A reaction to the rise in ransomware

Ransomware has become the weapon of choice for many well-funded cyber-gangs. The Colonial Pipeline attack in May 2021 saw over 1100 gigabytes of data stolen and resulted in the company paying a $4.4 million ransom. This seems relatively insignificant when compared to the Kaseya attack in July that affected over 1,500 companies worldwide and saw the attackers demand $70 million in ransom.

Following the spate of ransomware attacks, the White House has formed a cross-government task force to coordinate a series measures, both defensive and offensive, to stem the tide. The measures include a widespread promotion of “digital resilience” and even the offering of $10 million in rewards for information leading to the identification of cybercriminals.

Of course, all of this comes at a cost. The new infrastructure bill includes a provision of $1.9 billion for cybersecurity funding. As the US moves forward with its digital transformation initiatives, including the rollout of national broadband and 5G networks, security will become an even more vital consideration.

A private/public partnership

On August 25th the Biden administration met with representatives of big tech, insurance and education to discuss what was described as a “whole-of-nation” effort to improve the cybersecurity stance of the US. Recognizing that much of the infrastructure that the US Government depends upon is privately owned, the President called upon CEOs from the likes of Google, Apple, JP Morgan Chase and Microsoft to commit to a more secure future.

Discussions were wide ranging and touched on the role that government legislation could play in establishing future standards for cybersecurity. The administration announced the National Institute of Standards and Technology (NIST) will be collaborating with industry, among others, to develop a framework for improving supply chain security.

In addition, many of those present announced initiatives aimed to improve cybersecurity, including programs designed specifically to address the shortage of cybersecurity professionals in the industry. Th insurance industry also committed to holding policyholders to higher standards and adopting best practices as a condition of receiving cyber insurance.

Ensuring authenticity and confidentiality

Cybersecurity incidents aren’t always associated with data theft or ransomware. Privacy and confidentiality are important, but so is authenticity. In June of this year, for example, the US Naval Institute claimed that the real-time tracking data of two NATO warships was falsified, allegedly placing them at the entrance to a major Russian naval base.

A robust cybersecurity stance includes provision for both prevention and protection technologies. The high-speed networks upon which much of the world has come to depend are not inherently secure. Bad actors in all their guises are targeting infrastructure, either for financial gain, privileged access or political influence.

The US, and other national governments, have a vital role to play. Not only are they responsible for protecting critical assets and citizens’ data, they also set the tone for corporate responsibility through the foundation and enforcement of meaningful cybersecurity standards and compliance obligations.

US government doubles down on cybersecurity

A national and economic security imperative

A reaction to the rise in ransomware

A private/public partnership

Ensuring authenticity and confidentiality

IDQ in the News

Stay one step ahead