Legislation and the future of federal cybersecurity

Cybersecurity continues to be at the forefront of national focus, thanks to Congress’ passing and the president’s signing of three cybersecurity-related bills last December.

Those statutes are now being implemented to continue the progress agencies have made in protecting government networks and working with state and local agencies, critical infrastructure operators, and other private-sector partners to achieve similar progress.

First, the Federal Information Security Modernization Act of 2014 moves government forward in adapting to the ever-changing landscape of the cyber world. Its importance is evidenced by the increasingly complex vulnerabilities, threats and actions against federal networks, often involving malicious third parties.

The act enables federal agencies to be more effective in developing and implementing protective strategies against network intruders. It continues and updates the risk management framework that has been a core tenet of the Federal Information Security Management Act and encourages agencies to use automated security tools to continuously diagnose and mitigate security vulnerabilities. It also codifies the Department of Homeland Security's role in overseeing the implementation of policy and guidelines for federal civilian agencies.

Concurrently, the National Cybersecurity Protection Act codifies the activities of DHS's National Cybersecurity and Communications Integration Center and further strengthens DHS’s ability to coordinate incident response and provide technical assistance to agencies through a variety of information security tools and techniques.

It authorizes DHS’s existing center to act as a critical interface for sharing cybersecurity information among federal civilian agencies and key stakeholders. The law also includes provisions for:

* Promoting situational awareness to enable real-time, integrated and operational actions across the federal government.

* Sharing cybersecurity threat, vulnerability, impact and incident information and analysis by and among federal, state and local government agencies, and private-sector entities.

* Conducting analysis of cybersecurity risks and incidents.

* Providing recommendations on security and resilience measures to federal and non-federal entities.

* Offering timely technical assistance to federal and non-federal entities with respect to cybersecurity threats and attribution, vulnerability mitigation, and incident response and mitigation.

The act also states that the center shall be composed of federal personnel and representatives from state and local governments and other non-federal entities, including information sharing and analysis organizations and owners and operators of critical information systems.

Finally, the DHS Cybersecurity Workforce Recruitment and Retention Act authorizes actions to enhance the government’s pool of talented cybersecurity professionals. It provides additional authorities to the DHS secretary to assist in the recruitment, training, education, development and retention of a highly qualified federal cybersecurity workforce.

The act also requires the secretary to evaluate efforts to improve the department's cybersecurity workforce and submit an annual report to the appropriate committees of Congress detailing DHS’s progress.

DHS’s continuous diagnostics and mitigation program is a prime example of the government’s efforts to operationalize cybersecurity protection in a way that reinforces the provisions of these three important statutes. Implementation of this and similar programs -- as reinforced by the new laws -- will continue to strengthen the way federal agencies protect their networks, systems and data from ever-evolving threats in cyberspace.

The efforts of the government to build a more effective cybersecurity posture is evident in the implementation of these three cybersecurity bills, which taken together will foster a more effective cybersecurity dynamic. By openly collaborating across agencies, coordinating incident response, and increasing the pool of cybersecurity professionals, the government will grow its capacity to operate in cyberspace at a rapid rate. Cohesive implementation of these bills will enable agencies to mitigate cybersecurity risks and proactively plan for vulnerabilities, providing a fountain for increasingly responsive tactics to address cyber threats successfully.