Why the cyber EO won't solve botnets

The distributed denial-of-service attack that hobbled Internet service across the U.S. in October 2016 showed how vulnerable connected devices are to botnets, said officials tasked with researching the problem. And reducing the botnet threat will be a long, slow process.

The Trump administration's cybersecurity executive order charges the secretaries of Commerce and Homeland Security with leading a process to reduce the threat of botnets and DDoS attacks. Under the order, the secretaries have until January 2018 to issue a preliminary report, with a final report due in May 2018.

Two members of the team conducting the study stressed to members of the Information Security and Privacy Advisory Board that they will not solve the botnet problem in a year.

Kevin Stine, chief of the National Institute of Standards and Technology's Applied Cybersecurity Division, said the goal is to develop a series of recommendations "that will contribute to what we're considering right now is more of a roadmap -- some potentially short-term, mid-term, long-term actions that can be taken."

The team is currently in the process of meeting with stakeholders and awaiting responses to a request for comment to gather information about what work has been done to date, what the barriers are to progress and what can realistically be done.

"We know some good things that should be happening, but why and where are the gaps that are occurring that we need to bring the right stakeholders together to talk about?'" said Evelyn Remaley, who's with the National Telecommunications and Information Administration's Office of Policy Analysis and Development.

Remaley and Stine emphasized that the challenge will only continue to grow because of the explosion in internet-connected devices and manufacturers.

"Having a new set of players come into the marketplace that can impact the ecosystem, who haven't really thought about security in the same way that many of have for a long time is a game changer," said Remaley.

She said there has been a lot of outreach to the internet of things sector to educate them on security and patching.

"The response has been good but it is taking some time ... because it is almost learning a new language," she said. "It's obviously not just one group either, it's so diverse."

At the center of their research will be finding a balance between regulation and market incentives to push people to practice better cyber hygiene and bake security into devices and systems.

"I think the complexity of this space is going to require multifaceted approaches," said Stine. "And I think the other piece to really think about...is the international dimension'."

The two speakers pointed to the variety of international companies, customers and regulatory ecosystems, and the fact that no country has found a solution to botnets.

"I think that alone makes it clear that even if you would like to fix it by passing regulation, that's actually not going to fix it," said Remaley. "So it is going to take these collaborative efforts across and internationally to make some progress here."

Remaley said the team is in close consultation with the White House about the work plan and build-out of the report to make sure they are meeting the expectations of the executive order. She said they are trying to make clear that the report delivered next year will be a roadmap to solutions, rather than the final solutions.

AT&T's Chris Boyer, chair of the ISPAB, encouraged the team to think beyond the usual focus on short-term patching and notification measures.

"We need to think about kind of a longer-term, fundamental rethinking of some of these architectures to make them more inherently secure," he said, "because right now we're really putting a Band-Aid on them."

Boyer and other board members stressed the need to focus on resiliency and not simply prevention or elimination of botnets. The latter would be unrealistic, they said because botnets will continue to exist and attacks will happen.

"That's what we try to focus on," said Remaley. "What is realistic, actionable and incremental progress that can be made? We're not going to try to boil the ocean."