Vendors prepare to spend more on cybersecurity under new rules

Companies may feel the sting of new expenses under the White House’s new cybersecurity strategy. But many tech executives agree the new requirements are necessary to reduce the pain of cyber attack.

“This investment comes out of [companies’] profit. So they would do what was necessary, but maybe not sufficient,” said Rob Carey, the president of Cloudera’s government solutions and DOD’s former principal deputy chief information officer. “And so, this I think, closes the gap between necessary and sufficient levels of cyber defense and what is expected.”

The White House’s cybersecurity strategy presses companies to upgrade hardware and software and hire experts to implement better network defenses, “so that we can raise the cyber defense posture of the country, not just the government agencies,” Carey said.

“There is a cost to doing this, but the cost of preparation and sort of defense is far less than cleaning up a cyber spill, right, or a cyber attack,” he said. “This becomes the must-fund stuff and the organizations that have been attacked, and then paid for their recovery themselves, they're the ones that are the evangelists for this kind of activity.”

Complaints about money are standard amid significant regulatory change and will likely wane, according to CyberSheath CEO Eric Noonan. 

“Eventually, the cries of cost will just go away” and become the “cost of doing business," Noonan said. “It's crystal clear to me that the federal government is using every lever they have to enforce mandatory cybersecurity minimums.” 

Those levers include the White House’s new strategy, its 2021 executive order the Pentagon’s Cybersecurity Maturity Model Certification, or CMMC, program; and the pending U.S. Securities and Exchange Commission rule for publicly traded companies.

So the only thing left after the long-awaited strategy is enforcement.  

“As strategies go, I think it's pretty aggressive and it's good. But implementation is something that we've seen a lot of strategies in the past not get executed on well,” said Chris Wysopal, founder and CTO of Veracode. “And one of the things that I think is important is to measure how well we're doing. So what are you going to use for measurement?”

Private industry tends to measure cybersecurity in the number of breaches or ransomware attacks, but by then it’s years too late, Wysopal said. 

“If you're looking at breaches, it's gonna take you another couple of years to understand if it's working or not. And so we need to get metrics that are closer,” he said. “People building the software should be able to share the metrics of what [they are] doing when they're building the software.”

John Sahlin, GDIT’s director of cyber solutions for its defense division, said the strategy is moving away from a compliance-driven approach to a resilience-based model by “incentivizing software companies toward a more secure development process.” 

DOD will release its own cyber document and will likely echo the national strategy, which aims to shift the burden of cybersecurity away from individuals and small companies to larger entities and the federal government. And by focusing on being resilient rather than compliant, there’s more room for growth, Sahlin said. 

“You expect to get hit, you expect that our adversaries whether they're criminals or nation-state actors, or script kiddies or whomever have gotten access to your environment. And then your goal is to make sure that when that happens, it doesn't absolutely crush you as an organization,” he said. 

“We deal with a lot of data that is sensitive, but not necessarily classified. And there have been some highly visible situations like Sea Dragon…that underscored the problem for this: lots of unclassified data about a sensitive weapons system was breached by nation-state actors.” 

For the Pentagon’s upcoming cybersecurity strategy, Sahlin expects there to be more of an emphasis on achieving zero trust, something the department has been working on in recent years with the creation of a dedicated strategy and office.  

“My guess would be that you will see more of an emphasis on the roadmap to zero trust, not as a rush to compliance, but as a progression of how are we more able to secure our most critical data and our mission critical data,” Sahlin said. 

“Compliance is important, it's critical, it's still going to be a need, it's still going to be a requirement. But we have to collectively do better if we are going to protect our national interests, and that of our coalition partners.”