Priorities for Enhancing National Cybersecurity

Jamie Brown is the director of global government relations for CA Technologies.

Presidential transitions are a time of considerable change in government, including new agency leaders and evolving policy priorities. But many issues persist, and this is certainly the case with cybersecurity. Advancing our nation’s cybersecurity posture must be a key priority for the Trump administration, especially if we are to maximize the benefits of digital transformation.

The nonpartisan Commission on Enhancing National Cybersecurity—which includes cybersecurity experts from industry, academia and government—recently delivered policy recommendations and action items for consideration by the new president and Congress. The comprehensiveness of the report reflects the public-private approach the commission took in seeking input on what our nation’s cybersecurity priorities should be in the years ahead.

Still, there are several areas that should be prioritized and improved upon.

First, the report rightly recognizes the critical role of identity-centric security in the digital economy, given identity is a key attack vector. The report recommends the launch of a national public-private initiative to increase the use of strong authentication to improve identity management.

The commission also stresses the importance of authenticating devices in an internet of things environment. But there needs to be significant emphasis now on managing privileged users and those accounts and credentials that hold the “keys to the kingdom.” In the medium and longer term, there should be greater focus on continuous authentication, using risk-factor and behavioral-based analysis to enhance security and reduce friction for users.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Second, the report recommends building on the success of the NIST Cybersecurity Framework by actively sustaining and increasing its adoption by federal agencies and private organizations. Many technology companies—including my employer—have been using the framework to help prioritize cybersecurity investments to improve technology processes.

To the extent we are able to use common terminology and risk management-based approaches, this will help improve the information security outcomes across the entire security ecosystem. Further, state and local governments interested in aligning their information security practices with the framework could benefit from additional federal government guidance or incentives.

Third, the report stresses the importance of technology adoption and of accelerating technology refreshes. According to the Government Accountability Office, the federal government spends over 75 percent of its IT budget on operations and maintenance rather than on expenditures for new technologies. This puts IT infrastructure at risk.

While the modernization of legacy IT is critical, we also need to extend modernization to deployment because, ultimately, federal agencies will not be able to realize the security benefits of new technologies unless they are actively in use.

Finally, the report recognizes the global context of the cybersecurity ecosystem and that the adoption of cybersecurity norms can help strengthen stability throughout our digital world. And while there are many potential benefits of a more active role for the federal government in the global standards arena, this activity should be closely tied to the promotion of international, industry-driven standards.

Using market-based approaches allows technology companies to focus resources on enhancing innovative security solutions for the global market, rather than on compliance with distinct requirements in different countries.

Cybersecurity is a shared responsibility. Hackers and bad actors aren’t going away; the attacks against government agencies, critical infrastructure industries and consumers continue to escalate with alarming frequency and volume.

Collectively—government, industry and consumers—we need to find a way to stay one step ahead. With this report, the commission created a promising road map, but it’s up to everyone to take the actions necessary to build a stronger cyber ecosystem and enhance our national cybersecurity posture.