One Year Later: A Hacker’s View on the Cybersecurity Executive Order

When the Colonial Pipeline ransomware attack took place last year, consumers were cut off from fuel, prices jumped, and some mild panic ensued. This was one of the first cyber-attacks that showed consumers—and the industry—that we’re more interconnected than we realized to the consequences of digital crimes. 

Timing is everything. The Colonial Pipeline attack helped pave the way for radical change in the federal government’s approach to cybersecurity. And that’s exactly what the U.S. government is doing with a full year of dynamic stakeholder engagement on various aspects of the Executive Order 14028 Improving the Nation’s Cybersecurity, that will change the status quo of how industry and government become more resilient. 

In the year since the inception of the EO, new cybersecurity incident reporting legislation also passed into law, but adversary tactics still grew more sophisticated and the line between cyber and real-world incidents evaporated. This played out significantly across manufacturing—the most attacked industry in 2021. Threat actors found a leverage point in the critical role manufacturers bear in global supply chains. Whether it was cream cheese, toilet paper or meat, the ripple effect of attacks impacted consumers in a meaningful way.  

The EO provides new defensive and offensive strategies that will help us win some small victories, but the key is effective execution. When the EO validated zero trust by recognizing it as a core part of its strategy to improve US cyber posture, we had a small victory. Now the challenge lays with the actual implementation. Without a deep understanding of trust relationships, implementations will fail. 

Trust relationships need to be thoroughly vetted, tested and tested again. Access and trust should never be presumed; that’s when security gaps are created. Today, many security teams are unknowingly building “less trust”—not zero trust—networks. 

To solve this, we must turn the tables and look at networks from an attacker’s lens; and threat hunting is one way to do just that. Yet, while the EO specifically mentions active cyber hunting, there is confusion around how to conduct the hunt. Automated security tools and security operations analysts should deal with about 80% of threats, but another 20% is left on the table that have the potential to cause real harm. 

Threat hunting should go beyond traditional detection technologies and, if done right, find the environment's unknowns. Threat hunters comb through security data and search for hidden malware or attackers. They look for patterns of suspicious activity that a computer might have missed or judged to be resolved but aren't. Remember, effective execution is key here.  

Another small victory is improvement with threat information sharing illustrated via CISA’s Joint Cyber Defense Collaborative JCDC and advancing to establish a collective and coordinated defense against cybercrime. Something we’ve lacked for a long time. 

Historically, the broader security community wasn’t involved—in the way it is today—with threat information sharing. The JCDC is bringing practitioners to the table early on, which has the potential to drive change. This doesn’t mean “mission accomplished.” There is still the challenge of making intel more digestible and accessible. Currently, there is no standard classification for threat analysis. Vendors have their own taxonomy, meaning it’s incredibly difficult to combine threat analyses from multiple vendors. 

Knowing the prevalent threats to federal agencies, and the tactics and techniques adversaries are using, is critical. Every second counts in the face of a cyberattack. The longer it takes to detect and contain a security incident, the costlier it is. For example, data breaches that took longer than 200 days to identify and contain cost an average of $1.26 million more compared to those that took less than 200 days. That’s why we have to continue refining our approach to threat information sharing. 

We’ve entered a sink or swim moment for cybersecurity. Legislation or more regulations alone won’t be how we gain an advantage over attackers. The EO should only be seen as one tool in our security arsenal. By effectively executing and going beyond what’s mandated and changing the culture around cybersecurity, federal agencies can better protect critical data and infrastructure that remains a top target by threat actors. 

With more than two decades of experience in the information security industry, Charles Henderson leads a global team of hackers, researchers, investigators and incident responders to provide offensive and defensive security services. Charles has also been hacking since he was nine years old. But for propriety’s sake, we don’t include his pre-teen exploits in his twenty-year tenure in the industry.