Creating a more resilient American infrastructure
With the necessary reforms to modernize federal IT now clearer, it's critical to call out that the government has far too long relied on antiquated technologies that cannot thwart today's stealthy and persistent adversaries.
President Joe Biden's new cybersecurity executive order (EO) attempts to fix some persistent issues with national and federal cybersecurity. But can it work? As someone who has spent more than two decades working in government and now a decade in the private sector confronting cyber threats, a few provisions stand out.
If the changes laid out within the EO are implemented and funded correctly, we could see huge changes within agencies in the next year. The federal government would be mandated (for the first time) to leverage the same technologies the private sector has been using to their advantage for years. Ultimately, the Biden Administration is looking to make U.S. infrastructure more resilient, and the EO is a step in the right direction, but there is still much work to be done.
With the necessary reforms to modernize federal IT now clearer, it's critical to call out that the government has far too long relied on antiquated technologies that cannot thwart today's stealthy and persistent adversaries, from both organized criminal groups, like we saw in the Colonial Pipeline ransomware incident, to sophisticated nation-state hackers, as we recently experienced with the SolarWinds incident. Signature-based technologies are ineffective against today's threats. Modern network defenders need full visibility at the endpoint, and this includes embracing the right people, process and technology to get there.
Embracing the right technologies
The EO specifically calls for the mandating of government entities to embrace and adopt (within 365 days) trusted technologies such as endpoint detection and response (EDR), zero trust architecture, more efficient threat hunting practices and more sensible approaches to log management. Additionally, the administration is recommending pairing the right technologies with strategies that ensure government agencies make more informed decisions and take a proactive (not reactive, as was done previously) stance to security. This includes a more holistic approach to information sharing and the standardization of incident response (IR) playbooks.
Federal guidance now requires modernizing IT through cloud-based technologies. CrowdStrike has promoted these very concepts, strategies and technologies for years. In fact, our CEO and co-founder, George Kurtz, recently testified about the importance of cloud adoption and zero trust, and the need to conduct threat hunting across federal networks at a Senate hearing following the SolarWinds incident.
The EO also reinforces the need to increase threat hunting across agencies. Threat hunting is the active search for "unknown unknowns," which describes new and novel attack behaviors that aren't typically detected by current automated methods of prevention and detection. It is, by nature, a "hands-on-keyboard activity," driven by humans. Proficient threat hunting requires a clear and comprehensive understanding of the threat landscape, 24/7 operations through a highly trained staff, and the implementation of technologies such as EDR. The recently disclosed Microsoft Exchange vulnerabilities highlight the absolute criticality for agencies to leverage proactive strategies such as threat hunting. Threat hunting invariably depends upon having access to centralized data, especially that stems from EDR and various system logs, in order to identify potential suspicious activity—something that was absent from recent government breaches. Simply put, if the adversary remains in your environment undetected for lengthy periods, sometimes even months or years without detection, you have a massive issue.
Implementing the proper strategy
And, just as COVID-19 and the massive shift to the work-from-anywhere-model has proven, private sector organizations and the government alike can function at a high-level remotely, but so can the adversary. The distributed workforce has proven that cloud-based technologies, such as EDR, are absolutely critical to secure the distributed workforce, including those in government agencies. Standardizing these technologies across agencies will ultimately reduce cost and complexity throughout the government, leading to better operations, information sharing and more informed strategies.
The EO identifies a number of areas where responsible departments and agencies must solicit input from stakeholders, including within industry, and so, the work is just beginning. As an industry veteran and someone who has sat on both sides of the public and private sector fence, I am cautiously optimistic that the EO can strengthen our defenses and improve overall security posture. The threat from the adversary is very real and very dangerous. Together, we can defeat them if we continue to collaborate and coordinate efforts throughout the U.S. government. I look forward to seeing our joint efforts continue to advance cybersecurity at the federal level as it is of the utmost importance.