Today\u2019s perilous cyber world threatens our national security, health, safety, prosperity and fundamental freedom. Criminals and terrorists have opportunity and means to attack at anytime from anywhere, whether it be simple criminal identify theft to orchestrated cyberattacks by other nations, cyber-terrorists, and organized crime. The stakes and risks continue to grow given continuing advances in information technology systems and ever-more sophisticated tools available to hackers.<\/p>\n\n\n\n
On May 11, 2017, President Trump signed Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.<\/i>The EO is organized around three interrelated aspects of cybersecurity: (1) federal networks, or how the federal executive branch safeguards its own IT systems; (2) the federal government\u2019s leadership role to identify and support cybersecurity of critical infrastructure at greatest risk across all government levels and business sectors; and (3) national implications of cybersecurity that transcend federal networks and critical infrastructure so the internet remains valuable to future generations.<\/p>\n\n\n\n
The president made each federal agency head responsible and accountable for cybersecurity. In specifying various assessments, plans and actions, EO 13800 builds on ongoing initiatives and leverages existing standards, such as The Framework for Improving Critical Infrastructure Cybersecurity<\/i>, issued by the National Institute of Standards and Technology. Addressing the requirements of EO 13800 demands serious attention since all aspects of our national interest are now in the cross hairs of criminals and terrorists intent on doing serious damage.<\/p>\n\n\n\n
We offer the following perspectives on implementing EO 13800 based on leading practices.<\/p>\n\n\n\n
– Build a foundation for success through business transformation that\u2019s lasting and adaptable to ever-changing cyber conditions. Viewing EO 13800 as a series of compliance requirements that just build on previous requirements simply isn\u2019t a recipe for success.<\/p>\n\n\n\n
– Don\u2019t assume technology is the \u201csilver bullet.\u201d While new technologies and capabilities are critical for cyber programs and initiatives, the basic foundation will continue to be sound governance, well-designed policies and procedures, focused training and awareness, and strong configuration management and access controls.<\/p>\n\n\n\n
– Drive transformation through the agency head, who cascades commitment, understanding and responsibility so the entire organization is engaged and energized. Everyone should view cybersecurity as their responsibility, with the chief information officer and the chief information security officer serving as valuable facilitators and technical advisors.<\/p>\n\n\n\n
– Adopt a risk management approach to drive identification and ranking of cyber risks, considering likelihood and impact, balanced against the level of cyber risk the agency is willing to accept. In doing so, address risks along a continuum of prevent, improve, detect, and respond.<\/p>\n\n\n\n
– Continually monitor risks and results, including cybersecurity problems identified in other organizations, to help ensure the right balance remains between risk and reward.<\/p>\n\n\n\n
– Embed good cybersecurity hygiene in routine day-to-day management of critical information assets and infrastructure, making cybersecurity a common component of the organizational culture.<\/p>\n\n\n\n
– Align cybersecurity to agency priorities and initiatives to reinforce the integral role of cybersecurity to accomplishing mission programs and operations.<\/p>\n\n\n\n
– Move to shared services and cloud-based capabilities, which can provide additional benefits, such as cost savings. It\u2019s critical these transitions are supported by strong organizational governance processes, including service provider agreements.<\/p>\n\n\n\n
– Work with other levels of government and the private sector to promote and adopt leading practices to protect the nation\u2019s most critical infrastructure through joint understanding, common frameworks, transparency, incident response capabilities, collaboration, and partnerships.<\/p>\n\n\n\n
– Build a first-class national cyber workforce across all government levels and business sectors, while ensuring the entire workforce understands the context and what they personally need to do to adequately safeguard data assets and critical infrastructure.<\/p>\n\n\n\n
– Don\u2019t forget about insider threats, with Edward Snowden and Chelsea Manning poignant reminders of what can go wrong.<\/p>\n\n\n\n
– Navigate the movement to intelligent automation to help understand and mitigate new and emerging cyber risks. Enabling technology will drive government business transformation. Whether robotic process automation, advanced process automation, or cognitive automation (think of IBM\u2019s Watson), this game changing technology will also redefine cybersecurity. For example, it will be imperative to govern deployment of \u201cbots,\u201d as well as countering botnet attacks, such as the WannaCry and NotPetya ransomware.<\/p>\n\n\n\n
Underlying EO 13800 is collaboration, cooperation, and consensus building, both within the United States and globally. This require strong, continuing leadership, with everyone in the boat rowing hard in the same direction. Over our nation\u2019s rich history, Americans have demonstrated an ability to come together to meet the most difficult challenges. Cybersecurity represents such a challenge.<\/p>\n\n\n\n
Tony Hubbard is a principal and leader of KPMG\u2019s Federal Cybersecurity practice; Geoff Weber is a principal in KPMG\u2019s Federal Advisory practice; and Jeff Steinhoff is the managing director of the KPMG Government Institute and the former assistant comptroller general of the United States.<\/i><\/p>\n\n\n\n
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. This article represents the views of the authors only, and not necessarily the views or professional advice of KPMG LLP.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
Addressing the requirements of the cyber executive order demands serious attention since all aspects of our national interest are now in the cross hairs of criminals and terrorists intent on doing serious damage.<\/p>\n","protected":false},"author":7,"featured_media":26729,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["opinions","daily-brief","newsletters","home"],"primary_category":"opinions"}}},"categories":[10],"tags":[],"coauthors":[7420],"class_list":["post-13425","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"QW7YWXDPK5AGDHIDVDZKQGZVJY","arc_canonical_url":"\/opinion\/2017\/11\/02\/12-ways-to-defend-the-nation-against-cyberattack-commentary\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n