In the wake of multiple high-profile security breaches that have impacted huge swaths of the American public, lawmakers are still trying to figure out how to legislate cybersecurity.<\/p>\n\n\n\n
While meaningful legislation may not be in the immediate future, at least one congressman believes there are ways lawmakers can improve cybersecurity, particularly in the civilian federal government.<\/p>\n\n\n\n
The first: Institute a serious stress test for the National Institute of Standards and Technology\u2019s cybersecurity framework, a de facto standard for federal cybersecurity used across agencies.<\/p>\n\n\n\n
\u201cDoes the NIST framework process provide adequate cybersecurity that we in the Senate can simply rely on and not have to engage?\u201d Sen. Sheldon Whitehouse said Nov. 28 at the CyberCon 2017 conference in Arlington, Virginia.<\/p>\n\n\n\n
\u201cAll of us have had the experience of working together on something and coming away happy with the process because it\u2019s so undemanding and easy to get along with versus being happy with the process because it is in fact, although demanding, providing serious cybersecurity to America\u2019s infrastructure. I don\u2019t think we know the answer to that question.\u201d<\/p>\n\n\n\n
A second possibility for Congress to aid federal cybersecurity is establishing a sort of \u201ca roving inspector general focused on cybersecurity with white hat penetration authority.\u201d Duties of that role could include targeting federal networks and monitoring for vulnerabilities at agencies.<\/p>\n\n\n\n
Theoretically that role would help prevent the kind of breach seen at the Office of Personnel Management in 2015, \u201cbefore all of our records got co-opted by the Chinese for OPM \u2026 that was something we should have realized,\u201d Whitehouse said.<\/p>\n\n\n\n
\u201cWe can\u2019t expect requisite expertise to do this well be spread across 73 different inspectors general. So call it an inspector general, call it a special investigator, call it a GAO group \u2014 I care less about where it\u2019s located than the fact that someone has to have the job actually testing whether what agencies say about their cybersecurity is really true. We don\u2019t have that effectively now.\u201d<\/p>\n\n\n\n
The third potential area for Congress to pitch in on cybersecurity: public awareness. Whitehouse said he doesn\u2019t believe the American public is acutely aware of cybersecurity dangers, partly because the chief players being targeted \u2014 private industry and the \u2014government \u2014 each have their own reasons for masking the problem.<\/p>\n\n\n\n
\u201cIf you\u2019re a private corporation that just got hacked to bits you don\u2019t want competitors [or possibly even] shareholders to know \u2026 so there\u2019s not a lot of good information coming out,\u201d Whitehouse said. \u201cOn the government side we are demons for classifying stuff; we overclassify like fiends and the result is it\u2019s very hard to get government reports out as good as, say, the McAfee Red Dragon report.\u201d<\/p>\n\n\n\n
Perhaps, he suggested, the answer to that problem is a designated government spokesperson of sorts dedicated to sharing such information.<\/p>\n\n\n\n
\u201cWe need a \u2018discloser in chief\u2019 or a \u2018storyteller in chief\u2019 \u2014 somebody who has the authority to declassify so they can actually negotiate with the principals and have authority at the table,\u201d Whitehouse said.<\/p>\n\n\n\n
\u201cAnd their job should be every quarter or every six months to tell the story of what happened in the last quarter \u2026 you can say, \u2018This is what kind of problem we had in the electric utility grid,\u2019 and you can work through the process of making sure that what should be classified stays classified.\u201d<\/p>\n\n\n\n
Whitehouse additionally advocated for an international \u201ccoalition of the willing\u201d that eschews nations going cyber-rogue, instead building consensus among partner nations to establish global cyber norms and standards.<\/p>\n\n\n\n
\u201cStart with Five Eyes, bring in other countries that are amenable and grow from there,\u201d he said. \u201cI don\u2019t think the Russians or Chinese will ever negotiate in good faith, so why bother? Set terms for the rest of the world and they\u2019ll begin to comply.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
While meaningful legislation may not be in the immediate future, at least one congressman believes there are ways to improve cybersecurity.<\/p>\n","protected":false},"author":7,"featured_media":2436,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":83,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"10":{"categories":["congress","daily-news-roundup","newsletters"],"primary_category":"congress"}}},"categories":[106,83,33,28],"tags":[],"coauthors":[2804],"class_list":["post-14396","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-cybercon","category-newsletters","category-smr"],"acf":{"subheadline":"","legacy_arc_id":"D3BRF2D7CFA5RLZL6VPJ7WEJHQ","arc_canonical_url":"\/smr\/cybercon\/2017\/11\/28\/3-ways-congress-can-help-boost-cybersecurity\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n