Despite a number of new laws and executive orders in the last decade, not much has changed in the government’s approach to improving cybersecurity. For example, the president’s Cybersecurity National Action Plan has surprisingly few new ideas. Besides creating another commission to study the problem, the president’s plan is little more than a list of familiar measures\u00a0\u2014\u00a0more information sharing, more hiring and more\u00a0spending on programs that produce little evidence of any real security value.
The most impactful changes in cybersecurity have been forced on the private sector by regulatory agencies. While necessary, the government’s use of regulatory authorities has been duplicative, uncoordinated and highly inefficient.\u00a0As such, the security value of compliance spending for most companies is questionable.<\/p>\n\n\n\n
Specifically, the\u00a0Health Insurance Portability and Accountability Act\u00a0and the\u00a0Gramm-Leach-Bliley Act\u00a0each impose requirements.\u00a0The Securities and Exchange Commission and many other agencies have also rolled out\u00a0standards.\u00a0Since most large enterprises fall under more than one regulatory agency, the present regime creates almost unmanageable compliance requirements.<\/p>\n\n\n\n
For many cybersecurity professionals, the focus on compliance actually detracts from efforts to implement effective cybersecurity measures. For small and mid-size businesses, the burden can be overwhelming.<\/p>\n\n\n\n\n\n
The government needs to do much more to consolidate and streamline cyber regulatory requirements and standards so that companies can focus on tools and processes that work, rather than audits and reports that are mostly duplicative and provide little protection.<\/p>\n\n\n\n
The best improvements in the government’s response to the cybersecurity challenge have been implemented by the military. The consolidation of the cyber forces for each branch (Army, Navy, Air Force and Marines) into a single cyber command goes a long way toward integrating and synchronizing U.S. cyber power. In addition, the Defense Department has ramped up training to produce thousands of top-tier cyber warriors.\u00a0This may be the one real solution to the enormous demand for skilled cybersecurity professionals in civilian government agencies and the private sector.<\/p>\n\n\n\n
Overall, I would give the Obama Administration a D-minus on cybersecurity.<\/p>\n\n\n\n
Over the last seven years, the government’s cybersecurity shortcomings\u00a0\u2014\u00a0made evident by the catastrophic\u00a0breach of the Office of Personnel Management and the penetration of White House and State Department unclassified systems\u00a0\u2014\u00a0were far worse than anything in the private sector.\u00a0Instead of bold, proactive\u00a0measures, the government took a reactive approach.<\/p>\n\n\n\n\n\n
By not shifting significant resources and aligning agency responsibilities, Congress shares much of the blame for the government’s mediocre response to this significant security challenge.<\/p>\n\n\n\n
It’s hard for the administration to coax and cajole the private sector into making the necessary investments in cybersecurity when the government itself can’t seem to get it right.<\/p>\n\n\n\n