Arthur T Knackerbracket has processed the following story:
Ransomware remains rampant and is a favorite tool of adversaries including North Korea. Other foes continue to place misinformation online in the hope of influencing American opinion.
At home, debate continues to bubble about the best approach to securing businesses, which complain that existing infosec rules and incident reporting regulations vary between jurisdictions, can involve multiple agencies, and also overlap.
How to hold the tech industry accountable when it drops the ball, in terms of security, is another ongoing debate, with some calling for voluntary guidelines that incentivize secure development practices, while others want mandated security standards that make tech companies liable for flaws in their products.
The Republican Party’s 2024 election platform document [PDF] mentions infosec just once, in the last paragraph of a 16-page manifesto, as follows:
Republicans will use all tools of National Power to protect our Nation’s Critical Infrastructure and Industrial Base from malicious cyber actors. This will be a National Priority, and we will both raise the Security Standards for our Critical Systems and Networks and defend them against bad actors.
None of the executive orders Trump had issued at the time of writing include more detailed information security policies.
But on its first day in office, the administration made two notable security-related changes.
One was to terminate all memberships of advisory committees that report to the Department of Homeland Security (DHS). That impacts infosec because DHS is the parent agency of the Cybersecurity and Infrastructure Security Agency (CISA), which in turn is home to the Cyber Safety Review Board (CSRB) – an org tasked with investigating major cybersecurity incidents.
Killing the board that pressured Microsoft to up its cybersecurity looks for all the world like payback for Microsoft's million dollar gift to Donald Trump's inaugural committee
CSRB is currently investigating the Salt Typhoon attacks on telcos but now appears to lack personnel to finish the job.
The board’s past work includes a scathing report that found Microsoft responsible for a "cascade of security failures" that allowed Chinese spies to break into senior US officials' email accounts.
US Senator Ron Wyden (D-OR) criticized the decision to terminate membership of DHS advisory committees.
"This is a massive gift to the Chinese spies who targeted top political figures," Wyden opined on Bluesky. "Killing the board that pressured Microsoft to up its cybersecurity looks for all the world like payback for Microsoft's million dollar gift to Donald Trump's inaugural committee."
The other big change was to revoke President Biden’s order on AI safety.
But at the time of writing, the executive order on cybersecurity signed by President Joe Biden just days before Trump's inauguration remains in place. That order requires software companies that sell to the government must submit proof to CISA that they are following secure software development practices.
[...] Trump’s choice to serve as National Security Advisor, Michael Waltz, has called for a change in doctrine to one that will "impose costs on the other side," ie: America carries cybersecurity offensives against adversaries that leaves a tangible financial mark on a target.
Tom Kellermann, who served on the Commission on Cyber Security under Obama, and is now senior veep of strategy at Contrast Security, believes the administration will adopt Waltz’s position.
"The US has, frankly, played defense for too long," Kellermann told The Register, pointing to a Google-Mandiant report that found 97 zero-day vulnerabilities were exploited in 2023, compared to 62 zero-days in 2022, and the People's Republic of China remains the top state-backed exploiter of zero-day holes.
"I'm hoping that they actually do begin to conduct more offensive operations, particularly against rogue nation states that have actively conducted destructive attacks against our infrastructures," Kellermann said.
They should go further than that and conduct destructive attacks against various Chinese military assets
"Given how we played in the past, typically it's a disruption of their command and control infrastructure associated with previous compromises of Western infrastructure," he noted.
"But I think they should go further than that and conduct destructive attacks against various Chinese military assets, particularly destructive attacks against the PLA [People's Liberation Army] cyber resources and the front companies in China that are acting as proxies for cyber attacks."
[...] Trump seems likely to persist with President Biden’s national cybersecurity policy and the Executive Order 14028 that directed federal agencies to adopt zero-trust architectures.
That plan built on an executive order that Trump enacted in 2017, titled “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.
"Cybersecurity is a non-partisan topic," said John Ackerly, CEO and co-founder of encryption business Virtru. "Everyone can agree we need to protect our country, our citizens, and critical infrastructure from digital threats posed by domestic and international cybercriminals."
Ackerly previously worked in the George W Bush White House as a tech advisor.
"In regards to policy in Trump's second term, I expect to see a continued maturation of zero trust initiatives with a steady focus on national security," Ackerly said. "The actions we've seen from China in the cyber realm have been monumental. The Salt Typhoon cyberattack is a prime example."
Ackerly also expects further collaboration between Washington and the private sector.
Threat-intelligence sharing efforts between public-private partnerships, public agencies, and the private sector was also a major focus for CISA under Easterly and the Biden administration. Under her leadership, CISA started the Joint Cyber Defense Collaborative (JCDC) public-private group, and convinced hundreds of companies to sign its secure-by-design pledge.
"I expect the incoming administration to embrace public-private sector collaboration, which is a boon for commercial businesses as well as government organizations." Ackerly said. "Efficiency is a clear priority under the new administration, and I think you may see that theme mirrored in commercial businesses."
(Score: 5, Informative) by JoeMerchant on Sunday February 02, @10:34PM (2 children)
Don't worry, these kids are uber smart, they'll definitely secure the systems bigly:
https://www.wired.com/story/elon-musk-government-young-engineers/ [wired.com]
https://www.wired.com/story/elon-musk-lackeys-general-services-administration/ [wired.com]
🌻🌻 [google.com]
(Score: 0) by Anonymous Coward on Monday February 03, @02:43AM
Nero fiddles...
(Score: 1, Funny) by Anonymous Coward on Monday February 03, @01:03PM
Barron's good with the Cyber, no?
(Score: 5, Touché) by driverless on Monday February 03, @02:25AM (3 children)
Blame DEI, or blame Biden, or blame Obama, take your pick. There, all sorted.
(Score: 4, Informative) by Thexalon on Monday February 03, @03:23AM (2 children)
One thing that has always been extremely consistent with the current president and the people around him: The buck invariably stops somewhere else, never at the Resolute Desk. Unless the thing happens to be perceived as good news, in which case it's always alleged to be his doing, e.g. "The sun rose this morning on a nice clear day, let's all thank the president for that."
"Think of how stupid the average person is. Then realize half of 'em are stupider than that." - George Carlin
(Score: 1) by dohzer on Monday February 03, @06:32AM
"He works in mysterious ways"
(Score: 0) by Anonymous Coward on Monday February 03, @01:06PM
I think that was the old incarnation. The new incarnation doesn't give a fuck. Send in Border Patrol - remember them? The lovely goons who showed up in Portland in unmarked vans snatching protestors and who, incidentally, are the ones collecting all those juicy tariffs.