Will 2017 finally be the year of cybersecurity? Picks of the Week
From Awareness to Action: A Cybersecurity Agenda for the 45th President | CSIS
Russian Hacking Illustrates Increasing Role of Cybersecurity in Geopolitical Warfare | The Hill
In 2017, real action on cybersecurity will happen after loss of life | CSO Online
Cybersecurity stories dominated the headlines in 2016, so it is unsurprising that new reports and many cybersecurity experts claim that 2017 will see continued nation-state cyber attacks, bigger and more damaging data breaches, targeted ransomware and Distributed Denial-of-Service (DDoS) attacks, and longer downtime and increased financial costs caused by successful attacks.
Organizations in both the public and private sectors strengthened or launched new cybersecurity initiatives in the past year, including addressing issues such as endpoint security, cloud security, cybersecurity funding, security controls, and cybersecurity staffing. This is important because 2016 was a year of unprecedented cyber attacks and massive data breaches, from the high-profile hacks of Democratic political organizations by the Russian government in an attempt to discredit American democracy and interfere with the US election, to the mega breaches that plagued Yahoo, LinkedIn, and numerous others (compromising millions of personally identifiable information and other sensitive data in the process), to cyber disruption involving critical infrastructure services such as the attack on the Ukrainian power grid by Russian hackers, to blackmarket ransomware and DDoS attacks that can take control of critical IT systems and then leverage it for extortion.
Much of what we saw in 2016 will evolve in complexity, scope, and sophistication in 2017. Cybercriminals will continue following the money trail, with ransomware and DDoS attacks becoming more widespread and increasing in scope and severity. Hackers will continue finding new vulnerabilities to exploit and ways to evade detection systems. Nation-states will increasingly rely on cyber espionage and cyber warfare as instruments of state power in order to gain an advantage on the battlefield, infiltrate and manipulate critical infrastructure services, such as the case with the Ukrainian power grid, and coerce adversaries toward a desired outcome. At the same time, U.S. and international law have not kept pace with technological innovation and enforcement of existing laws in cyberspace is intrinsically difficult, with some countries still refusing to cooperate in prosecuting cybercriminals.
We’re now at a tipping point in the digital age and the Internet economy: as we continue to adopt the Internet of Things (IoT), embed connected devices into all our essential services and every part of our lives, and rely more than ever on technologies that are inherently insecure, we’re also becoming increasingly less resilient and exponentially more vulnerable to cyber attacks.
Cybersecurity is not a new problem, nor is it a unique concern to world powers, large companies, or specific sectors. Despite an exponential increase in attention and awareness about cybersecurity and much activity on the international stage and within government to tackle these issues over the last decade, we are still at risk (and increasingly so!) and much is left for governments and organizations around the world to do to ensure a secure and stable digital environment that promotes innovation and supports continued economic growth, while also protecting personal freedoms and national security.
A new report released this week by the Center for Strategic and International Studies (CSIS) addresses these specific issues and provides detailed recommendations for the next administration to strengthen the cybersecurity posture of the United States. The CSIS Cyber Policy Task Force behind the report included members of Congress and identified specific policies, organizational improvements, and resources needed for progress in this challenging area. The report, titled “From Awareness to Action: A Cybersecurity Agenda for the 45th President,” builds on the report published in 2009 by the Commission on Cybersecurity for the 44th Presidency – a foundational document for creating a strategic approach to cybersecurity – and follows the December report of the Commission on Enhancing National Cybersecurity, established by President Barack Obama in February 2016. Two of its widest-ranging recommendations included the creation of an appointed post of assistant to the president for cybersecurity and the establishment of a new program to consolidate all civilian agencies’ networks into a single network. CSIS’s report included the first, but not the second.
As Sen. Sheldon Whitehouse (D-RI), Ranking Member of the Senate Judiciary Subcommittee on Crime and Terrorism who served as co-chair of the CSIS Cyber Policy Task Force, said upon the release of the report, “this past election has proven just how important it is for the President-elect and his national security team to appreciate the scope and the severity of the cyber threat.” Building on strategies the Obama’s administration established, the CSIS report recommends that the next administration improves and reorganizes oversight authorities, elevates the role of the White House cybersecurity coordinator, establishes an independent cyber agency within DHS and a Division of Data Protection within the Federal Trade Commission, clarifies the cyber defense roles of civilian and military agencies, better secures critical infrastructure and services, and works closely with allies against common cyber threats.
Although President-elect Trump continues to express skepticism about the Russian government’s attempt to orchestrate pre-election cyber attacks to undermine the U.S. democratic process and has yet to offer details about his cybersecurity priorities and agenda, this report will hopefully provide a blueprint for the next administration to follow since one of its key authors, Karen Evans, is now a member of the Trump transition team.
Will 2017 finally be the year of increased cybersecurity? And what will it take?