An important first step in improving the nation's cyber security was taken by the President last week. On Thursday, President Trump signed an executive order on strengthening the cyber security of federal networks and critical infrastructure.
The most important highlight is that the President will hold heads of executive departments and agencies accountable for managing cyber security risk to their enterprises.
The timing could not have been better. The day after the order was signed, WannaCry shook the world. More than 150 countries were affected.
What the order calls for
The order calls for federal agencies to seek opportunities to co-locate cyber technology rather than keep them in silos. By splitting onsite and cloud-based systems, government agencies increase their threat landscape and open more doors for outside attack. Due to the division of power, expertise, responsibilities and resources, government entities prefer to operate as individual silos. This has to change.
Where US cyber security needs to go
The private sector, especially start-ups, are the most innovative in cyber security. Government procurement procedures tend to favour large, well-established vendors over new technology. In cyber defence you cannot use yesterday's solutions for tomorrow's problems. Government should increase cooperation with cyber security start-ups, where agile development and fast iteration can answer challenges that bigger vendors are slow to address.
Buying cyber technology from foreign sources is risky. There are valid concerns about state actors and their relationships with private firms in their jurisdictions.
The reporting requirement
The order requires all executive branches to submit a risk management report. These reports describe security measures and significant risks to the agency, and determine whether agencies can realistically adopt consolidated network architectures. The 90-day window is a start, but the underlying problems will take years to fix.
Originally published 15 May 2017. Migrated to the new IRC site in 2026.