News / Science & Technology

Obama Administration Offers Companies Broad Standards to Improve Cybersecurity

Reuters
The U.S. government on Wednesday released the final version of standards meant to help companies in nationally critical industries better defend against cyber attacks, and officials now face the challenge of getting the private sector to adopt the voluntary measures.

Criticized for being too vague and toothless, the so-called cybersecurity framework turned a vast amount of industry input into guidelines designed for 16 different sectors whose disruption could be devastating to the country.

The release from the National Institute of Standards and Technology comes exactly one year after President Barack Obama issued an executive order directing the agency to compile voluntary minimum cybersecurity standards as one step to counter the lack of progress on cybersecurity law in Congress.

“While I believe today's Framework marks a turning point, it's clear that much more work needs to be done to enhance our cybersecurity,” Obama said in a statement.

“I again urge Congress to move forward on cybersecurity legislation that both protects our nation and our privacy and civil liberties,” he said. “Meanwhile, my Administration will continue to take action, under existing authorities, to protect our nation from this threat.”

The framework, drafted by the nonregulatory government agency in consultation with thousands of industry experts, offers broad benchmarks for companies to measure the effectiveness of their cyber defenses.

The Obama administration had faced intense pushback from the private sector on its earlier effort to mandate cyber defense standards, which contributed to stalled legislation. Now, the White House hopes companies voluntarily adopt the framework they have helped draft.

“This voluntary Framework is a great example of how the private sector and government can, and should, work together to meet this shared challenge,” Obama said, and a senior administration official called the framework the beginning of a “continuing common-sense conversation” about protecting the nation's critical assets from cyber attacks.

“I think that the NIST standards will become over the next year or two, while we are waiting for legislation, the de facto best practices, just because they are accessible and current,” said Jonathan Fairtlough, managing director at Kroll Advisory Solutions' cyber investigations practice.

Will private sector adapt standards?

Cybersecurity experts warn that relentless efforts to hack into U.S. banks and financial institutions, the power grid and other critical infrastructure, paired with instances of disruptive attacks abroad, pose a national security threat.

The issue recently became a household topic after hackers stole about 40 million credit and debit card records and 70 million other records with personal customer data from the third-largest U.S. retailer, Target Corp.

Many experts have expressed alarm about the lack of awareness or reluctance among some companies' leadership to spend more money on cyber defenses. The framework could force the issue into more executive suites, analysts say.

“At a minimum, it's going to force this conversation up the food chain, out of the CEO office into the boardroom,” said Tom Kellermann, a former member of Obama's Commission on Cyber Security and software company executive now with professional services firm Alvarez & Marsal.

But it is unclear whether the private sector, always concerned about liabilities attached to any standards, would widely adopt the voluntary framework.

The departments of Homeland Security, Commerce and Treasury are reviewing potential incentives for adoption, though some companies worry that incentives will come with strings attached and prompt more regulatory oversight or threat of lawsuits.

The White House has emphasized the voluntary nature of the framework and the need for companies to view cybersecurity as a business decision, part of its risk-management strategy.

“We may not ever know how widely the framework has been adopted, because obviously there's not a requirement,” a second senior Obama administration official said on Wednesday. “There's an enlightened sense here that we're counting on.”

Department of Homeland Security on Wednesday also launched a program called Critical Infrastructure Cyber Community that would help companies reach out to the government for assistance in adopting the framework, and that participation may help gage the popularity of the standards, the official said.

Questions about effectiveness

But it is also unclear how effective the framework will prove in practice.

“At that high level, they got it right. ... Further down, it gets murky really fast,” said Andrew Ginter, vice president of industrial security at Waterfall Security Solutions, whose clients include power plants and water-treatment facilities.

“The NIST framework never uses the word 'firewall.' It's that abstract,” he said, referring to a common standard component of network security.

The framework offers sweeping categories such as “access control” or “data security” to evaluate how effectively a company identifies and protects network assets, and detects, responds to and recovers from breaches, on a one-to-four-tier scale for implementation.

The categories then break into subcategories, such as keeping inventories of used software platforms and applications, ensuring that top executives know roles and responsibilities, and setting information security policies.

The document also incorporates how the companies could do that while protecting privacy and civil liberties.

The framework builds on and references existing regulations, many of which were developed for specific sectors, such as energy and financial services.

“It can get really quite hard” studying and balancing various existing standards, said Dave Burg, who advises corporations on cybersecurity strategies at consultancy PricewaterhouseCoopers. “This framework will provide a very nice baseline against which companies can test themselves.”

You May Like

Myanmar Fighting Poses Dilemma for China

To gain some insight into conflict, VOA’s Steve Herman spoke with Min Zaw Oo, director of ceasefire negotiation and implementation at Myanmar Peace Center More

Australia Concerned Over Islamic State 'Brides'

Canberra believes there are between 30 and 40 Australian women who have taken part in terror attacks or are supporting the Islamic State terror network More

Recreational Marijuana Use Now Legal in Washington, DC

Law allows adults 21 and over to privately possess and smoke 0.05 kilogram of pot, and to grow small amounts of the plant More

This forum has been closed.
Comments
     
There are no comments in this forum. Be first and add one

Featured Videos

Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
US Supreme Court Hears Hijab Discrimination Casei
X
Katherine Gypson
February 25, 2015 11:30 PM
The U.S. Supreme Court has heard opening arguments in a workplace religious discrimination case that examines whether a clothing store can refuse to hire a young woman for wearing the headscarf she says is a symbol of her Muslim faith. Katherine Gypson reports from the Supreme Court.
Video

Video US Supreme Court Hears Hijab Discrimination Case

The U.S. Supreme Court has heard opening arguments in a workplace religious discrimination case that examines whether a clothing store can refuse to hire a young woman for wearing the headscarf she says is a symbol of her Muslim faith. Katherine Gypson reports from the Supreme Court.
Video

Video Falling Gas Prices Hurt Nascent Illinois Hydraulic Fracturing Industry

Falling oil prices are helping consumers purchase cheaper petroleum at the pump. But that’s made hydraulic fracturing or “fracking” less economically viable for the companies in the United States invested in the process. VOA’s Kane Farabaugh reports on one Midwestern town that was hoping to change its fortunes by cashing in on the next big U.S. oil boom.
Video

Video Fighting in Sudan's South Kordofan Fuels Mass Displacement

Heavy fighting in Sudan's South Kordofan state is causing hundreds of thousands to flee into uncertain conditions. Local aid organizations estimate as many as 400,000 civilians have been internally displaced since the conflict began more than three years ago, while another 250,000 have fled across the border to refugee camps in South Sudan. VOA's Adam Bailes reports.
Video

Video Lao Dam Project Runs Into Opposition

A Lao dam project on a section of the Mekong River is drawing opposition from local fishermen, international environmental groups and neighboring countries. VOA's Say Mony visited the region to investigate the concerns. Colin Lovett narrates.
Video

Video A Filmmaker Discovers Her Biracial Identity in "Little White Lie

Lacey Schwartz grew up in an upper middle-class Jewish family, in a town in upstate New York where almost everyone she knew was white. She assumed that she was, as well. Her recent documentary, Little White Lie, tells the story of how she uncovered the secret of her true racial background. VOA’s Carolyn Weaver has more on the film.
Video

Video Deep Under Antarctic Ice Sheet, Life!

With the end of summer in the Southern hemisphere, the Antarctic research season is over. Scientists from Northern Illinois University are back in their laboratory after a 3-month expedition on the Ross Ice Shelf, the world’s largest floating ice sheet. As VOA’s Rosanne Skirble reports, they hope to find clues to explain the dynamics of the rapidly melting ice and its impact on sea level rise.
Video

Video US-Cuba Normalization Talks Resume Friday

Negotiations aimed at normalizing diplomatic relations between the U.S. and Cuba resume Friday. On the table: lifting a half-century trade embargo and easing banking and travel restrictions. There's opposition in Congress, but some analysts say there may be sufficient political and economic incentives in both nations for a potential breakthrough this year. VOA's Mil Arcega reports.
Video

Video Pakistan's Deadline For SIM Registration Has Cellphone Users Scrambling

Pakistani cell phone users have until midnight Thursday to register their SIM cards, or their service will be cut off. While some privacy experts worry about government intrusion, many Pakistanis are just worried about keeping their phone lines open. VOA Deewa reporter Arshad Muhmand has more from Peshawar.
Video

Video Myanmar Warns Factory Workers to End Strikes

Outside Myanmar's main city Yangon, thousands of workers walked off their jobs earlier this month demanding a doubling of their wages, pay raises after a year and input from labor unions on industrial regulations. Since Friday, the standoff has grown more tense as police moved in to disrupt the sit-ins, resulting in clashes that injured people from both sides. VOA correspondent Steve Herman visited industrial zones which have become a focus of Myanmar's fledgling workers rights movement.
Video

Video Oscar Winners Do More Than Thank the Academy

The Academy Awards presentation is Hollywood’s night to reward the best movies from the previous year. It’s typically a lot of glitter, a lot of thank you’s, a lot of speeches. But many of this year’s speeches carried messages beyond the thank you's. VOA’s Carolyn Presutti takes a look.

All About America

Circumventing Censorship

An Internet Primer for Healthy Web Habits

As surveillance and censoring technologies advance, so, too, do new tools for your computer or mobile device that help protect your privacy and break through Internet censorship.
More