For decades, the United States government and private sector have worked tirelessly to secure cyberspace, yet our nation remains frighteningly vulnerable to a litany of cyberthreats posed by cybercriminals and foreign adversaries alike. Daily news reports of cyber intrusions ranging from criminal ransomware attacks to foreign state-sponsored intrusions into power, water, and other critical infrastructure systems are a constant reminder that “by almost every measure, the cybersecurity threat landscape is actually worse.” We can, and must, do better. To develop an effective national cybersecurity strategy, policymakers should consider the following ten points.
Prioritize “Key Systems”
Policymakers should prioritize securing critical infrastructure whose cybersecurity failures could have catastrophic impacts on national security, economic security, public health or safety. Such systems include the electrical grid, water systems, ports, rail and air transportation as well as national, state, and local governments.
Use Memory Safe languages for key systems
A fundamental cybersecurity problem stems from the widespread use of software written in unsafe programming languages. These languages, developed in the early days of computing—before cybersecurity was even a consideration—were designed for efficiency, but are vulnerable to a class of programming bugs known as “memory safety errors.”
Memory safety errors have been described as “today’s biggest attack surface for hackers” and are estimated to be responsible for nearly 70% of software vulnerabilities. Fortunately, today’s memory safe programming languages (e.g., Rust) are specifically designed to eliminate memory safety errors.
The federal government has developed a roadmap to help companies transition to memory safe code, and many companies have begun the journey. Accelerating this transition will significantly strengthen the nation’s cybersecurity.
Apply formal methods for key systems
Memory-safe languages eliminate many software vulnerabilities but are not a cure-all. Using “formal methods” offers even greater security. Formal methods rely on mathematical proof “to create ultra-secure, ultra-reliable software.” In fact, when the Defense Advanced Research Projects Agency (DARPA) used formal methods to program a military helicopter’s flight control computer, all subsequent hacking attempts failed.
Formal methods are currently in use by numerous leading technology companies, such as Amazon Web Services and Microsoft, and in high-assurance contexts, such as development of flight-control software. Implementation of formal methods requires some work, but the necessary tools are publicly available, the benefits are significant, and future advancements in automation will likely make implementation even easier.
Establish resilient architectures
Migrating to resilient architectures based on “zero trust” principles will further strengthen the cybersecurity of key systems. Traditional security models automatically trust users within an organization’s perimeter. In contrast, zero trust models trust no one by default. Taking a “never trust, always verify” approach, these models reduce the chance of breach by verifying every access request, regardless of where it originates.
Policymakers should ensure that zero trust architectures are established for key critical infrastructure through Congressional action and/or federal regulations akin to those already established for interstate electric transmission, railroads, and pipelines.
Build data resilience
Data resilience is the ability to keep data accessible and uncorrupted, even during a cyberattack. One effective way to improve data resilience is to back up key systems in the cloud—an approach Ukraine famously used just before Russia’s invasion. By migrating thousands of terabytes of critical government data to the cloud, Ukraine was able to maintain government operations despite intense kinetic operations and cyberattacks.
Defend proactively through threat hunting
Policymakers should ensure that defensive cyber “threat hunting”—proactively searching networks for undetected cyberthreats—is conducted regularly undertaken on key networks. Many key systems already receive threat hunting services through contracts with private firms, but policymakers should make sure that every key system is covered, potentially by establishing necessary baseline requirements. While private companies can provide much of this support, government agencies— such as the Coast Guard under its “Captain of the Port” authorities to protect critical port infrastructure—can also play a role. Finally, because defensive threat hunting on key networks serves the public interest, Congress should consider providing financial support, such as tax credits or dedicated budget allocations.
Coordinate government and private sector cybersecurity actions
Effective cybersecurity requires close collaboration between the government and the private sector. To ensure this coordination, a central body overseen by the National Cyber Director should be established. The NCD would act as a “head coach,” guiding efforts across both sectors, while leaving day-to-day operations to the organizations best equipped to handle them.
Establish “Regional Resilience Districts”
Policymakers should support regional approaches to cybersecurity, which help manage risks across sectors in critical areas. Piloting regional resilience districts in places with major military installations, such as Charleston, South Carolina or the Houston ship channel, would strengthen cross-sector protection, limit cascading effects from cybersecurity failures, and improve recovery from major attacks.
Incorporate adversary disruption into cyber campaigns
Policymakers should collaborate with key private sector firms to assess their ability to disrupt adversarial cyber attacks—for example, by banning entities that violate terms of service from their networks. They should then determine when and how private sector and government actions, whether individually or together, can most effectively contribute to disrupting adversaries.
Governments have previously worked with the private sector to take down criminal cyber organizations, sometimes using the Fourth Amendment’s asset seizure authority. Given the rise in cyber intrusions by both criminals (e.g., ransomware operators) and nation-state adversaries (e.g., China’s Typhoons), policymakers should consider expanding these efforts beyond asset seizure to include active disruption.
Capitalize on emerging technology
Finally, policymakers should leverage the innovation pipeline—including expertise from industry, government, federal R&D centers, national laboratories, and academia—to effectively apply emerging technologies like artificial intelligence in support of both offensive and defensive cybersecurity missions.
Cybersecurity policymakers have a unique opportunity to dramatically strengthen our digital defenses by following the ten steps outlined above. Implementing these measures will help safeguard national security, critical infrastructure, and the public good in an increasingly complex threat environment. The time for decisive action is now.
This op-ed is derived from the forthcoming Atlantic Council report by the authors on “Cybersecurity Strategy for the United States.”
Franklin D. Kramer is a distinguished fellow at and serves on the board of the Atlantic Council. He is a former assistant secretary of defense for international security affairs.
Robert J. Butler is the co-founder and managing director of Cyber Strategies LLC, served as the first deputy assistant secretary of defense for space and cyber policy, and served as the Chief Security Officer for IO Data Centers, a global data center enterprise, among other cybersecurity-related roles in both corporate and government organizations.
Melanie J. Teplinsky is an adjunct professor and senior fellow in the Technology, Law and Security Program at American University (AU), Washington College of Law. She previously practiced technology law at Steptoe & Jonson LLP and served on the pre-IPO advisory board for CrowdStrike.
The post The ten key reforms that can close America’s cybersecurity gaps appeared first on CyberScoop.
Cybercriminals and foreign adversaries are exploiting gaps in our digital armor. These essential reforms can help American cybersecurity catch up.
The post The ten key reforms that can close America’s cybersecurity gaps appeared first on CyberScoop. Read MoreCyberScoop
