The new year presents the federal government with renewed opportunities to tackle some of the most critical cyber threats to U.S. national security. Cybercriminals have the capabilities to significantly disrupt the U.S. power grid and target aging critical infrastructure, compromise election security and make citizens question the integrity of systems once deemed secure. The ongoing partial shutdown further threatens our nation’s cybersecurity; there aren’t enough resources to monitor incoming cyber threats, making it more difficult to compensate for missed time after the shutdown ends. How will federal cybersecurity operations bounce back and combat threats in 2019?
Elevating the former National Protection and Programs Directorate (NPPD) to the Cybersecurity and Infrastructure Agency (CISA) was an important step to protect our nation’s civilian cyber resources, but there is still work to be done. CISA’s ability to transition and begin operations at full speed has been impeded, with almost half of its workforce furloughed and the rest working without pay until the government reopens. We are losing out on critical operational capacity and cybersecurity talent. The length of the shutdown will no doubt impact CISA’s capabilities for 2019, including the work of the National Risk Management Center (NRMC), a component of CISA tasked with identifying and addressing systemic risks to the nation’s critical infrastructure in the energy, finance and telecommunications sectors.
When federal operations return to normal, the joint Department of Homeland Security (DHS)-industry Cyber Supply Chain Task Force will initiate work to reduce cyber risks in the technology and communications supply chain. The Task Force is expected to develop strategies to address supply chain risks from attacks affecting government contractors, suppliers and all levels of government this year. This issue has continued to gain traction with lawmakers who have concerns about foreign technology used in everything from 5G technology to public transit railcars. The Department of Defense (DoD) is also making improvements to supply chain security under its new strategy, dubbed Deliver Uncompromised. The strategy, announced with the goal of protecting the department’s $100 billion supply chain, will add security assessments to the department’s weapons contracts. Developing guidance and recommendations that align with modern, agile IT development methods is one of the key challenges these efforts will face. Ideally, we are looking to increase security while allowing for continued innovation and digital transformation.
Congressional support for DHS’ Continuous Diagnostics and Mitigation (CDM) program and future funding should remain a priority. CDM helps federal agencies assess their cyber exposure gaps and have visibility into their expanded attack surface in order to better prioritize and address vulnerabilities. Lawmakers are also expected to focus on botnets, which according to a report by the Council to Secure the Digital Economy (CSDE), will take advantage of the increased use of IoT devices, from smart speakers to tools used by public utilities. Members of Congress are exploring opportunities to introduce legislation to help law enforcement officials counteract cybercriminals who utilize botnets to perpetrate attacks, as well as legislation to improve baseline security measures for government acquisition of IoT devices, applications and networks. Last year’s report to the White House, co-authored by the secretary of Commerce and the secretary of Homeland Security, and the subsequent release of the roadmap this past fall, provide a path forward to implement recommendations to address the risks posed by botnets and enhance the resilience of the internet and communications systems.
Lastly, while the immediate concern of the 2018 midterm election security has passed, the 2020 presidential campaign is already underway. We must act now to ensure that resources are available to states and localities to combat attacks on election infrastructure. Congress’s first order of business was fitting, with the introduction of H.R.1. This legislation seeks to prioritize election security efforts and reduce vulnerabilities through grants to states and municipalities that will help upgrade aging election equipment and develop incident reporting requirements for equipment vendors.
Cybersecurity threats aren’t going anywhere in 2019. The modern attack surface has expanded; our critical infrastructure, elections, IoT, and personal devices are under attack from adversaries. DHS, DoD and Congress are all working to limit the impact of such attacks. These are just some of the many cyber priorities we can expect in Washington as the year progresses and agencies return to normal operations.
The views expressed here are the writer’s and are not necessarily endorsed by Homeland Security Today, which welcomes a broad range of viewpoints in support of securing our homeland. To submit a piece for consideration, email [email protected]. Our editorial guidelines can be found here.
