I'm (more than) just a bill — Fresh off the August recess, Congress faces a tight window to finalize the annual defense funding bill, which will determine what cyber policy dreams will become reality, when — and with how much money. To prepare for the legislative sprint ahead, your MC host asked cyber experts which aspects of the draft National Defense Authorization Act has them most excited. Improved information-sharing — Every cyber expert nice enough to sacrifice their Labor Day holiday for a chit chat with MC singled out the transformative potential of the Joint Collaborative Environment, an information-sharing portal that would integrate government threat streams with data from the private sector. Sitting under the Joint Cyber Defense Collaborative, the JCE would empower both government and industry threat hunters, allowing them to analyze threat data at an unprecedented scale. "What's killing us right now is siloed data streams," said Mark Montgomery, executive director of the Cyberspace Solarium Commission. "Data has to move beyond email and Slack to more automated and integrated data exchange programs, like the JCE." Really critical critical infrastructure — Multiple experts who spoke with MC also applauded a host of provisions surrounding the protection of so-called systemically important entities — critical infrastructure providers whose impairment via cyberattack would cascade widely across the U.S. economy. Though growing industry pushback means a major regulatory overhaul is unlikely this year, Lauren Zabierek, executive director of the Cyber Project at Harvard's Belfer Center, said she was "heartened" by a provision in the draft bill that would require DHS to conduct a study of possible recommendations for a minimum level of cybersecurity among SIEs. Zabierek said she was hopeful this effort "could lay the path toward [future] requirements, which I think should be codified by Congress." Accountability for software vendors – A provision in the House version of the bill would require vendors to certify that software they sell to the government is either free of known vulnerabilities or that they have a plan to fix it. That could trigger "an enormous market shift," according to Michael Daniel, president and CEO of the non-profit Cyber Threat Alliance. "Previously, vendors bore no liability for providing software with known defects," explained Daniel. "By putting some of the burden on software makers to fix vulnerabilities, the provision has the potential to start shifting some of the market dynamics around software provisioning." A reason to smile – Overall, experts who spoke with the MC agreed that the forthcoming NDAA heralded good news for U.S. cyber policy. "The current NDAA is what I would call 'blocking and tackling,'" Montgomery said. "Nothing in the bill is some big, long bomb. But there are a lot of good things in there."
| 
Comments
Post a Comment