clear

Subscribe

Recent Posts

clear

Archives

2018
Jan Apr May Jul Aug

2017
Jan Feb Mar Apr May Jul Aug Sep Oct Nov Dec

2016
Sep Oct Nov Dec

2014
Apr

2013
Feb Jun Jul

2012
Jan Feb Aug Oct

2011
Jan Feb Mar Jun Jul Sep Oct Dec

2009
Mar Apr

clear
Tuesday, 6 December 2016
Presidential Cybersecurity Commission Makes Some Good Suggestions
Share
clear

President Obama's Commission on Enhancing National Cybersecurity issued its report on December 1, and I thought it had some good recommendations.  I was expecting a long list of regulatory requirements, but did not find those.  Now we have to wait to see if the incoming President chooses to follow the recommendations.

The report contents was divided into six imperatives and 16 recommendations.  The recommendations were backed up with action items.  The major recurring idea in the report was that of public-private partnerships.  Another one was the use of incentives to encourage the adoption of good cyber security programs.  There were many specific steps that the group documented.

Here are some of the high points that caught my attention:

  • Creation of a National Cybersecurity Private-Public Program (NCP3) to address collaboration of public and private sectors in cyber defense.  This is needed, since we don't have a template to use in the event of a major incident.
  • Strong authentication:   government services should offer strong authentication to citizens; agencies should require strong authentication by employees and contractors; the government should determine how it can provide identity proofing for all.
  • The NIST Cyber Security Framework (CSF) gets prime billing.  Recommendations are that it should be required in government agencies, promoted in the private sector and promoted internationally.
  • Incentives should be provided for companies that follow good cyber risk management principles.
  • Significant focus on helping SMB markets.
  • Recommendation to increase funding for cybersecurity in civilian federal agencies by $4 billion over 10 years.
  • Development of a cybersecurity nutritional label to help educate consumers.
  • Workforce improvement:  100,000 new cybersecurity practitioners by 2020; 50,000 new apprentice level practitioners by 2020.
  • Mandatory training program for managers and executives.
  • Move federal agencies from security requirements management to enterprise risk management.

The whole report is worth reading and can be found here.

clear
Posted on 12/06/2016 3:19 PM by Fred Scholl
Comments
No comments yet.