The White House on Wednesday issued a highly-anticipated set of guidelines to help businesses defend themselves from hackers.
President Obama ordered his administration to create the cybersecurity framework last year after congressional Republicans blocked his preferred legislation. White House officials trumpeted the framework Wednesday, saying it will help upgrade the nation’s defenses against cyberattacks.
But the guidelines are entirely voluntary. Without legislation, the administration can’t force companies to follow the rules, and it’s unclear how much the government can do to encourage compliance. Officials said they won’t even be able to track which companies are adopting the standards.
“While I believe today’s framework marks a turning point, it’s clear that much more work needs to be done to enhance our cybersecurity,” Obama said in a statement.
“I again urge Congress to move forward on cybersecurity legislation that both protects our nation and our privacy and civil liberties. Meanwhile, my administration will continue to take action, under existing authorities, to protect our nation from this threat.”
For years, the Obama administration has been warning that cyberattacks represent one of the gravest threats to national security and that many critical systems remain woefully underprepared for a sophisticated attack.
Hackers could derail trains, shutdown power grids, cause planes to collide, or ruin the water supply, officials warned in congressional testimony, public speeches, and op-eds.
In 2012, the White House lobbied Congress to pass legislation requiring critical infrastructure operators, such as telecom companies, banks, and electric utilities, to meet government cybersecurity standards. But Republicans argued that mandatory regulations would burden companies and do little to combat the constantly evolving threat of cyberattacks.
Democrats scaled back their legislation so that businesses would be pressured — but not forced — to follow the cybersecurity standards. But Republicans still objected and successfully filibustered the Cybersecurity Act, which was authored by independent Sen. Joe Lieberman and Republican Sen. Susan Collins and backed by most Democrats.
Following the defeat of the bill, Obama signed an executive order instructing the National Institute of Standards and Technology, a Commerce Department agency, to work with the private sector to develop voluntary cybersecurity guidelines for critical infrastructure.
The framework is a set of broad strategies to help companies defend their systems and contains few specific recommendations. The document is divided into five cybersecurity actions: identify, protect, detect, respond, and recover.
Businesses are urged to take steps such as training their employees, cataloging the software they use, managing remote access to their systems, and backing up their data. In the event of an attack, they should identify the malicious computer code, share information with other groups, assess the damage, and restore their systems.
The standards are largely based on existing industry best-practices, and officials said they plan to keep them up-to-date as threats and security measures evolve.
The standards can apply to retailers like Target, which suffered a massive data breach that compromised millions of credit card numbers late last year.
Although the guidelines are voluntary, the White House is urging regulatory agencies to update their existing regulations to match the framework. So the Federal Communications Commission, which already has broad power over telecom companies, may revise certain regulations to more closely align with the guidelines.
The Homeland Security Department will also develop a program to try to incentivize companies to follow the rules. Phyllis Schneck, DHS deputy undersecretary for cybersecurity, said Monday morning during an event at the Center for National Policy that cybersecurity insurance may be available to companies that follow the guidelines but are breached anyway.
Adam Segal, a cybersecurity fellow at the Council on Foreign Relations, said the framework isn’t a replacement for legislation.
“This is the best we’re going to get right now,” he said. “Given the political constraints and the reality, this is a good first step.”
Business groups praised the administration for pursuing voluntary guidelines instead of creating a new regulatory regime.
“They’ve done some really good things here in trying to be helpful and not focus on regulation,” Tom Patterson, the head of cybersecurity consulting for Computer Sciences Corp., said. “Had it resulted in a simple checklist, it wouldn’t be nearly as effective as giving real guidance.”
Although business groups have fought against any attempts for mandatory cybersecurity regulation, they do want Congress to pass legislation allowing greater information-sharing between companies and the government.
The companies want legal protection from liability for information they share with other companies or the government about attacks on their systems. Although Obama’s executive order encouraged the government to share more cybersecurity information with the private sector, there is little the administration can do on liability protection without legislation.
Key lawmakers praised the framework and reiterated their support for legislation Wednesday. But Republican opposition continues to mean that mandatory regulations and even government pressure are unlikely to pass Congress any time soon.
And the revelations about National Security Agency surveillance have also heightened fears about the government’s access to private data, meaning that any cyber-information-sharing bills are a longer shot than ever before.
What We're Following See More »
"The move marked the first time Mr. Mueller is known to have used a grand jury subpoena to seek information from a member of Mr. Trump’s inner circle. ...Mr. Mueller is likely to allow Mr. Bannon to forgo the grand jury appearance if he agrees to instead be questioned by investigators in the less formal setting of the special counsel’s offices in Washington."
"The chief of staff and senior counselor to FBI Director Christopher Wray is expected to meet with the House Oversight Committee Thursday. A spokesperson for House Oversight confirmed to the Washington Examiner that Jim Rybicki is expected to testify as part of the committee’s investigation into the Department of Justice’s probe in Hillary Clinton’s private email server, and the decision by then-FBI Director James Comey to announce there would be no criminal charges against the former secretary of state and 2016 Democratic presidential nominee."
"Homeland Security Kristjen Nielsen confirmed that President Trump used 'tough language' in an Oval Office meeting last week over immigration policy, but she said she did not hear him describe some African countries and Haiti as 'shithole countries,' as has been reported." When pressed she, also said she "didn't know" whether Norway was a predominately white country.
"The percentage of Americans without health insurance ticked up 1.3 percentage points in 2017, ending the year at 12.2%, according to the latest data from Gallup. That’s still a lot lower than it was before the Affordable Care Act’s coverage expansion took effect, but this is the biggest single-year increase under the ACA."
"White House Communications Director Hope Hicks is expected to meet with the House Intelligence Committee as soon as this week, making her one of President Donald Trump's closest confidantes to be privately interviewed in the panel's Russia investigation, multiple sources with knowledge of the matter told CNN." She could testify as soon as Friday.