How Should Government and Industry Manage Cyber Risk?

TL;DR

Effective national cybersecurity requires clearly assigned government roles, repeated preparation, and practical support for organizations that lack dedicated security expertise. The panel assigns cyber law enforcement to the FBI, incident response and standards leadership to Homeland Security, and national defense to the Defense Department and intelligence community, while urging focused executive action, incentives, and protections for smaller organizations.

Transcript

Secretary Gates, Secretary Napolitano, Bob Mueller, director of the FBI, and I sat down and created what's called the bubble chart for roles and responsibilities for the federal government. And what that did was helped identify the lanes in the road, what your roles and responsibilities were. So FBI, law enforcement for cyber and cyber-related even... Read More

Key Insights

• Federal cyber responsibilities are divided among specialized institutions: the FBI handles law enforcement, Homeland Security focuses on protection, incident response, standards, and public engagement, while the Defense Department and intelligence community hold the capabilities required to defend the nation and respond to attacks.
• Clear accountability is essential because a cyber attack could quickly expand into other forms of power. The agencies responsible for national defense must understand their missions, train for them, practice coordinated responses, and accept accountability when the country is attacked.
• Blockchain-based systems can reduce transaction time by codifying certain human relationships in computer-readable rules and relying on consensus. This can move verification and risk management toward the beginning of a transaction instead of depending primarily on lawyers and courts afterward.
• Reputation is becoming as important as confidentiality because convincing fabricated media can disrupt accepted sources of truth. The panel anticipates systems capable of analyzing live social media video and generating fake footage so realistic that an individual may be unable to recognize that an event never occurred.
• Single-purpose executive orders are more useful as calls to action than broad collections of short deadlines and unrelated requirements. The panel argues that government already has extensive studies identifying persistent cybersecurity problems, so departments and agencies should provide roadmaps and explain what prevents solutions.
• Cyber have-nots are organizations that face serious adversaries without sufficient security funding, personnel, expertise, or organizational continuity. Small nonprofits, businesses, political organizations, and some government agencies may never develop the internal capabilities available to major financial institutions.
• The DNC example shows how structural constraints can create severe cyber exposure. According to the panel, the organization had no cybersecurity staff, no internal IT personnel because technology operations were outsourced, limited resources, and a workforce that rotated every two years.
• Economic incentives can encourage smaller organizations to invest in cybersecurity. The panel proposes R&D tax credits for hiring security personnel or purchasing security technology, along with possible safe harbors recognizing that an organization made reasonable efforts even when attackers still succeeded.

Questions & Answers

Q: How should federal cybersecurity responsibilities be divided?

Federal cybersecurity responsibilities should be assigned according to distinct institutional missions. The FBI should handle law enforcement for cyber and cyber-related events. Homeland Security should lead protection, incident response, standards such as the NIST framework, and public engagement with government. The Defense Department and intelligence community should defend the nation because they possess the capabilities needed to respond when attacks threaten national security.

Q: Why must government agencies clarify their cyber roles?

Government agencies must clarify their cyber roles because confusion can weaken preparation, coordination, and accountability during an attack. The presidential commission found that stakeholders across departments confused their roles and missions. Since a cyber attack could quickly develop into other forms of power, the organizations responsible for national defense must know their duties, train together, practice responses, and remain accountable for performing them.

Q: How can blockchain systems make transactions faster?

Blockchain systems can make transactions faster by recording relationships and transactions in code that computers can interpret, then using consensus-based processes to validate them. The panel contrasts this approach with paper checks and legal processes that may require substantial time. Faster validation shortens the time to shared truth, but it also requires participants to address risks carefully before completing transactions.

Q: Why does blockchain shift risk management toward the beginning of a transaction?

Blockchain shifts risk management toward the beginning because important relationships and validation rules are codified before a transaction is accepted. Traditional systems may resolve the small portion of disputed cases later through lawyers, courts, and human judgment. Consensus-based systems can establish usable truth much faster, so participants must design the rules carefully and evaluate potential errors before relying on the resulting record.

Q: Why is reputation becoming a major cybersecurity concern?

Reputation is becoming a major cybersecurity concern because fabricated media can challenge the credibility of people, organizations, and accepted evidence. The panel warns about systems that analyze live social media feeds and generate compelling fake video that viewers may be unable to distinguish from real events. Such tools could disrupt social points of truth and force organizations to manage rapidly spreading reputational disturbances.

Q: What makes an effective cybersecurity executive order?

An effective cybersecurity executive order should have a simple, focused purpose and operate as a call to action for departments and agencies. The panel recommends requesting current security conditions, concrete roadmaps, listening sessions, and explanations of barriers that prevent solutions. Broad drafts containing many unrelated requirements and ninety-to-one-hundred-day deadlines risk obscuring action on problems that previous administrations and industry task forces have already studied.

Q: Why are small organizations especially vulnerable to cyber attacks?

Small organizations are especially vulnerable because they may lack funding, dedicated security personnel, internal IT expertise, and stable staffing. The DNC example involved outsourced IT, no cybersecurity staff, and an organization whose full staff rotated every two years. Similar constraints affect nonprofits, small businesses, and some government agencies, even though these organizations may face adversaries with substantial capabilities and resources.

Q: How could tax incentives improve cybersecurity investment?

Tax incentives could make security spending more feasible for businesses and nonprofits that must stretch limited budgets. The panel suggests R&D tax credits for hiring security professionals or purchasing security technology. It also raises the possibility of a safe harbor for organizations that made genuine protective efforts but were breached anyway, recognizing that breached companies are victims of crime as well as accountable organizations.

Summary & Key Takeaways

• Federal cybersecurity depends on clearly defined responsibilities. The FBI handles law enforcement for cyber events, Homeland Security leads protection, incident response, standards, and public engagement, while the Defense Department and intelligence community defend the nation. Because cyber attacks may escalate into other forms of power, responsible agencies must train and practice their missions.

• Modern cryptographic and blockchain systems can accelerate transactions and shorten the time required to establish shared truth. By expressing certain human relationships in code and using consensus-based systems, they shift attention toward careful design before transactions occur. At the same time, compelling fake media threatens reputation and society's traditional points of truth.

• Focused government action and broader economic support are needed because longstanding security problems remain unresolved. Small businesses, nonprofits, political organizations, and some government agencies may lack money, personnel, continuity, or internal IT expertise. Tax credits and possible safe harbors could reward genuine security investments while recognizing that breached organizations are also crime victims.