Presidential Cybersecurity Commission Makes Some Good Suggestions

President Obama’s Commission on Enhancing National Cybersecurity issued its report on December 1, and I thought it had some good recommendations.  I was expecting a long list of regulatory requirements but did not find those.  Now we have to wait to see if the incoming President chooses to follow the recommendations.

The report contents were divided into six imperatives and 16 recommendations.  The recommendations were backed up with action items.  The major recurring idea in the report was that of public-private partnerships.  Another one was the use of incentives to encourage the adoption of good cybersecurity programs.  There were many specific steps that the group documented.

Here are some of the high points that caught my attention:

• Creation of a National Cybersecurity Private-Public Program (NCP³) to address the collaboration of public and private sectors in cyber defense.  This is needed, since we don’t have a template to use in the event of a major incident.
• Strong authentication:   government services should offer strong authentication to citizens; agencies should require strong authentication by employees and contractors; the government should determine how it can provide identity proofing for all.
• The NIST Cyber Security Framework (CSF) gets prime billing.  Recommendations are that it should be required in government agencies, promoted in the private sector and promoted internationally.
• Incentives should be provided for companies that follow good cyber risk management principles.
• Significant focus on helping SMB markets.
• Recommendation to increase funding for cybersecurity in civilian federal agencies by $4 billion over 10 years.
• Development of a cybersecurity nutritional label to help educate consumers.
• Workforce improvement:  100,000 new cybersecurity practitioners by 2020; 50,000 new apprentice level practitioners by 2020.
• Mandatory training program for managers and executives.
• Move federal agencies from security requirements management to enterprise risk management.

The whole report is worth reading and can be found here.