Obama executive order redefines critical infrastructure
More companies could get designated as part of the sector under this week's presidential cybersecurity order
Computerworld - President Barack Obama's cybersecurity executive order, signed on Tuesday, could significantly expand the list of companies categorized as part of U.S. critical infrastructure sector, security experts said Wednesday.
The executive order requires federal agencies and critical infrastructure owners and operators to work cooperatively to minimize cyber risks and strengthen resilience to attacks. It also calls for the creation of new consensus security standards and best practices that critical infrastructure companies will be urged, but not mandated, to follow.
The order stems from what the White House has long said is the need for immediate action to protect critical assets against cyber threats.
Administration officials contended that the order was necessary because Congress has so far failed to adequately update cybersecurity legislation.
A key piece of the executive order is requires federal agencies overseeing critical infrastructure areas to identify organizations "where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security."
Such entities will then be designated as part of the U.S. critical infrastructure.
The order gives the Department of Homeland Security (DHS) and sector-specific federal agencies 150 days to use a risk-based assessment approach to identify such organizations. Owners and operators of those businesses will then be notified by the DHS.
The order allows businesses to challenge a classification and ask to for reconsideration.
A separate Presidential Policy Directive (PPD-21) released on Tuesday scraps the previous national policy for federal agencies and departments to identify and prioritize critical infrastructure. That policy had been established under Homeland Security Presidential Directive-7 (HSPD-7) of 2003.
"This PPD updates our policy from a primary focus on protecting critical infrastructure against terrorism to protecting, securing, and making the nation's critical infrastructure more resilient to all hazards - including natural disasters, manmade threats, pandemics, and cyber attacks," a spokeswoman from the White House's National Security Council told Computerworld via email Wednesday.
"The PPD is focused on clarifying Federal roles and responsibilities; integrating physical security and cybersecurity analysis and situational awareness; improving information sharing; and having the Federal government function more effectively to be a better partner to the critical infrastructure owners and operators," she added.
The Presidential directive identifies 16 critical infrastructure sectors, including the Chemical, Commercial Facilities, Critical Manufacturing, Dams, Defense Industrial Base, Energy, Financial Services, Information Technology, Nuclear Reactors and Water and Wastewater systems.
The DHS is the designated federal agency for 10 of these sectors, including IT, Critical Manufacturing and Communication. The Treasury Department will oversee the identifying of critical infrastructure entities within the financial services sector while the Department of Defense will oversee the Defense Industrial Base sector.
The language in the executive order significantly broadens the number of entities that can be classified as being part of the country's critical infrastructure, said Andrew Serwin, chair of the privacy, security and information management practice at law firm Foley & Lardner LLP.
The order defines critical infrastructure as any organization and associated systems where a cyberattack could pose a threat to U.S. national security, public safety and health or economic interests.
- DOJ's charges against China reframe security, surveillance debate
- Hacker indictments against China's military unlikely to change anything
- U.S. to formally accuse Chinese military of hacking
- Cyberattacks could paralyze U.S., former defense chief warns
- The NSA blame game: Singling out RSA diverts attention from others
- Jury still out on FISA court
- Suspected China-based hackers 'Comment Crew' rises again
- Chinese hackers master the art of lying in wait
- Spy court OK'd all U.S. wiretap requests it received in 2012
- Groups denounce FBI plan to require Internet backdoors for wiretaps
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!