Obama executive order redefines critical infrastructure
So businesses that support or partner with companies and federal agencies from the listed as part of the critical infrastructure sector could be designated as well. "I think that you could see a variety of other industries getting sucked into the definition of critical infrastructure," Serwin said.
It's unclear yet what risk criteria the federal agencies will use to identify entities, he said. "But you could see a scenario where any business of a certain size" could be considered critical.
Obama's order does not require private sector owners and operators of critical infrastructure to adopt any of the new security standards and best practices. But they will be pressured to adopt them anyway from a due diligence standpoint, Serwin maintained.
"There are huge brand issues with cybersecurity and privacy," Serwin said. "If you are in a designated critical infrastructure category, you don't want to be the company that didn't follow the recommendations."
A wide range of companies from the health care, IT, financial services and other sectors need to determine whether they could be designated as part of the critical infrastructure sector under the executive order, said David Ransom, a partner at law firm McDermott Will & Emery.
The DHS secretary appears to have been given wide latitude to designate critical infrastructure under the order, Ransom said. The language leaves open the possibility that a wide range of private sector entities from a spectrum of industries could get classified as critical infrastructure.
"What their view is going to be remains to be seen," he said.
The executive order's open-ended definition of critical infrastructure gives the DHS and sector specific federal agencies the ability "to cast a wide net in the process of identifying which companies and their associated assets and systems might be included within their statutory capacity," said John South, chief security officer at Heartland Payment Systems.
The key question though is whether broadening the list of companies will make much of a difference in heading off cybersecurity threats, South said.
Efforts to define critical infrastructure entities goes back as far as 1998 at least, he noted. Considerable progress has already been made in identifying information sharing capabilities of the sort described in the executive order, South added.
"Nothing in this directive clarifies what timely information sharing is and how this differs from where we are currently," he said. "If there is no substantive product that provides actionable, timely intelligence - regardless of how wide the net of critical infrastructure is cast - we haven't advanced very much."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
- DOJ's charges against China reframe security, surveillance debate
- Hacker indictments against China's military unlikely to change anything
- U.S. to formally accuse Chinese military of hacking
- Cyberattacks could paralyze U.S., former defense chief warns
- The NSA blame game: Singling out RSA diverts attention from others
- Jury still out on FISA court
- Suspected China-based hackers 'Comment Crew' rises again
- Chinese hackers master the art of lying in wait
- Spy court OK'd all U.S. wiretap requests it received in 2012
- Groups denounce FBI plan to require Internet backdoors for wiretaps
Read more about Security in Computerworld's Security Topic Center.
- Single-Vendor Security Ecosystems Offer Concrete Benefits Over Point Solutions IT security decision-makers from companies with 100 to 5,000 employees evaluates the current endpoint security solution market based on Forrester's own market data,...
- Case Study: Intuit Turns to Self-Service IT Intuit empowered its users to resolve their own IT issues with a consumer-like experience to free IT to focus on more strategic initiatives....
- Automation for a Better Tomorrow Check out the five most common annoyances facing enterprise IT service desks today, and how automation can resolve all of them. Download the...
- Beyond the Enterprise App Store Leverage proactive, secure and automated IT Service delivery to move beyond the traditional App Store and empower your users. Read the white paper...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!