Obama executive order redefines critical infrastructure
So businesses that support or partner with companies and federal agencies from the listed as part of the critical infrastructure sector could be designated as well. "I think that you could see a variety of other industries getting sucked into the definition of critical infrastructure," Serwin said.
It's unclear yet what risk criteria the federal agencies will use to identify entities, he said. "But you could see a scenario where any business of a certain size" could be considered critical.
Obama's order does not require private sector owners and operators of critical infrastructure to adopt any of the new security standards and best practices. But they will be pressured to adopt them anyway from a due diligence standpoint, Serwin maintained.
"There are huge brand issues with cybersecurity and privacy," Serwin said. "If you are in a designated critical infrastructure category, you don't want to be the company that didn't follow the recommendations."
A wide range of companies from the health care, IT, financial services and other sectors need to determine whether they could be designated as part of the critical infrastructure sector under the executive order, said David Ransom, a partner at law firm McDermott Will & Emery.
The DHS secretary appears to have been given wide latitude to designate critical infrastructure under the order, Ransom said. The language leaves open the possibility that a wide range of private sector entities from a spectrum of industries could get classified as critical infrastructure.
"What their view is going to be remains to be seen," he said.
The executive order's open-ended definition of critical infrastructure gives the DHS and sector specific federal agencies the ability "to cast a wide net in the process of identifying which companies and their associated assets and systems might be included within their statutory capacity," said John South, chief security officer at Heartland Payment Systems.
The key question though is whether broadening the list of companies will make much of a difference in heading off cybersecurity threats, South said.
Efforts to define critical infrastructure entities goes back as far as 1998 at least, he noted. Considerable progress has already been made in identifying information sharing capabilities of the sort described in the executive order, South added.
"Nothing in this directive clarifies what timely information sharing is and how this differs from where we are currently," he said. "If there is no substantive product that provides actionable, timely intelligence - regardless of how wide the net of critical infrastructure is cast - we haven't advanced very much."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- DOJ's charges against China reframe security, surveillance debate
- Hacker indictments against China's military unlikely to change anything
- U.S. to formally accuse Chinese military of hacking
- Cyberattacks could paralyze U.S., former defense chief warns
- The NSA blame game: Singling out RSA diverts attention from others
- Jury still out on FISA court
- Suspected China-based hackers 'Comment Crew' rises again
- Chinese hackers master the art of lying in wait
- Spy court OK'd all U.S. wiretap requests it received in 2012
- Groups denounce FBI plan to require Internet backdoors for wiretaps
Read more about Security in Computerworld's Security Topic Center.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!