Experts: What to expect after cybersecurity executive order
The Obama administration's cybersecurity framework could see current banking and utility regulations as a model, some say
IDG News Service - U.S. government agencies will need the help of companies while developing a set of cybersecurity standards that President Obama has called for in an executive order signed last month, administration officials said.
The Obama administration will look to private industry for cybersecurity standards and best practices on which to base the voluntary framework focused on reducing risks to companies providing critical infrastructure, representatives of the U.S. Department of Commerce and sub-agency the U.S. National Institute of Standards and Technology said Monday during a briefing on the executive order.
The government will not push through its own idea of what the standards should look like, said Ari Schwartz, senior policy adviser in the Department of Commerce.
"This is not one of those examples of, 'we're from the government, and we're here to help,'" Schwartz added. "It's, 'we're from the government, and we need your help.'"
Even with industry participation, the framework could contain some rigorous standards aimed at improving cybersecurity for businesses identified as critical infrastructure, said some lawyers at Venable, the law firm hosting Monday's briefing. Existing security regulations for the electric utility and financial services industries may serve as models for the executive order's framework, Venable lawyers said.
The new standards will likely question how a company's network is designed and configured and who has access to the network, said Brian Zimmet, a partner in Venable's energy practice group. "Which ports are open and which ports are closed?" he said. "You're looking at being able to justify every single open port on your network and being able to articulate a valid business reason for having that port open."
The framework's standards prompt some changes at participating companies, he added.
"When your network was originally set up by your IT people, they set it up with an eye, generally, toward making the system work and making it as easy as possible for the company to do its business," Zimmet said. "When you start applying cybersecurity standards to this question, you're really looking at the opposite of what the IT guys were looking at when they designed the network."
The framework may also ask businesses to report cybersecurity breaches, as financial institutions now do, added Venable partner John Bowman, who works with the banking industry. Bowman's clients see current cybersecurity regulations on banks as a model for the framework, but some industries may not need as many regulations, he said.
The cybersecurity rules for the banking industry impose a "considerable" burden on those businesses, he said.
Obama's order tasks NIST with leading the effort to develop the cybersecurity framework, and the agency will host several workshops for interested people to comment, said Adam Sedgewick, senior Internet policy advisor at NIST. The first workshop is April 3 at NIST's headquarters in Gaithersburg, Maryland, near Washington, D.C.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!