International Cyber Terrorism

V. Cyber Security Regulation
A Cybersecurity Regulation comprises directives that safeguard information
technology and computer systems with the purpose of forcing companies and
organizations to protect their systems and information
from cyberattacks like viruses, worms, Trojan horses, phishing, denial of service (DOS)
attacks, unauthorized access (stealing intellectual property or confidential
information) and control system attacks. There are numerous measures available to
prevent cyberattacks.
Cybersecurity measures include firewalls, antivirus
software, intrusion
detection and prevention systems, encryption,
and login passwords. There have been
attempts to improve cybersecurity through
regulation and collaborative efforts between
the government and the private sector to
encourage voluntary improvements to
cybersecurity. [1] Industry
regulators,
including banking regulators, have taken notice
of the risk from cybersecurity and have either begun or planned to begin to include
cybersecurity as an aspect of regulatory examinations.
Background
In 2011 the DoD released a guidance called the Department of Defense Strategy for
Operating in Cyberspace which articulated five goals: to treat cyberspace as an
operational domain, to employ new defensive concepts to protect DoD networks and
systems, to partner with other agencies and the private sector in pursuit of a "whole-ofgovernment
cybersecurity Strategy", to work with international allies in support of
collective cybersecurity and to support the development of a cyber workforce capable of
rapid technological innovation. A March 2011 GAO report "identified protecting the
federal government's information systems and the nation's cyber critical infrastructure
as a governmentwide high-risk area" noting that federal information security had been
designated a high-risk area since 1997. As of 2003 systems protecting critical
infrastructure, called cyber critical infrastructure protection of cyber CIP have also been
included.
In November 2013, the DoD put forward the new cybersecurity rule (78 Fed. Reg.
69373), which imposed certain requirements on contractors: compliance with
certain NIST IT standards, mandatory reporting of cybersecurity incidents to the DoD,
and a "flow-down" clause that applies the same requirements to subcontractors.
Page 81 of 174