CS Jul-Aug 2023

cyber strategy
SECURITY BY DESIGN
NEW CYBERSECURITY MEASURES BEING IMPOSED IN THE US WILL HIT
SOFTWARE COMPANIES HARD. WHAT MIGHT THIS MEAN FOR THE UK?
The US recently published its national
cybersecurity strategy. Released by
the Biden administration, it seeks to
impose minimum security standards for
critical infrastructure onto larger software
makers. Equally, it means to shift responsibility
for maintaining the security of
computer systems away from consumers
and small businesses. What impact is this
likely to have on the security industry - and
what implications, in particular, might this
have for the UK? Does it have any other
option but to follow the same path?
Phil Tonkin, senior director of strategy
at Dragos, says that the US National
Cybersecurity Strategy aiming to move
from a voluntary approach to cybersecurity
in many industries to more aggressive,
and mandatory, regulatory standards -
a 'fundamental shift' to rebalance the
responsibility to defend cyberspace -
did not come as a surprise. "For months,
administration officials telegraphed the
intent to use regulatory and market drivers
to shift the burden of mitigating cyber risks
away from end users and to those best
positioned to have earliest and broadest
impact. This includes not just critical
infrastructure owners and operators, but
also technology companies, software
makers and service providers," he says.
However, this is not a shift that will not
happen overnight. "While the US National
Cybersecurity Strategy signals a stronger
regulatory environment in the US, many
different standards bodies and regulatory
agencies oversee a patchwork of regulatory
frameworks and requirements for different
industries. Even as the administration has
rolled out new requirements for certain
industries, including railways and pipelines,
others will require new authorities from
Congress."
REGULATORY ESSENTIALS
What this means is that the US government
and experts from industry have time to
work together toward building regulatory
requirements that achieve the best possible
outcomes for securing infrastructure and
the digital ecosystem, with a focus on real
security and not just simple compliance
advises Tonkin, who also points out how
the strategy highlights the importance of
international coalitions and partnerships to
counter cyber threats, devoting an entire
pillar to those shared goals.
"The consequences of cybercrime are not
geographically restricted, requiring a global
approach to countering threats and managing
vulnerabilities. Economies are interconnected
globally as well, with many
companies operating across countries
and regions. So, any time a new security
standard or regulation is adopted, industry
has to react and this often has a ripple
effect globally."
He adds that the 2016 UK National Cyber
Strategy has focused on developing
capability with a particular focus on critical
infrastructure across all areas. "In 2022, it
began to consider this in the context of
increasing digitisation, sustainability and
reducing international dependence. This
continues to mature, in particular as the UK
begins to find its own direction in setting
future Network Security legislation outside
of the European Union. "Both the UK and
EU have begun to move legislation to cover
more entities, closer to the consumer,"
Tonkin concludes. "However, there is a
growing global recognition that the
responsibility to secure digital products
cannot be the responsibility of individuals.
The eyes of the world will be on the US to
learn how security by design is enforced."
Phil Tonkin, Dragos.
www.computingsecurity.co.uk @CSMagAndAwards July/August 2023 computing security
31