Experts: Trump to follow Obama's lead on cyber policy

"Our initial impressions are positive," said Intel Security's Steve Grobman. "The administration is off to a good start."

In cybersecurity policy, if in nothing else, there is likely to be a great deal of continuity between the Trump presidency and its predecessor, scholars and executives said Wednesday — seizing in particular on a renewed push for federal IT modernization expected from the incoming administration.

“What you see in the draft [executive order on cybersecurity the administration has been circulating] more than anything is else is continuity,” Jeffrey Eisenach told an event at Stanford University’s Hoover Institution Washington campus Wednesday. Eisenach is a scholar at the right-leaning American Enterprise Institute think tank and was a volunteer for the Trump transition team.

“There is not a partisan divide on this question,” he continued, “The issues [Republican critics of the Obama administration raised] went to execution,” rather than policy.

“If you talked to people in the Obama White House, in the Obama cyber world during the last year of the administration, I think they were painfully aware that there was a gap between the vision and the execution,” he concluded.

His remarks reflected a broad consensus among the panelists and speakers at the event, although Adam Klein, of the Center for a New American Security, cautioned that “There’s a lot of conjecture in this.”

“Many of the people who will shape these polices aren’t in place yet,” he noted, adding that the administration is “likely to be reactive rather than proactive until their people are in place.”

But the early signs seem encouraging, noted Steve Grobman, CTO of Intel Security, formerly known as McAfee.

Trump’s draft cybersecurity EO puts a focus on modernizing federal IT that Grobman called “critically needed [and] long overdue.”

“Properly managed and funded this draft order would enable the retirement, replacement and modernization of legacy federal IT that is difficulty to secure and expensive to maintain,” Grobman noted.

Eisenach said he didn’t know when or even whether the EO would be signed, but it does represent a “clear policy direction” from the top.

“If you look at the draft [EO] the focus on upgrading federal IT is quite clear and something everybody ought to take heart about,” added Eisenach.

Denise Zheng from the Center for Strategic and International Studies said that if she had to single out one recommendation, “I think it’s procurement and how the federal government buys technology to secure its own networks.”

She said that there was a growing realization that better security could be achieved through centralizing the provision of some IT services and buying in others from outside — something that industry was likely to welcome. “There is certainly an appetite to do managed services, to outsource and to do less of the government’s own cybersecurity by itself. And I do think there’s an alignment of government and industry interests there,” she said.

Along with the focus on upgrading IT, the draft EO puts stress on making agency heads responsible for securing their own IT systems, which Grobman said would make a big difference.

“For too long cybersecurity policies and operational outcomes have been delegated too far down the the management chain, often with poor results,” he said. “Holding heads of government agencies responsible for cybersecurity outcomes in their agencies and putting [the White House Office of Management and Budget] with its budgetary authority in a lead position to drive accountability throughout government has the potential to radically improve the security posture of government agencies,” he added.

“Once we have seen the final order, we’ll be in a position to undertake a lengthy review and finalize our position on it, he said. But “Our initial impressions are positive,” Grobman summed up. “The administration is off to a good start.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure