Bossert promises new national cybersecurity strategy

Trump administration officials are working on a new national cybersecurity strategy, building on the president's executive order earlier this year, homeland security adviser Tom Bossert said Tuesday.

Trump administration officials are working on a new national cybersecurity strategy, building on the president’s executive order earlier this year, homeland security adviser Tom Bossert said Tuesday.

“The president moved in his first months to put out an executive order to do the trench work necessary to put us in a position of putting forward a cybersecurity strategy,” he said at a Palo Alto Networks event Tuesday in Washington, D.C. “As soon as we’re prepared to issue a strategy that will be beneficial to the government and the nation, we’ll do so.”

During a conversation on stage with Palo Alto Networks CEO Mark McLaughlin, Bossert said he was surprised and disappointed that the 2008 Comprehensive National Cybersecurity Initiative he had helped craft during his time serving President George W. Bush still appeared to be the blueprint for U.S. strategy in cyberspace.

“If you had told me that 10 years later, I’d come back into government and that would still be the extant strategy and wasn’t fully implemented yet I’d have thought … I mean I have to moderate my language here,” he joked.

The CNCI followed President Bush’s 2003 National Strategy to Secure Cyberspace, which established three strategic objectives for national cyberspace security: preventing cyberattacks against vital national industries; reducing national vulnerability to cyberattacks; and minimizing damage and recovery time from cyberattacks that got through.

While the CNCI was continued under President Barack Obama, there were several national cybersecurity strategy documents released while Bossert wasn’t in government service:

• The White House Cyberspace Policy Review (May 2009)

• The International Strategy for Cyberspace (May 2011)

• The Strategic Plan for Cybersecurity Research and Development (December 2011)

Two years later, in 2015, the Pentagon produced the Department of Defense Cyber Strategy. And in February last year, the White House produced the Cybersecurity National Action Plan, combining pledges to improve federal cybersecurity with plans to empower consumers to improve their online protections through measures like two-factor authentication.

Bossert was tight lipped when asked after his presentation to outline the strategy or give more details.

“Scoping” — deciding exactly what areas of policy and which agencies should be included — “is always an important first step,” he said, adding, “But I think the [cybersecurity] executive order gives you a good blueprint, and the blueprint is to organize our efforts” into three component parts:

• Defending federal networks “practicing what we preach before we preach it to others”

• Working with critical infrastructure owners and operators to protect vital industries

• The global dimension: Developing norms of good behavior for nation states in cyberspace and raising the costs for foreign adversaries who don’t abide by them.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems

• Bipartisan Senate bill aims to prepare energy sector for Q-Day