From data breaches to election interference, cyberattacks continue to pose a serious threat to U.S. government agencies, businesses, and citizens. But these incidents are so common that they seem normal. Even with lawsuits and economic sanctions, the response to incidents has been slow. Data breaches have caused distrust, and with that has come cynicism and an acceptance that nothing can be done. But there is hope. In the past six months, the U.S. has taken three extraordinary steps to change the way it approaches cybersecurity, and they all involve the help of an unlikely ally: hackers.
With the following initiatives, there is an opportunity to significantly improve the security of federal civilian services, the government supply chain, and the nation's electoral systems.
Insurance of every federal political organization
There are more than 400 political organizations that operate as members of the federal government and are responsible for securing their digital assets and the large amounts of sensitive information they hold.
These agencies reach out to every citizen in ways we can’t imagine – from physical defense to private data. Yet these organizations continue to be frequent targets of cyberattacks. Over 35,000 cyber incidents were reported by federal agencies in 2017 alone. The U.S. Postal Service, the Internal Revenue and the White House are among the organizations that have reported data breaches in the past five years.
A new initiative launched by the U.S. Department of Homeland Security (DHS) will require every government agency to partner with ethical hackers to better secure their digital assets. The directive will require all federal government agencies to establish a vulnerability disclosure policy (VDP) to receive and resolve security vulnerabilities identified by ethical hackers before they can be exploited by cybercriminals .A VDP ensures that if a hacker finds something dangerous on a website or app, they can easily report it and the organization will have a direct way to handle the communication to take action to remediate the situation.
Vulnerability disclosure has long been an important practice in the cyber community. The US Department of Defense (DOD) has implemented such a policy since 2016 and has since resolved over 12,000 security vulnerabilities that could otherwise have been exploited by various cybercriminals .
Securing electoral systems
IT-ISAC and the Senate Rules Committee are working with all election security vendors, election certification organizations, and the private industry to understand how ethical hackers could help secure elections.
The relationships between ethical hackers and election security have been damaged, even though they work towards the same goal.
This summer, IT-ISAC attempted to bridge the gap by issuing a Request for Information (RFI) on how VDPs and hackers can better collaborate. The so-called election vendors have made enormous efforts to understand the importance of ethical hacker input.
Securing the government supply chain
DOD is completely overhauling how it secures the defense supply chain through the Cybersecurity Maturity Model Certification (CMMC). The CMMC will require every organization that works with DOD to meet certain cybersecurity standards.
The impact of this is staggering. Breaches in the government risk the country’s national security and there is a direct monetary impact on the taxpayer, with an average cost of $6,000. Ethical hackers could play a significant role in this initiative.
Exploitation of vulnerabilities found in government infrastructure in cyberspace will only increase. Meanwhile, there is an entire army of hundreds of thousands of security experts ready to help.
