One of the biggest security problems on the Internet is a ransomware attack. Ransomware can impact all our lives. Just take the Scripps Health and Colonial Pipeline ransomware attacks that we discussed in recent podcast episodes. Last week we gave you 6 tips for planning for a ransomware attack. And today we are going to discuss 6 points from the recently released cyber Executive Order.
In this episode:
6 Points In Cyber Executive Order – Ep 306
Today’s Episode is brought to you by:
Kardon
and
HIPAA for MSPs with Security First IT
Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity.
The HIPAA Boot Camp
Virtual Edition Aug 17-19, 2021
Great idea! Share Help Me With HIPAA with one person this week!
Thanks to our donors. We appreciate your support!
If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com
Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA
If you see a couple of numbers on the left side you can click that and go directly to that part of the audio. Get the best of both worlds from the show notes to the audio and back!
6 Points In Cyber Executive Order
[10:23] The recently signed Executive Order on Improving the Nation’s Cybersecurity has some interesting plans included in it. Here are our top 6 thoughts on what we see in the Order’s directives.1 – The policy statement itself has some text that is important to note.
Incremental improvements will not give us the security we need; instead, the Federal Government needs to make bold changes and significant investments in order to defend the vital institutions that underpin the American way of life. The Federal Government must bring to bear the full scope of its authorities and resources to protect and secure its computer systems, whether they are cloud-based, on-premises, or hybrid. The scope of protection and security must include systems that process data (information technology (IT)) and those that run the vital machinery that ensures our safety (operational technology (OT)).
It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order.
It is a welcome site to see some of those statements in policy directives. The question will be what actually gets done on this list. None of those statements are wrong, but we have been trying to get many of these things done for years and the list keeps growing the longer it takes to get the ball rolling.
2 – Information sharing contract updates
[16:56] A lot of information about cybersecurity findings and attack methods isn’t being shared so that everyone can benefit from the incident to improve their protections. According to a lot of folks, that has to do with contracts in place that set limits on information that can be shared.The directive is for all the lawyers and cyber folks to figure out how to make it possible for better information sharing while maintaining confidentiality of information. Surely they can work that out, but it’s not a problem we want to spend much time on.
However, check out the things they are supposed to make sure all the service providers, including cloud providers, contracts cover. It states that the “contract language and requirements shall be designed to ensure that:”
service providers share such data, information, and reporting, as they relate to cyber incidents or potential incidents relevant to any agency with which they have contracted, directly with such agency and any other agency that the Director of OMB, in consultation with the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, and the Director of National Intelligence, deems appropriate, consistent with applicable privacy laws, regulations, and policies;
service providers collaborate with Federal cybersecurity or investigative agencies in their investigations of and responses to incidents or potential incidents on Federal Information Systems, including by implementing technical capabilities, such as monitoring networks for threats in collaboration with agencies they support, as needed;
service providers share cyber threat and incident information with agencies, doing so, where possible, in industry-recognized formats for incident response and remediation.
Those are not little requirements there. There is also this little note down in all the other language about contract requirements:
We know there are cases where contracts are preventing things and there are also cases where people are hiding behind contracts. They want these updates to language and requirements to happen in short time frames like 90 days for some parts and 45 days for other parts of this review and update.
The important thing is they mention standardizing cybersecurity requirements across agencies to make it more efficient and effective for the Federal Government to enter into things and know across all the agencies what the language and requirements include. That has never been done because there has never been any national standards for these things.
Today, we are figuring out cybersecurity much like they had to figure out managing planes flying all over the world at the same time. The big problem is in the last year we threw a bunch of planes up without much worry for standards or safety.
3 – Zero Trust Adoption
[34:37] We probably have to do an entire episode on what Zero Trust is, but it has been discussed as the ultimate security solution for the last few years. Basically, it means that all network traffic and system activities should be assumed to be bad actors until proven otherwise. Exactly the opposite of the way it works today where it assumes you are good until it sees bad things happen.Every single new migration must include Zero Trust. All the folks that have been proponents of these implementations are excited, for sure!
You will not stop hearing about Zero Trust for the next decade, if not longer.
4 – Software Supply Chain Security
[39:09] No surprise here. We have been talking about this for years and SolarWinds just locked this requirement into the sights of all cybersecurity professionals.I love how the development of software has improved dramatically over the last decade or so with the concepts of agile development. However, one major thing that was skipped to attain better speed is security concerns. This getting features out as soon as possible and fixing the problems later approach has only exacerbated the problem by purposefully not taking the time to find all the potential vulnerabilities before release.
NIST has just released the Defending Against Software Supply Chain Attacks guide in April. That document opens by saying that we want you to use our other guides:
I have been sending out the SSDF guide to our clients and partners in the development business for months now. That came out in April of 2020 but no one had time to look at it back then. Slowly, it has gained attention. NIST won’t have time to start over on all these things, so I would expect these guidelines will be a part of it unless they were already working on a different approach.
Here are a few of the requirements included in that list:
providing a purchaser a Software Bill of Materials (SBOM) for each product directly or by publishing it on a public website;
participating in a vulnerability disclosure program that includes a reporting and disclosure process;
attesting to conformity with secure software development practices;
C-SCRM is designed to provide ways to complete the NIST CSF Supply Chain defined practices. We have one that is specifically designed for small and medium healthcare organizations. We haven’t had a chance to spend much time on it, but it will be a good option for any SMB to follow. And then there’s the Health Industry Cybersecurity Supply Chain Risk Management Guide (HIC-SCRiM). These guides are not going to make a lot of vendors happy. As much as they have hated ours so far, this one will be despised.
5 – Establishing a Cyber Safety Review Board
[47:28] Remember I said we were a lot like the FAA when they were trying to figure out managing all the planes? The NTSB investigates all the plane, train, etc big incidents to determine what happened and who or what caused the incident to occur.We’re gonna be getting a Cyber Safety Review Board! When these major events occur they will be called in to investigate major incidents. It will have cyber professionals from the public and private sector along with representatives from CISA, FBI, NSA, and you get it.
6 – Standardizing the Federal Government’s Playbook for Responding to Cybersecurity Vulnerabilities and Incidents.
[49:17] Again, an important part of managing this massive problem is by standardizing the processes being used. When we work with small clients we help them build playbooks for specific incidents. This directive says in 120 days they will come up with a standard response that covers all the NIST standards and appropriate guidelines.It also includes requirements for improving detection of vulnerabilities and incidents on federal systems, investigation and remediation capabilities and some other specifics that basically mean that nothing in here should mess up National Security while we are trying to do security.
So, yeah… this cyber executive order will make everybody do cybersecurity the same way. We are all going to be speaking the same language. And there will be a standard playbook that everyone will follow when it comes to ransomware.
There is definitely a lot to unpack in this Executive Order that we never even touched on. What will be interesting to see is where all of this ends up because there are a lot of things that must be done within 90-120 days. We should start seeing some things popping up for us to deal with by the end of the summer. Just what we needed, something else to fit into the 4th quarter todo list.
Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!
HIPAA is not about compliance,
it’s about patient care.TM
Special thanks to our sponsors Security First IT and Kardon.
