The era of quiet responses to cyberattacks against U.S. networks is over.
The White House on Friday released its long-awaited National Cyber Strategy, laying out in plain terms the Trump administration's intention to “deploy the full suite of U.S. government defensive and offensive cyber operations” to erode adversary capabilities and “raise the costs for their aggression.”
An accompanying executive order describes how the U.S. plans to more aggressively target transnational cybercrime groups across the departments of State, Justice and Homeland Security.
But absent from the text of both documents are direct mentions of China and Russia — Washington’s main cyber foes.
The document marks a shift from past cyber strategies released under both the first Trump administration and the Biden administration, with an emphasis on prioritizing cyber offensive measures. By contrast, the Biden administration’s cyber strategy sought to use regulation to nudge companies to write more secure code and shift the burden of cyber defense from small companies to major tech providers.
The office of National Cyber Director Sean Cairncross published the six-page doctrine after months of teasing its contents and feedback meetings with industry representatives.
The six pillars are described only in broad strokes, none longer than two paragraphs.
The first is focused on shaping adversary behavior. In it, the White House pledges to “detect, confront, and defeat cyber adversaries before they breach our networks and systems,” and stresses the need to “create real risk for adversaries who seek to harm us, and impose consequences on those who do act against us.”
Other pillars of the strategy include promoting common-sense cyber regulation; modernizing outdated federal cyber networks; hardening America’s critical infrastructure; growing the cyber workforce; and securing emerging technologies, like cryptocurrencies and blockchain.
The Trump administration has recently grown louder in its discussion of U.S. cyber strength in military missions. President Donald Trump hinted at the use of cyber capabilities to turn off the lights in Caracas during the U.S. strike on Venezuela in January that led to the arrest of Venezuelan President Nicolás Maduro. And earlier this week, officials said that U.S. Cyber Command was one of the “first movers” in the ongoing war with Iran, jamming Tehran’s communication networks.
The strategy suggests that the Trump administration plans to respond to cyberattacks with greater force — aligning with sentiments shared by top U.S. allies to treat cyberattacks against critical infrastructure, such as hospitals and energy grids, as acts of war.
“We will act swiftly, deliberately, and proactively to disable cyber threats to America,” the strategy states. “We will not confine our responses to the ‘cyber’ realm."
One throughline of the strategy is artificial intelligence.
The modernization pillar directs federal agencies to adopt “AI-powered cybersecurity solutions” to better protect government networks. In the section on emerging technology, the White House calls on the government to support AI innovation internationally, rely on AI to scale the nation’s cyber defenses, and secure the “data, infrastructure and models that underpin U.S. leadership in AI.”
Cairncross said in November that cyber deterrence was a top-line matter for the Trump administration, adding that the U.S. historically has not done “a terrific job sending a signal to our adversaries that this behavior is not consequence-free.”
In the executive order, Trump directs the attorney general to prioritize prosecutions of cyber-enabled fraud and scam schemes and to develop recommendations for how to return funds seized by the government back to victims.
It tasks the secretary of Homeland Security to work with state and local partners to provide training to stop such scams, while the secretary of State is encouraged to confront foreign nations hosting transnational scam compounds and “impose consequences” on any that refuse to take enforcement action. The most prolific scam compounds are based in Southeast Asia, including in Laos, Cambodia and Myanmar.
The strategy comes amid rising concerns from security experts that the U.S. is falling behind Beijing and Moscow in cyberspace — especially as they are accelerating sophisticated cyberattacks against U.S. infrastructure.
Chinese government-linked hackers have dialed up their attacks against U.S. networks, hijacking AI tools to automate cyber espionage campaigns, deploying malware to infiltrate government and IT groups and targeting widely used Microsoft products to compromise multiple U.S. agencies. And Russian hackers have also targeted the U.S. federal court filing system and a U.S. engineering firm over work the company had done for Ukraine.
Under Trump, the federal government has hemorrhaged cyber talent. The NSA and U.S. Cyber Command have been without a permanent leader since Trump fired its dual-hatted head last April. The Cybersecurity and Infrastructure Security Agency has not had a Senate-confirmed leader since the start of Trump’s second term and has endured major leadership turmoil under recently ousted DHS Secretary Kristi Noem.
Not everyone is impressed by Trump’s brief, chest-thumping cyber strategy.
House Homeland Security Committee ranking member Bennie Thompson (D-Miss.) described the text as “barely three pages of substance” and “impressively underachieving.”
“Completely lacking is even the most basic blueprint for how the Administration will go about achieving any of its cybersecurity goals — an objective possibly hamstrung by the hemorrhage in cyber talent across all Federal agencies since Trump took office,” Thompson said, alluding to personnel cuts at agencies including CISA.
“Cybersecurity is a national security imperative, and we need better leadership than this,” he added.
via Politics, Policy, Political News Top Stories https://ift.tt/2rCnEaD
