6 ms·

Executive Order on Improving the Nation’s Cybersecurity

85 points by encryptluks2 6y ago

encryptluks2 6y ago
The verbiage of this order will essentially require that any company doing business with the government to share your data with them.
- deleted 6y ago
  [deleted]
- 1cvmask 6y ago
  The dragnet expands. Information sharing already exists.
dwheeler 6y ago
At a high level the executive order contains more-or-less what people had been expecting (there have been several reports about what it would probably contain ahead-of-time). It includes a significant emphasis on information sharing, software bill of materials (SBOMs) for all software used by the US federal government, Zero Trust, multi-factor authentication, and encryption.
- jandrewrogers 6y ago
  These are all standard practice even for the unclassified parts of intelligence agencies, which is probably where they borrowed it from. Now applied to the Department of Agriculture.
- toomuchtodo 6y ago
  If these are unfunded mandates, traction is unlikely. For example, Login.gov support is essentially mandated by 6 USC 1523: Federal cybersecurity requirements (specifically, 6 U.S.C. 1523(b)(1)(D)) for public facing agency websites [1], but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled (the DHS Trusted Traveler program site is an exception). Congress will need to provide appropriations in order to meet the executive order’s requirements. Note that subsection C mandates encryption (at rest and in transit), and subsection E mandates multi factor authentication. This statute has been in effect since 2015. Show me the money. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1523&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...
  - Frost1x 6y ago
    >...but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled... This is ultimately, IMO, why many 'cybersecurity' risks manifest. The work to secure things isn't valued and is always undervalued or even unfunded. It takes more time, effort and skill to make more secure software. In addition, adding security layers makes many processes less efficient and more time consuming. Working in secure environments means productivity has to take a hit. These costs can't continually be passed to software development without appropriate resource allocations. Software already runs 'lean' in most ecosystems. If you want to add more requirements, you need to pay for it because it costs more and tends to add ongoing costs to develop and use more secure software systems.
    - mason55 6y ago
      You really need the software version of a building or fire code so that no individual company can gain a competitive advantage by skipping out on security.
      - dcow 6y ago
        Exactly this. I know some people dread it but I cant wait for the software industry to mature to the point of having ethics boards, building codes, bodies that license professionals, multiple tiers of professionals (think of the nurse vs pa vs physician analog), etc. It’s expensive to build real good software and too often well meaning devs are left trying to cobble together a half finished product on unrealistic timelines overworking themselves to add all the building code in secret because their management didn't understand why it’s necessary. Not to mention the inconsistency in hiring and level of ability you have to wade through when everyone is an “engineer”.
        R0b0t1 6y ago
        Complete and utter hell. What drives the explosive growth of the industry now is the lack of pointless restriction. Wages are high because more people are allowed to compete as opposed to just those who were lucky or privileged enough to be in the right life circumstance to get some credential. Tools and processes can be improved, but not by fiat. There is no board of microbial directors guiding cell planning. I feel I have no succinctly adequate description for you now, but take building codes and healthcare: many laws exist to "protect" people but often what benefits people most directly is more money. Forcing them to spend that money on supporting multiple levels of hierarchy takes their life from them in a very real way (c.f. housing shortage and healthcare shortage).
swframe2 6y ago
Could someone comment on how effective using a yubikey is at protecting companies? If they are good, I'm not sure why they aren't used more. I spoke to a gov computer friend and he said they would never use a yubikey.
- an_opabinia 6y ago
  Is it a significant improvement over a cellphone app like Authy? Not really. Then, sophisticated people need secure enclaves for signing, which are also ubiquitous via iPhones and not in Yubikey.
- senectus1 6y ago
  I'm in the mining space, one thing that I can tell you is that software in the mining and oil/gas space can be horribly archaic, poorly architecture and very poorly supported. I'm lucky for the most part in that my company is very cutting edge and running latest windows and pushing software devs/vendors to stay as up to date as us. But support for "new" tech like Yubikey authentication is very slow to encroach in these industries. Yeah I know Yubikey isn't new in the holistic sense. but its a lot "newer" than a lot of the tech in these industries.
- dyu 6y ago
  US federal gov has their own PIV/CAC
- alert0 6y ago
  They help against phishing and password theft, as it requires a physical item in addition to the password. Doesn't matter much if someone downloads a Word doc with macros and runs it.
- EricE 6y ago
  two factor authentication can be enabled multiple ways - through dedicated hardware like Yubikey or via software via things like Google Authenticator or proprietary solutions like SecureAuth (around WAY before Google Auth). What 2 factor is used isn't important - what's important that you use some sort of 2nd factor (your password - something you know as being the first factor) that's limited to one physical device (something you have) that is not easily moveable. And NO, SMS is NOT 2 factor since you can bump a cell phone number from one phone to another pretty trivially with most cell phone companies (unfortunately). SMS is about on par with emailing you a code for secondary authentication. A barrier for a remote hacker who doesn't have physical access to you or your stuff, but not that high of a barrier.
lolinder 6y ago
The White House also released a fact sheet which summarizes the order. It makes for a shorter read if you just want a summary. https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/ https://www.whitehouse.gov/briefing-room/statements-releases...
jfgiogktkt 6y ago
Interesting that there is no deterrent aspect - going after the baddies or pressuring their protectors or facilitators.
- EricE 6y ago
  I dunno - seems far more reasonable to reduce the amount of targets for baddies, especially since our current infrastructure is a much larger target rich environment than it should be!
canada_dry 6y ago
The rates of IT Security consultants with Fed Gov't experience just increased by 100% overnight - for at least the next 60 days of the date of this order.
- bladegash 6y ago
  Those rates are already severely pumped due to other compliance/regulatory initiatives (e.g., NIST 800-171 and CMMC).
  - EricE 6y ago
    Eh - NIST 800-171 is gaining traction in industry. Some even actively campaign for it's more broad adoption: https://blog.rsisecurity.com/why-you-should-adopt-the-cybersecurity-nist-framework/ https://blog.rsisecurity.com/why-you-should-adopt-the-cybers... There's lots of common sense foundational stuff in there that if more companies did I would be less likely watching people get in fistfights at a nearby gas station :p I can't find a link to it but Microsoft also announced they are making all of their cloud offerings FedRAMP Moderate compliant - basically adopting all the moderate 800-171 controls for the parts of 800-171 that apply to their cloud offerings. It wouldn't hurt people to read through and think about the different parts of 800-171 and what they could easily adopt into the workflows they are involved in.
    - bladegash 6y ago
      That is my point - the rates for those consultants are already through the roof. This is just going to take them that much higher! FYI - Azure commercial is FedRAMP high and I believe O365 Commercial is FedRAMP moderate now. Everything else is equivalent or over and above that.
deleted 6y ago
[deleted]
dwheeler 6y ago
I just posted how the Linux Foundation’s communities have already built supports for parts of this EO: https://www.linuxfoundation.org/en/blog/how-lf-communities-enable-security-measures-required-by-the-us-executive-order-on-cybersecurity/ https://www.linuxfoundation.org/en/blog/how-lf-communities-e...

85 points by encryptluks2 6y ago

The verbiage of this order will essentially require that any company doing business with the government to share your data with them.

deleted 6y ago
[deleted]
1cvmask 6y ago
The dragnet expands. Information sharing already exists.

dwheeler 6y ago

At a high level the executive order contains more-or-less what people had been expecting (there have been several reports about what it would probably contain ahead-of-time). It includes a significant emphasis on information sharing, software bill of materials (SBOMs) for all software used by the US federal government, Zero Trust, multi-factor authentication, and encryption.

jandrewrogers 6y ago
These are all standard practice even for the unclassified parts of intelligence agencies, which is probably where they borrowed it from. Now applied to the Department of Agriculture.
toomuchtodo 6y ago
If these are unfunded mandates, traction is unlikely. For example, Login.gov support is essentially mandated by 6 USC 1523: Federal cybersecurity requirements (specifically, 6 U.S.C. 1523(b)(1)(D)) for public facing agency websites [1], but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled (the DHS Trusted Traveler program site is an exception). Congress will need to provide appropriations in order to meet the executive order’s requirements. Note that subsection C mandates encryption (at rest and in transit), and subsection E mandates multi factor authentication. This statute has been in effect since 2015. Show me the money. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1523&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...
- Frost1x 6y ago
  >...but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled... This is ultimately, IMO, why many 'cybersecurity' risks manifest. The work to secure things isn't valued and is always undervalued or even unfunded. It takes more time, effort and skill to make more secure software. In addition, adding security layers makes many processes less efficient and more time consuming. Working in secure environments means productivity has to take a hit. These costs can't continually be passed to software development without appropriate resource allocations. Software already runs 'lean' in most ecosystems. If you want to add more requirements, you need to pay for it because it costs more and tends to add ongoing costs to develop and use more secure software systems.
  - mason55 6y ago
    You really need the software version of a building or fire code so that no individual company can gain a competitive advantage by skipping out on security.
    - dcow 6y ago
      Exactly this. I know some people dread it but I cant wait for the software industry to mature to the point of having ethics boards, building codes, bodies that license professionals, multiple tiers of professionals (think of the nurse vs pa vs physician analog), etc. It’s expensive to build real good software and too often well meaning devs are left trying to cobble together a half finished product on unrealistic timelines overworking themselves to add all the building code in secret because their management didn't understand why it’s necessary. Not to mention the inconsistency in hiring and level of ability you have to wade through when everyone is an “engineer”.
      - R0b0t1 6y ago
        Complete and utter hell. What drives the explosive growth of the industry now is the lack of pointless restriction. Wages are high because more people are allowed to compete as opposed to just those who were lucky or privileged enough to be in the right life circumstance to get some credential. Tools and processes can be improved, but not by fiat. There is no board of microbial directors guiding cell planning. I feel I have no succinctly adequate description for you now, but take building codes and healthcare: many laws exist to "protect" people but often what benefits people most directly is more money. Forcing them to spend that money on supporting multiple levels of hierarchy takes their life from them in a very real way (c.f. housing shortage and healthcare shortage).

swframe2 6y ago

Could someone comment on how effective using a yubikey is at protecting companies? If they are good, I'm not sure why they aren't used more. I spoke to a gov computer friend and he said they would never use a yubikey.

an_opabinia 6y ago
Is it a significant improvement over a cellphone app like Authy? Not really. Then, sophisticated people need secure enclaves for signing, which are also ubiquitous via iPhones and not in Yubikey.
senectus1 6y ago
I'm in the mining space, one thing that I can tell you is that software in the mining and oil/gas space can be horribly archaic, poorly architecture and very poorly supported. I'm lucky for the most part in that my company is very cutting edge and running latest windows and pushing software devs/vendors to stay as up to date as us. But support for "new" tech like Yubikey authentication is very slow to encroach in these industries. Yeah I know Yubikey isn't new in the holistic sense. but its a lot "newer" than a lot of the tech in these industries.
dyu 6y ago
US federal gov has their own PIV/CAC
alert0 6y ago
They help against phishing and password theft, as it requires a physical item in addition to the password. Doesn't matter much if someone downloads a Word doc with macros and runs it.
EricE 6y ago
two factor authentication can be enabled multiple ways - through dedicated hardware like Yubikey or via software via things like Google Authenticator or proprietary solutions like SecureAuth (around WAY before Google Auth). What 2 factor is used isn't important - what's important that you use some sort of 2nd factor (your password - something you know as being the first factor) that's limited to one physical device (something you have) that is not easily moveable. And NO, SMS is NOT 2 factor since you can bump a cell phone number from one phone to another pretty trivially with most cell phone companies (unfortunately). SMS is about on par with emailing you a code for secondary authentication. A barrier for a remote hacker who doesn't have physical access to you or your stuff, but not that high of a barrier.

lolinder 6y ago

The White House also released a fact sheet which summarizes the order. It makes for a shorter read if you just want a summary. https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/ https://www.whitehouse.gov/briefing-room/statements-releases...

jfgiogktkt 6y ago

Interesting that there is no deterrent aspect - going after the baddies or pressuring their protectors or facilitators.

EricE 6y ago
I dunno - seems far more reasonable to reduce the amount of targets for baddies, especially since our current infrastructure is a much larger target rich environment than it should be!

canada_dry 6y ago

The rates of IT Security consultants with Fed Gov't experience just increased by 100% overnight - for at least the next 60 days of the date of this order.

bladegash 6y ago
Those rates are already severely pumped due to other compliance/regulatory initiatives (e.g., NIST 800-171 and CMMC).
- EricE 6y ago
  Eh - NIST 800-171 is gaining traction in industry. Some even actively campaign for it's more broad adoption: https://blog.rsisecurity.com/why-you-should-adopt-the-cybersecurity-nist-framework/ https://blog.rsisecurity.com/why-you-should-adopt-the-cybers... There's lots of common sense foundational stuff in there that if more companies did I would be less likely watching people get in fistfights at a nearby gas station :p I can't find a link to it but Microsoft also announced they are making all of their cloud offerings FedRAMP Moderate compliant - basically adopting all the moderate 800-171 controls for the parts of 800-171 that apply to their cloud offerings. It wouldn't hurt people to read through and think about the different parts of 800-171 and what they could easily adopt into the workflows they are involved in.
  - bladegash 6y ago
    That is my point - the rates for those consultants are already through the roof. This is just going to take them that much higher! FYI - Azure commercial is FedRAMP high and I believe O365 Commercial is FedRAMP moderate now. Everything else is equivalent or over and above that.

deleted 6y ago

[deleted]

dwheeler 6y ago

I just posted how the Linux Foundation’s communities have already built supports for parts of this EO: https://www.linuxfoundation.org/en/blog/how-lf-communities-enable-security-measures-required-by-the-us-executive-order-on-cybersecurity/ https://www.linuxfoundation.org/en/blog/how-lf-communities-e...