5 ms·

At a high level the executive order contains more-or-less what people had been expecting (there have been several reports about what it would probably contain a

At a high level the executive order contains more-or-less what people had been expecting (there have been several reports about what it would probably contain ahead-of-time). It includes a significant emphasis on information sharing, software bill of materials (SBOMs) for all software used by the US federal government, Zero Trust, multi-factor authentication, and encryption.

jandrewrogers 5y ago
These are all standard practice even for the unclassified parts of intelligence agencies, which is probably where they borrowed it from. Now applied to the Department of Agriculture.
toomuchtodo 5y ago
If these are unfunded mandates, traction is unlikely. For example, Login.gov support is essentially mandated by 6 USC 1523: Federal cybersecurity requirements (specifically, 6 U.S.C. 1523(b)(1)(D)) for public facing agency websites [1], but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled (the DHS Trusted Traveler program site is an exception). Congress will need to provide appropriations in order to meet the executive order’s requirements. Note that subsection C mandates encryption (at rest and in transit), and subsection E mandates multi factor authentication. This statute has been in effect since 2015. Show me the money. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1523&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...
- Frost1x 5y ago
  >...but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled... This is ultimately, IMO, why many 'cybersecurity' risks manifest. The work to secure things isn't valued and is always undervalued or even unfunded. It takes more time, effort and skill to make more secure software. In addition, adding security layers makes many processes less efficient and more time consuming. Working in secure environments means productivity has to take a hit. These costs can't continually be passed to software development without appropriate resource allocations. Software already runs 'lean' in most ecosystems. If you want to add more requirements, you need to pay for it because it costs more and tends to add ongoing costs to develop and use more secure software systems.
  - mason55 5y ago
    You really need the software version of a building or fire code so that no individual company can gain a competitive advantage by skipping out on security.
    - dcow 5y ago
      Exactly this. I know some people dread it but I cant wait for the software industry to mature to the point of having ethics boards, building codes, bodies that license professionals, multiple tiers of professionals (think of the nurse vs pa vs physician analog), etc. It’s expensive to build real good software and too often well meaning devs are left trying to cobble together a half finished product on unrealistic timelines overworking themselves to add all the building code in secret because their management didn't understand why it’s necessary. Not to mention the inconsistency in hiring and level of ability you have to wade through when everyone is an “engineer”.
      - R0b0t1 5y ago
        Complete and utter hell. What drives the explosive growth of the industry now is the lack of pointless restriction. Wages are high because more people are allowed to compete as opposed to just those who were lucky or privileged enough to be in the right life circumstance to get some credential. Tools and processes can be improved, but not by fiat. There is no board of microbial directors guiding cell planning. I feel I have no succinctly adequate description for you now, but take building codes and healthcare: many laws exist to "protect" people but often what benefits people most directly is more money. Forcing them to spend that money on supporting multiple levels of hierarchy takes their life from them in a very real way (c.f. housing shortage and healthcare shortage).
        dcow 5y ago
        What? The explosion is over. Software is ubiquitous. I’d like to treat software engineering like a real engineering profession. I didn't say prevent the volume of people from participating. Rather, incorporate a credentialing system so that maybe your fresh grad or boot-camper isn’t working 18hr days on standing up core infrastructure without the experience to push back against manipulative management or ridiculous client timelines. Prioritizing security will only happen if all engineers require it (otherwise you’d be undercut by someone who doesn't care). That’s why you need governance. We all have to be on the same page about security and reliability and it just happens that not everyone is equally qualified to do security or has the edge to build really reliable systems. And sometimes engineers just need to be protected from themselves even if they are experienced and qualified. It’s easy to say you’ll do that later when there aren’t immediate consequences for not. And we all know how often “later” becomes “never”. Nothing I’ve described prevents innovation. You can still build your sloppy app really fast and throw it at the wall because it’s probably not doing anything important. But if you’re getting hired commissioned whatever to build real software that keeps industrial systems running or puts things in space or handles personal information or blasts messages at millions of people all at once, etc., there should be a framework to help you communicate costs to people. Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. As much as I hate the fact that we depend so much on oil, the industry is fundamentally important and the software that operates it should be secure because people run the gas stations when it’s not. You cant really make the argument that the oil industry only happened because some disruptive college kids got together in their garage and had ambition in the face of an unregulated dreamscape. And it’s not like the oil industry cant afford to pay for security.
- jholdn 5y ago
  I don't think this is correct usage of the term "unfunded mandate". "Unfunded mandate" means when the federal government requires a separate entity (e.g. state, municipality, company) to perform a function without reimbursement or appropriation of funds. Executive orders (that don't rely on special powers granted to the executive by legislation like emergency powers) only apply to the federal agencies. "Unfunded mandate" cannot describe mandates the federal government places on itself. edit: You're right, what's required is a funded mandate. Gas is too foundational to the function of the country to leave to a private enterprise that isn't (and shouldn't be) responsible for a guarantee to provide their service. There should be federal intervention by buying a stake in the industry (though maybe in the case of the petroleum industry the federal government already pays enough but I say that from meme knowledge not actual knowledge).
  - toomuchtodo 5y ago
    I am open to more appropriate terminology to indicate an executive order is set forth with no funding provided alongside. For these orders, the President’s Budget should include requests for Congress to provide appropriations for the work that will need to be performed (the delta between current state and expected state).
    - dwheeler 5y ago
      Within various parts of the US executive branch, presidential executive orders that say "do X" without funding to match are also called "unfunded mandates" - at least sometimes. I certainly heard the phrase used that way. I don't know if that's an abuse of the term or not. It is true that it's different when it's applied within the executive branch. The US executive branch has to obey the laws, but it does have some discretion on how it prioritizes the work. So, for example, it could prioritize some of these activities by de-prioritizing (and thus reducing the funds) of other activities. That's hard, because it's often harder to stop something you're already doing (there are often existing groups in place who will be unhappy if you stop it). But it's officially possible, and if it's important enough, then it can be done. The US government's executive branch bureaucracy cares very much about what the president orders, though when there's limited funding the work must be prioritized. Some of these steps, such as creating new FAR clauses & adding them to contracts, don't require new money (though their results may impose new costs later). But it's fair to say that others will cause costs, and they'll need to go to Congress to try to get that funding. But that's not insane. The attacks on SolarWinds and friends have been estimated to cost $100 billion in damage to the USG (that's probably too high, but it shows real harm). The latest Colonial Pipeline ransomware, which threatens the US east coast, is making the news. Congress lives on the US east coast. I can easily see that money flowing from Congress.
- dillondoyle 5y ago
  Part of why this seems to have teeth though is procurement policy. I was actually kind of excited reading this, seems to do more with more power than I would have guessed. Though I guess companies probably will jack up their bids to cover any extra costs, even if they should have been doing basic security from the get, so that might be an 'unfunded mandate' in a sense
- JasonFruit 5y ago
  Any executive order is necessarily an unfunded mandate, because it's issued by the executive without involvement of Congress, which alone can pass actual laws that fund things: > No Money shall be drawn from the Treasury, but in Consequence of Appropriations made by Law… — U.S. Constitution, Article I, section 9, clause 7
  - spiralx 5y ago
    There is a discretionary budget allocated to the executive that can be used for funding EOs, although it's not huge when looked at relative to the budget - $800m a year is what's in my head but I could be wrong.
    - JasonFruit 5y ago
      Yes, I suppose, but given the scope of executive orders of late, that funding is not that significant. (Imagine saying that about almost a billion dollars!)

jandrewrogers 5y ago

These are all standard practice even for the unclassified parts of intelligence agencies, which is probably where they borrowed it from. Now applied to the Department of Agriculture.

toomuchtodo 5y ago

If these are unfunded mandates, traction is unlikely. For example, Login.gov support is essentially mandated by 6 USC 1523: Federal cybersecurity requirements (specifically, 6 U.S.C. 1523(b)(1)(D)) for public facing agency websites [1], but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled (the DHS Trusted Traveler program site is an exception). Congress will need to provide appropriations in order to meet the executive order’s requirements. Note that subsection C mandates encryption (at rest and in transit), and subsection E mandates multi factor authentication. This statute has been in effect since 2015. Show me the money. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1523&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...

Frost1x 5y ago
>...but agencies aren’t provided with the necessary appropriations to have the work performed, hence the mandate is left unfulfilled... This is ultimately, IMO, why many 'cybersecurity' risks manifest. The work to secure things isn't valued and is always undervalued or even unfunded. It takes more time, effort and skill to make more secure software. In addition, adding security layers makes many processes less efficient and more time consuming. Working in secure environments means productivity has to take a hit. These costs can't continually be passed to software development without appropriate resource allocations. Software already runs 'lean' in most ecosystems. If you want to add more requirements, you need to pay for it because it costs more and tends to add ongoing costs to develop and use more secure software systems.
- mason55 5y ago
  You really need the software version of a building or fire code so that no individual company can gain a competitive advantage by skipping out on security.
  - dcow 5y ago
    Exactly this. I know some people dread it but I cant wait for the software industry to mature to the point of having ethics boards, building codes, bodies that license professionals, multiple tiers of professionals (think of the nurse vs pa vs physician analog), etc. It’s expensive to build real good software and too often well meaning devs are left trying to cobble together a half finished product on unrealistic timelines overworking themselves to add all the building code in secret because their management didn't understand why it’s necessary. Not to mention the inconsistency in hiring and level of ability you have to wade through when everyone is an “engineer”.
    - R0b0t1 5y ago
      Complete and utter hell. What drives the explosive growth of the industry now is the lack of pointless restriction. Wages are high because more people are allowed to compete as opposed to just those who were lucky or privileged enough to be in the right life circumstance to get some credential. Tools and processes can be improved, but not by fiat. There is no board of microbial directors guiding cell planning. I feel I have no succinctly adequate description for you now, but take building codes and healthcare: many laws exist to "protect" people but often what benefits people most directly is more money. Forcing them to spend that money on supporting multiple levels of hierarchy takes their life from them in a very real way (c.f. housing shortage and healthcare shortage).
      - dcow 5y ago
        What? The explosion is over. Software is ubiquitous. I’d like to treat software engineering like a real engineering profession. I didn't say prevent the volume of people from participating. Rather, incorporate a credentialing system so that maybe your fresh grad or boot-camper isn’t working 18hr days on standing up core infrastructure without the experience to push back against manipulative management or ridiculous client timelines. Prioritizing security will only happen if all engineers require it (otherwise you’d be undercut by someone who doesn't care). That’s why you need governance. We all have to be on the same page about security and reliability and it just happens that not everyone is equally qualified to do security or has the edge to build really reliable systems. And sometimes engineers just need to be protected from themselves even if they are experienced and qualified. It’s easy to say you’ll do that later when there aren’t immediate consequences for not. And we all know how often “later” becomes “never”. Nothing I’ve described prevents innovation. You can still build your sloppy app really fast and throw it at the wall because it’s probably not doing anything important. But if you’re getting hired commissioned whatever to build real software that keeps industrial systems running or puts things in space or handles personal information or blasts messages at millions of people all at once, etc., there should be a framework to help you communicate costs to people. Building code exists to prevent houses from falling over. Healthcare credentials exist to prevent damage to human life. As much as I hate the fact that we depend so much on oil, the industry is fundamentally important and the software that operates it should be secure because people run the gas stations when it’s not. You cant really make the argument that the oil industry only happened because some disruptive college kids got together in their garage and had ambition in the face of an unregulated dreamscape. And it’s not like the oil industry cant afford to pay for security.
jholdn 5y ago
I don't think this is correct usage of the term "unfunded mandate". "Unfunded mandate" means when the federal government requires a separate entity (e.g. state, municipality, company) to perform a function without reimbursement or appropriation of funds. Executive orders (that don't rely on special powers granted to the executive by legislation like emergency powers) only apply to the federal agencies. "Unfunded mandate" cannot describe mandates the federal government places on itself. edit: You're right, what's required is a funded mandate. Gas is too foundational to the function of the country to leave to a private enterprise that isn't (and shouldn't be) responsible for a guarantee to provide their service. There should be federal intervention by buying a stake in the industry (though maybe in the case of the petroleum industry the federal government already pays enough but I say that from meme knowledge not actual knowledge).
- toomuchtodo 5y ago
  I am open to more appropriate terminology to indicate an executive order is set forth with no funding provided alongside. For these orders, the President’s Budget should include requests for Congress to provide appropriations for the work that will need to be performed (the delta between current state and expected state).
  - dwheeler 5y ago
    Within various parts of the US executive branch, presidential executive orders that say "do X" without funding to match are also called "unfunded mandates" - at least sometimes. I certainly heard the phrase used that way. I don't know if that's an abuse of the term or not. It is true that it's different when it's applied within the executive branch. The US executive branch has to obey the laws, but it does have some discretion on how it prioritizes the work. So, for example, it could prioritize some of these activities by de-prioritizing (and thus reducing the funds) of other activities. That's hard, because it's often harder to stop something you're already doing (there are often existing groups in place who will be unhappy if you stop it). But it's officially possible, and if it's important enough, then it can be done. The US government's executive branch bureaucracy cares very much about what the president orders, though when there's limited funding the work must be prioritized. Some of these steps, such as creating new FAR clauses & adding them to contracts, don't require new money (though their results may impose new costs later). But it's fair to say that others will cause costs, and they'll need to go to Congress to try to get that funding. But that's not insane. The attacks on SolarWinds and friends have been estimated to cost $100 billion in damage to the USG (that's probably too high, but it shows real harm). The latest Colonial Pipeline ransomware, which threatens the US east coast, is making the news. Congress lives on the US east coast. I can easily see that money flowing from Congress.
dillondoyle 5y ago
Part of why this seems to have teeth though is procurement policy. I was actually kind of excited reading this, seems to do more with more power than I would have guessed. Though I guess companies probably will jack up their bids to cover any extra costs, even if they should have been doing basic security from the get, so that might be an 'unfunded mandate' in a sense
JasonFruit 5y ago
Any executive order is necessarily an unfunded mandate, because it's issued by the executive without involvement of Congress, which alone can pass actual laws that fund things: > No Money shall be drawn from the Treasury, but in Consequence of Appropriations made by Law… — U.S. Constitution, Article I, section 9, clause 7
- spiralx 5y ago
  There is a discretionary budget allocated to the executive that can be used for funding EOs, although it's not huge when looked at relative to the budget - $800m a year is what's in my head but I could be wrong.
  - JasonFruit 5y ago
    Yes, I suppose, but given the scope of executive orders of late, that funding is not that significant. (Imagine saying that about almost a billion dollars!)