Biden on cyber security after 100 days: A good start, but now comes the hard part

President Joe Biden declared in mid-December, more than a month before he took office, that cyber security would be a “top priority” of his administration.

It should be. The digital world, as we are all now reminded daily, has a direct impact on the real world, for better and worse. It provides conveniences and powers that were the stuff of sci-fi dreams only a generation ago, but it also generates threats to privacy, physical safety, and personal, corporate, and national security.

And 100 days into his first term, which marks the end of the so-called honeymoon period for a new president, Biden has made a start on assembling a team, responding to at least some foreign attacks, and building a strategy.

But as any elected official knows, making promises is the easy part. Delivering on them can get difficult and complicated. That is especially true when it comes to this issue. If the president succeeds in moving the cyber security needle in a substantive way, he’ll be the first.

Not that his predecessors didn’t try. Biden inherits a pile of executive orders and initiatives from every U.S. president since Bill Clinton, starting with Clinton’s National Plan for Information Systems Protection in 2000, labeled “the first-ever national strategy for protecting the nation’s computer networks from deliberate attacks.”

The most recent, under the Trump administration, were December 2018’s proposed “Cybersecurity Moonshot” and then March 2020’s 182-page report from the U.S. Cyberspace Solarium Commission proposing more than 80 recommendations to implement a strategy of “layered cyber deterrence.”

“What we’re trying to do here is a 9/11 Commission report without 9/11,” Senator Angus King, I-Maine, one of the commission’s two cochairs, told Wired magazine at the time. “We’re trying to solve a problem before it turns into a catastrophe.”

Still, after two decades during which the internet has become as embedded in modern life as the automobile and television, no cyber security expert would describe it as safe and secure, multiple well-intentioned policy initiatives notwithstanding.

Indeed, the challenge for Biden is evident in the cyber security failures at the federal level:

• The Office of Personnel Management (OPM) couldn’t protect the personally identifiable information (PII) of more than 22 million current and former federal employees.
• The National Security Agency (NSA) couldn’t protect its own stash of so-called zero-day (not yet publicly known) vulnerabilities that it hoped to use to spy on, or attack, hostile nation states or terrorist groups. Instead, the stash ended up in the hands of Wikileaks.
• Much more recently, government couldn’t prevent, or even detect, the cyber attack on IT vendor SolarWinds, attributed to Russia, that compromised 9 federal agencies and (so far) about 100 private sector companies.
• Another attack, this one attributed to China, took advantage of zero-day vulnerabilities in Microsoft’s Exchange Server, an enterprise email product. It has reportedly affected at least 30,000 organizations in the U.S. including law firms, defense contractors, and local governments.
• And just a couple of weeks ago, a joint advisory from the NSA, the Cyber & Infrastructure Security Agency (CISA), and the FBI warned that SVR, the Russian Foreign Intelligence Service, was actively exploiting five major software vulnerabilities against American and allied targets.

All of which left the president with multiple fires to put out, or at least confront, in the early days of his administration. A couple of weeks ago he issued an executive order announcing sanctions against Russia for the SolarWinds attack and for allegedly seeking to interfere in the 2020 election. They included the expulsion of 10 Russian diplomats.

Russia promptly announced the expulsion of 10 U.S. diplomats, added 8 U.S. officials to its sanctions list and said it will restrict the activities of U.S. nongovernmental organizations operating in Russia. So far, there have been no announcements of sanctions against China.

In addition:

• The president announced major cyber security appointments, putting several NSA alumni in charge of the nation’s cyber security. They include Anne Neuberger (former various senior roles at the NSA) in the newly created role of deputy national security adviser for cyber security on the National Security Council; Jen Easterly (former deputy director of the NSA’s counterterrorism center) as head of CISA; and John “Chris” Inglis (former NSA deputy director) as national cyber director. Rob Silvers, appointed undersecretary of the Department of Homeland Security for policy, is the only one without an NSA background.
• The president proposed, and Congress recently passed, a $1.9 trillion coronavirus relief package with $650 million of that dedicated to CISA.
  On April 20, the administration announced a “100-day plan aimed at protecting the electric grid against cyber attacks. National Security Council spokesperson Emily Horne called it “a pilot of the administration’s broader cyber security initiative planned for multiple critical infrastructure sectors.” It also would require government contractors to report attacks on their networks and software to federal government customers within several days of discovery. That comes shortly after the North American Electric Reliability Corp. (NERC) reported that about a quarter of roughly 1,500 electric utilities that share data with NERC said they had installed the malicious SolarWinds software update called Orion, although most said they had not detected any evidence of compromise.
• The infrastructure plan also includes $100 billion for improving the power grid, some of which is expected to be used to improve cyber security.

Cyber security funding is not enough

And the response to all this from the cyber security community? So far, it’s mixed. Dmitri Alperovitch, cofounder and former CTO of CrowdStrike and now chair of Silverado Policy Accelerator, called Biden’s appointments the “cyber equivalent of the dream team.”

But regarding funding for cyber security, critics say it is not nearly enough.

While the $650 million earmarked for CISA in the infrastructure bill is more than welcome, Andy Keiser, a former House Intelligence Committee staffer with close ties to CISA, told Politico that the agency is “overworked, understaffed, and in one sense fighting half-blindfolded.”

Regarding the sanctions on Russia, which immediately responded in kind, it looked more like symbolism on both sides than real punishment for penetrating the U.S. government and stealing an unknown amount of data.

As has been said for years, it’s likely that the U.S. is using cyber attacks to spy on its enemies just as aggressively.

And when it comes to cyber strategy, experts say Biden doesn’t need to start from scratch, given that he is awash in templates from previous administrations.