Only the Interesting Bits of the US 2023 National Cybersecurity Strategy

In March, the United States released its 2023 National Cybersecurity Strategy, and although it is filled with predictable direction, it does have a couple of groundbreaking elements. Therefore, it deserves a quick breakdown to highlight the most relevant aspects. Although this document is a national strategy, it has global relevance, as where the US goes, others will follow. I'll do my best to skip over the mundane, call out what should already have been in progress, and identify those truly groundbreaking aspects. All the while, I'll give a bit of opinionated narrative on the importance and how this may all impact how we trust our growing digital world. Let's get started. So this 39-page document, uh, is available, was published by the White House, and opening talks a little bit about why we need to have it. It's signed by the U.S. President. The most important thing here is it breaks up this into 5 different pillars. The first one is to defend critical infrastructure. Arguably pretty important. The next one is to disrupt and dismantle threat actors. There's going to be an interesting little element here that we're going to talk about. The third pillar is to shape the market forces to drive security and resilience. That's a good thing, really allows our industry to be more sustainable over time. The fourth pillar is to invest in a resilient future. This is good because bad things do happen and we want to be able to come back quickly and minimize the overall impact when something bad couldn't be prevented. The last pillar is to forge international partnerships to pursue shared goals because we're not alone. Everybody's tied together in this world. We need to be working with our allies. So let's dive into it. The introduction, pretty straightforward, nothing too relevant there. It is talking about the emerging trends. Cybersecurity is constantly changing the environment, the technology, the battlefields, um, the players, what they can do, the types of attacks and impacts. So yes, this is important. One of the things they do call out here is really the OT world, the operational technology world. Think IoT and IIoT, industrial IoT devices. They're becoming more prominent and playing a bigger role, especially in critical infrastructure. The other thing it calls out are those malicious actors. Our entire industry is centered around bad people doing bad things, doing aggressive things. If people weren't aggressive or trying to attack, we really wouldn't need cybersecurity. So understanding the actors are important. And one of the things I love here is they actually call out the countries we're worried about: China, Russia, Iran, and North Korea. These are traditionally the most aggressive in the cyber domain. They harvest data. China's well known for harvesting all sorts of secret and private data, communications, intellectual property, and whatnot. They also do conduct some attacks. Russia is renowned for conducting very aggressive attacks, not only on the US but all over the world. Uh, we see it in Ukraine, uh, over the past year and even before that, very aggressive. Same thing with Iran and North Korea. They're looking either to do damage or they're looking to conduct things like ransomware to be able to gather money, right? Hard currency for their governments and to get around sanctions. So these are the big four that they called out, but again, this is going to change. The simple fact is cyber attacks are pretty cheap compared to having to build tanks and ships and planes. We're going to see a lot more countries going into this and investing in cyber offensive technologies to be able to impact and attack countries and adversaries all over the globe. They don't even have to share a border. So this list only grows from this point on. Okay, moving on to kind of the approach again, they break it up into 5 pillars. We talked about that as well, and they cover kind of 2 areas and say, um, they're shifting a little bit. Now this document is just the latest. There had been previous cybersecurity strategies that have been published by the US government. So this isn't work that's being started. This is work that's continuing. And they did wanna call out a couple of different areas. First off, they're looking to rebalance the responsibility. And we're gonna get into this a little bit more, um, of who really should be defending cyberspace. The long and short of it is we understand that critical infrastructure is important. Most of critical infrastructure is actually owned, operated, run, and protected by private companies. But the US government has a role and we all— US government also has to protect its own infrastructure and, you know, Department of Defense and all these other agencies. So at the end of the day, it's going to take a partnership. So, yes, that's common sense, but they need to call it out. They really, really need to. And they do. The other is to realign incentives. Our economy, our world investments, uh, innovation revolves around money. And so if we can shift where the financial incentives are, we can help spur innovation and adoption of that innovation and moving to better defensive and maybe even counter-offensive types of capabilities. So this is another area that they're looking into, and we're going to talk about a very interesting aspect of how this is going to work. Okay, building on existing policy. Again, this is not the first cybersecurity strategy. There are lots of different groups and agencies that work diligently to try and protect government assets, to try and protect critical infrastructure, to try and protect the private sector. So this is just the next kind of step up. On the shoulders of the previous strategy. There's, again, there are two fundamental changes which are really, really interesting. We'll get to those. But keep in mind, this is working on the backs of people that have been trying to make this happen and through no fault of their own, maybe have not succeeded at the pace we would all like or to the extent that we would all like. There is still a tremendous amount of vulnerable systems out there, um, critical aspects to our digital technology and services that could terribly impact every citizen in the United States, our allies, and people around the world. Okay, so let's talk about the different 5 pillars. Pillar 1, defending critical infrastructure. Seems kind of like common sense, right? Why aren't we doing this? Well, yes, critical infrastructure is hugely important. And when we talk about critical infrastructure sectors, it's things like power, water, um, food distribution, transportation, communications, healthcare, finances. These are the underpinnings of our modern society. If food doesn't show up on our shelves or, uh, fuel doesn't show up in the gas stations, if our telecommunications go down or we can't be serviced by our doctors or emergency healthcare. These are all big problems. If you can't get paid or get money out of the bank to go buy the things you need to buy, that starts to basically tear at the very fabric of our society and we wouldn't last very long. These are big targets for our adversaries. We name the adversaries. They know these are critical aspects, hence critical infrastructure. So why are they calling this out? It should be obvious. They should already be protecting it. You're right, they should. But part of it is they need to again call many things out that seem to be common sense. But if they don't call them out, the omission may make it appear like they're deprioritizing it. So they're not. So yes, a lot of this document is simply talking about what is currently being worked on or obviously should be worked on. This is one of those areas. And so yes, we need to build innovative capabilities and allow the owners— again, critical infrastructure is primarily owned by the private sector, right? Making sure that they can do what they need to do and the federal agencies help support that. Yes, makes common sense. Okay, so Section 1.1, establishing security requirements. Yes, we want to enable healthy competition without sacrificing cybersecurity. So again, we want our industries and our businesses to be able to compete, make money, do good things, grow, expand, create more jobs, pay better salaries and all that. But we also want to make sure that they're not sacrificing cybersecurity just to get products out to market. So they're laying some groundwork here because they want to make some shifts in regards to that balance and some of those decisions that are often made by private companies on whether to invest in security before they throw products out the door. Okay. Okay, critical infrastructure, yes. Regulations, they're looking to implement regulations and I hate regulations. Most people hate regulations and any regulations that are created are often a decade too late solving problems that existed a decade ago and maybe not the evolution of those problems in today, but they are needed to at least raise all boats because there are some organizations that either by choice or lack of budget or capability. They're just not even doing the basics. So expect that, yes, there will be regulations to try and drive some of those minimum security practices out there. It's needed because right now, again, there are organizations and even critical infrastructures that aren't meeting those consistently. So yes, expect regulations. Harmonization and streamlining. It's just another way of saying, hey, make it efficient. Okay, great. Yes, obvious. Enable regulated entities to afford security. Yeah, if you can't afford security, you're not going to be able to do it. So they're talking about looking at different ways to either subsidize or invest in things or co— lots of different ways. But they recognize the fact that security is not free and it's not cheap.. And many organizations, especially small and medium businesses out there, it's really tough to afford a comprehensive set of security capabilities. So it's great that they called it out. There isn't a whole lot of meat behind this other than simply saying, hey, this is a problem. We know it's an issue. We need to figure out something. It's not going to be solved anytime soon. Continuing within Pillar 1, Section 1.2, we need to scale Private-public collaboration. This is one of those, duh, of course. Yes, of course. So it talks about a whole bunch of organizations that are already in existence, the fact that they should be grown and more public and private organizations need to be contributing, getting or contributing to and getting something meaningful back from it. So yes, makes a lot of sense. We won't belabor it. The next subsection within this pillar, integrate federal cybersecurity centers. So they're talking about, you know, expanding these centers. And again, it helps the federal government understand and keep a pulse on what's going on, what new type of attacks and attackers and impacts and losses and so forth. But on the flip side, it can potentially provide resources, either faster or better resources, to those who are in need of it or those who are being victimized. Therefore, they really, really need it. The next one, 1.4, update federal incident response plans and processes. Of course, because bad things happen and you need to have a good incident response plan. You shouldn't be trying to figure out what your crisis plan is as you go. You should already know how to enact it and make it efficient and effective. In doing that, what it does is it minimizes the impact when something bad does happen. You shrink it down, and that's a good thing that reduces the overall impacts. Okay, 1.5, modernize federal defenses. Again, something obvious. Um, not all federal agencies or state agencies or local agencies are very well defended against cyber attacks, especially given the fact that at the federal level here, they're worried about other nation states attacking. Nation states that are willing to throw down billions and billions of dollars of investment to make the attack successful. So at that level, which is really the highest tier of threat agents we have to worry about, you have to have pretty good systems. Right now they don't. Yes, they need to get there. They need to improve. That's not to say that they're not doing anything because they are. There are hundreds or probably thousands of cybersecurity professionals in our federal government alone that are working every day to improve and just keep things up and running. You know, fending off as many attacks as possible and trying to quickly recover from ones that do occur. So there are a lot of very professional cybersecurity folks out there grinding away at it every single day. However, it has to get better. The very nature of cybersecurity is the attackers get better over time. They get more creative. They, as technology shifts and gets adopted, there are more windows of opportunity for them to attack and exploit vulnerabilities. So yes, have to modernize the federal defenses. We have to get them up to a point where they can keep pace with the attackers and maintain that over time. Uh, so yes, we talk about different agencies, federal systems. Again, it's all talking about the same thing. We have to modernize. Okay, so that's the end of Pillar 1. Pretty basic, nothing surprising there at all. Pillar 2, this is where it gets really fun. Pillar 2 is about disrupting and dismantling threat actors. So I want you to read this here because this is important. The highlighted text, the United States will use all instruments of national power to disrupt and dismantle threat actors who actions threaten our interests. That's new. Okay, now let's talk a little bit of what that really means. Read in the green text. Efforts may integrate diplomatic— well, that's very nice— information, military, both kinetic and cyber— that's a little less nice— financial intelligence and law enforcement capabilities. Basically, it's pulling out the stops. Now keep in mind that what it's talking about here, and it goes into more detail, is to proactively and reactively attack foreign entities that are looking to attack the United States or are attacking the United States or our interests. Now, the United States has done offensive actions in the past, um, but hasn't been open about it, kept it concealed, right? Didn't want to make the news. This is a fundamental shift in that policy. It's saying we are putting out to the world that we are going to go on the offensive. If there is a perceived or real threat, we're going to go attack it. That's a fundamental shift. So this kind of takes the gloves off for many of those agencies and departments who are currently working to undermine, um, aggressive, uh, organizations that are targeting US and US interests. To allow them to be a little bit more aggressive. Now, there's got to be a lot of procedures and policies behind all this. There has to be targeting and approvals and things of that sort. So there's bureaucratic things and controls and frameworks that need to be instituted. But we do this in the military all the time, right? You've got a kill chain to say, hey, somebody sees a target. How fast can you get approval to launch on it? How fast can you get assets in and move? This is very similar to that. And again, you don't necessarily have to be stealthy. The President of the United States, as part of the National Cybersecurity Strategy, has stated, "We will attack. We might." So that changes the game a little bit, right? Our adversaries in the past knew that the United States may retaliate, may do something, but knew that they were kind of hobbled, that they couldn't do something too overtly. They had to do it to where there was still plausible deniability. And that greatly limits what offensive actions you can take and how fast you can take them. With this in place, ooh, that's an entirely different message, right? The US isn't going to be held back by a lot of those restrictions. So the attackers really kind of need to beware at this point. So this is a fundamental change, an important fundamental change. And I expect other governments from around the world to probably follow suit on this, which again enables some of that collaboration we'll talk about a little bit later. So this is an important element. Talking about integrating disruption activities, again, defending forward. I love how politically correct that statement is. Basically what that means is to proactively attack. So if we see that somebody is building an infrastructure that would be used for a cyber attack or developing malware or something like that for cyber attack or starting to gather a large botnet that they may use even before they actually conduct the attack. Go out there, attack them, take out those resources, do harm, do damage, destroy their systems maybe, right? Corrupt their systems, destroy their capability, do whatever you need to do. And that would be considered defending forward before they've actually launched the attack against you. Okay. US Cyber Command, DOD components will integrate cyberspace operations into their efforts to defend against state and non-state actors capable of posing these threats. DOD, Department of Defense, US Cyber Command. They've got assets. They've got assets that have the capability to go out and give a digital punch, to take the fight to the enemy. And what they're saying here is, guess what? This is going to be part of the overall strategy. We're going to be using those resources just like they cited above, military resources, both cyber and even potentially kinetic. That means there may be scenarios where a Hellfire is being launched from a drone somewhere. Right, to take out a cyber threat. Again, there's a lot of politics around. It's not like we're going to start doing this to, to foreign countries tomorrow or anything like that. But this sets the groundwork. It sets the tone. Very relevant, probably the most relevant aspect in this entire document that is a game changer. All right. Enhanced public-private operational collaboration to disrupt adversaries. Makes sense, right? If you have now the ability to go out and, and attack the bad guys, you need to know what the bad guys are doing. If they're attacking, who are they? And that means we need to have public-private collaboration because a lot of times it is the public world that's being attacked, and that's valuable intelligence for those who will assess whether that they want to counter that. Increase the speed and scale of intelligence sharing. Again, it all goes around there. We need to know who's being attacked so we can figure out what we're going to do, how we can respond, how we can protect others. Speed is very, very important in the cyber world. So, you know, attack infrastructures can be set up very fairly quickly, launched, and then torn down. So it is important that we increase our ability to be very responsive in cases where attacks are ongoing. Prevent abuse of US-based infrastructure. Yeah, pretty basic. We need to defend our infrastructure, our own telecommunications, things of that sort. So as part of that, we want them to actually— right, the telcos and, and the other critical infrastructure owners— to make reasonable attempts to secure their own infrastructure.. And we're going to get into a little bit more. Regulations are going to be tied into this, things of that sort. All right, 2.5 here, counter cybercrime, defeat ransomware. They call out ransomware, and really what they're talking about is digital extortion. Ransomware is one of it, but, you know, they talk about ransomware, which is great because it is a growing scourge and we do need to get rid of it and we actually can get rid of it. But they talk about, you know, being able to provide safe havens, you know, or eliminate safe safe havens for criminals, be able to provide investigation services for crimes that are ongoing, target the actual criminals, increase the resistance of tools and protections, things of that sort. One of the things they do actually talk here is, you know, the, the abuse of virtual currency to launder ransomware payments. And it's more political statement than anything. Virtual currency isn't used predominantly by criminals. It's less— it's a fraction of a percentage, but it's something that could grow in the future. And it's something especially for the nation states that are looking to grab money and get around sanctions so that they can fund their government and their government's, you know, military activities and activities to to whether it be for nuclear programs or whatnot. So that is important. But again, I mean, really, if you wanted to, you would have to take out cash would be better than virtual currencies. Cash is used more for by criminals and nefarious reasons than any virtual currency percentage-wise as well as total amount. But it is interesting that they're looking at this from different aspects. So I do applaud them for doing that. One of the most important things I think in the discussion around ransomware is they did highlight, right, render ransomware no longer profitable. I've talked about how to do this in other, uh, other posts. Really, you make it to where they don't get paid, and if that's how you can do it, where it's illegal to pay them or to give them anything, then they don't do it anymore, right? They move on to something else. So I like that they've called that out. And we're seeing other countries look at options of doing exactly like, exactly that, outlawing the payment of digital extortions. I would expect actually Australia to probably pass something before anybody else. And again, reducing for profit. Anytime you're looking at attackers, you need to look at their motivation, right? What's driving them? What are their objectives?. And if you can undermine that, you're eliminating the attacks before they even happen. All right, let's go to pillar 3. Pillar 3 has got some interesting things here, and this is really around shaping those market forces. It talks about resilience, it talks about affordability and whatnot. And, you know, again, we want to create an environment where you can drive the broad adoption of really good cybersecurity practices. Which means you have to have the right tools and the processes and the communication, the training. You have to have it affordable. You have to make it to where there's not too much friction for the users of it. So it has to be usable. And again, they're recognizing that there are challenges here. There's no solution and there's no federal solution. They're simply saying they need to look for opportunities and work across that private and public partnership to figure out ways of reducing those impacts. And one of the things that they can do, they actually talk about this using federal purchase power. They did this, for example, with telecommunications equipment. They did this with zero trust, saying, okay, you know, we're only for government vendors, you have to have the following controls in place, or you can only be using certain types of equipment, or you have to adhere to some type of security infrastructure. And therefore, the money being spent on those companies, right, it is attracting others to develop and integrate and then offer that to everybody, and prices go down. One other thing they're talking about here is about insurance markets, right, specifically cybersecurity insurance, to be able to cover in the event of some catastrophe, right? Some regional or national or even global type of attack, uh, that doesn't necessarily, uh, that, that shouldn't crater the insurance companies, that the government may help. This again, it's, it's kind of a political decision. There's some pros and cons each way, but it looks like that they're willing to explore those options, kind of like what FDIC does for the banking industry, they may do something very similar for cyber insurance. Nothing guaranteed here, but it's more exploratory to say, hey, this is something that we could do to help make the economy and the natural system, which includes insurance, right, to be able to kind of fend for itself. And 3.1 here, hold the stewards of our data accountable. This gets into some pretty interesting areas, and this is laying some groundwork for the second major shift that they're going to be talking about here. The administration supports legislative efforts to impose robust, clear limits on the ability to collect, use, transfer, and maintain personal data. Again, we don't have a national privacy set of regulations. It's all done by states and they're all different. So yes, privacy and cybersecurity are tied together. So this is important, probably not going to be something that gets resolved in the next 5, maybe even decade, 10 years. But it's good that they're looking into it and they're calling it out that this does need to get worked. Drive the development of secure IoT devices. This is really in the manufacturing world, in the operations world, in the critical infrastructure of services and things of that sort. There are a lot of IoT devices that are in those environments and they're automating. If you could have a regular valve today that somebody has to turn in a factory, tomorrow if you replace it with an internet-connected one that has a motor and you can control it remotely, you reduce a lot of overhead, a lot of costs. You reduce the amount of time to respond to issues and reconfigure your whatever you're doing. So it is an efficiency cost savings kind of mechanism that many organizations are moving to. Great. The only problem is now you've put this on the internet or it's reachable via the internet. Some bad person may start opening valves or turning things on or off or things of that sort, reconfiguring things, poisoning water supplies, crashing cars, whatever it is, you gotta protect it. So this is important. They've only put one little section in here, but this is something the industry has been talking about for a long time. Omission of something like this would have been glaring. So they had to throw a couple of paragraphs in here to say, we recognize it. Okay, let's try and make it work as well. All right. 3.3. This is important as well. So this is the second area that fundamentally is changing from previous directions. This is talking about the liability of software, of hardware, of devices, of services that are all tied to the digital world. Today, when you buy a piece of software or sign up for a service, you have to sign off on an EULA, right? An end-user licensing agreement. Nobody reads them. Everybody knows nobody reads them. And for those who do try and read them, they're typically faced with a whole bunch of legalese that you can't interpret unless you're a 20-year lawyer in contracts. Okay, what those documents often say is that you cannot hold the supplier, the author, the company that's providing these services or software, you can't hold them liable for any defects, any vulnerabilities, any bad things that happen. It causes somebody to die. Oh well, not our problem, right? You sign the EULA and you are waiving all your rights to punitive damages and liability and everything else. Okay, this is a fundamental shift in saying the government wants to change that and put more accountability back on those manufacturers, back on those providers and suppliers. This is not something they want. That's why they've written in the EULA, hey, we can do whatever we want. We can put out faulty code, a faulty product, and yeah, you might be able to sue us for damages, but not punitive damages, not the big dollar amount. We're behind a shield here. You've signed off on it. To change that is gonna take a lot of work. To hold those companies accountable to some layer is gonna be tough. One of the first things that they wanna do is they want to put out a kind of common sense rule that says if you're writing software or creating a product, you can't release it until you close all the known vulnerabilities. But that doesn't happen today. Lots and lots of software, for example, are released with known vulnerabilities that could be exploited. And they just— the vendor wants to get it out to market as fast as possible. We'll patch that later. We'll take care of it some other time. We'll do an update. Sometimes they do, sometimes they don't. But either way, when you buy that product, it's already vulnerable and it could potentially cause harm to you. So again, one of the first things, okay, you can't release something unless you've closed the known vulnerabilities. Oh, and by the way, you also have to have a program to continuously update for new vulnerabilities. Abilities that are discovered. You'd think it's common sense, and it is, but it's not the current practice. And this has huge ramifications. Something that common sense and simple as it sounds is actually really impactful. It can be translated into dollars and cents and delays in releasing products and competitive, uh, uh, competition and market share and everything else. This is a sea change. So they've talked a little bit about the liability. They're talking about different frameworks. They're talking about the creating, creation of SBOMs or software bill of materials. So you know what's in it so you can figure out whether it's vulnerable or not and to list whether it is things of that sort. And again, these are common sense issues, but to actually implement this, would be huge. Right now, as it turns out, software companies, manufacturing for hardware and appliances, they're not making a big deal about this. They're simply saying, yeah, if it's reasonable. They also know that it's going to take one or two decades at least to get this type of legislation in, and they will have plenty of time. To lobby and fight it and show the pros and cons and try and change it. But there's no company out there if you read their EULAs, because they could do this right now, that want to take on that liability, that are stating positively that, you know, we won't release things with any type of known vulnerability. There are a few companies out there. Look for the ones with ethics statements, by the way, because that's where it's going to be. Sometimes in their security section, sometimes if they actually have an ethical statement like a privacy statement, right? But one that's dedicated to digital ethics. Again, really important. So this is the other major change coming out of this document. In 3.4, they're talking about, again, using federal grants to invest, to give incentives for better innovation. Yes, this is something they do now. DARPA is a great example of it, or In-Q-Tel on the intelligence side. So yes, they're just calling out the obvious here, using the federal procurement process. Again, they're doing that now, and this is something that they can do to influence and drive innovation into the markets. The most latest, or the latest thing that they're doing, is basically saying zero trust. The federal government's going to go to zero trust. Everything has to follow zero trust kind of architecture. You know, and that helps all the vendors that want to sell, you know, be able to invest in zero trust capabilities and then be able to sell it to the government. And that just goes downstream. It helps everyone. 3.6, explore a federal cyber insurance backstop. Talked a little bit about this, right? It's about a federal insurance response to catastrophic events. Yes, willing to explore that. This entire, you know, section, it's one paragraph. Again, it's something that they're exploring. They want to assess it. Don't know if it's feasible. Don't know if it brings in the right economic incentives. Uh, we don't want situations where, you know, uh, like you have banks that are too big to fail, things like that. You, you want to maneuver in such a way that you're making a healthy environment that's acting responsibly and not simply insuring with taxpayer dollars if a company goes rogue and decides to make bad decisions. Decisions. So they have to assess it. Okay, pillar number 4, we're almost done here. Invest in a resilient future. This is just common sense stuff, right? We want to make sure that the technology, the people, the cybersecurity staffing is in place, all that kind of stuff. This is talking about the foundations of the internet because the internet was never originally designed to be secure. There's lots of different vulnerabilities. They call out a few border gateway protocols, unencrypted DNS systems, things like that. They want to kind of try and clean stuff up, try and get people to move to more secure technologies, hopefully in a way that is not oppressive to, to how they run their business or operation. So these are all good things to have. Reinvigorate federal research and development. Yes, R&D is needed. R&D will always be needed. It's currently being done now. It needs to be done in the future. They have to put this in there. Prepare for post-quantum future. I won't get too much into the quantum discussion. I've got lots of videos and posts on that. But yes, at some point in the future, there is a cliff where quantum computers will evolve to such a level that they will be able to undermine most of the encryption that we currently use. Think of like your banking transactions. Right? You don't want bad guys being able to decrypt that or masquerade as you and start siphoning funds out of your account or doing bad things. So again, there's already a lot of work. NIST is leading this in coming up with new algorithms and they've already named several and then moving to those before we reach that cliff. So the computers aren't there yet, but we want to be able to transition away from vulnerable algorithms that are susceptible to quantum attacks to quantum-resistant algorithms that are not as susceptible to those attacks. But this is a constant evolution in encryption. This is actually nothing new or surprising. We've seen it coming. We know it, but it needs to be listed here. So it's a good thing it is. Secure our clean energy future. Okay. Yes. Clean energy is important. Um, Sounds more political there, but okay. Yes. Um, the support development of a digital identity ecosystem, yes and no. Um, digital identity is important, but it can also be misused. And this is a discussion that has been going on for a very, very, very long time. National ID cards, unique identifiers in computers, or, um, you know, clipper chips or whatever. This is not a new discussion, but I think the important aspect that they call out here is having good identity security and digital credentials can be beneficial to cybersecurity. In fact, it is beneficial to cybersecurity, but it also has to respect privacy and some other things out there, our rights, not only ours, but rights around the, around the globe as well. So there is still a lot of work and debate that needs to go on in this space. But they do call out that, yes, having digital identities and credentials does help a cybersecurity environment because you can start figuring out, is somebody trustworthy or are they not? So that is important. I'm glad that they mentioned it. But again, that's real, real sticky, right? You're talking about individual privacy, civil rights, civil liberties. There's all sorts of stuff Lion Minds here that can blow this up. And again, it's nothing new. This debate has been going on for the better part of 3 decades. I don't expect any traction or much traction in this moving forward other than, hey, have strong credentials, right? So people can't hack you, brute force, phish your credentials, things of that sort. That's probably what it'll be, what they're gonna come out with. 4.6, develop a national strategy to strengthen our cyber workforce. Yes, we've got what, over a million different cybersecurity-related or associated or partial roles out there, uh, just in the US, several million around the globe. We need to have a good feeder channel so us veterans here can actually retire at some point and we can hand it off to people. And this has to continue. We need new blood. We need We need diversity, we need inclusion, we need people that think in different ways because the attackers are thinking in different ways. The attackers are diverse. So we have to have that. And it's great that they call this out. This is a big problem. Uh, when you look at the, the NICE group, the National Initiative for Cybersecurity Education, they've been around for a while. They've done great things. They talk about some of these different areas, but we're far from where we need to be. So it's good to call this out. And I would love to see more focus, especially in grade school, high school, secondary schools, things of that sort to get more people into STEM and cybersecurity to help out. All right, pillar 5, this is the last one. Forge international partnerships to pursue shared goals. Yeah, of course. All right, we're not alone in the digital world. We've got allies, we've got partners. They need us, we need them.. So yes, build coalitions to counter the threats. Yes, share information, exchange cybersecurity, best practices, um, identify threats and share that, work collectively to go arrest the bad guys who are trying to hide out in your country. Yes, yes, yes. This— there's so many different groups working on this right now, but that's not to say they've, they've perfected it. They do need air cover from the president, from Congress, from their nation-state leaders from all over the globe to help fund and make the collaboration stronger. And that's really what this is talking about. It's not that there's no collaboration now, it's just that it has to get better, it has to get faster, it has to get more efficient, it has to be a driving force to be able to go after the bad guys. So yeah, strengthen international partner capability. We're going to help them, they're going to help us, we're all going to hold hands, it's going to be great. And again, I'm not belittling the efforts. There are tremendous professionals out there trying to get this done and are stymied by some of the things that are simply not in place that need to be. So we do need to work together. And yes, we're going to, of course, assist our allies and partners. Again, common sense stuff that they need to put in there. The omission of not putting it in there could raise a red flag and people go, oh, we're not going to do this anymore. So yes, this this is nothing new. I'm gonna keep going down. Secure communicate or communicate with each other. Yes, yes. The last section in the paper, and it's very short, is about implementation because everything in here so far is aspirational, right? We wanna go do this. There's some groups starting to, we need to continue to do this. There is a huge element, especially with the two areas we talked about, right? Offensive operations and shifting that liability back to the manufacturers, right? There is a lot of work that needs to be done there. So really what they're saying here is there's a lot of things they have to look into. They have to— there's a lot of things they have to assess and determine whether it's the right direction. If it is the right direction, who's going to own it? How does it get funded? Who's going to implement it? What are the timelines? And so there's lots of details that come them afterwards. So that's what this, you know, page is just simply talking about. And there you have it, right? 30-something pages, uh, of the US, uh, 2023 National Cybersecurity Strategy. Overall, I like it. I really do. Um, 80%, 85%, is things we're already doing, or we know we should be doing, or common sense. We're just kind of reiterating and building on what previous strategies have said we really should do. And yes, we really should do those. The other 15-20% is new. Now, the two big things: offensive operations out in the open, proactively even. That's a game changer. And that telegraphs to our enemies— and again, they called them out— Russia, China, North Korea, Afghanistan. It's letting them know, gloves are off. If you want to continue to attack us, we're going to attack back. And we're not going to be limited by, we want to keep it concealed, we want plausible deniability, we want to remain stealthy. You know, oops, your, your uranium refinement equipment somehow got a virus. Oh, don't know how that happened. No, this may be something that the president comes out and says, this is what we did yesterday. We did X, Y, and Z. And this is why that changes the equation. That changes the calculus for those who are looking to attack the United States and our allies. The second thing is more internal. It's about the software and device manufacturers. They've had the ability to basically put a legal contract out there and say, oh, I'm not going to be held accountable for this. Yeah, I might release it with flaws and bugs and, and might even be malware in there. Don't know. I'm going to get it out to market fast. I'm going to try and make a quick buck. I can't be held accountable. That fundamentally changes that and forces, or it will force It's not there yet, nowhere near there yet, but it will force more accountability, right, which means more investment up front to secure things ahead of time before they reach the market. That has been needed for a very, very long time, and that probably more than anything else will greatly improve our digital world, making it more secure, fundamentally, measurably more secure. So I like those two aspects. Now, someone asked me the other day, um, are these all the aspects? How is it if you had to rate this from, you know, 1 to 5, 1 to 10, whatever? Well, I had written something up for— actually, it was for Australia. That talked about strategic principles and what you really need at a nation level, because it's different than a company or even just a federal agency. When you're talking at national levels, things are a little bit different and you need to take kind of those high roads and make sure you've got the big fundamentals in place. And I identified 5 areas, right? So the first thing is you have to have strategic cybersecurity leadership. This document infers it, but it doesn't come out and specifically state or address we need to have better leaders. It doesn't talk about experience or requirement of cybersecurity leadership in critical infrastructure businesses. It doesn't. Does that mean the company that protects your water supply from being poisoned, they can hire anybody for cybersecurity. They can hire the janitor. You're not gonna have a good cybersecurity program. So again, making sure you've got leadership and putting guardrails. I love the fact that they talked about, okay, well, we need to have, you know, good workforce. They needed to have another section talking about cybersecurity leadership. And even when it comes to, okay, government contracts, Hey, we're only gonna have a government contract with you if you have a professional cybersecurity leader. You have a CISO with so many years experience or a background or this or that or certificate, something, something. All right, so I would, I would have liked more focus on leadership because that will make or break the overall efficiency and effectiveness of what's gonna be delivered in cybersecurity. The second area, regulatory frameworks. I think it talks about it. Talked a little bit about it. It hinted about different frameworks. It hinted about different capabilities that inferred, yes, you would need a regular, you know, regulation or, or a law passed for it. So I think they actually did a good job in kind of discussing some of those frameworks. Not a 10 out of 10, but I think they did an okay job on that. Risk controls. I think they did a good job on this too, because they talked about the incentives. They talked about innovation. They had talked about investment. They talked about resilience and new technologies and leveraging security that's in old technologies, right? All those kinds of things. I like what they did there when they talked about risk controls. They talked about, you know, past, present, and even future ones. So I think they did good there. Targeting the attackers. Oh yeah, especially when they talked about the nation-state attackers, the top-tier attackers that are gonna invest billions. And by the way, just because it's a nation-state doesn't mean it doesn't affect Everybody, because yes, that nation-state may invest $10 billion in a particular attack and attack some other government and maybe attack the Defense Department. And you think, well, my company isn't the Defense Department, they're not going to attack me. Well, you're not quite understanding the situation because as soon as that aggressor builds, uh, figures out the vulnerability, builds the exploit and uses it, It's now in the wild. Everybody can grab that and they will tear it apart, find the interesting bits, and then use it in their attacks, in their ransomware attacks, in their denial of service attacks, and their exploitation and hacking and botnets and everything else, in their spam and phishing attacks. So yeah, it does trickle down to each and every one of us. So I like that they did talk about targeting attackers at the nation-state level. They also talked about cyber criminals. I like that they even called out specifically ransomware organizations. That's awesome. I think they did good there. I think there's still a lot more education that needs to happen with the population, with society, education, and even the businesses out there, because a lot of them still think it's cybersecurity is simply a technical endeavor. It's a light switch. I just have to build the right light switch to turn it on or off. If it's on, we're completely secure. If it's not, then we're not. It doesn't work that way. We have to incorporate the bad guys and their creativity in it as well. The last area is cooperation and enablement cohesion. I think they did a good job here because again, they talked about within the country, they talked about across different agencies, they talked about outside the country with our partners. And law enforcement and intelligence and military and all those things. So I think out of all these areas, the cooperation and enablement is— was best represented in this strategy. And honestly, if you don't have that, nothing else matters because again, you can't solve it by yourself. So the most important thing, if you're going to build a national strategy, is to get everybody involved. Involved and leveraging those resources. And so, yeah, I think they did a really good job in that. And that's it. Thank you all for listening. If you're interested in cybersecurity topics, in rants, in reviews and things like that, I would urge you to hit the like button and subscribe to Cybersecurity Insights. I do a podcast every once in a while talking about fun things like this. And you can always reach out to me if you've got ideas or a particular area you want me to dive into. Thank you very much. See you next time.