National Cybersecurity Strategy

This strategy and other projects attest to the fact that the U.S. recognizes that cybersecurity is essential to its economy, democracy, information privacy, and national defense. In cooperation with the private sector, President Biden's Administration has worked to strengthen the country's cybersecurity and, together with international allies and partners, aims to improve collective prevention, defense, and response to cyber threats from around the world that run counter to shared interests.

Implementing the National Cybersecurity Strategy will require efforts, collaboration, and investments by the U.S. government, international allies, partners, civil society, and the private sector. Throughout implementation, the Federal Government will collect and monitor data related to investments, progress, results, and effectiveness of efforts. Furthermore, it will prioritize applying lessons learned from previous cyber incidents and seek to keep up with the constant and accelerating changes within the cyber ecosystem. Let's look at the issues this strategy aims to address and the pillars on which it is based.

The cyber environment continues to expand and complexify at an accelerated pace. Not only in structural and interconnection matters, for the good of companies and consumers, but also in terms of cyber risks and threats. Every day, criminal groups, including those backed by governments of autocratic nations, dissenting from the interests and norms of the U.S. and allied countries, target organizations and users worldwide. They seek to exploit both vulnerabilities in computer systems and in the people who operate them. They mainly aim to achieve the theft of sensitive information or monetary assets and the disruption of operations or services.

As interdependencies in the digital ecosystem increase, cyberattacks on a few spread rapidly, affecting many as a consequence. As the amount of sensitive information stored within cyberspace grows, more people are at risk. These are common problems today in the field of cybersecurity. This strategy seeks to address them with a more outstanding and larger-scale commitment, aiming for positive changes to strengthen the defense, resilience, and national values such as safety, democracy, and economic prosperity.

The five pillars of this strategy are the following:

From this pillar, the ideal is to instill confidence in citizens in the availability and security of critical infrastructure and its services. Unfortunately, the rewards the market grants to companies that own and operate such infrastructure and voluntarily implement cybersecurity risk prevention and mitigation strategies are insufficient. Likewise, there has been a lack of mandatory requirements that encourage the implementation of preventive measures, so the Administration is focusing on establishing them and expanding the use of at least (but encouraging going beyond) minimum requirements for cybersecurity practices and outcomes in critical sectors.

In addition, in all sectors, the Administration seeks to modernize regulatory frameworks (basing them on existing standards and guidelines), better adapt them to each sector's changing risks and threats, and harmonize them to avoid duplication and streamline their implementation. In line with what Fluid Attacks usually shares, they state: "The most effective and efficient regulatory frameworks will be those put in place well before a crisis, rather than through the imposition of emergency regulations after a crisis occurs."

Here, the Administration emphasizes enabling and fostering collaboration between public and private organizations to defend critical infrastructure and its essential services and prevent their disruption. It also highlights the model to follow that the Federal Government can represent and the support it can provide to the defense of critical infrastructure by modernizing the security of its own networks and systems (under the principle of zero trust) and improving its incident response policies. When sectors of the critical infrastructure request support from the Federal Government, it should coordinate authorities and efforts for a unified response backed by predefined support possibilities and guidelines.

Part of the purpose of this pillar is to make it impossible for cybercriminals to mount or maintain campaigns that threaten the security of the U.S. Already, the Federal Government has improved its capabilities to respond to cybersecurity incidents; it has arrested, prosecuted, and sanctioned transnational threat actors, and recovered enormous amounts of money from illicit activities. Based on these and other successes, again highlighting the need for continued and coordinated cross-sector collaboration, it intends to persist in enhancing its strategies to thwart campaigns before they impact, render them non-profitable, and dismantle cybercriminal groups.

The Federal Government will use purchasing power and grant-making to incentivize the adoption of cybersecurity best practices. The idea is to invest in new infrastructures that are secure and resilient by design and to maintain them that way throughout their lifecycle. Moreover, the Administration will encourage coordinated disclosure of vulnerabilities in all technologies and further development of SBOMs. It will also develop processes to identify and mitigate risks in unsupported software used in critical infrastructure. Finally, it seeks to prioritize funding for research and development in cybersecurity technologies, especially those to strengthen critical infrastructure.

Additionally, in this pillar, the Administration acknowledges the shortage of specialized cybersecurity personnel within and outside the nation. As a response to this, it seeks to contribute investment to enable greater access to education in this field and expand, diversify, and maintain a strong workforce.

The Administration aims to build a coalition with other countries "to maintain an open, free, global, interoperable, reliable, and secure Internet." Ideally, through international collaboration, it will address common threats, punish and disrupt transnational criminal groups, protect against repression by them, help improve the capacity of coalition members, strengthen and defend globally accepted norms, and build an increasingly secure and resilient ecosystem. The U.S. and its allies will be able to "advance common cybersecurity interests by sharing cyber threat information, exchanging model cybersecurity practices, comparing sector-specific expertise, driving secure-by-design principles, and coordinating policy and incident response activities."

Finally, other aspects of this last pillar include the U.S. interest in working collaboratively to generate new international law enforcement mechanisms, create secure, transparent, and reliable global supply chains for different technology products and services, and support investigations, response, and recovery of allies affected by incidents.