A Single Partner for Everything You Need Optiv works with more than 450 world-class security technology partners. By putting you at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can.
We Are Optiv Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner. However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
Nine Takeaways from the Newly Announced National Cybersecurity Strategy Breadcrumb Home Insights Blog Nine Takeaways from the Newly Announced National Cybersecurity Strategy April 14, 2023 Recently, the Biden administration released its much anticipated National Cybersecurity Strategy. Founded on five pillars - defend critical infrastructure, disrupt and dismantle threat actors, shape market forces to drive security and resilience, invest in a resilient future, and forge international partnerships to pursue shared goals - the strategy builds on the 2018 National Cyber Strategy issued by the Trump administration, as well as several other national security memorandums and Executive Order 14028. Though the five pillars identified in the 2023 strategy are vastly different in verbiage from the 2018 version, they are similar in intent - and they’ve been modernized to meet today’s threats and cybersecurity trends. Some of the initiatives within focus on areas that warrant much-needed national attention, and others change the national cybersecurity landscape for developers and service providers. There is a lot to digest in the 39-page strategy, but here are a few key themes that stood out to me, as well as key takeaways for each: The strategy further calls for formalizing performance-based cybersecurity requirements across critical infrastructure and government systems, including national security systems. There are some initiatives already underway that aim to do just this, including Cybersecurity Maturity Model Certification (CMMC) for those that process or handle government-controlled, unclassified information - and this is a good start. The 2023 strategy, however, takes the principles within CMMC and makes them more widely applicable to all industries deemed “critical.” Among other things, the strategy emphasizes that regulations must be agile enough to adapt to adversaries’ tactics, there must be a focus on secure-by-design principles, and systems must be designed to fail safely and recover quickly, all of which are a marked change from what have been compliance-based regulations in the past. This points to a continued trend of the government taking a risk-based approach to cybersecurity. An emphasis is placed on increased collaboration between the government and the private sector, including increased access to sensitive cyber intelligence for those defending critical infrastructure and increased speed to sharing of information across industries and the government. This speaks to the importance of enabling real-time, actionable, and multidirectional sharing, which is a capability that the industry needs. Any increased visibility into bad actors’ tactics, techniques, and procedures, especially intelligence that is actionable and timely, is a positive for the industry. A specific section regarding national security systems calls for increased protection against insider threats and nation-state actors. Actively identifying these systems for modernization of cybersecurity requirements is something that has been long overdue. My hope is that this will carry over to the defense industrial base as well and include an effort to modernize the archaic architectures and limitations levied on national security systems. A concerted effort to move to more secure cloud platforms and enable more effective cybersecurity tools needs to be made in this space. The move to zero-trust architectures is another recurring theme in the strategy, which reflects the push in the industry. We will continue to see the federal government modernize its security to reflect industry standards, and its move to zero trust is no different. What is different, however, is its sense of urgency to act. Several recent policy memos and regulations have centered on modernizing government cybersecurity infrastructure, and this is emphasized heavily in the 2023 strategy. The themes of accountability and shifting liability, including holding developers responsible for security vulnerabilities in their products and moving to incentivize secure development practices, are repeated throughout the document in several sections. This is coupled with a call for increased federal oversight and standards, and continued development of a software bill of materials. This follows a continued struggle in the industry with software supply-chain issues and third-party software. For example, according to Statista, there was a 742 percent increase of opensource software supply-chain attacks from 2020 to 2022, and I expect that trend to continue. The strategy details the exploration of a federal cybersecurity insurance program. This has been a hot topic in the industry as insurance premiums have been increasing, policies have stricter terms and more exclusions, and it’s growing harder to secure a policy. While there weren’t too many details on the program, I foresee this gaining traction if the cyber insurance market continues to head in the same direction. Another focus area that aligns with current trends in the cybersecurity market is developing cybersecurity talent and strengthening the cybersecurity workforce. There continues to be a shortage of qualified cybersecurity professionals across the government and industry. The 2023 strategy places a focus on closing this gap, mentioning several ongoing efforts that are helping remediate the shortage of workers, including the National Initiative for Cybersecurity Education, CyberCorps, and National Centers of Academic Excellence in Cybersecurity program. Pillar five was dedicated to international partnerships, which is critical to ensuring that other countries help enforce the rule of law and agree to norms of behavior. As the 2023 strategy states, most attacks against the United States originate from outside the country. This, in and of itself, is why we need to focus on building a common vision and agreed-upon norms around the world. Also in pillar five, there is a focus on securing the supply chain and ensuring goods are sourced from trusted vendors and countries. The concerns about and subsequent banning of Huawei and ZTE in the United States opened people’s eyes to potential spying and supply-chain issues from countries and companies that may be tied to nation-state actors. This reflects the continued posture toward hardware supply chain-risk mitigation and a continued move toward sourcing from US-based companies and trusted foreign vendors. We’re living in an unprecedented threat landscape, and we can only protect ourselves from bad actors if we work together. This means there must be ongoing collaboration between the private and public sectors. This is exactly what the Biden administration aims to jumpstart with its 2023 strategy, and the initiatives within will put us on the path to cybersecurity success. Max Shier is the chief information security officer at Optiv. He has more than 27 years of experience in all facets of security, including direct cybersecurity, information technology, cybersecurity oversight, and implementation of critical space-based national defense programs. *This article originally appeared on the NACD BoardTalk blog. Reprinted with permission. https://blog.nacdonline.org/posts/takeaways-national-cybersecurity-strategy By: Max Shier VP, Chief Information Security Officer | Optiv Max Shier is a 23-year Air Force veteran and has more than 27 years of experience in all facets of security, including direct cybersecurity and IT experience in several technology and security domains. Prior to Optiv, Shier held several leadership positions in the Federal Government and the defense industry base, with his most recent position as a cybersecurity director at a large defense contractor where he was responsible for cybersecurity oversight and implementation of critical space-based national defense programs. Share: Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.
Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.
Would you like to speak to an advisor? How can we help you today? Image E-Book Cybersecurity Field Guide #13: A Practical Approach to Securing Your Cloud Transformation Download Now Image Events Register for an Upcoming OptivCon Learn More Ready to speak to an Optiv expert to discuss your security needs?