Executive Order on Improving the Nation’s Cybersecurity (S1E31)

Today, we will interview Micah Maryn, a subject matter expert from Akamai Technologies. We will look at the Executive Order issued May 15, 2021, titled Executive Order on Improving the Nation’s Cybersecurity.  It covers many aspects of cybersecurity ranging from sharing threat information to remediation after an attack.  We will never know what precipitated this document, but it seems reasonable that the order was issued in response to some recent high-profile attacks.

During this interview, Micah comments on three main aspects of the Executive Order: Zero Trust, reporting requirements, and modernization.

Micah observes that past presidents have issued Executive Orders about cybersecurity. One of the distinguishing characteristics of this order is the mention of Zero Trust. He surmises that the move to the cloud is precipitating a closer look at Zero Trust.  The cloud does not have a neatly defined perimeter, like an on-premises network.  Micah thinks that it would be hard to accomplish a move to the cloud without adopting Zero Trust.

When discussing Zero Trust a related topic is identity management. After all, you cannot grant access to information to the wrong person.  Micah Maryn talks about the multifactor authentication mandates that are due within 180 days – the 8th of November.  It looks like some agencies are ahead of the curve with this requirement while others are lagging.

Experienced federal technology professionals are familiar with the Trusted Internet Connection (TIC) 3.0.  During the interview, Micah observes that TIC 3.0 is a great starting point for bolstering federal cybersecurity in the cloud. TIC 3.0 is the latest revision in a series of improvements that filters agency access to the cloud.  TIC 3.0 covers many of the requirements listed in the Executive Order.

Many of the improvements are tied to a reporting system. Micah suggests that the purpose of these reports is to provide data to leaders on how to flesh out the details of the requirements. One agency may be underfunded, another agency may have accomplished the goals already. It is entirely possible that the reports could reveal a list of requirements for an agency.  The solution may be getting the money the next fiscal year. When the OMB gets reports, then definitive policy starts to form.

Featured Speakers: