August 2021 Developments Under President Biden’s Cybersecurity Executive Order – Technology

The Cyber EO requires federal agencies to meet several important
deadlines in August 2021.  These deadlines are in the areas of
enhancing critical software supply chain security, improving the
federal government's investigative and remediation
capabilities, and modernizing federal agency approaches to
cybersecurity.  In addition, the National Institute of
Standards and Technology ("NIST") took several
significant actions related to supply chain security in August
2021, not all of which were driven by deadlines in the Cyber EO.
 This blog examines the actions taken by federal agencies to
meet the EO's August deadlines as well as the NIST actions
referred to above.

A.  Enhancing Critical Software Supply Chain
Security

1. Actions Taken By OMB During August 2021

Section 4(a) of the Cyber EO states that the security and
integrity of "critical software" is of particular
concern, and that the federal government must take action to
rapidly improve the security and integrity of the software supply
chain, with a priority on addressing critical software. 
Pursuant to section 4(g) of the EO, NIST published a definition of the term "critical
software" on June 25, 2021.  Subsequently, on July 8,
2021, NIST published guidance to federal agencies on security measures
for critical software.  These developments are discussed
in greater detail in our blogs on the June and July 2021 Cyber EO
developments.

Section 4(j) of the EO requires the Office of Management and
Budget ("OMB") to take appropriate steps by August 10,
2021 to require that agencies comply with the July 8 critical
software security guidance issued by NIST.  On August 10,
2021, Shalanda Young, the Acting Director of OMB, issued a
Memorandum to the Heads of Executive Departments and Agencies
entitled "Protecting Critical Software Through Enhanced
Security Measures" (the "August 10 Memo").

The August 10 Memo sets out a "phased approach" for
agency implementation of the NIST guidance.  During the
initial phase, agencies are required to focus on identifying and
securing stand-alone, on-premise software that performs
"security-critical functions or poses similar significant
potential for harm if compromised."  Such software
includes applications that provide the following categories of
service:

• identity, credential, and access management (ICAM)
• operating systems, hypervisors, container environments
• web browsers
• endpoint security
• network control
• network protection
• network monitoring and configuration
• operational monitoring and analysis
• remote scanning
• remote access and configuration management
• backup/recovery and remote storage

Along these lines, during the initial phase the August 10 Memo
requires each agency to identify by October 10, 2021 all
"critical software" as defined by NIST that falls within
the categories of service described above that is in use or in the
process of acquisition by the agency. The August 10 Memo further
provides that each agency must implement the security measures
designated in NIST's July 8 guidance for all categories of
critical software included in the initial phase by August 10,
2022.

The August 10 Memo states that OMB will address subsequent
phases of implementation in the future for additional categories of
software as determined by CISA.  The Memo states that the
following categories of software, among others, will be addressed
in these future phases:

• software that controls access to data;
• cloud-based and hybrid software;
• software development tools, such as code repository systems,
  testing software, integration software, packaging software, and
  deployment software;
• software components in boot-level firmware; and
• software components in operational technology.

2. Actions Taken by NIST During August 2021

The Biden Administration announced at a "Cybersecurity Summit" held at the White
House on August 25, 2021 that NIST would collaborate with industry
and other partners to develop a new framework for improving the
security and integrity of the technology supply chain. The
Administration states that this framework will serve as guidance to
public and private entities on how to build secure technology and
how to assess the security of technology, including open-source
software, in their supply chains. This new framework will focus on
promoting the development and adoption of international
standards.

In a related development, a NIST spokesman announced on August
25, 2021 that NIST will delay issuance of a second draft (update)
of SP 800-161 Rev. 1, "Supply Chain Risk Management",
from September 2021 until October or November 2021 in order to
incorporate requirements imposed by the Cyber EO.  In
particular, Section 4(c) of the EO requires NIST to publish by
November 8, 2021 preliminary guidelines for enhancing software
supply chain security based on input from federal agencies, private
industry, and academia that NIST received in June and July 2021.
The NIST spokesperson stated that delaying the issuance of the NIST
SP 800-161 Rev. 1 update would allow the agency to meet the
EO's November 8 deadline for preliminary guidance on enhancing
software supply chain security.  It is unclear whether the
update to SP 800-161 is the same as the new NIST framework for
improving the security and integrity of the technology supply chain
that the Biden Administration announced at the White House
Cybersecurity Summit.

On August 24, 2021, NIST released the final version of NISTIR
8259B, "IOT Non-Technical Supporting Capability Core
Baseline".  This document complements NISTIR 8259A,
"Core Device Cybersecurity Capability Baseline (May 2020),
which is NIST's guide to the technical aspects of manufacturing
secure Internet of Things ("IOT") devices and products.
 The document describes four recommended non-technical
supporting capabilities related to the lifecycle of cybersecurity
management that manufacturers should implement, including (1)
documentation, (2) information and query reception, (3) information
dissemination, and (4) education and awareness.  Together,
NISTIR 8259A and NISTIR 8259B are intended to define a baseline set
of activities that manufacturers should undertake during the
planning, development, and operational life of IOT devices to
address the cybersecurity needs and goals of their customers.

On August 31, NIST issued a draft White Paper setting forth criteria that
can be used to create the pilot labelling program for consumer IOT
devices contemplated by Section 4 of the Cyber EO.  This
program is intended to educate the public on the security
capabilities and vulnerabilities of IOT devices and software
development practices.  The White Paper notes among other
things that in line with the direction set forth by the Cyber EO,
IoT products must reflect increasingly comprehensive levels of
testing and assessment, and that "[m]ore cybersecurity
controls may be needed for devices that pose inherently greater
risks such as a door lock or stove."  The White Paper
notes that a label should clearly convey information to consumers
about elevated security capabilities, and that it should be
understandable and actionable by the consumer.  The White
Paper states that NIST plans to hold a workshop on September 14 and
15, 2021, to obtain comments and other input on the pilot labelling
program.

B.  Improving the Federal Government's
Cyber Investigative and Remediation Capabilities

Section 8(c) of the Cyber EO requires OMB, in consultation with
the Secretaries of Commerce and DHS, to formulate policies for
agencies to establish requirements for logging, log retention, and
log management that ensure centralized access and visibility for
the highest level security operations center ("SOC") of
each agency.  On August 27, 2021, the OMB Director issued
a Memorandum to the heads of federal
agencies regarding the logging, log retention, and log management
requirements of EO section 8(c) (the "August 27
Memo").  The August 27 Memo also establishes requirements
for agencies to increase the sharing of such information, as needed
and appropriate, to accelerate incident response efforts and to
enable more effective defense of federal information and
agencies.

Section 1 of the August 27 Memo establishes an "Event
Logging ("EL") maturity model that includes the four
"Logging Tiers" described in the following table:

The August 27 Memo requires each federal agency to assess its
current logging maturity against the four tiers in the Memo's
maturity model and identify any resource and implementation gaps
that may exist relative to the respective requirements of each
of  those tiers. Agencies are required to report their
assessments and gap analyses to OMB by October 27, 2021. In
addition, the August 27 Memo requires each agency to reach the EL
Tier 1 Maturity level by August 27, 2022, the EL Tier 2 Maturity
level by February 27, 2023, and the EL Tier 3 Maturity level by
August 27, 2023.

C.  Modernizing Federal Agency Approaches To
Cybersecurity

Section 3(c) of the Cyber EO states that federal agencies should
migrate to cloud technology in a coordinated, deliberate way that
adopts Zero Trust Architecture as practicable.  The EO directs
CISA to modernize its current cybersecurity programs, services, and
capabilities to be fully functional with cloud-computing
environments that have Zero Trust Architecture.  The EO also
directs CISA, in consultation with the GSA's FedRAMP Program,
to develop security principles governing Cloud Service Providers
("CSPs") for incorporation into agency modernization
efforts.

To implement these requirements, Section 3(c) imposes an August
10, 2021 deadline for completion of the following:

• OMB's development of a Federal cloud-security strategy and
  its issuance of guidance to agencies that seeks to ensure that they
  fully understand and effectively address the risks of using
  cloud-based services and to move them closer to Zero Trust
  Architecture.
• CISA's issuance of cloud-security technical reference
  architecture documentation for civilian agencies that illustrates
  recommended approaches to cloud migration and data protection for
  agency data collection and reporting.
• Evaluation by each federal agency of the types and sensitivity
  of its unclassified data that includes appropriate processing and
  storage solutions for such data, with priority on identifying that
  data that is most sensitive and under the greatest threat.

It is unclear what, if any, actions were taken by OMB, CISA, or
federal agencies to implement these requirements during August
2021.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.

Comments are closed.