Why the U.S. Needs a Unified Cybersecurity Framework
Why the U.S. Needs a Unified Cybersecurity Framework
By Prathamesh Khedekar
Amid the Russian and Ukrainian crisis, Google uncovered widespread phishing attacks targeting organizations in Ukraine and Poland. Similarly, LinkedIn phishing scams have surged by a whopping 232% in the last few months.
The FBI Flash Alert made a release this month confirming that the RagnarLocker ransomware from April 2020 has infected some 52 organizations across different industries, and government systems were not an exception.
I have designed public-safety communication systems for the government of the U.S., the U.K. and Dutch telecom giant KPN. With the adoption of a holistic approach, I was able to secure these systems against the cyber risks that existed at the time. With the advent of artificial intelligence (AI) and the sophisticated nature of cyber attacks, the scale and nature of cyber threats have grown exponentially.
One of the biggest cybersecurity challenges the U.S., government faces today is not the lack of engineering and financial resources but a lack of a unified cybersecurity protocol. The cybersecurity landscape in the U.S. is loosely structured and rests on the shoulders of 80 committees and subcommittees that currently govern the cybersecurity frameworks and policies.
Critical infrastructure sectors, such as water, the power grid and hospitals, are protected under the Cybersecurity and Infrastructure Security Agency (CISA), which is the Department of Homeland Security’s (DHS) primary agency involved with cybersecurity. The federal agencies, on the other hand, follow the cybersecurity policies enforced by the Office of Management and Budget (OMB). The National Security Agency (NSA), one of the Department of Defense (DoD) agencies, focuses on international adversaries in cyberspace. The Cybersecurity and Network Reliability division of FCC regulates cybersecurity laws for telecommunications companies.
Suppose we were to disseminate information about an impending cyber attack across all industry sectors. In that case, we will need to organize a joint meeting with each of these agencies and upvote the prevention and remediation strategies amongst 80 or so committees. This multicommittee approach adds delay and risk and works to the advantage of hackers. A delay of 30 seconds is enough for a potential hacker to steal thousands of gigabytes (GB) of data from a compromised enterprise computing system.
The current multicommittee approach adopted by the U.S. government in the era of AI-powered cyber bots only exacerbates our vulnerabilities. These challenges can be addressed by developing a unified national cybersecurity framework, opening up room for cross-border and cross-sectoral cyber collaboration, adopting the latest technological advancements and incorporating cyber awareness in the day to day life.
To address the inefficiencies in the design and execution of cybersecurity laws and policies, the U.S. government would benefit from adopting a single umbrella approach. The Network and Information Security Directive is one such initiative developed by the EU to standardize and centralize the cybersecurity framework for all of its 27 members. It ensures each EU member nation will have a dedicated National Computer Security Incident Response Team (CSIRT) that responds to cyberattacks in a unified and timely manner. Such a unified committee can streamline the decision-making and risk management process that plays a crucial role in preventing and remediating cyberattacks.
The unified committee could also foster cross-border collaboration with the EU and other allies, so intelligence around cyberattacks is disseminated quickly and efficiently across all countries. This will help the governments minimize global inefficiencies and establish healthy channels for transmitting and receiving cyber intelligence associated with impending cyber attacks.
Similar synergy can be achieved between businesses and the government. Strengthening collaboration between the private and public sectors and collating cyber intelligence can yield more subject matter experts working hand in hand and serving both parts of the economy. This information will enable the unified committee to uncover hidden insights from ongoing cyberattacks worldwide and continuously enhance the national cybersecurity framework to prevent future attacks.
Speaking of the private sector, there are organizations that are fostering research focused on the use of AI for cyber reconnaissance. The conventional cybersecurity models are built around predefined data sets to predict future cyberattacks and do not take into account user behavior. A good example of it is a compromised social media account. When a hacker gets hold of a user’s credentials, they can successfully log in to the victim’s account. A cyber team won’t be able to do much in this scenario until such an attack is identified and flagged by the victim. With the advent of machine learning, we can deploy behavioral models that can analyze the user login and navigation pattern across a website to identify if the account has been hacked. Such AI-based behavioral models do just that.
What good is AI if we don’t address the weakest link in the cyber world: people? By educating the masses on cyber hygiene in schools, colleges and workplaces, the unified cybersecurity committee can raise awareness amongst citizens. Such initiatives will play a vital role in strengthening public safety and security at both grassroots and a national level.
While we tend to think the cyberattacks are only bound to impact our inbox, social media or bank accounts, we don’t realize we are one cyber attack away from living without basic amenities like clean water, electricity, gas and the internet for weeks.
Prathamesh Khedekar is a technical product operations manager at Creospan, where he leads technology programs for Fortune 100 clients. Prior to that, he served as a senior staff engineer at Motorola Solutions and designed secure mission-critical communication systems for government agencies in the U.S,, U.K. and the Netherlands. He holds a master’s degree in electrical engineering from the University of Southern California.
Gloss