Fed report castigates U.S. ability to fend
off a cyberattack, suggests major reforms

The
Cyberspace Solarium Commission issued a 182-page report stating the United
States in dangerously insecure when it comes to defending itself from a
cyberattack and offered a litany of recommendations to shore up the nation’s
defenses.

The Commission,
headed by Sens. Angus King, I-Me., and Mike Gallagher, R-Wisc., stated the
executive branch should issue an updated National Cyber Strategy, establish
House Permanent Select and Senate Select Committees on Cybersecurity, establish
a Senate-confirmed National Cyber Director, strengthen
the Cybersecurity and Infrastructure Security Agency (CISA) and implement
policies designed to better recruit, develop and retain cyber talent.

“The United States now operates in a cyber landscape that
requires a level of data security, resilience, and trustworthiness that neither
the U.S. government nor the private sector alone is currently equipped to
provide. Moreover, shortfalls in agility, technical expertise, and unity of
effort, both within the U.S. government and between the public and private
sectors, are growing,” the senators said in their executive
summary.

To rectify these issues the report lists five strategic
steps its writers believe need to be taken to push the country in the right
direction.

The first is to establish a credible level of deterrence by
being willing and able to use a level of retaliatory force commensurate with any
cyberattack suffered

“The federal government and the private sector must defend
themselves and strike back with speed and agility. This is difficult because
the government is not optimized to be quick or agile, but we simply must be
faster than our adversaries in order to prevent them from destroying our
networks and, by extension, our way of life,” the report stated.

The next recommendation centers on creating a Continuity of
the Economy plan similar to those created during the Cold War to help the
nation recover from a physical attack, but in this case one designed to rapidly
restore critical functions across corporations and industry sectors to get the economy
back up and running after a catastrophic cyberattack.

In order to institute these steps, the report stated the
government itself must be reformed. This would include elevating and empowering
CISA
and create new focal points for coordinating cybersecurity
in the executive branch and Congress. The position of National Cyber Director should
be created with oversight from a new Cybersecurity Commission.

The private sector will also be expected to due its part.
Considering most of the nation’s critical infrastructure is privately owned
these entities some regulations should be instituted.

“We do not want to saddle the private sector with onerous
and counterproductive regulations, nor do we want to force companies to hand
over their data to the federal government. But we need C-suite executives to
take cyber seriously since they are on the front lines. With support from the
federal government, private-sector entities must be able to act with speed and
agility to stop cyberattackers from breaking out in their networks and the
larger array of networks on which the nation relies,” the report said.

Finally, the report noted election security must be a
priority. If we don’t get election security right, deterrence will fail and
future generations will look back with longing and regret on the once powerful
American Republic and wonder how we screwed the whole thing up, King and
Gallagher said.

Tom Gann, chief public policy officer at McAfee, said in a
statement the Solarium Commission rightly notes that turning the tide on cyberthreats
must involve federal, state, local and tribal governments as well as industry,
academia and individuals.

“We applaud the Commission for calling for a common and
interoperable environment for sharing and fusing  threat information, insights, and other
relevant data across the federal government and between the public and private
sectors. This interoperability must also extend to cybersecurity tools, which
today often function in silos,” he said.