There are four key takeaways.  First, many companies that do not believe they are part of the critical infrastructure will be considered critical infrastructure.  Second, the government will be taking a more active role in attempting to have companies designated as critical infrastructure become more aware and compliant regarding cybersecurity.  This will likely result in pressure on these companies to increase security (with resulting increases in spending) as the government will be attempting to have companies follow a cybersecurity framework that will be created.  Third, information sharing continues to be a focus to address the cyber threat.  Fourth, there are strategies that companies can use to help address these issues, and they are discussed below after the summary of the Executive Order.

Defining Critical Infrastructure.

This is a definition that will go far beyond what people traditionally think of as “critical infrastructure” and executives must consider the impact of this Executive Order, and more importantly how they can help their companies address this risk.

DHS has previously identified 18 critical infrastructure Sectors:  Food and Agriculture; Banking and Finance; Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy; Governmental Facilities; Healthcare and Public Health; Information Technology; National Monuments and Icons; Nuclear Reactors, Materials and Waste; Postal and Shipping; Transportation Systems; and Water.

The Executive order may expand this list because the order focuses on any “systems or assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”  The Executive Order contemplates making this determination based upon a new risk-based assessment to identify critical infrastructure where a cybersecurity incident could “reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.”  The owners of businesses in the critical infrastructure will be notified that they have been deemed to be critical infrastructure, and the businesses have the opportunity to ask for reconsideration of this designation.

Information Sharing.

The first substantive focus of the Executive Order is information sharing, and as noted in prior posts by the Lares Institute, this is a critical issue as in many cases the public sector has better threat intelligence than the private sector, though the private sector is often the target of a cyber attack.  There have been prior Executive Orders from both President Bush and President Obama related to information sharing, and this order again reiterates the need for the public sector to share non-classified information with the private sector to help address the cybersecurity problem.  It also orders the Attorney General, the Secretary of Homeland Security, and the Director of National Intelligence to issue instructions consistent with this order to ensure the release of appropriate information to the private sector.  Consistent with Executive Order 13549, there are also provisions focused on expediting the clearance process to enable information sharing.

Consultative Process.

Recognizing the need to build consensus and gather information, the Secretary of DHS is also required to establish a consultative process to coordinate improvements to the critical infrastructure.

Cybersecurity Framework.

Building upon that, the order also requires the Department of Commerce to direct NIST to create a framework to reduce cyber risk to the critical infrastructure in a way that establishes cross-sector security standards and guidelines.  This is to provide a “a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks” and will “incorporate voluntary consensus standards and industry best practices to the fullest extent possible.”  There is to be a technology neutral framework that enables competition for addressing cyber risks.  There is to be a public comment and review process, and there is to be a preliminary version of the framework released within 240 days of the order, and the final order is to be released within 1 year.

DHS is also required to, in coordination with other agencies, establish a voluntary program to support the adoption of the framework.  In order to encourage participation, the order contemplates the creation of incentives to promote participation in the program.

Once the framework is created, there is to be a governmental review of the existing cybersecurity regulatory requirements to make sure that these regulations are sufficient given the current risks, and additional actions may be contemplated if the existing regulations are deemed insufficient.

Privacy and Civil Liberties.

There was also a privacy and civil liberties focus, because the Executive Order mandates that the CPO and the Officer for Civil Liberties of DHS are to produce a public report regarding the privacy impact of these new requirements.

Information Sharing and Information Superiority.

As noted in the prior post, Information Superiority and Information Sharing—A Solution for the Public and Private Sector, information sharing and information superiority are critical steps any company can take to address the cyber issue.  As I have previously noted, there are four key steps:

• The first step companies must take to implement Information Superiority, and reduce the chances of an exploitable information imbalance, is understand what information they have.
• The second step companies must take is to create a governance structure that includes key senior stakeholders from departments that are relevant to governing information.
• The third step companies must take is to create a framework that classifies the company’s information based upon sensitivity.
• The fourth step companies must take is to make systematic behavioral changes to how information is collected and processed, so that information is appropriately shared with key stakeholders, both internal and external.

As the threats continue to grow, and the chances of governmental action increase, these are steps that companies can take to get ahead of the cybersecurity framework, and also reduce their cybersecurity risk.  In these times of doing more with less, using Information Superiority to focus security efforts also offers many companies a path forward to address cyber concerns.

A link to the article can be found here.

The whole history of the challenges to the Red Flag Rule are beyond the scope of this post, but they include a challenge by the ABA, as well as amendments in 2010 to modify the scope of the definition.  The FTC, recognizing these changes, as issued the Rule, which is open to comment for 60 days, and the amended Red Flags Rule now provides that a creditor is covered only if, in the ordinary course of business, it regularly:

• Obtains or uses consumer reports in connection with a credit transaction;
• Furnishes information to consumer reporting agencies in connection with a credit transaction; or
• Advances funds to or on behalf of a person, in certain cases.

This is important because many businesses were included within the broader definition of creditor, and now may not be under the new definition.  The Lares Institute will be submitting comments on this Interim Final Rule.