A Decade-Old Cyber Policy Desperately Needs an Update, Group Says

Ransomware wasn’t even a thing the last time the White House updated its playbook for cooperating with industry to guard critical infrastructure, but a new, bipartisan report offers 12 recommendations for bringing the decade-old policy into the present day.

“It sounds boring, because it's kind of like government bureaucracy. But it's the kind of government bureaucracy that is the backbone of security. And so we've really got to get moving out on this," Mark Montgomery, senior advisor for CSC 2.0, a project that continues the work of the Cyberspace Solarium Commission established by Congress, told Defense One.

On Wednesday, the commission released 12 recommendations for revising Presidential Policy Directive 21, or PPD-21, a 2013 document that defines critical infrastructure sectors and how they should coordinate with federal agencies to head off cyber and physical attacks.

“We don't talk about this out loud too often, but the cyber resilience of our country, of our military mobility—ports, rail and air—is critical to responding to a crisis. That's how we move our people, our ammunition, our equipment, all that stuff. It's insanely vulnerable right now,” said Montgomery, who also co-authored the report, predicting that port security would likely be addressed in the upcoming defense policy bill.

The report calls for identifying DHS’s Cybersecurity and Infrastructure Security Agency as the national risk management agency—a responsibility already codified in law—in the revised policy because it didn’t exist when PPD-21 was created. It also calls for ways to share information between the various sectors, plus implementation and resourcing plans for the policy.

Commission co-chair Rep. Mike Gallagher, R-Wisc., said in a statement that the new report “gives the administration a blueprint for how we can improve PPD-21 and better protect our critical infrastructure.” He said it builds on the commission's 2020 report that addressed public-private partnerships.

There’s been a lot of movement in cyber policy in recent years: a new national cyber strategy, the 2021 cybersecurity executive order, and the creation of the national cyber director in the White House. But PPD-21 is so old it doesn’t mention CISA, the agency most responsible for protecting U.S. critical infrastructure, or one of the most common forms of attacks: ransomware.

“None of these threats existed when PPD-21 [was written], or at least they didn't exist to this extent. We didn't think about hospitals and their vulnerabilities in cyberspace the way we do now, in the sort of era of ransomware and even sort of in post pandemic ransomware and then sort of the challenge that has been raised,” said Annie Fixler, the director of Foundation for Defense of Democracy’s Center on Cyber and Technology Innovation and a co-author on the report. “Ten years is sort of criminally too long for that document not to have been updated and we are seeing sort of coming to a head all of the challenges with the document not reflecting how industry and the government partners actually work together.”

But as bureaucratic as it may be, the policy’s function is critical, said Joshua Corman, vice president of cyber safety strategy for Claroty, an industrial cybersecurity company.

“PPD-21 currently treats everything as equally critical. Angry Birds on my iPhone is designated critical infrastructure. It's IT. It's part of the Information Technology critical infrastructure sector. But so is timely access to patient care with mortal consequences. Why are we treating Angry Birds the same as we would Epic or Cerner electronic medical records?” 

Corman said the report recommends mapping critical functions that cross sectors to better understand how long sectors and systems can withstand disruption before lives are put at risk. 

“Many of the suppliers in manufacturing heavy equipment need water, need electricity. So disruptions to the weakest of these affect our national defense as well,” Corman said. Plus, military bases are “a microcosm of almost all of these critical infrastructure sectors. So I think we are very prone.”