The White House's Cyber Tool Wish List

The White House is making progress on the steps required by President Donald Trump’s cybersecurity executive order, the acting federal chief information security officer said Wednesday.

In late August, for instance, a White House advisory group shared a draft of its plans to modernize government technology, including encrypting more data and investing more in cloud storage. The order also required federal agency heads to provide cyber risk management reports to the Office of Management and Budget. That documentation is currently trickling into the White House and being sent to the president, Grant Schneider, who is also the National Security Council’s senior director for cybersecurity, said Wednesday at a U.S. Chamber of Commerce cybersecurity event.

Schneider said his team was “very pleased” with agencies’ progress on cybersecurity assessments, and that some of the “deliverables” mandated in the cybersecurity executive order will “ultimately be made public at the President’s discretion.”

The diminishing costs of carrying out a cyberattack means adversaries’ jobs are getting easier, Schneider said. As the “odds of them carrying out malicious cyber activity” anonymously grows, it’s less likely that those adversaries are going to be noticed, he said.

Across government and the private sector, most attacks exploit existing backdoors and software vulnerabilities, he said. “We really need to focus on the basics: strong authentication, find[ing] ways to be sure you understand who’s on your network, and what they’re doing. And then basic [security] patch management.”

He asked businesses supplying cybersecurity technology to provide products that are simple to use and affordable. Those companies should also be agile enough to modify their products based on new requirements.

“We’re not the quickest at buying stuff. … We need tools and products that are going to solve next week’s problems, not last year’s problems,” he said.

New tools the government buys should also help it share information about cyber threats with other groups in real time, he said.

Cybersecurity companies should look beyond low prices as the key determiner of selling success, he added.

Suppliers should focus on “putting security in on the front end, where it’s a discriminator, [at] the point of purchase” when customers are comparing products. The more customers start demanding robust security up front, “the better chance we have of getting there.”