Cybersecurity National Action Plan

Cybersecurity National Action Plan is a comprehensive strategy developed by the United States Department of Homeland Security in collaboration with the National Security Agency, Federal Bureau of Investigation, and other United States Department of Defense agencies to enhance the country's cybersecurity posture. The plan was announced by Barack Obama, the President of the United States, in 2016, with the goal of improving the nation's cybersecurity through a combination of short-term and long-term initiatives. This effort was supported by Congress, including Senate Select Committee on Intelligence and House Permanent Select Committee on Intelligence, as well as private sector companies like Microsoft, Google, and Amazon Web Services. The plan also drew on expertise from Stanford University, Massachusetts Institute of Technology, and Carnegie Mellon University.

Introduction

The Cybersecurity National Action Plan is built on the principles of National Institute of Standards and Technology's Cybersecurity Framework, which provides a structured approach to managing and reducing cyber risk. The plan recognizes the critical role of cybersecurity in protecting the nation's critical infrastructure, including power grid, financial system, and healthcare system, as identified by the Department of Energy, Department of the Treasury, and Department of Health and Human Services. It also acknowledges the importance of international cooperation, as seen in the G20, G7, and NATO summits, in addressing the global nature of cyber threats. The plan's development involved input from various stakeholders, including Symantec, McAfee, and FireEye, as well as Center for Strategic and International Studies and Council on Foreign Relations.

Background

The need for a comprehensive cybersecurity plan was highlighted by several high-profile cyber attacks, including the Office of Personnel Management data breach and the Sony Pictures hack, which were attributed to China and North Korea respectively. These incidents demonstrated the vulnerability of the nation's cybersecurity and the need for a coordinated response to cyber threats. The plan draws on the expertise of National Security Agency, Federal Bureau of Investigation, and Department of Homeland Security, as well as private sector companies like Palantir Technologies and CrowdStrike. The plan also builds on previous initiatives, such as the Cybersecurity Act of 2015 and the National Cybersecurity Protection Act of 2014, which were sponsored by Senator Angus King and Representative Michael McCaul.

Key Initiatives

The Cybersecurity National Action Plan includes several key initiatives, such as the establishment of a Federal Chief Information Security Officer position, which was filled by Gregory Touhill, and the creation of a National Cybersecurity Awareness Campaign, which was launched in partnership with SANS Institute and Cybersecurity and Infrastructure Security Agency. The plan also calls for the development of a Cybersecurity Talent Pipeline, which aims to attract and retain top cybersecurity talent from universities like University of California, Berkeley and Georgia Institute of Technology. Additionally, the plan includes initiatives to enhance cybersecurity research and development, such as the Cybersecurity Research and Development Act, which was sponsored by Senator Mark Warner and Representative Anna Eshoo. The plan also involves collaboration with international partners, including European Union, Canada, and Australia, to address the global nature of cyber threats.

Implementation and Progress

The implementation of the Cybersecurity National Action Plan is being led by the Cybersecurity and Infrastructure Security Agency, which was established in 2018, and is working closely with other federal agencies, including National Security Agency and Federal Bureau of Investigation. The plan's progress is being tracked by the Congressional Oversight Committee, which includes members from House Committee on Homeland Security and Senate Committee on Homeland Security and Governmental Affairs. The plan has also received support from private sector companies, such as Microsoft, Google, and Amazon Web Services, which are providing resources and expertise to support the plan's implementation. The plan's implementation is also being informed by research from think tanks like Center for Strategic and International Studies and Council on Foreign Relations.

Challenges and Criticisms

The implementation of the Cybersecurity National Action Plan faces several challenges, including the need for increased funding and resources, as well as the complexity of cyber threats, which are constantly evolving and becoming more sophisticated. The plan has also been criticized for its lack of concrete metrics and clear timelines, which makes it difficult to measure progress and hold agencies accountable. Additionally, the plan's reliance on private sector partnerships has raised concerns about the potential for conflicts of interest and the need for greater transparency and oversight. The plan has also been criticized by Senator Ron Wyden and Representative Ted Lieu, who have raised concerns about the plan's impact on civil liberties and privacy.

Conclusion

The Cybersecurity National Action Plan is a critical step towards enhancing the nation's cybersecurity posture and protecting against cyber threats. The plan's implementation requires a coordinated effort from federal agencies, private sector companies, and international partners, as well as research institutions like Stanford University and Massachusetts Institute of Technology. While the plan faces several challenges and criticisms, it provides a comprehensive framework for addressing the complex and evolving nature of cyber threats, and its success will depend on the ability of stakeholders to work together to achieve its goals, including National Institute of Standards and Technology, Department of Homeland Security, and Federal Bureau of Investigation. The plan's impact will be felt across various sectors, including finance, healthcare, and energy, and will require ongoing support from Congress, including Senate Committee on Commerce, Science, and Transportation and House Committee on Energy and Commerce. Category:Cybersecurity in the United States