04:41 PM
Connect Directly
Repost This

White House Proposes Cybersecurity Insurance, Other Incentives For Executive Order

Goal is to provide financial and other perks for participation in voluntary cybersecurity framework

A nagging question surrounding the Executive Order to beef up the security of the nation's critical infrastructure has been how the Obama administration would incentivize organizations to adopt the voluntary framework and participate in threat information-sharing. The White House yesterday answered that, spelling out several proposed incentives on the table for those who adopt the upcoming cybersecurity practices that will be mapped out in a framework currently under development.

Michael Daniel, special assistant to the president and cybersecurity coordinator, said the White House gathered recommendations from the Departments of Homeland Security, Commerce, and Treasury, and came up with these proposed incentives: cybersecurity insurance, federal grants, preference in technical assistance, liability limitation, streamlining with existing regulations and laws, optional public recognition, rate recovery for price-regulated industries, and cybersecurity research for future security issues.

"Over the next few months, agencies will examine these options in detail to determine which ones to adopt and how, based substantially on input from critical infrastructure stakeholders," Daniel said in a blog post, noting that this is preliminary report does not represent the final policy of the administration. "We believe that sharing the findings and our plans for continued work will promote transparency and sustain a public conversation about the recommendations."

The goal is to provide organizations with some financial and other incentives to justify investing in new technologies and practices under the voluntary framework. "Some of the recommended incentives can be put in place quickly under existing authorities after the Voluntary Program is established. Others would require legislative action and additional maturation of the Cybersecurity Framework and Voluntary Program, along with further analysis and dialogue between the Administration, Congress, and private sector stakeholders," he said. "We are currently working with the appropriate agencies to prioritize each incentive area and move forward."

One of the more intriguing incentives, security experts say, is the one that brings the insurance industry into the equation. Daniel explained it as a way "to build underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing and foster a competitive cyber insurance market. The Commerce Department’s National Institute of Standards and Technology is taking steps to engage the insurance industry in further discussion on the Framework," he said in his blog post.

[Michael Daniel says President Obama's Executive Order on Cybersecurity sets the stage for cybersecurity legislation for protecting critical infrastructure. See White House Cybersecurity Czar: New Executive Order A 'Down Payment'.]

The National Institute of Standards and Technology (NIST) last month held its third workshop on crafting the cybersecurity framework. The voluntary framework is being hashed out by participating critical infrastructure operators and owners, security experts, and others under the leadership of NIST. It's scheduled to be published in draft form in October and finalized in February of 2014.

The framework thus far is centered around five security functions: know, prevent, detect, respond and recover, notes Stephen Cobb, security evangelist for Eset, which is participating in the NIST workshops to build the framework. Cobb recently blogged about the July workshop .

Meanwhile, incentives are key to getting organizations to adopt the framework, experts say. The Obama administration's outline of incentives is a major step there, they say.

"I think it's one of the most positive things to come out of the EO and actually creates some motivation for companies to think about the voluntary framework," says Mark Weatherford, principal with The Chertoff Group. "The kind of incentives identified actually go farther than I've seen in the past which is very good news."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/8/2013 | 7:07:35 PM
re: White House Proposes Cybersecurity Insurance, Other Incentives For Executive Order
Just as the emphasis on reputation, economics, mission, and competitiveness varies among government, critical infrastructure, defense industrial base, and commercial industry partners, so does the range of tolerance for risk and regulation. Consequently, the public policy measures needed to promote the public good must be tailored and harmonized among these diverse interest.

The NIST Workshops on the Cyber Security Framework are revealing an underlying reluctance to harmonize standards associated with resistance to regulation. Here there are trust issues associated with the commitment to voluntary compliance. Beyond that Congress is split on what kind and whether incentives should be offered especially on indemnification of liability.

And then there is the issue of moral hazard faced by industry participants. If they know of threats and risks and don't act on behalf of their customers and the public, there are consequences.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web