Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

House OKs Cybersecurity Reforms

Bill calls for creation of a permanent National Office for Cyberspace and Office of the Federal Chief Technology Officer within the White House

The House of Representatives has passed a bill that would update the federal government's cybersecurity requirements and create a permanent cybersecurity office within the White House, putting some long-sought reforms closer to passage.

The reforms were passed as an amendment offered by Rep. Jim Langevin (D-R.I.) and Dianne Watson (D-Calif.) that made its way into the annual defense spending bill, the National Defense Authorization Act for Fiscal Year 2011. The defense authorization bill passed the House on Friday by a 229-186 vote.

The Senate version of the bill, which passed the Senate Armed Services Committee last week, does not currently contain the Watson-Langevin amendment or similar provisions, but that could change before the vote on the Senate floor. Any differences would be reconciled in conference before the bill is sent to President Obama to sign.

The most wide-ranging changes of the amendment, which combines legislation offered earlier this session by Langevin and Watson, include creating a permanent National Office for Cyberspace and Office of the Federal Chief Technology Officer within the White House, giving both the director of the National Office for Cyberspace and the federal CTO specific responsibilities, and adding new cybersecurity requirements for agencies in areas like acquisition, budgeting, and actually securing IT systems.

"The passage of this amendment comes after a great deal of work to raise awareness about the cyber vulnerabilities that exist throughout our federal government," Langevin, co-chair of the House Cybersecurity Caucus, said in a statement. "These provisions will establish strong, centralized oversight to protect our nation's critical information infrastructure and update our comprehensive policy for operating in cyberspace."

The National Office for Cyberspace -- the "principal office for coordinating" cybersecurity issues in government, according to the amendment, would include a director, appointed by the President and confirmed by the Senate, who would develop and oversee implementation of cybersecurity policies, principles, and standards.

The role of the director would be somewhat analogous to that of the current White House cybersecurity coordinator, Howard Schmidt, but arguably with more power. The director would be vested with authority to require agencies to identify and provide cybersecurity protections at a level commensurate with risk, establish an international cybersecurity strategy, coordinate development of standards for national security systems, and help coordinate secure acquisition policies. Like Schmidt's position, the director would not have budget authority, though agencies would have to send their cybersecurity budgets to the cyberspace office.

The director and agencies would be advised by a Federal Cybersecurity Practice Board containing 10 or fewer members, including representatives from certain agencies. The board would develop and update IT security policies and procedures like minimum security controls, measures of effectiveness, criteria for products and services to meet minimum security controls, and remedies for agencies' security deficiencies.

The creation of a permanent federal CTO position seems to blur the lines of roles currently filled by federal CIO Vivek Kundra and federal CTO Aneesh Chopra. The new official would advise the president, agencies, and CIOs and CTOs on IT issues including budget issues; lead interagency IT planning efforts; establish public-private partnerships to "achieve knowledge of tech available to be used for improving government operations and information technology research and development activities"; recommend federal IT policies; and publish an annual report about the state of federal IT.

Another significant change in the bill is the replacement of a requirement for "periodic testing" of cybersecurity, found in old legislative language, to automated and continuous monitoring to ensure cybersecurity controls are properly implemented and effective.

The amendment also requires creation of new guidance to ensure sufficient training and qualifications of officials with significant cybersecurity duties; the formal designation of a senior agency official as a CISO, rather than simply designating a senior agency official who will take on cybersecurity responsibilities; the addition of formal compliance assessment and operational cybersecurity roles for CISOs; development of secure acquisition policies; and a requirement to send to Congress initial vulnerability assessments of any new major systems that agencies plan to deploy.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...