Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/7/2013
04:41 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

White House Proposes Cybersecurity Insurance, Other Incentives For Executive Order

Goal is to provide financial and other perks for participation in voluntary cybersecurity framework

A nagging question surrounding the Executive Order to beef up the security of the nation's critical infrastructure has been how the Obama administration would incentivize organizations to adopt the voluntary framework and participate in threat information-sharing. The White House yesterday answered that, spelling out several proposed incentives on the table for those who adopt the upcoming cybersecurity practices that will be mapped out in a framework currently under development.

Michael Daniel, special assistant to the president and cybersecurity coordinator, said the White House gathered recommendations from the Departments of Homeland Security, Commerce, and Treasury, and came up with these proposed incentives: cybersecurity insurance, federal grants, preference in technical assistance, liability limitation, streamlining with existing regulations and laws, optional public recognition, rate recovery for price-regulated industries, and cybersecurity research for future security issues.

"Over the next few months, agencies will examine these options in detail to determine which ones to adopt and how, based substantially on input from critical infrastructure stakeholders," Daniel said in a blog post, noting that this is preliminary report does not represent the final policy of the administration. "We believe that sharing the findings and our plans for continued work will promote transparency and sustain a public conversation about the recommendations."

The goal is to provide organizations with some financial and other incentives to justify investing in new technologies and practices under the voluntary framework. "Some of the recommended incentives can be put in place quickly under existing authorities after the Voluntary Program is established. Others would require legislative action and additional maturation of the Cybersecurity Framework and Voluntary Program, along with further analysis and dialogue between the Administration, Congress, and private sector stakeholders," he said. "We are currently working with the appropriate agencies to prioritize each incentive area and move forward."

One of the more intriguing incentives, security experts say, is the one that brings the insurance industry into the equation. Daniel explained it as a way "to build underwriting practices that promote the adoption of cyber risk-reducing measures and risk-based pricing and foster a competitive cyber insurance market. The Commerce Department’s National Institute of Standards and Technology is taking steps to engage the insurance industry in further discussion on the Framework," he said in his blog post.

[Michael Daniel says President Obama's Executive Order on Cybersecurity sets the stage for cybersecurity legislation for protecting critical infrastructure. See White House Cybersecurity Czar: New Executive Order A 'Down Payment'.]

The National Institute of Standards and Technology (NIST) last month held its third workshop on crafting the cybersecurity framework. The voluntary framework is being hashed out by participating critical infrastructure operators and owners, security experts, and others under the leadership of NIST. It's scheduled to be published in draft form in October and finalized in February of 2014.

The framework thus far is centered around five security functions: know, prevent, detect, respond and recover, notes Stephen Cobb, security evangelist for Eset, which is participating in the NIST workshops to build the framework. Cobb recently blogged about the July workshop .

Meanwhile, incentives are key to getting organizations to adopt the framework, experts say. The Obama administration's outline of incentives is a major step there, they say.

"I think it's one of the most positive things to come out of the EO and actually creates some motivation for companies to think about the voluntary framework," says Mark Weatherford, principal with The Chertoff Group. "The kind of incentives identified actually go farther than I've seen in the past which is very good news."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
oneilldon
50%
50%
oneilldon,
User Rank: Guru
8/8/2013 | 7:07:35 PM
re: White House Proposes Cybersecurity Insurance, Other Incentives For Executive Order
Just as the emphasis on reputation, economics, mission, and competitiveness varies among government, critical infrastructure, defense industrial base, and commercial industry partners, so does the range of tolerance for risk and regulation. Consequently, the public policy measures needed to promote the public good must be tailored and harmonized among these diverse interest.

The NIST Workshops on the Cyber Security Framework are revealing an underlying reluctance to harmonize standards associated with resistance to regulation. Here there are trust issues associated with the commitment to voluntary compliance. Beyond that Congress is split on what kind and whether incentives should be offered especially on indemnification of liability.

And then there is the issue of moral hazard faced by industry participants. If they know of threats and risks and don't act on behalf of their customers and the public, there are consequences.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...