White House Cybersecurity Strategy at a Crossroads

Fallout from a rapid-fire series of developments surrounding the 2016 election hacking and meddling by Russia continued today as President Donald Trump attempted to walk back Monday's public dismissal of his intelligence agencies' findings pointing to Russia.

The chaos from Trump's apparent disconnect with his intelligence officials and others in the administration underscores concerns that the administration's cybersecurity strategy could be unraveling.

The latest chapter began late last Friday with the bombshell federal indictments of 12 Russian military officers for alleged hacking and leaking in an orchestrated effort to tip the scales toward Trump's presidential run by damaging Hillary Clinton's candidacy.

The detailed indictment provided names of the Russians, as well as how they led the hacks of the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online. In addition, they infiltrated the website of a state election board and pilfered information on 500,000 voters as well as breached a software supplier that verifies voter registration information.

But yesterday, after a private meeting with Russian President Vladimir Putin in Helsinki, Trump publicly disputed his own US intel agencies' findings and sided with Putin's denials. After the press conference, Trump's director of national intelligence, Daniel Coats, issued a statement standing by the US intelligence findings. 

Trump attempted a little damage control today back at the White House. But he still stopped short of fully calling out Russia as the perpetrator: Trump said it could also be someone other than Russia behind the election hacks and meddling.

"I have full, great faith in US intelligence," he said after meeting with congressional leaders. "The Russians had no impact at all on the outcome of the election. ... I accept our intelligence community's conclusion that Russia's meddling in the 2016 election took place. Could be other people also."

Trump said he misspoke at one point during the press conference with Putin. He said he actually meant to say the word "wouldn't," not "would," when he stated: "I don't see any reason why it would be Russia" behind the hacks. 

Meanwhile, Trump said the US will "aggressively repeal and repel any efforts to interfere in our elections" and that his administration has taken "strong action to secure our election systems and the process."

The Race is On
Indeed, the US Department of Homeland Security (DHS) has been reaching out to states and other related parties to offer assistance for securing their election systems. But getting all states and municipalities on board with the proper security tools and practices with the nation's disparate election and voting systems is a huge challenge.

"Elections are still very local, the federal government must still be invited to the table, and as a result we have a fractured system that is impossible to secure," says Chris Pierson, CEO of Binary Sun Cyber Risk Advisers. Pierson notes that the priority systems to secure – in tight or pivotal races, for example – will be a moving target from election to election. He says many US election systems and databases already are likely compromised.

But Ron Gula, president of Gula Tech Adventures, says it's not the voting machines he's worried about. He says there are more insidious ways nation-states like Russia could disrupt this election, such as attacking the systems that report voting results to the media. "That could tip an election" with early results that ultimately discourage turnout, he says. And campaign workers are an obvious and easy target for phishing attacks, since their organizations are typically not well-funded and less likely to be able to afford two-factor authentication and other security measures.

The Russian military hacking teams from the GRU also stole more data than they leaked in 2016, including information from the Republication National Committee (RNC) and other targets. They could use the as-yet unknown stolen information, or other hacks, to repeat their previous operation this fall and in future elections, experts say.

Tom Kellermann, chief cybersecurity officer at Carbon Black, expects more Russian cyberattacks if the fall election swings out of Trump's favor and into that of the Democrats'. "Putin will take the gloves off then," he says. "And even if [Russia] feel they are winning, they aren't going to slow their hacking."

Russia's hacking teams already have been spotted in energy networks in the US: The Trump administration in March called out Russia for targeting its power grid. 

The White House cybersecurity coordinator position, which was vacated by former head Rob Joyce in April, was quietly eliminated altogether. Politico in May reported that it had obtained an email to the White House National Security Council staff from John Bolton aide Christine Samuelian that said: "The role of cyber coordinator will end," in an effort to "streamline authority" in the NSC, which includes two senior cybersecurity directors.

Trump's cybersecurity policy hasn't evolved much, and the lack of a cybersecurity coordinator may be partly why, experts say. "I think we really need somebody in there to make sure we have the right technology and approach across all leadership in government – in Congress and major agencies," Gula says.

Kellermann says while the administration still can set cybersecurity policy without someone in that position, having a cybersecurity coordinator can help bridge the various government departments. "A problem in DC is that people don't want to listen to other departments," he says.

Meanwhile, Trump's reluctance to strongly condemn Putin and his GRU for their hacking campaign during the presidential election isn't helping demonstrate a strong cybersecurity front for the US, experts say. That could leave the US vulnerable.

But it appears the key players in the nation's cyber defense aren't getting tripped up by the political battles. According to a report in The Washington Post, Paul Nakasone, director of the NSA and head of the US CyberCommand, already has the two organizations working on fighting back against any Russian cyberattacks on the 2018 election. 

Michael Hayden, a former CIA director and NSA director, says those efforts are not sufficient to protect the US, however. "Nakasone, and the heads of the other three-letter agencies, are doing what they can in their own lanes, absent an overall approach directed by the president," he told the Post. "As good as it is, it's not good enough. This is not a narrowly defined cyberthreat. This is one of the most significant strategic national security threats facing the United States since 9/11."

Editor's Note: Home Page photo credit to Andrew Harnik/AP/Shutterstock

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.