Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

07:55 PM
Connect Directly

White House Cybersecurity Strategy at a Crossroads

Trump administration's initial lack of a unified front in the wake of Russian election-hacking indictments worries cybersecurity experts.

Fallout from a rapid-fire series of developments surrounding the 2016 election hacking and meddling by Russia continued today as President Donald Trump attempted to walk back Monday's public dismissal of his intelligence agencies' findings pointing to Russia.

The chaos from Trump's apparent disconnect with his intelligence officials and others in the administration underscores concerns that the administration's cybersecurity strategy could be unraveling.

The latest chapter began late last Friday with the bombshell federal indictments of 12 Russian military officers for alleged hacking and leaking in an orchestrated effort to tip the scales toward Trump's presidential run by damaging Hillary Clinton's candidacy.

The detailed indictment provided names of the Russians, as well as how they led the hacks of the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online. In addition, they infiltrated the website of a state election board and pilfered information on 500,000 voters as well as breached a software supplier that verifies voter registration information.

But yesterday, after a private meeting with Russian President Vladimir Putin in Helsinki, Trump publicly disputed his own US intel agencies' findings and sided with Putin's denials. After the press conference, Trump's director of national intelligence, Daniel Coats, issued a statement standing by the US intelligence findings. 

Trump attempted a little damage control today back at the White House. But he still stopped short of fully calling out Russia as the perpetrator: Trump said it could also be someone other than Russia behind the election hacks and meddling.

"I have full, great faith in US intelligence," he said after meeting with congressional leaders. "The Russians had no impact at all on the outcome of the election. ... I accept our intelligence community's conclusion that Russia's meddling in the 2016 election took place. Could be other people also."

Trump said he misspoke at one point during the press conference with Putin. He said he actually meant to say the word "wouldn't," not "would," when he stated: "I don't see any reason why it would be Russia" behind the hacks. 

Meanwhile, Trump said the US will "aggressively repeal and repel any efforts to interfere in our elections" and that his administration has taken "strong action to secure our election systems and the process."

The Race is On
Indeed, the US Department of Homeland Security (DHS) has been reaching out to states and other related parties to offer assistance for securing their election systems. But getting all states and municipalities on board with the proper security tools and practices with the nation's disparate election and voting systems is a huge challenge.

"Elections are still very local, the federal government must still be invited to the table, and as a result we have a fractured system that is impossible to secure," says Chris Pierson, CEO of Binary Sun Cyber Risk Advisers. Pierson notes that the priority systems to secure – in tight or pivotal races, for example – will be a moving target from election to election. He says many US election systems and databases already are likely compromised.

But Ron Gula, president of Gula Tech Adventures, says it's not the voting machines he's worried about. He says there are more insidious ways nation-states like Russia could disrupt this election, such as attacking the systems that report voting results to the media. "That could tip an election" with early results that ultimately discourage turnout, he says. And campaign workers are an obvious and easy target for phishing attacks, since their organizations are typically not well-funded and less likely to be able to afford two-factor authentication and other security measures.

The Russian military hacking teams from the GRU also stole more data than they leaked in 2016, including information from the Republication National Committee (RNC) and other targets. They could use the as-yet unknown stolen information, or other hacks, to repeat their previous operation this fall and in future elections, experts say.

Tom Kellermann, chief cybersecurity officer at Carbon Black, expects more Russian cyberattacks if the fall election swings out of Trump's favor and into that of the Democrats'. "Putin will take the gloves off then," he says. "And even if [Russia] feel they are winning, they aren't going to slow their hacking."

Russia's hacking teams already have been spotted in energy networks in the US: The Trump administration in March called out Russia for targeting its power grid. 

The White House cybersecurity coordinator position, which was vacated by former head Rob Joyce in April, was quietly eliminated altogether. Politico in May reported that it had obtained an email to the White House National Security Council staff from John Bolton aide Christine Samuelian that said: "The role of cyber coordinator will end," in an effort to "streamline authority" in the NSC, which includes two senior cybersecurity directors.

Trump's cybersecurity policy hasn't evolved much, and the lack of a cybersecurity coordinator may be partly why, experts say. "I think we really need somebody in there to make sure we have the right technology and approach across all leadership in government – in Congress and major agencies," Gula says.

Kellermann says while the administration still can set cybersecurity policy without someone in that position, having a cybersecurity coordinator can help bridge the various government departments. "A problem in DC is that people don't want to listen to other departments," he says.

Meanwhile, Trump's reluctance to strongly condemn Putin and his GRU for their hacking campaign during the presidential election isn't helping demonstrate a strong cybersecurity front for the US, experts say. That could leave the US vulnerable.

But it appears the key players in the nation's cyber defense aren't getting tripped up by the political battles. According to a report in The Washington Post, Paul Nakasone, director of the NSA and head of the US CyberCommand, already has the two organizations working on fighting back against any Russian cyberattacks on the 2018 election. 

Michael Hayden, a former CIA director and NSA director, says those efforts are not sufficient to protect the US, however. "Nakasone, and the heads of the other three-letter agencies, are doing what they can in their own lanes, absent an overall approach directed by the president," he told the Post. "As good as it is, it's not good enough. This is not a narrowly defined cyberthreat. This is one of the most significant strategic national security threats facing the United States since 9/11."

Editor's Note: Home Page photo credit to Andrew Harnik/AP/Shutterstock

Related Content:



Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
9/20/2019 | 5:26:59 AM
Thanks for your analytics
User Rank: Strategist
7/18/2018 | 11:44:23 AM
Re: Analysis
Russian Hacking has been going on since before Obama and even further. Everyone is listening to everyone elses communications. The NSA is gobbling up everything with SIGINT and OSINT and yet there's still no evidence that the Russian's meddled in the election to an extent that swayed the vote count. The DNC used poor security practices and even gave people with questionable foreign ties access and security clearance to congressional and campaign documentation, and then tried to ccover it up when it became poltically expedient to do so. Saying that there's no clear Cybersecurity plan from Trump is disingenous. Obama administration published the NICE framework as well as other Executive Orders to enhance Cybersecurity and that did little to stop Russian trollls, Bots, etc. Trump published this https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ 

Which more or less says the same thing Obama said in generic terms. The difference is in backing up actual threats with actions. Unless you sit in a SOC, NOC, NSA cell that has direct information on what threats are actually occurring on a daily basis, saying that Trump somehow gave away the keys to the kingdom is flat out false. All that aside, as a security professional, I come to your site to avoid politics, but more and more tech journalists can't help but throw in their political spin. 
User Rank: Strategist
7/18/2018 | 10:03:12 AM
Missing something
I'm missing something in all of this brouhaha and I could be accused of having simple/slow brain:

Where is the specific list of offenses that constitutes this meddling?  If bogus information dissemination is all there is to it, then I suggest the concern might rightly have to do with a society (ours) that has the lost the ability of critical analysis.  If something doesn't read "right", if the first thought "This seems hokey" it just might be.  Hacking I get although I don't get skipping the basics to prevent (patch your servers and desktops, teach people not to click on links in emails, keep following the established approval chain despite a "hair-on-fire" phone call or email from the Big Cheese - always get confirmation).  Fear of Russian meddling might be doing more harm than good.  
User Rank: Strategist
7/18/2018 | 10:01:26 AM
Re: Analysis
I was thinking the same thing.  Where is the proof?  Has anyone ever heard of the enemy within?  And who in the heck was the DEM HQ security hack?  I think they all did this to themselves in case they lost.  Who know, and the lack of direction that Mueller has been bulldogging is not reassuring.  Thanks for putting it down so well.
User Rank: Strategist
7/18/2018 | 9:59:23 AM
Re: White House Cybersecurity Strategy
Thanks for mentioning this technology.  I'll have to look into it.  Sounds interesting
User Rank: Moderator
7/18/2018 | 9:20:08 AM
White House Cybersecurity Strategy
The internet's security is irretrievably insecure. I suggest the US looks at RINA (Recursive InterNetworking Architecture). I have no personal interest in this; I just think it looks as though it should be investigated as a alternative to the current cybersecurity 'patch and pray' philosophy.
User Rank: Strategist
7/18/2018 | 9:12:24 AM
The report which is the basis for the current Russian indictments identifies perpetrators not found in the current list of those indicted.

Mueller was held accountable during the previous round of Russian indictments when one defendant was represented in court and demanded that Mueller produce the evidence of a crime.  He first tried to delay and then produced data that did not contain evidence.

It appears the current list is intended to exclude any Russian who may actually show up in court demanding accountability and so it is difficult to take seriously.

In other words, the basis for this analysis of Cybersecurity performance is based on a political ploy that has already proven worthless when it comes to drawing conclusions.

The fact is that a number of state sponsored attempts including our own are working every minute of every day to gather whatever information can be produced.

In the future let's stick to that and not waste time playing politics.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/7/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
'Unkillable' Android Malware App Continues to Infect Devices Worldwide
Jai Vijayan, Contributing Writer,  4/8/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-09
Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded, le...
PUBLISHED: 2020-04-09
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc__tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to...
PUBLISHED: 2020-04-09
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.
PUBLISHED: 2020-04-09
An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific loc...
PUBLISHED: 2020-04-09
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are u...