Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

07:55 PM
Connect Directly

White House Cybersecurity Strategy at a Crossroads

Trump administration's initial lack of a unified front in the wake of Russian election-hacking indictments worries cybersecurity experts.

Fallout from a rapid-fire series of developments surrounding the 2016 election hacking and meddling by Russia continued today as President Donald Trump attempted to walk back Monday's public dismissal of his intelligence agencies' findings pointing to Russia.

The chaos from Trump's apparent disconnect with his intelligence officials and others in the administration underscores concerns that the administration's cybersecurity strategy could be unraveling.

The latest chapter began late last Friday with the bombshell federal indictments of 12 Russian military officers for alleged hacking and leaking in an orchestrated effort to tip the scales toward Trump's presidential run by damaging Hillary Clinton's candidacy.

The detailed indictment provided names of the Russians, as well as how they led the hacks of the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online. In addition, they infiltrated the website of a state election board and pilfered information on 500,000 voters as well as breached a software supplier that verifies voter registration information.

But yesterday, after a private meeting with Russian President Vladimir Putin in Helsinki, Trump publicly disputed his own US intel agencies' findings and sided with Putin's denials. After the press conference, Trump's director of national intelligence, Daniel Coats, issued a statement standing by the US intelligence findings. 

Trump attempted a little damage control today back at the White House. But he still stopped short of fully calling out Russia as the perpetrator: Trump said it could also be someone other than Russia behind the election hacks and meddling.

"I have full, great faith in US intelligence," he said after meeting with congressional leaders. "The Russians had no impact at all on the outcome of the election. ... I accept our intelligence community's conclusion that Russia's meddling in the 2016 election took place. Could be other people also."

Trump said he misspoke at one point during the press conference with Putin. He said he actually meant to say the word "wouldn't," not "would," when he stated: "I don't see any reason why it would be Russia" behind the hacks. 

Meanwhile, Trump said the US will "aggressively repeal and repel any efforts to interfere in our elections" and that his administration has taken "strong action to secure our election systems and the process."

The Race is On
Indeed, the US Department of Homeland Security (DHS) has been reaching out to states and other related parties to offer assistance for securing their election systems. But getting all states and municipalities on board with the proper security tools and practices with the nation's disparate election and voting systems is a huge challenge.

"Elections are still very local, the federal government must still be invited to the table, and as a result we have a fractured system that is impossible to secure," says Chris Pierson, CEO of Binary Sun Cyber Risk Advisers. Pierson notes that the priority systems to secure – in tight or pivotal races, for example – will be a moving target from election to election. He says many US election systems and databases already are likely compromised.

But Ron Gula, president of Gula Tech Adventures, says it's not the voting machines he's worried about. He says there are more insidious ways nation-states like Russia could disrupt this election, such as attacking the systems that report voting results to the media. "That could tip an election" with early results that ultimately discourage turnout, he says. And campaign workers are an obvious and easy target for phishing attacks, since their organizations are typically not well-funded and less likely to be able to afford two-factor authentication and other security measures.

The Russian military hacking teams from the GRU also stole more data than they leaked in 2016, including information from the Republication National Committee (RNC) and other targets. They could use the as-yet unknown stolen information, or other hacks, to repeat their previous operation this fall and in future elections, experts say.

Tom Kellermann, chief cybersecurity officer at Carbon Black, expects more Russian cyberattacks if the fall election swings out of Trump's favor and into that of the Democrats'. "Putin will take the gloves off then," he says. "And even if [Russia] feel they are winning, they aren't going to slow their hacking."

Russia's hacking teams already have been spotted in energy networks in the US: The Trump administration in March called out Russia for targeting its power grid. 

The White House cybersecurity coordinator position, which was vacated by former head Rob Joyce in April, was quietly eliminated altogether. Politico in May reported that it had obtained an email to the White House National Security Council staff from John Bolton aide Christine Samuelian that said: "The role of cyber coordinator will end," in an effort to "streamline authority" in the NSC, which includes two senior cybersecurity directors.

Trump's cybersecurity policy hasn't evolved much, and the lack of a cybersecurity coordinator may be partly why, experts say. "I think we really need somebody in there to make sure we have the right technology and approach across all leadership in government – in Congress and major agencies," Gula says.

Kellermann says while the administration still can set cybersecurity policy without someone in that position, having a cybersecurity coordinator can help bridge the various government departments. "A problem in DC is that people don't want to listen to other departments," he says.

Meanwhile, Trump's reluctance to strongly condemn Putin and his GRU for their hacking campaign during the presidential election isn't helping demonstrate a strong cybersecurity front for the US, experts say. That could leave the US vulnerable.

But it appears the key players in the nation's cyber defense aren't getting tripped up by the political battles. According to a report in The Washington Post, Paul Nakasone, director of the NSA and head of the US CyberCommand, already has the two organizations working on fighting back against any Russian cyberattacks on the 2018 election. 

Michael Hayden, a former CIA director and NSA director, says those efforts are not sufficient to protect the US, however. "Nakasone, and the heads of the other three-letter agencies, are doing what they can in their own lanes, absent an overall approach directed by the president," he told the Post. "As good as it is, it's not good enough. This is not a narrowly defined cyberthreat. This is one of the most significant strategic national security threats facing the United States since 9/11."

Editor's Note: Home Page photo credit to Andrew Harnik/AP/Shutterstock

Related Content:



Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
9/20/2019 | 5:26:59 AM
Thanks for your analytics
User Rank: Strategist
7/18/2018 | 11:44:23 AM
Re: Analysis
Russian Hacking has been going on since before Obama and even further. Everyone is listening to everyone elses communications. The NSA is gobbling up everything with SIGINT and OSINT and yet there's still no evidence that the Russian's meddled in the election to an extent that swayed the vote count. The DNC used poor security practices and even gave people with questionable foreign ties access and security clearance to congressional and campaign documentation, and then tried to ccover it up when it became poltically expedient to do so. Saying that there's no clear Cybersecurity plan from Trump is disingenous. Obama administration published the NICE framework as well as other Executive Orders to enhance Cybersecurity and that did little to stop Russian trollls, Bots, etc. Trump published this https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ 

Which more or less says the same thing Obama said in generic terms. The difference is in backing up actual threats with actions. Unless you sit in a SOC, NOC, NSA cell that has direct information on what threats are actually occurring on a daily basis, saying that Trump somehow gave away the keys to the kingdom is flat out false. All that aside, as a security professional, I come to your site to avoid politics, but more and more tech journalists can't help but throw in their political spin. 
User Rank: Strategist
7/18/2018 | 10:03:12 AM
Missing something
I'm missing something in all of this brouhaha and I could be accused of having simple/slow brain:

Where is the specific list of offenses that constitutes this meddling?  If bogus information dissemination is all there is to it, then I suggest the concern might rightly have to do with a society (ours) that has the lost the ability of critical analysis.  If something doesn't read "right", if the first thought "This seems hokey" it just might be.  Hacking I get although I don't get skipping the basics to prevent (patch your servers and desktops, teach people not to click on links in emails, keep following the established approval chain despite a "hair-on-fire" phone call or email from the Big Cheese - always get confirmation).  Fear of Russian meddling might be doing more harm than good.  
User Rank: Strategist
7/18/2018 | 10:01:26 AM
Re: Analysis
I was thinking the same thing.  Where is the proof?  Has anyone ever heard of the enemy within?  And who in the heck was the DEM HQ security hack?  I think they all did this to themselves in case they lost.  Who know, and the lack of direction that Mueller has been bulldogging is not reassuring.  Thanks for putting it down so well.
User Rank: Strategist
7/18/2018 | 9:59:23 AM
Re: White House Cybersecurity Strategy
Thanks for mentioning this technology.  I'll have to look into it.  Sounds interesting
User Rank: Moderator
7/18/2018 | 9:20:08 AM
White House Cybersecurity Strategy
The internet's security is irretrievably insecure. I suggest the US looks at RINA (Recursive InterNetworking Architecture). I have no personal interest in this; I just think it looks as though it should be investigated as a alternative to the current cybersecurity 'patch and pray' philosophy.
User Rank: Strategist
7/18/2018 | 9:12:24 AM
The report which is the basis for the current Russian indictments identifies perpetrators not found in the current list of those indicted.

Mueller was held accountable during the previous round of Russian indictments when one defendant was represented in court and demanded that Mueller produce the evidence of a crime.  He first tried to delay and then produced data that did not contain evidence.

It appears the current list is intended to exclude any Russian who may actually show up in court demanding accountability and so it is difficult to take seriously.

In other words, the basis for this analysis of Cybersecurity performance is based on a political ploy that has already proven worthless when it comes to drawing conclusions.

The fact is that a number of state sponsored attempts including our own are working every minute of every day to gather whatever information can be produced.

In the future let's stick to that and not waste time playing politics.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.