Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

07:55 PM
Connect Directly

White House Cybersecurity Strategy at a Crossroads

Trump administration's initial lack of a unified front in the wake of Russian election-hacking indictments worries cybersecurity experts.

Fallout from a rapid-fire series of developments surrounding the 2016 election hacking and meddling by Russia continued today as President Donald Trump attempted to walk back Monday's public dismissal of his intelligence agencies' findings pointing to Russia.

The chaos from Trump's apparent disconnect with his intelligence officials and others in the administration underscores concerns that the administration's cybersecurity strategy could be unraveling.

The latest chapter began late last Friday with the bombshell federal indictments of 12 Russian military officers for alleged hacking and leaking in an orchestrated effort to tip the scales toward Trump's presidential run by damaging Hillary Clinton's candidacy.

The detailed indictment provided names of the Russians, as well as how they led the hacks of the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online. In addition, they infiltrated the website of a state election board and pilfered information on 500,000 voters as well as breached a software supplier that verifies voter registration information.

But yesterday, after a private meeting with Russian President Vladimir Putin in Helsinki, Trump publicly disputed his own US intel agencies' findings and sided with Putin's denials. After the press conference, Trump's director of national intelligence, Daniel Coats, issued a statement standing by the US intelligence findings. 

Trump attempted a little damage control today back at the White House. But he still stopped short of fully calling out Russia as the perpetrator: Trump said it could also be someone other than Russia behind the election hacks and meddling.

"I have full, great faith in US intelligence," he said after meeting with congressional leaders. "The Russians had no impact at all on the outcome of the election. ... I accept our intelligence community's conclusion that Russia's meddling in the 2016 election took place. Could be other people also."

Trump said he misspoke at one point during the press conference with Putin. He said he actually meant to say the word "wouldn't," not "would," when he stated: "I don't see any reason why it would be Russia" behind the hacks. 

Meanwhile, Trump said the US will "aggressively repeal and repel any efforts to interfere in our elections" and that his administration has taken "strong action to secure our election systems and the process."

The Race is On
Indeed, the US Department of Homeland Security (DHS) has been reaching out to states and other related parties to offer assistance for securing their election systems. But getting all states and municipalities on board with the proper security tools and practices with the nation's disparate election and voting systems is a huge challenge.

"Elections are still very local, the federal government must still be invited to the table, and as a result we have a fractured system that is impossible to secure," says Chris Pierson, CEO of Binary Sun Cyber Risk Advisers. Pierson notes that the priority systems to secure – in tight or pivotal races, for example – will be a moving target from election to election. He says many US election systems and databases already are likely compromised.

But Ron Gula, president of Gula Tech Adventures, says it's not the voting machines he's worried about. He says there are more insidious ways nation-states like Russia could disrupt this election, such as attacking the systems that report voting results to the media. "That could tip an election" with early results that ultimately discourage turnout, he says. And campaign workers are an obvious and easy target for phishing attacks, since their organizations are typically not well-funded and less likely to be able to afford two-factor authentication and other security measures.

The Russian military hacking teams from the GRU also stole more data than they leaked in 2016, including information from the Republication National Committee (RNC) and other targets. They could use the as-yet unknown stolen information, or other hacks, to repeat their previous operation this fall and in future elections, experts say.

Tom Kellermann, chief cybersecurity officer at Carbon Black, expects more Russian cyberattacks if the fall election swings out of Trump's favor and into that of the Democrats'. "Putin will take the gloves off then," he says. "And even if [Russia] feel they are winning, they aren't going to slow their hacking."

Russia's hacking teams already have been spotted in energy networks in the US: The Trump administration in March called out Russia for targeting its power grid. 

The White House cybersecurity coordinator position, which was vacated by former head Rob Joyce in April, was quietly eliminated altogether. Politico in May reported that it had obtained an email to the White House National Security Council staff from John Bolton aide Christine Samuelian that said: "The role of cyber coordinator will end," in an effort to "streamline authority" in the NSC, which includes two senior cybersecurity directors.

Trump's cybersecurity policy hasn't evolved much, and the lack of a cybersecurity coordinator may be partly why, experts say. "I think we really need somebody in there to make sure we have the right technology and approach across all leadership in government – in Congress and major agencies," Gula says.

Kellermann says while the administration still can set cybersecurity policy without someone in that position, having a cybersecurity coordinator can help bridge the various government departments. "A problem in DC is that people don't want to listen to other departments," he says.

Meanwhile, Trump's reluctance to strongly condemn Putin and his GRU for their hacking campaign during the presidential election isn't helping demonstrate a strong cybersecurity front for the US, experts say. That could leave the US vulnerable.

But it appears the key players in the nation's cyber defense aren't getting tripped up by the political battles. According to a report in The Washington Post, Paul Nakasone, director of the NSA and head of the US CyberCommand, already has the two organizations working on fighting back against any Russian cyberattacks on the 2018 election. 

Michael Hayden, a former CIA director and NSA director, says those efforts are not sufficient to protect the US, however. "Nakasone, and the heads of the other three-letter agencies, are doing what they can in their own lanes, absent an overall approach directed by the president," he told the Post. "As good as it is, it's not good enough. This is not a narrowly defined cyberthreat. This is one of the most significant strategic national security threats facing the United States since 9/11."

Editor's Note: Home Page photo credit to Andrew Harnik/AP/Shutterstock

Related Content:



Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Strategist
7/18/2018 | 9:12:24 AM
The report which is the basis for the current Russian indictments identifies perpetrators not found in the current list of those indicted.

Mueller was held accountable during the previous round of Russian indictments when one defendant was represented in court and demanded that Mueller produce the evidence of a crime.  He first tried to delay and then produced data that did not contain evidence.

It appears the current list is intended to exclude any Russian who may actually show up in court demanding accountability and so it is difficult to take seriously.

In other words, the basis for this analysis of Cybersecurity performance is based on a political ploy that has already proven worthless when it comes to drawing conclusions.

The fact is that a number of state sponsored attempts including our own are working every minute of every day to gather whatever information can be produced.

In the future let's stick to that and not waste time playing politics.


User Rank: Moderator
7/18/2018 | 9:20:08 AM
White House Cybersecurity Strategy
The internet's security is irretrievably insecure. I suggest the US looks at RINA (Recursive InterNetworking Architecture). I have no personal interest in this; I just think it looks as though it should be investigated as a alternative to the current cybersecurity 'patch and pray' philosophy.
User Rank: Strategist
7/18/2018 | 9:59:23 AM
Re: White House Cybersecurity Strategy
Thanks for mentioning this technology.  I'll have to look into it.  Sounds interesting
User Rank: Strategist
7/18/2018 | 10:01:26 AM
Re: Analysis
I was thinking the same thing.  Where is the proof?  Has anyone ever heard of the enemy within?  And who in the heck was the DEM HQ security hack?  I think they all did this to themselves in case they lost.  Who know, and the lack of direction that Mueller has been bulldogging is not reassuring.  Thanks for putting it down so well.
User Rank: Strategist
7/18/2018 | 10:03:12 AM
Missing something
I'm missing something in all of this brouhaha and I could be accused of having simple/slow brain:

Where is the specific list of offenses that constitutes this meddling?  If bogus information dissemination is all there is to it, then I suggest the concern might rightly have to do with a society (ours) that has the lost the ability of critical analysis.  If something doesn't read "right", if the first thought "This seems hokey" it just might be.  Hacking I get although I don't get skipping the basics to prevent (patch your servers and desktops, teach people not to click on links in emails, keep following the established approval chain despite a "hair-on-fire" phone call or email from the Big Cheese - always get confirmation).  Fear of Russian meddling might be doing more harm than good.  
User Rank: Strategist
7/18/2018 | 11:44:23 AM
Re: Analysis
Russian Hacking has been going on since before Obama and even further. Everyone is listening to everyone elses communications. The NSA is gobbling up everything with SIGINT and OSINT and yet there's still no evidence that the Russian's meddled in the election to an extent that swayed the vote count. The DNC used poor security practices and even gave people with questionable foreign ties access and security clearance to congressional and campaign documentation, and then tried to ccover it up when it became poltically expedient to do so. Saying that there's no clear Cybersecurity plan from Trump is disingenous. Obama administration published the NICE framework as well as other Executive Orders to enhance Cybersecurity and that did little to stop Russian trollls, Bots, etc. Trump published this https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ 

Which more or less says the same thing Obama said in generic terms. The difference is in backing up actual threats with actions. Unless you sit in a SOC, NOC, NSA cell that has direct information on what threats are actually occurring on a daily basis, saying that Trump somehow gave away the keys to the kingdom is flat out false. All that aside, as a security professional, I come to your site to avoid politics, but more and more tech journalists can't help but throw in their political spin. 
User Rank: Apprentice
9/20/2019 | 5:26:59 AM
Thanks for your analytics
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused att...
PUBLISHED: 2021-05-16
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the othe...
PUBLISHED: 2021-05-16
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
PUBLISHED: 2021-05-16
Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
PUBLISHED: 2021-05-16
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.