The Biden administration issues a national cybersecurity strategy, seeking to impose minimum standards, shift responsibility to larger software makers, and more

CyberScoop :

CyberScoop 2023-03-03

Context & Ripple Effects

The administration had already begun tying software-security expectations to federal vendors through a 2021 executive order on cybersecurity standards. Related coverage then described a broader move away from voluntary corporate cooperation toward minimum standards and stronger oversight.

The national strategy extends that policy direction beyond a federal-vendor initiative by placing more responsibility on larger software makers. It matters because it frames insecure software as a producer-side obligation rather than solely an end user’s risk to manage.

First-order effects

Larger software makers face a clearer policy expectation to bear more of the responsibility for preventing and mitigating vulnerabilities, alongside prospective minimum security standards.
Organizations buying and operating software gain a federal strategy that favors baseline protections over reliance on vendors’ voluntary security commitments.

Second-order effects

Software vendors’ security practices become a more central competitive and procurement issue as purchasers can compare products against emerging baseline expectations.
The shift from voluntary cooperation to oversight raises the compliance burden most directly for larger producers, potentially widening the gap between firms with established security programs and those without them.

Third-order effects

If minimum standards become durable policy, cybersecurity governance shifts toward assigning liability and security duties across the software supply chain rather than treating breaches primarily as the customer’s problem.
The strategy signals a longer-running federal role in defining software security baselines, with implementation choices determining how broadly that role reaches beyond government procurement.

The trend: US cybersecurity policy is moving from voluntary corporate commitments toward baseline standards and greater producer responsibility for software risk.

Discussion

@k8em0 @k8em0 on x
Today @WhiteHouse & @ONCD released the National CyberSecurity Strategy Important shifts: - Rebalancing responsibility to defend cyberspace to those most capable of defense (incl Software liability) - Realigning incentives to favor long term investments https://www.whitehouse.gov/…
@ericgeller Eric Geller on x
The Biden administration this morning released its long-awaited National Cybersecurity Strategy: https://www.whitehouse.gov/... Major proposals include: * New critical infrastructure regulatory authority * Liability for software vendors * Limits on private-sector data collection …
@oncd @oncd on x
Today @POTUS released the Administration's National Cybersecurity Strategy. This Strategy fundamentally reimagines America's cyber social contract and establishes an affirmative, values-driven vision for a secure cyberspace. https://www.whitehouse.gov/...
@tonyajoriley Tonya Riley on x
For my privacy folks the National Cyber Strategy has something for you too! Biden once again calls for federal privacy legislation and makes it clear that security by design means collecting less data https://cyberscoop.com/... https://twitter.com/...
@kembawalden46 Kemba Walden on x
As the Acting National Cyber Director, I'm proud to share that the Biden-Harris Administration has released the National Cybersecurity Strategy to secure the full benefits of a safe and secure digital ecosystem for all Americans. https://www.whitehouse.gov/...
@mandiant @mandiant on x
Mandiant supports the private-public partnership model as outlined in the National Strategy to help resource-restricted sectors and entities defend themselves. We see this as an opportunity to better align our collective defense to the threats facing us. https://www.csis.org/...
@nsa_csdirector Rob Joyce on x
The National Cyber Strategy enables our collective work to defend cyberspace, disrupt threat actors, defeat ransomware, and invest in a resilient future - while supporting partnerships that work across the public and private sectors. @NSACyber is proud of the team. https://twitte…
@gerryconnolly Rep. Gerry Connolly on x
This is a forward-looking, whole-of-government approach to cybersecurity. @POTUS understands that the nature of the 21st Century threat landscape demands strong, proactive leadership from the federal government, and that's what he has delivered. https://www.whitehouse.gov/...
@juliettekayyem Juliette Kayyem on x
One way to frame the new Cybersecurity Strategy is how its been guided by the Colonial Pipeline ransomware attack in 2021. The company had not isolated its operations technology nor had it planned any response, so when the attack occurred it had to shut down for a week. 1/ https:…
@kaylintrychon @kaylintrychon on x
Glad to see the @WhiteHouse National Cyber Strategy out in the 🌎. A lot of collaboration and effort went into developing this and i'm hopeful for how it will guide security outcomes in the near and long term. https://www.whitehouse.gov/...
@usambnato Ambassador Julianne Smith on x
Great to welcome @ncfick, Ambassador at Large for Cyberspace & Digital Policy @StateCDP, to @NATO - especially as the new U.S. cybersecurity strategy was just released today. https://www.whitehouse.gov/... https://twitter.com/...
@c_painter Chris Painter on x
I've worked on many #cybersecurity strategies over 20 yrs, and this new WH one is very strong & forward leaning. Strong endorsement & articulation of norms, accountability & intl engagement; finally recognizing need for smart regulation for CI ... https://www.whitehouse.gov/...
@tonyajoriley Tonya Riley on x
A round-up of the National Cyber Strategy for the digital identity crowd: -Gov will “encourage and enable” investment -Big emphasis on vendor choice, security, privacy, equity, accessibility -encourages same focus for states piloting mobile driver's licenses -more NIST research
@wavesblog @wavesblog on x
“The move to establish minimum standards builds on efforts in recent decades to write minimum security standards, especially in the energy industry, and Thursday's document makes clear that similar measures are coming for other critical infrastructure sectors” https://twitter.com…
@ericgeller Eric Geller on x
The strategy is divided into five pillars (see screenshot in previous tweet) and emphasizes two major societal and policy shifts: 1. Shifting burden for security away onto “most capable and best-positioned actors” 2. Investing in long-term resilience w/ regs, incentives, R&D http…
@nicolesganga Nicole Sganga on x
In a real pivot, the Biden administration lays out a cybersecurity strategy that goes beyond traditional, voluntary means of information sharing and public-private partnership and onto regulations within critical sectors “that level the playing field.” https://www.cbsnews.com/...
@nicolesganga Nicole Sganga on x
NEW: The White House has unveiled its long-awaited national cybersecurity strategy. Calling for comprehensive regulation, the 38-page blueprint elevates criminal ransomware attacks on critical infrastructure to matters of national security. https://www.cbsnews.com/...
@joeconsorti @joeconsorti on x
There was a gaping $1.8 billion hole in Binance's balance sheet where there should have been USDC collateral. By the way, it has over 90 other “B-tokens” that it issues and collateralizes with the underlying crypto, all of which are susceptible to this same rehypothecation. https…
@shashj Shashank Joshi on x
New US cyber strategy “endorses more aggressive action to disrupt malicious hackers, an area of concentration for the Trump administration, which authorized Cyber Command to more freely undertake offensive missions in cyberspace.” https://www.washingtonpost.com/ ... https://twitt…
@campuscodi Catalin Cimpanu on x
The White House's long-awaited National Cybersecurity Strategy is out: https://www.whitehouse.gov/... Actual document PDF: https://www.whitehouse.gov/... Live stream with the announcement later today: https://www.youtube.com/... https://twitter.com/...
@autismcapital @autismcapital on x
ICYMI: The establishment pressure on Binance intensifies. Forbes reports that Binance *possibly* engaged in monkey business by quietly moving $1.8B of collateral meant to back its customer's stablecoin deposits to be sent to hedge funds; including Alameda https://www.forbes.com/.…

Chronicles