Seeing a data breach mentioned in the news from time to time for companies like Facebook has become commonplace. But often, it’s not something that may directly impact us in a tangible way.
watch short video > https://youtu.be/5E6X0WtAfM0
However, this year has seen a major increase in cyberattacks and those that can directly impact millions of people.
Two recent examples were the ransomware attacks on Colonial Pipeline and JBS (the world’s largest supplier of beef and pork). The Colonial breach caused major gas shortages across the East Coast and impacted just about every American’s wallet as they filled up their gas tanks. The national average price for a gallon of gas rose past the $3.00 mark, higher than it had been in over a decade!
The attack on food supplier JBS, impacted more than just the U.S., with plant closures happening in multiple countries, and restaurants in the U.S. complaining about higher-priced meat products.
This increase in cybersecurity risk has prompted a major announcement by the White House. In May, it issued an executive order to improve the nation’s cybersecurity as a whole.
This was one of the most detailed executive orders of its kind and it’s based on the concept that everyone – government and private sector organizations – must work together to take bold steps to improve national IT security.
One of the opening statements of the executive order that sums up this basis is:
“Protecting our Nation from malicious cyber actors requires the Federal Government to partner with the private sector. The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace.”
We’ll give you an overview of the basics of this 34-page “Executive Order on Improving the Nation’s Cybersecurity” and what you can glean from this to improve your own network security infrastructure.
Key Points of the Executive Order on Cybersecurity
Section 1: Policy (Prevent, Detect, Assess, Remediate)
This establishes that a national policy be put in place that emphasizes the prevention, detection, assessment, and remediation of cyber incidents as a top priority. It also makes the connection between cybersecurity and economic security for the nation.
Companies looking for a good place to begin their IT security strategy can look to this: Prevent, Detect, Assess, Remediate model, which covers the basics of good cyber hygiene from A to Z.
Section 2: Removing Barriers to Sharing Threat Information
When one contactor or cloud software provider doesn’t share threat information with others, it can lead to increased risk. This is being addressed in this second section, which includes a requirement for information sharing by government vendors for any threat information.
When you’re putting together your own cybersecurity systems, think about having a “single pane of glass” when it comes to monitoring and threat detection for all your different systems, which improves the chance of threats being addressed right away.
Section 3: Modernizing the Federal Government Cybersecurity
To keep up with evolving and ever more sophisticated threats, the federal government is modernizing its cybersecurity infrastructure.
This includes a move to a zero-trust approach, which includes important safeguards like multi-factor authentication, safe listing, and other protections.
Zero-trust is an approach that can be used by any size business and is the way that you should frame your IT security if you want to stay protected against the modern attacks happening today.
Section 4: Enhancing Software Supply Chain Security
There have been cases of some mobile or IoT devices arriving from the manufacturer already infected with malware. This is due to a breach in the supply chain that allows the introduction of malicious code.
Supply chain security is also being addressed in this executive order with new requirements for hardware and software providers.
When purchasing new hardware or software, you should do a quick Google search first to ensure you’re not purchasing a device known to have a security flaw.
Section 5: Establishing a Cyber Safety Review Board
A Cyber Safety Review Board is being created. Its main purpose being, “The Board shall review and assess, with respect to significant cyber incidents … affecting FCEB Information Systems or non-Federal systems, threat activity, vulnerabilities, mitigation activities, and agency responses.”
Does your company have anyone that oversees your IT security safety? If not, partnering with a managed IT service provider like Magnify247 can fill that gap.
Section 6: Standardizing the Government’s Security Response Playbook
Incident response is vital to reducing the damage from a cyberattack and mitigating costs and downtime. The executive order calls for a standardized security response playbook to be developed that all government organizations can follow.
Your company should also have a plan in place to respond to cyberattacks. Read our three-part series on how to create a cybersecurity incident response plan.
Section 7: Improving Detection of Cybersecurity Vulnerabilities & Incidents on Government Networks
Maximizing early detection of vulnerabilities and threats is being emphasized to ward off potential breaches of government networks.
Ongoing monitoring should be in place for any size business. This ensures that threats are detected and dealt with as soon as possible.
Section 8: Improving the Government’s Investigation & Remediation Capabilities
It’s hard to seal up a cybersecurity leak if you don’t know where it is. This section addresses the creation of a more robust investigation, tracking, and remediation strategy and apparatus.
System logs and user access tracking are systems that SMBs should have in place to identify the source of a breach. And endpoint management and monitoring are a must.
Get Your Zero-Trust Framework Started with Magnify247
“Trust no one, find someone you can trust.”
Magnify247 can help your Hamilton County business use best practices of a zero-trust framework to improve your cybersecurity posture and reduce risk.
Contact us today to learn more!
