Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: Stuff Looks Coming. Hey there everyone, and welcome to Tech Stuff.
Speaker 1: My name is Jonathan Strickland, and here is Lauren Vogelbaum. Yep,
Speaker 1: that's that's that's my co host. Everybody. Today, we're going
Speaker 1: to talk a little bit about security. It's an important thing,
Speaker 1: cyber security specifically. Yeah, you've got to secure your cybers,
Speaker 1: all your cybers, all your cybers are belonging to you
Speaker 1: and should continue to do so. Um. Yeah, we're we're
Speaker 1: talking about cybersecurity because because President of Wilma did, yes
Speaker 1: he did. The President of the United States of America
Speaker 1: had his State of the Union address, which is when
Speaker 1: the president, if you are not from the United States,
Speaker 1: were perhaps just our politically, uh, completely separate from anything
Speaker 1: that goes on, a little bit lost and confused perhaps,
Speaker 1: or maybe maybe you haven't been to the internet. Maybe
Speaker 1: you live as a hermit often the distance and you
Speaker 1: only get human contact through podcasts, in which case, hey,
Speaker 1: thanks for choosing ours. But yeah, every every year the
Speaker 1: president has this this forum where he begins to to
Speaker 1: address how the country is doing and what his administration
Speaker 1: or her administration. Should we ever get a female president.
Speaker 1: I'm sure it's someday, someday, any any year now, but anyway,
Speaker 1: that is when the president will lay out plans for
Speaker 1: what is going what the government will focus on in
Speaker 1: the following year, assuming the rest of the government plays ball,
Speaker 1: because again the United States government, it's not just the president, sure,
Speaker 1: but but it's kind of saying what's important. Yeah, yeah,
Speaker 1: And I personally kind of side note. I feel like
Speaker 1: this has become less critical to politics now, in this
Speaker 1: this our information age, than it was, for example, fifty
Speaker 1: or sixty years ago, when people didn't really have direct
Speaker 1: and continual access to everything bloody going on in the
Speaker 1: government all the time. Yeah, that's that's a good point
Speaker 1: because earlier you would hear the president essentially during the
Speaker 1: State of the Union address and after any major event
Speaker 1: like a catastrophe or not even not not necessarily something bad,
Speaker 1: but usually it had to be something big, and then
Speaker 1: the president would end up addressing the nation about it.
Speaker 1: But in this case, we now live in a world
Speaker 1: where we get this information on a fairly continuous basis.
Speaker 1: I mean, you could follow the president on Twitter and
Speaker 1: get information or just the twenty four hour news coverage
Speaker 1: of what's going on the government's out there too. Anyways.
Speaker 1: State the Union kind of traditionally seen as a big
Speaker 1: important event here in the US. So during the State
Speaker 1: of the Union, one of the many points the President
Speaker 1: addressed was cybersecurity. Now that was not the the the
Speaker 1: entire focus of the speech. In fact, it only took
Speaker 1: up a small section about a minute and a half.
Speaker 1: I think. Yeah. In fact I can I can read
Speaker 1: out verbatim what he said because the text is available
Speaker 1: on the on the Internet of all things. So here's
Speaker 1: what President Obama had to say about cyber security. America
Speaker 1: must also face the rapidly growing threat from cyber attacks.
Speaker 1: We know hackers steal people's identities and infiltrate private email.
Speaker 1: We know foreign countries and companies swipe our corporate secrets.
Speaker 1: Now our enemies are also seeking the ability to sabotage
Speaker 1: our power grid, our financial institutions, and our air traffic
Speaker 1: control systems. We cannot look back years from now and
Speaker 1: wonder why we did nothing in the face of real
Speaker 1: threats to our security and our economy. That's why earlier
Speaker 1: today I signed a new executive order that will strengthen
Speaker 1: our cyber defenses by increasing information sharing and developing standards
Speaker 1: to protect our national security, our jobs, and our privacy.
Speaker 1: Now Congress must act as well by passing legislation to
Speaker 1: give our government a greater capacity secure our networks ended
Speaker 1: to our attacks. So really, this of course just served
Speaker 1: to alert the nation to yes, we are aware of
Speaker 1: the problem, and yes we are going to do something
Speaker 1: to respond to this problem. But of course the speech
Speaker 1: was not the right venue to go into detail about
Speaker 1: what that was going to be, right right, These these
Speaker 1: kinds of speeches aren't really used for extreme detail of
Speaker 1: any kind. It's it's more more hey stuff, Yeah, hey, problem,
Speaker 1: we're gonna fix it. How are we going to fix it?
Speaker 1: Look over here at the Chewbacca. Um. Yeah, And this
Speaker 1: is regardless of who is in power. It's just that's
Speaker 1: the way, that's the way it works. Yeah, we We are,
Speaker 1: by the way, trying very hard in this episode to
Speaker 1: to not let any of our personal politics enter into
Speaker 1: this discussion. Sure, so this is this is actually us
Speaker 1: being being as fair as we possibly can be. And
Speaker 1: if we wind up making a little bit of fun
Speaker 1: of any given administration, it's not Yeah, it's not politically motivated.
Speaker 1: Now in this case, it's motivated by our knowledge of
Speaker 1: how technology works, how policy works, and how those two
Speaker 1: things don't necessarily mesh very well. Uh. And that that's
Speaker 1: regardless of what your political stances, whether you're conservative or liberal,
Speaker 1: no matter what it's it's just the technology is kind
Speaker 1: of a political uh, just as a tool. Now you
Speaker 1: can use it for political means. But anyway, getting into this,
Speaker 1: we we really wanted to talk more about the Executive
Speaker 1: Order itself because that's where the approach that that Obama
Speaker 1: wants the government to take. That's where that's where it
Speaker 1: comes from, right right, And UM, I I read I
Speaker 1: read a great write up that Michael Daniel, who is
Speaker 1: Obama's cybersecurity coordinator, wrote up about it, UM and he
Speaker 1: was just saying that that basically the Executive Order breaks
Speaker 1: down into three parts and that's um basically just uh,
Speaker 1: it covers information sharing first off, which means that it
Speaker 1: really wants the different segments of the government to work
Speaker 1: with all of these private companies that run run our
Speaker 1: technology infrastructure and our power infrastructure, UM to share information
Speaker 1: about any any cyber threats that are going on. And UM, yeah,
Speaker 1: that's the first big section because obviously the issue here
Speaker 1: is that sometimes the government gets information, but depending upon
Speaker 1: the classification of that information, they may not be able
Speaker 1: to share it very on a very wide distribution. And
Speaker 1: beyond that, sometimes when you get information in the government,
Speaker 1: it's really hard for the information to escape the government.
Speaker 1: So in other words, this is supposed to lay the
Speaker 1: groundwork to allow the government to share information with entities
Speaker 1: that are critical to our infrastructure, and also going the
Speaker 1: other way, giving giving those entities, uh basic incentive, thank
Speaker 1: you so much, incentive to also share any information that
Speaker 1: they have about some cyber texts, any cyber attacks that
Speaker 1: might be occurring back to the government so that the
Speaker 1: government can do more to help out right, And we'll
Speaker 1: we'll dive into more about how that's a challenge in
Speaker 1: a little bit because as it turns out, you know,
Speaker 1: it sounds, yeah, totally everybody like like we just got attacked,
Speaker 1: we should let the government know. But I'll get into
Speaker 1: why a lot of companies don't really necessarily see that
Speaker 1: as the best option, right right, All right, So that's
Speaker 1: part one. Part to UM kind of outlines a flexible
Speaker 1: risk based package of core practices based on existing standards
Speaker 1: of cybersecurity. Yeah, so this is looking at there there
Speaker 1: are several organizations already that are working toward the best
Speaker 1: practices for cybersecurity, and so this is kind of trying
Speaker 1: to to say, let's take a look at all of
Speaker 1: this stuff and and pick and choose the best out
Speaker 1: of all of it and use that as the framework
Speaker 1: for what everyone should do. That's also possibly going to
Speaker 1: be a bottleneck, but I'll get to that when we
Speaker 1: get a little further into this. Yes. Yes, the third
Speaker 1: The third part then deals with privacy protections, because when
Speaker 1: you're dealing with these companies that have a lot of
Speaker 1: private citizens data or even their own private corporate data
Speaker 1: or you know, or or on the other end from
Speaker 1: the government, the government doesn't doesn't want anything sensitive to
Speaker 1: end up being revealed that they don't want to give out. Right. Yeah,
Speaker 1: you know, companies have proprietary information for example, So let's
Speaker 1: say that a cyber attack focuses on something that involves
Speaker 1: proprietary information, information that is necessary for that company to
Speaker 1: keep secret. It's a trade secret. It's something that allows
Speaker 1: them to do business the way they do it and
Speaker 1: make money and make money. Yeah. So for example, just
Speaker 1: this is a random example that I just thought up
Speaker 1: right now, but the Google algorithm. Okay, because Google algorithm,
Speaker 1: that's essentially the the the recipe that tells Google how
Speaker 1: to rank search results on any given query. Well, that's
Speaker 1: a that's pretty useful information to have, especially if you're
Speaker 1: building websites. But let's say that cyber they the Google
Speaker 1: suffered a cyber attack and part of the information that
Speaker 1: was compromised was this Google algorithm, which is kind of
Speaker 1: like their their secret sauce. You know, it's it's not
Speaker 1: not published, right, is the mathematical Horsey sauce. Yes, it is, Yes,
Speaker 1: it's it's part of their eleven Herbs and spices, and
Speaker 1: so they don't want the information getting out. And if
Speaker 1: they were to report the information to the government, it's
Speaker 1: possible that part of the distribution of information to everybody else,
Speaker 1: you know, saying like, well, Google was attacked, so these
Speaker 1: other companies need to be aware of this as well.
Speaker 1: The worry is that the algorithm itself would become part
Speaker 1: of that information distribution and then Google loses its advantage
Speaker 1: in the marketplace. That's that's just a simple example, and
Speaker 1: it may even be unrealistic in the sense of what
Speaker 1: we're talking about here, but it's just to kind of illustrate, uh,
Speaker 1: why the government needs to take this into account when
Speaker 1: formulating policy. Yeah, and and so those are the basic
Speaker 1: three parts and uh, and the administration is really big
Speaker 1: on on saying that you know that that they want
Speaker 1: to work really hard with with companies and with the
Speaker 1: different government organizations to make all of this as sensical
Speaker 1: and um, not like work, more like sharing and hugging. Yeah,
Speaker 1: there needs to be sharing and hugging well while standing
Speaker 1: shoulder to shoulder to keep the cyber attackers at bay.
Speaker 1: And you know, and so they say that they worked
Speaker 1: with with over two companies directly and and fifteen million
Speaker 1: employees and all kinds of crazy numbers like that, trying
Speaker 1: to trying to work to get this information together. And
Speaker 1: and to be fair, we should also point out that
Speaker 1: these are it's a directive, but again it does not
Speaker 1: lay out step by step how this is going to happen.
Speaker 1: It's more like saying to specific departments within the government, Hey,
Speaker 1: this is what I want. Here's the result I want.
Speaker 1: You have two hundred and forty days to return to
Speaker 1: me the result I want go And it's up to
Speaker 1: that individual department to determine what are the steps that
Speaker 1: it needs to take in order to meet the requirements
Speaker 1: of this executive order. Uh. This is also something that
Speaker 1: I've seen critics point at, saying, a lot of the
Speaker 1: time tables that are discussed within the Executive Order are
Speaker 1: not necessarily realistic because you're talking about navigating such a
Speaker 1: complex issue, not just from the technology side, but from
Speaker 1: the existing policy side. That uh, that in order to
Speaker 1: to find something that satisfies the needs of the Executive
Speaker 1: Order and does not violate any of these other entities
Speaker 1: that are already out there is a huge challenge. And
Speaker 1: two hundred forty days, which is just one of the deadlines.
Speaker 1: There's some that are like a hundred twenty days, depending
Speaker 1: upon what it is. But it's just it's just not
Speaker 1: enough time, right and especially considering that if you've been
Speaker 1: paying attention to the news at all, and say the
Speaker 1: past existence of reality, you may have noticed that the
Speaker 1: different parts of American political system don't necessarily work together
Speaker 1: extremely well, and so so things. I mean, for for example,
Speaker 1: there was a Cybersecurity Act last year I believe that
Speaker 1: tried to go through Congress. It made it past No,
Speaker 1: that was the other one. It got failbustered by the Republicans.
Speaker 1: They were saying that it was going to place too
Speaker 1: much of a burden on the companies, that it would affect,
Speaker 1: and and all kinds of stuff like that has been
Speaker 1: going on for the past three and a half years,
Speaker 1: or really since the mid nineties when computer networks became
Speaker 1: a really integral part of business. Yeah. This this is
Speaker 1: a complicated issue because on one hand, you're talking about
Speaker 1: protecting a lot of private entities, and private entities do
Speaker 1: not have any connection to the government other than paying taxes. Honestly,
Speaker 1: as I'm sure we're all aware, but anyway, these private
Speaker 1: entities don't necessarily have any other connection to the government.
Speaker 1: They're not run by the government. It's not a socialist
Speaker 1: kind of structure. It's private structure. Uh. But that means
Speaker 1: that they you know, how far can the government come
Speaker 1: in to try and protect these entities When the entity
Speaker 1: itself is in control of something that's vital to the
Speaker 1: operation of business or national security, then there it is
Speaker 1: in the government's interest to come in and say, look,
Speaker 1: I know that we don't have any uh any call
Speaker 1: and how you run your business, that's not our job,
Speaker 1: but we need to protect it because how your business
Speaker 1: performs affects the citizens of this country. So I guess
Speaker 1: we can start diving into the example order. Did you
Speaker 1: have something else you wanted to mention before we did that?
Speaker 1: And that's about it, all right, So here's the here's
Speaker 1: an opening paragraph from part of the executive order. Does
Speaker 1: the policy of the United States to enhance the security
Speaker 1: and resilience of the nation's critical infrastructure and to maintain
Speaker 1: a cyber environment that encourages efficiency, innovation, and economic prosperity
Speaker 1: while promoting safety, security, business competentiality, privacy, and civil liberties.
Speaker 1: We can achieve these goals through a partnership with the
Speaker 1: owners and operators of critical infrastructure to improve cybersecurity information sharing,
Speaker 1: and collaboratively develop and implement risk based standards. As a
Speaker 1: as a mouthful, fascinating, that was so thrilling. It was, Yeah,
Speaker 1: it's it's it's it's not quite legally ease, it's not
Speaker 1: it's not so dense as to be uh, completely inoperable.
Speaker 1: You can't understand a word of it without having like
Speaker 1: three lawyers on your team, but it does. It does
Speaker 1: make it kind of you know, it's it's this very
Speaker 1: formal sort of language. Part of the issue here also
Speaker 1: is that some people argue that the terms are not
Speaker 1: narrowly defined enough to make it meaningful. For example, you
Speaker 1: talk about operators of critical infrastructure, um, they there are
Speaker 1: some people who say that that's not specific enough. You know,
Speaker 1: you don't you know how what? What? What is infrastructure?
Speaker 1: Are we talking? Are we talking just things like power grids?
Speaker 1: I mean that would clearly be critical infrastructure. Does it
Speaker 1: extend to UH to telephones, does it extend to dams?
Speaker 1: Or doesn't extend to UH? To cybersecurity firms? Because if
Speaker 1: you're talking about something now that where you're really trying
Speaker 1: to protect people from cyber attacks, does that mean does
Speaker 1: that extend to the point that cybersecurity firms become part
Speaker 1: of this critical infrastructure because they are the protection against
Speaker 1: that sort of thing. Um. I'm sure that those kind
Speaker 1: of definitions will be worked out. And sometimes this sort
Speaker 1: of legislation or these executive orders I should say, not
Speaker 1: not legislation, but this executive order. And sometimes these things
Speaker 1: are are vaguely worded on purpose to try and have
Speaker 1: the broadest possible application, and then you narrow it down
Speaker 1: as it's put into practice. And that's the feeling that
Speaker 1: I get from this, and especially since they're kind up
Speaker 1: going like, yeah, do this thing and you work it out. Yeah.
Speaker 1: So I'm gonna go through a little bit kind of
Speaker 1: point by point of some of the sections here, and
Speaker 1: then after I do that, we'll we'll kind of talk
Speaker 1: about some of the the not just criticisms, but just
Speaker 1: some of the observations people have made about this. So,
Speaker 1: so it begins by talking about distributing reports of detected
Speaker 1: cyber security threats to private sector companies as long as
Speaker 1: those reports do not endanger investigations and law enforcement efforts
Speaker 1: and they are unclassified. So, in other words, when the
Speaker 1: government gets, say a report that there's a threat, a
Speaker 1: cyber threat, uh, this is what would allow the government
Speaker 1: to send that information out to the various parties that
Speaker 1: could be affected by this cyber threat and to kind
Speaker 1: of give them a heads up saying, look, we've detected
Speaker 1: that there's some operation in let's say China, whether it's
Speaker 1: state backed or it's a group of hackers who are
Speaker 1: working on their own or whatever, or maybe it's a
Speaker 1: Russian group that looks like it's working out of China.
Speaker 1: This is complicated. We can't really be sure because the
Speaker 1: way the internet works in the way hackers get around
Speaker 1: this sort of thing. But they've detected that there's this
Speaker 1: credible threat, and they've detected what the potential targets are.
Speaker 1: This part of the executive order gives the government the
Speaker 1: ability to say, hey, heads up, it's coming in. And
Speaker 1: this is actually an expansion of a currently existing program
Speaker 1: um called the Defense Industrial Based Information Sharing Program, which
Speaker 1: I believe currently exists to allow government contractors to receive
Speaker 1: real time reports about these threats. Right, and so again,
Speaker 1: the reason why they say it can't endanger investigations is clearly,
Speaker 1: if there's a like UH and a law enforcement group,
Speaker 1: whether it's it's the United States or it could be
Speaker 1: some UH international type of UH law enforcement group looking
Speaker 1: into the problem, then by sharing information, you could compromise
Speaker 1: that that investigation. So it's a delicate thing. It's it's
Speaker 1: not something where every single time there's going to be
Speaker 1: a threat, there's automatically going to be a report generator
Speaker 1: that gets sent out. It's going to be a case
Speaker 1: by case basis. The next section talks about how classified
Speaker 1: reports will go to critical infrastructure entities that are authorized
Speaker 1: to receive them. So there will be some privately held
Speaker 1: companies that will be authorized to receive classified information, assuming
Speaker 1: that classified information relates to that entity in some way.
Speaker 1: I think it's also talking a little bit about trying
Speaker 1: to expedite the process of getting clearances for appropriate uh
Speaker 1: A individuals and also state and government representatives to give
Speaker 1: that stuff. Yeah, exactly, yes. So this this again is
Speaker 1: kind of like cutting away some of the red tape
Speaker 1: that would exist between information and the and the entity
Speaker 1: that would most benefit from receiving it, uh in a
Speaker 1: in a cyber attack kind of situation. It would also
Speaker 1: expand the Enhanced Cyber Security Services Program to all critical
Speaker 1: infrastructure sectors, which is a voluntary information sharing program and
Speaker 1: it offers this is where you were talking about, it's
Speaker 1: offering the cross fight info to the private sector folks,
Speaker 1: but also it's a sharing program that is supposed to
Speaker 1: encourage companies to share information between each other to say, uh,
Speaker 1: there's this cyber attack that we've we've detected and it
Speaker 1: could affect your industry as well as ours. So the
Speaker 1: idea is that it's supposed to encourage these companies to participate,
Speaker 1: but it is voluntary. We'll get into that when we
Speaker 1: get into the criticisms. Um Also, beyond the security clearance
Speaker 1: being expedited, we have private sector experts will be invited
Speaker 1: to come and speak to the government on a regular
Speaker 1: basis to keep the government informed about cyber risks and
Speaker 1: the best practices to respond to them. Now, this is
Speaker 1: essentially the part of the executive Order that recognizes the
Speaker 1: fact that the people who hold positions of power in
Speaker 1: politics may not be technologically qualified. They maybe savvy, but
Speaker 1: even a technologically savvy person would not necessarily be up
Speaker 1: to date on the latest cyber threats. And so this
Speaker 1: is this is to give the government the chance to
Speaker 1: maintain a an ongoing dialogue with experts in the cybersecurity
Speaker 1: field so that the best policies are formed as a result,
Speaker 1: and that the best practices are formed as a result,
Speaker 1: because what works today may not work in three months.
Speaker 1: It's a funny thing about technology. And then, uh, the
Speaker 1: next section is the one that's all about privacy and
Speaker 1: civil liberties because apparent that it's it's a really big
Speaker 1: issue in the idea that a lot of these companies
Speaker 1: have a lot of our data, not just corporate data,
Speaker 1: but our personal data. So think about it like power companies,
Speaker 1: gas companies. Uh, you've got you've got credit card companies.
Speaker 1: You should you know, all sorts of vendors out there
Speaker 1: have information, social networking companies, all of these have personal
Speaker 1: information that could put citizens at risk if that information
Speaker 1: were shared to a broader audience. So that's the part
Speaker 1: where the executive Order says, Okay, we want this culture
Speaker 1: of sharing. We want to be able to get the
Speaker 1: information to where it needs to be so that we
Speaker 1: can protect ourselves, but we don't want to do that
Speaker 1: at the expense of personal privacy and civil liberties. We
Speaker 1: don't want to violate anyone's privacy or expectation to privacy. Um,
Speaker 1: so we don't want a credit card company to send
Speaker 1: information to some other entity that just so happens to
Speaker 1: have the the all the credit card numbers, names, addresses,
Speaker 1: credit scores of everyone who's a customer with that credit
Speaker 1: card company, because that would be a bad thing. And
Speaker 1: so one of the things that this this requires is
Speaker 1: a regular assessments in public reporting of any kind of mishaps. Yeah,
Speaker 1: so it's an ongoing dialogue again with the government to
Speaker 1: make sure that this is done an appropriate way, because
Speaker 1: I mean, obviously, when when people start to worry about security.
Speaker 1: It's it can be I won't say easy, but it's
Speaker 1: possible that you overlook other concerns that you should really
Speaker 1: take into mind when you're trying to protect yourself. We
Speaker 1: we usually see this in the wake of some sort
Speaker 1: of actual attack, where an attack happens and then we
Speaker 1: just want to respond to that and make sure it
Speaker 1: doesn't happen again. And you can easily set aside other
Speaker 1: concerns that you really need to keep in mind the
Speaker 1: whole time. Well, before we move on to the rest
Speaker 1: of the executive Order, I think now would be a
Speaker 1: good time to take a quick break and thank our sponsor,
Speaker 1: and now back to the show. So the next section
Speaker 1: is all about consulting and getting various departments to talk
Speaker 1: to each other to improve security measures, so when one
Speaker 1: group sees something that's working, it can communicate that with
Speaker 1: other groups. It's kind of it's kind of this idea
Speaker 1: of UH inciting cooperation between departments and other entities. Then
Speaker 1: there's a section. I've got a direct quote here, and
Speaker 1: the Secretary of Commerce shall direct the Director of the
Speaker 1: National Institute of Standards and Technology UH for here. Henceford
Speaker 1: known as a director to lead the development of a
Speaker 1: framework to reduce cyber risks to critical infrastructure, henceforth known
Speaker 1: as the cybersecurity Framework. The cybersecurity Framework shall include a
Speaker 1: set of standards, methodologies, procedures, and processes that align policy, business,
Speaker 1: and technological approaches to address cyber risks. That's essentially saying
Speaker 1: you have to take everything into consideration and make it
Speaker 1: into a cyber security approach that takes all of that
Speaker 1: into account and works, which is huge. I mean, that's
Speaker 1: just incredibly complex. I mean, policy alone is complicated, yes,
Speaker 1: a little bit. And then you've got technology, which is
Speaker 1: constantly evolving. So what by the time you're finished drafting
Speaker 1: a policy, it may be that the technology has so Now, granted,
Speaker 1: I'm not blaming anyone for this, because it's just that's
Speaker 1: just how reality is. And I don't know how else
Speaker 1: you could word this in a way that would make
Speaker 1: sense and and get across the importance of what needs
Speaker 1: to be done. Yeah, and and that is that is
Speaker 1: a good I mean, I feel like they've got enough
Speaker 1: of a cautionary air about it that it's not just
Speaker 1: you know, they're not just sitting there quoting Tim Gotten
Speaker 1: going well, make it work. But yeah, yeah, but it
Speaker 1: does kind of start to set in how enormous this
Speaker 1: issue is. It's also enormously important, So I'm very glad
Speaker 1: that the government is looking into it, and they have
Speaker 1: been looking into it. That whould also I'm sure we
Speaker 1: kind of alluded to it already. This is not the
Speaker 1: first time the government has looked at cybersecurity, but it's
Speaker 1: it's you know, they're seeing it as it's just going
Speaker 1: to get increasingly important as time goes on. Next, they
Speaker 1: said that the Cybersecurity Framework shall provide a poritized, flexible, repeatable,
Speaker 1: performance based and cost effective approach, including information security measures
Speaker 1: and controls, to help owners and operators of critical infrastructure, identify, assess,
Speaker 1: and manage cyber risk. This is also a huge thing.
Speaker 1: I mean, it's it's it's a it's a tall order
Speaker 1: because you're talking about an approach that is going to
Speaker 1: work in The approach ideally should work in every case
Speaker 1: across multiple industries, because the idea of it being repeatable
Speaker 1: means that it can't be something that, oh, because this
Speaker 1: threat was the specific to this industry, then it can't
Speaker 1: work for over here and or or even just that
Speaker 1: because our approach work for this threat but the reason
Speaker 1: why it worked for this threat was because of x
Speaker 1: uh that you know, that might mean that it's not repeatable.
Speaker 1: So it's a very challenging thing. Again, I'm not saying
Speaker 1: it's impossible, but you know, and again and there's not
Speaker 1: much they could What else are they gonna say, like
Speaker 1: produce an infinite number of responses that can work in
Speaker 1: any given situation, depending upon which response you're using in
Speaker 1: which industry. I mean, that just wouldn't work. Oh no, no,
Speaker 1: And they do talk a lot about scaling. They want
Speaker 1: to make sure that this is going to work just
Speaker 1: as well for for small small companies as well as
Speaker 1: big companies, and yeah, across the board. But that just
Speaker 1: makes it harder. Yeah, yeah, in fact, and then the
Speaker 1: next section says, you gotta do all this without impacting
Speaker 1: business and privacy. So you have to come up with
Speaker 1: a way to protect our businesses and our infrastructure in
Speaker 1: such a way that it's not going to negatively impact
Speaker 1: those businesses. So you can't come up with a plan
Speaker 1: that protects everyone, but it ends up taking a cut
Speaker 1: of everyone's profits because they have to do spend so
Speaker 1: many work hours doing this thing. Oh you know, which
Speaker 1: is why the Republicans last year filibustered that last Act
Speaker 1: and and and it's tough, I mean uh. And we'll
Speaker 1: get into more about wine stuff in a second. Also,
Speaker 1: the that's where they introduced the idea of the open
Speaker 1: public review and comment process so that this becomes an
Speaker 1: evolving policy over time, which again I'm very glad that
Speaker 1: kind of stuff is built into this executive order. It
Speaker 1: recognizes that this is a problem that is going to
Speaker 1: change over time, and you cannot create a policy and
Speaker 1: expected to be evergreen, and that it's going to that
Speaker 1: one approach once you've once you've established it is going
Speaker 1: to work forever. This is the sort of interesting because
Speaker 1: there are other policies that were created back when the
Speaker 1: telephone industry was first coming into prominence that still affect
Speaker 1: how the Internet works today. And there are a lot
Speaker 1: of people who who protest that. They say, look, these
Speaker 1: were policies that were made for a much older telecommunications
Speaker 1: network that could do a very limited number of things,
Speaker 1: and now you're applying it to a much more complex
Speaker 1: system that is far more sophisticated, and the implications for
Speaker 1: how it works are far more complicated. Expecting those rules
Speaker 1: to apply to this thing is unrealistic, and you've got
Speaker 1: a lot of that kind of discussion going on, mostly
Speaker 1: in in uh interest groups that like you know that
Speaker 1: are forming up about protecting the Internet. But um, anyway,
Speaker 1: that's that's kind of a similar thing like that. It
Speaker 1: built into this is saying let's have this ongoing public
Speaker 1: discourse so that we can avoid this if if possible,
Speaker 1: it's gonna be you know, we're gonna see it anyway,
Speaker 1: because it's impossible to avoid it completely, but at least
Speaker 1: they're looking into that. Then you've got the Latin next
Speaker 1: section where it says the Secretary and coordination with sector
Speaker 1: specific agencies, shall establish a voluntary program to support the
Speaker 1: adoption of the Cybersecurity Framework by owners and operators of
Speaker 1: critical infrastructure and any other interested entities to get a
Speaker 1: the program. Um, here's that voluntary program bit again. Okay,
Speaker 1: I'll say that just until I finished this last one.
Speaker 1: Here's my last point. Within one fifty days of the
Speaker 1: date of this order, the Secretary shall use a risk
Speaker 1: based approach to identify critical infrastructure where cybersecurity incident could
Speaker 1: reasonably result and kind strophic, regional, or national effects on
Speaker 1: public health or safety, economic security, or national security entities
Speaker 1: identified as such can then appeal that. So, in other words,
Speaker 1: if you are the head of a company and the
Speaker 1: United States government government starts to look at all the
Speaker 1: companies that are part of this infrastructure and they identify
Speaker 1: your company as being one of these incredibly critical Yes,
Speaker 1: not like it's critical because of the services you provide
Speaker 1: and the likelihood that you would be a target for
Speaker 1: a cyber attack. Um, then they could designate you as
Speaker 1: such and you would be able to appeal because if
Speaker 1: you are one of these critical infrastructure entities, you're going
Speaker 1: to have to jump through a lot more hoops than
Speaker 1: you would if you were not. So companies actually kind
Speaker 1: of have an incentive to not be one of these
Speaker 1: things because then they if they are one, they're going
Speaker 1: to have to conform to more UH specific policies. Right
Speaker 1: because they are considered critical elements of the infrastructure. It
Speaker 1: takes that sticky voluntary term a little bit out of it. Yeah,
Speaker 1: it does, because if they say, hey, no, really, really
Speaker 1: you you are super important and if you go down,
Speaker 1: then the United States is in a lot of trouble.
Speaker 1: So you are part of this critical infrastructure, whether you
Speaker 1: like it or not. So therefore, because of this, we
Speaker 1: need you to follow these directions. Uh, and other companies
Speaker 1: might be like, you know, I'd really like it if
Speaker 1: I had more of a choice, because then I could
Speaker 1: choose not to do that, and that would be awesome.
Speaker 1: So that's why there's that appeal process, and that's where
Speaker 1: we come to the problem with the voluntary nature of
Speaker 1: much of this policy. The idea here is that again
Speaker 1: we don't in the United States in particular, there's there's
Speaker 1: a stigma against the government and private business. And and
Speaker 1: I'm not saying that it's unwarranted. I'm not saying that
Speaker 1: we should have a socialist country where every single business
Speaker 1: is owned, at least in part or operated by the government.
Speaker 1: That that's not what I'm saying at all. What I'm
Speaker 1: saying is that it does mean that in order to
Speaker 1: preserve this very important, very American idea of private business,
Speaker 1: we don't let the government just come in and take
Speaker 1: over and regulate us or or protect us to a
Speaker 1: certain point. I mean, it's sort of our business. Yeah,
Speaker 1: So there's there's a delicate nature here, and it's again
Speaker 1: it's one of those things where it's it's a very
Speaker 1: American approach and it's it's tough to work something like
Speaker 1: cybersecurity in there and not make it a voluntary program,
Speaker 1: because if we made it mandatory, the government would essentially
Speaker 1: be saying, look, we're not telling you how to sell
Speaker 1: your widgets, but we aren't telling you how to protect
Speaker 1: your network. And that gets complicated. Even even if it's
Speaker 1: for the greater good, it's it's a it's a tough thing.
Speaker 1: And I mean I certainly if I owned a big business,
Speaker 1: I would be thinking, look, I don't want to have
Speaker 1: yet another set of policies that I have to uh,
Speaker 1: I have to keep up with and follow up with
Speaker 1: and spend my time and money taking care of. Right.
Speaker 1: I don't want to get certified every couple of years
Speaker 1: to make sure that I'm following this. Let me do
Speaker 1: it on my own. It's in my best interest to
Speaker 1: make sure that I'm not going to get attacked anyway. Yeah, exactly.
Speaker 1: That's that's the business owner perspective is saying, look, I
Speaker 1: don't want to get attacked because if I get attacked,
Speaker 1: it hurts my bottom line. So I have I have
Speaker 1: a market driven reason to prevent attacks. But the on
Speaker 1: the flip side of that, the United States is saying, look,
Speaker 1: these attacks are sophisticated, they're coming from multiple points, they
Speaker 1: are using different methods to attack different systems, and in
Speaker 1: some cases it may just be that your company isn't
Speaker 1: a specific target, but it's part of a larger group
Speaker 1: of targets, and we have to protect the United States citizens.
Speaker 1: So there's their valid arguments on either side. Now, making
Speaker 1: it a voluntary program helps both parties because the government
Speaker 1: isn't saying, look, you have to follow this out of
Speaker 1: rules or you can't do business in the the United States,
Speaker 1: and the business can say, well, do we want to
Speaker 1: be part of this so that we can help protect
Speaker 1: our business as well as make sure that in our
Speaker 1: own lives we don't go home and the power goes
Speaker 1: off right right. And this is actually kind of in
Speaker 1: contrast to UH. Interestingly enough, the European Commission also just
Speaker 1: in this past week released a bunch of cybersecurity stuff
Speaker 1: UM and and and there sounds like it might be
Speaker 1: a little bit more mandatory. They want to introduce a
Speaker 1: Computer Emergency Response Team a k A CERT to UH,
Speaker 1: introduce laws compelling companies to disclose attack details to to
Speaker 1: this national authority and and that this each each sert
Speaker 1: would be responsible for defending these companies against attack, so
Speaker 1: you know, and and it's it's it's in a little
Speaker 1: bit more of of a planning stage, I think, than
Speaker 1: than what Obama's orders outlining. But it is nonetheless, you know,
Speaker 1: just just a little bit of contrast there. See, I
Speaker 1: just wonder if the CERTs are a breath mint or
Speaker 1: a candy mint. That's the first thing I thought. As
Speaker 1: soon as you said certain, my brain turned off. These
Speaker 1: are the deep questions that we ask here on tax staffs.
Speaker 1: Shows you how Jonathan Strickland works, which is that he
Speaker 1: is distracted by shiny things and puns and mints and mints. Yeah,
Speaker 1: they are intensely flavorful. So yeah, I mean that voluntary
Speaker 1: approach is one of the things that some people are
Speaker 1: saying makes the Executive Order lack teeth because without without
Speaker 1: really providing strong incentives, companies have no reason to join
Speaker 1: this because because in the long run it will be
Speaker 1: more work to have to conform to whatever the policy requires. Now,
Speaker 1: if the incentives are big enough, whether they're you know,
Speaker 1: tax breaks or whatever, then maybe companies will end up
Speaker 1: joining because they'll think, well, whatever the work is to
Speaker 1: conform to the policy. It's going to be balanced out
Speaker 1: by the incentives. So the incentives, although they haven't been
Speaker 1: really uh you know, they haven't been listed out yet,
Speaker 1: it's possible they could be attractive enough for for companies
Speaker 1: to join this. But that was one of the big
Speaker 1: arguments I saw was that by making it voluntary, although
Speaker 1: every single UM business analysts I saw who said it,
Speaker 1: they said, well, the problem is it's voluntary, so it's
Speaker 1: not gonna work very well. But on the other hand,
Speaker 1: if it were mandatory, everyone would be freaking out. So
Speaker 1: it's almost like there's no right approach, right unless unless
Speaker 1: you're able to provide those amazing incentives you could, you
Speaker 1: cannot make it mandatory and not have everyone riot. Yeah,
Speaker 1: so um. The Also they mentioned that the the this
Speaker 1: framework idea is incredibly complex, and part of that is
Speaker 1: because they're already a lot of security frameworks that government
Speaker 1: agencies have to abide by. So there's and I could
Speaker 1: give you a list of acronyms and not being able
Speaker 1: to tell you what any of them mean, but I'm
Speaker 1: not going to insult you or myself by doing that.
Speaker 1: But there are a lot of security frameworks already and
Speaker 1: so this policy would have to work, uh, in an
Speaker 1: alignment with those, because we've already got these rules that
Speaker 1: that departments in the government have to follow, and so
Speaker 1: unless they were to get rid of all that in
Speaker 1: order to streamline it, this would be yet another set
Speaker 1: of rules. So you think about it. If you've ever
Speaker 1: had more than one boss, like at a time, and
Speaker 1: you have different directions coming from both bosses, and you
Speaker 1: have to figure out how to complete a project that
Speaker 1: follows all of these rules, and some of them contradict
Speaker 1: each other. You know, I've had that. Yeah, that's it
Speaker 1: wasn't fine. I didn't like that. Just a stressful, frustrating experience.
Speaker 1: Now expand that out to an entire government department and
Speaker 1: you understand why they can get a little antsie at times. Um.
Speaker 1: Then also there's still some questions about the privacy implications. Uh.
Speaker 1: While the the executive order does talk about being careful
Speaker 1: about privacy, it doesn't lay out any specifics on the approach,
Speaker 1: and so that always makes people a little nervous. Yeah,
Speaker 1: until until we know the particulars, you can't really be
Speaker 1: sure that your privacy is going to be uh protected. Yeah, yeah,
Speaker 1: it's supposed to be but until until I know the specifics,
Speaker 1: we can't be sure. And are we going to apply
Speaker 1: these same security measures to the to the information to
Speaker 1: get sent out as a result of these security measures,
Speaker 1: because otherwise it's just it's it's a it's a definite
Speaker 1: vicious cycle. Uh. And and just you know again, because
Speaker 1: there's so little detail here, you know, it's it's it's
Speaker 1: putting a lot of of responsibility on these different departments.
Speaker 1: It's hard to say how well this approach will work
Speaker 1: because honestly, we just have the framework of what it's
Speaker 1: supposed to do, not how it's supposed to do it.
Speaker 1: So so it's a little too early for us to
Speaker 1: say whether or not the policy that comes out of this,
Speaker 1: assuming that one does come out of it, will be
Speaker 1: a good one or a bad one. Because when we
Speaker 1: also have to have Congress way in on this. Uh,
Speaker 1: this is an executive order, but if we want laws passed,
Speaker 1: that's when you start looking to Congress. And a lot
Speaker 1: of the issues that have happened in the past few
Speaker 1: years that have to do with security online also seemed
Speaker 1: to involve intellectual property. Um, and that's I think it's
Speaker 1: pretty ugly. I mean, we have and sis, these were
Speaker 1: things that we're not just about protecting the well, that's
Speaker 1: about protecting businesses use it, but not from cyber attacks
Speaker 1: so much as piracy. But you know, that's the kind
Speaker 1: of stuff that we see have and all the time,
Speaker 1: because we've got a lot of powerful interest groups that
Speaker 1: are campaigning very hard with certain members of Congress to
Speaker 1: put forth legislation that would protect their industries and possibly
Speaker 1: hurt uh, innocent users of the Internet as a result,
Speaker 1: mostly through unintended consequences, not necessary, not not on purpose. Yeah,
Speaker 1: I mean, but but but just like the Cyber Intelligence
Speaker 1: Sharing and Protection Act of CISPA UM, you know, failed
Speaker 1: to make it through the Senate. It was because it
Speaker 1: was because basically the White House said, in this form
Speaker 1: we're going to veto it because of privacy issues. Yeah. Yeah, See,
Speaker 1: it's not an easy problem to solve at all. I mean,
Speaker 1: there's there are a lot of mind fields around this problem.
Speaker 1: So if it were just as simple as let's oh,
Speaker 1: here here's your problem. Your firewall for the United States
Speaker 1: wasn't flipped on, let me just turn the switch, then
Speaker 1: that would be great. Unfortunately that's not the not not
Speaker 1: the case. So yeah, it's it's gonna be it's gonna
Speaker 1: be a tough tough act to to enact. Really, it's
Speaker 1: gonna be a tough policy to create because to make
Speaker 1: it effective and yet not violate our privacy or civil
Speaker 1: liberties well or put too much of a burden on
Speaker 1: private business, or not give enough incentive for private business
Speaker 1: to even get involved with it. Um It's it's not
Speaker 1: an easy thing to do, certainly not. And it also
Speaker 1: requires a kind of a base level of just people
Speaker 1: being aware of stuff. I mean, for example, in in
Speaker 1: the news this week. Last week there was that kind
Speaker 1: of hilarious thing where where the emergency alert system was
Speaker 1: hacked in um On, Tanta, Michigan, California, and New Mexico,
Speaker 1: I think, and they sent out that um hacker sent
Speaker 1: out this zombie apocalypse warning. Oh right, right right, I
Speaker 1: remember that. Yeah, the whole emergency alert the deadhead of
Speaker 1: risen from the grave, that kind of thing, right right,
Speaker 1: I think? I think, yeah, gaker, someone reported that four
Speaker 1: people proceeded to freak write the hell out, and they
Speaker 1: definitely called in. Four people called in concern, and of
Speaker 1: course they may have just called in to ask y'all,
Speaker 1: did you get hacked? We don't know. We don't know
Speaker 1: what the nature of the calls were. We just know
Speaker 1: that four people did actually call in. So whether or
Speaker 1: not they were truly worried that the dead had risen
Speaker 1: or they were just wondering what the heck went on,
Speaker 1: we don't know. Right. But supposedly, according to the president
Speaker 1: of the Michigan Association of Broadcasters, UH they routers reported
Speaker 1: that they believed the hackers succeeded because the TV stations
Speaker 1: had never changed the default passwords that were installed in
Speaker 1: their hardware. Yeah, password one to three guys. It's great
Speaker 1: and and and that kind of thing. I mean, just
Speaker 1: just basic, you know. It's it's we really need to
Speaker 1: just educate everyone about how the internet works, maybe, or
Speaker 1: or just make sure that everyone cares enough. We'll let
Speaker 1: people know that there are uh default passwords and they
Speaker 1: are pretty much standard across all devices of us from
Speaker 1: a certain manufacturer. I mean maybe that it's admin for
Speaker 1: one and password for another, but they are standard across.
Speaker 1: And once you know what those standards are, that's the
Speaker 1: first thing you try. And you can find them on
Speaker 1: the internet, that's yeah, So you can find them by
Speaker 1: buying one. That's all you have to do is go
Speaker 1: out and you buy one of each thing and they're
Speaker 1: not that expensive, Like you buy some routers, they're not
Speaker 1: that that expensive. By buying each one and installing, you
Speaker 1: see what the default password is, and then you just
Speaker 1: add that to your dictionary attack. You know, you make
Speaker 1: that priority one. So first first round of dictionary attack,
Speaker 1: use the default password. If that works, your golden if not,
Speaker 1: moved a step two. So I mean, yeah, it's it's
Speaker 1: not good. And then on top of that, like on
Speaker 1: a related thing, we haven't done an episode about this,
Speaker 1: but on a kind of related idea about information online
Speaker 1: and protecting ourselves and making sure we can respond to threats.
Speaker 1: Another report that happened earlier in it was about the
Speaker 1: FBI asking essentially asking internet companies for a wire tap
Speaker 1: friendly back door into their systems. Now, this included everything
Speaker 1: from infrastructure to actual corporations, and the FBI said, we
Speaker 1: want to be able to get in there and check
Speaker 1: on information when we are looking for things like cyber
Speaker 1: terrorists or cyber warfare attacks and perhaps not thinking about
Speaker 1: the fact that every time you you cut a new
Speaker 1: door in a wall, it's that door can be used
Speaker 1: by anybody exactly that's the issue here is that inner.
Speaker 1: First of all, most of these systems already have back doors,
Speaker 1: so really it would mean giving the FBI access to them,
Speaker 1: because you have to have a way for an administrator
Speaker 1: to get hold of the system so that when something
Speaker 1: goes wrong, the administrator can fix it. As I learned
Speaker 1: in the documentary Durassic Park. Yes, very important, that's a
Speaker 1: good one. Yeah. Also it shows that when you create
Speaker 1: a security back door that an administrator can get into,
Speaker 1: a twelve year old girl can hack in because she
Speaker 1: knows Unix was that Unix? I think it was Unix,
Speaker 1: all of that out of I know this, I know,
Speaker 1: she says, I know this, and then she sits down
Speaker 1: in types and then by the third thing she's in. Uh,
Speaker 1: because that's the rule of three in the Internet of Hollywood.
Speaker 1: But yeah, the the point here is that by introducing vulnerabilities,
Speaker 1: you have created the opportunity for the bad guys whoever
Speaker 1: you want to say are the bad guys, to go
Speaker 1: and infiltrate a system, so you don't Generally, that's considered
Speaker 1: by most security experts to be what we call a
Speaker 1: bad thing, giving more opportunity to people to infiltrate a
Speaker 1: system is not a great idea. It doesn't help you
Speaker 1: be safe. So we've got a lot of focus on
Speaker 1: this this problem, and I'm at least confident that the
Speaker 1: government is aware that there are experts out there who
Speaker 1: can help guide this conversation. Whether they listen or not,
Speaker 1: that's you know, that that remains to be seen. But
Speaker 1: I hope that they are careful enough to consider exactly
Speaker 1: the implications of these these policies so that when they're
Speaker 1: enacting them, when they start to really build them out, uh,
Speaker 1: they are doing it with the most accurate information. And
Speaker 1: I already think they really do have the best of
Speaker 1: intentions as far as cybersecurity is concerned. Whether or not
Speaker 1: you agree considering you know, the business side of things
Speaker 1: that that that's different, but but at least from the
Speaker 1: idea we need to protect ourselves, I think we all
Speaker 1: agree on that that the cyber threat is a real threat,
Speaker 1: and it's a growing threat, and as we relying more
Speaker 1: and more on these systems, it's just going to get
Speaker 1: even to become an even more attractive target for someone
Speaker 1: who wants to really wreak some havoc. So for all
Speaker 1: those doctor evils, out there. I am not one, No,
Speaker 1: certainly not. I don't own a cat. So anyway, that's
Speaker 1: that's kind of the story about where we are right now.
Speaker 1: As far as the the idea of trying to protect ourselves,
Speaker 1: I know it was vague, but that's because again the
Speaker 1: executive order was necessarily even it's all vague right now,
Speaker 1: so you know, keep keep checking back. We'll let you
Speaker 1: know if there are any definite development right and and
Speaker 1: again I'll be amazed if this, if everyone is able
Speaker 1: to meet the deadlines that are laid out in this
Speaker 1: executive order. It would It's not that it's impossible, it
Speaker 1: would just require a pretty remarkable turnaround. So we'll see
Speaker 1: how it develops. We'll see how this could potentially impact business, individuals,
Speaker 1: um and even our our national security. It's an important thing.
Speaker 1: And keep in mind, you know, of course, for those
Speaker 1: of us in the United States, there are lots of
Speaker 1: other nations that are looking into this as well. Lauren
Speaker 1: was talking about the European Union looking into ways of
Speaker 1: protecting uh the the infrastructure in Europe. But this is
Speaker 1: not localized to the United States as particular approaches. But
Speaker 1: the problem is worldwide, So we're just gonna see lots
Speaker 1: of different takes on this system and whether or not
Speaker 1: any of them work better than others well, which is
Speaker 1: let to wait and see. So with that in mind,
Speaker 1: if you guys have any topics you would like us
Speaker 1: to tackle in future episodes of tech Stuff, here's what
Speaker 1: I would like you to do. I would like you
Speaker 1: to send us an email our addresses tech stuff at
Speaker 1: Discovery dot com, or let us know on Facebook or
Speaker 1: Twitter are handled both of those as text stuff hs
Speaker 1: W and Laura and I will talk you again really
Speaker 1: soon for more on this and thousands of other topics.
Speaker 1: Is it how stuff works dot com