Federal Tech Podcast: for innovators, entrepreneurs, and CEOs who want to increase reach and improve brand awareness

Ep. 61 Understanding the National Cybersecurity Strategy

Apr 6, 2023

Bill Wright, Global Head of Government Affairs at Elastic, discusses the National Cybersecurity Strategy and the challenge of federal privacy legislation. The strategy aims to fill in security gaps in the private sector, shift security liability to software makers, and incentivize basic security built into offerings. Industry groups may resist these changes. Public-private partnerships are crucial for enhancing cyber protections in critical infrastructure sectors.

Ask episode

Chapters

Transcript

Episode notes

Introduction

00:00 • 3min

National Cybersecurity Strategy and Challenges

02:52 • 12min

Industry groups' response to DoD's initiative on CMMC and pushback on cybersecurity requirements

15:18 • 2min

The Evolution of Infrastructure and the Role of Public-Private Partnerships in Cybersecurity

17:44 • 3min

Challenges of Cyber Incident Reporting and the Need for Harmonization

20:39 • 3min

In March of 2023, the National Cybersecurity Strategy was released. Lots of pundits opined a day or two after the release; rather than an immediate reaction, it seems best to wait for a news cycle or two to look at the strategy from a better perspective. Well, what better perspective than a person who has worked inside the government, is an attorney, and has some serious credentials in the tech world?

Today, we sat down with Bill Wright, Global Head of Government Affairs at Elastic. The strategy document talks about the importance of infrastructure. Bill Wright comments that 80% of the critical infrastructure in the United States is privately held. One overarching purpose of the document is to try to fill in the security gaps in the private sector.

Bill remarks that the third "pillar" of the document may present the biggest challenge. This is the call for federal privacy legislation. Americans are sensitive to any kind of federal control over-identification. This alone may take three to five years to pass legislation.

What is new is a shift of security liability to the software makers. The Executive Order is trying to incentivize solutions providers to have basic security built into the offering, instead of the constant bolting on of software packaged to comply with a new initiative. Years of failure have shown how limited this after-the-fact approach is.

Because Bill has decades of experience in technology policy, he can see how some industry groups may balk. The example he gives is members of industrial water systems were not consulted before this mandate.

He ends the interview by stating the obvious: computer networks are now part of the critical infrastructure of the United States. Many of the security recommendations are made with an understanding of the role of CISA in the entire endeavor.

Listen to the interview to get a fresh, new perspective on the new federal mandate.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast www.federaltechpodcast.com