The US Data Security EO with Lee Licata and Grant Dasher (Part 2)
Nov 26, 2024
auto_awesome
Lee Licata, Deputy Section Chief for National Security Data Risk at DOJ, and Grant Dasher, Acting Technical Deputy Director for Cybersecurity at CISA, dive into crucial cybersecurity regulations following Executive Order 14117. They discuss the implications of the DOJ's proposed rulemaking and the necessity for public participation in shaping these crucial regulations. The conversation spotlights national security risks related to data handling and the role of CISA in enforcing compliance. Tune in for insights into the evolving landscape of cybersecurity policymaking!
The implementation of Executive Order 14117 focuses on addressing national security risks from adversarial nations accessing sensitive American data.
The Streamlining Federal Cybersecurity Regulations Act aims to create a regulatory harmonization committee to refine cybersecurity policies in the U.S.
Deep dives
Legislative Developments in Cybersecurity
Recent legislative efforts focus on improving cybersecurity regulations in the U.S. with the introduction of the Streamlining Federal Cybersecurity Regulations Act, proposed by Senators Gary Peters and James Lankford. This bill, along with a counterpart in the House, aims to establish a regulatory harmonization committee led by the national cyber director. The growing conversation around regulatory harmonization highlights a need to refine U.S. cybersecurity policies, addressing challenges faced by companies operating in multiple sectors. Events held by the G7 and Columbia University underline the increasing engagement and importance of these legislative measures in shaping the future of U.S. cyber policy.
Data Security Executive Order Insights
The implementation of the Data Security Executive Order, signed by President Biden earlier this year, seeks to tackle national security risks related to adversarial nations accessing Americans' sensitive data. Recent updates include proposed regulations that identify six countries of concern—China, Russia, Iran, North Korea, Venezuela, and Cuba—highlighting the serious threats posed by these nations. The regulations outline the types of sensitive personal data at risk, such as genomic and financial data, while also establishing compliance protocols for businesses. As companies prepare for upcoming deadlines, public feedback during consultation periods will help refine these regulations to ensure robust protection against potential data breaches.
CISA's Role in Cybersecurity Regulation
The Cybersecurity Infrastructure Security Agency (CISA) is actively developing security requirements guiding investment and vendor agreements involving sensitive data linked to the aforementioned six countries. These requirements aim to manage and mitigate risks associated with restricted transactions that could lead to unauthorized access to personal data. CISA's collaboration with the Department of Justice on these regulations showcases a combined effort to enhance security protocols in the face of national security concerns. As organizations are encouraged to prepare for compliance ahead of the final rule's issuance, these best practices will help streamline cybersecurity measures across sectors.
Emerging Threats from Social Engineering Tactics
Research has uncovered that Russian cyber operations are increasingly emphasizing social engineering tactics to exploit individuals’ trust. Recent reports highlight targeted efforts where attackers impersonate known contacts, leveraging familiar subjects to bypass traditional security measures. The implementation of screening steps, such as sending messages without attachments, serves to reduce suspicion while cleverly filtering potential victims. As cyber threats evolve, ongoing education about these malicious tactics and the importance of multi-factor authentication can empower individuals to better protect themselves against such sophisticated attacks.
In the latest Distilling Cyber Policy podcast, Alex Botting and Jen Ellis from the Center for Cybersecurity Policy & Law are re-joined by guests from earlier this season: Lee Licata, Deputy Section Chief for National Security Data Risk at the Department of Justice (DOJ), and Grant Dasher, the Acting Technical Deputy Director for Cybersecurity at the Cybersecurity and Infrastructure Agency (CISA).
Both came on to discuss the then-recently released Executive Order 14117 and the associated Advanced Notice of Proposed Rulemaking (ANPRM). Since then, the DOJ issued a Notice of Proposed Rulemaking (NPRM), with written comments from the public due by November 29, 2024. Additionally, as directed by the EO, CISA has developed proposed security requirements to apply to classes of restricted transactions identified in the NPRM. In the episode, Lee and Grant dig into the proposed rule and security requirements, as well as the next steps in the rule making process.