Addressing the Cyber Alert Gap: Recommendations for Corporate Boards

Government CISA Advisory Committee Urges Action on Cyber Alerts and Corporate Boards

Introduction

The Cybersecurity and Infrastructure Security Agency’s (CISA) advisory committee has delivered a comprehensive list of recommendations to CISA Director Jen Easterly. These recommendations aim to enhance cybersecurity expertise on corporate boards of directors, develop a national cybersecurity alert mechanism, and ensure the protection of high-risk communities from surveillance. The committee comprises former top-ranking officials, executives, and lawmakers who bring a wealth of experience to the table.

Cybersecurity Expertise on Corporate Boards

One of the key recommendations made by the subcommittee on corporate cyber responsibility is to improve the cybersecurity expertise of corporate board members. With new rules from the Securities and Exchange Commission requiring publicly traded companies to report significant breaches, it is crucial for board members to be educated and trained on cybersecurity issues. Dave DeWalt, founder and CEO of investment firm NightDragon, highlights the need for increased expertise on boards.

The Need for a National Cybersecurity Alert System

The lack of an authoritative and coherent national cybersecurity alert system is a pressing concern. Multiple avenues of information flow exist, but they are fragmented and lack actionability. The subcommittee emphasizes the need for actionable alerts that enable swift and effective response to cyber threats. By establishing a national cybersecurity alert system administered by CISA, we can better coordinate responses and protect critical infrastructure.

Protecting High-Risk Communities

High-risk communities, such as non-government organizations, activists, and journalists, are particularly vulnerable to surveillance and hacking. The technical advisory council subcommittee has provided recommendations on how CISA can better protect these communities. This includes providing them with guidance and access to tools that will enhance their cybersecurity defenses. Ensuring the safety of these communities is essential for the protection of free speech and democracy.

Building a Strong Cybersecurity Workforce

To address the growing cybersecurity threats, it is crucial to build a strong and capable workforce. The cyber workforce committee recommends that CISA develop benchmarks and metrics to track progress in this area. Additionally, programs should be created to address burnout and provide opportunities for upskilling and cross-training. Investing in the cybersecurity workforce is necessary to effectively respond to evolving cyber threats.

Enhancing Resilience and Reducing Systemic Risk

The subcommittee on building resilience and reducing systemic risk emphasizes the need to align the forthcoming rewrite of Presidential Policy Directive 21, which designates critical infrastructure sectors and overseeing agencies, with CISA’s determinations of systemically important entities. This alignment will ensure a coordinated and cohesive approach to protecting critical infrastructure. Furthermore, CISA should define its role as a national coordinator and update the national cyber incident response plan to address emerging challenges.

Editorial

Transformative Recommendations for Enhanced Cybersecurity

The recommendations put forth by the CISA advisory committee are significant and have the potential to greatly enhance cybersecurity measures in the United States. The committee’s findings highlight the urgent need to address cybersecurity expertise on corporate boards, the establishment of a national cybersecurity alert system, and improved protection for high-risk communities. These measures are crucial in safeguarding our critical infrastructure and protecting the privacy and security of individuals and organizations.

Collaboration and Action Needed

To translate these recommendations into effective policy, collaboration and action are key. CISA Director Jen Easterly’s track record of embracing committee recommendations instills confidence that these transformative suggestions will be taken seriously. It is imperative for stakeholders across the public and private sectors to come together and implement these recommendations swiftly. Cybersecurity is a shared responsibility, and a collective effort is essential to strengthening our national defenses.

Advice

Investing in Cybersecurity Expertise

It is crucial for organizations to prioritize cybersecurity expertise on their boards of directors. This includes providing education and training for board members on cybersecurity issues. By doing so, companies can stay ahead of evolving threats and mitigate the potential risks associated with cyberattacks. Additionally, organizations should consider establishing performance goals to measure the effectiveness of their boards in ensuring cyber responsible practices.

Establishing a National Cybersecurity Alert System

To improve our ability to respond effectively to cyber threats, CISA should create a national cybersecurity alert system. This system should provide authoritative and coherent alerts that enable prompt action. Collaboration between government agencies, private sector organizations, and cybersecurity experts will be crucial in implementing this system successfully. Regular testing and evaluation of the alert system’s effectiveness should also be conducted.

Protecting High-Risk Communities

The safety and security of high-risk communities, including non-government organizations, activists, and journalists, should be a priority. CISA should work closely with these communities to provide them with guidance, support, and access to the necessary tools for protection against surveillance and hacking. Protecting the privacy and freedom of individuals and organizations is vital for maintaining a healthy democracy.

Nurturing a Strong Cybersecurity Workforce

To address the shortage of skilled cybersecurity professionals, organizations and government agencies should invest in building a robust cybersecurity workforce. This can be achieved through the development of training programs, upskilling initiatives, and cross-training opportunities. Programs should also be in place to address burnout and provide support for cybersecurity professionals, ensuring their long-term effectiveness in defending against cyber threats.

Building Resilience and Reducing Systemic Risk

Aligning the forthcoming rewrite of Presidential Policy Directive 21 with CISA’s determinations of systemically important entities is crucial to mitigating systemic risk in critical infrastructure. CISA should take a leadership role in defining its national coordinating role and updating the national cyber incident response plan to address emerging challenges. This will facilitate a more coordinated and effective response to cyber incidents.