Cybersecurity in 2016: Real change or more of the same?

Looking back, 2015 was a time of strain in the public sector when it came to cybersecurity, with the hack of systems at the Office of Personnel Management that exposed over 20 million government employee records, the high infection rate of state and local networks by malware and ransomware and the overall lack of security compliance of government software. Here, then, is a start-of-the-year list of some the issues government will face in 2016.

The Internet of Things: The rap about the IoT is that it’s still on the horizon,  but many argue that it’s already here, and people are putting (betting?) money on it influencing both industrial IT and the evolution of smart cities. The White House demonstrated its support when it jumped into the fray in 2015 with a $160 million initiative. But there are concerns that the technical evolution of the IoT is getting too far ahead of the much slower development of security and privacy policies. This year should see rapid movement around those issues. We hope.

Contractors get the security eye: Big integrators and government contractors have long been aware of the need for tight cybersecurity in their work with government agencies, but the same can’t always be said of the subcontractors they hire. As hackers get more sophisticated about how to access government systems, they are finding vulnerabilities in the security of those smaller firms, with devastating results. The OPM hack, for example, was attributed to the theft of a vendor’s network access credentials. The massive breach at the retailing giant Target the previous year was blamed on credentials stole from a HVAC vendor. The government has begun to try and rein in lax vendor security, with the Office of Management and Budget issuing “cyber guidance” for contractors. Don’t bet on that being the last word, however.

Encryption: There’s a debate brewing over encryption. On the one hand, it’s considered essential to cover security, given that best practices now assume that persistent hackers will penetrate even the best defenses. In that case, the more data and communications can be encrypted, the safer they will be. OMB seemed to be following that logic when it issued a memo in June requiring federal agencies to encrypt their websites and web services connections. But others say that it’s a much more nuanced argument than just encrypting everything, and that true security also requires a way to inspect both incoming and outgoing encrypted traffic. Email encryption has become a particular target for security critics, especially in light of the hackers of Pentagon email networks who reportedly took advantage of outgoing encrypted traffic that was not being inspected. Meanwhile, the government is having to address public demands for even more encryption, a move intelligence agencies view with suspicion, saying it could hurt their efforts against terrorism.

The value of NIST: The National Institute of Standards and Technology has never been an outfit to blow its own horn, so its impact on cybersecurity over the past few years has often seemed less obvious than that of the Department of Homeland Security and DOD. But NIST is arguably the most ambitious agency when it comes to addressing the more technical aspects of cybersecurity, and 2016 could finally be the year when agency gets the recognition it deserves. Surveys already suggest that the majority of government agencies are now getting on board with NIST’s Cybersecurity Framework, and the private sector is also paying greater attention to that guidance. Other NIST endeavors, such as its Identity Ecosystem Framework, the first version of which was released in October, are also taking flight. The agency recently asked for proposals that can develop identity solutions for state and local government.

The malware ecosystem: The biggest hurdle government may have when it comes to cybersecurity is realizing what it’s up against. Despite the now-clichéd idea that only state actors such as Russia and China are capable of the biggest and most penetrating attacks, the lure of filthy lucre has created a widespread and highly networked ecosystem of criminals and hackers that crank out highly sophisticated threats. And government is not ready to deal with this kind of industrialized threat machine, according to some observers. The spectrum of tools now available to hackers is immense and growing, and the research and development that goes on in this underground industry is impressive -- turning even legitimate proxy networks into channels hackers can use to their advantage.

The year security is taken seriously? Despite 2015 providing an embarrassment of cybersecurity breach riches, there’s no sign that government overall is paying that much more attention to information security -- it still seems to fall behind many other issues that cash-strapped agencies must address. Whatever security resources are being deployed seem to be mostly aimed at reaction rather than preemption. However, there are signs that attitude may be changing. Early in 2015, the DOD said it would kick workers guilty of “poor cyber hygiene” off networks they need to do their jobs, and Congress has made noises about stricter oversight of agency cybersecurity and holding agencies accountable for failures. Time will tell if these efforts amount to anything. If the lesson of the OPM hack -- that agency executives can lose their jobs if they don’t take care of security -- doesn’t hit home, you have to wonder what will.