Governance & Risk Management

Has Cybersecurity Been Overstudied?

Has cybersecurity been overstudied by the U.S. federal government and its stakeholders?

See Also: How to Take the Complexity Out of Cybersecurity

Melissa Hathaway, who served presidents George W .Bush and Barack Obama as a top cybersecurity adviser, points out that over the past decade, more than 100 recommendations on improving the cybersecurity of government and the private sector have come from Congress, presidential studies and private-sector think tanks (see Obama's Cyber Review Leader on What's Ahead for Trump).

But for the most part, those recommendations have not been implemented, she points out. "They have consistently called for the need for leadership, follow-through and operationalization of the policies," says Hathaway, a senior adviser on cybersecurity at the Harvard Kennedy School's Belfer Center for Science and International Affairs.

Heavy Load

Hathaway says the cybersecurity executive order signed by President Donald Trump on May 11, which directs the government to further study the problem, will add dozens of new reports in 14 areas (see Trump Finally Signs Cybersecurity Executive Order).

"This will require every agency to dedicate precious and shrinking resources - time and personnel - to develop these plans, delaying and possibly distracting these agencies from their current cybersecurity activities and operations," Hathaway says.

Hathaway is a veteran of cybersecurity strategy development. In February 2009, a new president - Obama - tapped Hathaway to conduct a policy review that became the basis of the Obama administration's cybersecurity policy.

She acknowledges that modernizing government IT is "desperately needed" and is consistent with congressional initiatives. "It is essential that we clean up our infected infrastructures," the former presidential adviser says.

"It is clear that cybersecurity is an important priority to President Trump," Hathaway says. "I am happy to see new initiatives along with continuity of some of the important activities that commenced under Presidents Obama and Bush."

Hathaway created a table that lists the new executive order's 14 requested reports, deadlines to complete the studies, lead agencies overseeing the studies and the recipients of the reports. The primary recipient for most of the reports is Thomas Bossert, assistant to the president for homeland security and counterterrorism. Bossert's portfolio includes cybersecurity.

Reports' Deadlines