Why the cyber EO won't solve botnets

Shutterstock image 

The distributed denial-of-service attack that hobbled Internet service across the U.S. in October 2016 showed how vulnerable connected devices are to botnets, said officials tasked with researching the problem. And reducing the botnet threat will be a long, slow process.

The Trump administration's cybersecurity executive order charges the secretaries of Commerce and Homeland Security with leading a process to reduce the threat of botnets and DDoS attacks. Under the order, the secretaries have until January 2018 to issue a preliminary report, with a final report due in May 2018.

Two members of the team conducting the study stressed to members of the Information Security and Privacy Advisory Board that they will not solve the botnet problem in a year.

Kevin Stine, chief of the National Institute of Standards and Technology's Applied Cybersecurity Division, said the goal is to develop a series of recommendations "that will contribute to what we're considering right now is more of a roadmap -- some potentially short-term, mid-term, long-term actions that can be taken."

The team is currently in the process of meeting with stakeholders and awaiting responses to a request for comment to gather information about what work has been done to date, what the barriers are to progress and what can realistically be done.

"We know some good things that should be happening, but why and where are the gaps that are occurring that we need to bring the right stakeholders together to talk about?'" said Evelyn Remaley, who's with the National Telecommunications and Information Administration's Office of Policy Analysis and Development.

Remaley and Stine emphasized that the challenge will only continue to grow because of the explosion in internet-connected devices and manufacturers.

"Having a new set of players come into the marketplace that can impact the ecosystem, who haven't really thought about security in the same way that many of have for a long time is a game changer," said Remaley.

She said there has been a lot of outreach to the internet of things sector to educate them on security and patching.

"The response has been good but it is taking some time ... because it is almost learning a new language," she said. "It's obviously not just one group either, it's so diverse."

At the center of their research will be finding a balance between regulation and market incentives to push people to practice better cyber hygiene and bake security into devices and systems.

"I think the complexity of this space is going to require multifaceted approaches," said Stine. "And I think the other piece to really think the international dimension'."

The two speakers pointed to the variety of international companies, customers and regulatory ecosystems, and the fact that no country has found a solution to botnets.

"I think that alone makes it clear that even if you would like to fix it by passing regulation, that's actually not going to fix it," said Remaley. "So it is going to take these collaborative efforts across and internationally to make some progress here."

Remaley said the team is in close consultation with the White House about the work plan and build-out of the report to make sure they are meeting the expectations of the executive order. She said they are trying to make clear that the report delivered next year will be a roadmap to solutions, rather than the final solutions.

AT&T's Chris Boyer, chair of the ISPAB, encouraged the team to think beyond the usual focus on short-term patching and notification measures.

"We need to think about kind of a longer-term, fundamental rethinking of some of these architectures to make them more inherently secure," he said, "because right now we're really putting a Band-Aid on them."

Boyer and other board members stressed the need to focus on resiliency and not simply prevention or elimination of botnets. The latter would be unrealistic, they said because botnets will continue to exist and attacks will happen.

"That's what we try to focus on," said Remaley. "What is realistic, actionable and incremental progress that can be made? We're not going to try to boil the ocean."

About the Author

Sean Carberry is a former FCW staff writer who focused on defense, cybersecurity and intelligence.


  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

  • Cloud
    cloud migration

    DHS cloud push comes with complications

    A pressing data center closure schedule and an ensuing scramble to move applications means that some Homeland Security components might need more than one hop to get to the cloud.

  • Comment
    Blue Signage and logo of the U.S. Department of Veterans Affairs

    Doing digital differently at VA

    The Department of Veterans Affairs CIO explains why digital transformation is not optional.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.