Cybersecurity

Why the cyber EO won't solve botnets

Shutterstock image 

The distributed denial-of-service attack that hobbled Internet service across the U.S. in October 2016 showed how vulnerable connected devices are to botnets, said officials tasked with researching the problem. And reducing the botnet threat will be a long, slow process.

The Trump administration's cybersecurity executive order charges the secretaries of Commerce and Homeland Security with leading a process to reduce the threat of botnets and DDoS attacks. Under the order, the secretaries have until January 2018 to issue a preliminary report, with a final report due in May 2018.

Two members of the team conducting the study stressed to members of the Information Security and Privacy Advisory Board that they will not solve the botnet problem in a year.

Kevin Stine, chief of the National Institute of Standards and Technology's Applied Cybersecurity Division, said the goal is to develop a series of recommendations "that will contribute to what we're considering right now is more of a roadmap -- some potentially short-term, mid-term, long-term actions that can be taken."

The team is currently in the process of meeting with stakeholders and awaiting responses to a request for comment to gather information about what work has been done to date, what the barriers are to progress and what can realistically be done.

"We know some good things that should be happening, but why and where are the gaps that are occurring that we need to bring the right stakeholders together to talk about?'" said Evelyn Remaley, who's with the National Telecommunications and Information Administration's Office of Policy Analysis and Development.

Remaley and Stine emphasized that the challenge will only continue to grow because of the explosion in internet-connected devices and manufacturers.

"Having a new set of players come into the marketplace that can impact the ecosystem, who haven't really thought about security in the same way that many of have for a long time is a game changer," said Remaley.

She said there has been a lot of outreach to the internet of things sector to educate them on security and patching.

"The response has been good but it is taking some time ... because it is almost learning a new language," she said. "It's obviously not just one group either, it's so diverse."

At the center of their research will be finding a balance between regulation and market incentives to push people to practice better cyber hygiene and bake security into devices and systems.

"I think the complexity of this space is going to require multifaceted approaches," said Stine. "And I think the other piece to really think about...is the international dimension'."

The two speakers pointed to the variety of international companies, customers and regulatory ecosystems, and the fact that no country has found a solution to botnets.

"I think that alone makes it clear that even if you would like to fix it by passing regulation, that's actually not going to fix it," said Remaley. "So it is going to take these collaborative efforts across and internationally to make some progress here."

Remaley said the team is in close consultation with the White House about the work plan and build-out of the report to make sure they are meeting the expectations of the executive order. She said they are trying to make clear that the report delivered next year will be a roadmap to solutions, rather than the final solutions.

AT&T's Chris Boyer, chair of the ISPAB, encouraged the team to think beyond the usual focus on short-term patching and notification measures.

"We need to think about kind of a longer-term, fundamental rethinking of some of these architectures to make them more inherently secure," he said, "because right now we're really putting a Band-Aid on them."

Boyer and other board members stressed the need to focus on resiliency and not simply prevention or elimination of botnets. The latter would be unrealistic, they said because botnets will continue to exist and attacks will happen.

"That's what we try to focus on," said Remaley. "What is realistic, actionable and incremental progress that can be made? We're not going to try to boil the ocean."

About the Author

Sean Carberry is a former FCW staff writer who focused on defense, cybersecurity and intelligence.


Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.