A New Era for Cybersecurity: Recommendations for Preparing Your Infrastructure

President Biden’s sweeping Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity underscores the urgent need for action against an increasingly sophisticated threat landscape. It’s a comprehensive directive aimed at fortifying the government’s cybersecurity posture, but its impact extends far beyond federal agencies—it sets a clear expectation for the private sector as well. For any organization doing business with the government or even tangentially supporting critical infrastructure, this is a moment to evaluate and elevate your cybersecurity readiness.

While the order is ambitious, its success will depend on robust implementation and follow-through. The focus on secure software development, AI-driven defense strategies, and stronger infrastructure resilience presents opportunities for forward-thinking organizations to align with these priorities and position themselves as leaders in cybersecurity. Consider these ten recommendations for preparing organizational infrastructure and programs:

Key Recommendations

1. 1. Align with Secure Software Supply Chain Requirements
      • Adopt secure software development practices outlined in NIST’s Secure Software Development Framework (SSDF) and other industry standards.
      • Ensure your vendors can provide clear attestations and artifacts validating their adherence to these practices, as failing validation may trigger regulatory scrutiny.
   2. Prepare for Quantum-Resilient Cryptography
      • Develop a roadmap to transition critical systems to post-quantum cryptographic standards.
      • Prioritize early adoption of hybrid key establishment methods to mitigate future risks.
   3. Leverage AI with Caution and Purpose
      • Invest in AI-driven tools for threat detection, incident response, and vulnerability management.
      • Recognize that AI technology still requires significant human oversight to maximize effectiveness.
   4. Adopt and Mature Zero Trust Architectures
      • Fully implement zero trust principles to minimize attack surfaces.
      • Focus on granular access controls, network segmentation, and phishing-resistant authentication.
   5. Modernize and Fortify Cloud Environments
      • Collaborate with your cloud providers to implement secure configurations and robust key management systems.
      • Strengthen authentication processes to combat nation-state threats, particularly following recent attacks attributed to China.
   6. Integrate Comprehensive Supply Chain Risk Management
      • Build or enhance your supply chain risk management programs to ensure vendors meet minimum cybersecurity requirements.
      • Continuously assess risks to address potential vulnerabilities.
   7. Stay Ahead of IoT Standards and Cyber Trust Mark (CTM) Compliance
      • Evaluate your IoT inventory and plan for compliance with Cyber Trust Mark (CTM) standards well ahead of the 2027 deadline.
   8. Focus on Digital Identity and Fraud Prevention
      • Support privacy-focused identity verification methods and consider adopting digital identity documents to streamline secure access for employees and customers.
   9. Partner with CISA for Threat Intelligence and Defense
      • Collaborate with government initiatives like CISA’s expanded threat-hunting capabilities to gain insights and strengthen defenses.
      • Ensure this does not undermine the effectiveness of your internal security teams.
   10. Prioritize Infrastructure Resilience
       • Conduct regular assessments and stress tests to evaluate the resilience of your systems, particularly in critical infrastructure sectors like energy, healthcare, and finance.

In summary, foundational to the success of this Order is a need for the government to follow through on previously issued EOs, such as implementing zero trust and securing cloud environments. Implementation may also be impacted by the long timeline for IoT updates, given the shelf life of many devices, which may delay the tangible impact of CTM compliance. Looking ahead, organizations must carefully manage collaboration with CISA and their existing security teams to avoid potential conflicts stemming from CISA’s expanded access. Finally, as highlighted by application security-related incidents like SolarWinds, organizations must bear in mind the importance of diversifying IT environments to reduce monoculture risks.

This executive order is more than just a government directive — it’s a blueprint for resilience in a time of unprecedented threats. It calls for organizations to adopt a proactive cybersecurity stance, ensuring they are not only compliant but also prepared to withstand and recover from attacks. For businesses looking to align with these initiatives, now is the time to act.