Trump administration pulls back curtain on secretive cybersecurity process

The Trump administration has mostly not altered the rules under which the government reaches a decision but is disclosing its process.

Advertisements

The White House on Wednesday made public for the first time the rules by which the government decides to disclose or keep secret software flaws that can be turned into cyberweapons — whether by U.S. agencies hacking for foreign intelligence, money-hungry criminals or foreign spies seeking to penetrate American computers.

The move to publish an un­classified charter responds to years of criticism that the process was unnecessarily opaque, fueling suspicion that it cloaked a stockpile of software flaws that the National Security Agency was hoarding to go after foreign targets but that put Americans’ cyber­security at risk.

“This is a really big improvement and an outstanding process,” said White House cybersecurity coordinator Rob Joyce, who spoke at an Aspen Institute event and issued a blog post on the charter.

By making it public, he said, “we hope to demonstrate to the American people that the federal government is carefully weighing the risks and benefits” of disclosure vs. retention.

The rules are part of the “Vulnerabilities Equities Process,” which the Obama administration revamped in 2014 as a multi­agency forum to debate whether and when to inform companies such as Microsoft and Juniper that the government has discovered or bought a software flaw that, if weaponized, could affect the security of their product.

The Trump administration has mostly not altered the rules under which the government reaches a decision but is disclosing its process. Under the VEP, an “equities review board” of at least a dozen national security and civilian agencies will meet monthly — or more often, if a need arises — to discuss newly discovered vulnerabilities. Besides the NSA, the CIA and the FBI, the list includes the Treasury, Commerce and State departments, and the Office of Management and Budget.

The priority is on disclosure, the policy states, to protect core Internet systems, the U.S. economy and critical infrastructure, unless there is “a demonstrable, overriding interest” in using the flaw for intelligence or law enforcement purposes.

To continue Click here http://snip.ly/tykw7

Author: compliance4all

Compliance4All, the ultimate continuing professional education provider offers you regulatory and compliance trainings from the industry's leading experts, but with one crucial difference -the cost. Compliance4All's objective is to be a platform that provides regulatory and compliance trainings with all the class and features that come with these trainings, at a lower price. Compliance4All seeks to make regulatory and compliance trainings low-hanging fruits. Industries We Focus On: • Trade & Logistics • Aerospace Defense • Banking & Insurance • Food & Beverages • Auditing/Accounting & Tax • Energy • Environment • Education • Automotive Transport • Science and Technology • Government • Construction • Electronics & Semiconductor • Operation • Engineering/Science • Purchasing & Vendor Relation • General counsel/Accountant • Geology & Mining • Documentation/Records

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s