One Year Later: A Hacker’s View on the Cybersecurity Executive Order

When the Colonial Pipeline ransomware attack took place last year, consumers were cut off from fuel, prices jumped, and some mild panic ensued. This was one of the first cyber-attacks that showed consumers—and the industry—that we’re more interconnected than we realized to the consequences of digital crimes. 

Timing is everything. The Colonial Pipeline attack helped pave the way for radical change in the federal government’s approach to cybersecurity. And that’s exactly what the U.S. government is doing with a full year of dynamic stakeholder engagement on various aspects of the Executive Order 14028 Improving the Nation’s Cybersecurity, that will change the status quo of how industry and government become more resilient. 

In the year since the inception of the EO, new cybersecurity incident reporting legislation also passed into law, but adversary tactics still grew more sophisticated and the line between cyber and real-world incidents evaporated. This played out significantly across manufacturing—the most attacked industry in 2021. Threat actors found a leverage point in the critical role manufacturers bear in global supply chains. Whether it was cream cheese, toilet paper or meat, the ripple effect of attacks impacted consumers in a meaningful way.  

The EO provides new defensive and offensive strategies that will help us win some small victories, but the key is effective execution. When the EO validated zero trust by recognizing it as a core part of its strategy to improve US cyber posture, we had a small victory. Now the challenge lays with the actual implementation. Without a deep understanding of trust relationships, implementations will fail. 

Trust relationships need to be thoroughly vetted, tested and tested again. Access and trust should never be presumed; that’s when security gaps are created. Today, many security teams are unknowingly building “less trust”—not zero trust—networks. 

To solve this, we must turn the tables and look at networks from an attacker’s lens; and threat hunting is one way to do just that. Yet, while the EO specifically mentions active cyber hunting, there is confusion around how to conduct the hunt. Automated security…