The Biden-Harris Administration today released a new National Cybersecurity Strategy which aims to "secure the full benefits of a safe and secure digital ecosystem for all Americans."
President Biden intends to use "all the tools of national power" to protect national security and public safety while allowing for economic prosperity. And it seems that national power is going to be aimed at the tech giants, as the strategy is focused on "shifting the burden for cybersecurity away from individuals, small businesses, and local governments, and onto the organizations that are most capable and best-positioned to reduce risks for all of us."
The strategy points to China, Russia, Iran, and North Korea as being the worst offenders when it comes to "aggressively using advanced cyber capabilities" against the US. However, it's China that the US government views as the most dangerous threat, claiming:
"The People’s Republic of China (PRC) now presents the broadest, most active, and most persistent threat to both government and private sector networks and is the only country with both the intent to reshape the international order and, increasingly, the economic, diplomatic, military, and technological power to do so."
The approach to achieving this enhanced level of national cybersecurity is reliant on five pillars:
- Defend critical infrastructure
- Disrupt and dismantle threat actors
- Shape market forces to drive security and resilience
- Invest in a resilient future
- Forge international partnerships to pursue shared goals
All five pillars seem typical for a modern approach to cybersecurity, and it looks as though Biden intends to take a similar line to the CHIPS Act. There will be a focus on long-term investments in cyber defense and resilience, but cybersecurity R&D is being prioritized, as are "partnerships with academia, manufacturers, technology companies, and owners and operators," alongside "developing a diverse and robust national cyber workforce."
Anyone willing to provide the cybersecurity systems the US government requires should therefore have an easy time getting funded and can call upon the support of federal departments and agencies, including the National Science Foundation (NSF) and DOE National Laboratories.
The big tech firms will be most concerned about the third pillar (shape market forces to drive security and resilience), as it suggests a big shift in consequences on to vendors for "poor cybersecurity." It also requires better privacy and security for personal data, and "shifting liability for software products and services to promote secure development practices."
The implementation of this new National Cybersecurity Strategy is apparently already underway and being coordinated by the Office of the National Cyber Director. The full strategy document can be downloaded as a PDF.