There are some striking parallels between a pandemic and cybersecurity.
And they are spelled out in a new white paper from one of the leading sources of cybersecurity strategies in the United States.
The Cyberspace Solarium Commission (CSC) developed a strategic consensus on defending the U.S. in cyberspace against significant attacks earlier in 2020.
Now, the commission's new white paper adds cybersecurity recommendations based on lessons learned from the COVID-19 pandemic response.
"The pandemic produces cascading effects and high levels of uncertainty. It has undermined normal policy-making processes and, in the absence of the requisite preparedness, has forced decision makers to craft hasty and ad hoc emergency responses.
This annex [white paper] collects observations from the pandemic
as they relate to the security of cyberspace, in terms of both the cybersecurity challenges it creates and what it can teach the
United States about how to prepare for a major cyber disruption."
4 top cybersecurity and pandemic parallels
The CSC identified four major parallels between the coronavirus pandemic and the cyber threat landscape.
- "Both the pandemic and a significant cyberattack can be global in nature, requiring that nations simultaneously look inward to manage a crisis and work across borders to contain its spread."
- "Both the COVID-19 pandemic and a significant cyberattack require a whole-of-nation response effort and are likely to challenge existing incident management doctrine and coordination mechanisms."
- "When no immediate therapies or vaccines are available, testing and treatments emerge slowly; such circumstances place a premium on building systems that are agile, are resilient, and enable coordination across the government and private sector, much as is necessary in the cyber realm."
- "Finally, and perhaps most importantly, prevention is far cheaper and pre-established relationships far more effective than a strategy based solely on detection and response."
4 new cybersecurity recommendations from the CSC
The Cyberspace Solarium Commission originally presented a list of dozens of urgent steps the U.S. should take as a means of cyber defense and resilience in March 2020.
Now, just a few months later, the world has changed and the pandemic response has informed the CSC's formulation of four new cybersecurity recommendations.
As a backdrop, consider the massive shift to remote work and other risks created by the pandemic's social distancing efforts:
1. Pass an Internet of Things Security Law
"With a significant portion of the workforce working from home during the COVID-19 disruption, household internet of things (IoT) devices, particularly household routers, have become vulnerable but important pieces of our national cyber ecosystem and our adversary's attack surface.
To ensure that the manufacturers of IoT devices build basic security measures into the products they sell, Congress should pass an IoT security law. The law should focus on known challenges, like insecurity in Wi-Fi routers, and mandate that these devices have reasonable security measures, such as those outlined under the National Institute of Standards and Technology's 'Recommendations for IoT Device Manufacturers.'
But it should be only modestly prescriptive, relying more heavily on
outcome-based standards, because security standards change with technology over time."
2. Support Nonprofits That Assist Law Enforcement's Cybercrime and Victim Support Efforts
"Cyber-specific nonprofit organizations regularly collaborate with law enforcement in writing cybercrime reports, carrying out enforcement operations, and providing victim support services.
As the COVID-19 pandemic has proven, trusted nonprofit organizations serve as critical law enforcement partners that can quickly mobilize to help identify and dismantle major online schemes. Such nonprofits have the expertise and flexibility to help and reinforce law enforcement efforts to disrupt cybercrime and assist victims. However, they often face financial challenges.
Therefore, the Commission recommends that Congress provide grants through the Department of Justice’s Office of Justice Programs to help fund these essential efforts."
The Cybercrime Support Network comes to mind as an organization that could benefit from this. Watch the recent SecureWorld web conference with the non-profit's CEO:
Cybercrime: What Is the State of Support for Consumer and SMB Victims?
3. Establish the Social Media Data and Threat Analysis Center
"Because major social media platforms are owned by private companies, developing a robust public-private partnership is essential to effectively combat disinformation.
To this end, the Commission supports the provision in the FY2020 National Defense Authorization Act that authorizes the Office of the Director of National Intelligence to establish and fund a Social Media Data and Threat Analysis Center (DTAC), which would take the form of an independent, nonprofit organization intended to encourage public-private cooperation to detect and counter foreign influence operations against the United States."
4. Increase Nongovernmental Capacity to Identify and Counter Foreign Disinformation and Influence Campaigns
"Congress should fund the Department of Justice to provide grants, in consultation with the Department of Homeland Security and the National Science Foundation, to nonprofit centers seeking to identify,
expose, and explain malign foreign influence campaigns to the American public while putting those campaigns in con-
text to avoid amplifying them.
Such malign foreign influence campaigns can include covert foreign state and non-state propaganda, disinformation, or other inauthentic activity across online platforms, social networks, or other communities."
CSC recommendations that have become more urgent
In addition to the new recommendations, the Cyberspace Solarium Commission says several of its original cybersecurity strategies have become even more pressing in the wake of the COVID-19 pandemic. Here are a few of them:
• The need to digitize critical services and do so securely, which underscores the importance of stimulus grants to incentivize the movement to the cloud and broader modernization in state, local, tribal, and territorial governments.
• The overall importance of the U.S. government leading the push for a more secure and reliable cyber ecosystem, given the increase in working from home.
• The increase in fraud and other malicious activity during the pandemic, which underscores the need to build capacity to combat opportunistic cybercrime.
• Prevention and mitigation efforts underpinned by a solid foundation of comprehensive data, a strong understanding of the risks posed by a crisis, and a data-driven approach to mitigating those risks before, during, and after a crisis.
• Response and recovery capability and capacity, including prior planning and frameworks to coordinate policy responses such as establishing a "Cyber State of Distress" and invoking the Defense Production Act.
There is much more in this new document created by the leaders at the CSC.
READ: Cybersecurity Lessons from the Pandemic white paper
Related cybersecurity podcast episodes
LISTEN: Coronavirus cyberattack against the World Health Organization
LISTEN: Geopolitics and cybersecurity in 2020
