U.S. National Cybersecurity Strategy: Key Pillars and Policy

Introduction

Cybersecurity is fast becoming the most important component of national security, especially in an era in which borders have become permeable and traditional forms of warfare are becoming outmoded or even obsolete. Malevolence increasingly manifests as cyberterrorism, with the destructive potential to wreak havoc on global economic, political, and social systems. Moreover, cybercrime is transnational — it is both akin to non-state terrorist activities and tightly woven into the methods used by non-state terrorist actors. Building a strong national defense around cybersecurity has therefore become a top priority for any sensible nation in this stage of the 21st century.

Overview of the National Cyber Strategy

The United States National Cyber Strategy provides a rough outline covering how the federal government protects all "networks, systems, functions, and data" without impeding the free flow of information or finance online (Office of the President of the United States 1). The strategy includes suggestions for how the federal government can work with allied counterparts abroad, as well as domestic and multinational allies in the private sector. In many ways, the National Cyber Strategy reflects core American interests, and the Office of the President overtly states the intent to "expand American influence abroad," without necessarily indicating what that influence means (1). By joining forces with a global cybersecurity team, the American government can hope to forge the types of coalitions that can prevent and impede cybercrime and cyberterrorism.

Cybercrime is a unique challenge. Unlike any type of traditional warfare, cybercrime and cyberterrorism can be conducted asynchronously. A criminal actor or group could, for example, set malicious code to execute at a future date and time, or have it triggered by a specific type of event — thereby going undetected until it is too late. Remaining vigilant and one step ahead of the threat is of critical importance to cybersecurity strategy. For this reason, the federal government needs to remain dedicated to culling the best minds from around the world to collaborate on an advanced, progressive, and intelligent cybersecurity strategy.

The cybersecurity strategy also needs to include the means by which to design artificially intelligent sentry systems that use algorithmic functions to contribute to a global defense shield capable of remaining intact under any and all circumstances. Working with the private sector in this regard, the United States government can deploy the best of its resources toward the creation of a worldwide system of support to protect public interests everywhere. An ideal cybersecurity strategy entails "a modus vivendi between the government and private corporations, trying to balance market efficiency, science and technology, basic freedoms, and privacy with IT security," as in the Israeli cybersecurity model (Adamsky 4). Public utilities, industry, education, business, and every sector of the economy all need continual protection from intruders and those who seek destruction or disruption.

Centralization is a key area of concern in the national cyber strategy. There are pros and cons, risks and benefits, associated with the centralization of cybersecurity or any other area of security. The Office of the President of the United States declares that centralization is in the best interest of the American people due to the need for aligning risk management and technology activities. Coordinating risk management resources under a common rubric helps all government agencies stay on the same page, aware of threats and the means by which to address them. Collaborating with allied governments will also aid in the protection of critical infrastructure, the protection of critical data, and the generation of an international intelligence community committed to systematic incident reporting.

Protecting critical national infrastructure is the primary objective of the federal cybersecurity strategy, although this objective is closely connected with ancillary goals. Emergency response services and their information networks, law enforcement databases of all types, power control networks, supervisory control and data acquisition (SCADA), military services, finance, and telecommunications are only a few of the many elements of a delicate digital web woven throughout the nation that requires constant vigilance and ongoing protection (Amoroso 2). A vigorous partnership between the private and public sectors has become absolutely essential in maintaining the federal government's cybersecurity program. The private sector offers insight, intelligence, feedback, risk assessment, and the means by which to intervene in case of threats and attacks. Yet ultimately it is the federal government that is responsible for creating the means by which to monitor and control massive amounts of data and for enforcing all laws related to the protection of that data. Cybersecurity strategy therefore includes a comprehensive defense structure with systematic ways of retaliating against and/or punishing aggressors.

The cyber domain is rightly recognized as an area of vulnerability in the national defense system overall (Office of the President of the United States). Small-scale cybersecurity measures such as the use of secure networks, firewalls, intrusion detection systems, antivirus software, audit trails, and encryption are insufficient for the large-scale needs of national infrastructure protection (Amoroso 2).