CISA Official: Government-Wide Cybersecurity Overhaul Will Take Years

President Joe Biden’s May 12 executive order set the stage for a long-term strategy for enhancing the federal government’s cybersecurity, according to an official from the Cybersecurity and Infrastructure Security Agency.

Matt Hartman, deputy assistant director of cybersecurity at CISA, said many of the core issues the executive order is trying to address can only be solved through years of “focus and investment,” GovernmentCIO Media & Research reported.

“Many of these EO tasks are sprints to develop architectures or roadmaps, and these are the initial milestones that will set additional milestones that will commence multi-year journeys,” Hartman said during a homeland security forum hosted by the American Council for Technology and Industry Advisory Council.

The executive order also expanded CISA’s authorities to counter cyber attacks, including through the creation of a cyber incident response playbook.

CISA recently logged the first entries in its list of “bad” cybersecurity practices for critical infrastructure operators.

According to Hartman, the Office of Management and Budget is expected to release a cloud security strategy sometime in August. 

He said the strategy will be focused on the zero trust security architecture and will coordinate the federal government’s implementation of the architecture over the next two years. 

The zero trust model was designed to protect systems from within by restricting access for all network users without exception.

Hartman previously said that CISA worked with the National Institute of Standards and Technology in helping develop the White House’s government-wide zero trust strategy.

Federal officials have recommended using a combination of zero trust and basic cyber hygiene to address threats like ransomware, which has affected critical infrastructure sectors like health care.