Trump Administration's Policy On Cybersecurity

President Trump's administration is expected to push for increased cybersecurity spending in US government, but also for increased digital surveillance and encryption work-arounds.

That's the view of some cyber-security policy experts, who said they expect Trump to focus on improving cybersecurity at federal agencies while shying away from new cyber-security regulations for businesses. 

Trump is likely to look for ways for the National Security Agency and other agencies to assist the government and companies in defending against cyber-attacks, said Jeffrey Eisenach, a visiting scholar at the American Enterprise Institute and a tech adviser during Trump's presidential transition.

"Cyber has to be top of mind for any view of the United States' global strategy," Eisenach said recently during a discussion about Trump's cybersecurity priorities. "If you're not thinking of cyber first, I don't know what you should be thinking about."

A proposed executive order from Trump on cybersecurity was leaked in January, but its formal release was postponed. Beyond the leaked drafts, it's difficult to read the tea leaves of a Trump cyber policy, other cyber-security experts said. 

Given Trump's focus on fighting terrorism during his presidential campaign, he's likely to push for greater surveillance powers, said Adam Klein, a senior fellow at the Center for a New American Security. A foreign surveillance provision in US law is set to expire at the end of the year, and Klein expects the Trump team to push for unfettered re-authorisation.

Trump "campaigned on vigorous counter-terrorism efforts, and that is likely to lead his approach on surveillance and privacy issues," Klein said. Trump may move away from former President Barack Obama's attempts to balance privacy and national security, he said. 

The Department of Homeland Security has already talked about demanding social media passwords during border searches, Klein said. While he said he doubts the searches will happen, the discussion "suggests we're in a new era here," he added.

Meanwhile, Trump and new Attorney General Jeff Sessions have both criticised tech companies' resistance to encryption backdoors, Klein noted. Both called on Apple to assist the FBI with unlocking a terrorism suspect's iPhone last year. Even if Congress doesn't pass encryption legislation, the Department of Justice could aggressively sue tech companies that refuse to break encryption, he said.

While Trump initially pushed for the cyber-security executive order, related issues now seem to be on the backburner in his administration as he focuses on a travel ban from Muslim-majority countries, building a border wall, and other issues, said Denise Zheng, director of the Technology Policy Program at the Center for Strategic and International Studies.

Drafts of the executive order assigned each cabinet official more responsibility for the safety of data within their agencies. Trump has also called for agencies to modernise their IT systems as a way to improve cyber-security.

One of the main cyber-security issues going forward is Russian hacking and its impact on the presidential election, but that's a "tough issue" for Trump to tackle, Zheng said.

Trump should focus on encouraging agencies and companies to share cyber-threat information and on modernising government IT systems, recommended Steve Grobman, CTO of Intel Security. The government's legacy IT systems "were not designed to make use of modern security best practices," he said.

To help with private-sector cyber-security, Trump should look for ways to expand cyber-security training programs, Grobman recommended.

And instead of regulations, Trump could look at tax breaks as a way to encourage companies to improve their cyber-security, he added. "Positive incentives, rather than punitive regulations, will help produce real results," he said.

Grobman also called on the Trump administration to resist any urges to require encryption backdoors in tech products. Encryption backdoors in devices may prompt criminals to move to other encryption technologies that device makers have no control over, he said.

"We need to test whether we're solving the problem with the solution that's being recommended," he added.

Computerworld

Tech Companies Oppose Trump’s Travel Ban:

Anonymous To Trump: You will ‘Regret’ Next 4 Years:

Trump Offers A Cyber Security Warning:

 

 

« Are Employees Your Weakest Link When It Comes To Security?
US Buys Mysterious ISIS Drone Killer »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

King & Spalding

King & Spalding

King & Spalding is an international law firm with offices in the United States, Europe and the Middle East. Practice areas include Data, Privacy & Security.

Site24x7

Site24x7

Site24x7 is an AI-powered observability platform for DevOps and IT operations.

ReFoMa

ReFoMa

ReFoMa is a consultancy and advisory company with a focus on information Security.

Information System Authority (RIA) - Estonia

Information System Authority (RIA) - Estonia

RIA ensures the interoperability of the state’s information system, organises activities related to information security, and handles security incidents in Estonian computer networks.

Dellfer

Dellfer

Dellfer secures connected cars and other IOT devices through Intrinsic protection, enabling the most sophisticated cybersecurity attacks to be seen instantly and remediated with precision.

Humming Heads

Humming Heads

Humming Heads offers a complete solution to fight the advanced threats that target a company's endpoints and servers.

ToucanX

ToucanX

ToucanX has eliminated remote attack vectors without sacrificing productivity. We’ve brought embedded near real time virtualization to the enterprise endpoint.

Center for Information Technology Policy (CITP) - Princeton University

Center for Information Technology Policy (CITP) - Princeton University

The Center for Information Technology Policy at Princeton University is a nexus of expertise in technology, engineering, public policy, and the social sciences.

TXOne Networks

TXOne Networks

TXOne Networks offer cybersecurity solutions to protect your industrial control systems to ensure their reliability and safety from cyberattacks.

Guidepost Solutions

Guidepost Solutions

Guidepost Solutions are a diverse, global team of investigators, experienced security and technology consultants, and compliance and monitoring experts.

Radiance Technologies

Radiance Technologies

Radiance solutions provide technological advantage and operational superiority for our nation in the areas of intelligence, cyber and advanced weapon systems.

Custodia Continuity

Custodia Continuity

Custodia Continuity manage your Security, Backup, Continuity and Compliance. You get on with your business.

Pistachio

Pistachio

Pistachio is the new evolution of cybersecurity awareness training and attack simulations.

LevelBlue

LevelBlue

LevelBlue simplify cybersecurity through award-winning managed security services, experienced strategic consulting, threat intelligence and renowned research.

Custocy

Custocy

Custocy is a unique collaborative AI technology that identifies sophisticated and unknown (zero-day) attacks.

National Critical Information Infrastructure Protection Centre (NCIIPC) - India

National Critical Information Infrastructure Protection Centre (NCIIPC) - India

NCIIPC's mission is to protect the Critical Information Infrastructure of India, from unauthorized access, modification, use, disclosure, disruption, incapacitation or destruction.