19 May Incoming executive action will create stronger cybersecurity standards

After the Colonial Pipeline, changes are on the horizon

The Colonial Pipeline attack has encouraged stricter action on cybersecurity standards for the United States. The primary goal is to boost standards and transparency regarding cybersecurity attacks while also addressing budgetary concerns. Additional funding for national cybersecurity could absolutely be beneficial, though not without addressing the current problems first.

This can only happen too soon. After the major infrastructure attack, a scramble for better security is at the top of everyone’s priority list. However, it also highlights the lackadaisical approach towards current cybersecurity methods. Experts agree it’s a frustrating digital landscape. That’s because common mistakes are still made, most of which are easily preventable. And, unfortunately, it’s these mistakes leading to serious cybersecurity problems like the Colonial Pipeline incident. 

Therefore, current actions taken will help address the problems. But the fight is long from over.

Issues plaguing the current cybersecurity landscape

When you consider the nature of a cybersecurity attack, you probably imagine happening over the course of a few days (or less). But that’s not true – cyber attacks not only disrupt services for a brief period, but IT teams have to handle the recovery period afterward. This can take up to a week or more, adding to overall business and performance lag.

Two of the reasons related to lack of funding and expertise, the issues an executive action hope to address. But this is an example of an SMB or smaller organization – you can see the “lag” in the wake of the Pipeline attack (or similar). 

Adding to that problem is the explosion of attack surfaces. Even before remote working, attack surfaces were a growing issue, where various devices connecting to a business network presented potential threats. Now, with remote working, that problem has increased exponentially. Without strong standards to keep problems like these in check, they’ve cropped up in networks abroad like electronic cysts.

Many of these mentioned complications were present in the Colonial Pipeline cyber infrastructure. From weak policy enforcement to usage of old software, the errors added up leading to a serious breach in their IT security. Worse yet, in the event of ransomware breaches, companies often end up paying the demand even though the FBI strongly recommends against. Internationally and abroad, it’s a consistent problem.

Solutions, executive and not

The fight for improved cybersecurity is always ongoing. There are likely major stipulations many IT based companies will need to abide by, though, regulatory actions will be for safety rather than draconian in measure.

Some speculation is requiring software and OS systems to utilize modern variations to improve security. Or, at the very least, not rely on software that is over a decade old. Cyber attackers routinely rely on weak infrastructure and legacy systems to successfully breach a network.

Other obligations will likely cover transparency. It’s imperative companies provide open reports about how a breach occurred and the extent of the damage. Not doing so creates needless barriers against IT experts who can better identify and solve the problem. It’s important, because cyber attacks demonstrate how they transcend the digital walls, so to speak. This translated to real, physical impacts in the world, briefly causing fuel shortages and other concerns.

Imagine the problem on a wider scale with other critical services, like power, utility, and even food. Given the seriousness of these problems, dictating that attacks are simply “sophisticated” in nature is no longer enough. Enterprises and organizations will need to be explicit and detailed to help fight against advanced cyber attacks.

Where it leaves you

Your business should prepare at least some time to develop strategies for attack reports. It should also strive to keep its infrastructure as secure as possible and move beyond legacy systems, if you can do so.

We are fast moving beyond a point where cyber attacks only impact us in the “numbers and zeroes” sense.  Therefore, acting fast and staying up to standard, executive action or no, is important.

For additional help, you can contact Bytagig for more information.