Special Edition is the blog for security testing business SE Labs. It explains how we test security products, reports on the internet threats we find and provides security tips for businesses, other organisations and home users.

Friday, 11 November 2016

Trump's Cybersecurity Policy

What does a Trump presidency mean for global cybersecurity?

Washington is nervous. No one knows if President Trump understands cybersecurity, or whether he'll listen to those who do.


Some pundits are already suggesting that his first 100 days in office will include a cyber emergency.

How he responds is crucial, but his comments so far have instilled little confidence.
"Cyber is becoming so big today, it's becoming something that a number of years ago, a short number of years ago wasn't even a word."
"We have to get very, very tough on cyber and cyber warfare. It is — it is a huge problem. I have a son. He’s 10 years old. He has computers. He is so good with these computers, it’s unbelievable. The security aspect of cyber is very, very tough. And maybe it’s hardly doable."
To be fair, Trump's campaign site does say that he'll order a review of "all U.S. cyber defences and vulnerabilities" by a specially assembled Cyber Review Team formed from "the military, law enforcement and the private sector".

But Washington needs to know if he will implement or even believe the Cyber Review Team's recommendations. After all, this is the man who, when experts discovered Russian-backed groups attacking the Democratic National Committee, said:
"I don’t think anybody knows it was Russia that broke into the DNC. She’s saying Russia, Russia, Russia, but I don’t — maybe it was. I mean, it could be Russia, but it could also be China. It could also be lots of other people. It also could be somebody sitting on their bed that weighs 400 pounds, OK?"
According to The Washington Post, a sense of dread is descending on the US intelligence community. Former CIA director Michael Hayden summed up the mood:
"I cannot remember another president-elect who has been so dismissive of intelligence received during a campaign or so suspicious of the quality and honesty of the intelligence he was about to receive."
Trump's policy also places an onus on deterring attacks by state and non-state actors, and he has a has a particular thing about China's hackers. He seems openly irritated by the country's refusal to observe intellectual property law. His plan here is to:
"Enforce stronger protections against Chinese hackers … and our responses to Chinese theft will be swift, robust, and unequivocal."
By this logic, it's apparently difficult to attribute an attack when it's Russia, but not when it's China. This kind of thinking will need to change or it could damage superpower relationships at a uniquely dangerous point in world history.

Part of the danger is that a sufficiently irked President could order a pre-emptive cyber-strike against China to show everyone who's boss. How will he pick the right target if he doesn't listen to his advisors? China's a very big place, and what looks like state-sponsored hacking to some might in fact turn out to be private enterprise. Such actions could be taken as an act of war, and even a limited cyberwar could leave swathes of the internet useless until rebuilt.

Trump also famously likes to abandon the script and simply ad lib during speeches, but national security depends on secrecy. Will he blurt out something in a speech that gives an enemy state a clue about America's capabilities or, even worse, her vulnerabilities?

Trump's view that "torture works" could also irreparably damage the relationship between GCHQ and the NSA. Torture is a no-no for the UK. The Cheltenham Doughnut is expressly forbidden from sharing intelligence with countries that openly engage in torture.

A change in policy by the US would further compromise the flow of intelligence already put at risk by Brexit. The Open Rights Group also believes that Trump will exert a great deal of influence over the UK's intelligence community.

Retaining skilled infosec talent from abroad is also about to become more of a problem for US companies, because Trump plans a crackdown on H-1B work visas. Taking up the slack means boosting cybersecurity degree courses, but any increase in trained manpower will take time to trickle through. In the meantime, who will fill the skills gap?

Ultimately, Trump is going to have to stop threatening and promising things he can't deliver, and start listening to his advisors. To do so, he must leave his preconceptions at the door to the Oval Office and think calmly and clearly before acting. Whether that will happen is anyone's guess, but it's not hyperbole to suggest that a huge amount depends on it.

No comments:

Post a Comment