President Biden's Executive Order Remediating Known Exploited Vulnerabilities

Why It Matters

Section Summary

This section of the Executive Order discusses the need to:

• Share threat information about the incidents they suffer with the federal government.
• Collect and preserve data that could aid threat detection, investigation and response.
• Perform technical activities — like network monitoring — to collaborate with agencies surrounding incident investigation and response.

Why This Is Needed

Historically, organizations have not shared threat information from the incidents they have suffered — and when they do, they tend to share the minimum information required to meet their compliance requirements.

The reason is simple: no organization wants to share bad news, especially when it comes to their cybersecurity capabilities. By sharing information about incidents that they have suffered, they risk damaging their reputation, losing their customers' trust, reducing their share price and making it seem like they wasted money on their current cybersecurity tools.

“The thought leaders who draft recommendations for new contractual language will have to refine the thresholds for reporting cyber intelligence to the government.”- Bradley Barth, Deputy Editor, SC Media

The Expected Impact

Staying silent about cybersecurity incidents is unsustainable and harms our broader community.

If an organization does not disclose information about their incidents, then other organizations will remain ignorant of that threat and remain at greater risk for suffering it themselves.

But if an organization rapidly shares information about their incidents, others can proactively hunt for indicators of that threat within their environment and raise defenses against it.

With this Executive Order, the federal government is creating a central authority to collect this threat information and share it publicly. But this approach will work only if organizations step up and rapidly share their incident information.

Why It Matters

Section Summary

This section of the Executive Order discusses the need to:

• Establish baseline security standards for the development of third-party software.
• Require suppliers to demonstrate the security of their development environment.
• Make security data for software suppliers publicly available and accountable.
• End procurement of legacy software developed out of compliance with these standards.

Why This Is Needed

Historically, organizations have lacked visibility into the security of their suppliers. They have relied on overly simplistic audits to manually track each of their supplier's security and risk, or they have fallen back on trust and assumed that their suppliers maintained effective defenses.

This approach was never ideal, and it's spiraling out of control as supply chains become more complex.

The result: organizations often perform supply chain security governance too late in their onboarding process. They often fail to regularly reappraise the security of their suppliers, and they typically lack meaningful end-to-end visibility into the risks their supply chain carries.

"The U.S. government and industry must work together to achieve the trusted, secure, and reliable global supply chain that is necessary to encourage economic growth, protect national security, and harness U.S. innovation."- Jason Oxman, President and CEO, Information Technology Industry Council

The Expected Impact

Software supply chain attacks have emerged as one of today's most significant threats, best exemplified by the recent SolarWinds attack that compromised hundreds of organizations, including dozens of federal government agencies.

With this Executive Order, the federal government seeks to create a more secure and accountable vendor ecosystem. To do so, they are using their purchasing power to incentivize third-party suppliers to implement secure software developer standards and to report their compliance with evidence.

Why It Matters

Section Summary

This section of the Executive Order discusses the need to:

• Create standardized playbooks and definitions for vulnerability and incident response.
• Achieve equal maturity levels around response plans across the entire organization.
• Execute uniform steps with consistent results to identify and mitigate threats.

Why This Is Needed

Historically, vulnerability and incident response has often been siloed, fragmented and ad hoc activities within organizations, performed using varying procedures to identify, remediate and recover from cybersecurity problems.

The result: organizations have lacked a shared understanding of their cybersecurity status and how to improve it. They have struggled to perform consistent vulnerability and incident response activities, maintain compliance with industry standards like the National Institute of Standards and Technology (NIST) Cybersecurity Framework and ensure you have maximum awareness of where vulnerabilities exist and a mechanism and a process to remediate them quickly.

“For the federal government, the uniform playbook is intended to help coordinate incident response. For the private sector, the standardized playbook will be a potentially valuable reference point as companies evaluate their own incident response policies and procedures.”- Global Law Firm Mayer Brown

The Expected Impact

To cause a breach, a malicious actor needs to find only one gap in an organization’s cybersecurity posture. If an organization cannot agree internally about what an incident looks like, how to prevent one, and how to respond if one occurs, then malicious actors will find many gaps to exploit.

Further, once an incident does occur, different groups within the organization will struggle to rapidly collaborate on remediation, furthering the spread and impact of the incident.

These standardized definitions and playbooks are also required to empower centralized cybersecurity authorities by giving them benchmarks to evaluate internal compliance against.

With this Executive Order, the federal government encourages organizations to standardize their response efforts and provides them with a template to model their new playbooks after.

Why It Matters

Section Summary

This section of the Executive Order discusses the requirements for robust and consistent cybersecurity event logging by developing standard practices for logging and creating mechanisms to enforce those practices.

Why This Is Needed

Historically, many organizations use systems that lack robust and consistent logging.

The result: many organizations have a limited ability to detect cybersecurity incidents, remediate those incidents, and perform accurate and effective analysis to determine each incident’s spread and root cause.

“As emphasized by some of the most pointed criticism of vendors in the aftermath of SolarWinds/Sunburst, the amount (and nature) of data recorded to network logs, and how that data is retained and accessed, can have a major influence on the speed and success of cyber incident response.”- Robert Chesney, Trey Herr, Lawfare

The Expected Impact

Recent incidents — most notably the SolarWinds attack — made it clear just how important log data is when a major incident occurs.

Organizations that retained sufficient log data in an easily accessible manner were more effective at remediating this incident than their counterparts.

With this Executive Order, the federal government seeks to lead the way in collecting and maintaining a sufficient volume of log data.

But the centralized approaches and Endpoint Detection and Response (EDR) solutions discussed within the Executive Order may not provide the optimal approach toward logging data to mitigate modern threats and vulnerabilities.