{"id":8252,"date":"2019-01-09T10:59:23","date_gmt":"2019-01-09T15:59:23","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=8252"},"modified":"2019-01-09T16:41:09","modified_gmt":"2019-01-09T21:41:09","slug":"the-government-shutdown-is-catastrophic-for-us-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/the-government-shutdown-is-catastrophic-for-us-cybersecurity\/","title":{"rendered":"The government shutdown is catastrophic for US cybersecurity"},"content":{"rendered":"\n

While the short-term impact is jarring, the long-term effects could prove\neven more harmful<\/h2>\n\n\n\n

The current US government shut down is doing serious damage\nto the US cybersecurity apparatus, but the longer-term impact could be even\nworse. <\/p>\n\n\n\n

If you\u2019ve paid any attention to the news in the US lately it\u2019s\nhard to ignore the massive government shutdown currently taking place. Case in\npoint, last night all of the American networks paused whatever they were\ncarrying to air a presidential address about said shutdown. Then an opposition\nresponse about the shutdown.<\/p>\n\n\n\n

It\u2019s kind of a big deal. <\/p><\/span>\n\n\n\n

\"The<\/figure><\/div>\n\n\n\n

My job isn\u2019t to wax philosophic about politics, so I\u2019ll just stick to the facts. The dispute is over immigration, specifically securing the United States\u2019 southern border with Mexico. The president, in keeping with a campaign promise, wants $5 billion to pay for a physical barrier, a wall, and has refused to sign any legislation to continue funding the government until he gets it. In the meantime, the US government is effectively shut down \u2013 including the State department, Justice Department, Treasury, Transportation Department, Department of the Interior, of Agriculture and of Homeland Security \u2013 and about 800,000 federal employees are currently furloughed or working without pay to carry out \u201cessential\u201d operations like air traffic control.<\/p>\n\n\n\n

So today we\u2019re going to talk about what the shut down is\ndoing to the United States\u2019 cyber defenses, and what impact this could have in\nthe future. <\/p>\n\n\n\n

Let\u2019s hash it out.<\/p>\n\n\n\n

Who is still at work?<\/h2>\n\n\n\n

As we discussed in November, the US recently created a new agency<\/a>, the Cybersecurity and Infrastructure Security Agency (CISA), under the umbrella of the Department of Homeland Security. <\/p>\n\n\n\n

“Elevating the cybersecurity mission within the Department of Homeland Security, streamlining our operations, and giving NPPD a name that reflects what it actually does will help better secure the nation’s critical infrastructure and cyber platforms,” said NPPD Under Secretary Christopher Krebs. “The changes will also improve the Department’s ability to engage with industry and government stakeholders and recruit top cybersecurity talent.”<\/p><\/blockquote>\n\n\n\n

Now, not even two months later, CISA has effectively been\nknee-capped by the shutdown. As has the National Institute for Standards in\nTechnology (NIST). <\/p>\n\n\n\n

\"The<\/figure><\/div>\n\n\n\n

The Cybersecurity and Infrastructure Security Agency <\/h2>\n\n\n\n

Let\u2019s start with CISA, the agency that has been created specifically to help with US cybersecurity. <\/p>\n\n\n\n

What the federal government considers \u201cessential\u201d is a bit opaque, and purposefully so. But that does mean some of the federal security apparatus is exempt.<\/p>\n\n\n\n

Per the Office of Management and Budget in a January 2018\nmemo offering guidance on a previous government shutdown:<\/p>\n\n\n\n

\u201cAt a minimum, agencies must avoid any threat to the security, confidentiality and integrity of the agency information and information systems maintained by or on behalf of the government\u2026 Agencies should maintain appropriate cybersecurity functions across all agency information technology systems, including patch management and security operations center (SOC) and incident response capabilities.\u201d<\/p><\/blockquote>\n\n\n\n

But, as reassuring as that may sound, it forgets two very\nimportant facts: <\/p>\n\n\n\n

  1. Roughly half of the federal workforce (estimates\nrange from 345,000 to 400,000) is furloughed, so these departments are not\nfunctioning at anything even close to full strength. <\/li>
  2. The employees that are working, currently are\nnot being paid for that work. They\u2019re working for free. And this happened right\nin the middle of the holidays. So morale is probably great.<\/li><\/ol>\n\n\n\n

    Now, the Senate did pass a bill that should give these\nemployees backpay, but that doesn\u2019t change the fact that these people haven\u2019t\nbeen paid in at least 18 days and this shutdown could continue for weeks. <\/p>\n\n\n\n

    And beyond that, even at full strength the US cyber defense apparatus is being pushed to the brink by foreign, state-sponsored hackers and cyber cells<\/a>. So weakening it puts the whole country at greater risk.<\/p>\n\n\n\n

    \u201cCyber threats don\u2019t operate on Washington\u2019s political timetable, and they don\u2019t stop because of a shutdown,\u201d Lisa Monaco, former assistant to the president for homeland security and counterterrorism, told Axios<\/a>.<\/p><\/blockquote>\n\n\n\n

    Or, as\na report from Duo Security said<\/a>:<\/p>\n\n\n\n

    \u201cTrying to keep networks and data safe and thwarting attacks when not at full-strength is risky, especially when no one can predict how long this state of affairs will last.\u201d<\/p><\/blockquote>\n\n\n\n

    Right now, 45% of the Cybersecurity and Infrastructure\nSecurity Agency is furloughed. 45% is also the percentage of employees on the\nDHS\u2019 analysis and operations teams \u2013 comprised of the Office of Intelligence\n& Analysis, and the Office of Operations Coordination \u2013 that are furloughed,\ntoo. <\/p>\n\n\n\n

    The National Protection and Programs Directorate \u2013 which handles a range of functions like the US-CERT (US \u2013 Computer Emergency Readiness Team) Continuous Diagnostics (CDM) and Automated Indicator Sharing (AIS) programs \u2013 has a whopping 85% of its workforce furloughed. <\/p>\n\n\n\n

    And depending on how long this shutdown continues, we could see a lot of these agencies that are currently operating on short-term reserves run out of money and be forced to shutter even more of their operations.<\/p>\n\n\n\n

    \"The<\/figure><\/div>\n\n\n\n

    The National Institute of Standards in Technology<\/h2>\n\n\n\n

    NIST is the agency responsible for setting standards. For instance, it\u2019s issued extensive guidance on encryption standards<\/a> that has helped inform the industry standards set forth by the CA\/B Forum. It\u2019s an exceedingly useful agency and it has been thoroughly depleted by this shutdown. <\/p>\n\n\n\n

    85% of NIST is furloughed.<\/p>\n\n\n\n

    That means a number of new standards that have been under review \u2013 standards that businesses rely on to set a baseline for their own security programs \u2013 are now on indefinite hold. <\/p>\n\n\n\n

    That includes: <\/p>\n\n\n\n