Trump administration promises more aggressive, less political cyber stance

In an election that rarely dipped into policy specifics, cybersecurity was front and center as both a political weapon and a major platform for both parties.

With several significant hacks — likely perpetrated by Russian-sponsored actors — against the Democratic party and candidates, there was no question that cyber would emerge as a core issue.
For his part, President-elect Donald Trump was unambiguous about his stance on cybersecurity.

“As a deterrent against attacks on our critical resources, the United States must possess — and has to — the unquestioned capacity to launch crippling cyber counterattacks. And I mean crippling,” Trump told a veterans group on Oct. 3. “America’s dominance in the arena must be unquestioned. Today, it’s totally questioned. People don’t even know if we have the capability that we are supposed to have.”

Along with a more aggressive offensive stance in cyberspace, Trump also called for a cyber review team — made up of military and civilian government experts, as well as from the private sector — to conduct a holistic assessment of the federal government’s cybersecurity posture, presumably with an eye toward bolstering that posture.
Trump "is specifically committed to fixing our cyber capabilities or improving them,” Sen. Jeff Sessions, R-Ala., a leading candidate for secretary of defense, said in an interview with Defense News, a sister publication of Federal Times. “We have got to both have a defensive plan and an offensive plan. You simply can’t allow yourself to be vulnerable all of the time to cyberattacks and not have a response.”

While Trump has pledged to be more aggressive in cyberspace, the realities of building strong defensive and offensive capabilities will be a long haul, according to Greg Garcia, executive vice president at Signal Group and the first Department of Homeland Security assistant secretary for cybersecurity. Moreover, a more aggressive America will lead to more aggressive adversaries, he said.

“The Donald talks tough … but the reality is that cybersecurity policy movement is by its nature incremental,” Garcia said. “Its technological complexity coupled with a wide and disparate network of users, vendors and service providers means that the law of unintended consequences is guaranteed to come into play against any combination of those players with promulgation of aggressive policy or regulatory initiatives.”
“Reacting and calling for security best practices are easy to do,” former National Security Agency computer scientist Ben Johnson, now chief security strategist at Carbon Black, said. “It gets to be a lot harder when we’re talking about doing these things in practice, though.”

The specifics will be the hardest to pin down, according to Johnson.

"[Is] Donald suggesting that we, as a country, make it a policy to hack back? Should individual businesses have the right to retaliate? Who should be conducting attribution? Should we even focus on attribution?” he wondered. “Attribution and retaliation seem to be on everyone’s minds in Washington right now — from policymakers to military leadership to the media to private experts involved in discussions with the former. These are necessary topics, but let’s not forget how poorly our private companies and our government agencies are doing at defense — we need to improve our capabilities in defending our sensitive data, our infrastructure and our digital credentials.”

Outgoing Rep. Randy Forbes, R-Va., a potential candidate for secretary of the Navy, said cyber-watchers could expect to see important changes immediately after Trump is sworn in in January, including de-politicization of the nation’s cybersecurity policy.

“I think that with a President Trump, you’ll see him coming out literally within the first few days saying that we are going to have an international defense strategy that is driven by the Pentagon and not by the political National Security Council,” he said. “That’s a clear game-changer. Because if you look around the globe, over the last eight years, the National Security Council has been writing that. And find one country anywhere that we are better off than we were eight years [ago], you cannot find it.”