A Blast from the Past: Government Regulations in Cybersecurity
Do you remember those old cartoons that used to make us laugh and scratch our heads at the same time? I recall one my dad brought home, which seemed to poke fun at the strict OSHA requirements. It was a curious piece that became a part of his life as a union machinist.
Fast forward to today, and here I am, working as a cybersecurity professional. We now have a new federal reporting requirement from the U.S. Securities and Exchange Commission (SEC) aimed at providing transparency to regulated businesses regarding their risk management priorities and response to breaches and attacks on their information resources. As I delve into this new rule, it reminds me of something I once said at a conference: relying solely on government regulations in cybersecurity is like driving a high-performance sports car using only the rear-view mirror.
Just like the OSHA legislation, the roots of this SEC ruling can be traced back decades. The need for federal oversight of worker safety emerged during the Industrial Revolution but only gained prominence after World War II. It was eventually signed into law in 1970.
Similarly, the need for organizational transparency in handling personal information has been recognized for years. As organizations began collecting and storing vast amounts of data, it became clear that individuals should have a say in how their information is used, stored, and protected. This latest SEC ruling is just another step in that direction, albeit a few decades later.
However, as with driving a sports car using only the rear-view mirror, relying on outdated rules and policies poses significant vulnerabilities. For instance, a tight timeline for reporting breaches may seem like a good policy, but defining what constitutes a breach can be challenging. Moreover, the rush to make a public statement may inadvertently aid attackers who can exploit the organization’s vulnerabilities before they are fully addressed.
The risk management aspects of this legislation also raise concerns. Many large private businesses have already prioritized cybersecurity as part of their corporate risk management strategy. Now, the SEC wants them to publicly outline their approach for transparency. However, this could introduce new risks as sensitive internal analyses and data are exposed.
This new regulation is reminiscent of the Computer Security Act of 1987, which aimed to establish a common risk-based approach to managing information security and governance. Back then, I was part of a team tasked with reviewing submissions from federal departments and agencies affected by the law. We painstakingly went through each security plan and provided feedback. Now, thirty-six years later, we are asking private organizations to do the same, with the added requirement of near-real-time incident reporting.
In essence, there is nothing groundbreaking here except for more paperwork and security compliance checkboxes. The burden falls on the beleaguered Chief Information Security Officer (CISO) and their team, who must comply with yet another government mandate. Unfortunately, this may not inspire much confidence from investors and the public in an organization’s ability to safeguard critical data and digital infrastructure assets. Perhaps it’s time for a new cartoon featuring a CISO driving their sports car in reverse amidst a whirlwind of government compliance forms and spreadsheets.