Cybersecurity Strategy, Law, And Policy

The chief technology officer (CTO) has indicated that your  organization has been requested by the National Security Council (NSC)  to comment on the upcoming National Cybersecurity Strategy. The NSC has  asked for specific recommendations as it relates to the next  cybersecurity strategy, private/public partnerships, and comments on how  specific technologies should be incorporated into the assessment.

The CTO has asked you to collaborate with your team to provide the organizational input.

You will be collaborating with your previously assigned team on this  assignment. It is up to the team members to decide how they will plan,  meet, discuss, and complete the six sections of the paper. Remember, if a  member fails to complete his or her part of the work, the team is still  responsible for all sections. You will also complete a peer review for  yourself and for each member of the team. The peer feedback will be  incorporated into each team member’s assignment grade.

As a group, use the Cybersecurity Strategy, Law, and Policy Team Assignment Template to write your paper, which should cover the following topics:

Part 1: National Security Strategy and Cybersecurity

• After reading the National Security Strategy (2017), comment on the following.
  • Should the United States create a separate cybersecurity strategy to  be published alongside the National Security Strategy (NSS), or do you  feel the NSS is sufficient? Why or why not?
  • Consider your answer in the context of the original National Strategy to Secure Cyberspace (2003). What is not adequately addressed in the National Security Strategy (2017) as it relates to cybersecurity?

Part 2: Public/Private Partnerships

• After reading the Cybersecurity Act of 2015, address  the private/public partnership with the DHS National Cybersecurity and  Communications Integration Center (NCCIC), arguably the most important  aspect of the act. The Cybersecurity Act of 2015 allows for private and  public sharing of cybersecurity threat information.
  • What should the DHS NCCIC (public) share with private sector  organizations? What type of threat information would enable private  organizations to better secure their networks?
  • On the flip side, what should private organizations share with the  NCCIC? As it is written, private organization sharing is completely  voluntary. Should this be mandatory? If so, what are the implications to  the customers’ private data?
  • The government is not allowed to collect data on citizens. How  should the act be updated to make it better and more value-added for the  public-private partnership in regards to cybersecurity?

Part 3: Private Sector Organizations

• Review the General Data Protection Regulation (GDPR) of  the European Commission (EU). It includes many provisions and arguably  strengthens data protection for individuals within the EU. It even  includes the right to be forgotten. The United States does not have a  similar regulation. There have only been a few regulations implemented  related to US citizens’ private data, which include medical and  financial industries. Some argue implementing regulation such as GDPR in  the United States would hinder innovation. They contend that the End  User License Agreements (EULA) provide sufficient protections and allow  the citizens to make the choice of what is and is not shared.
  • As a private sector organization, do you believe that an equivalent to GDPR should be implemented in the United States?

Part 4: Protecting Critical Infrastructure and the Homeland

• The Department of Defense (DoD) Cyber Strategy 2018 discusses the protection of critical infrastructure and the homeland.
  • What does that mean to private organizations such as yours?
  • If most critical infrastructure in the United States is owned by the  private sector, what responsibility does the DoD have in this regard?
  • Some would argue US laws are outdated and thus the DoD has little  authority to assist. Others would argue US laws were purposely  established such that the private sector would defend itself and not  need assistance from the military. Obviously, for the DoD to assist, it  would need the private organizations’ data. Said another way, the DoD  would need your data as a private citizen/customer of that organization.  Those that believe our laws need to be updated argue giving up privacy  for protection is legitimate.
  • Others will argue that we should not give private information of  citizens to the government for any reason. As a citizen, would you feel  comfortable with this? As a private organization, would you feel  comfortable giving information that may contain your customers’ private  data to the DoD?
  • Is there a third solution (middle ground) you would propose that enables privacy but also enables cybersecurity?

Part 5: Cybersecurity Technologies

• The authors of the National Security Strategy (NSS) are  looking to address particular technologies that have the opportunity to  revolutionize cybersecurity. They believe that blockchain technology is  a revolutionary technology that has the ability to significantly  improve cybersecurity.
  • What would be your recommendation for how the NSS should incorporate this technology to the public?
  • Propose exactly what you believe should be written in the NSS.  Specifically, explain the blockchain technology in layman’s terms to  nontechnical people that may be reading the NSS, give examples of how it  could be used to provide revolutionary cybersecurity, include examples  of how it is being used to provide cybersecurity solutions, and discuss  what, if any policies or laws should be established to mandate its use  in specific industries.

Part 6: Ethics in Cybersecurity.

• Ethical issues are at the core of what we do as cybersecurity  professionals. Think of the example of a cyber defender working in a  hospital. They are charged with securing the network, medical devices,  and protecting sensitive personal health information from unauthorized  disclosure. They are not only protecting patient privacy but their  health and perhaps even their lives. Confidentiality, Integrity,  Availability – the C-I-A triad – and many other cybersecurity practices  are increasingly at play in protecting citizens in all walks of life and  in all sectors. Thus, acting in an ethical manner, is one of the  hallmarks of a cybersecurity professional.
  • What are the ethically significant harms that may result from mass surveillance (including by government and corporations)?
  • What are the ethically significant harms that may result from  emerging technologies such as blockchain technology, artificial  intelligence, and machine learning.

Notes

• While quality is valued over quantity, it is expected that a quality paper will result in a minimum length of 10–15 pages.
• Use additional sources as needed and be sure to critically analyze the questions, addressing the pros and cons in your proposal.