The National Strategy to Secure Cyberspace
Full Title of Reference
The National Strategy to Secure Cyberspace
Executive Office of the President of the U.S., The National Strategy to Secure Cyberspace (2003). Online Paper. Web
- Resource by Type: US Government Reports and Documents
Consistent with the National Strategy for Homeland Security, the strategic objectives of this National Strategy to Secure Cyberspace are to:
- Prevent cyber attacks against America’s critical infrastructures;
- Reduce national vulnerability to cyber attacks; and
- Minimize damage and recovery time from cyber attacks that do occur.
The National Strategy to Secure Cyberspace articulates five national priorities including:
- National Cyberspace Security Response System;
- A National Cyberspace Security Threat and Vulnerability Reduction Program;
- A National Cyberspace Security Awareness and Training Program;
- Securing Governments’ Cyberspace; and
- National Security and International Cyberspace Security Cooperation.
The first priority focuses on improving our response to cyber incidents and reducing the potential damage from such events. The second, third, and fourth priorities aim to reduce threats from, and our vulnerabilities to, cyber attacks. The fifth priority is to prevent cyber attacks that could impact national security assets and to improve the international management of and response to such attacks.
Priority I: A National Cyberspace Security Response System
Rapid identification, information exchange, and remediation can often mitigate the damage caused by malicious cyberspace activity. For those activities to be effective at a national level, the United States needs a partnership between government and industry to perform analyses, issue warnings, and coordinate response efforts. Privacy and civil liberties must be protected in the process. Because no cybersecurity plan can be impervious to concerted and intelligent attack, information systems must be able to operate while under attack and have the resilience to restore full operations quickly.
The National Strategy to Secure Cyberspace identifies eight major actions and initiatives for cyberspace security response:
- Establish a public-private architecture for responding to national-level cyber incidents;
- Provide for the development of tactical and strategic analysis of cyber attacks and vulnerability assessments;
- Encourage the development of a private sector capability to share a synoptic view of the health of cyberspace;
- Expand the Cyber Warning and Information Network to support the role of DHS in coordinating crisis management for cyberspace security;
- Improve national incident management;
- Coordinate processes for voluntary participation in the development of national public-private continuity and contingency plans;
- Exercise cybersecurity continuity plans for federal systems; and
- Improve and enhance public-private information sharing involving cyber attacks, threats, and vulnerabilities.
Priority II: A National Cyberspace Security Threat and Vulnerability Reduction Program
By exploiting vulnerabilities in our cyber systems, an organized attack may endanger the security of our Nation’s critical infrastructures. The vulnerabilities that most threaten cyberspace occur in the information assets of critical infrastructure enterprises themselves and their external supporting structures, such as the mechanisms of the Internet. Lesser-secured sites on the interconnected network of networks also present potentially significant exposures to cyber attacks. Vulnerabilities result from weaknesses in technology and because of improper implementation and oversight of technological products.
The National Strategy to Secure Cyberspace identifies eight major actions and initiatives to reduce threats and related vulnerabilities:
- Enhance law enforcement’s capabilities for preventing and prosecuting cyberspace attacks;
- Create a process for national vulnerability assessments to better understand the potential consequences of threats and vulnerabilities;
- Secure the mechanisms of the Internet by improving protocols and routing;
- Foster the use of trusted digital control systems/supervisory control and data acquisition systems;
- Reduce and remediate software vulnerabilities;
- Understand infrastructure interdependencies and improve the physical security of cyber systems and telecommunications;
- Prioritize federal cybersecurity research and development agendas; and
- Assess and secure emerging systems.
Priority III: A National Cyberspace Security Awareness and Training Program
Many cyber vulnerabilities exist because of a lack of cybersecurity awareness on the part of computer users, systems administrators, technology developers, procurement officials, auditors, chief information officers (CIOs), chief executive officers, and corporate boards. Such awareness-based vulnerabilities present serious risks to critical infrastructures regardless of whether they exist within the infrastructure itself. A lack of trained personnel and the absence of widely accepted, multi-level certification programs for cybersecurity professionals complicate the task of addressing cyber vulnerabilities.
The National Strategy to Secure Cyberspace identifies four major actions and initiatives for awareness, education, and training:
- Promote a comprehensive national awareness program to empower all Americans—businesses, the general workforce, and the general population—to secure their own parts of cyberspace;
- Foster adequate training and education programs to support the Nation’s cybersecurity needs;
- Increase the efficiency of existing federal cybersecurity training programs; and
- Promote private-sector support for well-coordinated, widely recognized professional cybersecurity certifications.