The Changing Role of Government in Cybersecurity

The dramatic increase in state and federal data privacy regulations prompts an answer to the question, “What is the role of government in cybersecurity?” Simply stated, governments are responsible for creating laws that protect the rights of its citizens, including the right to free speech and the right to privacy. Today, those rights are expressed and defended in cyberspace, giving rise to the need for cybersecurity laws and regulations.   

Current Cybersecurity Laws and Regulations  

It is often said that cybersecurity is a team sport, and everyone has a role to play. However, when it comes to governments, the stakes of the game are exceptionally high. They are responsible for ensuring the long-term protection of assets vital to the national interest such as power plants, healthcare systems, financial systems, and other critical infrastructure sectors.  

They do this by creating security policies to protect the digital identities and privacy of their citizens and secure the operational resilience of their critical assets. This is done by developing frameworks for attack prevention and security resiliency and holding cybercriminals accountable for their actions.  

Governments can either form a committee or commission an outside agency like NIST to create the standards that underpin mandated cybersecurity regulations. National frameworks and compliance standards include FISMA, GDPR, ITAR, HIPAA, NIST, PCI DSS, SOX, CUI protection, and more. International guidelines include GDPR, LGPD, DORA, and others.  

The Future of Government and Cybersecurity Legislation 

Over the last few years, cybercriminal activity has become a threat to national security. In response, governments have stepped up with new strategies and cybersecurity legislation to cover the gaps. However, more education is always needed to create a cyber-educated populace that understands the need for these changes, and how to stay safe in a digitally dangerous world.  

A Comprehensive National Cybersecurity Strategy 

The Biden-Harris National Cybersecurity Strategy was rolled out in March of 2023. It outlines “fundamental shifts in how the United States allocates roles, responsibilities, and resources in cyberspace” in order to “secure the full benefits of a safe and secure digital ecosystem for all Americans.” It puts forth five basic tenants: 

1. Defend Critical Infrastructure 
2. Disrupt and Dismantle Threat Actors 
3. Shape Market Forces to Drive Security and Resilience  
4. Invest in a Resilient Future 
5. Forge International Partnerships to Pursue Shared Goals 

For suggestions on how to unpack and address these tenants, check out the Fortra eBook: Understanding the White House’s 2023 National Cybersecurity Strategy 

True to its leadership role, the National Cybersecurity Strategy advocates two fundamental shifts. One, to put the onus for national security primarily on “the most capable and best-positioned actors to make our digital ecosystem secure and resilient” (or the major public and private sector players), as opposed to small companies and the end-users (who have far fewer resources to secure the national interests in cyberspace).  

Secondly, it pushes for “generational investments in renewing our infrastructure,” solidifying a long-term view of cybersecurity initiatives which includes increased semiconductor supply chain security and modernizing our cryptographic technologies.  

Collaboration 

Intelligence gathering is key to defend against cybercriminals. Because each entity has a different perspective and vantage point within the cyber domain, this is done largely through collaboration. That is why government cyber intelligence is shared both with the private sector and with other countries, and it allows for the takedown of infrastructure used by international cybercrime syndicates. The EU Cyber Solidarity Act and Interpol’s cybercrime unit are two examples of cross-border collaboration.  

Cybersecurity Education and Awareness 

Cross-collaboration needs to be applied to cybersecurity education and awareness as well, and there’s no better place to start than the top.  

For example, in the U.S., there are national and state-level awareness campaigns around eliminating risky behaviors on the roads. Similarly, these awareness campaigns can extend to reducing risky behaviors in cyberspace — whether it’s on a mobile device, a personal computer, or even a company issued device. “National Cybersecurity Awareness Month” has the right idea and could possibly stand to gain even more support with a government-sponsored endorsement or campaign of its own.  

Governments can also invest in educating their workforce to bridge the gap. We have seen the EU launch Cybersecurity Skills Academy, the U.S. launch the National Cyber Workforce Education Strategy, and Costa Rica unveil its Cybersecurity Impact Bootcamp. These initiatives will not only help bridge the workforce gap but create a pipeline of cyber-educated talent for the future.  

Cybersecurity and Compliance 

Fortra has over two decades of experience securing government agencies and helping them maintain the cybersecurity compliance standards that will keep them, and their users, safe.  

Cybersecurity Software Solutions for Meeting Government Legislation and Regulations 

Fortra’s cybersecurity solutions for government help you: 

• Protect CUI per Executive Order mandated controls 
• Secure Department of Defense technology with ITAR 
• Maintain FISMA compliance as you protect sensitive federal data 

By providing a range of robust government cybersecurity software like: 

• Vulnerability Management: Know the risks faced by your systems and what weaknesses could land you in compliance trouble. 
• Digital Risk Protection: Named DRP Company of the Year, Fortra protects your agency across social media, third-party feeds, and the deep and dark web. 
• Offensive Security: Fortra’s Core Security offensive security suite supports civilian agencies, the intelligence community, the Department of Defense, federal system integrators, and more. 
• Secure File Transfer: An effective managed file transfer (MFT) solution will help agencies meet strict security requirements like GLBA, SOX, HIPAA, PCI DSS, and FISMA. 
• Compliance: We’ll help you understand all the major regulations — domestically and internationally — and turn your compliance value from a liability into an asset.  

Uniquely positioned to implement wide-sweeping change on a national level, governments are responsible for carrying out their duties to defend the rights, privileges, and safety of their citizens. The cyber landscape just happens to be another battleground of that same fundamental fight.