Thread by @ErrataRob

1/n It's a bludgeon instead of a scalpel. It drives up the cost of "compliance" with generalities. It assumes people aren't "taking security seriously" so bullies or bribes them into doing so.
whitehouse.gov/briefing-room/…

2/n Thus, it appears that instead of "addressing threats", the federal government is going to spend the next two years "addressing compliance".

3/ For all the vendors saying "buy my EDR" or "buy my ZeroTrust", your lobbying of the government has successful -- expect big orders soon.

4/ On the other hand, I may be misreading it. It's big on creating new rules for everything under the sun, but short on providing budget for departments to comply with them, or programs to enforce them.

https://twitter.com/selenakyle/status/1392633617906638848

5/ Sadly, I'm a government outsider. I see a nod to every suggested cybersecurity policy of the last several years (most of which I hate). But what this is really about is probably something completely different, such as a CISA power grab.

6/ I have no opinion whether centralizing more cybersecurity under the CISA (Cybersecurity and Infrastructure Security Agency) is good or bad. I'm sure departments throughout government are going to hate the encroachment on their turf.

7/ Thus, I see only what it says, an attempt to bludgeon everyone into "taking security seriously". What I don't see, as a non-government person, is the vast parts of the document that people will ignore, like they have in prior cybersecurity executive orders.

8/ I would defer to government people as to the actual meaningful parts of the document that won't be ignored.

9/ Let me take the IoT section. It's backwards looking based on Mirai, and not forward looking. Consumer IoT is protected by home firewalls -- the major security threat is the company providing cloud services to it, not the IoT device itself.

10/ What I don't read in the executive order is how to deal with incidents like that with Verkada -- a startup focused on securing IoT cameras so that Mirai couldn't happen again, but with laughable security in the cloud that pwned customers.

11/ This is similar to my comments everywhere: a superficial understanding of cybersecurity threats that are handled with a bludgeon rather than a scalpel.