A cybersecurity regulation comprises directives that safeguard information technology and computer systems with the purpose of forcing companies and organizations to protect their systems and information from cyberattacks like viruses, worms, Trojan horses, phishing, denial of service (DOS) attacks, unauthorized access (stealing intellectual property or confidential information) and control system attacks. While cybersecurity regulations aim to minimize cyber risks and enhance protection, the uncertainty arising from frequent changes or new regulations can significantly impact organizational response strategies.
There are numerous measures available to prevent cyberattacks. Cybersecurity measures include firewalls, anti-virus software, intrusion detection and prevention systems, encryption, and login passwords. There have been attempts to improve cybersecurity through regulation and collaborative efforts between the government and the private sector to encourage voluntary improvements to cybersecurity. Industry regulators, including banking regulators, have taken notice of the risk from cybersecurity and have either begun or planned to begin to include cybersecurity as an aspect of regulatory examinations.
Recent research suggests there is also a lack of cyber-security regulation and enforcement in maritime businesses, including the digital connectivity between ships and ports.
Background In 2011 the United States Department of Defense (DoD) released a guidance called the Department of Defense Strategy for Operating in Cyberspace which articulated five goals: to treat cyberspace as an operational domain, to employ new defensive concepts to protect DoD networks and systems, to partner with other agencies and the private sector in pursuit of a "whole-of-government cybersecurity Strategy", to work with international allies in support of collective cybersecurity and to support the development of a cyber workforce capable of rapid technological innovation. A March 2011 Government Accountability Office (GAO) report "identified protecting the federal government's information systems and the nation's cyber critical infrastructure as a governmentwide high-risk area" noting that federal information security had been designated a high-risk area since 1997. As of 2003 systems protecting critical infrastructure, called cyber critical infrastructure protection of cyber CIP has also been included.
In November 2013, the DoD put forward the new cybersecurity rule (78 Fed. Reg. 69373), which imposed certain requirements on contractors: compliance with certain National Institute of Standards and Technology (NIST) IT standards, mandatory reporting of cybersecurity incidents to the DoD, and a "flow-down" clause that applies the same requirements to subcontractors.
A June 2013 Congressional report found there were over 50 statutes relevant to cybersecurity compliance. The Federal Information Security Management Act of 2002 (FISMA) is one of the key statutes governing federal cybersecurity regulations.
United States Federal government There are few federal cybersecurity regulations and the ones that exist focus on specific industries. The three main cybersecurity regulations are the 1996 Health Insurance Portability and Accountability Act (HIPAA), the 1999 Gramm-Leach-Bliley Act, and the 2002 Homeland Security Act, which included the Federal Information Security Management Act (FISMA). The three regulations mandate that healthcare organizations, financial institutions, and federal agencies should protect their systems and information. For example, FISMA, which applies to every government agency, "requires the development and implementation of mandatory policies, principles, standards, and guidelines on information security." However, the regulations do not address numerous computer-related industries, such as Internet service providers (ISPs) and software companies. Furthermore, the regulations do not specify what cybersecurity measures must be implemented and require only a "reasonable" level of security. The vague language of these regulations leaves much room for interpretation. Bruce Schneier, the founder of Cupertino's Counterpane Internet Security, argues that companies will not make sufficient investments in cybersecurity unless the government forces them to do so. He also states that successful cyberattacks on government systems still occur despite government efforts.
It has been suggested that the Data Quality Act already provides the Office of Management and Budget the statutory authority to implement critical infrastructure protection regulations by the Administrative Procedure Act rulemaking process. The idea has not been fully vetted and would require additional legal analysis before a rulemaking could begin.
State governments State governments have attempted to improve cybersecurity by increasing public visibility of firms with weak security. In 2003, California passed the Notice of Security Breach Act, which requires that any company that maintains personal information of California citizens and has a security breach must disclose the details of the event. Personal information includes name, social security number, driver's license number, credit card number or financial information. Several other states have followed California's example and passed similar security breach notification regulations. Such security breach notification regulations punish firms for their cybersecurity failures while giving them the freedom to choose how to secure their systems. Also, the regulation creates an incentive for companies to voluntarily invest in cybersecurity to avoid the potential loss of reputation and the resulting economic loss that can come from a successful cyber attack.
In 2004, the California State Legislature passed California Assembly Bill 1950, which also applies to businesses that own or maintain personal information for California residents. The regulation dictates for businesses to maintain a reasonable level of security and that they required security practices also extend to business partners. The regulation is an improvement on the federal standard because it expands the number of firms required to maintain an acceptable standard of cybersecurity. However, like the federal legislation, it requires a "reasonable" level of cybersecurity, which leaves much room for interpretation until case law is established.
Proposed regulation The US Congress has proposed numerous bills that expand upon cybersecurity regulation. The Consumer Data Security and Notification Act amends the Gramm-Leach-Bliley Act to require disclosure of security breaches by financial institutions. Congressmen have also proposed "expanding Gramm-Leach-Bliley to all industries that touch consumer financial information, including any firm that accepts payment by a credit card." Congress has proposed cybersecurity regulations similar to California's Notice of Security Breach Act for companies that maintain personal information. The Information Protection and Security Act requires that data brokers "ensure data accuracy and confidentiality, authenticate and track users, detect and prevent unauthorized activity, and mitigate potential harm to individuals."
In addition to requiring companies to improve cybersecurity, Congress is also considering bills that criminalize cyberattacks. The Securely Protect Yourself Against Cyber Trespass Act (SPY ACT) was a bill of this type. It focused on phishing and spyware bill and was passed on May 23, 2005, in the US House of Representatives but died in the US Senate. The bill "makes unlawful the unauthorized usage of a computer to take control of it, modify its setting, collect or induce the owner to disclose personally identifiable information, install unsolicited software, and tamper with security, anti-spyware, or anti-virus software."
On May 12, 2011, US president Barack Obama proposed a package of cybersecurity legislative reforms to improve the security of US persons, the federal government, and critical infrastructure. A year of public debate and Congress hearings followed, resulting in the House of Representative passing an information sharing bill and the Senate developing a compromise bill seeking to balance national security, privacy, and business interests.
In July 2012, the Cybersecurity Act of 2012 was proposed by Senators Joseph Lieberman and Susan Collins. The bill would have required creating voluntary "best practice standards" for protection of key infrastructure from cyber attacks, which businesses would be encouraged to adopt through incentives such as liability protection. The bill was put to a vote in the Senate but failed to pass. Obama had voiced his support for the Act in a Wall Street Journal op-ed, and it also received support from officials in the military and national security including John O. Brennan, the chief counterterrorism adviser to the White House. According to The Washington Post, experts said that the failure to pass the act may leave the United States "vulnerable to widespread hacking or a serious cyberattack." The act was opposed by Republican senators like John McCain who was concerned that the act would introduce regulations that would not be effective and could be a "burden" for businesses. After the Senate vote, Republican Senator Kay Bailey Hutchison stated that the opposition to the bill was not a partisan issue but it not take the right approach to cybersecurity.The senate vote was not strictly along partisan lines, as six Democrats voted against it, and five Republicans voted for it. Critics of the bill included the US Chamber of Commerce, advocacy groups like the American Civil Liberties Union and the Electronic Frontier Foundation, cybersecurity expert Jody Westby, and The Heritage Foundation, both of whom argued that although the government must act on cybersecurity, the bill was flawed in its approach and represented "too intrusive a federal role."
In February 2013, Obama proposed the Executive Order Improving Critical Infrastructure Cybersecurity. It represents the latest iteration of policy but is not considered to be law as it has not been addressed by Congress yet. It seeks to improve existing public-private partnerships by enhancing timeliness of information flow between DHS and critical infrastructure companies. It directs federal agencies to share cyber threat intelligence warnings to any private sector entity identified as a target. It also tasks DHS with improving the process to expedite security clearance processes for applicable public and private sector entities to enable the federal government to share this information at the appropriate sensitive and classified levels. It directs the development of a framework to reduce cyber risks, incorporating current industry best practices and voluntary standards. Lastly, it tasks the federal agencies involved with incorporating privacy and civil liberties protections in line with Fair Information Practice Principles.