What Does The Latest Cybersecurity Executive Order Mean?
Some vendor tools used for this collection process charge based on data ingestion or the number of events collected per second. This acts as a disincentive to collect all the logs, as the budget may simply not allow for the cost of collecting and retaining all the data.
The recent Executive Order also states more details will be released regarding the specifications of the types of logs that will be mandated for collection, the storage period and the protection requirements for the integrity of those logs during the collection process. Once this is known, then agencies, suppliers and vendors will be able to determine the actual infrastructure or tools needed to meet these requirements.
Protecting logging integrity is critical, as there’s no point collecting the log if the bad guy has already changed it to remove traces of their presence. This is going to mean strong cryptography to ensure that logs aren't manipulated prior to their storage or analysis as well as security policy enforcement on each endpoint.
Many companies meet compliance these days by simply keeping log data in a central storage location, but this doesn't give ready access to that data or make it immediately useful in any forensic activity or real-time threat hunting. Further details about log sharing between agencies and the ability to send log data in real time to multiple locations (e.g., a service provider, an agency-level central log storage and a regulatory authority) are also likely to become a requirement, in my opinion.
The Executive Order highlights the real-world impact of cyber threats and how cybersecurity isn't just an IT issue but a business issue — one that can impact sovereignty, national security and the security of critical services that we all take for granted every day. When a bad actor can disrupt critical services like clean water, power, gas or food supplies it's essentially an attack on society, and a renewed focus on cyber preparedness — with tools, process and funding — is welcomed.
