Biden Administration Opens Opportunities for MSSPs with National Cybersecurity Strategy

The Biden Administration has released its long-awaited National Cybersecurity Strategy that sketches a blueprint for how the federal government plans to deal with the immense volume of cyber threats hitting targets in the public and private sectors and critical infrastructure facilities.

The 35-page document is not law and the White House does not expect it to pass Congress in its current iteration but hopes that it will serve as a guideline for future cyber legislation. Indeed, in its current form it could also serve as a standard for how third-party companies compete for lucrative federal and private sector contracts based on minimally acceptable cybersecurity protections by law.

Strategy's MSSP Advantage

The document gives managed security service providers (MSSPs) a potentially notable windfall, set up as they are to deliver cyber expertise well beyond what other third-party providers can do. While the policy paper does not specifically mention MSSPs, the inference and opportunity is clear for big deals in the public and private sector.

The bottom line change is that the proposition relieves individuals, small businesses and local governments from the burden of implementing and protecting their cyber investments. In truth, the White House doesn't have the power to make the tech sector do anything, but the strategy is much more than ideas and intentions: It can serve as a beacon of where legislative priorities are headed and signal which companies are leading the charge.

Commenting on the strategy during a press briefing, Acting National Cyber Director Kemba Walden said:

Walden said that the "biggest, most capable and best-positioned actors in our digital ecosystem can and should shoulder a greater share of the burden for managing cyber risk and keeping us all safe.”

She added that laying responsibility on individuals and groups who lack the resources to protect themselves is both “unfair” and “ineffective.” And vendors are currently rewarded for being “first to market, not secure to market.” Translated, it means that the policy asks the tech sector to bake security into its products, similar to a call to action that CISA Director Jen Easterly delivered in remarks last week at Carnegie Mellon University in a lead-in to the cyber policy document.

A Closer Look at the White House Cyber Strategy

Among the key precepts of the document, the White House is proposing that legislation be directed at software makers that fail to safeguard their products and services, suggesting that a bill of that magnitude not be merely a stick but also a carrot. The Administration is offering an “adaptable safe harbor framework” to protect companies that follow through with locking down their products from digital sabotage.

“Companies that make software must have the freedom to innovate, but they must also be held liable when they fail to live up to the duty of care they owe consumers, businesses or critical infrastructure providers,” the White House said in the report.

The national cybersecurity strategy is built on what the Administration calls five pillars (abridged and based on a White House fact sheet):

1.) Defend Critical Infrastructure

2.) Disrupt and Dismantle Threat Actors

3.) Shape Market Forces to Drive Security and Resilience

4.) Invest in a Resilient Future

5.) Forge International Partnerships to Pursue Shared Goals

Cybersecurity Industry Leaders React

A number of cybersecurity providers weighed in on the strategy.

Joshua Corman, former CISA chief strategist and current vice president of cyber safety at Claroty said:

"In Pillar 3, which is likely to be the most controversial, the strategy acknowledges market failures and that voluntary free market forces only get you so far (something I’ve told Congress and the last several administrations). To protect the public good, the federal government intends to use its existing authorities to regulate and incentivize better cybersecurity and resilience of the nation’s critical infrastructure. Where it lacks sufficient statutory authorities, it intends to ask Congress for new authorities."

Cody Cornell, Swimlane co-founder and chief strategy officer, commented:

"While the idea of sector-specific frameworks is a good one, these frameworks are not one size fits all and have specific guidance and controls that can be very beneficial. There is a lot of work to be done on defining the sectors, the frameworks, getting buy-in and providing guidance on not just implementation, but how they will be measured and enforced, because a framework with no enforcement is entirely voluntary and runs contrary to the goal of rebalancing the responsibility of defending cyberspace."

Edgard Capdevielle, chief executive of ICS/OT cybersecurity, Nozomi Networks, said:

"The National Cyber Strategy's non-voluntary requirements for critical infrastructure to increase cybersecurity posture will be met with varying responses from CEOs and boards alike. While the impetus for a better cyber posture to defend against potential nation-state adversaries is wise and necessary, the ability for these entities to identify the budget and personnel to manage these pieces is going to be difficult. As it is for most companies in this macroeconomic climate.

"We look forward to working with our U.S. critical infrastructure partners, just as we have with their international counterparts, to meet changing regulatory guidelines with the best defenses and visibility possible."