President Joe Biden recently introduced an updated policy aimed at protecting critical U.S. infrastructure sectors such as energy and financial services from foreign cyberattacks. This new policy serves as a revamp of the Obama administration’s Presidential Policy Directive, or PPD-21, which was established in 2013. The decision to revise this policy was initiated over a year ago to adapt to the evolving threat landscape posed by malicious cyber activity from nation-state actors and technological advancements like artificial intelligence.
In recent years, the threat environment has shifted significantly, moving away from counterterrorism towards strategic competition. In light of disruptive ransomware attacks and cyber intrusions into U.S. water systems, the need for enhanced cybersecurity measures has become more pressing. FBI Director Christopher Wray has repeatedly raised concerns about Chinese hackers targeting critical infrastructure components such as the electrical grid, water plants, and transportation systems. The FBI’s successful disruption of a Chinese hacking group underscores the ongoing cyber threats faced by the United States.
Despite efforts to improve diplomatic relations with China, tensions between the two countries persist, particularly in light of geopolitical uncertainties. The Biden administration has issued warnings to China against supporting Russia’s invasion of Ukraine, threatening to impose sanctions if necessary. With China’s increasing assertiveness concerning Taiwan, the U.S. has intensified its military support to the island, further escalating tensions between the two superpowers. As the geopolitical landscape remains volatile, security officials remain vigilant against potential cyberattacks from Chinese threat actors.
Biden’s updated policy delineates the various responsibilities of federal agencies in safeguarding U.S. critical infrastructure. The Department of Homeland Security (DHS) has been tasked with leading the government-wide efforts to mitigate security risks, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA). The DHS Secretary is mandated to produce a biennial report for the president outlining the progress made in addressing these risks. Additionally, U.S. intelligence agencies are directed to declassify relevant information for private sector stakeholders within vulnerable industries such as transportation, water, and energy to enhance their cybersecurity posture.
The updated policy also seeks to formalize CISA’s role within the government security network, given its establishment in 2018, five years after the publication of PPD-21. By acknowledging CISA’s crucial role in safeguarding critical infrastructure, the new policy underscores the need for collaboration between government agencies and private sector entities to strengthen cyber defenses. As highlighted by a senior administration official, the original policy failed to address CISA’s responsibilities due to the agency’s inception post-PPD-21.
The evolving cybersecurity landscape demands updated policies and coordinated efforts to protect critical U.S. infrastructure from cyber threats. Biden’s revised policy signifies a step towards enhancing the nation’s cybersecurity resilience and underscores the importance of proactive measures to safeguard vital infrastructure sectors from malicious actors. By acknowledging the dynamic nature of cybersecurity threats and prioritizing collaboration between government agencies and private sector stakeholders, the U.S. aims to bolster its defense mechanisms against cyber threats in an increasingly digital world.