T he information technology (IT) industry has evolved greatly over the last half century. This technology is ubiquitous and increasingly integral to almost every facet of modern society. ICT devices and components are generally interdependent, and disruption of one may affect many others. The Concept of Cybersecurity

Over the past several years, experts and policymakers have expressed increasing concerns about protecting ICT systems from cyberattacks —deliberate attempts by unauthorized persons to access ICT systems, usually with the goal of theft, disruption, damage, or other unlawful actions. Many experts expect the number and severity of cyberattacks to increase over the next several years. The act of protecting ICT systems and their contents has come to be known as cybersecurity . A broad and arguably somewhat fuzzy concept, cybersecurity can be a useful term but tends to defy precise definition. Cybersecurity is also sometimes conflated inappropriately in public discussion with other concepts such as privacy, information sharing, intelligence gathering, and surveillance. Management of Cybersecurity Risks

The risks associated with any attack depend on three factors: threats (who is attacking), vulnerabilities (the weaknesses they are attacking), and impacts (what the attack does). The management of risk to information systems is considered fundamental to effective cybersecurity. Most cyberattacks have limited impacts, but a successful attack on some components of critical infrastructure (CI)—most of which is held by the private sector—could have significant effects on national security, the economy, and the livelihood and safety of individual citizens. Federal Role

The federal role in cybersecurity involves both securing federal systems and assisting in protecting nonfederal systems. Under current law, all federal agencies have cybersecurity responsibilities relating to their own systems, and many have sector-specific responsibilities for CI. More than 50 statutes address various aspects of cybersecurity. Workforce —improving the size, skills, and preparation of the federal and private sector cybersecurity workforce. Information Sharing P.L. Executive Branch Actions

Some notable actions have been taken by the Obama Administration during the 114 th Congress. Initiatives in the plan include a proposed revolving fund for modernizing federal IT (see H.R. 5792 ) and the appointment of a federal chief information security officer, among other actions. Presidential Policy Directive 41 describes how the federal government will respond to cybersecurity incidents affecting government and private-sector entities, including principles, kinds of response, a framework of roles and responsibilities, and coordination. Long-Term Challenges

The legislative and executive-branch actions discussed above are largely designed to address several well-established near-term needs in cybersecurity: preventing cyber-based disasters and espionage, reducing impacts of successful attacks, improving inter- and intrasector collaboration, clarifying federal agency roles and responsibilities, and fighting cybercrime. However, those needs exist in the context of more difficult long-term challenges relating to design, incentives, consensus, and environment (DICE):
Design: Experts often say that effective security needs to be an integral part of ICT design. Legislation and executive actions in the 114 th and future Congresses could have significant impacts on those challenges.
The information and communications technology (ICT) industry has evolved greatly over the last half century. The technology is ubiquitous and increasingly integral to almost every facet of modern society. ICT devices and components are generally interdependent, and disruption of one may affect many others. Over the past several years, experts and policymakers have expressed increasing concerns about protecting ICT systems from cyberattacks, which many experts expect to increase in frequency and severity over the next several years.
The act of protecting ICT systems and their contents has come to be known as cybersecurity. A broad and arguably somewhat fuzzy concept, cybersecurity can be a useful term but tends to defy precise definition. It is also sometimes inappropriately conflated with other concepts such as privacy, information sharing, intelligence gathering, and surveillance. However, cybersecurity can be an important tool in protecting privacy and preventing unauthorized surveillance, and information sharing and intelligence gathering can be useful tools for effecting cybersecurity.
The management of risk to information systems is considered fundamental to effective cybersecurity. The risks associated with any attack depend on three factors: threats (who is attacking), vulnerabilities (the weaknesses they are attacking), and impacts (what the attack does). Most cyberattacks have limited impacts, but a successful attack on some components of critical infrastructure (CI)—most of which is held by the private sector—could have significant effects on national security, the economy, and the livelihood and safety of individual citizens. Reducing such risks usually involves removing threat sources, addressing vulnerabilities, and lessening impacts.
The federal role in cybersecurity involves both securing federal systems and assisting in protecting nonfederal systems. Under current law, all federal agencies have cybersecurity responsibilities relating to their own systems, and many have sector-specific responsibilities for CI. On average, federal agencies spend more than 10% of their annual ICT budgets on cybersecurity.
More than 50 statutes address various aspects of cybersecurity. Five bills enacted in the 113th Congress and another in the 114th address the security of federal ICT and U.S. CI, the federal cybersecurity workforce, cybersecurity research and development, information sharing in both the public and private sectors, and international aspects of cybersecurity. Other bills considered by Congress have addressed a range of additional issues, including data breach prevention and response, cybercrime and law enforcement, and the Internet of Things, among others.
Among actions taken by the Obama Administration during the 114th Congress are promotion and expansion of nonfederal information sharing and analysis organizations; announcement of an action plan to improve cybersecurity nationwide; proposed increases in cybersecurity funding for federal agencies of more than 30%, including establishment of a revolving fund for modernizing federal ICT; and a directive laying out how the federal government will respond to both government and private-sector cybersecurity incidents.
Those recent legislative and executive-branch actions are largely designed to address several well-established needs in cybersecurity. However, those needs exist in the context of difficult long-term challenges relating to design, incentives, consensus, and environment. Legislation and executive actions in the 114th and future Congresses could have significant impacts on those challenges.