The Trump administration has announced its long-awaited cybersecurity strategy. While light on detail, the Trump administration has committed to deploying the full suite of defensive and offensive cyber operations available to the U.S. government and will aggressively target transnational cybercrime groups to protect Americans.

For many years, cybercriminals have targeted the United States more than any other country, and cyberattacks have been growing in volume and sophistication. Financially motivated cybercriminals and state-sponsored hacking groups continue to target the U.S. government and private sector firms, with Russia, China, Iran, and North Korea posing the greatest threat to critical infrastructure and national security. In contrast to published strategies from past administrations, none of these countries is named in the policy document.

The document – President Trump’s CYBER STRATEGY for America – announces six policy pillars that underpin the strategy. Each of the six policy pillars is vital for national security; however, the document lacks detail on how the U.S. government will achieve those cybersecurity goals. The strategy includes only 5 pages of text, two of which are introductory pages boasting of the might of the United States, America’s wealth of cybersecurity talent, and its unrivalled technological and economic innovation.

Regarding talent, the U.S. government has lost a considerable amount during President Trump’s second term, including the heads of the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA). Neither agency currently has a Senate-confirmed leader, and CISA has lost around one-third of its workforce under the current administration.

That said, the strategy is welcome news and will guide the efforts of the United States in targeting cybercriminals and nation-state actors. By improving defenses and aggressively targeting cybercriminal gangs, the Trump administration plans to make it much harder for adversaries’ cyber operations to succeed by eroding their capabilities and raising the costs for their aggression.

“By disrupting adversaries’ cyber campaigns and making our networks more defensible and resilient, we will unleash innovation, accelerate economic growth, and secure American technology dominance. We will remove burdensome, ineffective regulations so that our industry partners innovate quickly in emerging technologies. Partners in the private sector must be able to respond and recover quickly to ensure continuity of the American economy,” explained President Trump in the cyber strategy document.

The six pillars outlined in the strategy for guiding the U.S. government are:

• Shape adversary behavior – Full use of government resources for tackling cybercrime and incentivizing the private sector to help identify and disrupt adversary networks. “We will uproot criminal infrastructure and deny financial exit and safe haven.”
• Promote common sense regulation – The administration plans to streamline cyber regulations to reduce compliance burdens, address liability, and better align regulators and industry globally.
• Modernize and secure federal government networks – Accelerating the modernization of federal information systems by implementing cybersecurity best practices, post-quantum cryptography, zero-trust architecture, and cloud transition.
• Secure critical infrastructure – Harden defenses and information and operational technology supply chains to deny adversaries access and ensure a rapid response and recovery in the event of a successful attack
• Sustain superiority in critical and emerging technologies – Building secure technologies and supply chains, supporting the security of cryptocurrencies and blockchain technologies, promoting post-quantum cryptography and secure quantum computing, and securing the AI technology stack and promoting innovation in AI security.
• Build talent and capacity – Ensuring there is investment in America’s cyber workforce, the creation of a pipeline that develops and shares talent, and the elimination of roadblocks that prevent industry, academia, government, and the military from aligning incentives and building a highly skilled cyber workforce.

The cyber strategy is accompanied by a new Executive Order that targets transnational criminal organizations that engage in cybercrime, fraud, and predatory schemes targeting American families, businesses, and critical infrastructure. The Executive Order specifically targets the most prevalent and costly cybercriminal operations, including ransomware attacks, phishing campaigns, financial fraud, sextortion schemes, and impersonation scams.

The Executive Order directs administration officials to conduct a comprehensive review of the operational, technical, diplomatic, and regulatory tools for combatting cybercriminal gangs, establishes a dedicated operational cell within the National Coordination Center (NCC) tasked with creating an action plan that identifies the groups responsible for scam centers and cybercrime and solutions for prevention, investigation, detection, disruption, and dismantling those groups’ operations.

The Attorney General has been instructed to prioritize prosecutions of cyber-enabled fraud and scam schemes, pursuing the most serious, provable offenses, and create a  Victims Restoration Program to ensure that seized and forfeited funds are directed to the victims of cybercrime. The Secretary of the Department of Homeland Security has been tasked with working with state and local partners and providing training, technical assistance, and resilience building against cyber threats.

The reception of the cyber strategy has been largely positive, although the policy has attracted some criticism for failing to state how the U.S. government will achieve its cybersecurity goals.  “The National Cyber Strategy represents an important step in aligning federal cyber policy with the scale and complexity of today’s threats. However, the hard work begins now, and that’s translating the vision into ambitious-yet-achievable operational outcomes. Consequence-based prioritization will be essential to ensure finite federal and private-sector resources are focused on the systems where disruption would have the greatest national impact,” said Matthew Hartman, Chief Strategy Officer at Merlin Group, a network of affiliates that invests in, enables, and scales cyber technology companies. “At the same time, this is an opportunity to clarify how government and industry divide responsibility for defining and delivering shared security and resilience outcomes. If implemented effectively, the strategy can help drive coordinated action across government and strengthen resilience across the infrastructure that underpins the U.S. economy and national security.”

“President Trump’s Cyber Strategy for America puts operational effect ahead of “compliance theater.” From a practitioner’s perspective, the emphasis on modernizing federal systems with zero trust, post‑quantum cryptography, and AI‑enabled defense—while streamlining duplicative regulation—is directionally appropriate,” said Bruce Jenkins, Chief Information Security Officer, Black Duck, an application security solution provider. “The real test and historical challenge will be in execution: translating these pillars into clear requirements, faster procurement, and measurable risk reduction across government and the defense industrial base.”

The post Trump Administration Announces Aggressive Cyber Strategy appeared first on The HIPAA Journal.