Blog

Class B Graham’s MOMs

Class B: Graham’s MOMs

Author’s Name

Institutional Affiliation

Class B: Graham’s MOMs

Graham (2015) explains that Maximum of Maximums (MOMs) are catastrophic natural and manmade events of large-scale destruction that cause unprecedented damage that goes beyond historical models, despite a nation’s excellence in preparing for such events. The author adds that even with premium preparedness, these events, also termed the mothers of all disasters end up killing thousands, disrupting economic activities for extended periods, and rendering large populations homeless without fundamental necessities. Graham gives several examples of such events, namely, huge hurricanes, earthquakes, nuclear terrorist attacks, and deadly epidemics.

Looking at the time relevance and locations of these examples, they do strike me as fundamentally different from Hurricane Katrina and the September 11 attacks. Both the 9/11 attacks and Hurricane Katrina exhibited some of the unique characteristics of Maximum of Maximums. Particularly, the two events were naturally catastrophic and resulted in extraordinary destruction and damage to life, property loss, and devastation of critical infrastructure. The aftermath of the two events was growing death tolls.

However, the nation seemed to ignore intelligence and misjudged the warning signs behind the growing threat of the terrorist attack, which means that it failed to prepare adequately for this event. Also, the forecasts issued by the National Hurricane Center after correctly predicted the strengthening of Hurricane Katrina were also ignored to some extent. What these mean is that in these two events nation was not adequately prepared to face respond to them. In that case, what differentiates Hurricane Katrina and the 9/11 terrorist attack from Graham’s MOMs is a lack of the element of preparation as MOMs cause massive damage even with sufficient national preparedness. Graham’s posit regarding people’s inadequacies in preparing for disasters is correct as a lack of preparation permeates government institutions that should be in the vanguard of driving such preparedness, hence becoming a true paradox for disaster planners. What should be done is it to model, initiate, and reinforce nationwide predictive educational programs to augment the public’s ability to predict disasters while enhancing their readiness and resilience.

References

Graham, D. A. (2015). The Mothers of All Disasters. The Atlantic. Retrieved December 02, 2019, from https://www.theatlantic.com/national/archive/2015/09/the-disaster-next-time/403063/.

Class B Week 13 Assignment

Class B: Week 13 Assignment

Author’s Name

Institutional Affiliation

Class B: Week 13 Assignment

The Dirty War movie presented by Magenta16V (2012) exhibits a scenario revolving around the movement of hazardous and lethal radioactive materials mixed with other volatile or explosive components cloaked in some vegetable oil containers from Turkey to England. This scenario aligns with our comprehension of systems from the perspective of intelligence. Specifically, it reflects our understanding that the logic of systems thinking is crucial in the development of helpful, coherent, and effective models of intelligence that allow us to buttress our intelligence, hence allowing us to survive in systems characterized by uncertainties. In the film, DA Stroma explains that the sole purpose of establishing a reconnaissance cell is to gather essential intelligence on intended targets as such targets are closer to the planning of a terrorist attack within the national security system. With such intelligence, national security officers can competently enhance crisis communication and decisions aimed at thwarting such an attack. This aligns with our understanding of systems in that gathering, analysing, and assessing intelligence helps us to generate outcomes that support communication and informed decision-making necessary in improving the systems within which we live.

From a critical outlook, I think that Meadows’ approach to systems thinking enables us to identify, categorize, and manage the elements of intelligence portrayed in Dirty War. Meadows and Wright (2008) suggest that intelligent system thinkers establish resilient systems based on a rich structure of multiple feedback loops that enable the restoration of such systems in the event of large disturbances. The national security agents in Dirty War needed such resilience to restore the national security system to stability after being perturbed by the attack. This resilience could be attained through positive emergency drills aimed at sending positive messages to Londoners about attack preparedness. I also think that intelligent system thinkers should demonstrate the ability to exercise all seven critical thinking skills suggested by Richmond (2018). These include closed-loop thinking, dynamic thinking, forest thinking, operational thinking, quantitative thinking, scientific thinking, and system-as-cause thinking.

References

Magenta16V. (November 05, 2012). Dirty war [Video file]. YouTube. Retrieved November 19, 2019, from https://www.youtube.com/watch?v=poZXRUxlaqk&t=2752s.

Meadows, D. H., & Wright, D. (2008). Thinking in systems: A primer. White River Junction, VT: Chelsea Green Publishing.

Richmond, B. (2018). The “thinking” in systems thinking: How can we make it easier to master?. Leverage Networks, Inc. Retrieved November 19, 2019, from https://thesystemsthinker.com/the-thinking-in-systems-thinking-how-can-we-make-it-easier-to-master/.

Class B Discussion 1

Class B: Discussion 1

Author’s Name

Institutional Affiliation

Class B: Discussion 1

Security professionals face numerous challenges, some of which are discussed in detail. One of the primary challenges they face today is the augmentation of sophistication and volumes of cyber-attacks. Perpetrators of cyber-attacks today have refined their tactics to increase the sophistication of these attacks that become manifest in the form of ransomware attacks, growing phishing volumes, and new methods of propagating malware development. Holt, Bossler, and Seigfried-Spellar (2017) attest to this challenge by acknowledging that between 2014 and 2015 only, ransomware or scareware attacks increased by a whopping 35%, targeting mobile devices, some operating systems, and web servers. Ransomware attacks are a challenge to security professionals because technological advances continue to trigger massive transformations in cybersecurity breaches. These breaches shift the cybersecurity goalposts, making it exceedingly difficult for these professionals to stay operationally ahead of such threats.

Another challenge for security professionals the broadening skill gap. Today, finding, training, and sustaining qualified employees, along with retaining the exceptional talent needed in dealing with new cybersecurity threats continue to be a big challenge. Cybersecurity requires specialized scientific and technical skills, knowledge, and experience. However, statistics provided by De Zan (2019) reveal that currently, there are about 3 million cybersecurity job posts that have not been filled globally because there are not enough security professionals to fill these posts. The same source estimates that the skill gap will become worse because it will widen to 3.5 million by 2021. What this means is that teams of security professionals will face a growing skill challenge because they simply cannot find additional and new next-generation security workforce with the experience, expertise, and talent needed to fulfill fundamental security functions.

The third challenge for security professionals is the problem of overwhelming priorities. According to Knapp and Langill (2014), reducing and mitigating the risks, vulnerabilities, and threats in cybersecurity require high-level prioritization. However, these priorities may become overwhelming to security professionals when juggling them. This is because these professionals end up being pulled in different directions as they work hard to meet the needs of their respective departments. Apart from having many priorities, security professionals have to deal with large volumes of security alerts of different complexities. As they compete with these alerts, it becomes had to cope with their volumes and complexities, and they become overwhelmed developing what is termed alert fatigue (Miliard, 2019). Other challenges include increasing complexities of business security environments, development of stricter global security regulations, issues associated with data interoperability, and budgetary restraints in implementing and managing security infrastructure.

I have been responsible for the security and protection of a physical asset, specifically manufacturing equipment. What I wished I had known going into this assignment are the industry-specific security solutions for protecting that equipment from theft, misuse, and hazards that are beyond human control. If I had not known these, the one issue that might cause me to stay up at night if given this assignment would include how to acquire and get acquainted with industrial controls in manufacturing processes. Another issue would include equipment insurance and related data integrity.

References

De Zan, T. (2019). Mind the gap: the cyber security skills shortage and public policy interventions. Oxford University.

Holt, T. J., Bossler, A. M., & Seigfried-Spellar, K. C. (2017). Cybercrime and digital forensics: An introduction. Routledge.

Knapp, E. D., & Langill, J. T. (2014). Industrial network security: Securing critical infrastructure networks for smart grid, SCADA, and other Industrial Control Systems, 2 Ed. Syngress.

Miliard, M. (August 30, 2019). Alert fatigue a big problem for cybersecurity professionals too. Healthcare IT News. Retrieved January 14, 2020, from https://www.healthcareitnews.com/news/alert-fatigue-big-problem-cybersecurity-professionals-too.

Class B Case Study Review

Class B: Case Study Review

Author’s Name

Institutional Affiliation

Class B: Case Study Review

The case study selected for this review exercise is the one by Rasmussen and Ramsayer (2015) on the release and absorption of carbon and how it influences the climate. The purpose of this case study is to discuss and analyze seven case studies considered as pressing concerns regarding carbon release and its effects on the warming of the climate. Two of the seven cases include the radical changes in Arctic carbon and the ever-growing concentration of atmospheric methane and its greenhouse warming effects. The others are the carbon storage capacity of tropical forests, carbon release from wildfires, carbon storage and carbon-related changes to North American forests, oceanic abortion of carbon, and carbon absorption by phytoplankton.

In the case study, the authors have addressed the topic of carbon absorption and release by Earth’s ecosystems comprehensively and sufficiently in a way that appeals to policymakers and practitioner audiences to take active actions in limiting carbon release to the environment. Specifically, Rasmussen and Ramsayer (2015) use these seven cases as examples of extreme carbon-related events that continually interact with the environment, shaping the current state of climate warming and causing other harmful events such as wildfires, reduced forest growth, and acidification. The case study also allows policymakers to have a framework for predicting the future of the climate based on the current carbon footprint in the seven key areas addressed.

From an analytical outlook, this case study will contribute meaningfully to the development of Security and Disaster Management studies as an academic field and professional domain in three ways. Firstly, it points to the availability of satellite and remote sensed data from NASA space expeditions, which can assist scholars and professionals to track changes to the climate and make useful predictions regarding climate warming. Secondly, the case study sensitizes environmental professionals about the design, establishment, and adoption of scientific models and instruments for modeling the extreme events that have been identified to have a massive impact on climate change and warming. With such modeling and instrumentation, these professionals can better quantify climate change based on the projections of severity and frequency of extreme events that cause climate change. Lastly, the case study will contribute by the development of such studies by providing current and evidence-based facts and data that will add value to these studies.

Having been published in 2015, this case study retains its value with the time distance from the seven events or case concerns. The rationale for this argument is that carbon release and absorption have continued to shape climate change since the time Rasmussen and Ramsayer (2015) authored this article. What this means is that the article is currently relevant to informing contemporary policy, professional, and scholarly actions relating to regulating the amount of carbon released to the environment. Since climate change due to carbon footprint is expected to be a continuing issue, the article will likely be read with interest in the future to guide decisions on strategic climate change and disaster control actions and measures.

Rasmussen and Ramsayer (2015) have presented their arguments in a clear, concise, and compelling way. The quality of their work is outstanding as they back their claims with evidence from proven and accurate facts from NASA data repository. They express high levels of originality and timeliness in the points judging from the fact that they convey them using professional language without bias and subjectivity while acknowledging sources from which they obtained information used to corroborate these points. This makes it valuable to subject matter experts within the environment study area and other disciplines of interest. By using clear subheadings for each of the seven cases, Rasmussen and Ramsayer (2015) express acceptable clarity of presentation. From a systems analysis perspective, the modeling of climate change suggested in this article should be done with caution. The reason is that the establishment of competing models would generate complicated analyses that would generate too much information, which would obscure real solutions to the systemic problems that cause climate change such as the reduction of carbon dioxide, Meadows and Wright (2008) suggest. In summary, this case study illustrates the weight of carbon release on aggravating climate change, indicating the need for proactive measures to lessen the carbon footprint.

References

Meadows, D. H., & Wright, D. (2008). Thinking in systems: A primer. White River Junction, VT: Chelsea Green Publishing.

Rasmussen, C. & Ramsayer, K. (November 11, 2015). Seven case studies in carbon and climate. Global Climate Change. NASA. Retrieved December 2, 2019, from https://climate.nasa.gov/news/2365/seven-case-studies-in-carbon-and-climate/.

CLASS A EMERGENCY RESPONSE POLICY DISCUSSION

CLASS A: EMERGENCY RESPONSE POLICY DISCUSSION

Author’s Name

Subject

Date

If I were a special consultant, I would advise the governor to do three things to enable and empower remote communities with training and resources that are essential to responding effectively to disasters. I would do this through an open and transparent process involving public reviews and input. Firstly, I would appeal to the governor to implement community-based disaster enlightenment programs and commit to ensuring ease of access to learning resources as part of effective disaster response policies. This move would augment the community’s competency and abilities in disaster risk reduction (DRR), humanitarian work after disasters, and disaster preparedness and response. Secondly, I would advise the governor to create and fund community-oriented empowerment-enhancing initiatives and disaster safety practices. Then, he would move to engage local institutions of learning to collaborate in disseminating such practices and activities as an imperative policy component for sustainable community-centered disaster management. Lastly, I would advise the governor to initiate and deploy strategic disaster-oriented task forces and empower the community with resources to activate these task forces for enhanced disaster response.

Assuming that I am considering strategic- or executive-level policy, my recommendations on the policy requirements for the governor to adopt indicate that the best balance is between top-down and bottom-up approaches to disaster management policy. A balance between top-down and bottom-up approaches will enhance the chances of eliciting and achieving support under the current circumstances because it emphasizes community empowerment trough training and resource deployment. Community empowerment, along with training and keeping the community informed in disaster response policy are the key groundwork for attaining sound community resilience to disasters.

Bibliography

Plough, Alonzo, Jonathan E. Fielding, Anita Chandra, Malcolm Williams, David Eisenman, Kenneth B. Wells, Grace Y. Law, Stella Fogleman, and Aizita Magaña. “Building community disaster resilience: perspectives from a large urban county department of public health.” American Journal of Public Health 103, no. 7 (2013): 1190-1197.

Rajeev M. M. “Sustainability and community empowerment in disaster management.” International Journal of Social Work and Human Services Practice 2, no. 6 (2014): 207-212.

Win, Yin Mar Nay. “A study on disaster risk reduction and management in community (Case Study: Bilin Township, Thaton District, Mon State)” PhD diss., Yangon University of Economics, 2019, 1-45.

CLASS A DISCUSSION

CLASS A: DISCUSSION

Author’s Name

Subject

Date

The level of government I have chosen for this week’s discussion is the state government. In the context of state governments, an example of something I regard as an improvement to current disaster-associated policy transformations is the amendment of the Emergency Relief and Assistance Fund (ERAF) regulation that took effect in 2014. This amendment was a change in government response structure that enabled the creation of a useful sliding-scale framework in Vermont for sharing costs on the 17.5% of non-federal match requirements for public assistance grants offered by the Federal Emergency Management Agency after federally-declared disasters. The new policy change means that Vermont will contribute an additional 7.5% towards these costs, and also contribute 12.5% or 17.5% of entire cost to enable communities to be well prepared to lessen damage emanating from floods. I see it as a positive policy change because it encourages collaboration between state and federal governments in augmenting community financial resilience against disasters.

An example of something I consider not an improvement is the establishment of the Community Planning Assistance for Wildfire program or (C-PAW) program in 2015. It was created to advocate collaboration with the communities to lessen risks of wildfire disasters through improved planning of land utilization in different states. Specifically, the program provides technical assistance to these communities as regards integrating wildfire risk planning into their land use plans to ensure the management of building codes development and natural resources, hence reducing risks of wildfire disasters. I do not see this program as a policy improvement but as an additional program among many other wildfire programs established in the last two decades following collaborative action between state and federal governments in the area of wildfire disaster management.

Bibliography

Headwaters Economics. “Communities Utilize Land Use Planning to Reduce Wildfire Risks and Costs.” Available at https://headwaterseconomics.org/wildfire/solutions/cpaw/ (Accessed November 29, 2019).

Richards, Ryan. “Before the Fire: Protecting Vulnerable Communities from Wildfire.” (Center for American Progress, July 25, 2019). Available athttps://www.americanprogress.org/issues/green/reports/2019/07/25/472639/before-the-fire/. (Accessed November 29, 2019).

Vermont Emergency Management.” 2018 Vermont State Hazard Mitigation Plan.” (Vermont: Vermont Emergency Management, 2018).

Vermont State Government. “Emergency Relief and Assistance Fund.” (Vermont: Vermont State Government, 2019). Available at https://floodready.vermont.gov/find_funding/emergency_relief_assistance. (Accessed November 29, 2019).

Class 643 Week 7

Class 643 Week 7

Author’s Name

Institutional Affiliation

Class 643 Week 7

Petya and NotPetya have several differences the first of which is the XOR key used. The latter uses 0x07 as a key while the former uses 0x37 (Alvarez, 2017). Another difference is that Petya is a standard piece of ransomware that quickly targeted a few cryptocurrency (Bitcoin) victims while NotPetya is malware with many tools that enable it to spread in and infect computers (Fruhlinger, 2017). Thirdly, the two differ in their reboot style where Petya initiates the reboot process using NtRaiseHardError API while NotPetya utilizes the “shutdown.exe/r/f” command to schedule a reboot (Alvarez, 2017). These and other differences are significant to the growing cybersecurity field as it relates to infrastructure because they reflect the magnitude of damage and vulnerabilities that can arise from critical infrastructure interdependency in the event of ransomware or malware attacks (Macaulay, 2019).

In general, NotPetya differs from ransomware in that this malware is not an attempt to achieve financial gain via cyber ransom but rather infect computers and deny users the opportunity to decrypt and restore their systems. So, the likely motivation in this difference was data destruction where NotPetya encrypts users’ data and damages it beyond repair (Fruhlinger, 2017). The implications of the NotPetya attack for global transportation systems are that it caused major transportation disruptions at port facilities globally and borked the global transport and logistics supply chains (Macaulay, 2019; Saul, 2017). Had Maersk not acted promptly to recover so quickly from this attack by reinstalling and replacing its IT systems in 10 days, the implications would have been total catastrophic transportation disruptions worldwide. Some factors that could have made the NotPetya attack worse are unpatched computer systems and massive infrastructure interdependence. What could have been done to help prevent this attack is infrastructure separation so that an attack on one infrastructure sector does not affect all sectors.

References

Alvarez, R. (July 09, 2017). Key differences between Petya and NotPetya. Fortinet, Inc. Retrieved February 25, 2020, from https://www.fortinet.com/blog/threat-research/key-differences-between-petya-and-notpetya.html.

Fruhlinger, J. (October 17, 2017). Petya ransomware and NotPetya malware: What you need to know now. CSO & IDG Communications, Inc. Retrieved February 25, 2020, from https://www.csoonline.com/article/3233210/petya-ransomware-and-notpetya-malware-what-you-need-to-know-now.html.

Macaulay, T. (2019). The danger of critical infrastructure interdependency. Governing Cyberspace during a Crisis in Trust, 69-73.

Saul, J. (2017). Global shipping feels fallout from Maersk cyber attack. Thompson Reuters.

Class 643 Week 6

Class 643 Week 6

Author’s Name

Institutional Affiliation

Class 643 Week 6

The differences between the 2015 cyber-attack on the Ukrainian electricity grid and the 2003 attack on the United States national electricity grid were so substantial because of the source or cause of the attack and the length of days the attack took. While the U.S. attack came from an unprecedented software failure or a software-based blackout bug within General Electric’s system (Poulsen, 2004; Wald, 2013), the Ukrainian attack emanated from perfectly synchronized, highly coordinated, and brilliantly executed multisite and multistage cyber-attack (Liang et al., 2016; Sullivan & Kamensky, 2017). Also, while the Ukrainian attack lasted only for about 6 hours, the American attack lasted for two weeks (14 days), making the impacts more profound than in Ukraine. While insider data security threats could have an equal impact as outsider data security threats, I think that we do perceive external attacks differently than a lack of proper internal controls. Most people feel that external attackers who can access data via keyloggers (as in the case of Ukraine) pose a greater threat than internal players who can directly access and compromise data for personal gains.

From a critical stance, I think that the vector of attack or the threat is of particular consequence. This is because the vector of attack relates to the variants of malware used to steal authorized users’ credentials that are then used to exploit vulnerabilities aimed at gaining access to systems and executing the cyber-attack. Similar tactics, techniques, procedures, and methodologies can be deployed to launch massive attacks of unprecedented ramifications, a fact that Sullivan and Kamensky (2017) confirm.

As we move into the future, hackers and cyber attackers will leverage new technologies to develop new and possibly more resilient versions of malware. What this means is that they will find new methods of executing future attacks that have higher rates of destructiveness compared to the methods used in the Ukrainian cyber-attack. The vulnerabilities in the Ukrainian system are still a concern because these new methods will allow attackers to exploit the vulnerabilities faster than defenders can provide remedies for them. So, my recommendation as regards preventing a repeat of such attacks anywhere in the world is an emphasis on international collaboration in rigorous and proactive updating and enforcement of critical infrastructure protection standards facilitated by vigorous independent auditing.

References

Liang, G., Weller, S. R., Zhao, J., Luo, F., & Dong, Z. Y. (2016). The 2015 Ukraine blackout: Implications for false data injection attacks. IEEE Transactions on Power Systems, 32(4), 3317-3318.

Poulsen, K. (2004). Software bug contributed to blackout. Security Focus. Retrieved February 20, 2020, from https://www.securityfocus.com/news/8016.

Sullivan, J. E., & Kamensky, D. (2017). How cyber-attacks in Ukraine show the vulnerability of the US power grid. The Electricity Journal, 30(3), 30-35.

Wald, M. L. (2013). The blackout that exposed the flaws in the grid. The New York. The New York Time Company. Retrieved February 20, 2020, from https://www.nytimes.com/2013/11/11/booming/the-blackout-that-exposed-the-flaws-in-the-grid.html.

Class 643 Week 5

Class 643 Week 5

Author’s Name

Institutional Affiliation

Class 643 Week 5

Stuxnet Attack Summary

Stuxnet is an advanced weaponized cyber-attack that targeted Iranian industrial control systems. As an Advanced Persistent Threat (APT), it consists of multiple zero-day exploits utilized in delivering malware that targets and infects particular industrial controls (Knapp & Langill, 2014). These targeted attacks serve the primary purpose of sabotaging automated industrial processes or precise industrial equipment (Baezner & Robin, 2017). Stuxnet is the first cyber-attack specifically designed and technologically created to target industrial control systems. The most likely technique of attack used with Stuxnet is a worm that uses four zero-day vulnerabilities to infect Windows-based computer networks through Universal Serial Bus (USB) access ports and flash drives (Baezner & Robin, 2017; Knapp & Langill, 2014). The vulnerabilities that Stuxnet exploited include zero-day vulnerabilities that affect driver certificates (that were stolen and employed in malware) and some privilege escalation vulnerabilities.

Impacts of Stuxnet

Stuxnet had numerous political, social, economic, international, and technological impacts. Stuxnet impacted the Iranian political realm and society by making them appear weak and vulnerable for failing to secure critical infrastructure adequately (Baezner & Robin, 2017). In the Iranian economy, Stuxnet’s impact was that the nation had to incur budgetary spending in replacing the centrifuges broken by the attack, along with establishing a new cybersecurity unit. Stuxnet’s international impacts were that it triggered wake-up calls for countries to enhance their cybersecurity initiatives. Also, Stuxnet sensitized nations to appreciate the need for robust cybersecurity strategies that extended comprehensively to critical infrastructure and actors in the private sector that manage the infrastructure (Baezner & Robin, 2017). Furthermore, Stuxnet lessened the Middle-East military tensions because the nuclear program in Iran was no longer deemed an immediate threat. Lastly, the hotspot analysis of Stuxnet raised concerns in the international community regarding the emergence of new Stuxnet versions within the cybercrime circles. As regards the technological impacts, Stuxnet was found to be instrumental in designing malware that could specifically sabotage industrial controls and precise industrial equipment. Also, the new zero-day vulnerabilities that Stuxnet exploited affected driver certificates, which were stolen and employed in creating malicious software (Baezner & Robin, 2017).

Prevention of Such Attacks

Going forward, Stuxnet and other APT attacks get prevented by augmenting security awareness, setting up layered defenses that cover all ICS systems, ensuring logical separation of networks, writing software in a way that detects non-conforming actions, and ensuring stricter user privileges. What was lacking here was properly written software and stricter user privileges, which could have provided better mechanisms for preventing Stuxnet. What could potentially reduce the extent of risk is the separation of networks.

References

Baezner, M., & Robin, P. (October 2017). Hotspot analysis: Stuxnet (No. 4) version 1. Center for Security Studies (CSS), ETH Zurich.

Knapp, E. D., & Langill, J. T. (2014). Industrial network security: Securing critical infrastructure networks for smart grid, SCADA, and other Industrial Control Systems, 2 Ed. Syngress.

Class 643 Week 4 Discussion

Class 643: Week 4 Discussion

Author’s Name

Institutional Affiliation

Class 643: Week 4 Discussion

The standardization of the five core functions of the NIST Cybersecurity Framework, namely, identify, detect, protect, respond, and recover, can assist in creating a unified approach to cybersecurity across all infrastructure sectors and industries in two ways. Firstly, the standardization would provide a cost-effective, flexible, repeatable, and prioritized approach to collective management of cybersecurity-related risks that effectively integrates best practices and guidelines for promoting critical infrastructure protection (NIST, 2019). Secondly, standardizing these functions would ensure the creation of a unified approach to cybersecurity by allowing streamlined and standards-based communication, discourses, collaboration, and risk management planning between and among players in these sectors and industries in a way that allows for the classification, reconciliation, and redistribution of critical infrastructure protection guidelines, policies, and standards.

The Presidential Executive Order that I select from the two is that of 2017 released by President Donald Trump. This executive order resulted from the constitutional mandate of the Office of the President to protect the American innovation and values by stretching critical infrastructure cybersecurity. This executive order has impacted the current state of cybersecurity significantly in several ways. For instance, the order has greatly strengthened the cybersecurity of federal networks and critical infrastructure by increasing the modernization of federal information technology infrastructure towards collaboration and cooperation with foreign allies in ensuring full-scale critical infrastructure security. Also, the executive order has impacted cybersecurity by augmenting accountability reporting by heads of enterprises and agencies across the United States (The White House, 2017). Thirdly, the executive order has impacted cybersecurity by increasing the promotion of marketplace transparency of critical infrastructure entities in their cybersecurity risk management practices.

The area or component of the NIST Cybersecurity Framework that I select is the protect component. This function relates to developing and implementing suitable safeguards for ensuring the secure delivery of critical infrastructure services (Dickinson, 2017; U.S. General Services Administration, 2020). This function of the framework has six categories involved, namely data security, access control, information protection processes and procedures, awareness and training, protective technology, and maintenance. The importance of three of them is addressed. The importance of data security is that it ensures the protection of confidentiality, availability, and integrity of information in the management of records and information. The importance of access control is to ensure that only authorized users, devices, transactions, and processes have access to facilities and assets (Yeagley, 2017). The significance of the information protection processes and procedures is the emphasis on maintaining and employing security policies, procedures, and processes in managing the protection of information assets and systems.

References

The White House. (May 11, 2017). Presidential executive order on strengthening the cybersecurity of federal networks and critical infrastructure. Washington, DC. The White House. Retrieved February 04, 2020, from https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/.

NIST. (November 18, 2019). Cybersecurity framework. Gaithersburg, MD. National Institute of Standard and Technology (NIST). Retrieved February 04, 2020, from https://www.nist.gov/cyberframework/new-framework.

Dickinson, D. (2017). Cybersecurity: going beyond protection to boost resiliency. White Paper. Harrisburg, PA. Phoenix Contact.

Yeagley, G. (July 19, 2017). The NIST cybersecurity framework – The protect function. North Providence, RI. Compass IT Compliance, LLC. Retrieved February 04, 2020, from https://www.compassitc.com/blog/the-nist-cybersecurity-framework-the-protect-function.

U.S. General Services Administration. (2020). NIST Cybersecurity Framework (CSF). Washington, DC. U.S. General Services Administration. Retrieved February 04, 2020, from https://www.gsa.gov/technology/technology-products-services/it-security/nist-cybersecurity-framework-csf.