ESG Recently Published a new Research Report titled “Cyber Supply Chain Security Vulnerabilities Within The U.S. Critical Infrastructure.” The report can be downloaded here.

As part of the survey, we asked respondents whether the U.S. Federal Government should be more active with cyber security strategies and defenses. Most respondents believe that the answer is “yes;” 31% said that the U.S. Federal Government should be “significantly more active with cyber security strategies and defenses” while 40% believe that the feds should be “somewhat more active with cyber security strategies and defenses.”

Okay, but what exactly should the government do? ESG asked this question as well–here are the results:

• 42% said, “create and publicize a ‘black list’ of vendors with poor product security”
• 42% said, “create better ways to share security information with the private sector”
• 39% said, “enact more stringent cyber security legislation along the lines of PCI”
• 39% said, “provide incentives (i.e., tax breaks, matching funds, etc.) to organizations that improve cyber security”
• 36% said, “amend existing laws to hold IT vendors liable for security problems associated with their products”
• 32% said, “enact legislation with higher fines for data breaches”
• 26% said, “limit government IT purchases to vendors that demonstrate a superior level of security in their products and processes”
• 23% said, “promote the use of FIPS-140 and common criteria certified products in the private sector”
• 23% said, “provide funding for cyber security funding and education”
• 22% said, “adopt and fund a public service campaign around cyber security education”

Interesting mix of carrot and stick suggestions. I don’t think the IT industry would be too thrilled with “black lists” or changes in liability laws, so expect lobbyists to push for federal incentives and programs.

One other interesting note here: Heavily regulated critical infrastructure organizations with the highest levels of security were most likely to push for more stringent regulations. It appears that something is lacking in current cyber security legislation that heavily regulated organizations recognize and want to change.

Related posts:

1. New ESG Research Report Points To Security Vulnerabilities In the US Critical Infrastructure
2. Are IT Vendors Getting a “Free Pass” On Cyber Security?
3. Are Critical Infrastructure Organizations Unaware of Security Incidents?
4. Corporate Executives Remain Lukewarm on Cyber Security
5. WikiLeaks, Critical Infrastructure, and Cyber Security

Tags: Barack Obama, Bill Clinton, CIP, Critical Infrastructure Protection, cyber security, cyber supply chain, Cyber supply chain assurance, cyber supply chain security, DHS, DOD, Enterprise Strategy Group, ESG, Howard Schmidt