President Joe Biden is introducing an executive order to strengthen cybersecurity standards for federal agencies and contractors, targeting vulnerabilities exposed by recent cyberattacks linked to China. The order, expected soon, focuses on secure software development, validation processes, and enhanced oversight by the Cybersecurity and Infrastructure Security Agency (CISA).
According to a draft seen by Reuters, vendors must provide documentation proving adherence to secure development standards, which will be validated through CISA's attestation program. Non-compliance could result in legal action. This measure follows several high-profile breaches, including a 2023 hack of U.S. Treasury emails, allegedly linked to Chinese operatives—a claim Beijing has denied.
Tom Kellermann of Contrast Security supports Biden’s push but criticizes the timelines for implementation as inadequate given the immediate threats from China, Russia, and cybercriminal groups. “We’re facing a cyber insurgency targeting critical infrastructure and federal agencies,” he said.
The order also addresses vulnerabilities in access tokens and cryptographic key management, which hackers exploited in the May 2023 breach of top U.S. officials’ emails, as noted by Microsoft.
Brandon Wales of SentinelOne highlighted the order’s continuity with prior administrations’ efforts to bolster cybersecurity capabilities. He emphasized the need for urgency, citing China as a “pacing threat” while acknowledging the broader landscape of cyber risks.
The White House and CISA declined to comment. While experts see the order as a step forward, many stress the importance of swift and comprehensive action to counter escalating cyber threats. Biden’s cybersecurity reforms aim to fortify the nation’s digital defenses and ensure resilience in the face of sophisticated cyberattacks.