UNSECURITY Episode 132: President Biden’s Executive Order (EO), Improving the Nation's Security

In Episode 132 (May 18, 2021), hosts Evan Francine and Brad Nye conduct a comprehensive section-by-section analysis of President Biden's Executive Order 14028, 'Improving the Nation's Cyber Security.' They characterize the order as a necessary but challenging initiative that mandates federal cybersecurity modernization across 11 sections.

**Key Provisions:** The EO establishes cybersecurity as a top federal priority and mandates specific requirements: multi-factor authentication deployment across federal civilian agencies within 180 days; encryption of data at rest and in transit; and movement to secure cloud services. Section 2 addresses information sharing barriers between federal agencies and contractors. Section 3 calls for a shift to zero trust architecture (referencing NIST SP 800-207) with agencies required to develop implementation plans within 60 days. Section 4 introduces software supply chain security measures including software bill of materials (SBOM) requirements and consumer labeling programs for IoT devices. Later sections establish a cyber safety review board, mandate standardized incident response playbooks, authorize CISA to conduct threat hunting across federal networks without per-agency authorization, and standardize log retention requirements.

**Implementation Concerns:** The hosts express significant concerns about aggressive implementation timelines (most deadlines 60-180 days) combined with the complexity of required changes. They emphasize that zero trust architecture, while conceptually sound, requires detailed understanding of organizational assets—hardware, software, and data flows—which most agencies lack. Brad notes that zero trust implementation often introduces complexity that can increase security risk if done poorly. The hosts also discuss tensions between security mandates and business continuity, citing a study showing 55% of C-level executives consider cybersecurity breaches overhyped, complicating implementations that disrupt operations.

**Workforce Challenges:** The hosts highlight that DHS launched a 60-day sprint to hire 200 cyber personnel by July 1st (with some sources citing up to 400 total hires needed), with half dedicated to CISA. They discuss potential negative consequences: drawing skilled workers from private sector and smaller government entities, creating salary competition that raises hiring costs, and introducing many new or entry-level personnel with broad access to critical systems. They note the risk of mistakes or malicious actors within newly hired cohorts conducting complex tasks like threat hunting.

**Positive Aspects:** Both hosts view the standardization of cybersecurity fundamentals positively—mandatory MFA, centralized logging, consistent incident response procedures, and log retention standards across agencies. The SBOM requirement is welcomed for supply chain transparency, though intellectual property concerns are noted. Establishment of a cyber safety review board modeled after the NTSB is praised as a potential positive, though hosts warn against private sector bias in advisory selections.

**Key Recommendations:** The hosts stress that implementation success depends critically on execution quality. They recommend organizations start with comprehensive asset inventory before implementing other controls, suggesting the aggressive timelines may be necessary given the federal government's cybersecurity deficit. They caution against mandating specific technologies (like endpoint detection and response) without clear threat context, noting this can lead to ineffective solutions. Overall, they view the order as forcing overdue standardization of foundational cybersecurity practices but emphasize that the aggressive approach carries implementation risks that will only become apparent as agencies develop their compliance plans over the coming months.