Application security, Security Staff Acquisition & Development, Governance, Risk and Compliance

National cyber director focused on staffing, promoting safe software and boosting workforce

Chris Inglis testifies June 10, 2021, during his confirmation hearing for national cyber director before the Senate Homeland Security and Governmental Affairs Committee in Washington. As it continues its hiring spree, Inglis’ office will turn its focus to a number of short term and medium-term goals to help bolster the nation’s collective cyb...

National Cyber Director Chris Inglis said his nascent office will be focused on “doctrine and people issues” within the federal government, raising the collective floor of U.S. cybersecurity knowledge and laying the groundwork for longer-term investments in secure software and hardware.

While providing an update to the Information Security Privacy Advisory Board, Inglis said on Wednesday that his office — created through the 2021 National Defense Authorization Act — is still less than halfway through its initial hiring phase. The Office of the National Cyber Director currently has around 30 employees on staff, but that number is expected rise to around 85 when initial hiring efforts are complete.

It's taken some time to get the office up and running, Inglis said, noting he was "confirmed in June (2021), showed up in July, but the funding didn't show up until November."

"Often times there's this issue of [being] authorized, not appropriated, and we experienced that,” he told the board.

As it continues its hiring spree, the office will turn its focus to a number of short-term and medium-term goals to help bolster the nation’s collective cybersecurity. That starts with providing more “coherence” to the distinct roles and responsibilities among agencies within the federal government when it comes to carrying out different cybersecurity missions and engaging with the private sector.

To that end, Inglis said that his office will look to set up tabletop exercises in the near future to test the federal government’s response to different cybersecurity scenarios. Additionally, while Congress has given his office limited authority to review the cyber budgets of other agencies, he said he is seeking to “broaden that remit” to include assessments of the proper roles and responsibilities for staff, where and how dollars are expended and prioritized and make recommendations for more efficient resource allocation.

For too long, cybersecurity strategies have focused on addressing technological flaws or vulnerabilities at the expense of looking at the larger process that governs how they’re used. While some tend to think of cyberspace as “a pile, a body of technology,” Inglis said it is more instructive to look at the domain as the sum total of the underlying technologies, the individual choices made by the people who manage them and the overall organizational doctrine that spells out who is responsible for protecting what.

Over the medium term, the office will work to promote transparency programs in the software supply chain (like software bill of materials, aka SBOMs, and additional support for open source software developers), as well as improving basic cyber hygiene among the U.S. workforce.

While the immediate response to the Log4j vulnerabilities demonstrated the promise of the federal government bringing its collective resources to bear on a problem, it’s still largely a reactive model that doesn’t address the way many cyber vulnerabilities are introduced into the system in the first place. The ultimate goal is to re-orient the federal government’s broader approach to its investments — whether through individual procurements or broader programs like recently passed $1.3 trillion infrastructure law — towards products, solutions and processes that have security baked in.

Inglis said his office will also continue to work through strategies to improve the cybersecurity workforce both inside and outside the federal government. That includes not just speeding up existing hiring or retention policies around cybersecurity but reexamining them writ large, from the type of job requirements listed to overhauling education, training and outreach efforts in order to reach new and broader demographics.

They will also be executing a new strategy to promote upskilling the baseline cybersecurity knowledge of workers around the country who make use computers or software in their day-to-day jobs but “know less about what’s happening in cyberspace than they do about the management of a hot stove or crossing a busy street.”

“We have to make sure that from the earliest age on — we don’t necessarily need to make them all Python programmers, that would be nice but that we make them cyber aware.”

Derek B. Johnson

Derek is a senior editor and reporter at SC Media, where he has spent the past three years providing award-winning coverage of cybersecurity news across the public and private sectors. Prior to that, he was a senior reporter covering cybersecurity policy at Federal Computer Week. Derek has a bachelor’s degree in print journalism from Hofstra University in New York and a master’s degree in public policy from George Mason University in Virginia.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.