The Department of Justice will more aggressively pursue contractors and grantees for misrepresenting their cybersecurity posture to the government. While few doubt there's a real problem to be solved, some in the legal and contracting community have raised questions about whether it could clash with other Justice and Biden administration cybersecurity priorities, and whether a good intentioned initiative could create a chilling effect among companies seeking government opportunities.

Ransomware, insider threats and shoddy access controls are at the heart of many compromises against the water and wastewater industries. So are tools like Remote Desktop Protocols that have become increasingly popular since the COVID-19 pandemic.

Diplomacy, disruption, digital resilience and cracking down on cryptocurrency were all cited as areas of discussion as the U.S. and other countries continue to see their industries, critical infrastructure and local governments hit by ransomware on a daily basis.

The agency is asking for companies and research firms to apply for cooperative research partnerships with the government to help develop technology and tools that would inform a “roadmap” the agency is devising to guide businesses and agencies on implementation.

The Office of Management and Budget has given federal agencies a series of new tasks over the next six months to assess their endpoint detection and response capabilities, identify visibility gaps and make sure they have the resources and staff to manage whichever EDR tool they end up adopting.

Federal CISO Chris DeRusha said when it comes to implementing zero trust strategies over the next three years, the "reality" is that many small or independent agencies can't be held to the same standards as their larger and better-resourced counterparts.

The requirements mirror regulations imposed on pipeline operators earlier this year following the Colonial Pipeline ransomware attack and require transportation operators to designate a cybersecurity lead to interact with government and report breaches, hacks and other cybersecurity incidents in a timely fashion.

The bill, sponsored by ranking Republican John Katko, N.Y., and Rep. Abigail Spanberger, D-Va., would empower CISA to prioritize part of critical infrastructure for cybersecurity resources and technical assistance.

Sen. Gary Peters previewed the legislation last week, which would codify CISA’s role as the “lead lead entity for operational cybersecurity coordination across the federal government.”

The White House wants the federal government to catalogue all of its devices and implement endpoint detection and response capabilities by 2024. To get there, agencies will have to navigate some of the same complex and unpleasant realities of the EDR market that have plagued the private sector for years.