Alex Stamos is the former chief of security at Facebook. Now he runs the Internet Observatory at Stanford University and says that one of the problems with the country's overall cyber strategy is that there is no one in charge of looking at the big picture. An NTSB for cyber would provide some of that.

"You have the FBI, which is deeply involved in the incident response, but they are there to enforce the law. It's not their job to come up with conclusions for the entire society," he said. "You have DHS's CISA, the Cybersecurity Infrastructure Security Agency, their job is to work on defense. So they're probably the closest of the agencies to this, but they don't have any investigative powers. So we're in this weird position where it's really nobody's job ... to tell us what happened."

Neuberger says the executive order seeks to address that by creating more transparency. "If you or I are going out to buy network management software like SolarWinds and we want to buy the software that is most secure, we have no way of assessing which that is," she said. "And as a result, we have no way of saying, 'you know what? I'm willing to pay $5 more for the more secure software because I don't want to bring more risk into my network.' "

Neuberger said that the administration can remedy that by defining a set of requirements for the way software is built. Federal contractors will have to prove that they have secure practices like separating where they develop software from the internet, and things like requiring proof of multifactor authentication. The administration is trying to change the way we all think of code: It isn't just zeroes and ones — it is critical infrastructure.

"The key here is we can't just expect companies to be motivated to build secure software because it's the right thing to do," said Kiersten Todt, managing director of the Cyber Readiness Institute and a former Obama adviser on cyber issues. "Government has to be working with these companies to tell them what secure software looks like and give them the resources, and incentivize them to do so."

She says consumers have a role to play, too. "If we start incentivizing security, then companies [and] the market will then inherently prioritize it because more people will buy the product," she said. "So there is a very much of a multi-stakeholder collaboration that has to happen here."

And an executive order alone won't do that.

"I think it's a first step," Todt said. "It's definitely not the Holy Grail. It's not a destination. It's the departure point."

Notification required

Another perennial issue is that when companies are hacked in the U.S., a lot of them keep it to themselves. The revelation of a cyberattack often affects confidence, share prices and reputation.

The executive order is seeking to change that. Neuberger said federal contractors will be required to be more open about attacks. "If you're doing business with the federal government, then when you have an incident, you must notify us quickly," she said. "Because we'd like to take that incident and ensure that the tactics, techniques and procedures, the information is broadly shared," she said. Then other companies, presumably, would follow their lead.

The chairman of the Senate Intelligence Committee, Sen. Mark Warner, told the U.S. Chamber of Commerce this week that he's working on a bill that will likely include some sort of "mandatory reporting" of cyber incidents and public-private cyberthreat intelligence sharing. He, too, said it was in response to the attack on SolarWinds.

But all this is easier said than done.

"The key is going to be in how each of these elements of the executive order are executed," Todt said. "And really how government is going to bring industry in to perform the functions to really look pre-event, middle of event, post-event and how we take those lessons learned and integrate them."

And while you may have never heard of SolarWinds or been affected by that attack, the connected world is increasingly vulnerable. And that is one of the messages the administration is trying to send.

"Cyberthreats loom large in a way that Americans feel," Neuberger said. "Can we trust our water, our power to be resilient? We see small companies being forced to pay a ransom to get their business back up and running. We see school systems' networks down due to criminals. So, those risks touch everyday Americans' lives."

The Biden administration has already leveled sanctions against Russia for the SolarWinds attack. And the White House has said there would be more "seen" and "unseen" responses to the breach. The unseen responses — for example, whether the Biden administration is preparing a reprisal attack against Moscow in cyberspace — was not something Neuberger was willing to talk about.

Copyright NPR 2021.