{"id":125,"date":"2021-09-18T00:07:39","date_gmt":"2021-09-18T00:07:39","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/cyberimpact1\/?page_id=125"},"modified":"2024-11-27T18:56:54","modified_gmt":"2024-11-27T18:56:54","slug":"cyse-406","status":"publish","type":"page","link":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/cyse-406\/","title":{"rendered":"CYSE 406"},"content":{"rendered":"<h1 style=\"text-align: center\">Cyber Law<\/h1>\n<p>Below is a scenario of me being a legislative research aid.<\/p>\n<div class=\"Page-container\">\n<div id=\"page-0\" class=\"Page PageComponent\">\n<div class=\"Draw Draw--not-drawing Draw--selection\">\n<div class=\"TextLayer-container\">\n<div class=\"textLayer\"><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">To<\/span><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">: Representative Tito Canduit, 26th District of Virginia<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">From<\/span><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">: Josiah Marshall Marshall, Legislative Research Aide<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Date<\/span><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">: 11\/22\/2024<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Subject<\/span><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">: Cybersecurity Research Memo &#8211; IoT Cybersecurity Improvement Act of 2020<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">The Internet of Things (IoT) Cybersecurity Improvement Act of 2020 is a federal law<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">signed by President Donald J. Trump. This law was signed on December 4th of 2020. This law<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">aims to help federal agencies improve their cybersecurity of internet connected devices. This law<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">mandates that minimum security standards for IoT devices purchased by the federal government<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">follow the National Institute of Standards and Technology. These standards focus on secure<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">developments, identity management, configuration management, patching. Contractors<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">supplying IoT devices to federal agencies must ensure their products meet NIST\u2019s guidelines.<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Regarding device assessment, assessments must be conducted to ensure compliance and address<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">new cybersecurity risks. Lastly, federal agencies are required to establish processes for<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">identifying and resolving vulnerabilities in IoT devices they use.<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">The problem\u2019s that IoT devices such as sensors, smart cameras, and connected medical<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">devices have been used more in recent years. In 2020 there were about 31 billion IoT devices<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">worldwide. These devices often have no security features and this makes them easy to attack. A<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">notable example of this is the 2016 Mirai botnet attack which harnessed unsecured IoT devices<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">to create a massive distributed denial-of-service (DDoS) attack that disrupted major websites.<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">This not only presents security risks, but risks to the federal government. As I stated earlier,<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">healthcare, the Department of Defense and other big federal agencies use IoT devices. An attack<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">on these systems could jeopardize national security. Because of this, growing threats are aiding<\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"Page-container\">\n<div id=\"page-1\" class=\"Page PageComponent\">\n<div class=\"Draw Draw--not-drawing Draw--selection\">\n<div class=\"TextLayer-container\">\n<div class=\"textLayer\"><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">in different countries because they know IoT devices can be useful to take advantage of national<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">security. However, this law responds to public concerns about cybersecurity and ransomware<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">incidents. This law aims to set precedent for improving security standards across the private<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">sector.<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">The strength of this law is that it establishes at least the most minimal security measures<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">and reduces risk of attackers exploiting poorly secured IoT devices in federal systems. It also<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">promotes security design in these IoT devices being made and encourages better approaches in<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">general. However, this law could improve by being IoT devices as a whole. This law only covers<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">the IoT devices used by federal agencies which is a small portion of the IoT devices. This law<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">needs to educate the public about why IoT devices need to be secure and have punishments if not<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">properly secured.<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Some voter focused observations are the economic impact. The law would encourage<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">better innovation by incentivizing companies to develop more secure products. This would be a<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">plus for voters focused on economic growth and jobs in the technology industry. This would also<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">set a benchmark for private companies and benefit consumers by raising the bar for IoT security.<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">What I recommend for Representative Canduit to strengthen your position on<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">cybersecurity is to consider supporting\/proposing laws that extend IoT security standards in<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">businesses to help consumers. Also you should also suggest partnerships with governments and<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">industry leaders to improve IoT security in general. The last thing that you should consider is<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">pushing for laws to continue to advance technological advancements in general and funding<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">security research to continue to watch for cybersecurity threats.<\/span><\/p>\n<div class=\"endOfContent textLayer--absolute\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"Page-container\">\n<div id=\"page-2\" class=\"Page PageComponent\">\n<div class=\"Draw Draw--not-drawing Draw--selection\">\n<div class=\"TextLayer-container\">\n<div class=\"textLayer\"><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Sincerely,<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Josiah Marshall<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">Sources:<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">https:\/\/www.congress.gov\/bill\/116th-congress\/house-bill\/1668<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">https:\/\/www.csoonline.com\/article\/568801\/2020-outlook-for-cybersecurity-legislation.html<\/span><br class=\"textLayer--absolute\" role=\"presentation\" \/><span class=\"textLayer--absolute\" dir=\"ltr\" role=\"presentation\">https:\/\/www.nist.gov\/internet-things-iot<\/span><\/p>\n<div class=\"endOfContent textLayer--absolute\"><\/div>\n<\/div>\n<\/div>\n<div class=\"PDFAnnotationLayer-container\">\n<div class=\"annotationLayer\" data-main-rotation=\"0\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cyber Law Below is a scenario of me being a legislative research aid. To: Representative Tito Canduit, 26th District of VirginiaFrom: Josiah Marshall Marshall, Legislative Research AideDate: 11\/22\/2024Subject: Cybersecurity Research Memo &#8211; IoT Cybersecurity Improvement Act of 2020The Internet of Things (IoT) Cybersecurity Improvement Act of 2020 is a federal lawsigned by President Donald J&#8230;. <\/p>\n<div class=\"link-more\"><a href=\"https:\/\/sites.wp.odu.edu\/josiah-marshall\/cyse-406\/\">Read More<\/a><\/div>\n","protected":false},"author":21947,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/pages\/125"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/users\/21947"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/comments?post=125"}],"version-history":[{"count":3,"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/pages\/125\/revisions"}],"predecessor-version":[{"id":308,"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/pages\/125\/revisions\/308"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/josiah-marshall\/wp-json\/wp\/v2\/media?parent=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}