Critical infrastructure cybersecurity professionals want to see more government incentives and harsher penalties. In my last blog, I highlighted a recent ESG research survey of cybersecurity professionals working at critical infrastructure organizations (note: I am an ESG employee). As a review:Only 22% of critical infrastructure cybersecurity professionals believe that the U.S. government’s cybersecurity strategy is extremely clear and thorough. The vast majority remain confused and/or underwhelmed.In spite of this misconception, 83% of cybersecurity professionals working within critical infrastructure industries say that the U.S. government should be more active with cybersecurity strategies and defenses.So the infosec crowd wants Uncle Sam to put more skin in the game, but what specific actions should the U.S. government take? Survey respondents were given a list of potential federal cybersecurity actions and asked to select which of these the government should move forward. Here’s what they said:47% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should create better ways to share cybersecurity information with the private sector. Good news for the Washington crowd as this aligns with President Obama’s Executive Order and several pieces of legislation making their way through congress.44% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should create and publicize a “black list” of vendors with poor product security. Clearly, these infosec pros want more accountability in the cyber supply chain. Interesting idea, but with all the money flowing to K Street lobbyists, this will never happen.40% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should limit federal government IT purchasing to vendors that demonstrate a superior level of security in their products and processes. I like this one assuming that the feds could establish an objective set of metrics as a guideline. This suggestion could actually be a white list proxy for the “black list” suggestion above.40% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should enact more stringent cybersecurity legislation along the lines of PCI DSS. Hmm, these infosec pros (i.e. those on the front line) are recommending something that Congress and organizations like the U.S. Chamber of Commerce have been so opposed to. Kind of a NIST cybersecurity framework with teeth. Are you listening, Congress?39% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should enact legislation with high fines for data breaches. A sort of financial Scarlet Letter? Once again, K Street lawyers would get in the way here.37% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should provide funding for cybersecurity professional training and education. I couldn’t agree more, but what’s needed is a concerted cybersecurity education strategy with funding for centers of excellence rather than the current peanut butter approach backed by meager funding.36% of cybersecurity professionals working at critical infrastructure organizations said that the federal government should provide incentives (i.e. tax breaks, matching funds, etc.) to organizations that improve cybersecurity. This too makes sense if the feds can establish useful and objective metrics for strong security.Attention Washington: an important constituency, cybersecurity professionals working at critical infrastructure organizations, is asking for your help. This group wants to see a detailed cogent cybersecurity strategy and more action. They also want you to sweeten the pot for organizations that make positive cybersecurity contributions and punish those that don’t. So stop treating cybersecurity as a political football and get busy!If you’d like to read more, the ESG research brief is available for download here. Related content analysis 5 things security pros want from XDR platforms New research shows that while extended detection and response (XDR) remains a nebulous topic, security pros know what they want from an XDR platform. By Jon Oltsik Jul 07, 2022 3 mins Intrusion Detection Software Incident Response opinion Bye-bye best-of-breed? ESG research finds that organizations are increasingly integrating security technologies and purchasing multi-product security platforms, changing the industry in the process. By Jon Oltsik Jun 14, 2022 4 mins Security Software opinion SOC modernization: 8 key considerations Organizations need SOC transformation for security efficacy and operational efficiency. Technology vendors should come to this year’s RSA Conference with clear messages and plans, not industry hyperbole. By Jon Oltsik Apr 27, 2022 6 mins RSA Conference Security Operations Center opinion 5 ways to improve security hygiene and posture management Security professionals suggest continuous controls validation, process automation, and integrating security and IT technologies. By Jon Oltsik Apr 05, 2022 4 mins Security Practices Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe