Practices and Political Implications of American Cybersecurity Policy since the CNCI (2008)
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
One may conventionally expect the United States to lack headway in its development of cybersecurity and related policymaking, particularly because the US is an advanced, constitutional democracy. However, facing the growing danger of cyber threats, the Bush Administration launched the Comprehensive National Cybersecurity Initiative (CNCI) in 2008 to systematically begin managing cybersecurity problems. The CNCI turns out to be a key document on which America’s cybersecurity foundation is built, providing direction for future policy. On this note, I first look into the various features of the CNCI to conceptualize and frame US cybersecurity policy into what I call the American Cybersecurity Triad. This framework consists of the three focal dimensions of: 1. governmentwide integration; 2. technological counterintelligence; and 3. educational mobilization. This triad is used as the analytical backbone of my paper to depict the core flow of American cyber defense. I then go through each leg of the triad, discussing the main practices that have been in progress since the CNCI. The executions of each of the dimensions in the consecutive order can be represented by: 1. federal, state, local, and international efforts; 2. technical innovations and private-public partnerships; and 3. professional and nonprofessional responsibilities. I then discuss controversial issues that each leg holds, to highlight the political implications that exist within the cybersecurity domain. The fundamental implications of concern regarding the reality of American cybersecurity policy, in the serial order of the triad above, are: 1. the complexities of political processes and bureaucratic biases; 2. the conflict between security and civil rights; and 3. the complications in building workforce coordination and public consensus. My analysis of the American cybersecurity policy since the CNCI finds that the American Cybersecurity Triad and the management of its political implications are crucial in constructing a cyber-secure nation. I finally argue that a state-centric and policy-oriented approach is essential in developing a comprehensive American cybersecurity policy.
Abstract
One may conventionally expect the United States to lack headway in its development of cybersecurity and related policymaking, particularly because the US is an advanced, constitutional democracy. However, facing the growing danger of cyber threats, the Bush Administration launched the Comprehensive National Cybersecurity Initiative (CNCI) in 2008 to systematically begin managing cybersecurity problems. The CNCI turns out to be a key document on which America’s cybersecurity foundation is built, providing direction for future policy. On this note, I first look into the various features of the CNCI to conceptualize and frame US cybersecurity policy into what I call the American Cybersecurity Triad. This framework consists of the three focal dimensions of: 1. governmentwide integration; 2. technological counterintelligence; and 3. educational mobilization. This triad is used as the analytical backbone of my paper to depict the core flow of American cyber defense. I then go through each leg of the triad, discussing the main practices that have been in progress since the CNCI. The executions of each of the dimensions in the consecutive order can be represented by: 1. federal, state, local, and international efforts; 2. technical innovations and private-public partnerships; and 3. professional and nonprofessional responsibilities. I then discuss controversial issues that each leg holds, to highlight the political implications that exist within the cybersecurity domain. The fundamental implications of concern regarding the reality of American cybersecurity policy, in the serial order of the triad above, are: 1. the complexities of political processes and bureaucratic biases; 2. the conflict between security and civil rights; and 3. the complications in building workforce coordination and public consensus. My analysis of the American cybersecurity policy since the CNCI finds that the American Cybersecurity Triad and the management of its political implications are crucial in constructing a cyber-secure nation. I finally argue that a state-centric and policy-oriented approach is essential in developing a comprehensive American cybersecurity policy.
참고문헌 (51)
- "Fact Sheet: The Administration’s Cybersecurity Accomplishments" (2011)[URL]
- "Federal Departments and Agencies focus Cybersecurity Activity on Three Administration Priorities" (2012)[URL]
- "Memorandum for Heads of Executive Departments and Agencies" (2010)[URL]
- "National Cybersecurity Awareness Month" (2011)[URL]
- "National Strategy for Trusted Identities in Cyberspace: Enhancing Online Choice, Efficiency, Security, and Privacy" (2011)[URL]
- "Cybersecurity Management in the States: The Emerging Role of Chief Information Security Officers" (2010)[URL]
- "National Initiative for Cybersecurity Education" (2012)[URL]
- "National Initiative for Cybersecurity Education Strategic Plan: Building a Digital Nation" (2011)[URL]
- "National Security Council (NSC), Cybersecurity" (2012)[URL]
- "The Comprehensive National Cybersecurity Initiative" (2009)[URL]
- "DoD Cyber Crime Center" (2012)[URL]
- "Cybersecurity Involves Federal, Industry Partners, Allies" (2012)[URL]
- "About the National Cybersecurity and Communications Integration Center" (2011)[URL]
- "Cyber Storm: Securing Cyber Space" (2011)[URL]
- "National Infrastructure Protection Plan: Partnering to Enhance Protection and Resiliency" (2009)[URL]
- "Protecting Our Federal Networks against Cyber Attacks" (2009)[URL]
- "Securing Cyberspace: Our Shared Responsibility" (2011)[URL]
- "Stop. Think" (2011)[URL]
- "Trusted Internet Connections" (2011)[URL]
- "US-CERT United States Computer Emergency Readiness Team" (2012)[URL]
- U.S. Government Accountability Office (GAO), "Cybersecurity: Progress Made but Challenges Remain in Defining and Coordinating the Comprehensive National Initiative, GAO-10-338", ~ (2010)
- "Governor McDonnell Announces New Virginia Cyber Security Marketing Effort" (2012)[URL]
- Citron, Danielle Keats, "Cyber Civil Rights", Boston University Law Review, 89, pp.61~125 (2009)
- Coldebella, Gus P, "Foundational Questions Regarding the Federal Role in Cybersecurity", Journal of National Security Law & Policy, 4, pp.233~245 (2010)
- Congleton, R, "A Model of Asymmetric Bureaucratic Inertia and Bias", Public Choice, 39, pp.421~425 (1982)
- Deibert, Ronald J., "Risking Security: Policies and Paradoxes of Cyberspace Security", International Political Sociology, 4, pp.15~32 (2010)
- Dodge, Ronald C, "Cybersecurity Workforce Development Directions", ~ (2011)
- Greenwald, Eric A., "History Repeats Itself: The 60-Day Cyberspace Policy Review in Context", Journal of National Security Law & Policy, 4, pp.41~60 (2010)
- Greer, John N, "Square Legal Pegs in Round Cyber Holes: The NSA, Lawfulness, and the Protection of Privacy Rights and Civil Liberties in Cyberspace", Journal of National Security Law & Policy, 4, pp.139~154 (2010)
- Harknett, Richard J., "The Cybersecurity Triad: Government, Private Sector Partners, and the Engaged Cybersecurity Citizen", Journal of Homeland Security and Emergency Management, 6(1) (2009)
- Harknett, Richard J., "The New Policy World Cybersecurity", Public Administration Review, 71(3), pp.455~460 (2011)
- Hunker, Jeffrey, "US International Policy for Cybersecurity: Five Issues that Won’t Go Away", Journal of National Security Law & Policy, 4, pp.197~216 (2010)
- Mnookin, L. Jennifer, "Technology and Privacy: The New Landscape (review)", Technology and Culture, 41(4), pp.828~830 (2000)
- Nojiem, Gregory T, "Cybersecurity and Freedom on the Internet", Journal of National Security Law & Policy, 4, pp.119~137 (2010)
- Podesta, John D, "Lost in Cyberspace? Finding American Liberties in a Dangerous Digital World", Yale Law & Policy Review, 23, pp.509~527 (2005)
- Prendergast, Canice, "The Motivation and Bias of Bureaucrats", The American Economic Review, 97(1), pp.180~196 (2007)
- Quigley, Kevin, "Cyber-Security and Risk Management in an Interoperable World: An Examination of Governmental Action in North America", Social Science Computer Review, 30(1), pp.83~94 (2011)
- Sharp, Walter Gary, "The Past, Present, and Future of Cybersecurity", Journal of National Security Law & Policy, 4, pp.13~26 (2010)
- Shaw, A. James, "The Right to Privacy and Cybersecurity: Safeguarding American Values", 석사, pp.2010
- Stone, Marianne, "Obama’s Cybersecurity Plan", Communications, 3 (2009)
- Vacca, W. Alexander, "Military Culture and Cyber Security", Survival: Global Politics and Strategy, 53(6), pp.159~176 (2011)
- Young, Mark D, "National Cyber Doctrine: The Missing Link in the Application of American Cyber Power", Journal of National Security Law & Policy, 4, pp.173~196 (2010)
- "Obama’s National Cybersecurity Initiative: Privacy and Civil Liberties are Damned" (2010)[URL]
- "Cybersecurity in Government: Determining your Priorities for the CNCI" (2010)[URL]
- "Will New Cybersecurity Bills Bring Security, or Bureaucracy?" (2011)[URL]
- "Fortinet and the Comprehensive National Cybersecurity Initiative (CNCI)" (2009)[URL]
- "Leveraging StealthWatch for CNCI and TIC Compliance" (2012)[URL]
- "The IT Industry’s Cybersecurity Principles for Industry and Government" (2011)[URL]
- "US Government Urged to Focus Cybersecurity Efforts on Education" (2011)[URL]
- "Institutional Foundations for Cyber Security: Current Responses and New Challenges" (2010)[URL]