Vacant White House cyber post draws concern amid global software breach

Cybersecurity experts are warning that a potential cyber leadership vacuum in the federal government may prevent agencies from recovering and responding to a sprawling ransomware attack that has already exposed millions of Americans' personal data.

A senior official with the Cybersecurity and Infrastructure Security Agency confirmed on a call with reporters last week that several federal civilian agencies were among the victims in a widespread cyberattack that exploited a vulnerability discovered in the popular MOVEit file-transfer product developed by Progress Software. The attack is believed to have been carried out by CL0p, a Russian-linked ransomware gang otherwise known as TA505. Since the news of the global attack was first reported, a variety of federal and state agencies, banks and private sector organizations also confirmed they were victims and that data may have been stolen from millions of customers.

The Office of the National Cyber Director was established under the National Defense Authorization Act for fiscal year 2021 in large part to provide coordination and guidance across the federal government on cybersecurity matters, including incident response and crisis management. Chris Inglis, the first-ever Senate-confirmed national cyber director, stepped down in February after helping to develop the new national cyber strategy released earlier this year. President Joe Biden has not yet nominated a replacement to fill the post. 

John Costello, former chief of staff for ONCD, told Nextgov/FCW that the path outlined in the cyber strategy will help reduce the frequency and impact of successful cyberattacks targeting the federal government — "but only if the strategy is implemented fully." 

“The fact the president has not nominated a new national cyber director — who would lead this effort— since Chris Inglis’s departure in February is a worrying oversight that needs to be addressed if we hope to build a more resilient cyber ecosystem long-term," Costello said. 

Lawmakers warned in a letter to the president last month that they were "extremely concerned" about the vacant cyber role and encouraged him to nominate acting National Cyber Director Kemba Walden, calling her a "proven, forward-thinking leader who can seamlessly step into the permanent position today."

"The coordination across the federal government is of the size and scope that demands the leadership of a Senate-confirmed NCD," the letter read. 

The lack of an appointed national cyber director "has hindered the administration's response" to the MOVEit exploit "and has allowed such attacks to become more damaging and disruptive," according to Mike Walters, vice president of vulnerability and threat research and cofounder of the security patch management software Action1. 

Walters said the position plays a critical role during cyberattacks that target both the public and private sectors by serving "as a central point of coordination between the federal government, FBI and private sector organizations." 

ONCD is currently developing an implementation plan for the national cyber strategy, in addition to a separate cyber workforce strategy due later this summer. Meanwhile, the office is typically seen as the lead for the federal government’s response to major cyberattacks like the one seen this month. 

But Inglis isn’t the only key leader from the agency to recently announce their departure. 

Robert Knake, ONCD's deputy national cyber director for budget and policy and one of the visionaries behind the latest cyber strategy, also reportedly stepped down from his position last week, just four months after Inglis' exit. 

Alex Hamerstone, advisory solutions director for the security consulting firm TrustedSec, noted that the ONCD currently has an interim director, and added that "there are countless women and men working in government at all levels who are devoted to preventing and responding to cyberattacks, which isn’t necessarily affected by not having a national cyber director."

However, Hamerstone acknowledged that the lack of an official replacement could signal that the federal government is not adequately prepared to respond to major cyberattacks. 

"I think the bigger issue is not so much that there isn’t a national cyber director, but more so the fact that the nomination process has not been a priority," he said, adding that the delay "is reflective of the fact that the nation’s cyber strategy is still being developed and from where it is driven is a subject of debate and disagreement."

It remains unclear when the White House plans to nominate a new national cyber director. ONCD did not immediately respond to requests for comments. 

CISA Director Jen Easterly told reporters last week that the cyber defense agency is "not tracking a significant impact against the civilian .gov enterprise" from the MOVEit breach.

"Although we are very concerned about this campaign and working on it with urgency, this is not a campaign like SolarWinds, that presents a systemic risk to our national security or our nation's networks," Easterly said.