Apple, Microsoft, and other leading tech firms have committed to improving US cybersecurity through initiatives that can mostly be divided into two categories: promises to educate people and donations of security-related products, the White House announced this week.
The education-focused initiatives are led by Google, IBM, Code.org, Girls Who Code, and the University of Texas System, as well as the newly rebranded NSF Advanced Technological Education National Cybersecurity Center. Microsoft is also said to be planning to “expand partnerships with community colleges and non-profits for cybersecurity training.”
The White House says Google “will help 100,000 Americans earn industry-recognized digital skills certificates” and that IBM will “train 150,000 people in cybersecurity skills over the next three years, and will partner with more than 20 Historically Black Colleges & Universities to establish Cybersecurity Leadership Centers to grow a more diverse cyber workforce.”
Apple will also reportedly “establish a new program to drive continuous security improvements throughout the technology supply chain” by pushing more than 9,000 suppliers in the US “to drive the mass adoption of multi-factor authentication, security training, vulnerability remediation, event logging, and incident response,” so they can better protect themselves from digital threats.
Some companies put their money where their mouths are. Google “will invest $10 billion over the next five years to expand zero-trust programs, help secure the software supply chain, and enhance open-source security,” and Microsoft “will invest $20 billion over the next five years to accelerate efforts to integrate cyber security by design and deliver advanced security solutions.”
The White House also says Microsoft “will immediately make available $150 million in technical services to help federal, state, and local governments with upgrading security protection.” Amazon, meanwhile, “will make available to the public at no charge the security awareness training it offers its employees.” (Oh, and give Amazon Web Services customers a physical security key.) Not that the two Washington-based companies are competing or anything.
The National Institute of Standards and Technology will also “collaborate with industry and other partners to develop a new framework to improve the security and integrity of the technology supply chain” that’s supposed to “serve as a guideline to public and private entities on how to build secure technology and assess the security of technology, including open source software.”
Being invited to contribute to this framework—or, from a less optimistic perspective, buying a seat at the table by committing a significant amount of time and money to the other initiatives—could give the participating companies a chance to influence policies that will directly affect the way they conduct their business. Keep your friends close and your regulators closer.
The White House says that the Industrial Control Systems Cybersecurity Initiative, which “has already improved the cybersecurity of more than 150 electric utilities that serve 90 million Americans,” will also expand to natural gas pipelines following the Colonial Pipeline attack from May that disrupted the 5,500-mile-long system that moves 100 million gallons of fuel a day.
