|
Executive Orders Targeting Cybersecurity
The law has been notoriously slow to catch up to nearly every type of technology and the changes they make. This summer, executive orders 13694 and 14144 were signed in an attempt to help some systems catch up to the changes in technology.
Among the two more notable changes: AI software vulnerabilities, prompt injection, data poisoning and model theft must be folded into existing vulnerability management and incident response workflows. In other words, AI issues will now be treated similarly to other software and hardware vulnerabilities so there can be management and response to issues that arise with open-source AI and it's associated programs. A first step of sorts to providing a pathway of some sort of more formalized response, remediation, and control rather than letting bad actors just run rampant as they'd like.
Another noteworthy change in this document is that it makes it so that, starting in 2027, federal government agencies will only be allowed to purchase wireless/Internet-of-Things (IoT) devices from vendors who are participating in the US Cyber Trust Mark. Of course, things could change, but it is notable to watch since similar expectations could begin to get passed down through industry regulations, cyber insurance, etc. over time.
| 
