Cabinet panel to identify “cyber adversaries,” fix government cybers now.

Today, the Washington Post published what appears to be a draft of an executive order to be signed by President Donald Trump. The order, entitled “Strengthening US Cyber Security and Capabilities,” puts flesh on the bones of the “cyber review” promised by Trump during the campaign. It spells out who will conduct the review and what its specific goals are. The order also sets a brisk pace for the review, calling for initial recommendations for the security of “national security systems” and critical infrastructure within 60 days. The review also has a 60-day deadline to provide the president with a list of “principal cyber adversaries.”

This is not the first 60-day cyber fix-it order from the White House. After the breach at the Office of Personnel Management in 2015, the Obama administration ordered a “cyber sprint” across the Federal government to get systems into compliance with security best practices. Results were mixed. The chief information officers of OPM and the Department of Education resigned under pressure from the House Government Oversight Committee after they failed to complete a majority of the mandated tasks.

The new order’s language indicates that the Trump administration will see private network infrastructure as being the federal government’s turf to defend—but that the administration will lean heavily on the private sector to figure out how to defend it. “Federal Government has a responsibility to defend America from cyber attacks that could threaten US national interests or cause significant damage to Americans’ personal or economic security,” the draft order states. “That responsibility extends to protecting both privately and publicly operated critical networks and infrastructure. At the same time, the need for dynamism, flexibility, and innovation in cyber security demands that the government exercise its responsibility in close cooperation with private sector entities.”

The administration’s “Review of Cyber Vulnerabilities” will be led by Defense Secretary James Mattis. He will “co-chair” the review with Secretary of Homeland Security John F. Kelly, the Director of National Intelligence (Sen. Dan Coates, after his confirmation), national security advisor Michael Flynn, and homeland security and terrorism advisor Thomas Bossert. The Vulnerabilities Review committee will have 60 days to “assemble all information in possession of the Federal Government that pertains to the most urgent vulnerabilities to national security systems... civilian government networks, and the most critical private sector infrastructure”—and then deliver initial recommendations on how to fix them to President Trump.

Within 100 days, the report calls for an assessment based on threats and vulnerabilities of the new capabilities required by the government, as well as recommendations on how to “incentivize private sector adoption of effective cyber security measures.”

The draft has yet to be confirmed by the White House as genuine. But aside from its breakneck pace (for a government review), some in the security industry have given tentative approval of the order. “It's a good sign that in its first week, the new Administration is immediately focusing on how we can better manage and secure our government's networks and connected devices,” David Damato, chief security officer at Tanium, told Ars in an e-mail. “This type of review has long been needed, as many government agencies do not even know how many endpoints are on their network, making it impossible to manage or secure them.”