U.S. Cyber Security Framework Is Good News-For Hackers

Ralph Langner, a leading industrial control systems security expert, criticizes the NIST Preliminary Cybersecurity Framework draft as insufficient to improve critical infrastructure security because it relies on voluntary, risk-based standards that allow organizations to self-select implementation tiers, producing inconsistent and potentially weak outcomes; he recommends replacing voluntary frameworks with clear regulatory guidelines and mandatory requirements for critical assets.