The White House's recently released National Cybersecurity Strategy addresses the increasing security threats faced by the United States and suggests a path to build collaboration and shift the burden away from individuals and small organizations to more capable ones. Security vendors are poised to contribute to the roadmap.

“We must rebalance the responsibility to defend cyberspace by shifting the burden for cybersecurity away from individuals, small businesses, and local governments, and onto the organizations that are most capable and best-positioned to reduce risks for all of us,” according to the White House document,

Gartner's recent strategic predictions supports this point, forecasting 45% of organizations worldwide will have experienced attacks on their software supply chains by 2025, a three-fold jump from 2021.

Many security vendors also applauded this strategy as a step in the right direction.

“We live in a world today where every company, government, and nonprofit is becoming a software provider in an effort to better serve their customers and constituents. Many of these organizations are still maturing in their ability to develop software and services securely. Clear national standards will be a significant step in the right direction,” Rapid7 CEO and Chairman Corey Thomas said in a statement.

The federal government seeks to build and enhance partnerships around five pillars:

1. Defending critical infrastructure
2. Disrupting and dismantling threat actors
3. Shaping market forces to drive security and resilience
4. Investing in a resilient future
5. Forging international partnerships to pursue shared goals

For critical infrastructure protection, the administration plans to drive better practices in cloud security, which is echoed by cloud security vendors’ recent push to bake security into the cloud and focus on secure access service edge (SASE).

Cato Networks Senior Director of Security Strategy Etay Maor claims SASE “supports President Biden’s notion that cloud infrastructure and cloud security cannot be separated and must be converged otherwise they are more vulnerable and complex to manage.”

To support the approach of building a security-resilient future, security vendors look to help the government and organizations to shift security left -- that is, build it in at the design phase of development.

Lacework highlighted the need to address security at the code level. “Implementing infrastructure as security both reduces the risk of security incidents in production and decreases time and effort of security remediation,” Lacework Global Field CISO Tim Chase said.

Snyk CEO Peter McKay also saw this trend of embedding security in the development cycles from the start, and said that “the new White House cyber strategy is a rallying cry for developer security. Organizations should address developer security now before rules are put in place that will impose fines and other penalties on organizations that fail to do so.”

The White House also mentioned taking coordinated and collaborative action in “developing a diverse and robust national cyber workforce” to build a resilient future.

Akamai VP Lauren Van Wazer, who was former President Obama's Assistant Director for Cybersecurity, expects this area to drive more private-public partnerships “where both industry and government are experiencing the same gaps in available personnel and skills.”

Other goals and approaches that security companies can support include cybersecurity research and development, open source and supply chain protection and security, post-quantum encryption, digital identity solutions, and international coalitions and partnerships.