Congress to grill Homeland Security on cyberweaknesses
12580
Blog: A congressional panel has been investigating how the agency handles threats to its own network. On Wednesday, it's set to put the department's top tech official on the spot.
182934
Jerry Archer asks whether Congress has the stomach to tackle big problems looming in cyberspace.
126900
(InfoWorld) - The U.S. Department of Homeland Security will host a invite-only conference two months from now that will bring together security experts from law enforcement, Internet service providers, and the technology industry. The Internet Security Operations and Intelligence (ISOI) workshop will be held on August 27 and 28 at the Academy for Educational Development in Washington D.C. It is expected to draw about 240 participants who will engage in a frank discussion of the latest trends in cybercrime, said Gadi Evron, a security evangelist with Beyond Security who is one of the event's planners. "It's an organized group of volunteers from all across the industry, governments, and services," he said via instant message. "All trusted people, all people who do something extra than their job... We respond to international threats and mitigate them, and establish global cooperation across borders daily." The conference will be hosted by the U.S. Computer Emergency Response Team, part of the Department of Homeland Security. This group has met previously in hush-hush events hosted on the campuses of Microsoft and Cisco Systems, and has helped in the response to a number of cyber-crime incidents including the denial of service attacks in Estonia and the recent compromise of Miami's Dolphin Stadium Web site, whichÂ was hackedÂ just days before the stadium played host to the National Football League's Super Bowl game. Because the conference is attended by a pre-screened audience (the press is not invited, thank you very much), presenters at the ISOI workshops offer a deeper level of technical detail than at other events, said Dan Hubbard, vice president of security research with Websense, who is presenting in August. "It really helps communicate the struggles on both sides of the coin." Hubbard will be discussing a new tool he has developed for detecting infections of social networking Web sites, called HoneyJax. Similar to a "honeypot" computer, which is designed to lure cyber-attackers, HoneyJax "allows you to track exploits in the Web 2.0 world and helps assist in the identification of misuse of these technologies" Hubbard said. Other scheduled talks will cover topics such as theÂ Estonian cyber-attacks, the use of Web-based mail for spam, and "Phishing and the IRS." Speakers will be from organizations such as Cisco, AOL, McAfee, the U.S. Department of the Treasury, and the Computer Emergency Response Team of Estonia. The workshops attract a "pretty good spread of people," said Exploit Prevention Labs Chief Technology Officer Roger Thompson, another presenter. "It's really just a forum for security professionals in different disciplines to get together and talk over a beer." Â
527998
U.S. lawmakers opened their own  investigation on Thursday of the cybersex scandal involving a  Republican congressman who sent lewd messages to young aides,  and will interview dozens of officials just weeks before the  November 7 elections, imperiling Republican control of  Congress.
521878
House of Representatives panel chairman says peer-to-peer networks pose a "national security threat," new laws needed.
210327
Better communication systems, improved rail security and more rigorous oversight are high on the list of homeland security issues Democrats plan to examine when they assume control of Congress in January.
712980
(InfoWorld) - The U.S. Congress can help protect residents against identity theft by passing a data breach notification bill that would also require companies to use reasonable security practices, officials from cybersecurity vendor Symantec said Tuesday. Robert Clyde, Symantec's vice president of technology, called on Congress to pass a data breach notification bill that would require organizations to report data breaches when there's a reasonable risk of identity theft. U.S. lawmakers introduced about a dozen bills requiring data breach notification after a series of breaches in early 2005, but legislation stalled largely over committee jurisdictional squabbles. About 30 states have passed breach notification laws, most of them since 2005. U.S. lawmakers have introduced four data breach notification bills since January. Private companies want one standard they can follow instead of dozens, Clyde said. "Having every state do their own data breach law ... starts to get out of control real quick," he said. "You put a huge burden on companies." In the last couple of years, Symantec has seen a change in cyber attacks, prompting the need for legislation. Gone are the days when attackers created viruses or worms simply for bragging rights; now, the majority of cyberattacks are targeted at stealing money, Clyde said. In many cases, the attacks are done with stealth in mind, with the criminals hoping to milk credit card accounts for months, he said. Often, ID thieves will take $5 or $10 from a credit card account every month, and most people won't notice the small charges, Clyde added. "The motive [of hackers] has changed from show-off to taking money," Clyde said during a briefing in Washington, D.C. Symantec called on Congress to pass a data breach bill that would include language requiring organizations to deploy standard security protections. "We'd like to see legislation be more proactive," said Tiffany Olson Jones, senior regional manager for North and Latin American government relations at Symantec. Part of the problem with passing a bill last year is that some of the legislation became too expansive and included several privacy measures, Clyde said. A simple data breach bill that focuses only on security breaches should have the best chance of passage, he said. Symantec endorsed the Data Accountability and Trust Act, introduced earlier this month by Representatives Bobby Rush, an Illinois Democrat, and Cliff Stearns, a Florida Republican. The bill, in addition to requiring breach notifications to affected customers, would authorize the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. Symantec also called on Congress to pass an antispyware bill. Several ways that spyware steals information, such as keystroke logging, isn't expressly prohibited in other cybersecurity laws, Clyde said.
427228
(InfoWorld) - SAN FRANCISCO -- U.S. companies and the federal government need to step up and fix the problems in their computer networks, the nation's new cybersecurity czar told attendees during his first-ever address atÂ RSA ConferenceÂ here on Thursday. Within the next 10 years, the majority of the world's communication needs will probably be handled by the Internet, said Gregory Garcia, the assistant secretary for cybersecurity and telecommunications at the U.S. Department of Homeland Security (DHS). "This proliferation of applications and devices within the converged network is going to create a breeding ground for security problems," he said. "Our networks and our systems are vulnerable and they are exposed." Garcia outlined two priorities for the year ahead. First, his office is working with federal agencies to adopt common security policies and practices. Second, he plans to work with the private sector to push forward a process called the National Infrastructure Protection Plan. This effort is intended to evaluate computer security risks on an industry-by-industry basis and outline the steps that need to be taken to address them. The broad strokes of this plan were outlined last June, and the DHS is now working with industry to flesh out sector-specific plans, Garcia said. He made it clear that the DHS expects U.S. companies to participate. "There are a lot of plans in Washington. This one is going to stick," he said. "The private sector owns and operates 90 percent of the critical infrastructure, and it's up to you all, not just the DHS, to secure this infrastructure." Companies looking for best practices already have a number of standards they can consider, Garcia said, pointing to the International Organization for Standardization (ISO) 17799 specification and the guidelines prescribed by Technet, an IT industry association. Computer security has not been a top priority at the DHS, which has paid far more attention to physical security threats to the nation since its inception in 2003. And though DHS Secretary Michael Chertoff tried to put a sharper focus on computer security by creating Garcia's high-level post in 2005, the position remained vacant for more than a year. Garcia was introduced Thursday by Art Coviello, president of EMC's RSA group, who said afterward that he was encouraged by the assistant secretary's speech. "It's a combination of carrot and stick," he said in an interview. "Chiding industry to actually comply with these standards that are out there, and a veiled threat of regulation to get things done." Coviello said that cybersecurity has "languished a bit" within DHS ever since U.S. President George W. Bush signed off on his administration's comprehensive cybersecurity plan in 2003. "The Department and Secretary [Tom] Ridge and Secretary Chertoff obviously focused on the right things -- physical threats -- but now it's time to get after the critical infrastructure from the cyber side," Coviello said in the interview. "I don't think industry is looking for a lot of regulation from government," he added. "What they are looking for is leadership."
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."
497924
Congresswoman Zoe Lofgren says bureaucratic miscues continue to hamstring serious government action to combat cyberattacks.
390115
Congress weighs a bill to restrict cooperation between U.S. companies and digital dictatorships.
65869
If a concerted cyberattack is coupled with a physical attack, will the system hold up? VeriSign CEO Stratton Sclavos talks about what's being done to prepare.
662835
House Homeland Security Committee chairman, Rep. Bennie Thompson (D-Mississippi), says hacks, virus outbreaks and other computer security problems undermine the government's efforts to encourage companies and private organizations to improve cyber security.
504911
The chairman of the House Committee on Homeland Security today questioned the legal basis of a new Bush administration plan to expand domestic law enforcement agencies' access to powerful satellite and aircraft sensor surveillance technology, contending that the administration has failed to build in...
494343
The U.S. Department of Homeland Security is planning a large-scale test of the nation's response to a cyberattack, to be held in early 2008.
376513
The Department of Homeland Security plans to collocate private-sector and government security experts at a US-CERT facility in an effort to better predict and prepare for cyberattacks.
587220
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.The Center for Strategic and International Studies ( CSIS ) wants the commission to come up with a list of recommendations that the new president who takes office in January 2009 &quot;can pick up and run with right away,&quot; said James Lewis, director of the CSIS Technology and Public Policy Program. The commission, made up of 32 cybersecurity experts, plans to finish its work by the end of 2008.Co-chairmen of the commission are retired Admiral Bobby Inman, former director of the U.S. National Security Agency; Scott Charney, corporate vice president for trustworthy computing at Microsoft; U.S. Representative Jim Langevin, a Rhode Island Democrat and chairman of the Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology; and Representative Michael McCaul of Texas, the ranking Republican on the subcommittee.Cyberthreats against the U.S.&#160;are growing, and it&#39;s&#160;important for Congress and the next president to take action, Langevin said. In the past year, his committee has investigated hundreds of cyberbreaches within the U.S. government.Langevin remains concerned about U.S. government networks, he said. The U.S. Department of Homeland Security reported 844 cybersecurity incidents in fiscal years 2005 and 2006, he noted.When the lead agency for protecting the U.S. against cyberattacks has hundreds of vulnerabilities, &quot;we&#39;ve clearly reached an unacceptable situation,&quot; Langevin said.The commission will expect action on its recommendations, added McCaul. He promised to push the recommendations in the cybersecurity subcommittee.&quot;The time is now for action,&quot; he said. &quot;For any [presidential] administration, it&#39;d be unwise to ignore that.&quot;Among the members of the committee are three former cybersecurity directors at the White House Office of Management and Budget; former Federal Trade Commission member Orson Swindle; former DHS assistant secretary for cybersecurity Amit Yoran; former head of the U.S. Department of Justice computer crimes division Marty Stansell-Gamm; and executives with Oracle, EMC, Internet Security Systems, and Verizon Communications.