Lack of Leadership Hampers Cybersecurity Efforts, Say Critics
22718
The failure to appoint an assistant secretary for cybersecurity and incomplete planning are raising questions about how well prepared the Department of Homeland Security is for a cyberattack directed against the nation's critical infrastructure.
427228
(InfoWorld) - SAN FRANCISCO -- U.S. companies and the federal government need to step up and fix the problems in their computer networks, the nation's new cybersecurity czar told attendees during his first-ever address atÂ RSA ConferenceÂ here on Thursday. Within the next 10 years, the majority of the world's communication needs will probably be handled by the Internet, said Gregory Garcia, the assistant secretary for cybersecurity and telecommunications at the U.S. Department of Homeland Security (DHS). "This proliferation of applications and devices within the converged network is going to create a breeding ground for security problems," he said. "Our networks and our systems are vulnerable and they are exposed." Garcia outlined two priorities for the year ahead. First, his office is working with federal agencies to adopt common security policies and practices. Second, he plans to work with the private sector to push forward a process called the National Infrastructure Protection Plan. This effort is intended to evaluate computer security risks on an industry-by-industry basis and outline the steps that need to be taken to address them. The broad strokes of this plan were outlined last June, and the DHS is now working with industry to flesh out sector-specific plans, Garcia said. He made it clear that the DHS expects U.S. companies to participate. "There are a lot of plans in Washington. This one is going to stick," he said. "The private sector owns and operates 90 percent of the critical infrastructure, and it's up to you all, not just the DHS, to secure this infrastructure." Companies looking for best practices already have a number of standards they can consider, Garcia said, pointing to the International Organization for Standardization (ISO) 17799 specification and the guidelines prescribed by Technet, an IT industry association. Computer security has not been a top priority at the DHS, which has paid far more attention to physical security threats to the nation since its inception in 2003. And though DHS Secretary Michael Chertoff tried to put a sharper focus on computer security by creating Garcia's high-level post in 2005, the position remained vacant for more than a year. Garcia was introduced Thursday by Art Coviello, president of EMC's RSA group, who said afterward that he was encouraged by the assistant secretary's speech. "It's a combination of carrot and stick," he said in an interview. "Chiding industry to actually comply with these standards that are out there, and a veiled threat of regulation to get things done." Coviello said that cybersecurity has "languished a bit" within DHS ever since U.S. President George W. Bush signed off on his administration's comprehensive cybersecurity plan in 2003. "The Department and Secretary [Tom] Ridge and Secretary Chertoff obviously focused on the right things -- physical threats -- but now it's time to get after the critical infrastructure from the cyber side," Coviello said in the interview. "I don't think industry is looking for a lot of regulation from government," he added. "What they are looking for is leadership."
80628
Cybercriminals do not stockpile exploits, then time their release to do the most damage, security researcher says.
427903
An increasingly networked infrastructure and a paucity of laws defining cybercrime could lead to disaster in Russia if terrorists such as Chechen separatists started turning their attention to electronic warfare, says one security expert there.
69867
Putting a stop to the cyberbullies is not going to be easy, says columnist Bill Thompson.
595194
The most vexing weakness in computer security is not in the hardware or the software, it is in the people who use the machines, according to top hackers and cyber safety specialists.
731985
The US government is not taking cybersecurity seriously enough and should spend more money and energy on the topic, a group of computer security firms said Tuesday.
130581
The cybersecurity efforts of the Federal Energy Regulatory Commission in some situations do not meet federal guidelines -- leaving the agency vulnerable to cyberattacks, according to the Energy Department's Inspector General.
576766
The GAO's Gregory Wilshusen says that government agencies aren't doing as good a job with security as they think they are -- particularly in areas such as access control and configuration management.
134112
Computer-security experts, including  former government officials, urged the George W. Bush  administration on Tuesday to devote more effort to  strengthening defenses against viruses, hackers and other  online threats.
596445
(InfoWorld) - The U.S. Department of Homeland Security (DHS) has failed to take several basic steps to protect the nation's cyber infrastructure, including a year-plus delay in naming an assistant secretary for cybersecurity, lawmakers and other critics said Wednesday. Lawmakers and representatives of cybersecurity trade groups questioned why the DHS has failed to fill the high-level cybersecurity position after DHS Secretary Michael Chertoff announced plans to create the position in July 2005. The delay in hiring an assistant secretary shows a "lack of cybersecurity leadership" at the DHS, said Representative John Dingell, a Michigan Democrat, during a congressional hearing. But DHS is working hard to hire an assistant secretary for cybersecurity, and the agency has continued to make significant progress in improving cybersecurity in the past year, George Foresman, the DHS under secretary for preparedness, told the House of Representatives Subcommittee on Telecommunications and the Internet. He spends about a quarter of his time working on cybersecurity issues, while Andy Purdy, acting director of the DHS National Cyber Security Division, spends about three quarters of his time on cybersecurity issues, Foresman said. Some potential candidates for the job have withdrawn their applications because of private work commitments, Foresman said. Still, the agency may be close to naming an assistant secretary, he said. "Had we been inactive the whole time, I think there'd be grave concern," Foresman said. "But I think we've been in overdrive." Some lawmakers and witnesses seemed to disagree. Representative Anna Eshoo, a California Democrat, said the lack of a top cybersecurity leader at DHS means the issue is not a top priority. "Simply put, we're putting ourselves in a real ditch here," she said. Congress may have to get involved in the assistant secretary's hiring, said David Powner, director of IT management issues at the U.S. Government Accountability Office (GAO), which has criticized the DHS cybersecurity effort in a series of reports. "If they can't figure it out soon, perhaps you can help them," Powner told lawmakers. A June report from GAO found that the DHS had not yet completed a plan involving public and private resources for recovery of the Internet after a major cyberattack, added Representative Ed Markey, a Massachusetts Democrat. Paul Kurtz, executive director of the Cyber Security Industry Alliance (CSIA) trade group, called on Congress to pass data breach legislation awaiting a vote on the House floor. CSIA also recommended that Congress better define the roles government agencies such as the DHS and the Department of Defense should play after a major cyberattack. "There is little strategic direction or leadership from the federal government in the area of information security," Kurtz said. "We must move beyond philosophy and statements of aspirations to defining priorities and programs." The U.S. government has the responsibility of setting priorities and coordinating response to cyberattacks, he added. "Let me be clear -- this is not a call for regulation or intervention," he said. "This is a call for leadership."
596489
Symantec says U.S. agencies need to better protect their cyber assets, echoing concerns raised last year by U.S. Government Accountability Office.
762970
A cybersecurity standard proposed for the U.S. would leave critical gaps in system safety, and one congressman warned Wednesday that if issues are not addressed in short order, "the future isn't going to be pretty" for the nation's infrastructure.
741713
Attack largely unsuccessful, but security experts warn of more to come.
317595
The US government is falling short in cybersecurity efforts and should take immediate steps to protect the country's technological resources, an industry group said.
657998
While IT employment numbers may be lagging, there is a glimmer of hope. The number of cybersecurity professionals is projected to grow at an annual compound rate of nearly 14 percent from now until 2008, according to a study released in November.
404305
(InfoWorld) - Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday. David Longhurst, who retired this week, called for businesses and governments to take a risk-based approach to cybersecurity by balancing the advantages of new applications and capabilities with the security risks. Too often, Longhurst found himself between the U.K. military, which wanted new networked capabilities, and in-house cybersecurity experts, who wanted no new networking functionality, he said during Microsoft Corp.'s Security Summit East in Washington, D.C. "IT security folks don't want to connect anything," he said. "They believe safe sex is no sex." Longhurst didn't downplay cybersecurity risks as he spoke to a crowd of developers and network security administrators. Protecting the global information infrastructure is one of the top -- if not the top -- challenges for governments, developers and infrastructure providers, he said. It's difficult to fully assess the magnitude of the threat, he said, with IT security experts often saying, "We just have to tell you, it's bad." But as security threats continue to be a large problem, IT users are demanding increased functionality that supports their business, is easy to use, is reliable and safe, and "makes the coffee in the morning," he said. Maybe users don't want their computers to make coffee, but IT security professionals can face demands from users who want to access sensitive data from Internet cafes in Beijing, he said. "They say, 'I'd like to connect to anybody, anywhere, access anything for practically any purpose, at any time,'" Longhurst said. "You could do all this ... if we didn't have a Wild West out there." Longhurst called on everyone in the IT chain, including developers, integrators and users, to give cybersecurity a higher priority. But he also advised companies and government agencies to weigh the risks of new technology with the benefits to themselves or their customers. "This is a risk-based business," he said. "There are no absolutes in this." To fully access risk, businesses and government agencies need to hear from IT security experts, from those wanting the new functionality and from engineers who estimate how long any identified problems will take to fix. In some cases, the U.K. government has rolled out new technology even with security concerns, but set a deadline for fixing any problems, he said. Earlier, George Stathakopoulos, Microsoft's general manager for product security, said the company continues to push security in its upcoming Windows Vista OS. Vista will include several security features, including support for smart-card access to computers, and the Windows Defender scanning tool, he said. Stathakopoulos called on governments and courts to increase penalties against attackers who are caught. "Right now, you write a Sasser [worm] and get a two-year suspended sentence," he said, referring to a 2005 conviction in Germany. "You may even get a security job."