DHS head: Cybersecurity remains a concern
100547
Fixing cybersecurity problems in the U.S. is a top priority at the U.S. Department of Homeland Security, said the agency's leader, but lawmakers didn't focus on the issue during a hearing in Congress Wednesday.
57499
(InfoWorld) - Officials from the U.S. Department of Homeland Security will hold a hearing on Capitol Hill on June 20 to discuss the findings of an investigation into the agency's own problems in battling electronic attacks and IT systems intrusions. In a hearing labeled "Hacking the Homeland: Investigating Cyber-security Vulnerabilities at the Department of Homeland Security," officials including DHS chief information officer Scott Charbo and Gregory Wilshusen, director of information security issues at the Government Accountability Office (GAO) are scheduled to detail their findings in response to requests from Congress to test the agency's IT security defenses. In a letter sent to Charbo on April 30, members of Congress led by Rep. Bennie G. Thompson (D-Miss.), chairman of the House Committee on Homeland Security, asked DHS to conduct a review of its information system security in the wake of news that the departments of commerce and state were successfully hacked during 2006. Details of those systems intrusions were first revealed at a hearing coordinated by the House Subcommittee on Emerging Threats, Cyber-security, Science, and Technology on April 19. "These incidents jeopardize the integrity of our government's information. We are concerned that similar incidents may be occurring within the networks of the Department of Homeland Security," read the letter, which was also signed by ranking members of the House Subcommittee on Management, Investigations, and Oversight. Among the issues expected to be addressed by Charbo and other witnesses -- including Keith A. Rhodes, director for the Center for Technology and Engineering in the GAO -- at next week's hearing will be a review of cybersecurity incidents reported to the DHS Security Operations Center (SOC), such as instances of rootkits, classified leaks, compromised Web sites, bot infections, unauthorized use of networks by contractors, and virus attacks. According to a Congressional press release distributed ahead of the hearing, the GAO witnesses will also describe an investigation they conducted on a specific DHS network that is "riddled with significant information security control weaknesses that place sensitive and personally identifiable information at increased risk of unauthorized disclosure." The subcommittee also plans to air some of its concerns with the DHS OneNet project, which is aimed at consolidating all of the agency's information networks under one roof, and to question a perceived lack of IT security funding by Charbo. The Congressional committee has said it will call for further investigation of security issues existing within DHS at the hearing. Among the specific questions posed to DHS leaders by Thompson and other members of the House Committee on Homeland Security are what responsibility Charbo has over management of the agency's networks, and his relationship with the department's chief information security officers (CISOs) and chief information officers. Charbo was also asked to provide details of the agency's information security policies and incident response plans, along with data on how many and what types of security events it has reported to the U.S. Computer Emergency Readiness Team (US-CERT), which was established in 2003 and operates as a partnership between DHS and the public and private sectors. Among the incidents that Congress has specifically asked for more information about are the most severe threats encountered by the agency between 2004 and 2007. The committee has also asked DHS officials to reveal whether or not they have taken an inventory of each access point on the agency's network, and how it has approached the practice of penetration testing for its internal and external systems. In addition to questioning the department's security testing policies, the committee has asked DHS to turn over details of any secure software coding initiatives it has launched in the name of eliminating vulnerabilities in its applications, as well as statistics on how much of its coding is being performed by outside contractors. The committee has also asked for information on whether or not DHS is requiring two-factor IT systems authentication for all privileged personnel and systems administrators. A good deal of discussion at the hearing is likely to be given over to the process that DHS has employed to meet the terms of the Federal Information Security Management Act (FISMA), which was enacted by Congress in 2002 and is aimed at improving IT security in the federal space via a system of mandated annual audits. The hearing may be seen as a bellwether moment in the continued development of government IT security policies and enforcement, as the DHS has been charged with helping to oversee the performance of other agencies, including via its work with US-CERT. If the DHS is found to have failed to protect its own systems adequately, some observers believe that the agency will be put under significant pressure to completely retrench its IT operations in the name of improving security, a process that may then be pushed out to other federal agencies. Some experts believe that adopting such an approach will soon become a fact of life for all government agencies, as many legacy computer systems and policies are not suited to respond to today's fierce security climate. Dave Nelson, a retired deputy CIO for IT security at NASA, who also worked in the White House Office of Scientific Research, said that the government, much like enterprise businesses, has been put in the uncomfortable position of coping with security threats in a cat-and-mouse game, based on long-standing flaws in the technologies and processes it employs. "Until the Internet and the computers that are on it are fundamentally reengineered to be inherently secure, we will always be in coping mode," Nelson said. "The government and IT industry may not know how to make these types of technologies yet, but if they don't get cracking, things will only get worse; as the economic and political payoff of attacks continues to rise, that's our only choice." While Nelson said he has not been made privy to information on attacks on government IT infrastructure for several years, he estimates that there are still many breaches, and that the sophistication of the attacks is ramping up quickly. One of the specific areas that Nelson said needs to be investigated more closely is to what extent foreign governments or politically motivated groups such as terrorists may be involved in cyberthreats. "We don't have any public information that would conclusively prove that some of these attacks are being launched by other nations, but there seem to be significant resources behind them in terms of people and financing," Nelson said. "That's the scariest part, and extrapolating that idea into the future, I don't see a lot of encouraging signs for improvement. If you look at the zero day attacks, they only seem to be getting worse, and I don't see evidence that the systems vulnerabilities they target are going away anytime soon."
144667
The technology industry stands behind its call for an assistant secretary for cybersecurity in the Homeland Security Department, even as confusion grows over what the department is planning.
598708
com September 20, 2004, 12:05 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
366031
Quick and determined action RSA The US's latest chief of cyber security has pledged quick and determined action to protect the nation's critical infrastructure from attack.â¦
732951
Weaknesses in the Energy Departmentâs cybersecurity allowed hackers to successfully penetrate its systems 199 times last year in intrusions that affected 3,531 systems, the departmentâs inspector general said.
567396
Government agencies need to better protect themselves against cybersecurity problems after congressional hearings and reports exposed weaknesses in 2007.
402450
(InfoWorld) - As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy. Last week, Paller was at it again, joining Eric Byres, Director of Industrial Cyber Security at Symantec to talk about cyberattacks on SCADA (supervisory control and data acquisition) systems that manage the nationâs critical infrastructure. Ahead of that event, Paller told InfoWorld Senior Editor Paul Roberts that SCADA hacks have already happened and that on the five-year anniversary of the Sept. 11, 2001, terrorist attacks, the U.S. gets an âFâÂ  for protecting its computers from hackers, terrorist or otherwise. InfoWorld: Weâve been hearing about the threat of terrorist cyberattacks for years. Is the threat for real? Alan Paller: It is a real threat, but itâs an interesting threat. What you have happening today is that terrorists are using cybercrime to get the money to buy the bombs to blow people up. But theyâre not using cyberattacks against physical things. There have been two cases that are very secret where SCADA systems that run power plants were taken over, but the crime was about extortion -- you know, âIf you donât pay us weâre going to do something bad.âÂ  In some cases the guys have proven that they can do damage by running a test denial of service attack, or a test outage. IW: Conventional wisdom was that SCADA systems are too old and idiosyncratic to be easy targets. What has changed? AP: The difference is that companies have added Windows systems to replace unknown operating systems, and then connected them to their networks, which are connected to the Internet. GAO did a great report on this back in 2004. Most of the attacks we hear about arenât aimed at SCADA systems, theyâre aimed at corporate networks, but once youâre on the network you can get into these (SCADA) systems. IW: Why should enterprise IT people care about the security of SCADA systems? AP: The big shock to us was all the places where control systems are used. NIST [National Institute of Standards and Technology] did a study that found SCADA systems were common in the electric, water, oil and gas, chemical, pharmaceutical, pulp and paper, food and beverage, discrete manufacturing, durable goods, air and rail transportation, mining and metallurgy industries. So tell me whatâs not covered there. Almost anyone who works in a major industry has this stuff on their plate.Â  IW: Is there any evidence that foreign governments are privy to information on how to attack SCADA systems in the U.S.? AP: Well, you have the statement Gen. Lord gave that the military has lost terabytes of sensitive information to the Chinese government. [Editorâs Note: Maj. Gen. William Lord told GCN in August that âChina has downloaded 10 to 20TB of data from NIPRNet, the DoDâs Non-Classified IP Router Network.â] That was the first public âoopsâ that weâve heard. It was an admission at the highest level that weâve spent all this money and systematically the Chinese have been able to come in and steal this information. IW: Recently, an article in Foreign Affairs criticized the U.S. government for playing defense on cybersecurity and missing the way terrorists are using the Internet to organize and raise money. Is that fair? AP: Youâre giving [the government] too much credit for having an active defense. They donât have an active defense. What they have is a lot of reports that have been written. Just one consulting firm increased their staff writing (cybersecurity) reports from four people to 200 in the last five years. As one chief of staff told me, the best thing to do with those reports is to pile them in front of our buildings so the terrorists canât use a car bomb to get us. IW: If you had to give the U.S. government a grade on cybersecurity, what would it be? AP: It would have to be an F. I mean, if you canât secure the boxes that you have, that would have to be an F.
6545
Computer-security experts, including former government officials, urged the Bush administration on Tuesday to devote more effort to strengthening defenses against viruses, hackers and other online threats.
25268
National intelligence director Mike McConnell said Tuesday that U.S. authorities are worried about "sleeper cells" of would-be terrorists inside the United States and are remaining vigilant against any new attacks.
634559
Computer systems running health, energy and other services remain vulnerable to attack, say MPs.
596942
The official leading the US overhaul of border security stressed Tuesday that Washington was still welcoming foreigners despite a new program to track &quot;biometric&quot; data of all visitors to the United States.
212665
The United States remains safe after the attack at a Scottish airport and two foiled car bombs in London, and there is no plan to raise the terror alert level, Homeland Security Secretary Michael Chertoff said Monday.
427538
Deadline for federal agencies' policies for dealing with data breaches approaches and it's not yet clear whether everyone will be done in time.
639860
WASHINGTON - The head of cybersecurity efforts at the U.S. Department of Homeland Security (DHS) has reportedly resigned this week, leaving his job after giving a one-day notice.
654323
Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday.
369317
Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the U.S. Department of Homeland Security (DHS).