Experts want more government focus on cybersecurity
358672
DECEMBER 07, 2004 (REUTERS) - Computer security experts, including former government officials, urged the Bush administration today to devote more effort to strengthening defenses against viruses, hackers and other online threats.
701156
The department must do more to lower the risk of cyberattacks against its IT systems and networks, an internal report says. By George V. Hulme.
606141
A more joined-up approach to net safety is needed if government is to get the message home to citizens.
206983
U.S. government agencies need to take additional steps to protect against cybersecurity problems after a series of congressional hearings and reports exposed several weaknesses in 2007, representatives of Symantec said.The government sector, including state and local governments, accounted for 26 percent of data breaches that could lead to identity theft in the first half of 2007, according to Symantec&#39;s latest Government Internet Security Threat Report, published in September. The U.S. Government Accountability Office (GAO)&#160;also issued about a dozen reports in the last six months criticizing federal agencies for not fully implementing GAO&#39;s cybersecurity recommendations, noted Jim Russell, Symantec&#39;s vice president for the public sector.In addition, the House of Representatives Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology hosted a series of hearings in 2007 focused on cybersecurity lapses at several government agencies, including the Department of Homeland Security and the State Department.&quot;You look at that, and you say, &#39;Why does that happen?&#39;&quot; Russell said.While U.S. agencies have a set of cybersecurity rules set out in the Federal Information Security Management Act of 2002 (FISMA), agencies aren&#39;t held accountable when they have breaches, Russell said. Agencies don&#39;t lose funding from Congress after cybersecurity incidents, he said.The federal cybersecurity rules don&#39;t have &quot;a whole lot of teeth,&quot; he added.The good news is that agencies can take more steps to fix problems, Russell said. The first step is to inventory their IT assets, a job several agencies haven&#39;t accomplished. That&#39;s not always easy, Russell said.&quot;Let&#39;s say I&#39;m an agency CIO,&quot; he added. &quot;My challenge is that my environment is so dynamic with the home workforce and telecommuting. I can see why it&#39;s a challenge to see what all the assets out there are.&quot;Russell also called on agencies to develop comprehensive cybersecurity plans, to do systematic vulnerability testing, and to have a data backup plan and back up frequently.Symantec expects that cybersecurity issues will come before Congress in 2008, particularly federal agency cybersecurity practices, said Kevin Richards, Symantec&#39;s federal government relations manager. This could be &quot;the year for information security for our federal agencies,&quot; he said.In December, Representative William Lacy Clay, a Missouri Democrat, introduced the Federal Agency Data Protection Act, which would require U.S. agencies to implement wireless data security measures. The bill would also require each U.S. agency to draft a plan to protect itself against the dangers of peer-to-peer file-trading networks, and it would give the director of the White House Office of Management and Budget new authority to establish information security policies.Clay&#39;s bill would write into law many OMB recommendations, Richards said. &quot;I always make the point that these are recommendations, and it&#39;s important to codify them,&quot; he said. &quot;It seems like our federal government IT security strategy is very reactionary and not proactive.&quot;That bill comes in addition to Federal Agency Data Breach Protection Act, which would require that federal agencies notify constituents whose data is lost or stolen. That bill, introduced last May, is sponsored by Representative Tom Davis, a Virginia Republican, in the House, and Senator Norm Coleman, a Minnesota Republican.Bills that would require private companies to notify customers when their personal information is stolen or lost seem to have stalled in Congress. But there still seems to be interest from lawmakers in agency cybersecurity and breach notification, Richards said. The hearings and information requests from Davis and other lawmakers are bringing to light multiple attacks and breaches at agencies, he said.&quot;There&#39;s no real mechanism requiring agencies to report breaches,&quot; Richards added. &quot;Now, [lawmakers] are dedicating more resources and giving better direction.&quot;
277157
A group representing technology industry executives yesterday called on the Bush administration to step up efforts to protect the nation&#39;s computer and Internet infrastructure, and it proposed
644368
New cybersecurity standards proposed by the North American Electric Reliability Corp. (NERC) to protect the nation's power infrastructure are not broad enough and fail to cover a significant number of interdependent assets.The standards also give electric utility owners, operators and users too much discretion when it comes to implementing the prescribed controls, a group of experts told members of the House Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology on Wednesday.James Langevin (D-R.I.), chairman of the committee, said the NERC's proposed standards require stakeholders in the power grid to establish plans, protocols, and controls for safeguarding physical and electronic access to the control systems that manage the national's electric infrastructure.The problem is the standards are focused purely on the reliability of "bulk power systems" and don't require electric sector owners and operators to secure their generation systems, distribution systems, or telecommunication equipment, Langevin said in prepared testimony."We know from countless real-world examples that these units are highly vulnerable to intentional and unintentional cyber-events. Knocking any of these units off could affect the power supply to our nation's critical infrastructure," he noted in his statement.The narrow focus of NERC's proposed cybersecurity standards is especially troubling, Langevin said, in light of a recent simulated attack against a power utility control system that was carried out by Department of Homeland Security researchers at the Idaho National Laboratory. The same methods that were used in that experiment could be used to carry out attacks against larger generators and other equipment and cause "widespread and long-term damage to the electric infrastructure," he warned."I'll be blunt: If this administration doesn't recognize and prioritize these problems soon, the future isn't going to be pretty," Langevin said.Joseph Weiss, managing partner of Applied Control Solutions, testified as an expert at the hearing. He said the growing interconnectedness of control systems with other networked computing systems is happening without a corresponding appreciation for the security risks resulting from such connectivity.For the most part, he stated in written testimony submitted to the committee, security issues have been the purview of the IT organizations within utility companies, whose control system groups manage grid and plant operations. As a result, it's often the case that some parts of the system are sensitized to security while others do not fully appreciate the risks, he said.Exacerbating this issue is the fact that many control system applications run in Windows and Unix environments and are therefore susceptible to the same security threats as other systems are. Traditional IT security controls, Weiss said, can help alleviate some of these issues, but they can also cause control system reliability problems.Against this backdrop, he said in his prepared remarks, the NERC's proposed standards are too narrowly focused on bulk power grid reliability, and not, for instance, on smaller substations that might support a major oil or gas pipeline in a remote locale. Similarly, there's not much priority given to securing the continuity of electricity to facilities such as municipal waterworks, manufacturing plants, refineries, hospitals and military installations.Experience has already shown the significant impact that an attack or a security incident against a control system can have on the electricity infrastructure, said Gregory Wilshusen, director of information security issues at the Government Accountability Office. Wilshusen provided written testimony to the committee.As examples, he cited a 2006 incident in which a foreign hacker planted malicious software capable of affecting a water treatment plant's operations, and another incident in which excessive traffic in a nuclear power plant's control system caused two circulation pumps to fail -- forcing the unit to be shut down manually.David Whiteley, executive vice president of the NERC, said that the security issues raised by the interconnectedness of the electric infrastructure and other infrastructures are important and need to be addressed. However, under its existing mandate, the NERC has the authority and responsibility for enforcing reliability standards on only the bulk power grid, not on the distribution system. Developing and enforcing standards on connected infrastructures is beyond the capability of a single body, he said.Whiteley said that in July of this year, the NERC sought comments from the Federal Energy Regulatory Commission on a proposal for approving eight CIP reliability standards. Those cybersecurity standards have been in development for several years and were developed with extensive input from industry experts.Computerworld is an InfoWorld affiliate
587220
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.The Center for Strategic and International Studies ( CSIS ) wants the commission to come up with a list of recommendations that the new president who takes office in January 2009 &quot;can pick up and run with right away,&quot; said James Lewis, director of the CSIS Technology and Public Policy Program. The commission, made up of 32 cybersecurity experts, plans to finish its work by the end of 2008.Co-chairmen of the commission are retired Admiral Bobby Inman, former director of the U.S. National Security Agency; Scott Charney, corporate vice president for trustworthy computing at Microsoft; U.S. Representative Jim Langevin, a Rhode Island Democrat and chairman of the Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology; and Representative Michael McCaul of Texas, the ranking Republican on the subcommittee.Cyberthreats against the U.S.&#160;are growing, and it&#39;s&#160;important for Congress and the next president to take action, Langevin said. In the past year, his committee has investigated hundreds of cyberbreaches within the U.S. government.Langevin remains concerned about U.S. government networks, he said. The U.S. Department of Homeland Security reported 844 cybersecurity incidents in fiscal years 2005 and 2006, he noted.When the lead agency for protecting the U.S. against cyberattacks has hundreds of vulnerabilities, &quot;we&#39;ve clearly reached an unacceptable situation,&quot; Langevin said.The commission will expect action on its recommendations, added McCaul. He promised to push the recommendations in the cybersecurity subcommittee.&quot;The time is now for action,&quot; he said. &quot;For any [presidential] administration, it&#39;d be unwise to ignore that.&quot;Among the members of the committee are three former cybersecurity directors at the White House Office of Management and Budget; former Federal Trade Commission member Orson Swindle; former DHS assistant secretary for cybersecurity Amit Yoran; former head of the U.S. Department of Justice computer crimes division Marty Stansell-Gamm; and executives with Oracle, EMC, Internet Security Systems, and Verizon Communications.
159347
Former government undersecretary William Schneider Jr. says the United States needs better identity authentication practices.
332601
The Department of Homeland Security has launched several new cybersecurity initiatives that it hopes to add to pilot projects and operational systems and that can be deployed throughout the government and the private sector.
267145
A cybersecurity group yesterday called on US President George Bush to invest more in IT issues and to make the top IT security job a bigger posting.
630811
The US has a new head of cyber security, amid concerns about the Bush administration&#39;s commitment to protecting computer networks from attack.
662835
House Homeland Security Committee chairman, Rep. Bennie Thompson (D-Mississippi), says hacks, virus outbreaks and other computer security problems undermine the government's efforts to encourage companies and private organizations to improve cyber security.
711887
Companies that provide federal agencies with network integration and payroll accounting technologies are benefiting from a government trying to bolster its defenses against terrorism, experts say. -The Washington Post
287017
(InfoWorld) - The Chinese government has denied involvement in a series of hacks carried out against IT systems at the Pentagon in June this week, but the threat of technology-driven espionage has forced the FBI to push businesses and academic institutions to better prepare for such attacks. Little publicly-available evidence exists to prove that foreign governments have backed or planned to launch attempts to steal intellectual property from U.S. corporations and researchers, but officials with the FBI claim that the problem is real and that American organizations must begin policing their operations more aggressively today to prevent valuable data from being stolen tomorrow. In October, the FBI's Counterintelligence Domain Program -- which aims to foster cooperation between the agency and private entities to help organizations identify and protect potential intelligence risks -- will mark its first year in existence. The program is already making significant steps in helping to close the gap between businesses and law enforcement to defend intellectual property from being left vulnerable to potential theft, FBI officials maintain. "In the past, we've always been reactive to this type of scenario and essentially showed up after the fact to bring resources to bear on this type of crime, but we want to be more proactive to help businesses and academic institutions protect themselves before an incident occurs," said Tom Mahlik, who serves as chief of the Domain program for the FBI. "We've always responded aggressively to traditional espionage with investigation, such as with the theft of national secrets, but those cases really represent counterintelligence failures where the secrets are already in Beijing or Moscow and where valuable new technologies or intellectual property would already be gone," he said. Counterintelligence efforts rank second on FBI Director Robert S. Mueller's current strategic agenda, sandwiched below counterterrorism work and above the fight against all forms of cyber-crime, according to Mahlik. Thus far, the Domain project has materialized primarily in the form of relationships built between the leaders of the agency's 56 individual divisions and the leading corporate entities and research groups identified by those units as organizations that control data that criminals and governments could try to get their hands on. For instance, companies handling sensitive government work -- such as defense contractors and large IT systems integrators -- have already joined in the effort, Mahlik said. The program will be expanded over time to pull more companies into the fold that are developing cutting-edge technologies and other products that are considered to give the U.S. a technological or business-related advantage. Those relationships, and training seminars held by the FBI in the name of expanding Domain, are aimed at identifying any research, information, or technologies that might be targeted by U.S. adversaries -- and to establish an ongoing information exchange among the program's members to improve protections and reduce opportunities for theft. As for the current state of involvement of foreign nation states, including large terrorist groups, in intellectual property theft, the FBI refuses to share specific examples or hard data, but Mahlik said there should be little doubt that the problem exists. "The FBI is well aware of deliberate targeted attacks that were aimed at stealing sensitive data from organizations, including NASA, the Department of Defense, and individual defense contractors," said the FBI expert. "We're still trying to deduce the magnitude of the problem, and a lot of that has to do with what we've dealt with in terms of investigating any ex-filtration of data and where it has ended up." Mahlik said that two of the most significant trends feeding the need for corporate counterintelligence are offshore outsourcing and the heavy flow of foreign engineering talent into U.S. corporations and research institutions. While it remains hard to prove that foreigners are being trained specifically with the purpose of infiltrating U.S organizations to steal valuable data, he said that the concept is very real. "This isn't about traditional spies anymore; the engineer, student, or business partner are the threat now, and these people are being given increased access to corporate secrets, intellectual property, and pre-patent research information at universities," Mahlik said. "These types of people are being actively used to ex-filtrate key pieces of information back to their homelands as there is always a race to establish a competitive advantage." Data security in a global market David Drab, principal for the Information & Content Security group at Xerox, said that companies are increasingly coming to the imaging giant looking for new ways to label sensitive information and track its flow among users in the workplace and throughout their supply chains. Before joining Xerox, Drab served at the FBI for 27 years and observed, among other things, the flow of former KGB agents in former Soviet states into criminal organizations. A good number of those intelligence experts were trained in the art of finding holders of sensitive corporate and national defense information and trying to liberate the data, he said, and many are likely employed in efforts to steal whatever plans they can sell to others for a profit today. "This is why you have Wal-Mart hiring former government intelligence officers. It's not about spying so much as it's about identifying business risk and what is occurring with competitors in the global environment," Drab said. "These companies are creating separate entities from traditional security or IT security to allow management to identify people internally who might have access to high-level information or might be targeted by competitors or foreign entities." Drab points to the 2001 indictment of two Japanese-born individuals accused of stealing research on Alzheimer's disease from the Lerner Research Institute (LRI) in Cleveland as proof of the need for enterprise counterintelligence. One of the accused researchers subsequently pled guilty to charges of misleading investigators looking into the situation, while another, who returned to Japan to work for a quasi-government agency working on Alzheimer's research, was unsuccessfully sought for extradition to the U.S. to face trial. Among the tools developed by Xerox to help trace the use of paper documents, one of the hardest data formats to track, are gloss marks and infrared stamps used to create a trail of evidence as to who might have accessed, printed and walked off with sensitive data when copies of any stolen documents are recovered. Large companies like financial services institutions have also begun speaking publicly about the problem of international cyber-theft, saying that they are already working to deal with the problem. At the Usenix Security Symposium held in Boston in August, Jerry Brady, global head of IT security at New York-based financial giant Morgan Stanley, outlined the threat of foreign attack as a current business reality. He specifically cited emerging activity in the Far East as worrisome. "Sometimes the threats are coming from the governments themselves in different parts of the world," said Brady. "The people who want to harm us drives a lot about how we think of security awareness. We do a lot of monitoring and threat intelligence to tell who our adversaries are today and who they will be tomorrow." When asked if the government has done enough to help companies like Morgan Stanley deal with the issue, Brady said that the firm's relationship with law enforcement officials has improved over the last several years, specifically around intelligence gathering regarding new threats. However, he said that companies cannot rely on the government alone to watch out for their interests overseas. "It's popular to pin this issue on the government, but we in private industry need to play an even bigger role in addressing the problem," said Brady. "Every time we go into a new country we have to do a risk assessment, every country has its own IP protections and concepts and we know that; we know the countries where ex-KGB Soviet Bloc resources have ended up, and where we need to be even more vigilant."
190508
Governments and private sector officials from around the world sought ways Thursday to jointly combat cybercrime, whose growth mirrors the phenomenal rise of the Internet's popularity.
73476
By JUAN A. LOZANO    HOUSTON  -- Businesses and government agencies must re-examine the growing threat of cyberterrorism to automated computer systems running power grids, dams and other industrial facilities, security experts said Tuesday...
687233
The U.S. government should create a body to foster the free flow of scientific knowledge and researchers from other countries while balancing the threat from enemies, an expert panel said on Thursday.