New cybersecurity chief lays out guidance
380834
Gregory Garcia, the newly appointed assistant secretary for cybersecurity and telecommunications at the Department of Homeland Security, says there are a lot of cybersecurity plans afloat in Washington, but the latest one "is going to stick."
211005
John Becker, the CEO of newly formed Cybertrust Inc., talks about the company's plan to deliver a range of risk management services for enterprise users.
587220
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.The Center for Strategic and International Studies ( CSIS ) wants the commission to come up with a list of recommendations that the new president who takes office in January 2009 &quot;can pick up and run with right away,&quot; said James Lewis, director of the CSIS Technology and Public Policy Program. The commission, made up of 32 cybersecurity experts, plans to finish its work by the end of 2008.Co-chairmen of the commission are retired Admiral Bobby Inman, former director of the U.S. National Security Agency; Scott Charney, corporate vice president for trustworthy computing at Microsoft; U.S. Representative Jim Langevin, a Rhode Island Democrat and chairman of the Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology; and Representative Michael McCaul of Texas, the ranking Republican on the subcommittee.Cyberthreats against the U.S.&#160;are growing, and it&#39;s&#160;important for Congress and the next president to take action, Langevin said. In the past year, his committee has investigated hundreds of cyberbreaches within the U.S. government.Langevin remains concerned about U.S. government networks, he said. The U.S. Department of Homeland Security reported 844 cybersecurity incidents in fiscal years 2005 and 2006, he noted.When the lead agency for protecting the U.S. against cyberattacks has hundreds of vulnerabilities, &quot;we&#39;ve clearly reached an unacceptable situation,&quot; Langevin said.The commission will expect action on its recommendations, added McCaul. He promised to push the recommendations in the cybersecurity subcommittee.&quot;The time is now for action,&quot; he said. &quot;For any [presidential] administration, it&#39;d be unwise to ignore that.&quot;Among the members of the committee are three former cybersecurity directors at the White House Office of Management and Budget; former Federal Trade Commission member Orson Swindle; former DHS assistant secretary for cybersecurity Amit Yoran; former head of the U.S. Department of Justice computer crimes division Marty Stansell-Gamm; and executives with Oracle, EMC, Internet Security Systems, and Verizon Communications.
404305
(InfoWorld) - Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday. David Longhurst, who retired this week, called for businesses and governments to take a risk-based approach to cybersecurity by balancing the advantages of new applications and capabilities with the security risks. Too often, Longhurst found himself between the U.K. military, which wanted new networked capabilities, and in-house cybersecurity experts, who wanted no new networking functionality, he said during Microsoft Corp.'s Security Summit East in Washington, D.C. "IT security folks don't want to connect anything," he said. "They believe safe sex is no sex." Longhurst didn't downplay cybersecurity risks as he spoke to a crowd of developers and network security administrators. Protecting the global information infrastructure is one of the top -- if not the top -- challenges for governments, developers and infrastructure providers, he said. It's difficult to fully assess the magnitude of the threat, he said, with IT security experts often saying, "We just have to tell you, it's bad." But as security threats continue to be a large problem, IT users are demanding increased functionality that supports their business, is easy to use, is reliable and safe, and "makes the coffee in the morning," he said. Maybe users don't want their computers to make coffee, but IT security professionals can face demands from users who want to access sensitive data from Internet cafes in Beijing, he said. "They say, 'I'd like to connect to anybody, anywhere, access anything for practically any purpose, at any time,'" Longhurst said. "You could do all this ... if we didn't have a Wild West out there." Longhurst called on everyone in the IT chain, including developers, integrators and users, to give cybersecurity a higher priority. But he also advised companies and government agencies to weigh the risks of new technology with the benefits to themselves or their customers. "This is a risk-based business," he said. "There are no absolutes in this." To fully access risk, businesses and government agencies need to hear from IT security experts, from those wanting the new functionality and from engineers who estimate how long any identified problems will take to fix. In some cases, the U.K. government has rolled out new technology even with security concerns, but set a deadline for fixing any problems, he said. Earlier, George Stathakopoulos, Microsoft's general manager for product security, said the company continues to push security in its upcoming Windows Vista OS. Vista will include several security features, including support for smart-card access to computers, and the Windows Defender scanning tool, he said. Stathakopoulos called on governments and courts to increase penalties against attackers who are caught. "Right now, you write a Sasser [worm] and get a two-year suspended sentence," he said, referring to a 2005 conviction in Germany. "You may even get a security job."
26500
WASHINGTON -- The nationâs top cyber-security official has resigned unexpectedly, raising new questions about the progress of efforts to protect the nationâs vast computer networks from terror attacks, electronic viruses and other threats, government
307822
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.
402450
(InfoWorld) - As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy. Last week, Paller was at it again, joining Eric Byres, Director of Industrial Cyber Security at Symantec to talk about cyberattacks on SCADA (supervisory control and data acquisition) systems that manage the nationâs critical infrastructure. Ahead of that event, Paller told InfoWorld Senior Editor Paul Roberts that SCADA hacks have already happened and that on the five-year anniversary of the Sept. 11, 2001, terrorist attacks, the U.S. gets an âFâÂ  for protecting its computers from hackers, terrorist or otherwise. InfoWorld: Weâve been hearing about the threat of terrorist cyberattacks for years. Is the threat for real? Alan Paller: It is a real threat, but itâs an interesting threat. What you have happening today is that terrorists are using cybercrime to get the money to buy the bombs to blow people up. But theyâre not using cyberattacks against physical things. There have been two cases that are very secret where SCADA systems that run power plants were taken over, but the crime was about extortion -- you know, âIf you donât pay us weâre going to do something bad.âÂ  In some cases the guys have proven that they can do damage by running a test denial of service attack, or a test outage. IW: Conventional wisdom was that SCADA systems are too old and idiosyncratic to be easy targets. What has changed? AP: The difference is that companies have added Windows systems to replace unknown operating systems, and then connected them to their networks, which are connected to the Internet. GAO did a great report on this back in 2004. Most of the attacks we hear about arenât aimed at SCADA systems, theyâre aimed at corporate networks, but once youâre on the network you can get into these (SCADA) systems. IW: Why should enterprise IT people care about the security of SCADA systems? AP: The big shock to us was all the places where control systems are used. NIST [National Institute of Standards and Technology] did a study that found SCADA systems were common in the electric, water, oil and gas, chemical, pharmaceutical, pulp and paper, food and beverage, discrete manufacturing, durable goods, air and rail transportation, mining and metallurgy industries. So tell me whatâs not covered there. Almost anyone who works in a major industry has this stuff on their plate.Â  IW: Is there any evidence that foreign governments are privy to information on how to attack SCADA systems in the U.S.? AP: Well, you have the statement Gen. Lord gave that the military has lost terabytes of sensitive information to the Chinese government. [Editorâs Note: Maj. Gen. William Lord told GCN in August that âChina has downloaded 10 to 20TB of data from NIPRNet, the DoDâs Non-Classified IP Router Network.â] That was the first public âoopsâ that weâve heard. It was an admission at the highest level that weâve spent all this money and systematically the Chinese have been able to come in and steal this information. IW: Recently, an article in Foreign Affairs criticized the U.S. government for playing defense on cybersecurity and missing the way terrorists are using the Internet to organize and raise money. Is that fair? AP: Youâre giving [the government] too much credit for having an active defense. They donât have an active defense. What they have is a lot of reports that have been written. Just one consulting firm increased their staff writing (cybersecurity) reports from four people to 200 in the last five years. As one chief of staff told me, the best thing to do with those reports is to pile them in front of our buildings so the terrorists canât use a car bomb to get us. IW: If you had to give the U.S. government a grade on cybersecurity, what would it be? AP: It would have to be an F. I mean, if you canât secure the boxes that you have, that would have to be an F.
7468
The government&#39;s cybersecurity chief has abruptly resigned from the Homeland Security Department amid a concerted campaign by the technology industry and some lawmakers to persuade the Bush administration to give him more authority and money for
730013
Microsoft's chief Trustworthy Computing strategist, Scott Charney, laid out the company's security efforts at the IT Forum today with all the seriousness one would expect from a former public prosecutor and U.S. Department of Justice cybercrime chief.
483534
A think tank has tapped several heavyweight cybersecurity experts for a commission tasked with giving security recommendations to the next U.S. president.
622165
In-Q-Tel's new CEO looks to nanotechnology to bolster safety and security.
739919
The U.S. Department of Homeland Security (DHS) finally named a leader for its cybersecurity efforts on Monday, fulfilling a promise made last July by an agency that has drawn poor marks for digital security.
596445
(InfoWorld) - The U.S. Department of Homeland Security (DHS) has failed to take several basic steps to protect the nation's cyber infrastructure, including a year-plus delay in naming an assistant secretary for cybersecurity, lawmakers and other critics said Wednesday. Lawmakers and representatives of cybersecurity trade groups questioned why the DHS has failed to fill the high-level cybersecurity position after DHS Secretary Michael Chertoff announced plans to create the position in July 2005. The delay in hiring an assistant secretary shows a "lack of cybersecurity leadership" at the DHS, said Representative John Dingell, a Michigan Democrat, during a congressional hearing. But DHS is working hard to hire an assistant secretary for cybersecurity, and the agency has continued to make significant progress in improving cybersecurity in the past year, George Foresman, the DHS under secretary for preparedness, told the House of Representatives Subcommittee on Telecommunications and the Internet. He spends about a quarter of his time working on cybersecurity issues, while Andy Purdy, acting director of the DHS National Cyber Security Division, spends about three quarters of his time on cybersecurity issues, Foresman said. Some potential candidates for the job have withdrawn their applications because of private work commitments, Foresman said. Still, the agency may be close to naming an assistant secretary, he said. "Had we been inactive the whole time, I think there'd be grave concern," Foresman said. "But I think we've been in overdrive." Some lawmakers and witnesses seemed to disagree. Representative Anna Eshoo, a California Democrat, said the lack of a top cybersecurity leader at DHS means the issue is not a top priority. "Simply put, we're putting ourselves in a real ditch here," she said. Congress may have to get involved in the assistant secretary's hiring, said David Powner, director of IT management issues at the U.S. Government Accountability Office (GAO), which has criticized the DHS cybersecurity effort in a series of reports. "If they can't figure it out soon, perhaps you can help them," Powner told lawmakers. A June report from GAO found that the DHS had not yet completed a plan involving public and private resources for recovery of the Internet after a major cyberattack, added Representative Ed Markey, a Massachusetts Democrat. Paul Kurtz, executive director of the Cyber Security Industry Alliance (CSIA) trade group, called on Congress to pass data breach legislation awaiting a vote on the House floor. CSIA also recommended that Congress better define the roles government agencies such as the DHS and the Department of Defense should play after a major cyberattack. "There is little strategic direction or leadership from the federal government in the area of information security," Kurtz said. "We must move beyond philosophy and statements of aspirations to defining priorities and programs." The U.S. government has the responsibility of setting priorities and coordinating response to cyberattacks, he added. "Let me be clear -- this is not a call for regulation or intervention," he said. "This is a call for leadership."
696118
Hoping to guide policy in President Bush's second term, the Cyber Security Industry Alliance today called for higher-profile leadership within the Dept. of Homeland Security. -washingtonpost.com
309870
WASHINGTON - The government's cybersecurity chief has abruptly resigned from the Homeland Security Department amid a concerted campaign by the technology industry and some lawmakers to persuade the Bush administration to give him more authority and money for protection programs.    Amit Yoran, a former software executive from Symantec Corp., made his resignation effective Thursday as director of the National Cyber Security Division, giving a single's day notice of his intention to leave...
740982
SEPTEMBER 15, 2004  - SAN MATEO, Calif. -- The Department of Homeland Security is actively planning several new pilot projects that officials hope will help solve one of the most pressing cybersecurity
211589
The government&#39;s cybersecurity chief resigned this week after serving a year with the Homeland Security Department. Amit Yoran, the first director of the National Cyber Security Division, said