Lawmakers: Can DHS protect its networks?
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."
367449
The House will propose moving cybersecurity offices from the Department of Homeland Security to the White House as part of the intelligence reorganization, according to draft legislation obtained Wednesday by The Associated Press. The bill, expected to be introduced Thursday, would place cybersecurity into the White House budget office...
30623
By James Derk Scripps Howard News Service  If you weren't worried enough about the security of your home computer and network, it may be time to step it up.
340162
Federal and industry experts grapple with how to apply CALEA wiretap standards to something that lawmakers didn't anticipate 10 years ago -- voice over IP. Michael Grebb reports from Washington.
60572
WASHINGTON - New immigration barriers and expanded police powers, as well as making more of the public airwaves available for emergency services, are some of the issues trying to find a home in a bill to overhaul U.S. spy agencies...
488166
Congress neared agreement Thursday on legislation to strengthen security at the nation's ports, regarded since the Sept. 11 attacks as one of the most vulnerable targets for a catastrophic act of terrorism.
464058
Lawmakers say the deal may pose a threat to national security.
545413
For Congress to do anything that helps protect consumers and the critical Internet infrastructure as a whole, it must pass laws that require proactive processes to protect computers, not that tell people how to deal with the resulting mess, writes columnist Ira Winkler.
57499
(InfoWorld) - Officials from the U.S. Department of Homeland Security will hold a hearing on Capitol Hill on June 20 to discuss the findings of an investigation into the agency's own problems in battling electronic attacks and IT systems intrusions. In a hearing labeled "Hacking the Homeland: Investigating Cyber-security Vulnerabilities at the Department of Homeland Security," officials including DHS chief information officer Scott Charbo and Gregory Wilshusen, director of information security issues at the Government Accountability Office (GAO) are scheduled to detail their findings in response to requests from Congress to test the agency's IT security defenses. In a letter sent to Charbo on April 30, members of Congress led by Rep. Bennie G. Thompson (D-Miss.), chairman of the House Committee on Homeland Security, asked DHS to conduct a review of its information system security in the wake of news that the departments of commerce and state were successfully hacked during 2006. Details of those systems intrusions were first revealed at a hearing coordinated by the House Subcommittee on Emerging Threats, Cyber-security, Science, and Technology on April 19. "These incidents jeopardize the integrity of our government's information. We are concerned that similar incidents may be occurring within the networks of the Department of Homeland Security," read the letter, which was also signed by ranking members of the House Subcommittee on Management, Investigations, and Oversight. Among the issues expected to be addressed by Charbo and other witnesses -- including Keith A. Rhodes, director for the Center for Technology and Engineering in the GAO -- at next week's hearing will be a review of cybersecurity incidents reported to the DHS Security Operations Center (SOC), such as instances of rootkits, classified leaks, compromised Web sites, bot infections, unauthorized use of networks by contractors, and virus attacks. According to a Congressional press release distributed ahead of the hearing, the GAO witnesses will also describe an investigation they conducted on a specific DHS network that is "riddled with significant information security control weaknesses that place sensitive and personally identifiable information at increased risk of unauthorized disclosure." The subcommittee also plans to air some of its concerns with the DHS OneNet project, which is aimed at consolidating all of the agency's information networks under one roof, and to question a perceived lack of IT security funding by Charbo. The Congressional committee has said it will call for further investigation of security issues existing within DHS at the hearing. Among the specific questions posed to DHS leaders by Thompson and other members of the House Committee on Homeland Security are what responsibility Charbo has over management of the agency's networks, and his relationship with the department's chief information security officers (CISOs) and chief information officers. Charbo was also asked to provide details of the agency's information security policies and incident response plans, along with data on how many and what types of security events it has reported to the U.S. Computer Emergency Readiness Team (US-CERT), which was established in 2003 and operates as a partnership between DHS and the public and private sectors. Among the incidents that Congress has specifically asked for more information about are the most severe threats encountered by the agency between 2004 and 2007. The committee has also asked DHS officials to reveal whether or not they have taken an inventory of each access point on the agency's network, and how it has approached the practice of penetration testing for its internal and external systems. In addition to questioning the department's security testing policies, the committee has asked DHS to turn over details of any secure software coding initiatives it has launched in the name of eliminating vulnerabilities in its applications, as well as statistics on how much of its coding is being performed by outside contractors. The committee has also asked for information on whether or not DHS is requiring two-factor IT systems authentication for all privileged personnel and systems administrators. A good deal of discussion at the hearing is likely to be given over to the process that DHS has employed to meet the terms of the Federal Information Security Management Act (FISMA), which was enacted by Congress in 2002 and is aimed at improving IT security in the federal space via a system of mandated annual audits. The hearing may be seen as a bellwether moment in the continued development of government IT security policies and enforcement, as the DHS has been charged with helping to oversee the performance of other agencies, including via its work with US-CERT. If the DHS is found to have failed to protect its own systems adequately, some observers believe that the agency will be put under significant pressure to completely retrench its IT operations in the name of improving security, a process that may then be pushed out to other federal agencies. Some experts believe that adopting such an approach will soon become a fact of life for all government agencies, as many legacy computer systems and policies are not suited to respond to today's fierce security climate. Dave Nelson, a retired deputy CIO for IT security at NASA, who also worked in the White House Office of Scientific Research, said that the government, much like enterprise businesses, has been put in the uncomfortable position of coping with security threats in a cat-and-mouse game, based on long-standing flaws in the technologies and processes it employs. "Until the Internet and the computers that are on it are fundamentally reengineered to be inherently secure, we will always be in coping mode," Nelson said. "The government and IT industry may not know how to make these types of technologies yet, but if they don't get cracking, things will only get worse; as the economic and political payoff of attacks continues to rise, that's our only choice." While Nelson said he has not been made privy to information on attacks on government IT infrastructure for several years, he estimates that there are still many breaches, and that the sophistication of the attacks is ramping up quickly. One of the specific areas that Nelson said needs to be investigated more closely is to what extent foreign governments or politically motivated groups such as terrorists may be involved in cyberthreats. "We don't have any public information that would conclusively prove that some of these attacks are being launched by other nations, but there seem to be significant resources behind them in terms of people and financing," Nelson said. "That's the scariest part, and extrapolating that idea into the future, I don't see a lot of encouraging signs for improvement. If you look at the zero day attacks, they only seem to be getting worse, and I don't see evidence that the systems vulnerabilities they target are going away anytime soon."
65201
As Senate prepares to consider a Net access ban extension, Democrat behind original ban warns changes to current law approved by the House of Representatives could make that so.
178448
A compromise emerged this summer, but now House leaders seek to limit DHS authority to regulate such security.
349623
Officials from the U.S. Department of Homeland Security will hold a hearing on Capitol Hill on June 20 to discuss the findings of an investigation into the agency's own problems in battling electronic attacks and IT systems intrusions.
114569
A Congressional inquiry into online data brokers has raised concerns that federal and local law enforcement may be skirting privacy laws to obtain calling records
748330
(InfoWorld) - The U.S. Department of Homeland Security (DHS) finally named a leader for its cybersecurity efforts on Monday, fulfilling a promise made last July by an agency that has drawn poor marks for digital security. Gregory Garcia has been named Assistant Secretary for Cyber Security and Telecommunications, according to a statement released late Monday from Michael Chertoff, secretary of homeland security. Chertoff announced plans to create the position in July 2005 but it had remained empty despite pressure from the IT industry to fill it. Some observers have slammed the DHS for a lack of readiness to deal with threats against the country's IT infrastructure. The DHS was created in the wake of the Sept. 11, 2001, terrorist attacks. Garcia comes to the DHS from the Information Technology Association of America, where he was vice president for information security policy and programs. He has also been secretary for the IT Sector Coordinating Council, a group involved in collaboration between industry and the DHS. "He brings both industry and government experience to bear," said Shannon Kellogg, director of government and industry affairs with EMC Corp.'s RSA division. "He has a lot of IT experience, but he also has telecom experience, and he's worked on the Hill." Garcia's appointment is a "very positive sign" that DHS is going to finally give cybersecurity the attention it deserves, Kellogg added. Earlier, Garcia worked on the staff of the U.S. House of Representatives Committee on Science for the majority Republican party and helped to draft and enact the Cyber Security Research and Development Act of 2002. Garcia has also worked with the Americans for Computer Privacy and the American Electronics Association. He has a bachelor of science degree from San Jose State University in California. Robert McMillan of the IDG News Service contributed to this story.
481913
WASHINGTON - A cybersecurity advocacy group on Tuesday called on U.S. President George Bush to focus more resources on computer issues and elevate the top IT security position at the U.S. Department of Homeland Security (DHS) to the assistant secretary level.
24261
As the 108th Congress scrambles in its final days to address homeland security issues, US Reps. Mac Thornberry (R-Texas) and Zoe Lofgren (D-Calif.
137332
Homeland Security Secretary Tom Ridge said yesterday that the role of overseeing computer security and the Internet should have a higher profile at the agency, in the face of increasing concern