Cyberattacks at DHS prompt new finger-pointing
640456
House committee demands answers from the agency after investigators turn up dozens of intrusions last year with ties to Chinese Web servers. An IT contractor says it wasn't at fault.
427785
Copycats are keeping busy. Security researcher says the Net threat's source code is "hot stuff."
630811
The US has a new head of cyber security, amid concerns about the Bush administration&#39;s commitment to protecting computer networks from attack.
320458
Web servers may be vulnerable to attack, security company warns.
65344
The director of national intelligence wants to monitor all internet communications to guard against cyberattack. His aide says "privacy and security are a zero-sum game." Our nation's spy masters may want to check their math. Commentary by Bruce Schneier.
710748
Lawmakers are on alert as hackers increase attacks on US infrastructure.
332601
The Department of Homeland Security has launched several new cybersecurity initiatives that it hopes to add to pilot projects and operational systems and that can be deployed throughout the government and the private sector.
376513
The Department of Homeland Security plans to collocate private-sector and government security experts at a US-CERT facility in an effort to better predict and prepare for cyberattacks.
208670
Inspectors find weak passwords, buffer overflows and mystery modems at the Department of Homeland Security.
526634
A top homeland security lawmaker has called for an investigation into possible cyber attacks on computer systems at the Homeland Security Department.
369317
Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the U.S. Department of Homeland Security (DHS).
596445
(InfoWorld) - The U.S. Department of Homeland Security (DHS) has failed to take several basic steps to protect the nation's cyber infrastructure, including a year-plus delay in naming an assistant secretary for cybersecurity, lawmakers and other critics said Wednesday. Lawmakers and representatives of cybersecurity trade groups questioned why the DHS has failed to fill the high-level cybersecurity position after DHS Secretary Michael Chertoff announced plans to create the position in July 2005. The delay in hiring an assistant secretary shows a "lack of cybersecurity leadership" at the DHS, said Representative John Dingell, a Michigan Democrat, during a congressional hearing. But DHS is working hard to hire an assistant secretary for cybersecurity, and the agency has continued to make significant progress in improving cybersecurity in the past year, George Foresman, the DHS under secretary for preparedness, told the House of Representatives Subcommittee on Telecommunications and the Internet. He spends about a quarter of his time working on cybersecurity issues, while Andy Purdy, acting director of the DHS National Cyber Security Division, spends about three quarters of his time on cybersecurity issues, Foresman said. Some potential candidates for the job have withdrawn their applications because of private work commitments, Foresman said. Still, the agency may be close to naming an assistant secretary, he said. "Had we been inactive the whole time, I think there'd be grave concern," Foresman said. "But I think we've been in overdrive." Some lawmakers and witnesses seemed to disagree. Representative Anna Eshoo, a California Democrat, said the lack of a top cybersecurity leader at DHS means the issue is not a top priority. "Simply put, we're putting ourselves in a real ditch here," she said. Congress may have to get involved in the assistant secretary's hiring, said David Powner, director of IT management issues at the U.S. Government Accountability Office (GAO), which has criticized the DHS cybersecurity effort in a series of reports. "If they can't figure it out soon, perhaps you can help them," Powner told lawmakers. A June report from GAO found that the DHS had not yet completed a plan involving public and private resources for recovery of the Internet after a major cyberattack, added Representative Ed Markey, a Massachusetts Democrat. Paul Kurtz, executive director of the Cyber Security Industry Alliance (CSIA) trade group, called on Congress to pass data breach legislation awaiting a vote on the House floor. CSIA also recommended that Congress better define the roles government agencies such as the DHS and the Department of Defense should play after a major cyberattack. "There is little strategic direction or leadership from the federal government in the area of information security," Kurtz said. "We must move beyond philosophy and statements of aspirations to defining priorities and programs." The U.S. government has the responsibility of setting priorities and coordinating response to cyberattacks, he added. "Let me be clear -- this is not a call for regulation or intervention," he said. "This is a call for leadership."
462867
Howard Schmidt, former security advisor to the White House, warns of upcoming threats to businesses and the Net itself.
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."
748330
(InfoWorld) - The U.S. Department of Homeland Security (DHS) finally named a leader for its cybersecurity efforts on Monday, fulfilling a promise made last July by an agency that has drawn poor marks for digital security. Gregory Garcia has been named Assistant Secretary for Cyber Security and Telecommunications, according to a statement released late Monday from Michael Chertoff, secretary of homeland security. Chertoff announced plans to create the position in July 2005 but it had remained empty despite pressure from the IT industry to fill it. Some observers have slammed the DHS for a lack of readiness to deal with threats against the country's IT infrastructure. The DHS was created in the wake of the Sept. 11, 2001, terrorist attacks. Garcia comes to the DHS from the Information Technology Association of America, where he was vice president for information security policy and programs. He has also been secretary for the IT Sector Coordinating Council, a group involved in collaboration between industry and the DHS. "He brings both industry and government experience to bear," said Shannon Kellogg, director of government and industry affairs with EMC Corp.'s RSA division. "He has a lot of IT experience, but he also has telecom experience, and he's worked on the Hill." Garcia's appointment is a "very positive sign" that DHS is going to finally give cybersecurity the attention it deserves, Kellogg added. Earlier, Garcia worked on the staff of the U.S. House of Representatives Committee on Science for the majority Republican party and helped to draft and enact the Cyber Security Research and Development Act of 2002. Garcia has also worked with the Americans for Computer Privacy and the American Electronics Association. He has a bachelor of science degree from San Jose State University in California. Robert McMillan of the IDG News Service contributed to this story.
730582
Ministers accused of trying to cover up the extent of Chinese cyber-attacks on Whitehall.
364615
A group representing the cybersecurity industry has called for the White House to show &quot;greater leadership&quot; in guarding the nation&#39;s computer infrastructure from attacks by hackers and viruses