Bush's 2008 IT budget focuses on cybersecurity
86899
(InfoWorld) - U.S. President George Bush's 2008 budget request for $65.5 billion in IT spending across federal agencies reflects his priorities to cut budget deficits while improving cybersecurity and enhancing e-government services to U.S. citizens, Bush advisors said Wednesday. "It's clearly demonstrated by our actions in this past year that the [cybersecurity] plans we've had in place aren't necessarily working," said Karen Evans, administrator of e-government and information technology in the White House Office of Management and Budget (OMB). "It's important for us ... that we have the trust of the American people that we'll protect their information." The U.S. government this year will focus heavily on IT security after reports of data breaches in 2006. The White House, working with federal auditors and Congress, will lean on agencies to improve cybersecurity using their existing resources, Evans said. Evans, during a press conference, didn't mention specific data breaches from 2006, but the Department of Veterans Affairs (VA) in MayÂ reported a laptop and hard drive containing the personal information of 26.5 million military veterans and their families stolen from an employee's home. Police later recovered the hardware, but the announcement set off a storm of criticism from Congress. The lost VA equipment prompted a congressional review of other government agencies, and they reported thousands of laptops missing in the last five years. OMB will encourage some smaller agencies to contract with larger ones for network access and security, Evans said. OMB will also ask many agencies to focus on internal problems that lead to lost data, not just on external threats, she said. Some agencies are spending a disproportionate amount on fighting external threats when the majority of cybersecurity problems are internal, she said. Bush's 2008 budget includes a 2.6 percent spending increase for IT, compared to his 2007 budget request. Of the $65.5 billion, $31.4 billion would go to the U.S. Department of Defense, $5.6 billion to the Department of Health and Human Services, and $4.1 billion to the Department of Homeland Security. DOD would get a 2.1 percent increase in its IT budget over Bush's 2007 request, HHS would get a 9.9 percent increase, and DHS would get a 1.1 percent decrease. The U.S. Congress has not yet finalized the budget for the government's fiscal year 2007, which started in October. With Bush's 2008 budget, OMB for the first time released a list of government IT projects that auditors are concerned about. In 2008, there are 346 IT funding requests on OMB's management watch list, meaning the requests have not met criteria such as performance goals, security and privacy requirements, or program management standards. Federal agencies have made 840 funding requests for IT programs for fiscal year 2008. The 346 programs on the management watch list total about $14.4 billion, Evans said. Sixty-one of those watch-list requests are from the Department of the Treasury, 52 are from the Department of Homeland Security, and 37 are from the VA.
113465
The Bush administration should spend more on cybersecurity research, share threat information with private-sector security vendors and set up an emergency computer network that would continue working during Internet blackouts, a computer security trade group said today.
533849
Rick White, head of the TechNet policy group discusses technology in next year's Congress and in the second term of the Bush administration.
598201
WASHINGTON, Feb. 5  /PRNewswire-USNewswire/ -- The President's Budget for fiscal year 2008 (FY08) transmitted to Congress today includes $4.871 billion in new federal funding for the Civil Works program of the U.S. Army Corps of Engineers.  Mr.
515170
Report outlines challenges governments face and the actions they can take to counter cybercrime.
739919
The U.S. Department of Homeland Security (DHS) finally named a leader for its cybersecurity efforts on Monday, fulfilling a promise made last July by an agency that has drawn poor marks for digital security.
427228
(InfoWorld) - SAN FRANCISCO -- U.S. companies and the federal government need to step up and fix the problems in their computer networks, the nation's new cybersecurity czar told attendees during his first-ever address atÂ RSA ConferenceÂ here on Thursday. Within the next 10 years, the majority of the world's communication needs will probably be handled by the Internet, said Gregory Garcia, the assistant secretary for cybersecurity and telecommunications at the U.S. Department of Homeland Security (DHS). "This proliferation of applications and devices within the converged network is going to create a breeding ground for security problems," he said. "Our networks and our systems are vulnerable and they are exposed." Garcia outlined two priorities for the year ahead. First, his office is working with federal agencies to adopt common security policies and practices. Second, he plans to work with the private sector to push forward a process called the National Infrastructure Protection Plan. This effort is intended to evaluate computer security risks on an industry-by-industry basis and outline the steps that need to be taken to address them. The broad strokes of this plan were outlined last June, and the DHS is now working with industry to flesh out sector-specific plans, Garcia said. He made it clear that the DHS expects U.S. companies to participate. "There are a lot of plans in Washington. This one is going to stick," he said. "The private sector owns and operates 90 percent of the critical infrastructure, and it's up to you all, not just the DHS, to secure this infrastructure." Companies looking for best practices already have a number of standards they can consider, Garcia said, pointing to the International Organization for Standardization (ISO) 17799 specification and the guidelines prescribed by Technet, an IT industry association. Computer security has not been a top priority at the DHS, which has paid far more attention to physical security threats to the nation since its inception in 2003. And though DHS Secretary Michael Chertoff tried to put a sharper focus on computer security by creating Garcia's high-level post in 2005, the position remained vacant for more than a year. Garcia was introduced Thursday by Art Coviello, president of EMC's RSA group, who said afterward that he was encouraged by the assistant secretary's speech. "It's a combination of carrot and stick," he said in an interview. "Chiding industry to actually comply with these standards that are out there, and a veiled threat of regulation to get things done." Coviello said that cybersecurity has "languished a bit" within DHS ever since U.S. President George W. Bush signed off on his administration's comprehensive cybersecurity plan in 2003. "The Department and Secretary [Tom] Ridge and Secretary Chertoff obviously focused on the right things -- physical threats -- but now it's time to get after the critical infrastructure from the cyber side," Coviello said in the interview. "I don't think industry is looking for a lot of regulation from government," he added. "What they are looking for is leadership."
587220
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.The Center for Strategic and International Studies ( CSIS ) wants the commission to come up with a list of recommendations that the new president who takes office in January 2009 &quot;can pick up and run with right away,&quot; said James Lewis, director of the CSIS Technology and Public Policy Program. The commission, made up of 32 cybersecurity experts, plans to finish its work by the end of 2008.Co-chairmen of the commission are retired Admiral Bobby Inman, former director of the U.S. National Security Agency; Scott Charney, corporate vice president for trustworthy computing at Microsoft; U.S. Representative Jim Langevin, a Rhode Island Democrat and chairman of the Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology; and Representative Michael McCaul of Texas, the ranking Republican on the subcommittee.Cyberthreats against the U.S.&#160;are growing, and it&#39;s&#160;important for Congress and the next president to take action, Langevin said. In the past year, his committee has investigated hundreds of cyberbreaches within the U.S. government.Langevin remains concerned about U.S. government networks, he said. The U.S. Department of Homeland Security reported 844 cybersecurity incidents in fiscal years 2005 and 2006, he noted.When the lead agency for protecting the U.S. against cyberattacks has hundreds of vulnerabilities, &quot;we&#39;ve clearly reached an unacceptable situation,&quot; Langevin said.The commission will expect action on its recommendations, added McCaul. He promised to push the recommendations in the cybersecurity subcommittee.&quot;The time is now for action,&quot; he said. &quot;For any [presidential] administration, it&#39;d be unwise to ignore that.&quot;Among the members of the committee are three former cybersecurity directors at the White House Office of Management and Budget; former Federal Trade Commission member Orson Swindle; former DHS assistant secretary for cybersecurity Amit Yoran; former head of the U.S. Department of Justice computer crimes division Marty Stansell-Gamm; and executives with Oracle, EMC, Internet Security Systems, and Verizon Communications.
746988
The House will propose moving cybersecurity offices from the Department of Homeland Security to the White House as part of the intelligence reorganization, according to draft legislation obtained Wednesday by The Associated Press. The bill, expected to be introduced Thursday, would place cybersecurity into the White House budget office.
596489
Symantec says U.S. agencies need to better protect their cyber assets, echoing concerns raised last year by U.S. Government Accountability Office.
244560
OCTOBER 01, 2004  - WASHINGTON -- Amit Yoran, the government&#39;s cybersecurity chief, abruptly resigned yesterday after one year with the US Department of Homeland Security (DHS), a move that raised serious questions about the Bush
568981
The office in charge of cyber-security in the Department of Homeland Security is planning to continue moving ahead on the agenda the agency has already set.
472083
President Bush's 2008 budget request includes $624.6 billion in defense spending and marks the first time he has offered an estimate of how much the wars in Iraq and Afghanistan will cost a year in advance.
657998
While IT employment numbers may be lagging, there is a glimmer of hope. The number of cybersecurity professionals is projected to grow at an annual compound rate of nearly 14 percent from now until 2008, according to a study released in November.
738930
(InfoWorld) - The Cyber Security Industry Alliance has given the U.S. government D grades on its cybersecurity efforts in 2006, and renewed its call for the U.S. Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government D grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. "Government needs to take these issues very seriously," said Liz Gasster, the CSIA's acting executive director and general counsel. Among the problems in 2006: The U.S. Department ofÂ Veterans Affairs reported a data breach involving the personal information of 26.5 million military veterans and family members. Other agencies also reported multiple lost laptops containing personal information. The CSIA called on agencies to notify citizens of data breaches. After a rash of reported data breaches in early 2005, members of Congress introduced multiple bills requiring companies with data breaches to notify affected consumers. ButÂ a breach-notification law failed to pass, partly because of jurisdictional fights between multiple congressional committees. A comprehensive data security bill should include breach notification, but also a requirement that all organizations holding sensitive data -- including private companies, government agencies, nonprofits, and educational institutions -- use reasonable security standards, Gasster said. The U.S. Federal Trade Commission has taken action against several companies, but a comprehensive law would give the FTC or another agency broad jurisdiction to investigate data breaches, she said. The CSIA is optimistic a comprehensive data breach law will pass in the next year, even though it stalled in the last Congress, Gasster added. Major data breaches continue to happen, and consumers will increase the pressure on Congress to act, she predicted. In mid-January, retailerÂ TJX Companies Inc. reported a massive data breach. "Consumers just are not going to put up with is," Gasster said. Here's how the CSIA generated its government cybersecurity grades: -- Security of sensitive information, grade D: Congress ratified the Council of Europe Convention on Cyber Crime, allowing the U.S. to work with other signatories on cybersecurity investigations, but failed to pass a comprehensive law to protect sensitive personal information. -- Security and resiliency of the critical information infrastructure, grade D: The Department of Homeland Security appointed an assistant secretary for cybersecurity and telecommunications and implemented some cybersecurity program, but it hasnât offered a clear agenda for its top cybersecurity research and development priorities or established a survivable emergency coordination network to handle a large-scale cybersecurity disaster. -- Federal information assurance, grade D: Government continues to offer a "mixed bag of successes and failures," the CSIA said, with progress within the White House Office of Management and Budget's enforcement of cybersecurity directives and implementation of U.S. President George Bush's Homeland Security Presidential Directive 12, requiring agencies to start issuing smart identification cards. But the government needs to do a better job in several areas, including security issues with telecommuting and releasing information on the cost of cyberattacks, the CSIA said. In addition to a comprehensive data protection bill, CSIA called for the U.S. government to strengthen the power of agency chief information officers and called on agencies to increase testing of cybersecurity controls.
762970
A cybersecurity standard proposed for the U.S. would leave critical gaps in system safety, and one congressman warned Wednesday that if issues are not addressed in short order, "the future isn't going to be pretty" for the nation's infrastructure.
562118
In the first column of this year, I discussed computer security outlook and hopes for 2008. I forecast more of the same that we saw in 2007: more spam, more malware, more bad guys basically owning the Internet and our connected computers. I don't see any trends or new leaders with significant power to change the status quo.