Security, science panel is suggested
475452
A new commission should be established to help balance the need for scientific openness and security concerns in a world facing terrorism, the National Research Council urged Thursday.
32377
Panel wants to hear from two investigators; others are due to say if they'll appear at a hearing next week.
364615
A group representing the cybersecurity industry has called for the White House to show &quot;greater leadership&quot; in guarding the nation&#39;s computer infrastructure from attacks by hackers and viruses
709584
(InfoWorld) - While stopping short of volunteering to host the event, Mozilla chief security official Window Snyder said that it could prove helpful for the open-source community to meet at its own conference to debate secure coding, vulnerability reporting, and product patching issues. In a recent interview with InfoWorld, Snyder -- whose official title with browser maker Mozilla is "chief security something or other" -- said that she would back a meeting of open-source software developers centered on a discussion of security issues. Working at Microsoft as part of its Secure Windows Initiative prior to joining Mozilla in 2006, Snyder helped organize Blue Hat, the software giant's now annual closed-door meeting with security researchers. Security has vastly improved in the open-source community over the last several years as an increasing number of contributors have stepped up to identify software vulnerabilities and help ward off potential attacks, but such a meeting of the minds could help developers improve their products even further, Snyder said. The event wouldn't likely adopt the same closed-door approach as Blue Hat, to which media members and other security industry onlookers remain uninvited, and security researchers and open-source developers would need to focus on both existing issues, such as improving vulnerability disclosure methods, and emerging topics, such as new threats aimed specifically at open-source technologies, according to the expert. If created, the event would likely take on the same grassroots feel of smaller security research conferences, such as the annual ShmooCon gathering in Washington, she said. "It would take a lot of work to coordinate, and we would need a lot of people to organize it, but something like [an open-source Blue Hat] could be very useful," Snyder said. "Anyone who wanted to contribute would have to be welcomed, and the idea would have to be to help people make their own security decisions more intelligently rather than to put pressure on people to change the ways they build things." Backers of the open-source model have long defended that they enjoy a significant advantage over makers of proprietary software -- such as Microsoft -- in the area of finding and patching security flaws in their products. Unlike Microsoft, which keeps its code under wraps and issues monthly updates that typically contain patches for multiple vulnerabilities that have been publicly identified by researchers, open-source companies like Mozilla -- perhaps best known for its Firefox browser -- have legions of contributors who attempt to find and fix any problems in its freely-distributed code on an ongoing basis. The ability to respond to problems so rapidly, and tap into a wider group of security experts in the form of the larger open-source community currently makes Firefox a more secure alternative to Microsoft's Internet Explorer and other proprietary software products, Snyder contends. By meeting as an industry, open-source security experts could also glean more detailed feedback from researchers, she said, as open-source flaws are typically only approached as an element of any published papers issued by security technology vendors. "The majority of reports that come out of the security researchers have a tremendous amount of knowledge, and we would love to get further involved in the overall process and understand the coding implications of what they find," Snyder said. "We could get more suggestions on building out our architecture in the future, which is something we always want to have an eye on." Overall, the security expert said that the open-source model continues to prove itself as advantageous in fighting off attacks, especially as Mozilla continues to hear from a growing number of people who are actively scouring its products for potential issues. "Transparency continues to be one of Mozilla's key factors for success," she said. "Some people might see it as an obstacle in terms of doing security with the whole world watching, and at times it can be a challenge, but we have ten thousand people testing our nightly builds, which is a lot more than you find on your typical browser development team."
100547
Fixing cybersecurity problems in the U.S. is a top priority at the U.S. Department of Homeland Security, said the agency's leader, but lawmakers didn't focus on the issue during a hearing in Congress Wednesday.
32406
The panel of scientists also warned of a looming imbalance between hardware and software technology in high-performance computing.
307822
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.
153380
Scientists gather to discuss their preferred targets for the next "flagship" mission to another world.
33631
RICHMOND, Aug. 30 -- The communications breakdowns, gaps in the mental health system and confusion over student privacy laws that were identified as problems by the panel that investigated the massacre at Virginia Tech might take years to correct and require action by the federal government, panel...
358672
DECEMBER 07, 2004 (REUTERS) - Computer security experts, including former government officials, urged the Bush administration today to devote more effort to strengthening defenses against viruses, hackers and other online threats.
416631
A think tank has tapped several heavyweight security experts to staff a commission that will advise the president.
468312
A policy and advocacy group called on the Bush administration Tuesday to put more muscle behind cyber-security, and urged the White House to act on a dozen proposals and recommendations to protect the country&#39;s technology infrastructure.
361565
A panel of leading computer scientists warned in a report issued Monday that unless the federal government significantly increases support for advanced research on supercomputing, the United
30623
By James Derk Scripps Howard News Service  If you weren't worried enough about the security of your home computer and network, it may be time to step it up.
142454
Climate change, renewable energy and space exploration will be high on the agenda when scientists from around the world gather for the annual meeting of the American Association for the Advancement of Science this week.
731966
The Cyber Security Industry Alliance (CSIA) has recommended that the Bush administration get a handle on cybersecurity issues, and has issued a 12 point recommendation to the White House to aid in the education process.
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."