Tech firms urge Bush to focus on cybersecurity
481913
WASHINGTON - A cybersecurity advocacy group on Tuesday called on U.S. President George Bush to focus more resources on computer issues and elevate the top IT security position at the U.S. Department of Homeland Security (DHS) to the assistant secretary level.
206983
U.S. government agencies need to take additional steps to protect against cybersecurity problems after a series of congressional hearings and reports exposed several weaknesses in 2007, representatives of Symantec said.The government sector, including state and local governments, accounted for 26 percent of data breaches that could lead to identity theft in the first half of 2007, according to Symantec&#39;s latest Government Internet Security Threat Report, published in September. The U.S. Government Accountability Office (GAO)&#160;also issued about a dozen reports in the last six months criticizing federal agencies for not fully implementing GAO&#39;s cybersecurity recommendations, noted Jim Russell, Symantec&#39;s vice president for the public sector.In addition, the House of Representatives Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology hosted a series of hearings in 2007 focused on cybersecurity lapses at several government agencies, including the Department of Homeland Security and the State Department.&quot;You look at that, and you say, &#39;Why does that happen?&#39;&quot; Russell said.While U.S. agencies have a set of cybersecurity rules set out in the Federal Information Security Management Act of 2002 (FISMA), agencies aren&#39;t held accountable when they have breaches, Russell said. Agencies don&#39;t lose funding from Congress after cybersecurity incidents, he said.The federal cybersecurity rules don&#39;t have &quot;a whole lot of teeth,&quot; he added.The good news is that agencies can take more steps to fix problems, Russell said. The first step is to inventory their IT assets, a job several agencies haven&#39;t accomplished. That&#39;s not always easy, Russell said.&quot;Let&#39;s say I&#39;m an agency CIO,&quot; he added. &quot;My challenge is that my environment is so dynamic with the home workforce and telecommuting. I can see why it&#39;s a challenge to see what all the assets out there are.&quot;Russell also called on agencies to develop comprehensive cybersecurity plans, to do systematic vulnerability testing, and to have a data backup plan and back up frequently.Symantec expects that cybersecurity issues will come before Congress in 2008, particularly federal agency cybersecurity practices, said Kevin Richards, Symantec&#39;s federal government relations manager. This could be &quot;the year for information security for our federal agencies,&quot; he said.In December, Representative William Lacy Clay, a Missouri Democrat, introduced the Federal Agency Data Protection Act, which would require U.S. agencies to implement wireless data security measures. The bill would also require each U.S. agency to draft a plan to protect itself against the dangers of peer-to-peer file-trading networks, and it would give the director of the White House Office of Management and Budget new authority to establish information security policies.Clay&#39;s bill would write into law many OMB recommendations, Richards said. &quot;I always make the point that these are recommendations, and it&#39;s important to codify them,&quot; he said. &quot;It seems like our federal government IT security strategy is very reactionary and not proactive.&quot;That bill comes in addition to Federal Agency Data Breach Protection Act, which would require that federal agencies notify constituents whose data is lost or stolen. That bill, introduced last May, is sponsored by Representative Tom Davis, a Virginia Republican, in the House, and Senator Norm Coleman, a Minnesota Republican.Bills that would require private companies to notify customers when their personal information is stolen or lost seem to have stalled in Congress. But there still seems to be interest from lawmakers in agency cybersecurity and breach notification, Richards said. The hearings and information requests from Davis and other lawmakers are bringing to light multiple attacks and breaches at agencies, he said.&quot;There&#39;s no real mechanism requiring agencies to report breaches,&quot; Richards added. &quot;Now, [lawmakers] are dedicating more resources and giving better direction.&quot;
526634
A top homeland security lawmaker has called for an investigation into possible cyber attacks on computer systems at the Homeland Security Department.
572122
Some tech groups are beginning to worry that major IT industry priorities, including patent reform, may lose out to other priorities in the U.S. Congress this year.In the last couple of weeks, large tech companies have renewed their push for patent reform legislation in the U.S. Congress, despite opposition from U.S. President George Bush&#39;s administration and some labor unions.The Computing Technology Industry Association (CompTIA) is concerned that a congressional debate over an economic stimulus package, plus typical election-year gridlock, could hurt the prospects for patent reform and other tech priorities, said Michael Wendy, a spokesman for the trade group.The House of Representatives&#39; economic stimulus package includes tax write-offs for small business purchase of equipment, which could include computers, Wendy said. That&#39;s a good move, but patent reform, a research and development tax credit, H-1B visa reform, and other issues remain undone, he said.&quot;We hope that Congress -- assuming they pass an [economic stimulus] package -- doesn&#39;t just say, &#39;Well, we gave you some favorable tax provisions that will help boost industry activity and have a long-tail effect on the economy, so that should be enough for you guys this session,&#39;&quot; Wendy said last week. &quot;One thing we&#39;re concerned about is that the economic stimulus bill may be seen by Congress as a &#39;get out of jail free&#39; card when it comes to other of our tech policy agenda.&quot;The House in September passed a patent reform bill -- supported by many large tech vendors, but&#160;opposed by several small tech companies&#160;-- but similar legislation has been stalled in the Senate. Large tech vendors, including Microsoft, IBM, and Symantec, have&#160;called for patent reform, saying it&#39;s too easy for companies with no intention of creating products to buy up patents and file multimillion-dollar infringement lawsuits against other companies.On Jan. 22, Senate Majority Leader Harry Reid, a Nevada Democrat, said patent reform was a priority, but it was in a line behind several other bills, including an economic stimulus package and a government surveillance authorization bill. The Senate would turn to patent reform, &quot;time permitting,&quot; he said then.&quot;On patent reform, we must carefully strike the right balance with a bill that promotes rather than blocks innovation from enterprising entrepreneurs,&quot; Reid added.The Senate Judiciary Committee approved its version of the Patent Reform Act on Jan. 24, and the bill is awaiting action in the full Senate.But earlier this week, the U.S. Department of Commerce sent a letter to the Senate Judiciary Committee raising concerns about the bill. The letter, outlining the Bush administration&#39;s views, focused on a section of the bill that would apportion infringement damages in a new way. Currently, courts generally consider the value of the entire product when a small piece of the product infringes a patent; the bill would allow courts to base damages only on the value of the infringing piece.The wide-ranging bill would also allow a new way to challenge patents after they are issued.That provision would &quot;create more problems than it solves,&quot; said the Commerce Department letter, signed by Nathaniel Wienecke, the agency&#39;s assistant secretary for legislative and intergovernmental affairs. &quot;The administration believes that such a dramatic change from current jurisprudence may have the unintended consequence of reducing the rewards of innovation and encouraging patent infringement,&quot; Wienecke wrote.Both sides can still work out their differences, Wienecke added.In addition, 14 labor unions, including the United Steelworkers, the Patent Office Professional Association and the Communications Workers of America, sent a letter to Senators Wednesday, saying they were concerned about the patent bill. &quot;Key parts of the proposed legislation may have the effect of increasing the likelihood of American inventions being stolen by our international competitors and, consequently, inhibiting sorely needed new investment in domestic manufacturing,&quot; the letter said.Still, some representatives of the tech industry say they&#39;re hopeful that patent reform can move forward.Senators, representatives of the Bush administration and other interested parties have been meeting regularly &quot;to find balanced solutions on all the issues,&quot; said Mark Isakowitz, spokesman for the Coalition for Patent Fairness, a group representing several large tech companies. &quot;We respectfully disagree [with the Bush administration] on damages, but we are confident ... we can work through concerns and achieve broad consensus on the bill, which would be a victory for the administration, the Congress and our economy,&quot; he added.
587220
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.The Center for Strategic and International Studies ( CSIS ) wants the commission to come up with a list of recommendations that the new president who takes office in January 2009 &quot;can pick up and run with right away,&quot; said James Lewis, director of the CSIS Technology and Public Policy Program. The commission, made up of 32 cybersecurity experts, plans to finish its work by the end of 2008.Co-chairmen of the commission are retired Admiral Bobby Inman, former director of the U.S. National Security Agency; Scott Charney, corporate vice president for trustworthy computing at Microsoft; U.S. Representative Jim Langevin, a Rhode Island Democrat and chairman of the Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology; and Representative Michael McCaul of Texas, the ranking Republican on the subcommittee.Cyberthreats against the U.S.&#160;are growing, and it&#39;s&#160;important for Congress and the next president to take action, Langevin said. In the past year, his committee has investigated hundreds of cyberbreaches within the U.S. government.Langevin remains concerned about U.S. government networks, he said. The U.S. Department of Homeland Security reported 844 cybersecurity incidents in fiscal years 2005 and 2006, he noted.When the lead agency for protecting the U.S. against cyberattacks has hundreds of vulnerabilities, &quot;we&#39;ve clearly reached an unacceptable situation,&quot; Langevin said.The commission will expect action on its recommendations, added McCaul. He promised to push the recommendations in the cybersecurity subcommittee.&quot;The time is now for action,&quot; he said. &quot;For any [presidential] administration, it&#39;d be unwise to ignore that.&quot;Among the members of the committee are three former cybersecurity directors at the White House Office of Management and Budget; former Federal Trade Commission member Orson Swindle; former DHS assistant secretary for cybersecurity Amit Yoran; former head of the U.S. Department of Justice computer crimes division Marty Stansell-Gamm; and executives with Oracle, EMC, Internet Security Systems, and Verizon Communications.
358672
DECEMBER 07, 2004 (REUTERS) - Computer security experts, including former government officials, urged the Bush administration today to devote more effort to strengthening defenses against viruses, hackers and other online threats.
731985
The US government is not taking cybersecurity seriously enough and should spend more money and energy on the topic, a group of computer security firms said Tuesday.
641744
A small group of IT security startups are hoping to cash in on the rise of the botnet scourge as businesses -- telecommunications carriers and Internet service providers, in particular -- seek new methods for stopping the attacks.
20487
Tech managers fear businesses are more vulnerable to malware because of wireless devices used by workers
769512
com September 30, 2004, 12:52 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
696118
Hoping to guide policy in President Bush's second term, the Cyber Security Industry Alliance today called for higher-profile leadership within the Dept. of Homeland Security. -washingtonpost.com
763821
Companies that have spent billions on cyberdefenses to thwart intruders are now addressing an even bigger threat: employees. Many are investing in software that monitors sensitive content inside corporate networks, say security analysts and venture capitalists.
86899
(InfoWorld) - U.S. President George Bush's 2008 budget request for $65.5 billion in IT spending across federal agencies reflects his priorities to cut budget deficits while improving cybersecurity and enhancing e-government services to U.S. citizens, Bush advisors said Wednesday. "It's clearly demonstrated by our actions in this past year that the [cybersecurity] plans we've had in place aren't necessarily working," said Karen Evans, administrator of e-government and information technology in the White House Office of Management and Budget (OMB). "It's important for us ... that we have the trust of the American people that we'll protect their information." The U.S. government this year will focus heavily on IT security after reports of data breaches in 2006. The White House, working with federal auditors and Congress, will lean on agencies to improve cybersecurity using their existing resources, Evans said. Evans, during a press conference, didn't mention specific data breaches from 2006, but the Department of Veterans Affairs (VA) in MayÂ reported a laptop and hard drive containing the personal information of 26.5 million military veterans and their families stolen from an employee's home. Police later recovered the hardware, but the announcement set off a storm of criticism from Congress. The lost VA equipment prompted a congressional review of other government agencies, and they reported thousands of laptops missing in the last five years. OMB will encourage some smaller agencies to contract with larger ones for network access and security, Evans said. OMB will also ask many agencies to focus on internal problems that lead to lost data, not just on external threats, she said. Some agencies are spending a disproportionate amount on fighting external threats when the majority of cybersecurity problems are internal, she said. Bush's 2008 budget includes a 2.6 percent spending increase for IT, compared to his 2007 budget request. Of the $65.5 billion, $31.4 billion would go to the U.S. Department of Defense, $5.6 billion to the Department of Health and Human Services, and $4.1 billion to the Department of Homeland Security. DOD would get a 2.1 percent increase in its IT budget over Bush's 2007 request, HHS would get a 9.9 percent increase, and DHS would get a 1.1 percent decrease. The U.S. Congress has not yet finalized the budget for the government's fiscal year 2007, which started in October. With Bush's 2008 budget, OMB for the first time released a list of government IT projects that auditors are concerned about. In 2008, there are 346 IT funding requests on OMB's management watch list, meaning the requests have not met criteria such as performance goals, security and privacy requirements, or program management standards. Federal agencies have made 840 funding requests for IT programs for fiscal year 2008. The 346 programs on the management watch list total about $14.4 billion, Evans said. Sixty-one of those watch-list requests are from the Department of the Treasury, 52 are from the Department of Homeland Security, and 37 are from the VA.
302175
com September 10, 2004, 1:42 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
408793
CEOs aren&#39;t doing enough to address the myriad IT security threats that loom large. At least that&#39;s what Ernst &amp; Young concluded from survey results it released today.
738930
(InfoWorld) - The Cyber Security Industry Alliance has given the U.S. government D grades on its cybersecurity efforts in 2006, and renewed its call for the U.S. Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government D grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. "Government needs to take these issues very seriously," said Liz Gasster, the CSIA's acting executive director and general counsel. Among the problems in 2006: The U.S. Department ofÂ Veterans Affairs reported a data breach involving the personal information of 26.5 million military veterans and family members. Other agencies also reported multiple lost laptops containing personal information. The CSIA called on agencies to notify citizens of data breaches. After a rash of reported data breaches in early 2005, members of Congress introduced multiple bills requiring companies with data breaches to notify affected consumers. ButÂ a breach-notification law failed to pass, partly because of jurisdictional fights between multiple congressional committees. A comprehensive data security bill should include breach notification, but also a requirement that all organizations holding sensitive data -- including private companies, government agencies, nonprofits, and educational institutions -- use reasonable security standards, Gasster said. The U.S. Federal Trade Commission has taken action against several companies, but a comprehensive law would give the FTC or another agency broad jurisdiction to investigate data breaches, she said. The CSIA is optimistic a comprehensive data breach law will pass in the next year, even though it stalled in the last Congress, Gasster added. Major data breaches continue to happen, and consumers will increase the pressure on Congress to act, she predicted. In mid-January, retailerÂ TJX Companies Inc. reported a massive data breach. "Consumers just are not going to put up with is," Gasster said. Here's how the CSIA generated its government cybersecurity grades: -- Security of sensitive information, grade D: Congress ratified the Council of Europe Convention on Cyber Crime, allowing the U.S. to work with other signatories on cybersecurity investigations, but failed to pass a comprehensive law to protect sensitive personal information. -- Security and resiliency of the critical information infrastructure, grade D: The Department of Homeland Security appointed an assistant secretary for cybersecurity and telecommunications and implemented some cybersecurity program, but it hasnât offered a clear agenda for its top cybersecurity research and development priorities or established a survivable emergency coordination network to handle a large-scale cybersecurity disaster. -- Federal information assurance, grade D: Government continues to offer a "mixed bag of successes and failures," the CSIA said, with progress within the White House Office of Management and Budget's enforcement of cybersecurity directives and implementation of U.S. President George Bush's Homeland Security Presidential Directive 12, requiring agencies to start issuing smart identification cards. But the government needs to do a better job in several areas, including security issues with telecommuting and releasing information on the cost of cyberattacks, the CSIA said. In addition to a comprehensive data protection bill, CSIA called for the U.S. government to strengthen the power of agency chief information officers and called on agencies to increase testing of cybersecurity controls.
545027
The U.S. government has warned banking, stock trading, and other financial Web sites of a potential cyber attack today, but officials and experts alike caution against undue alarm.