| Network Security Consulting SecurityFocus Article
Commission Calls For Cybersecurity Czar Security Article by Robert Lemos - SecurityFocus
http://www.securityfocus.com/news/11540
2008-12-08 A group of technology and government experts called on Monday for the next U.S. administration to create a National Office for Cyberspace and focus more heavily on securing corporate and federal networks, or face continuing economic losses due to online espionage. In a 94-page report released on Monday, the Commission on Cybersecurity for the 44th Presidency stressed that the next U.S. administration — currently being formed by President-elect Barack Obama — must treat incursions into the nation's networks as a serious problem, akin to nuclear non-proliferation and combatting terrorism. "America's failure to protect cyberspace is one of the most urgent national security priorities facing the new administration," the commission stated in the report. "Weak cybersecurity dilutes our investment in innovation while subsidizing the research and development efforts of foreign competitors. In the new global competition, where economic strength and technological leadership are as important to national power as military force, failing to secure cyberspace puts us at a disadvantage." The report is the culmination of a 14-month effort, organized by the Center for Strategic and International Studies, to help the next president of the United States create a more effective cyberspace policy. The task force formed amongst increasing worries that state-sponsored spies and online intruders were breaching sensitive government and industry computer systems, stealing valuable information. For the past two years, congressional committees have taken an increasing interest in federal agencies' failure to protect themselves against online attacks. The Department of State acknowledged in June 2006 that attackers had installed remote access software on systems in the agency and abroad, stolen passwords and targeted information on China and North Korea. In October 2006, the Department of Commerce took hundreds of computers offline following a series of attacks aimed at federal employees' computer accounts by online thieves that appear to be based in China. Last month, Newsweek reported that computers at both the Obama campaign and the McCain campaign had been breached during the summer by what U.S. officials stated were foreign attackers. While many policy makers and security experts worried about terrorist-sponsored cyberattacks following September 11, the most damaging intrusions have been those that have led to the loss of intellectual property, the report stated. The loss from such attacks is hard to gauge, said James Lewis, a senior fellow with the Center for Strategic and International Studies, who worked on the commission report. One government agency who fights such attacks estimated losses in the billions of dollars, he said. "A lot of spending in the coming administration will be on innovation in the U.S.," Lewis said. "But it doesn't do us any good, if our competitors can download that information for free." Cybersecurity has not been a major priority for past administrations. In 1998, President Clinton signed Presidential Decision Directive No. 63, which required agencies to take steps to protect eight critical infrastructures. In 2000, the Clinton Administration unveiled its National Plan to Protect Critical Infrastructure, but failed to fund critical programs to push federal agencies to secure their systems. While many of those agencies have slowly improved their security compliance scores under the Federal Information System Management Act (FISMA) of 2002, the Bush Administration has also largely failed to create strong recommendations or requirements to improve cybersecurity. In a 94-page report released on Monday, the Commission on Cybersecurity for the 44th Presidency stressed that the next U.S. administration — currently being formed by President-elect Barack Obama — must treat incursions into the nation's networks as a serious problem, akin to nuclear non-proliferation and combatting terrorism. "America's failure to protect cyberspace is one of the most urgent national security priorities facing the new administration," the commission stated in the report. "Weak cybersecurity dilutes our investment in innovation while subsidizing the research and development efforts of foreign competitors. In the new global competition, where economic strength and technological leadership are as important to national power as military force, failing to secure cyberspace puts us at a disadvantage." The report is the culmination of a 14-month effort, organized by the Center for Strategic and International Studies, to help the next president of the United States create a more effective cyberspace policy. The task force formed amongst increasing worries that state-sponsored spies and online intruders were breaching sensitive government and industry computer systems, stealing valuable information. For the past two years, congressional committees have taken an increasing interest in federal agencies' failure to protect themselves against online attacks. The Department of State acknowledged in June 2006 that attackers had installed remote access software on systems in the agency and abroad, stolen passwords and targeted information on China and North Korea. In October 2006, the Department of Commerce took hundreds of computers offline following a series of attacks aimed at federal employees' computer accounts by online thieves that appear to be based in China. Last month, Newsweek reported that computers at both the Obama campaign and the McCain campaign had been breached during the summer by what U.S. officials stated were foreign attackers. While many policy makers and security experts worried about terrorist-sponsored cyberattacks following September 11, the most damaging intrusions have been those that have led to the loss of intellectual property, the report stated. The loss from such attacks is hard to gauge, said James Lewis, a senior fellow with the Center for Strategic and International Studies, who worked on the commission report. One government agency who fights such attacks estimated losses in the billions of dollars, he said. "A lot of spending in the coming administration will be on innovation in the U.S.," Lewis said. "But it doesn't do us any good, if our competitors can download that information for free." Cybersecurity has not been a major priority for past administrations. In 1998, President Clinton signed Presidential Decision Directive No. 63, which required agencies to take steps to protect eight critical infrastructures. In 2000, the Clinton Administration unveiled its National Plan to Protect Critical Infrastructure, but failed to fund critical programs to push federal agencies to secure their systems. While many of those agencies have slowly improved their security compliance scores under the Federal Information System Management Act (FISMA) of 2002, the Bush Administration has also largely failed to create strong recommendations or requirements to improve cybersecurity. The commission aimed to change the lackluster presidential support. The report recommended that the Obama administration create a comprehensive strategy for cyberspace, declaring that it "is a vital national asset that the United States will protect using all instruments of national power." While such an effort starts with international diplomacy, the United States also needs to create the framework — or "doctrine" — to support military attacks through cyberspace, the report stated. Economic policy as well as intelligence and law-enforcement agencies round out the tools that the U.S. could bring to bear. The commission also called for the administration to establish a cybersecurity directorate within the National Security Council and the position of Assistant to the President for Cyberspace to create a strategy and advise the president. The post would be part of the National Office for Cyberspace, a group that would follow an approach similar to nuclear non-proliferation efforts, coordinating between agencies whose responsibilities directly impact cybersecurity. "The post is a recognition that the operational stuff at the Department of Homeland Security is fine, but you need to have a strategic view, which is what the White House does," said Marcus Sachs, executive director for government affairs at Verizon Communications and a commission member. "That is one of the key things that we think is missing: Treating cyberspace like a part of the essence of the country, the same as transportation, the military and the economy." Among its other recommendations, the commission called for better authentication for access to critical infrastructure. The federal government has already embarked on the use of strong identification documents & mdash; such as the Common Access Card — for physical access to sensitive installations. The same type of requirements should also apply to logical access to sensitive computers and control systems, said Lewis. "The control system of an electrical power facility, that should require strong authentication," he said. "But if you are accessing a monitoring device, then perhaps not." The commission also called for revamping current regulations to create more incentive for the operators of critical infrastructure to secure their systems. While the report concurred that the regulation of the Internet is a contentious issue, abandoning the development of defense to market forces has left the United States with scattershot protection. If the government adopts an approach similar to its Y2K initiatives — education and government leadership backed by regulations that force companies to disclose the steps taken to mitigate the problem — the policy could be much more effective, the report stated. Another approach could be to use the coming stimulus efforts to also require that companies invest in security, said Amit Yoran, CEO of NetWitness and a member of the commission. "One of the challenges is that many industries have not been good in securing their systems," Yoran said. "In this economic environment, it is entirely possible as you look at incentive programs and the stimulus, because there are a wide variety of ways to alter or improve behavior." If you have tips or insights on this topic, please contact SecurityFocus.
|
