Cybersecurity Policy Will Pose Challenges, Security Pros Say

Now that there's some movement toward a U.S. cybersecurity policy, it's time to roll up the sleeves and get to work, and that task won't be easy, software security experts suggested on Friday.

A number of industry security experts voiced their views as President Barack Obama unveiled a "Cyberspace Policy Review" document on Friday. Obama also announced a new White House position to be filled, called the cybersecurity coordinator.

The 76-page Cyberspace Policy Review report (PDF) found that America's current architecture in sectors both public and private lacks both "security and resilience."

"Without major advances in the security of these systems or significant change in how they are constructed or operated, it is doubtful that the United States can protect itself from the growing threat of cybercrime and state-sponsored intrusions and operations," the report said.

Software security experts already working in the trenches had a few pointers to add.

Chris Schwartzbauer, senior vice president of Shavlik Technologies, said of the report via e-mail that there wasn't "enough focus on where the threat is coming from, nor [on] reducing the response time to those threats." Such a focus would better help with any defensive measures taken, he added.

"Our government can lead the way here by setting some basic security standards like the FDCC, Federal Desktop Core Configuration," Schwartzbauer said. "FDCC focuses on the basics of controlling and protecting the systems on our nation's networks."

Phil Lieberman, president of Lieberman Software, criticized the report on the legal front.

"There needs to be a bright line of reasonable care for enterprises as well as incentives to implement strengthened cybersecurity," Leiberman said. "The statement needs to go further and provide a legal safe harbor for organizations that implement security and also a waiver of liability for those organizations that share breach information."

Other security pros feel that the acute need for cybersecurity mandates participation at all levels, especially because of the government's pervasive use of private industry. Indeed, page 17 of the report calls for public-private partnerships. It also recommends collaboration between state and local governments, as well as with academic circles.

"A multi-pronged attack will be required," said ESET's Director of Technical Education, Randy Abrams. "The cybercriminals are very well organized. A modicum of security is unattainable if the government as well as the private sector does not learn to organize to combat the threat."

ESET recently established a Securing Our eCity portal to help consumers with cybersecurity issues. The company cites a national poll of 1,000 U.S. adults, conducted by Competitive Edge Research and Communication Inc., in which 65 percent said they'd favor increased governmental involvement in cybersecurity. It's a very timely finding, Abrams said.

President Obama said a search is being conducted for a "cybersecurity coordinator" who will identify key threat areas. How much power and leeway that person will have remains to be seen, but challenges lie ahead.

"The challenges facing a cyber czar are complex because the backbone of the Internet itself, and the majority of Internet infrastructure, is in the hands of the private sector," said Abe Kleinfeld, CEO of security firm nCircle.

Kleinfeld wonders whether the new coordinator will have the power to quickly "mobilize defenses against any serious cyber attack."

"And if (he/she) does, who would he call to protect assets that are in the hands of the private sector? Would the private sector, whose success has been determined by innovation and invention, be willing to take orders from the public sector when it is widely perceived to be far behind in the area of cybersecurity?"

Coordinating the number of parties involved poses a steep challenge.

"This distribution of assets makes the Internet more resilient, but it also makes it a challenge to defend," Kleinfeld said. "A program that would provide substantive protection for U.S. Internet assets would require a deep partnership between the public and private sectors, and any kind of security cooperation on this scale has yet to be achieved."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.


  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group