Cybersecurity Policy Will Pose Challenges, Security Pros Say

Now that there's some movement toward a U.S. cybersecurity policy, it's time to roll up the sleeves and get to work, and that task won't be easy, software security experts suggested on Friday.

A number of industry security experts voiced their views as President Barack Obama unveiled a "Cyberspace Policy Review" document on Friday. Obama also announced a new White House position to be filled, called the cybersecurity coordinator.

The 76-page Cyberspace Policy Review report (PDF) found that America's current architecture in sectors both public and private lacks both "security and resilience."

"Without major advances in the security of these systems or significant change in how they are constructed or operated, it is doubtful that the United States can protect itself from the growing threat of cybercrime and state-sponsored intrusions and operations," the report said.

Software security experts already working in the trenches had a few pointers to add.

Chris Schwartzbauer, senior vice president of Shavlik Technologies, said of the report via e-mail that there wasn't "enough focus on where the threat is coming from, nor [on] reducing the response time to those threats." Such a focus would better help with any defensive measures taken, he added.

"Our government can lead the way here by setting some basic security standards like the FDCC, Federal Desktop Core Configuration," Schwartzbauer said. "FDCC focuses on the basics of controlling and protecting the systems on our nation's networks."

Phil Lieberman, president of Lieberman Software, criticized the report on the legal front.

"There needs to be a bright line of reasonable care for enterprises as well as incentives to implement strengthened cybersecurity," Leiberman said. "The statement needs to go further and provide a legal safe harbor for organizations that implement security and also a waiver of liability for those organizations that share breach information."

Other security pros feel that the acute need for cybersecurity mandates participation at all levels, especially because of the government's pervasive use of private industry. Indeed, page 17 of the report calls for public-private partnerships. It also recommends collaboration between state and local governments, as well as with academic circles.

"A multi-pronged attack will be required," said ESET's Director of Technical Education, Randy Abrams. "The cybercriminals are very well organized. A modicum of security is unattainable if the government as well as the private sector does not learn to organize to combat the threat."

ESET recently established a Securing Our eCity portal to help consumers with cybersecurity issues. The company cites a national poll of 1,000 U.S. adults, conducted by Competitive Edge Research and Communication Inc., in which 65 percent said they'd favor increased governmental involvement in cybersecurity. It's a very timely finding, Abrams said.

President Obama said a search is being conducted for a "cybersecurity coordinator" who will identify key threat areas. How much power and leeway that person will have remains to be seen, but challenges lie ahead.

"The challenges facing a cyber czar are complex because the backbone of the Internet itself, and the majority of Internet infrastructure, is in the hands of the private sector," said Abe Kleinfeld, CEO of security firm nCircle.

Kleinfeld wonders whether the new coordinator will have the power to quickly "mobilize defenses against any serious cyber attack."

"And if (he/she) does, who would he call to protect assets that are in the hands of the private sector? Would the private sector, whose success has been determined by innovation and invention, be willing to take orders from the public sector when it is widely perceived to be far behind in the area of cybersecurity?"

Coordinating the number of parties involved poses a steep challenge.

"This distribution of assets makes the Internet more resilient, but it also makes it a challenge to defend," Kleinfeld said. "A program that would provide substantive protection for U.S. Internet assets would require a deep partnership between the public and private sectors, and any kind of security cooperation on this scale has yet to be achieved."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group