DHS Gets Low Marks

Information security executives have a negative perception of the Department of Homeland Security. The color-coded alert system has proved useless.

Cybersecurity has become something of a standing joke inside DHS, a buried priority that was even rumored to be moving to the Office of Management and Budget, of all places. It’s also endured the departure of several appointees who left after only a few months, including Richard Clarke, Howard Schmidt and Amit Yoran. It seems DHS’s attitude toward information security is reflected in our respondents’ perception of how the agency has handled it. More respondents rated DHS’s handling of information security as “poor” than those who rated it “excellent” and “good” combined. DHS is also under pressure from Congress and other critics to either radically change or altogether scrap the color-coded alert system, and the numbers suggest that that’s the right move in terms of infosec, since it hardly registered, even with critical infrastructure companies, when the feds declared Orange Alerts.

Compliance? What’s That?

The majority of information security executives range from ambivalent (at best) to downright dismissive (at worst) about the intentions, effect and pertinence of security regulations.

One pwc analyst called these numbers scary, but which is scariest? Is it the comparatively low number of respondents who are in compliance? Or the shockingly high number of respondents who cop to not complying even though they know that they have to? Or could it be the startlingly low number who believe that the regulations apply to them? (The list of regulatory mandates in the survey was much longer, but other, lesser regulations showed a similar pattern.)

The third one may be the most telling. Just 11 percent of respondents said they needed to be in compliance with California’s SB 1386 law, which mandates that companies report breaches of personal data to consumers. In fact, any company that has even one customer in California must comply with the law, and surely more than 11 percent of U.S. respondents’ companies do business in our most populous state. Similarly, more than half said they didn’t need to comply with Sarbanes-Oxley, and four out of 10 respondents in the health-care industry said that the Health Insurance Portability and Accountability Act (HIPAA) didn’t apply to them, which seems impossible on the face of it.

But what do the numbers mean? Here are two theories, both of which probably play some role: One, the regs are confusing and difficult to comply with. This would explain the low numbers of respondents who believe they needed to comply with HIPAA or Gramm-Leach-Bliley regulations. They simply don’t understand how the rules apply to them. Another theory is that the regulations have, in respondents’ minds anyway, few if any teeth. Companies don’t fear any serious repercussions for not complying with the regulations, either because the mandates are too vague to really be enforced, or the regulatory agencies aren’t devoting resources to enforcement.