CIO —
Ed Lazowska holds the Bill & Melinda Gates Chair in Computer Science & Engineering at the University of Washington, where he specializes in the design, implementation and analysis of high-performance computing and communication systems. In May 2003, President Bush appointed him cochairman of the president’s Information Technology Advisory Committee (PITAC) from 2003 to 2005. PITAC, created by an act of Congress in 1991, is made up of experts from both academia and the private sector who advise the President on IT issues. It has traditionally been one of the most important mechanisms that the government has to ensure that the nation’s R&D programs have the appropriate scope and direction to keep the country at the forefront of the IT industry. Under Lazowska’s leadership, PITAC studied three issues: IT for health care, the future of computational science and cybersecurity. PITAC’s report on cybersecurity, called "Cyber Security: A Crisis of Prioritization," was published in February. "The title nicely summarizes our findings," says Lazowska. "There is a crisis, and it is due to a failure to adequately prioritize this issue—a failure by CIOs, and a failure by the federal government."
Lazowska doesn’t pull any punches when discussing the Bush administration’s approach to the issue. "In my opinion," he says, "this administration does not value science, engineering, advanced education and research as much as it should—as much as the future health of the nation requires." As a result, he says, the private sector—and CIOs in particular—won’t be able to buy the products that they need to truly be secure unless they demand more from their government and, just as importantly, show a commitment to cybersecurity by paying for state of the artproducts.
CIO: You’re not very optimistic about the state of U.S. cybersecurity. What is the one-minute version of the problem?
Ed Lazowska: There is a big gap between what we already know about cybersecurity and our deployment of technologies and processes to improve it. That’s a CIO problem. There’s also a big gap between what we already know about cybersecurity and what we need to know in order to engineer adequately secure systems for the long-term future. That’s a federal government problem, because the federal government is responsible for R&D that looks out more than one product cycle—R&D such as engineering a more secure version of the Internet (see "Blame the Internet," Page 84).
In your report to the president, you concluded that IT infrastructure is highly vulnerable. What are some of the key vulnerabilities?
We see some of the effects of cybervulnerabilities on a daily basis on the front page of our newspapers: phishing attacks, pharming attacks, denial-of-service attacks and large-scale disclosure of credit card information. Even phishing attacks, which seem easy to dismiss as a gullibility problem, arise from the basic design of the protocols we use today, which make it impossible to determine the source of a network communication with certainty.
