Cybersecurity Strategy: A Work in Progress

Richard Clarke didn’t want to create just another one of those reports that Washington churns out as easily as network TV cranks out new reality shows. But in trying to meet the impossible challenge of pleasing politicians, private industry and public users alike, that may be exactly what the president’s cybersecurity adviser has done. A 64-page document released in September, titled "The National Strategy to Secure Cyberspace," is less a strategy with specific action items than a list of best practices, recommendations and suggestions.

The good news is that it is a draft. In the past year, the White House has sponsored four town hall meetings around the country and published 53 sets of key questions to spark public debate. But Clarke and strategy coauthor Howard Schmidt, vice chair of President Bush’s Critical Infrastructure Protection Board, claim they need even more input before a final strategy is produced.

Jim Dempsey, deputy director with the Washington, D.C.-based Center for Democracy and Technology, a pro-civil liberties lobbying group, believes the strategy might not have sufficient incentives for private industry to act, but he’s not sure where the pressure to be secure should come from. "I think [the government] correctly recognized that they could not take a regulatory approach, but that still leaves open the question of whether we in society have the right mix of incentives for security," says Dempsey.

If government and private industry are unable to agree on security needs and mandates, the future security of cyberspace is in jeopardy, says RSA Security President and CEO Arthur Coviello. "I was a little disappointed that it was just a draft, but now people can debate it. The government has the opportunity to lead by example, to put their money where their mouth is," he says.

The White House is planning eight more town hall meetings and is accepting comments until Nov. 18 via e-mail at feed back@cybersecurity.gov. No date has been set for the final release of the guidelines, but as the draft strategy ironically argues, "good intentions and good beginnings are not the measure of success. Rather, the government will require demonstrated performance and results." For a copy of the cybersecurity strategy, go to www.white house.gov/nsc/nss.html.

-Julie Hanson

New Rules for Imports Will Save Supply Chain Costs

The government is going to help make your supply chain more efficient. Now stifle that laugh. U.S. Customs regulations proposed in August require data about imports to be reported to the Customs agency 24 hours before the goods are loaded on any ship bound for the United States. That means you and your supply chain partners will have to share more information online. And it will save you money.