Obama's Cybersecurity Push: What It Means for CIOs
President Obama aims to fix U.S. cybersecurity, but can the feds hit a moving target? Not without private sector support and practical solutions.
>
At least 34 federal mandates, regulations and laws apply to the IT inside companies that touch critical infrastructure in the United States, according to the GAO. What's more, it's a collection of rules that no one person, or even one agency or department, oversees. The assortment includes the Food and Drug Administration, Office of the Comptroller of Currency, Securities and Exchange Commission, Federal Energy Regulatory Commission and the Departments of Treasury, Homeland Security and Interior. Fragmentation means security standards across industries, measured and monitored uniformly, don't exist. Therefore, neither does a good answer to the question, "How secure is the U.S. digital infrastructure?"
Gilligan, like other security gurus, supports the idea of an official to coordinate cybersecurity and related efforts, but warns it's a big, political job to rationalize the crazy quilt of security mandates. The official must coordinate various federal bodies as well as private industry and academia. "Doing this, we would begin to have a cohesive strategy," Gilligan says. "Right now, it's free agents" working for their own organizations' interests.
Formulating long-term strategy gets pushed aside when the focus is on dealing with daily tactical issues or "Whac-A-Mole security," says Daniel Mintz, a CTO at consulting firm CSC and former CIO at the U.S. Department of Transportation (DoT). "The current approach of trying to do everything, everywhere, results in accomplishing little, anywhere," he says.
Last year, under George W. Bush, the government devised a cybersecurity plan called the Comprehensive National Cyber Security Initiative, aimed mainly at protecting systems related to the Department of Homeland Security. That's a narrow swath of cyberspace and, because the work is classified, it's hard to tell how effective it's been. Obama has pledged to be "transparent" about the process and seek out advice from the private sector. But the idea of government imposing new rules for industry sends up a red flag for some. Industry can usually patrol itself, maintains Larson, the former security director at American Water, provided there are market incentives to do so. "If you're a large, publicly owned entity, your board is not going to let you get away without identifying risks and mitigating them. That's market forces at work."
The Changing Threat
When government officials officially talk security, most of the scenes they paint involve malicious people taking down major systems. In turn, we are assured that government and corporate entities have reliable backups.
But that's not the way cyberattackers are behaving, says Eugene H. Spafford, executive director of the Center for Education and Research in Information Assurance and Security. The center is affiliated with Purdue University where a year ago, then-Senator Obama held a summit on security challenges. A trend security experts say is more insidious is attacks that come as subtle changes to data rather than complete denial of service.
Security
Receive the latest security news as it breaks.
