Obama's Cybersecurity Push: What It Means for CIOs
President Obama aims to fix U.S. cybersecurity, but can the feds hit a moving target? Not without private sector support and practical solutions.
>
Corrupting data in the financial system by introducing errors would spread fear about the accuracy of bank records. People, perhaps countries, now distrustful of the system would pull their money out en masse. Computer break-ins that mess with the electric grid or the healthcare system or the air traffic control system could kill people, Spafford says.
"Suppose all the flight control systems get altered to direct planes into each other rather than have the screens go blank," he says. So far, such a calamity hasn't happened. But if it did, Spafford adds, "the result would be a lack of confidence in the system even when it was restored."
Covering the most critical security gaps, not just the obvious ones, then, becomes imperative, Gilligan says. "Especially in today's environment," he says, "it wouldn't take much to push us even further into recession or depression."
Corporate IT leaders can adopt some protection methods commonly used by government, such as encrypting sensitive data as well as application software when doing backups. But other tactics don't make sense in the corporate realm.
At the U.S. Department of Defense, for example, just 10 of its thousands of computing sites are connected to the Internet, says Rear Admiral Elizabeth Hight, vice director of the Defense Information Systems Agency, which supplies much of the infrastructure IT to the DoD.
Fewer connections to the public networks mean fewer points of vulnerability, Hight says. But today, keeping a company off the Internet probably means putting a company out of business.
Practical Solutions
So what to do? One proposal gaining attention in Washington is the Consensus Audit Guidelines. Gilligan worked to develop them with security research and training group The SANS Institute, the Center for Strategic and International Studies, as well as other security experts and practitioners inside and outside government. The guidelines emphasize simplicity. Rather than dive deep into technology or debate which agency should oversee another, the guidelines put forth 20 basic management and process ideas, the underlying principle of which is frequent monitoring and measuring of whatever you're doing to thwart the most common patterns of cyberattack.
The guidelines, says Eugene Schultz, CTO of consulting firm Emagined Security, "are about how you perceive the problem and how you manage it with limited resources. It's very real-world."
That's a good approach, security experts say, as cybercriminals continually adjust their patterns and tools. Not only that, but most are steps that every CIO could take today without spending a ton of money.
Security
Receive the latest security news as it breaks.
