A few steps forward, a few back

Amit Yoran recently described his one-year tenure as the government's cybersecurity czar as 'an interesting political experience' and assessed his accomplishments with a combination of satisfaction and frustration.'I believe we were successful in building the start-up capability we were asked to build,' he said at a Washington conference hosted by the Computer Security Institute.On the other hand, he said, 'the government really doesn't know what its IT assets are' and is doing an inadequate job of certifying its systems and software for security.Yoran came to the job of director of the Homeland Security Department's National Cyber Security Division with the perspectives of an engineer and entrepreneur. This led him to attempt to map the government's IP address space and Internet exposure for the first time.'It's not yet complete, but we have tabled out what the address space looks like,' he said.The engineer's hands-on approach also contributed to his abrupt departure from the job in September.'Maybe that's not the right fit for the job,' he said. 'Like any large organization, there is a fair degree of bureaucracy.'Yoran was appointed cybersecurity chief in September 2003 after months of complaints from security professionals that the administration was not giving enough attention to cybersecurity. The presidential adviser's position had been eliminated in the White House, and DHS had no one who was focused on the job of securing information systems.Even after creation of DHS' National Cyber Security Division, there were complaints that Yoran's position was too far down in the department's management chain to be effective.For his part, Yoran found the scope of the job daunting. 'How do you go about securing cyberspace?' he said.He tried to take a practical approach, he said, with both long- and short-term programs. At the strategic level, the department has funded research into tools that aid in software development. Perpetuating known coding errors is a common source of security flaws in software, and automating the quality assurance process could change the current attack-and-patch cycle of IT systems, he said.'DHS cannot by itself change the way software is developed, but we can encourage and help in the adoption of some of the new tools,' he said.Although improved software development is a necessary long-term goal for improving security, it will not have immediate impact, Yoran said.'You have to be realistic about how long it is going to take to produce a more secure infrastructure,' he said. 'To refresh some of our critical infrastructure systems is going to take years, if not decades.'Looking for a more immediate impact, Yoran set out to more accurately define the government's IT space.'The first thing I asked was, What does our address space look like?' he said.When he found no one knew the answer, he began the program to map government IP addresses. The project has identified 5,700 network blocks of varying sizes. A second program to identify the Internet exposure of those networks is under way.'The work is not yet done, but we have been scanning the 127 agencies and the 5,700 network blocks,' he said.The next step will be to analyze the data from the scans to produce vulnerability profiles that can be acted upon by the agencies that own the networks.Another area where Yoran said much work remains to be done is in software testing and certification. The current Common Criteria evaluation scheme, run by the National Institute of Standards and Technology and the National Security Agency under the National Information Assurance Partnership, is not much of an improvement over the Orange Book standards it replaced, he said.'Government has done an inadequate job of revolutionizing the process,' he said.Vendors still must subject software to subjective multimillion-dollar reviews that take months to complete and only validate vendor claims in the end. Agencies bound to products with Common Criteria certifications often do not have access to more up-to-date, improved products, Yoran said.'You get all kinds of game-playing, and it doesn't encourage government to work with industry' to create innovative, reliable software, he said. 'The current process is counterproductive.'Yoran also found fault with the certification and accreditation process required for essential government systems under the Federal Information Security Management Act. He said the evaluations are impractical and focus too much on paperwork.'It may be academically accurate, but it leaves a lot of room for improvement,' he said.Yoran's former deputy, Andy Purdy, now is acting cybersecurity director at DHS. There have been proposals, some from lawmakers, that the security chief be made an assistant secretary within the department or the position moved into the White House.Yoran said he felt his position was at the proper organizational level for the job that he had been asked to do. But he refused to speculate on where his replacement should be within in the department.'Let the folks who do the organizational structures craft the structure that will be most effective,' he said.He said his replacement probably should be someone who is better at maneuvering through the bureaucracy than he had been.'I am optimistic you will be able to recruit high-caliber folks who will step up to the job,' he said.