Cybersecurity group celebrates its first birthday by looking ahead
Connecting state and local government leaders
The Computer Security Industry Alliance has "established a beachhead in Washington," executive director Paul Kurtz says.
SAN FRANCISCO'The Computer Security Industry Alliance had a busy first year, weighing in on federal anti-spyware legislation, evaluating the Common Criteria evaluation scheme and presenting the president with a cybersecurity to-do list.
"I think we've made tremendous progress in the first year," CSIA executive director Paul Kurtz said. "We have established a beachhead in Washington."
The group's agenda for the coming year includes suggesting reforms to the Common Criteria and continuing education for Congress and the private sector about information security.
CSIA, a CEO-led public policy and advocacy group in Washington for the IT security industry, is celebrating its first birthday this week at the RSA Security Conference. The twin factors that spurred the group's formation last year were the lack of a unified industry voice and a lack of government understanding on IT issues at a time of growing regulation, CSIA officials said.
"There was a shared concern about the total void of awareness of the need for cybersecurity throughout both the federal and the state and local levels," said John McNulty, CEO for Secure Computing Corp. of San Jose, Calif., a founding member of the alliance.
Some progress has been made in fostering awareness, McNulty said. "Without a doubt it has improved," he said. "Without a doubt, it still is not good enough."
"The security industry is a big, horizontal industry," said Tom Noonan, CEO of Internet Security Systems of Atlanta, another founding member. "There had never been any organization focused exclusively on security. [Industry officials] were being called to Washington more and more, to testify before Congress and educate staffers and officials. We were being called upon to present a unified industry face, and we weren't organized to have one."
CSIA was established with 12 corporate members at last year's RSA Conference to provide a corporate voice in security policy debates. It has grown to 16 members. Noonan calls the group's formation its most significant accomplishment, to date.
"Don't underestimate the amount of energy required to organize and fund a group like this," he said.
Among its first efforts was for Kurtz, a former presidential adviser, to help fine-tune anti-spyware legislation.
"The way it was originally written would have been a disaster," requiring continuous user consent for such security features as automatic updating of antivirus signatures, McNulty said. Lawmakers changed the language, to allow for a single consent to enable automatic updates.
The group also sent President Bush a list of recommendations it says the government should undertake to improve the nation's cybersecurity. These included creating an assistant secretary for cybersecurity at the Homeland Security Department, establishing an emergency coordination network, and expanding funding for basic research and standards development [see GCN story].
At a Common Criteria users meeting last summer, the alliance aired complaints about the multinational security certification program. Software is evaluated against vendor claims or user requirements. The program is overseen in the United States by the National Information Assurance Partnership, a collaboration between the National Institute of Standards and Technology and the National Security Agency. IT vendors have long called the process burdensome.
"It is very inefficient," Kurtz said. "There is a lot of paperwork and cost associated with it, and at the end of the day the number of agencies actually buying NIAP-certified products is quite small."
There is a need for a security certification program, McNulty said. But, "it's not right yet." He pointed to his company's experience with its Sidewinder firewall.
"We spent a ton of money getting it certified and keeping it up," he said. "Every time we make a new release, we resubmit" for certification. But the Common Criteria is not mandated for government buyers, so the program is something of a paper tiger, he said.
CSIA is planning a second users forum this year to explore ways to improve the program.
Also on the alliance's agenda for the coming year:
- Keeping tabs on new federal, state, local and international regulations, as well as evaluating existing regulatory requirements such as those in the Sarbanes-Oxley Act.
- Monitoring security implications of moving health care records into the digital world.
- Adressing security concerns in technologies such as voice over IP and radio frequency identification, which are becoming widely adopted in government and the private sector.
- Having a say in legislation as Congress continues to address IT problems such as spyware and phishing.
NEXT STORY: Security conference kicks off with FISMA focus