Security wars move to new turf

Andy Purdy, acting director of the National Cyber Security Division and U.S. Computer Emergency Response Team since April 2003, is the Homeland Security Department's lightning rod for preventing, responding to and recovering from electronic attacks.He helped launch the center in his job as White House senior adviser for IT security and privacy, a position he held from April 2002 to April 2003 while on detail from the Sentencing Commission. At the commission, Purdy worked as chief deputy general counsel from 1987 to April 2002. He also was counsel to the Senate Impeachment Trial Committee from July 1989 to October 1989.Purdy previously served as counsel to different congressional committees and was an assistant U.S. attorney for the Eastern District of Pennsylvania in Philadelphia.Purdy holds an undergraduate degree in government and economics from the College of William and Mary and a law degree from the University of Virginia. GCN senior writer Wilson P. Dizard III interviewed him by telephone.Purdy: There will be a much bigger cybercomponent. At the most significant level, we have formed the National Cyber Response Coordination Group, which is part of the whole National Response Plan. So the National Response Plan has all the elements and processes that physical and cyber [infrastructure defenders] would have when it's an incident of national significance.The NCRCG [activates] during a physical crisis. The Interagency Incident Management Group is stood up, as is the National Cyber Response Coordination Group.Purdy: We have been actively involved in the national intelligence estimate for cybersecurity. Most of it is classified. It is an example of where intelligence agencies and law enforcement have worked together to connect the dots on major threats from states and nonstate actors to make sure [they] have a common picture. Our law enforcement and intelligence folks are tracking malicious cyberactivity.There is an active involvement of criminal [elements] in electronic crime. I shouldn't be more specific at this time.Purdy: I don't look at it in terms of a monoculture. I look at it in two tracks. One is the existence and discovery of numerous vulnerabilities and challenges that pose risks and costs to system operations, to protect systems without damaging [them].Also we are actively involved in software assurance efforts to solve the problem that code is written with so many vulnerabilities.Purdy: I think one of the great efforts is in the area of access controls, where the move is toward two-factor authentication. It's something you have and something you know, like when you go to the bank [cash machine] with a card and a PIN. I think there will be substantial progress for stronger access controls in the next year. I think most trusted users will have three-factor identification: something you have, something you know and something you are.Purdy: In terms of DHS, the effort to raise and maintain the level of appropriate awareness is run by the CIO and chief information security officer. They have had very aggressive campaigns for educating employees. There have been very aggressive efforts in other agencies. Our agency, with the Office of Management and Budget, does intend to raise awareness.Purdy: The responsibility for our systems security rests with the CIO and chief information security officer. We have been in discussions and have a close relationship with those offices. We think we are moving ahead aggressively.Purdy: Right now there is a black market in malicious cybertools of attack that are focused on financial gain. I am troubled by the availability of those malicious tools, particularly the ability to buy and grow botnets, which are networks of computers that are controlled by the perpetrator. [A botnet targets] computers of users who are unaware of that control. It means that, because of spyware and malicious code placed on computers, someone can use those computers to launch spam and steal personal identity information. They could also be used to launch denial-of-service and other serious attacks.The move from the script kiddies to significant organized criminal groups does give law enforcement targets to investigate. But we can't rely on law enforcement alone to deal with the risks posed by these malicious tools.Purdy: Our dependency on cyberspace and the risks [that entails] is one that requires vigilance and concerted action. The [National Cyber Security Division], in partnership with other agencies and the private sector, is proceeding with appropriate seriousness to reduce risks.Purdy: The road map is provided by the President's Management Agenda and the requirements of [the Federal Information Security Management Act] to bring their systems into a heightened state of cybersecurity readiness.Purdy: We are working in partnership with the Defense Department and others in our software assurance initiative trying to develop tools so that software can be reviewed and analyzed whether it is made domestically or overseas. Traditionally, regarding our national security information systems, there has been heightened scrutiny given to all products that are going to be acquired from foreign sources. The development of the tools is important.Purdy: We are pursuing our goals to strengthen our National Cyber Response system. We are improving the information flow about cybersecurity from federal agencies and building our relationships internationally as well.