Industry calls for government to guide defense of IT infrastructure
Connecting state and local government leaders
A lack of coordination between government and industry hampers efforts to protect the nation's critical infrastructure from cyberattacks and mishaps, a panel of industry experts told the House Science Committee this month.
A lack of coordination between government and industry hampers efforts to protect the nation's critical infrastructure from cyberattacks and mishaps, a panel of industry experts told the House Science Committee this month.Each industry sector, including electrical power, petroleum, chemical and communications, is pursuing its own security and disaster recovery programs. But an overarching government policy to coordinate these plans has so far been lacking.'You couldn't shut down the entire country,' said Gerald Freese, director of enterprise information security for American Electric Power of Columbus, Ohio. 'That is a misconception.'But a concerted attack on the power grid could do considerable regional damage, he said.Vulnerabilities will increase as industries move operational controls from legacy systems to standardized platforms and public networks such as the Internet, said John Leggate, CIO of BP PLC of London. By 2007, many companies will face higher exposure to cyberattacks, he said.Witnesses identified three primary areas where improvement is needed to facilitate critical infrastructure defense:The Homeland Security Department is the lead agency for coordinating infrastructure protection in government. The department has been criticized for placing too low a priority on the subject, burying the lead official too low in its organizational chart. Secretary Michael Chertoff responded this summer by creating an assistant secretary position for cybersecurity and telecommunications.The Sept. 15 hearing was called to help develop a federal cybersecurity agenda, particularly for the new assistant secretary.Until the new position is filled, the department's lead IT security official is Donald 'Andy' Purdy, acting director of the National Cyber Security Division.Science Committee leaders criticized DHS progress in infrastructure protection since deficiencies were identified in the wake of the 2001 terrorist attacks.'After four years of working on this, we are not where we need to be,' said ranking Democrat Bart Gordon of Tennessee.Purdy defended the National Cyber Security Division's performance, saying it has established US-CERT as the primary national cyberspace response system and expects to complete the National Infrastructure Protection Plan later this year.But cooperation between industry and government still is being done primarily on an ad hoc basis.Chairman Sherwood Boehlert (R-N.Y.) said he was dissatisfied with levels of federal spending for cybersecurity R&D. He told industry representatives they should lobby Congress aggressively for higher R&D appropriations.'Please carry that back to your hired guns,' he advised them.Basic security R&D is needed because IT platforms on which critical infrastructures increasingly depend are evolving quickly.'Right now, we're working with obsolete equipment in a lot of cases,' Freese said.It is difficult to secure myriad one-of-a-kind systems, but the diversity also can add an element of security by not presenting commonly known vulnerabilities to attackers. That security disappears in the move to more efficient and cost-effective standardized platforms. To counter this trend, research is needed in secure software development and system interactivity, witnesses said.The threat level to the infrastructure as a whole is difficult to determine because of restrictions on sharing information.'We are vulnerable to an undetermined extent,' Freese said.'The private sector is caught between antitrust laws and freedom of information laws,' said David Kepler, CIO of Dow Chemical Co. of Midland, Mich. The laws limit the company's ability to share information, either with other companies or with the government, without fear of proprietary data being released to the public, he said.DHS has been asking for information on vulnerabilities from companies, but has gotten little, Freese said. 'It is extremely frustrating for them. We can't provide that to them because they can't protect it.'DHS has authority to exempt from the Freedom of Information Act private-sector data that is classified as protected critical infrastructure information. But private-sector witnesses were unsure of the status of that program at DHS.Purdy said that the program now is operating with interim rules for PCII classification and that final rules 'are expected momentarily.'
Andy Purdy, acting director of DHS' National Cyber Security Division, said final rules for classifying protected critical infrastructure information are expected soon.
Rick Steele
- Data sharing between the public and private sectors
- Government funding for IT security research and development
- Law enforcement efforts to identify and prevent attacks on the infrastructure.