Much work remains to secure U.S. cyberinfrastructure, industry group says
Connecting state and local government leaders
DHS finally named an assistant secretary for cybersecurity last year, and the Senate ratified the first international treaty on cybercrime.
SAN FRANCISCO ' The Homeland Security Department finally named an assistant secretary for cybersecurity last year, and the Senate ratified the first international treaty on cybercrime.
The Computer Security Industry Alliance had lobbied for these achievements for more than two years and counts them as big wins, said acting executive director Liz Gasster. But the nation still lacks a comprehensive data security law, and DHS needs to develop response and recovery plans for disruptions of our critical infrastructure.
These challenges, along with a reworking of the Federal Information Security Management Act, are among the priorities for CSIA in its fourth year, Gasster said.
CSIA, celebrating its third birthday this week at the annual RSA cybersecurity conference, is a CEO-led public policy and advocacy group formed in 2004. It was established with 12 corporate members to give the security industry a unified voice in Washington and since has doubled its membership to 24 companies.
CSIA has set out a cybersecurity agenda for government for the last two years, with only indifferent results. In its Federal Progress Report for 2006, it gave the administration an overall grade of D because of failures to pass privacy legislation and to set clear priorities for future work.
U.S. ratification of the Council of Europe's Convention on Cybercrime was a major objective of CSIA from the beginning. It is the first treaty requiring cooperation among law enforcement agencies in different counties in the investigation and prosecution of online fraud and other computer crimes. Forty nations have signed the treaty, which went into effect in July 2004, and 18 have ratified it. The U.S. Senate ratified it in August.
'That is particularly important,' Gasster said, because the convention will help put pressure on other countries, including non-signatory countries, to bring their laws into line with the treaty.
In September, Greg Garcia was named to the long-awaited and long-vacant post of assistant secretary for cybersecurity and telecommunications at DHS. The new position raises the profile of cybersecurity within the department, and industry groups have lobbied for it since the creation of DHS in 2003.
Gasster praised the appointment, but said it is only a first step.
'It's just the beginning of more work DHS needs to do,' she said. 'They try to have their hands in all things cybersecurity,' including public awareness and research and development programs. But there is a lack of focus on the nuts and bolts of dealing with a major cyberdisruption. 'We are concerned that there isn't the leadership structure to respond to such a situation,' she said.
Gasster said DHS needs to concentrate on three areas:
- A command-and-control structure for response to a cyberemergency
- A situational awareness system to let responders see what is happening across the Internet in near real time so that disruptions can be quickly identified
- An emergency communications plan that includes not only how to keep communications working during a crisis, but also who in the private sector would be responsible for responding to disruptions of the infrastructure.