Security pros find cyberspace review lacking
Connecting state and local government leaders
Industry security experts say the Cyberspace Policy Review could use greater detail on identifying threats, offering legal protection for security and the extent of powers held by the cybersecurity coordinator.
The Cyberspace Policy Review unveiled last month by President Barack Obama, and the creation of a new cybersecurity coordinator position, though a positive step, is lacking in the details, according to several industry security experts.
The 76-page Cyberspace Policy Review report (PDF) found that America's current architecture in the public and private sector lacks both "security and resilience."
"Without major advances in the security of these systems or significant change in how they are constructed or operated, it is doubtful that the United States can protect itself from the growing threat of cyber crime and state-sponsored intrusions and operations," the report said.
Software security experts already working in the trenches had a few pointers to add.
Chris Schwartzbauer, senior vice president of Shavlik Technologies, said via e-mail that the report doesn't have "enough focus on where the threat is coming from, nor [on] reducing the response time to those threats." Such a focus would better help with any defensive measures taken, he added.
"Our government can lead the way here by setting some basic security standards like the FDCC, Federal Desktop Core Configuration," Schwartzbauer said. "FDCC focuses on the basics of controlling and protecting the systems on our nation's networks."
Phil Lieberman, president of Lieberman Software, criticized the report on the legal front.
"There needs to be a bright line of reasonable care for enterprises as well as incentives to implement strengthened cybersecurity," Leiberman said. "The statement needs to go further and provide a legal safe harbor for organizations that implement security and also a waiver of liability for those organizations that share breach information."
Other security pros feel that the acute need for cybersecurity mandates participation at all levels, especially because of the government's pervasive use of private industry. Indeed, page 17 of the report calls for public-private partnerships. It also recommends collaboration between state and local governments, as well as with academic circles.
"A multi-pronged attack will be required," said Randy Abrams, ESET's Director of Technical Education. "The cybercriminals are very well organized. A modicum of security is unattainable if the government as well as the private sector does not learn to organize to combat the threat."
ESET recently established a Securing Our eCity portal to help consumers with cybersecurity issues. The company cites a national poll of 1,000 U.S. adults, conducted by Competitive Edge Research and Communication Inc., in which 65 percent said they would favor increased governmental involvement in cybersecurity. It's a very timely finding, Abrams said.
Obama said a search is being conducted for a "cybersecurity coordinator" who will identify key threat areas. How much power and leeway that person will have remains to be seen, but challenges lie ahead.
"The challenges facing a cyber czar are complex because the backbone of the Internet itself, and the majority of Internet infrastructure, is in the hands of the private sector," said Abe Kleinfeld, CEO of security firm nCircle.
Kleinfeld wondered whether the new coordinator will have the power to quickly "mobilize defenses against any serious cyberattack."
"And if (he/she) does, who would he call to protect assets that are in the hands of the private sector? Would the private sector, whose success has been determined by innovation and invention, be willing to take orders from the public sector when it is widely perceived to be far behind in the area of cybersecurity?"
Coordinating the number of parties involved poses a steep challenge.
"This distribution of assets makes the Internet more resilient, but it also makes it a challenge to defend," Kleinfeld said. "A program that would provide substantive protection for U.S. Internet assets would require a deep partnership between the public and private sectors, and any kind of security cooperation on this scale has yet to be achieved."