U.S. not prepared for 'potentially devastating' cyberattacks, House panel told

Years of recommendations from the Government Accountability Office and inspectors general have failed to significantly improve the country’s cybersecurity posture at a time when the United States is becoming increasingly reliant on an interconnected information infrastructure, GAO’s director of information security issues told a House homeland security subcommittee March 16.

“The federal government continues to face significant challenges in protecting the nation’s cyber-reliant critical infrastructure and federal information systems,” said Gregory Wilshusen, GAO’s director of information security issues.

James Lewis, a senior fellow at the Center for Strategic and International Studies, advocated an aggressive defensive posture spearheaded by government at the national and international levels.

“Active defense is the future of cybersecurity,” Lewis said. “Active defense could be structured to operate like NORAD, where the Air Force protects our skies by focusing on foreign threats. It is not perfect, but it works, and other nations are deploying this kind of defense against foreign attacks.”

Related coverage:

Securing critical infrastructure needs holistic approach, panel says

The House Homeland Security Committee’s Cybersecurity, Infrastructure Protection and Security Technologies Subcommittee heard a familiar litany of threats to the nation’s critical infrastructure during the March 16 hearing: The amount of malware reported in 2010 tripled from the year before; the number of incidents reported by federal agencies to the U.S. Computer Emergency Readiness Team increased from 5,503 incidents in fiscal 2006 to 41,776 incidents in fiscal 2010; and government IT systems have remained on GAO’s list of high-risk programs since the 1990s.

“Pervasive and sustained cyberattacks against the United States continue to pose a potentially devastating impact on federal and nonfederal systems and operations,” Wilshusen said.

Lewis warned lawmakers that trotting out the same old recommendations for voluntary security controls and more public/private cooperation would not be effective.

“This is not a record of success,” he said. “Whatever we are doing is not working. Since 1998, we have repeatedly tried a combination of information sharing, market-based approaches, public/private partnership and self-regulation in a vain effort to strengthen our cyber defenses.”

The tried-and-failed strategies persist, he added, “due to a reluctance to make the changes cybersecurity requires. People still advocate strategies and policies that appeared more than a decade ago and which have not worked.”

The Homeland Security Department has primary responsibility for the security of civilian agency IT systems, and Philip Reitinger, deputy undersecretary of DHS’ National Protection and Programs Directorate, outlined some of the department’s primary efforts in that area. They include issuing the National Cyber Incident Response Plan, providing technical expertise to the private sector, protecting civilian networks with tools such as the Einstein 2 intrusion-detection system, developing a cybersecurity workforce, and coordinating interagency and public/private cooperation.

Despite those efforts, “we face persistent, unauthorized and often unattributed intrusions into federal executive branch civilian networks,” Reitinger said.

Although DHS has the lead in civilian IT security, Reitinger warned that “no single technology or single government entity alone can overcome the cybersecurity challenges our nation faces.”

Wilshusen described key initiatives for improving cybersecurity that have yet to be fully implemented, including:

• 24 near- and midterm recommendations in President Barack Obama’s cybersecurity policy review of 2009. Although recommendations are being implemented, they could take years to complete.
• Updating the national strategy for securing the information and communications infrastructure.
• Developing a comprehensive national strategy for addressing global cybersecurity and governance.
• Finalizing cybersecurity guidelines and monitoring compliance related to electricity grid modernization, being developed by National Institute of Standards and Technology.
• Creating a prioritized national and federal cybersecurity research and development agenda.

Lewis emphasized the need for a comprehensive national strategy to address a global problem. The strategy must be backed by executive-level and legal authority and include some real teeth, he said.

“Voluntary action is also not enough,” he added. Even sophisticated technology companies have proved incapable of defending themselves against the resources of foreign governments. “Voluntary action by itself will always be inadequate against dangerous foreign opponents.”

He called for “a comprehensive strategy that coordinates military, intelligence, law enforcement and diplomatic activities” and warned that “limitations on the use of our military and intelligence capabilities continue to weaken cybersecurity in the United States.”

“Better cybersecurity is possible but not if we continue to use failed approaches,” he said. “This puts a great responsibility on Congress and the White House.”