A bill set to be introduced in the Senate on Tuesday would make wholesale changes to the way that the federal government handles information security, including the establishment of a Nation Officer for Cyberspace, which would sit right below the president. According to a story on SearchCompliance.com, the bill, known as the Information and Communications Enhancement Act, also contemplates an overhaul of the controversial FISMA legislation.
Much of the talk at the RSA Conference last week centered on the lack of the unifying theme or big-time story that usually emerges to take over the show by mid-week. But there was, in fact, a major story, and it was the abject failure of the Obama administration, in the person of Melissa Hathaway, to deliver any concrete details on its plans to drag the country’s information security infrastructure out of the quagmire it’s been in for nearly a decade.
By George Hulme
In her much anticipated talk, acting senior director for cyberspace by President Obama, Melissa Hathaway generally reviewed what we already knew, and what has been previously reported when it comes to federal cyber security: The White House should coordinate IT security efforts; private sector needs to play a bigger role in securing cyberspace (hey, wasn’t this also the mantra for Richard Clarke’s National Strategy to Secure Cyber Space?); and a handful of agencies should be responsible for the security of federal computer networks.
Contrary to a number of media reports, as well as statements by other intelligence officials, Lt. Gen. Keith Alexander, the director of the National Security Agency, said on Tuesday that his agency is not interested in taking charge of the country’s cybersecurity efforts.
One of the more widely anticipated keynotes at the RSA Conference this week is the talk by Melissa Hathaway, who was in charge of the Obama administration’s recently completed review of the country’s information security standing. However it now looks unlikely that Hathaway will actually reveal any of the key findings or recommendations in the review during her talk on Wednesday afternoon at the conference.
The FBI has been using an in-house spyware program for several years to monitor the activities of suspected online criminals and hackers, according to recently released documents. The documents, obtained by Wired.com, show that the FBI was able to plant the program on target machines by encouraging their subjects to click on a link that silently installed the software.
From SMBlog (Steve Bellovin)
The Senate bill introduced earlier this month that would make sweeping changes to the way that information security is practiced both in the federal government and the private sector has a number of good elements, but the flaws in the proposed legislation outweight the benefits, writes Steve Bellovin.
The supposedly new attacks on the electrical grid and other portions of the country’s critical infrastructure that came to light this week are in fact not new at all and have been ongoing for several years. Attackers have been making serious inroads into U.S. government, utility and military networks for most of this decade and the problem is continuing to worsen, security experts say.
From Cnet (Elinor Mills)
The security of U.S. networks is in such disarray that the Pentagon has spent $100 million in the last six months alone to repair damage done by cyber attacks. That huge number presumably includes cleaning up after external attacks, viruses and internal problems.
From Educated Guesswork (Eric Rescorla)
The received wisdom in the security industry is that trying to qualitatively assess the security of a given piece of software is an incredibly difficult task. Some of the sharpest minds in software security–Gary McGraw, Brian Chess and Michael Howard among them–have spent years trying to nail down a framework for this task, with varying degrees of success. Not to worry, though. As Eric Rescorla writes, the government has now joined the fray with a proposal to develop standards for software security.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
