Government needs a plan to limit Web usage during a security crisis |
 |
By Robert Westervelt, News Editor
22 Apr 2009 | SearchSecurity.com |
|
|
SAN FRANCISCO -- Cybercriminals are overrunning the Internet and posing an ever-increasing threat to critical infrastructure in the United States, forcing lawmakers and government officials to rethink how to react in the event of a major Internet security crisis.
Tuesday at the 2009 RSA Conference, a panel of experts from the Department of Defense, National Security Agency and the Department of Homeland Security agreed that drastic measures are needed to shore up defenses of critical infrastructure and ensure a plan is in place for critical communications in the event of a national emergency.
Paul Kurtz, executive director of the Arlington, Va.-based Software Assurance Forum for Excellence in Code (SAFECode) and former White House advisor on national security issues, said lawmakers need to address Net neutrality and priority communications in a time of crisis.
A new bill in Congress proposes to give the U.S. government authority over all networks considered part of the nation's critical infrastructure. The Cybersecurity Act of 2009 would give authority to the president to shut down Internet traffic to protect national security. It also would grant the federal government access to data from various companies in the private sector. Kurtz said the proposal's scope is too broad, hasn't been fully vetted and may not be the right answer. Instead, he said the government may need to focus on a measure that would limit Internet traffic to ensure agencies directing a crisis response can communicate.
"When we go into IP network world and think about crisis responding, is my ability to download a movie as important as these guys being able to communicate?" Kurtz asked. "The answer is no."
Government officials have been increasing the focus on cybersecurity issues as lawmakers in Congress have signaled that they plan to fund initiatives to better secure the nation's infrastructure. Earlier this month, a report in the Wall Street Journal cited current and former national security officials who said malware was discovered on electrical grid computer systems. The Journal also reported this week that terabytes of data on the U.S. military's most technologically advanced fighter aircraft was stolen by computer hackers over the past two years.
RSA panelist Robert Lentz, deputy secretary for cybersecurity at the Department of Defense, said the federal government needs to shift to a dynamic defense, rather than the traditional layered approach used in the private sector. Automated systems need to quickly detect and attack threats immediately, he said. In addition, he added that data collected from the private sector could help defend the country.
"We have to be as far outside the network as we can to anticipate attacks," Lentz said. "We have to have devices talking to devices and infrastructure and applications talking to one another."
Jim Richberg, chief of staff of the Joint Interagency Cyber Task Force, helped develop the comprehensive National Cybersecurity Initiative and has been briefing lawmakers on cybersecurity issues. Richberg said lawmakers are ready to act, but the process is bogged down with dozens of congressional committees that claim ownership over the Internet and security issues. Richberg said the NCI helped get more than 20 government agencies to "rationalize instead of competing against each other" for funding.
"Every time I brief the threat to Congress, I never had one of them say 'I believe you are hyping the threat,'" Richberg said. "They finally understand that this is a serous problem and requires a serious and sustained effort."
But Lentz warned that even a strong focus on cybersecurity in Congress and greater agency cooperation to recognize and defend against threats could still come up short without support from other countries.
"I think we all have to be focusing as partners internationally in this area," Lentz said. "Countries are starting to come together and realize they have to be part of the club to help keep [the Internet] a neutral place for all of us to continue to work in."
The panelists agreed that as currently written, the Cybersecurity Act of 2009 won't likely gain congressional approval. But, according to Richberg, pieces of it will eventually become law and could help improve cybersecurity at the federal level.
"Senior lawmakers seem to get it, but they can be overzealous," Richberg said. "They understand the magnitude of the threat… but what they don't grasp is what the way ahead is. We still don't have the bumper sticker that says 'Here's the answer; fund this.'"
|
|
|
|
