The Cybersecurity Act, S. 773

Cybersecurity Bill Trims President's Power
Current version of Senate legislation eliminates provision that permitted the president to shut down the Internet in the event of a major cyber attack.

Elizabeth Montalbano


The Senate Wednesday re-introduced a cybersecurity bill it considered last year, minus a provision that would have allowed the president to shut down the Internet in the event of a major cyber attack.

The Cybersecurity Act, S. 773, co-sponsored by Senators Jay Rockefeller (D-W.Va.) and Olympia Snowe (R-Maine), is aimed at protecting critical U.S. network infrastructure against cybersecurity threats by fostering collaboration between the federal government and the private sectors that maintain that infrastructure.

The legislation was originally introduced last April in a two-bill package that together called for the creation of a national cybersecurity adviser, as well as aimed to revise cybersecurity processes and oversight in government, facilitate public-private partnerships on keeping computer systems safe, fund cybersecurity research, and encourage the hiring of more cybersecurity specialists.

Companion legislation that would create the national cybersecurity adviser position -- the National Cybersecurity Advisor Act, S.778 -- is still pending before the Senate Committee on Homeland Security and Government Affairs.

The new Cybersecurity Act more or less maintains the goals of the original bill, but also has some key differences.

One big one is that it no longer gives the president unilateral power to disconnect networks from the Internet in the event of a major cyber attack.

As written now, the bill requires the president to work with organizations that own critical network infrastructure to come up with cybersecurity emergency response plans rather than take action on his own.

The bill also includes new provisions. One creates a process for the president and those in the private sector that maintain and own critical infrastructure to come together to decide which IT systems are most crucial to national security and how they should be secured.

Another provision requires the president to provide security clearances to some private-sector officials at those organizations so they have access to classified cyber-threat information they wouldn't otherwise be privy to.

Cybersecurity is a major priority for the Obama Administration, which requested $866 million to protect networks and data in its recently announced fiscal 2011 budget.

Though that figure is slightly less than what was allocated in 2010, officials maintain cybersecurity remains top of mind for the administration, a sentiment reflected in the reintroduction of the Senate bill and other recent government actions.

The House last month passed its own cybersecurity bill, the Cybersecurity Enhancement Act of 2009 (HR 4061), first introduced by Rep. Daniel Lipinski (D-IL) last year.

That bill, though not as broad in scope as the Senate bill, funds research and development for a comprehensive cybersecurity plan that would involve the cooperation of several federal agencies.

The Department of Homeland Security also is taking steps to foster better communication between government intelligence officials and private-sector organizations looking after critical networks.

Through a pilot program the DHS recently launched, CIOs and CSOs from state and local governments as well as private-sector organizations will periodically be allowed to access classified intelligence information regarding cyber threats from state and local fusion centers.

F.U.D (fear, uncertainty, and doubt)

In the above “60 Minutes” video, correspondent Steve Kroft spoke with former and current US government officials and private-sector security about the nation’s vulnerability to cyber attack.

“If I were an attacker and I wanted to do strategic damage to the United States, I would either take the cold of winter or the heat of summer, I probably would sack electric power on the U.S. East Cost, maybe the West Coast, and attempt to cause a cascading effect. All of those things are in the art of the possible from a sophisticated attacker,” Retired Admiral Mike McConnell told Kroft.

To most IT professionals, this revelation isn’t, or at least shouldn’t be, news. Before joining TechRepublic 10 years ago, I worked for a regulated utility–a power company. Even then, before anyone was seriously pushing a “smart grid” we were keenly aware of digital threats to our organization. But, just because IT is aware of a threat, doesn’t mean the business is dedicated to addressing those threats. Corporate management is usually most focused on maximizing profit. (I am not referring to my former employer, but making a general statement about the disconnect that often occurs between IT staff and corporate leadership.)

In fact, this disconnect isn’t confined to IT or even the corporate world. Whenever you have individuals or groups with different and/or competing interests, disconnects are common. Yet it is IT’s job to help protect the organization from cyber threats, and in many cases the stakes are too high to allow a communication gap, lack of understanding, or just pure apathy to prevent good security.

Part of IT’s security mission must therefore be to educate the greater community about relevant security threats and convince them to take or approve the necessary countermeasures. It’s the second goal that’s often the most difficult. Even your best descriptions of DoS attacks, rootkits, SQL injection attacks, social engineering, and all the other threats we face can fall on deaf ears unless you impress upon your audience the consequences of inaction. This is when fear can help.
Fear does not equal F.U.D (fear, uncertainty, and doubt)

Whether you’re trying to convince senior management to ban USB drives or your three-year old not to touch the stove, fear is a powerful motivator. Yet, fear is a double-edged sword. If used inappropriately fear will win you more enemies than supporters and can undermine your ultimate goal of improved security. Therefore, I recommend the following guidelines:

1. Avoid the hype. Be truthful and realistic. Don’t make outlandish or unsubstantiated claims of IT destruction and massive financial loss, if the threats you’re discussing aren’t likely to cause such outcomes. Present the threat as you understand it, explain the likelihood of occurrence, and describe your organization’s level of exposure.
2. Temper fear with solutions. Once you’ve explained a threat, follow up with your best recommendations on how to mitigate it. You’re goal is to motivate the audience into changing their behavior or giving their approval for an action, not merely to scare them. And, don’t come in with an all or nothing plan. Be prepared to offer a range of mitigation options, which vary in scope and cost.
3. Don’t overuse fear. Remember the tale of the boy who cried wolf? If you constantly predict IT catastrophes that never materialize, your audience will eventually stop listening to you.
4. Focus on an audience who can act. Narrowly target your message to those who can address the threat or have significant influence of those who can. Inducing fear in those who can’t benefit from point 2 is counterproductive.

Is fear effective?

Yet, not everyone agrees that fear is an effective motivator. In April 2009, I published a ZDNet video on the possibility of a digital Pearl Harbor event. On the video, Bruce Schneier, noted cryptographer and Chief Security Technology Officer of BT Counterpane, suggests IT is better off avoiding fear as a motivator. “We’re better as an industry, if we don’t stoke fear, if we don’t talk about the digital Pearl Harbor. People turn off from that,” Schneier said.

I agree with Schneier’s statement that IT shouldn’t “stoke” people’s fears unnecessarily–see all my above points. But, I still think a little fear can be a powerful motivator. And remember, all fear isn’t created equal. Rationally explaining the negative consequences of not upgrading your network’s intrusion detection system is a far cry yelling fire in a crowded theater. What do you think?

U.S. Homeland Security 1,000 cybersecurity experts

U.S. Homeland Security wants to hire 1,000 cybersecurity experts

Dept. of Homeland Security needs experts needed to fill out vast network protection goals
By Michael Cooney , Network World , 10/01/2009The Department of Homeland Security is looking to hire 1,000 cybersecurity professionals in the next three years according to the agency’s secretary Janet Napolitano.

The department now has the authority to recruit and hire cybersecurity professionals across DHS over the next three years in order to help fulfill its mission to protect the nation’s cyber infrastructure, systems and networks, she said.

NetworkWorld Extra: 12 changes that would give US cybersecurity a much needed kick in the pants

“This new hiring authority will enable DHS to recruit the best cyber analysts, developers and engineers in the world to serve their country by leading the nation’s defenses against cyber threats,” Napolitano stated. DHS his the focal point for the security of cyberspace -- including analysis, warning, information sharing, vulnerability reduction, mitigation, and recovery efforts for public and private critical infrastructure information systems.

The hiring authority, which results from a collaborative effort between DHS, the Office of Personnel Management and the Office of Management and Budget, lets DHS staff up to 1,000 positions over three years across all DHS agencies to fulfill critical cybersecurity roles—including cyber risk and strategic analysis; cyber incident response; vulnerability detection and assessment; intelligence and investigation; and network and systems engineering.

The need for DHS to bolster its security realm is a hot topic. A Government Accountability Office report this year said that while DHS established the National Cyber Security Division to be responsible for leading national day-today cybersecurity efforts that has not enabled DHS to become the national focal point for security as envisioned.

The GAO said the Defense Department and other organizations within the intelligence community that have significant resources and capabilities have come to dominate federal efforts. The group told the GAO there also needs to be an independent cybersecurity organization that leverages and integrates the capabilities of the private sector, civilian government, law enforcement, military, intelligence community, and the nation's international allies to address incidents against the nation's critical cyber systems and functions.

The cybersecurity jobs announcement comes on the same day that the FBI said fraudsters are targeting social networking sites with increased frequency and users need to take precautions, the FBI warned.

The FBI said fraudsters continue to hijack accounts on social networking sites and spread malicious software by using various techniques. One technique involves the use of spam to promote phishing sites, claiming there has been a violation of the terms of agreement or some other type of issue which needs to be resolved. Other spam entices users to download an application or view a video. Some spam appears to be sent from users' "friends", giving the perception of being legitimate. Once the user responds to the phishing site, downloads the application, or clicks on the video link, their computer, telephone or other digital device becomes infected, the FBI stated.

Meanwhile legislators are trying to encourage cooperation among universities and businesses to develop technology needed to carry out a strategic government effort to fight cyber attacks.

A US House subcommittee is recommending a bill that calls for a university-industry task force to coordinate joint cybersecurity research and development projects between business and academia. The Cybersecurity Research and Development Amendments Act of 2009 was approved recently by the House Committee on Science and Technology's Research and Science Education Subcommittee.

The legislation would set up a scholarship program that pays college bills for students who study in fields related to cybersecurity. They would also get summer internships in the federal government. In return the students would agree to work as cybersecurity professionals within the federal government for a period equal to the number of years they received scholarships. If there aren't any jobs there, they would work for state or local governments in the same capacity or teach cybersecurity courses.