Risk
6/1/2010
12:33 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybersecurity Regulations Pass House

A House bill would create a federal cybersecurity director and add new cybersecurity requirements, but must be reconciled with the Senate bill, which doesn't have these provisions.

The House of Representatives has passed a bill that would update the federal government's cybersecurity requirements and create a permanent cybersecurity office within the White House, putting some long-sought reforms closer to passage.

The reforms were passed as an amendment offered by Rep. Jim Langevin (D-R.I.) and Dianne Watson (D-Calif.) that made its way into the annual defense spending bill, the National Defense Authorization Act for Fiscal Year 2011. The defense authorization bill passed the House on Friday by a 229-186 vote.

The Senate version of the bill, which passed the Senate Armed Services Committee last week, does not currently contain the Watson-Langevin amendment or similar provisions, but that could change before the vote on the Senate floor. Any differences would be reconciled in conference before the bill is sent to President Obama to sign.

The most wide-ranging changes of the amendment, which combines legislation offered earlier this session by Langevin and Watson, include creating a permanent National Office for Cyberspace and Office of the Federal Chief Technology Officer within the White House, giving both the director of the National Office for Cyberspace and the federal CTO specific responsibilities, and adding new cybersecurity requirements for agencies in areas like acquisition, budgeting, and actually securing IT systems.

"The passage of this amendment comes after a great deal of work to raise awareness about the cyber vulnerabilities that exist throughout our federal government," Langevin, co-chair of the House Cybersecurity Caucus, said in a statement. "These provisions will establish strong, centralized oversight to protect our nation's critical information infrastructure and update our comprehensive policy for operating in cyberspace."

The National Office for Cyberspace -- the "principal office for coordinating" cybersecurity issues in government, according to the amendment, would include a director, appointed by the President and confirmed by the Senate, who would develop and oversee implementation of cybersecurity policies, principles, and standards.

The role of the director would be somewhat analogous to that of the current White House cybersecurity coordinator, Howard Schmidt, but arguably with more power. The director would be vested with authority to require agencies to identify and provide cybersecurity protections at a level commensurate with risk, establish an international cybersecurity strategy, coordinate development of standards for national security systems, and help coordinate secure acquisition policies. Like Schmidt's position, the director would not have budget authority, though agencies would have to send their cybersecurity budgets to the cyberspace office.

The director and agencies would be advised by a Federal Cybersecurity Practice Board containing 10 or fewer members, including representatives from certain agencies. The board would develop and update IT security policies and procedures like minimum security controls, measures of effectiveness, criteria for products and services to meet minimum security controls, and remedies for agencies' security deficiencies.

The creation of a permanent federal CTO position seems to blur the lines of roles currently filled by federal CIO Vivek Kundra and federal CTO Aneesh Chopra. The new official would advise the president, agencies, and CIOs and CTOs on IT issues including budget issues; lead interagency IT planning efforts; establish public-private partnerships to "achieve knowledge of tech available to be used for improving government operations and information technology research and development activities"; recommend federal IT policies; and publish an annual report about the state of federal IT.

Another significant change in the bill is the replacement of a requirement for "periodic testing" of cybersecurity, found in old legislative language, to automated and continuous monitoring to ensure cybersecurity controls are properly implemented and effective.

The amendment also requires creation of new guidance to ensure sufficient training and qualifications of officials with significant cybersecurity duties; the formal designation of a senior agency official as a CISO, rather than simply designating a senior agency official who will take on cybersecurity responsibilities; the addition of formal compliance assessment and operational cybersecurity roles for CISOs; development of secure acquisition policies; and a requirement to send to Congress initial vulnerability assessments of any new major systems that agencies plan to deploy.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4725
Published: 2014-07-27
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVE-2014-4726
Published: 2014-07-27
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-2625
Published: 2014-07-26
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

CVE-2014-2626
Published: 2014-07-26
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.