Risk
6/1/2010
12:33 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybersecurity Regulations Pass House

A House bill would create a federal cybersecurity director and add new cybersecurity requirements, but must be reconciled with the Senate bill, which doesn't have these provisions.

The House of Representatives has passed a bill that would update the federal government's cybersecurity requirements and create a permanent cybersecurity office within the White House, putting some long-sought reforms closer to passage.

The reforms were passed as an amendment offered by Rep. Jim Langevin (D-R.I.) and Dianne Watson (D-Calif.) that made its way into the annual defense spending bill, the National Defense Authorization Act for Fiscal Year 2011. The defense authorization bill passed the House on Friday by a 229-186 vote.

The Senate version of the bill, which passed the Senate Armed Services Committee last week, does not currently contain the Watson-Langevin amendment or similar provisions, but that could change before the vote on the Senate floor. Any differences would be reconciled in conference before the bill is sent to President Obama to sign.

The most wide-ranging changes of the amendment, which combines legislation offered earlier this session by Langevin and Watson, include creating a permanent National Office for Cyberspace and Office of the Federal Chief Technology Officer within the White House, giving both the director of the National Office for Cyberspace and the federal CTO specific responsibilities, and adding new cybersecurity requirements for agencies in areas like acquisition, budgeting, and actually securing IT systems.

"The passage of this amendment comes after a great deal of work to raise awareness about the cyber vulnerabilities that exist throughout our federal government," Langevin, co-chair of the House Cybersecurity Caucus, said in a statement. "These provisions will establish strong, centralized oversight to protect our nation's critical information infrastructure and update our comprehensive policy for operating in cyberspace."

The National Office for Cyberspace -- the "principal office for coordinating" cybersecurity issues in government, according to the amendment, would include a director, appointed by the President and confirmed by the Senate, who would develop and oversee implementation of cybersecurity policies, principles, and standards.

The role of the director would be somewhat analogous to that of the current White House cybersecurity coordinator, Howard Schmidt, but arguably with more power. The director would be vested with authority to require agencies to identify and provide cybersecurity protections at a level commensurate with risk, establish an international cybersecurity strategy, coordinate development of standards for national security systems, and help coordinate secure acquisition policies. Like Schmidt's position, the director would not have budget authority, though agencies would have to send their cybersecurity budgets to the cyberspace office.

The director and agencies would be advised by a Federal Cybersecurity Practice Board containing 10 or fewer members, including representatives from certain agencies. The board would develop and update IT security policies and procedures like minimum security controls, measures of effectiveness, criteria for products and services to meet minimum security controls, and remedies for agencies' security deficiencies.

The creation of a permanent federal CTO position seems to blur the lines of roles currently filled by federal CIO Vivek Kundra and federal CTO Aneesh Chopra. The new official would advise the president, agencies, and CIOs and CTOs on IT issues including budget issues; lead interagency IT planning efforts; establish public-private partnerships to "achieve knowledge of tech available to be used for improving government operations and information technology research and development activities"; recommend federal IT policies; and publish an annual report about the state of federal IT.

Another significant change in the bill is the replacement of a requirement for "periodic testing" of cybersecurity, found in old legislative language, to automated and continuous monitoring to ensure cybersecurity controls are properly implemented and effective.

The amendment also requires creation of new guidance to ensure sufficient training and qualifications of officials with significant cybersecurity duties; the formal designation of a senior agency official as a CISO, rather than simply designating a senior agency official who will take on cybersecurity responsibilities; the addition of formal compliance assessment and operational cybersecurity roles for CISOs; development of secure acquisition policies; and a requirement to send to Congress initial vulnerability assessments of any new major systems that agencies plan to deploy.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.