Risk
6/1/2010
12:33 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybersecurity Regulations Pass House

A House bill would create a federal cybersecurity director and add new cybersecurity requirements, but must be reconciled with the Senate bill, which doesn't have these provisions.

The House of Representatives has passed a bill that would update the federal government's cybersecurity requirements and create a permanent cybersecurity office within the White House, putting some long-sought reforms closer to passage.

The reforms were passed as an amendment offered by Rep. Jim Langevin (D-R.I.) and Dianne Watson (D-Calif.) that made its way into the annual defense spending bill, the National Defense Authorization Act for Fiscal Year 2011. The defense authorization bill passed the House on Friday by a 229-186 vote.

The Senate version of the bill, which passed the Senate Armed Services Committee last week, does not currently contain the Watson-Langevin amendment or similar provisions, but that could change before the vote on the Senate floor. Any differences would be reconciled in conference before the bill is sent to President Obama to sign.

The most wide-ranging changes of the amendment, which combines legislation offered earlier this session by Langevin and Watson, include creating a permanent National Office for Cyberspace and Office of the Federal Chief Technology Officer within the White House, giving both the director of the National Office for Cyberspace and the federal CTO specific responsibilities, and adding new cybersecurity requirements for agencies in areas like acquisition, budgeting, and actually securing IT systems.

"The passage of this amendment comes after a great deal of work to raise awareness about the cyber vulnerabilities that exist throughout our federal government," Langevin, co-chair of the House Cybersecurity Caucus, said in a statement. "These provisions will establish strong, centralized oversight to protect our nation's critical information infrastructure and update our comprehensive policy for operating in cyberspace."

The National Office for Cyberspace -- the "principal office for coordinating" cybersecurity issues in government, according to the amendment, would include a director, appointed by the President and confirmed by the Senate, who would develop and oversee implementation of cybersecurity policies, principles, and standards.

The role of the director would be somewhat analogous to that of the current White House cybersecurity coordinator, Howard Schmidt, but arguably with more power. The director would be vested with authority to require agencies to identify and provide cybersecurity protections at a level commensurate with risk, establish an international cybersecurity strategy, coordinate development of standards for national security systems, and help coordinate secure acquisition policies. Like Schmidt's position, the director would not have budget authority, though agencies would have to send their cybersecurity budgets to the cyberspace office.

The director and agencies would be advised by a Federal Cybersecurity Practice Board containing 10 or fewer members, including representatives from certain agencies. The board would develop and update IT security policies and procedures like minimum security controls, measures of effectiveness, criteria for products and services to meet minimum security controls, and remedies for agencies' security deficiencies.

The creation of a permanent federal CTO position seems to blur the lines of roles currently filled by federal CIO Vivek Kundra and federal CTO Aneesh Chopra. The new official would advise the president, agencies, and CIOs and CTOs on IT issues including budget issues; lead interagency IT planning efforts; establish public-private partnerships to "achieve knowledge of tech available to be used for improving government operations and information technology research and development activities"; recommend federal IT policies; and publish an annual report about the state of federal IT.

Another significant change in the bill is the replacement of a requirement for "periodic testing" of cybersecurity, found in old legislative language, to automated and continuous monitoring to ensure cybersecurity controls are properly implemented and effective.

The amendment also requires creation of new guidance to ensure sufficient training and qualifications of officials with significant cybersecurity duties; the formal designation of a senior agency official as a CISO, rather than simply designating a senior agency official who will take on cybersecurity responsibilities; the addition of formal compliance assessment and operational cybersecurity roles for CISOs; development of secure acquisition policies; and a requirement to send to Congress initial vulnerability assessments of any new major systems that agencies plan to deploy.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.