Risk
12/20/2010
12:32 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

DHS Secretary Asserts Cybersecurity Leadership

Cybersecurity should be led by the Department of Homeland Security and not left to the market or the military, Janet Napolitano said.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
Cybersecurity should be left neither to the free market nor to the military to solve, Department of Homeland Security (DHS) secretary Janet Napolitano said in a speech in Washington, D.C., last week as she reasserted her agency's role as the locus of cybersecurity authority in the federal government.

"Cyberspace is fundamentally a civilian space," Napolitano said. "There are some who say cybersecurity should be left to the market, and there are some who characterize the Internet as a battlefield. Both the market and the battlefield analogies are the wrong ones to use. We should be talking about this as, fundamentally, a civilian space and a civilian benefit that employs partnerships with the private sector and across the globe."

The DHS has taken the lead in the federal government on cybersecurity measures via its National Cyber Security Division. That group this year headed up a major international and inter-governmental cyber exercise, Cyber Storm III, and continued ramping up efforts to protect federal systems and critical infrastructure like power plants.

Napolitano has been an ardent supporter of DHS' leadership role, but while she implied a DHS-centered view of cybersecurity, she did admit that DHS can't do it alone. "It is our goal to build one of the very best teams that we can to tackle the cybersecurity challenge," she added. "No single industry or agency, quite frankly, can manage it. Cybersecurity is about effective partnerships and shared security."

This year, DHS has expanded partnerships with private industry, for example doing a substantial amount of investigative work on the Stuxnet worm that infiltrated power plant control systems earlier this year and working to build up liaisons with private sector industries it deems to be "critical."

DHS has also improved its partnerships with military and military intelligence this year. In October, DHS and the Department of Defense signed a cybersecurity pact to improve collaboration between the agencies and boost DHS' encryption and decryption capabilities by comingling National Security Agency (NSA) cryptologic analysts and DHS cybersecurity leadership in a move that signaled progress in a sometimes uneasy relationship with the military.

"We're working very closely along and across the federal family, particularly having worked out really the thorny issues involving how the NSA is to be used in a civilian context for protection and prevention, as well as in a military context," Napolitano said last week.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.