Risk

5/29/2009
12:53 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Obama Cybersecurity Plan: What's In It For SMBs?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?President Obama's outline this morning of cybersecurity initiatives his administration intends to pursue includes a couple of points that, if followed up on, may have positive impacts for small and midsize businesses (and the rest of the country, too).

On the other hand, the report kicks off with one that may give some pause, and not just to businesses:

But with the broad reach of a loose and lightly regulated digital infrastructure, great risks threaten nations, private enterprises, and individual rights. The government has a responsibility to address these strategic vulnerabilities to ensure that the United States and its citizens, together with the larger community of nations, can realize the full potential of the information technology revolution.

The looseness and lightness of regulation, of course, are often touted as the precise reasons why the Internet, has flourished and why more than a few small and midsized businesses flourished along with it. Have to see what sorts of regulations -- taxation? access limitations? -- and how heavy they are before we can know how a)likely they are to be enacted and b) how much they are likely to change the Net As We Know It.

The emphasis on cyber security education as a national priority is important, but the devil here (the angels, too, I guess) will be in the details:

...the Federal government should initiate a national public awareness and education campaign informed by previous successful campaigns.

The report proposes:

To help achieve these goals, the Nation should:

Promote cybersecurity risk awareness for all citizens;

Build an education system that will enhance understanding of cybersecurity and allow the United States to retain and expand upon its scientific, engineering, and market leadership in information technology;

Expand and train the workforce to protect the Nations competitive advantage; and

 Help organizations and individuals make smart choices as they manage risk.

Admirable goals -- but a k-12 program for example, puts a decade and a half between us and the first full-run graduates. The emphasis -- and execution -- of aggressive and comprehensive campaigns of consumer cybersecurity awareness is crucially important, particularly as consumer technologies -- the same ones many of your employees are bringing to the workplace -- present larger and larger potential risks.

One interesting note is a planned (promised may be too strong a word for today's announcements) use of incentives, positive and negative, to encourage heightened cybersecurity practices throughout the economy:

Additional incentive mechanisms that the government should explore include adjustments to liability considerations (reduced liability in exchange for improved security or increased liability for the consequences of poor security), indemnification, tax incentives, and new regulatory requirements and compliance mechanisms.

Shouldn't have to have tax benefits, say, for protecting data and access to data, but we've seen all too often that all too many business, sites, and IPs don't bother with even critical patches; maybe incentives (and on the side, stiff penalties and liabilities) would help. Certainly for companies practicing sound security measures, tax incentives would be a reward as well as an inducement, and nothing wrong with that.

Early days yet, clearly, to know how many, if any of these recommendations will come to fruition -- the cyberczar, for instant, remains an Administrator To Be Named -- and while the world moves at Netspeed the Congress and other regulatory bodies don't.

Stay tuned.

The complete 60 Day Cyberspace Policy Review is here.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.