Risk
5/29/2009
12:53 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Obama Cybersecurity Plan: What's In It For SMBs?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?President Obama's outline this morning of cybersecurity initiatives his administration intends to pursue includes a couple of points that, if followed up on, may have positive impacts for small and midsize businesses (and the rest of the country, too).

On the other hand, the report kicks off with one that may give some pause, and not just to businesses:

But with the broad reach of a loose and lightly regulated digital infrastructure, great risks threaten nations, private enterprises, and individual rights. The government has a responsibility to address these strategic vulnerabilities to ensure that the United States and its citizens, together with the larger community of nations, can realize the full potential of the information technology revolution.

The looseness and lightness of regulation, of course, are often touted as the precise reasons why the Internet, has flourished and why more than a few small and midsized businesses flourished along with it. Have to see what sorts of regulations -- taxation? access limitations? -- and how heavy they are before we can know how a)likely they are to be enacted and b) how much they are likely to change the Net As We Know It.

The emphasis on cyber security education as a national priority is important, but the devil here (the angels, too, I guess) will be in the details:

...the Federal government should initiate a national public awareness and education campaign informed by previous successful campaigns.

The report proposes:

To help achieve these goals, the Nation should:

Promote cybersecurity risk awareness for all citizens;

Build an education system that will enhance understanding of cybersecurity and allow the United States to retain and expand upon its scientific, engineering, and market leadership in information technology;

Expand and train the workforce to protect the Nations competitive advantage; and

 Help organizations and individuals make smart choices as they manage risk.

Admirable goals -- but a k-12 program for example, puts a decade and a half between us and the first full-run graduates. The emphasis -- and execution -- of aggressive and comprehensive campaigns of consumer cybersecurity awareness is crucially important, particularly as consumer technologies -- the same ones many of your employees are bringing to the workplace -- present larger and larger potential risks.

One interesting note is a planned (promised may be too strong a word for today's announcements) use of incentives, positive and negative, to encourage heightened cybersecurity practices throughout the economy:

Additional incentive mechanisms that the government should explore include adjustments to liability considerations (reduced liability in exchange for improved security or increased liability for the consequences of poor security), indemnification, tax incentives, and new regulatory requirements and compliance mechanisms.

Shouldn't have to have tax benefits, say, for protecting data and access to data, but we've seen all too often that all too many business, sites, and IPs don't bother with even critical patches; maybe incentives (and on the side, stiff penalties and liabilities) would help. Certainly for companies practicing sound security measures, tax incentives would be a reward as well as an inducement, and nothing wrong with that.

Early days yet, clearly, to know how many, if any of these recommendations will come to fruition -- the cyberczar, for instant, remains an Administrator To Be Named -- and while the world moves at Netspeed the Congress and other regulatory bodies don't.

Stay tuned.

The complete 60 Day Cyberspace Policy Review is here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: good one 
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2001-1594
Published: 2015-08-04
GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, an...

CVE-2002-2445
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) "service." for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdwon user, which has unspecified impact and attack vectors.

CVE-2002-2446
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors.

CVE-2003-1603
Published: 2015-08-04
GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2) "2" for the LOCAL user of the FTP server for the Codonics printer, which has unspecified impact and attack vectors.

CVE-2004-2777
Published: 2015-08-04
GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002...

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!