Risk
5/29/2009
12:53 PM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Obama Cybersecurity Plan: What's In It For SMBs?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?President Obama's outline this morning of cybersecurity initiatives his administration intends to pursue includes a couple of points that, if followed up on, may have positive impacts for small and midsize businesses (and the rest of the country, too).

On the other hand, the report kicks off with one that may give some pause, and not just to businesses:

But with the broad reach of a loose and lightly regulated digital infrastructure, great risks threaten nations, private enterprises, and individual rights. The government has a responsibility to address these strategic vulnerabilities to ensure that the United States and its citizens, together with the larger community of nations, can realize the full potential of the information technology revolution.

The looseness and lightness of regulation, of course, are often touted as the precise reasons why the Internet, has flourished and why more than a few small and midsized businesses flourished along with it. Have to see what sorts of regulations -- taxation? access limitations? -- and how heavy they are before we can know how a)likely they are to be enacted and b) how much they are likely to change the Net As We Know It.

The emphasis on cyber security education as a national priority is important, but the devil here (the angels, too, I guess) will be in the details:

...the Federal government should initiate a national public awareness and education campaign informed by previous successful campaigns.

The report proposes:

To help achieve these goals, the Nation should:

Promote cybersecurity risk awareness for all citizens;

Build an education system that will enhance understanding of cybersecurity and allow the United States to retain and expand upon its scientific, engineering, and market leadership in information technology;

Expand and train the workforce to protect the Nations competitive advantage; and

 Help organizations and individuals make smart choices as they manage risk.

Admirable goals -- but a k-12 program for example, puts a decade and a half between us and the first full-run graduates. The emphasis -- and execution -- of aggressive and comprehensive campaigns of consumer cybersecurity awareness is crucially important, particularly as consumer technologies -- the same ones many of your employees are bringing to the workplace -- present larger and larger potential risks.

One interesting note is a planned (promised may be too strong a word for today's announcements) use of incentives, positive and negative, to encourage heightened cybersecurity practices throughout the economy:

Additional incentive mechanisms that the government should explore include adjustments to liability considerations (reduced liability in exchange for improved security or increased liability for the consequences of poor security), indemnification, tax incentives, and new regulatory requirements and compliance mechanisms.

Shouldn't have to have tax benefits, say, for protecting data and access to data, but we've seen all too often that all too many business, sites, and IPs don't bother with even critical patches; maybe incentives (and on the side, stiff penalties and liabilities) would help. Certainly for companies practicing sound security measures, tax incentives would be a reward as well as an inducement, and nothing wrong with that.

Early days yet, clearly, to know how many, if any of these recommendations will come to fruition -- the cyberczar, for instant, remains an Administrator To Be Named -- and while the world moves at Netspeed the Congress and other regulatory bodies don't.

Stay tuned.

The complete 60 Day Cyberspace Policy Review is here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-4350
Published: 2014-09-19
Buffer overflow in QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIDI file.

CVE-2014-4376
Published: 2014-09-19
IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.

CVE-2014-4390
Published: 2014-09-19
Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application.

Best of the Web
Dark Reading Radio