Risk
5/29/2009
12:53 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Obama Cybersecurity Plan: What's In It For SMBs?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?

New cyberczar (though no names yet), management from the top, calls for more coordinated cybersecurity efforts, privacy protection -- same old same old, or does the unveiling of the Obama administration's cybersecurity plan promise real changes in the government's approach to scuring cyberspace. More importantly, what's in the plan for small and midsized businesses?President Obama's outline this morning of cybersecurity initiatives his administration intends to pursue includes a couple of points that, if followed up on, may have positive impacts for small and midsize businesses (and the rest of the country, too).

On the other hand, the report kicks off with one that may give some pause, and not just to businesses:

But with the broad reach of a loose and lightly regulated digital infrastructure, great risks threaten nations, private enterprises, and individual rights. The government has a responsibility to address these strategic vulnerabilities to ensure that the United States and its citizens, together with the larger community of nations, can realize the full potential of the information technology revolution.

The looseness and lightness of regulation, of course, are often touted as the precise reasons why the Internet, has flourished and why more than a few small and midsized businesses flourished along with it. Have to see what sorts of regulations -- taxation? access limitations? -- and how heavy they are before we can know how a)likely they are to be enacted and b) how much they are likely to change the Net As We Know It.

The emphasis on cyber security education as a national priority is important, but the devil here (the angels, too, I guess) will be in the details:

...the Federal government should initiate a national public awareness and education campaign informed by previous successful campaigns.

The report proposes:

To help achieve these goals, the Nation should:

Promote cybersecurity risk awareness for all citizens;

Build an education system that will enhance understanding of cybersecurity and allow the United States to retain and expand upon its scientific, engineering, and market leadership in information technology;

Expand and train the workforce to protect the Nations competitive advantage; and

 Help organizations and individuals make smart choices as they manage risk.

Admirable goals -- but a k-12 program for example, puts a decade and a half between us and the first full-run graduates. The emphasis -- and execution -- of aggressive and comprehensive campaigns of consumer cybersecurity awareness is crucially important, particularly as consumer technologies -- the same ones many of your employees are bringing to the workplace -- present larger and larger potential risks.

One interesting note is a planned (promised may be too strong a word for today's announcements) use of incentives, positive and negative, to encourage heightened cybersecurity practices throughout the economy:

Additional incentive mechanisms that the government should explore include adjustments to liability considerations (reduced liability in exchange for improved security or increased liability for the consequences of poor security), indemnification, tax incentives, and new regulatory requirements and compliance mechanisms.

Shouldn't have to have tax benefits, say, for protecting data and access to data, but we've seen all too often that all too many business, sites, and IPs don't bother with even critical patches; maybe incentives (and on the side, stiff penalties and liabilities) would help. Certainly for companies practicing sound security measures, tax incentives would be a reward as well as an inducement, and nothing wrong with that.

Early days yet, clearly, to know how many, if any of these recommendations will come to fruition -- the cyberczar, for instant, remains an Administrator To Be Named -- and while the world moves at Netspeed the Congress and other regulatory bodies don't.

Stay tuned.

The complete 60 Day Cyberspace Policy Review is here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

CVE-2015-2922
Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?