Risk
3/3/2010
07:45 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

RSA: DHS Chief Launches Cybersecurity Competition

Secretary of the Department of Homeland Security, Janet Napolitano, is asking for help to engage the public in a discussion about cybersecurity.

Speaking at the RSA Conference in San Francisco on Wednesday, Secretary of the Department of Homeland Security (DHS) Janet Napolitano announced the National Cybersecurity Awareness Campaign Challenge Competition, a contest to solicit ideas from individuals and industry about how to best engage the American public in a discussion about cybersecurity.

"A secure cyber environment is as much about people and habits and culture as it is about machines," said Napolitano. "...We need to have an ongoing, two-way conversation between the public and private sectors [about how to improve cybersecurity]."

Proposals submitted to DHS before the April 30 deadline will be evaluated based on factors that include teamwork, effective metrics for distribution and engagement, use of Web 2.0 technology, compliance with spam laws, privacy, repeatability, feedback mechanism, list building, transparency, and message.

Winners will be invited to a DHS event in Washington D.C. in late May or early June and will have the opportunity to help plan the National Cybersecurity Awareness Campaign with DHS and to prepare the campaign for its launch in October, during Cybersecurity Awareness Month.

Further details are available at the DHS Web site.

Napolitano offered reassurance that DHS understands the challenges of cybersecurity and repeated President Obama's acknowledgment of the seriousness of the cyber threat faced by the nation.

At the same time, she came to ask for help. Success, she said, will depend on our ability to interface with the private sector.

"We're working with our private sector partners in the financial services arena and with other key industries about what needs to be done and what can be done," she said, adding that this can be expected to continue.

As DHS addresses the cybersecurity challenge, it needs more than ideas about public outreach strategy. It needs cybersecurity talent.

"In fact, we may be trying to recruit some of your talent right now," she said, scanning the audience of cybersecurity professionals. "We need it."

She described how the government has been deploying and improving its Einstein intrusion detection system to spot, identify, and (eventually) disable cyber threats to government agencies.

And she called on the private sector to "redouble efforts to increase the security, reliability, and quality of products you have that enter the global supply chain."

The goal, she said, is an IT ecosystem that offers security automation, speed and interoperability, and privacy.

"We need to do more and we need to do it faster," she said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.