Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/29/2010
01:08 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Government's Cybersecurity Role Gets Mixed Reaction

A survey of critical infrastructure executives finds mixed views on government's role in cybersecurity in the private sector.

A worldwide survey that shows widespread cyber attacks on critical infrastructure companies finds that the role of government in working to stop those attacks is up in the air. Indeed, a majority of respondents believes governments to be among the culprits.

Overall, more than half of the 600 industry executives surveyed by the Center for Strategic and International Studies, with support from security vendor McAfee, think their nation's laws aren't strong enough to deter cyber attacks, and 45% believe that their countries are incapable of preventing attacks.

The survey comes as a heated debate has emerged about the proper role of government in bolstering cybersecurity in the private sector. In his first public speech as White House cyber coordinator earlier this week, Howard Schmidt said that fostering public-private partnerships is among his top agenda items.

The survey does find, by a thin margin, a belief that government regulation is improving security. "I have sensed for a year or more that industry, which used to think that the government didn't need to get involved, doesn't have any confidence that they can solve this problem on their own," Stewart Baker, distinguished visiting fellow at CSIS and a partner at law firm Steptoe & Johnson, said in an interview.

In all, 58% of respondents said that government regulation had "sharpened [corporate] policy and improved security." However, on this question, just as on others, the views diverge widely among different countries. In China and Germany, for example, more than 60% believe government regulation has been helpful, while only a minority held that view in Italy and Australia.

Only about a third of respondents said that they were involved in a public-private partnership. However, the report notes, that in some countries, such as the United States, where participation in those partnerships is higher, "data suggests that industry concerns persist about information-sharing being a one-way street."

Somewhat counter-intuitively, despite frequent reports of data breaches and successful cyber attacks against companies in the United States and the fact that survey respondents ranked the United States among the countries most vulnerable to attacks, they also looked to light regulation in the U.S. as a model for cybersecurity.

Part of the mixed view on government's role in private sector cybersecurity may come from the fact that many companies think they are in fact under attack from government cyber warriors. About 60% of respondents believe governments are already attacking their infrastructure, with the United States as the leading suspect, followed by China and Russia.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26030
PUBLISHED: 2021-04-14
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
CVE-2021-26031
PUBLISHED: 2021-04-14
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
CVE-2021-27710
PUBLISHED: 2021-04-14
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system funct...
CVE-2021-28484
PUBLISHED: 2021-04-14
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send i...
CVE-2021-29654
PUBLISHED: 2021-04-14
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execution.