Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/19/2005
06:28 PM
Patricia Keefe
Patricia Keefe
Commentary
50%
50%

Homeland Insecurity

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.While The New York Times was polishing its report on secret, presidential-approved eavesdropping on U.S. citizens, another report was making the headlines last week on the beltway and in the tech press. The Cyber Security Industry Alliance, which includes big-name security companies such as Symantec, McAfee, and RSA blasted the government's progress in keeping the United States safe from cyberattacks.

Here we go again.

This is just nuts. In the past year, I've watched report after report record negative grades and mete out severe tongue-lashings to government agency after government department, posted in story upon story. When does this end?

Over the last several years we've watched the Homeland Security czar post become a revolving door as proponents struggle to give the position some visibility, meaning and authority.

Meanwhile, GAO report card after report cards slaps around our various government agencies--including Homeland Security--for earning low scores on security readiness.

Since this is the same government that has urged reluctant companies to report security breaches and the mostly privately owned national infrastructure to adhere to a standard level of security measures, it's a classic case of "do as I say, not as I do."

Now granted, the CSIA is a a security trade association--in other words, a bunch of vendors. And for all we know, they are really just peeved at not making their year-end sales quota. And if the government isn't working on its security shortcomings, there is probably some truth to that suspicion. But the fact is, as noted above, there is a boatload of evidence pointing to the same conclusion: Our government stinks at internal security.

Sticking the needle in a little deeper, the CSIA said its report, "National Agenda for Information Security in 2006," is a response to President Bush's "National Strategy To Secure Cyberspace," which was released in 2003.

As we all know, cyberspace ain't secure today, and it won't be anytime soon--if ever. (Speaking of which, are you up to speed on the latest worm plaguing the Internet byways?) But back to reality, it should be possible to batten down the hatches on government agency networks, laptops, and cell phones, at least enough to push those security grades out of the cellar and up toward a respectable B or, even better, an A. Some agencies have done it--the Department of Transportation, for one.

But when Homeland Security consistently takes a beating, it's beyond embarrassing. It should be worrisome.

The CSIA makes the point that Homeland Security is supposed to take over responsibility for cybersecurity from the White House, but complains the issue has been "lost ... constantly overwhelmed by other issues such as physical threats or event from overseas." This is all important stuff, but let's not forget that as a nation we are constantly pushing more and more of our data onto huge networks that are at least partially public. We've got public health-care initiatives, criminal databases, and information sharing between airports and various government agencies, to name just a few. Operations are becoming increasing automated. A successful cyberattack could have devastating consequences.

Yes, I know, a recent report from the FBI disses the ability of terrorists to mount serious cyberattacks and adds that the agency has so far not detected any plans to launch cyberattacks against major public institutions in the United States. But this is one agency, and its own record since 9/11 isn't so hot, especially when it comes to its own use of technology. And the Bush administration sure seems worried about a very real threat to the country. So what if the FBI is wrong?

Consider this: Hurricane Katrina gave us a taste of the chaos that will ensue if key personal records are lost and systems go down. Do we really want to wait until the bad guys are fully capable of launching a successful cyberattack? Now is the time to act. The government needs to step forward, get its own house in order, and take on that "strategic level" of leadership role that the CSIA and so many others rightly complain has been lacking.

If the threat of terrorism is so great that we need to infringe upon basic American civil liberties, then it stands to reason that securing the operations of key government agencies and departments should be a top priority, and the very least we could accomplish in the name of homeland security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9007
PUBLISHED: 2020-02-16
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
CVE-2020-9012
PUBLISHED: 2020-02-16
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVE-2019-20456
PUBLISHED: 2020-02-16
Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking.
CVE-2020-8996
PUBLISHED: 2020-02-16
AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI.
CVE-2020-8997
PUBLISHED: 2020-02-16
Abbott FreeStyle Libre 14-day before February 2020 and FreeStyle Libre 2 before February 2020 allow remote attackers to enable write access via a specific NFC unlock command.