Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/19/2005
06:28 PM
Patricia Keefe
Patricia Keefe
Commentary
50%
50%

Homeland Insecurity

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.While The New York Times was polishing its report on secret, presidential-approved eavesdropping on U.S. citizens, another report was making the headlines last week on the beltway and in the tech press. The Cyber Security Industry Alliance, which includes big-name security companies such as Symantec, McAfee, and RSA blasted the government's progress in keeping the United States safe from cyberattacks.

Here we go again.

This is just nuts. In the past year, I've watched report after report record negative grades and mete out severe tongue-lashings to government agency after government department, posted in story upon story. When does this end?

Over the last several years we've watched the Homeland Security czar post become a revolving door as proponents struggle to give the position some visibility, meaning and authority.

Meanwhile, GAO report card after report cards slaps around our various government agencies--including Homeland Security--for earning low scores on security readiness.

Since this is the same government that has urged reluctant companies to report security breaches and the mostly privately owned national infrastructure to adhere to a standard level of security measures, it's a classic case of "do as I say, not as I do."

Now granted, the CSIA is a a security trade association--in other words, a bunch of vendors. And for all we know, they are really just peeved at not making their year-end sales quota. And if the government isn't working on its security shortcomings, there is probably some truth to that suspicion. But the fact is, as noted above, there is a boatload of evidence pointing to the same conclusion: Our government stinks at internal security.

Sticking the needle in a little deeper, the CSIA said its report, "National Agenda for Information Security in 2006," is a response to President Bush's "National Strategy To Secure Cyberspace," which was released in 2003.

As we all know, cyberspace ain't secure today, and it won't be anytime soon--if ever. (Speaking of which, are you up to speed on the latest worm plaguing the Internet byways?) But back to reality, it should be possible to batten down the hatches on government agency networks, laptops, and cell phones, at least enough to push those security grades out of the cellar and up toward a respectable B or, even better, an A. Some agencies have done it--the Department of Transportation, for one.

But when Homeland Security consistently takes a beating, it's beyond embarrassing. It should be worrisome.

The CSIA makes the point that Homeland Security is supposed to take over responsibility for cybersecurity from the White House, but complains the issue has been "lost ... constantly overwhelmed by other issues such as physical threats or event from overseas." This is all important stuff, but let's not forget that as a nation we are constantly pushing more and more of our data onto huge networks that are at least partially public. We've got public health-care initiatives, criminal databases, and information sharing between airports and various government agencies, to name just a few. Operations are becoming increasing automated. A successful cyberattack could have devastating consequences.

Yes, I know, a recent report from the FBI disses the ability of terrorists to mount serious cyberattacks and adds that the agency has so far not detected any plans to launch cyberattacks against major public institutions in the United States. But this is one agency, and its own record since 9/11 isn't so hot, especially when it comes to its own use of technology. And the Bush administration sure seems worried about a very real threat to the country. So what if the FBI is wrong?

Consider this: Hurricane Katrina gave us a taste of the chaos that will ensue if key personal records are lost and systems go down. Do we really want to wait until the bad guys are fully capable of launching a successful cyberattack? Now is the time to act. The government needs to step forward, get its own house in order, and take on that "strategic level" of leadership role that the CSIA and so many others rightly complain has been lacking.

If the threat of terrorism is so great that we need to infringe upon basic American civil liberties, then it stands to reason that securing the operations of key government agencies and departments should be a top priority, and the very least we could accomplish in the name of homeland security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5230
PUBLISHED: 2019-11-13
P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than NEO-AL00D NEO-AL00 9.1.0.321(C786E320R1P1T8) have an improper validation vulnerability. The system does not perform...
CVE-2019-5231
PUBLISHED: 2019-11-13
P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package.
CVE-2019-5233
PUBLISHED: 2019-11-13
Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components.
CVE-2019-5246
PUBLISHED: 2019-11-13
Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain par...
CVE-2010-4177
PUBLISHED: 2019-11-12
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.