Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/19/2005
06:28 PM
Patricia Keefe
Patricia Keefe
Commentary
50%
50%

Homeland Insecurity

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.While The New York Times was polishing its report on secret, presidential-approved eavesdropping on U.S. citizens, another report was making the headlines last week on the beltway and in the tech press. The Cyber Security Industry Alliance, which includes big-name security companies such as Symantec, McAfee, and RSA blasted the government's progress in keeping the United States safe from cyberattacks.

Here we go again.

This is just nuts. In the past year, I've watched report after report record negative grades and mete out severe tongue-lashings to government agency after government department, posted in story upon story. When does this end?

Over the last several years we've watched the Homeland Security czar post become a revolving door as proponents struggle to give the position some visibility, meaning and authority.

Meanwhile, GAO report card after report cards slaps around our various government agencies--including Homeland Security--for earning low scores on security readiness.

Since this is the same government that has urged reluctant companies to report security breaches and the mostly privately owned national infrastructure to adhere to a standard level of security measures, it's a classic case of "do as I say, not as I do."

Now granted, the CSIA is a a security trade association--in other words, a bunch of vendors. And for all we know, they are really just peeved at not making their year-end sales quota. And if the government isn't working on its security shortcomings, there is probably some truth to that suspicion. But the fact is, as noted above, there is a boatload of evidence pointing to the same conclusion: Our government stinks at internal security.

Sticking the needle in a little deeper, the CSIA said its report, "National Agenda for Information Security in 2006," is a response to President Bush's "National Strategy To Secure Cyberspace," which was released in 2003.

As we all know, cyberspace ain't secure today, and it won't be anytime soon--if ever. (Speaking of which, are you up to speed on the latest worm plaguing the Internet byways?) But back to reality, it should be possible to batten down the hatches on government agency networks, laptops, and cell phones, at least enough to push those security grades out of the cellar and up toward a respectable B or, even better, an A. Some agencies have done it--the Department of Transportation, for one.

But when Homeland Security consistently takes a beating, it's beyond embarrassing. It should be worrisome.

The CSIA makes the point that Homeland Security is supposed to take over responsibility for cybersecurity from the White House, but complains the issue has been "lost ... constantly overwhelmed by other issues such as physical threats or event from overseas." This is all important stuff, but let's not forget that as a nation we are constantly pushing more and more of our data onto huge networks that are at least partially public. We've got public health-care initiatives, criminal databases, and information sharing between airports and various government agencies, to name just a few. Operations are becoming increasing automated. A successful cyberattack could have devastating consequences.

Yes, I know, a recent report from the FBI disses the ability of terrorists to mount serious cyberattacks and adds that the agency has so far not detected any plans to launch cyberattacks against major public institutions in the United States. But this is one agency, and its own record since 9/11 isn't so hot, especially when it comes to its own use of technology. And the Bush administration sure seems worried about a very real threat to the country. So what if the FBI is wrong?

Consider this: Hurricane Katrina gave us a taste of the chaos that will ensue if key personal records are lost and systems go down. Do we really want to wait until the bad guys are fully capable of launching a successful cyberattack? Now is the time to act. The government needs to step forward, get its own house in order, and take on that "strategic level" of leadership role that the CSIA and so many others rightly complain has been lacking.

If the threat of terrorism is so great that we need to infringe upon basic American civil liberties, then it stands to reason that securing the operations of key government agencies and departments should be a top priority, and the very least we could accomplish in the name of homeland security.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-33185
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
CVE-2021-33186
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-31272
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
CVE-2021-31660
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.