Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


06:28 PM
Patricia Keefe
Patricia Keefe

Homeland Insecurity

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.While The New York Times was polishing its report on secret, presidential-approved eavesdropping on U.S. citizens, another report was making the headlines last week on the beltway and in the tech press. The Cyber Security Industry Alliance, which includes big-name security companies such as Symantec, McAfee, and RSA blasted the government's progress in keeping the United States safe from cyberattacks.

Here we go again.

This is just nuts. In the past year, I've watched report after report record negative grades and mete out severe tongue-lashings to government agency after government department, posted in story upon story. When does this end?

Over the last several years we've watched the Homeland Security czar post become a revolving door as proponents struggle to give the position some visibility, meaning and authority.

Meanwhile, GAO report card after report cards slaps around our various government agencies--including Homeland Security--for earning low scores on security readiness.

Since this is the same government that has urged reluctant companies to report security breaches and the mostly privately owned national infrastructure to adhere to a standard level of security measures, it's a classic case of "do as I say, not as I do."

Now granted, the CSIA is a a security trade association--in other words, a bunch of vendors. And for all we know, they are really just peeved at not making their year-end sales quota. And if the government isn't working on its security shortcomings, there is probably some truth to that suspicion. But the fact is, as noted above, there is a boatload of evidence pointing to the same conclusion: Our government stinks at internal security.

Sticking the needle in a little deeper, the CSIA said its report, "National Agenda for Information Security in 2006," is a response to President Bush's "National Strategy To Secure Cyberspace," which was released in 2003.

As we all know, cyberspace ain't secure today, and it won't be anytime soon--if ever. (Speaking of which, are you up to speed on the latest worm plaguing the Internet byways?) But back to reality, it should be possible to batten down the hatches on government agency networks, laptops, and cell phones, at least enough to push those security grades out of the cellar and up toward a respectable B or, even better, an A. Some agencies have done it--the Department of Transportation, for one.

But when Homeland Security consistently takes a beating, it's beyond embarrassing. It should be worrisome.

The CSIA makes the point that Homeland Security is supposed to take over responsibility for cybersecurity from the White House, but complains the issue has been "lost ... constantly overwhelmed by other issues such as physical threats or event from overseas." This is all important stuff, but let's not forget that as a nation we are constantly pushing more and more of our data onto huge networks that are at least partially public. We've got public health-care initiatives, criminal databases, and information sharing between airports and various government agencies, to name just a few. Operations are becoming increasing automated. A successful cyberattack could have devastating consequences.

Yes, I know, a recent report from the FBI disses the ability of terrorists to mount serious cyberattacks and adds that the agency has so far not detected any plans to launch cyberattacks against major public institutions in the United States. But this is one agency, and its own record since 9/11 isn't so hot, especially when it comes to its own use of technology. And the Bush administration sure seems worried about a very real threat to the country. So what if the FBI is wrong?

Consider this: Hurricane Katrina gave us a taste of the chaos that will ensue if key personal records are lost and systems go down. Do we really want to wait until the bad guys are fully capable of launching a successful cyberattack? Now is the time to act. The government needs to step forward, get its own house in order, and take on that "strategic level" of leadership role that the CSIA and so many others rightly complain has been lacking.

If the threat of terrorism is so great that we need to infringe upon basic American civil liberties, then it stands to reason that securing the operations of key government agencies and departments should be a top priority, and the very least we could accomplish in the name of homeland security.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-04
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
PUBLISHED: 2020-04-04
bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file.
PUBLISHED: 2020-04-04
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
PUBLISHED: 2020-04-04
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.
PUBLISHED: 2020-04-04
Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode.