Gilligan urges agencies to push for safer software

Gilligan urges agencies to push for safer software

• By William Jackson
• Oct 05, 2001

The Air Force's deputy CIO last week called on the software industry to deliver products that are more secure out of the box than they are now.

'None of us can afford a continual race with hackers in the current find-and-patch mode,' John Gilligan said.

Gilligan, co-chairman of the CIO Council's security, privacy and critical infrastructure committee, said government agencies should demand more secure software from suppliers and be willing to pay for it.

'The initial cost may be higher, but we need to look at the whole lifecycle,' he said.

Gilligan made his challenge last week at the release of the SANS Institute-FBI list of the most critical computer security vulnerabilities. It expands last year's top 10 vulnerabilities to 20, which most successful hacker attacks exploit, said Alan Paller, research director of the SANS Institute of Bethesda, Md.

Paller said none of last year's top 10 vulnerabilities has been retired because poorly configured software still is being sold and installed.

'The Internet is not ready to withstand a major attack,' he said.

State Department CIO Fernando Burbano testified to the effectiveness of the list. He said he oversees systems with 50,000 users at 260 locations in 169 countries that successfully weathered the recent onslaught of Internet worms.

When Code Red struck, State systems received 500,000 copies the first day and 1 million a day for the next several days but without infection, said Burbano, who also is assistant secretary of State for IRM.

Nimda repelled

As for the Nimda virus, 'We were bombarded the first day, and we repelled it,' he said. There were 1 million strikes the first day, 4 million the second and 8 million the third.

State has contingency plans for locking down its systems and disconnecting from the Internet, 'but we haven't had to do that' because of the SANS-FBI list, Burbano said. 'We've implemented most [patches] to the extent we can.'

Burbano predicted that America's war on terrorism will produce a cyberbacklash.

'When the attack starts, you're going to see some of the terrorist countries striking back from cyberspace,' he said.

Gilligan agreed.

'We can be absolutely certain there will be a continuation, and probably an escalation, of cyberattacks in the future,' he said.

He acknowledged that demanding better software from vendors is difficult because of the lack of standards.

'We are nowhere near' being able to certify commercial software as secure, he said. 'But I think we're at the point where we are ready to begin discussions.'

The Center for Internet Security will release an automated scanner program that searches for the SANS-FBI top 20 vulnerabilities. To request a copy, send e-mail to info@cisecurity.org with the subject 'Top Twenty Scanner.'

More information appears on the SANS Web site, at www.sans.org.