Security wars move to new turf
- By Wilson P. Dizard III
- Mar 29, 2005
Organized cybercrime calls for an organized response from DHS
Andy Purdy, DHS cybercrime fighter
Andy Purdy, acting director of the National Cyber Security Division and U.S. Computer Emergency Response Team since April 2003, is the Homeland Security Department's lightning rod for preventing, responding to and recovering from electronic attacks.
He helped launch the center in his job as White House senior adviser for IT security and privacy, a position he held from April 2002 to April 2003 while on detail from the Sentencing Commission. At the commission, Purdy worked as chief deputy general counsel from 1987 to April 2002. He also was counsel to the Senate Impeachment Trial Committee from July 1989 to October 1989.
Purdy previously served as counsel to different congressional committees and was an assistant U.S. attorney for the Eastern District of Pennsylvania in Philadelphia.
Purdy holds an undergraduate degree in government and economics from the College of William and Mary and a law degree from the University of Virginia. GCN senior writer Wilson P. Dizard III interviewed him by telephone.GCN: Last year's Topoff cyberattack exercise indicated some gaps in coordination between physical infrastructure protection agencies and cybersecurity agencies. What steps have been taken to fill these gaps, and how will the upcoming Topoff exercise reflect these changes?
Purdy: There will be a much bigger cybercomponent. At the most significant level, we have formed the National Cyber Response Coordination Group, which is part of the whole National Response Plan. So the National Response Plan has all the elements and processes that physical and cyber [infrastructure defenders] would have when it's an incident of national significance.
The NCRCG [activates] during a physical crisis. The Interagency Incident Management Group is stood up, as is the National Cyber Response Coordination Group.GCN: What indications have you received, if any, that criminal, terrorist and drug-smuggling groups are coordinating their cyberattack efforts? What countries are the biggest source of sophisticated cyberattacks on federal, state and local agencies?
Purdy: We have been actively involved in the national intelligence estimate for cybersecurity. Most of it is classified. It is an example of where intelligence agencies and law enforcement have worked together to connect the dots on major threats from states and nonstate actors to make sure [they] have a common picture. Our law enforcement and intelligence folks are tracking malicious cyberactivity.
There is an active involvement of criminal [elements] in electronic crime. I shouldn't be more specific at this time.GCN: Do you believe that the dominance of certain operating systems and applications has created a monoculture of systems technology in some arenas that makes cyberattacks easier and more profitable?
Purdy: I don't look at it in terms of a monoculture. I look at it in two tracks. One is the existence and discovery of numerous vulnerabilities and challenges that pose risks and costs to system operations, to protect systems without damaging [them].
Also we are actively involved in software assurance efforts to solve the problem that code is written with so many vulnerabilities.GCN: Studies of the insider threat to cybersecurity indicate that most cyberattacks mounted internally come from nontechnical employees'usually from authorized users. How can federal systems managers stem this threat?
Purdy: I think one of the great efforts is in the area of access controls, where the move is toward two-factor authentication. It's something you have and something you know, like when you go to the bank [cash machine] with a card and a PIN. I think there will be substantial progress for stronger access controls in the next year. I think most trusted users will have three-factor identification: something you have, something you know and something you are.GCN: Are you satisfied with the level of education about systems security in DHS or in federal agencies generally? Does DHS plan a renewed push to raise cybersecurity awareness and strengthen systems security training in the government?
Purdy: In terms of DHS, the effort to raise and maintain the level of appropriate awareness is run by the CIO and chief information security officer. They have had very aggressive campaigns for educating employees. There have been very aggressive efforts in other agencies. Our agency, with the Office of Management and Budget, does intend to raise awareness.GCN: The Homeland Security Department has received criticism from Congress and its own inspector general on several points of systems security. What steps is the cybersecurity division taking to deal with these problems, if any?
Purdy: The responsibility for our systems security rests with the CIO and chief information security officer. We have been in discussions and have a close relationship with those offices. We think we are moving ahead aggressively.GCN: Cyberattacks have advanced far beyond the level of the 'script kiddie' attacks. What do you believe are the most insidious and potentially damaging types of cyberattacks, and what emerging types of attacks keep you awake at night?
Purdy: Right now there is a black market in malicious cybertools of attack that are focused on financial gain. I am troubled by the availability of those malicious tools, particularly the ability to buy and grow botnets, which are networks of computers that are controlled by the perpetrator. [A botnet targets] computers of users who are unaware of that control. It means that, because of spyware and malicious code placed on computers, someone can use those computers to launch spam and steal personal identity information. They could also be used to launch denial-of-service and other serious attacks.
The move from the script kiddies to significant organized criminal groups does give law enforcement targets to investigate. But we can't rely on law enforcement alone to deal with the risks posed by these malicious tools.GCN: The lack of a cyber-Pearl Harbor may have lulled the private sector and parts of the government into complacency. Is there an actual need for alarm about this problem? Can we shelve our digital duct tape?
Purdy: Our dependency on cyberspace and the risks [that entails] is one that requires vigilance and concerted action. The [National Cyber Security Division], in partnership with other agencies and the private sector, is proceeding with appropriate seriousness to reduce risks.GCN: Where should federal IT managers direct their security resources most urgently?
Purdy: The road map is provided by the President's Management Agenda and the requirements of [the Federal Information Security Management Act] to bring their systems into a heightened state of cybersecurity readiness.GCN: Are you confident that overseas software development facilities that supply commercial applications for federal use have sufficient security, especially with regard to checking the backgrounds of programmers and systems analysts in places like Bangalore, India, and China, where commercial software is produced?
Purdy: We are working in partnership with the Defense Department and others in our software assurance initiative trying to develop tools so that software can be reviewed and analyzed whether it is made domestically or overseas. Traditionally, regarding our national security information systems, there has been heightened scrutiny given to all products that are going to be acquired from foreign sources. The development of the tools is important.GCN: What initiatives do you plan for the cybersecurity division in coming months?
Purdy: We are pursuing our goals to strengthen our National Cyber Response system. We are improving the information flow about cybersecurity from federal agencies and building our relationships internationally as well.