Much work remains to secure U.S. cyberinfrastructure, industry group says
- By William Jackson
- Feb 06, 2007
SAN FRANCISCO ' The Homeland Security Department finally named an assistant secretary for cybersecurity last year, and the Senate ratified the first international treaty on cybercrime.
The Computer Security Industry Alliance had lobbied for these achievements for more than two years and counts them as big wins, said acting executive director Liz Gasster. But the nation still lacks a comprehensive data security law, and DHS needs to develop response and recovery plans for disruptions of our critical infrastructure.
These challenges, along with a reworking of the Federal Information Security Management Act, are among the priorities for CSIA in its fourth year, Gasster said.
CSIA, celebrating its third birthday this week at the annual RSA cybersecurity conference, is a CEO-led public policy and advocacy group formed in 2004. It was established with 12 corporate members to give the security industry a unified voice in Washington and since has doubled its membership to 24 companies.
CSIA has set out a cybersecurity agenda for government for the last two years, with only indifferent results. In its Federal Progress Report for 2006, it gave the administration an overall grade of D because of failures to pass privacy legislation and to set clear priorities for future work.
U.S. ratification of the Council of Europe's Convention on Cybercrime was a major objective of CSIA from the beginning. It is the first treaty requiring cooperation among law enforcement agencies in different counties in the investigation and prosecution of online fraud and other computer crimes. Forty nations have signed the treaty, which went into effect in July 2004, and 18 have ratified it. The U.S. Senate ratified it in August.
'That is particularly important,' Gasster said, because the convention will help put pressure on other countries, including non-signatory countries, to bring their laws into line with the treaty.
In September, Greg Garcia was named to the long-awaited and long-vacant post of assistant secretary for cybersecurity and telecommunications at DHS. The new position raises the profile of cybersecurity within the department, and industry groups have lobbied for it since the creation of DHS in 2003.
Gasster praised the appointment, but said it is only a first step.
'It's just the beginning of more work DHS needs to do,' she said. 'They try to have their hands in all things cybersecurity,' including public awareness and research and development programs. But there is a lack of focus on the nuts and bolts of dealing with a major cyberdisruption. 'We are concerned that there isn't the leadership structure to respond to such a situation,' she said.
Gasster said DHS needs to concentrate on three areas:
- A command-and-control structure for response to a cyberemergency
- A situational awareness system to let responders see what is happening across the Internet in near real time so that disruptions can be quickly identified
- An emergency communications plan that includes not only how to keep communications working during a crisis, but also who in the private sector would be responsible for responding to disruptions of the infrastructure.
Gasster was disappointed at Congress' failure last year to pass data security legislation. A number of bills were introduced in the last Congress addressing how personal data is protected, but none made it out of committee. In the absence of a national law, many states have passed their own laws requiring public notification of data breaches, creating a regulatory patchwork that many companies want to replace.
'It's a rather confusing landscape out there today,' Gasster said, and a national law would simplify and improve compliance.
Many state laws address only the disclosure of sensitive data, and not its protection. Gasster said CSIA wants a more proactive law that would set standards for data security as well as procedures to respond to breaches.
Can such a law be passed in the 110th Congress?
'I'm an optimist,' Gasster said. 'There is clearly a strong public mandate for legislation.' She blamed jurisdictional battles between committees for killing bills in the last Congress and is hopeful these can be ironed out in the coming year.
Another area CSIA wants Congress to address is FISMA. Gasster called FISMA, which sets out IT security policies for federal agencies, a 'terrific piece of legislation,' for raising the profile of IT security. 'But more needs to be done to enhance the responsibility and authority of CIOs as change agents,' she said.
CSIA also opened an office in Brussels in September and will be working to influence the European Community as it updates its policies on spam, spyware and privacy.
'It's important to have a presence on the ground there,' Gasster said. 'Cybersecurity is a global matter.'
William Jackson is a Maryland-based freelance writer.