Commission calls for cybersecurity restructuring

The security of the nation’s cyber infrastructure is too fragile and too critical to be trusted to individual agencies. Instead, it requires a comprehensive strategy directed by the White House, a panel of government and industry experts said in making recommendations to the incoming president.

A long-awaited report by the Commission on Cyber Security for the 44th Presidency, released Dec. 8, recommends that cybersecurity be elevated to the level of the National Security Council and that a new National Office for Cyberspace be created and given governmentwide oversight responsibilities.

“Any comprehensive national security strategy is going to have many components,” said Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group and co-chairman of the commission. Ensuring cooperation and coordination of the components requires leadership at a high level, he added. “It seemed obvious to us it would have to be placed in the White House.”

Cybersecurity efforts by the Homeland Security and Defense departments and the Office of Management and Budget are good but have not been adequately coordinated with one another, said Rep. Michael McCaul (R-Texas), co-chairman of the commission and ranking member of the House Homeland Security Committee’s Emerging Threats, Cybersecurity, and Science and Technology Subcommittee. “Elevating this position to the White House will help ensure that coordination,” he added.

The commission made several other recommendations that are likely to prove controversial in some circles. For example, members advocate greater federal regulation of the Internet to ensure that minimum security standards are met and suggest mandating stronger authentication for access to critical infrastructures, such as industrial control systems, energy systems, financial services and government services.

However, the commission tried to balance security needs and concerns over individual privacy with the traditional open nature of the Internet. Members said the government should avoid prescriptive security mandates that could stifle innovation and should prevent businesses from requiring strong authentication for all online activities in favor of a risk-based approach to credentialing.

The Center for Strategic and International Studies established the commission in 2007 in response to the growing number of breaches being reported in government information systems. Its goal was to produce concrete recommendations that could be implemented quickly and produce results.

Rep. Jim Langevin (D-R.I.), chairman of the emerging threats subcommittee, and retired Air Force Lt. Gen. Harry Raduege, now chairman of the Deloitte Center for Network Innovation, also served as co-chairmen of the commission. In addition, the group included 50 members from government, industry and academia, and James Lewis, chief of the technology policy program at CSIS, was the commission’s project director.

In the past year, the commission held 19 briefings to gather data. Its primary findings were that cybersecurity is a major national security issue, and that in addressing it, the government must respect privacy and civil liberties concerns.

“Only a comprehensive national security strategy that embraces both the domestic and international aspects of cybersecurity will improve the situation,” the commission’s report states.

Raduege called cyberspace a new global battlefront and identified four phases in the country’s acceptance of cyberthreats. The first was denial, followed by awareness. We are now in the third phase — actualization — which includes responses such as President George W. Bush’s Comprehensive National Cyber Security Initiative, legislation and studies such as the one by CSIS. Raduege said he hopes a fourth phase will follow in which security is a fundamental concern.

“We need strong measures and new ideas,” he said. “Cybersecurity is not a project. It is a campaign. It is going to continue for a long time.”

“The Obama administration has the opportunity and, I hope, the desire to improve the situation,” Langevin said.

But the commission’s recommendations must compete with pressing economic and military crises for attention as the new administration takes office. Lewis said the commission worked with both presidential campaigns and that “there are folks in the transition team who are well aware of what has been written.” He said they have expressed interest in the recommendations but made no firm commitment to act on them.

No price tag was attached to the recommendations. Although some would require establishing new offices and staff, others would be a matter of shifting priorities.

The commission members did not criticize DHS, which was given the lead for cybersecurity under the Bush administration, nor did it have harsh words for the president’s initiative. One of its recommendations is that the government should not start all over again by throwing out that initiative.

“While the [Bush administration’s initiative] is not comprehensive and unnecessary secrecy reduced its effect, we believe it is a good place to start,” the commission’s report states.

DHS and OMB would maintain their responsibilities for operational activities under the commission’s proposals, but the new National Office for Cyberspace and a new cybersecurity directorate at NSC would oversee a revised Federal Information Security Management Act, the Trusted Internet Connections initiative and the Federal Desktop Core Configuration plan. They might also require agencies to seek approval for cyberspace-related projects before submitting their budget proposals to OMB.

The recommendations call for a sort of Monroe Doctrine for cyberspace “based on a public statement by the president that the cyber infrastructure of the United States is a vital asset for national security and the economy and that the United States will protect it, using all instruments of national power,” the report states. Those instruments would include diplomatic, intelligence, military, economic and law enforcement activities.

Applying a broad, heavy-handed policy to cybersecurity could prove difficult because so far we have a lot of anecdotal evidence but little hard information about the nature of the threats we are facing in the online world, the commission members said.

“Massive amounts of data have been stolen” from government systems “almost on a daily basis,” McCaul said, and there have been trillions of dollars’ worth of theft and fraud in the private sector. But “it is very difficult to get back to the source,” he added.

“We know far too little about the identity and intent of those attacking,” Raduege said.

Without knowing whether the attack is coming from a nation state, a criminal ring or a casual hacker, it is difficult to determine whether the response should be military, police-driven or diplomatic.

Other recommendations offered by the commission include:

• Reinvent the public/private partnership between government and the businesses that own and operate most of the country’s cyber infrastructure, with an increased emphasis on trust and information sharing.
• Modernize the decades-old laws governing communications and other elements of the cyber infrastructure.
• Implement basic security standards in government acquisition requirements so they can drive improved security.
• Support research, training and education in cybersecurity.
• Revise FISMA to require performance-based measurements.
• Eliminate the distinction in requirements for national security information systems versus civilian systems and create a single risk-based approach to cybersecurity.