Commission calls for cybersecurity restructuring

A comprehensive strategy to secure cyberspace requires White House leadership.

The security of the nation’s cyber infrastructure is too fragile and too critical to be trusted to individual agencies. Instead, it requires a comprehensive strategy directed by the White House, a panel of government and industry experts said in making recommendations to the incoming president.

A long-awaited report by the Commission on Cyber Security for the 44th Presidency, released Dec. 8, recommends that cybersecurity be elevated to the level of the National Security Council and that a new National Office for Cyberspace be created and given governmentwide oversight responsibilities.

“Any comprehensive national security strategy is going to have many components,” said Scott Charney, corporate vice president of Microsoft’s Trustworthy Computing Group and co-chairman of the commission. Ensuring cooperation and coordination of the components requires leadership at a high level, he added. “It seemed obvious to us it would have to be placed in the White House.”

Cybersecurity efforts by the Homeland Security and Defense departments and the Office of Management and Budget are good but have not been adequately coordinated with one another, said Rep. Michael McCaul (R-Texas), co-chairman of the commission and ranking member of the House Homeland Security Committee’s Emerging Threats, Cybersecurity, and Science and Technology Subcommittee. “Elevating this position to the White House will help ensure that coordination,” he added.

The commission made several other recommendations that are likely to prove controversial in some circles. For example, members advocate greater federal regulation of the Internet to ensure that minimum security standards are met and suggest mandating stronger authentication for access to critical infrastructures, such as industrial control systems, energy systems, financial services and government services.

However, the commission tried to balance security needs and concerns over individual privacy with the traditional open nature of the Internet. Members said the government should avoid prescriptive security mandates that could stifle innovation and should prevent businesses from requiring strong authentication for all online activities in favor of a risk-based approach to credentialing.

The Center for Strategic and International Studies established the commission in 2007 in response to the growing number of breaches being reported in government information systems. Its goal was to produce concrete recommendations that could be implemented quickly and produce results.

Rep. Jim Langevin (D-R.I.), chairman of the emerging threats subcommittee, and retired Air Force Lt. Gen. Harry Raduege, now chairman of the Deloitte Center for Network Innovation, also served as co-chairmen of the commission. In addition, the group included 50 members from government, industry and academia, and James Lewis, chief of the technology policy program at CSIS, was the commission’s project director.

In the past year, the commission held 19 briefings to gather data. Its primary findings were that cybersecurity is a major national security issue, and that in addressing it, the government must respect privacy and civil liberties concerns.

“Only a comprehensive national security strategy that embraces both the domestic and international aspects of cybersecurity will improve the situation,” the commission’s report states.

Raduege called cyberspace a new global battlefront and identified four phases in the country’s acceptance of cyberthreats. The first was denial, followed by awareness. We are now in the third phase — actualization — which includes responses such as President George W. Bush’s Comprehensive National Cyber Security Initiative, legislation and studies such as the one by CSIS. Raduege said he hopes a fourth phase will follow in which security is a fundamental concern.

“We need strong measures and new ideas,” he said. “Cybersecurity is not a project. It is a campaign. It is going to continue for a long time.”

“The Obama administration has the opportunity and, I hope, the desire to improve the situation,” Langevin said.

But the commission’s recommendations must compete with pressing economic and military crises for attention as the new administration takes office. Lewis said the commission worked with both presidential campaigns and that “there are folks in the transition team who are well aware of what has been written.” He said they have expressed interest in the recommendations but made no firm commitment to act on them.

No price tag was attached to the recommendations. Although some would require establishing new offices and staff, others would be a matter of shifting priorities.

The commission members did not criticize DHS, which was given the lead for cybersecurity under the Bush administration, nor did it have harsh words for the president’s initiative. One of its recommendations is that the government should not start all over again by throwing out that initiative.

“While the [Bush administration’s initiative] is not comprehensive and unnecessary secrecy reduced its effect, we believe it is a good place to start,” the commission’s report states.

DHS and OMB would maintain their responsibilities for operational activities under the commission’s proposals, but the new National Office for Cyberspace and a new cybersecurity directorate at NSC would oversee a revised Federal Information Security Management Act, the Trusted Internet Connections initiative and the Federal Desktop Core Configuration plan. They might also require agencies to seek approval for cyberspace-related projects before submitting their budget proposals to OMB.

The recommendations call for a sort of Monroe Doctrine for cyberspace “based on a public statement by the president that the cyber infrastructure of the United States is a vital asset for national security and the economy and that the United States will protect it, using all instruments of national power,” the report states. Those instruments would include diplomatic, intelligence, military, economic and law enforcement activities.

Applying a broad, heavy-handed policy to cybersecurity could prove difficult because so far we have a lot of anecdotal evidence but little hard information about the nature of the threats we are facing in the online world, the commission members said.

“Massive amounts of data have been stolen” from government systems “almost on a daily basis,” McCaul said, and there have been trillions of dollars’ worth of theft and fraud in the private sector. But “it is very difficult to get back to the source,” he added.

“We know far too little about the identity and intent of those attacking,” Raduege said.

Without knowing whether the attack is coming from a nation state, a criminal ring or a casual hacker, it is difficult to determine whether the response should be military, police-driven or diplomatic.

Other recommendations offered by the commission include:

  • Reinvent the public/private partnership between government and the businesses that own and operate most of the country’s cyber infrastructure, with an increased emphasis on trust and information sharing.
  • Modernize the decades-old laws governing communications and other elements of the cyber infrastructure.
  • Implement basic security standards in government acquisition requirements so they can drive improved security.
  • Support research, training and education in cybersecurity.
  • Revise FISMA to require performance-based measurements.
  • Eliminate the distinction in requirements for national security information systems versus civilian systems and create a single risk-based approach to cybersecurity.
X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.