'No one would tolerate' Internet crime rates in physical world, FCC official says

Despite strong reservations from many lawmakers about government’s ability to effectively regulate cybersecurity in the private sector, industry efforts to date have been inadequate to protect networks on which the nation’s economy and security increasingly depend, according to a panel of federal officials.

James Barnett Jr., chief of the Federal Communications Commission’s Public Safety and Homeland Security Bureau, called network operators the first line of defense and praised their efforts before a House Energy and Commerce subcommittee.

But “it’s not working,” Barnett said. “We wouldn’t be here talking about it if it were. No one would tolerate this level of criminality, thievery, vandalism or invasion of property if it was done in the physical world, and we can no longer afford to tolerate it in cyberspace.”

Related coverage:

Industry to Congress: Hands off cybersecurity

Legal, policy frameworks can hamper cybersecurity

Witnesses at the March 28 hearing stopped short of endorsing mandatory requirements for private-sector cybersecurity, however. They focused instead on improved voluntary cooperation between the public and private sectors. Barnett said government should seek “smart, practical, voluntary solutions through cooperative efforts...wherever it is possible and effective.”

The hearing was the third this year in response to a GOP cybersecurity task force that last year recommended Congress concentrate on targeted, easy-to-achieve legislation rather than a comprehensive cybersecurity bill.

The task force also recommended that Congress avoid regulation in favor of incentives for voluntary cooperation. This is at odds with several comprehensive bills that introduced by Democrats that would give the Homeland Security Department responsibility for overseeing minimum security standards for privately owned critical infrastructure.

DHS currently is the lead agency for protecting civilian government infrastructure as well as privately owned systems, but the department has little legal authority in either role. Acting Assistant Secretary Roberta Stempfley of the DHS National Protection and Programs Directorate told the committee the federal government has a responsibility to take part in cybersecurity, but said department’s current role is collaborative.

Barnett said major networking companies serving 80 percent of the nation’s Internet users have agreed to adopt voluntary recommendations developed by the FCC’s Communications Security, Reliability and Interoperability Council, a cooperative public-private organization. They include:

• The Anti-Bot Code, a voluntary code of conduct to provide a baseline framework of security to mitigate the botnet threat. Actions include end-user education; detection, notification and remediation of bots on their networks, and information sharing. Comcast and CenturyLink already have implemented these measures and other networks have pledged to follow suit.
• Prevention of route hijacking. Service providers will work to develop and implement secure routing protocols that will prevent exploitation of vulnerabilities in the Border Gateway Protocol. This would include an authoritative database of IP address blocks that ISPs could check and use to prevent hijacking.
• Implement Domain Name System Security Extensions (DNSSEC) to prevent misdirection of traffic by exploiting DNS vulnerabilities.

Barnett said the recommendations are “non-regulatory, industry-based and have been worked on in cooperation with our federal partners.”

DNSSEC is also a focus of the Commerce Department’s National Telecommunications and Information Administration, a non-regulatory agency that helps develop federal communications policy and advanced implementation of DNSSEC on the Internet’s root zone.

“DNSSEC deployment at the authoritative root was an important step toward ensuring the integrity of DNS data,” said NTIA Associate Administrator Fiona Alexander. “If we are going to maintain the trust of the Internet, we must support further DNSSEC deployment.”

Robert Hutchinson, senior manager for information security sciences at Sandia National Laboratories, outlined what he believes government must do to improve cybersecurity:

• Shift from a focus on data theft to what he called the more important issue of data modification, which could corrupt decision making and undermine public safety and confidence.
• Pay more attention to supply chain security to ensure hardware and software has not been compromised at its source.
• Supplement information sharing between government and industry with clear, enforced rules on how information can be used by each side.
• Expand efforts to develop a professional cybersecurity workforce through educational programs and professional development.

Witnesses emphasized their current roles in voluntary cooperation with the private sector and did not ask for regulatory authority to ensure baseline security in critical infrastructure. Such a request would be unlikely to be met with favor in the Republican-controlled subcommittee. Subcommittee vice chairman Rep. Lee Terry (R-Neb.) said that, in his opinion, having DHS create rules for an industry sector would be “dooming that industry.”