Is the Bush Administration Getting Serious About Information Security?

Of course, protecting government systems is just one part of what needs to be done to improve our nation's cyber security posture. With the vast majority of critical infrastructure systems — from power plants to financial institutions and telecommunications providers — located in the private sector, steps will also need to be taken to enhance the information security of those systems, organizations and networks.

A new national blue-ribbon commission has been established to take on the task of identifying a strategy and set of recommendations for the next Administration to move ahead in securing cyberspace. The Commission on Cyber Security for the 44th Presidency is scheduled to complete its work by December 2008 and is being convened by the Center for Strategic and International Studies, a nonpartisan, nonprofit research center organization headquartered in Washington, D.C.

As the Commission does its work, the U.S. Congress continues to do its own in relation to improving our national cyber defenses and on critical infrastructure protection, with many oversight hearings on cyber security by the House Homeland Security Committee. I credit the House Homeland Security Committee and its Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology in particular for raising awareness and pushing for more focus and prioritization on these issues during the 110th Congress. I also think that DHS Assistant Secretary for Cybersecurity and Communications, Greg Garcia, has done a solid job during his first year as the Administration's "cyber czar" by focusing more attention on the issue within DHS. Specifically, he has helped increase national awareness, improving coordination with private industry and is beginning to position the U.S. CERT and the National Cyber Security Division to play an enhanced (and desperately needed) role in protecting federal networks. For more on Garcia's first year, see Brian Robinson's recent article in Federal Computer Week.

It's important to note also that while all the above activity (that is more focused on critical infrastructure protection and securing government systems) has been occurring, cyber-crime and identity theft are also receiving more attention. The President's Identity Theft Task Force issued a Strategic Plan for Combating Identity Theft earlier this year — and the U.S. Congress is considering several legislative measures to implement some of the Strategic Plan's recommendations that focus on cyber-crime. If you didn't see it, there was an excellent series by Ryan Blitstein this past week in the San Jose Mercury News about the complexities surrounding cyber-crime, both in terms of the threats, the difficulties of finding the actual perpetrators, as well as the effective prosecution and penalization of the criminals once they are caught. What is striking to me though, in terms of Congressional in-action, is that we have not yet seen a cyber-crime bill (of the several versions that are being considered) enacted yet. With the billions of dollars in economic losses annually that the Mercury News series covers in detail, why can't the Congress find a way to move some of the legislation that is aimed at the actual criminals? This week, the U.S. Senate approved S. 2168, the Identity Theft Enforcement and Restitution Act of 2007, which is a welcome development; the House should also move a similar bill this year. In addition, the House and Senate should pass a national data security bill that would establish federal standards for safeguarding sensitive information and for notifying consumers should a breach occur — the President's Strategic Plan also recommended that course of action.

Let me know what you think.

Post A Comment

Your Name
Your Email	Publish email?: Yes No
Your Blog
Subject
Comment
Verification Word