Trust Me!

It was hastily organized and slightly awkward, but it was a first: Representatives from the FBI, Microsoft and industry security groups stood on a single dais in Washington, D.C., and warned the world about the dangers of the Code Red computer worm.

While the July 30 press conference was arguably helpful in stemming the spread of the virus, the real news was the coalition itself, which is in its earliest and most fragile state. The reality is that federal goals to protect the nations infrastructure from cyberattacks remain largely unrealized, leaving most private-sector companies to fend for themselves in increasingly dangerous times.

In just one year, network intrusions have doubled, according to a recent report. The Computer Security Institutes (CSI) 2001 Computer Crime and Security Survey showed that 40 percent of 538 respondents detected system penetrations from outside, compared with 20 percent in 2000. Thirty-eight percent said they were the victims of denial-of-service attacks, up 11 percent from last year.

The Bush administration recently created nine new Department of Justice (DOJ) teams to prosecute cybercrimes. In addition, the White House is expected to announce a new national infrastructure protection directive in the next few weeks; early reports, however, indicate that it will do little more than add another interagency oversight layer, while leaving the present structure unchanged.

What exists now is a dizzying patchwork of competing and sometimes conflicting government agencies and a scattering of largely paranoid industry security groups. Everyone agrees that mutual trust and cooperation are the keys to success. No one is exactly sure how to get there.

"People are still committed to the idea that this is a problem that can only be solved by some joint public/private partnership," said Bruce Moulton, chairman of the Financial Services Information Sharing and Analysis Center (FS/ISAC). "Nobody has come up with a magic vision yet."