What Kind of Cyber-security Czar Do We Want?

By Larry Seltzer  |  Posted 2009-03-10 Print this article Print

What kind of national cyber-security officer could really make a difference? Do we really want to have an Internet under that kind of thumb?

During his campaign, President Obama promised that he would "make cyber-security the top priority that it should be in the 21st century. I'll declare our cyber-infrastructure a strategic asset, and appoint a national cyber-adviser, who will report directly to me."

About a month ago Obama appointed Melissa Hathaway, who served as the cyber-security coordinator executive under Mike McConnell, former President Bush's Director of National Intelligence, to be a senior director at the National Security Council. She is currently performing a 60-day review of security of federal systems. She is also a leading candidate to be the "national cyber-adviser" to which Obama referred in the campaign, assuming he goes through with such an appointment. Currently she is several steps away from reporting directly to the president.

Many years after creating a Director of National Intelligence (the new one is Dennis C. Blair), specifically in order to coordinate all the various sources of intelligence and make sense of them, it seems we're not very good at that, according to a report examined by the Wall Street Journal. "Cultural, organizational and technical obstacles have slowed efforts to move information across agency boundaries," according to the article. Expect cyber-security to be a similar problem, and remember that it is one of those components that needs to be coordinated by the DNI.

I actually assume that the DNI really did try to do a better job, and it seems the report says they did accomplish some things, just that they have a long way to go. But it's a really hard job, and coordinating cyber-security for the nation is really hard, too. It could be that it's a job doomed to failure; could we actually make things worse?

Absolutely we could. It's worth asking at the outset what we're talking about defending; is it just federal government systems, in which case the czar is really just the federal CSO? This is not only unobjectionable, it's a pretty good idea. I'm sure most large federal agencies have a CSO or someone with such responsibilities (correct me below if I'm wrong) but it's fair to have a coordinator directing a common security policy above them, one who can also help them to get their jobs done by providing political weight. This position really needs to report directly to the president? That I don't understand.

Already we've seen that political decisions are central to how this effort will be made. Just the other day the most recent person in charge of federal cyber-security, Rod Beckstrom, head of the U.S. National Cyber Security Center, resigned, complaining that all the authority was being taken from the Department of Homeland Security and put in the National Security Agency. That and the fact that his group was only sparsely funded. Even if this is just a job about federal systems, should it be run out of the NSA?

And if we're talking about someone who's in charge of security for the whole of U.S. Internet infrastructure, the idea is pretentious and dangerous. Today an appointed czar would have no real authority over badly administered Web servers, ISPs that have insufficient controls, networks with no DNSSec or IPv6 support. And there is no U.S. border to defend on the Internet; many significant U.S. Internet assets are tied closely with assets owned by the same organizations abroad.

If the government is supposed to have real authority in this regard it would take new and highly intrusive legislation to do so, and none of us would take it sitting down. If they won't have the authority, then nothing has really changed, which is maybe the best way to go about things.

What would you do if you really wanted to shape up the nation's networks? You'd need someone in charge with real authority, like a real CTO or network admin at a real enterprise. Imagine it: someone with the authority to quarantine infected systems; the authority to disconnect networks that are poorly, perhaps even maliciously, managed; the authority to ban old and insecure products and, conversely the authority to mandate new and secure ones, like DNSSec and IPv6; the authority to tell people "no, you can't do that with your own computer."

There is no way we would ever put up with authority like that on the Internet. There's no way service providers would put up with it either.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.

For insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's blog Cheap Hack.

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel