eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
With little fanfare, the White House Friday afternoon released the much debated National Strategy to Secure Cyberspace, which calls on industry to show unprecedented cooperation with goverment agencies in the name of network security.
The plan depends heavily on network operators and industry groups sharing with the government information on network attacks, security threats and widespread vulnerabilities. While similar efforts in the past have failed, some industry insiders say there is reason to believe that this time may be different. Meanwhile, President Bush in his introduction of the plan, called the effort “a framework for protecting this infrastructure that is essential to our economy, security, and way of life.”
“The cornerstone of Americas cyberspace security strategy is and will remain a public-private partnership. The federal government invites the creation of, and participation in, public-private partnerships to implement this strategy,” Bush wrote. “Only by acting together can we build a more secure future in cyberspace.”
Those who had seen earlier versions of the plan expressed support. “The strategy is being accepted within the government,” said Pete Morrison, director of the public sector at security vendor Netegrity Inc., in Waltham, Mass. “Ive seen a new awareness inside the government, and I think when people see that, they [will be] more willing to take it seriously and help with information.”
The centerpiece of the strategy is a comprehensive cyber-security response system that relies on contributions from the private sector. The system would utilize a broad information-sharing program both inside and outside the federal government, facilitated by a separate office within the Department of Homeland Security, which the plan also calls for.
The “infrastructure protection program office,” as referred to in the plan, would handle the flow of data between the private sector and the government. The office would also be responsible for determining how to store information regarding critical infrastructure protection that is voluntarily submitted by nongovernment organizations.
The strategy also recommends that the private sector develop a centralized network operations center to assess Internet health and complement the DHSs centralized capability and the overall National Cyberspace Security Response System.
This final plan differs greatly from the preliminary draft released for comment by the Presidents Critical Infrastructure Protection Board in September under the direction of outgoing PCIPB Chairman Richard Clarke.
That original draft was divided into five sections—covering home users and small businesses, large enterprises, critical sectors, national priorities, and global issues. The final version is organized along five priorities—a national cyberspace security response system, a national cyberspace security threat and vulnerability reduction program, a national cyberspace security awareness and training program, securing governments cyberspace, and international cyberspace security cooperation.
And where the original draft was heavy on recommendations and suggestions, the approved plan uses much stronger language, in many cases issuing directives to various government agencies.
Page Two
: With Little Fanfare, Feds Unveil Cyber Plan”>
Still, the core of the new plan is cooperation and information sharing—both sensitive subjects for the private sector. Past information-sharing concepts, not sponsored by the government, have centered on organizations such as the industry-specific Information Sharing and Analysis Centers and the FBIs InfraGard. However, these and other plans have lacked a good definition of the kind of data the government needs and how its going to be handled once its submitted. As such, security experts say this time around, the government would do well to make such distinctions.
“Sharing information [on vulnerabilities] reveals nothing that would make a company look bad in front of its customers,” said Stuart Schechter, a security researcher at Harvard University, in Cambridge, Mass., and co-author of a paper on the benefits of information sharing. “Even revealing that youve seen a vulnerability exploited doesnt reveal that this has resulted in a successful attack. Better statistics on just how many systems are broken into because systems arent patched would be nice to know—but most of us know where these systems fail. Better numbers on losses from attacks would certainly be useful.”
However, some security experts are pessimistic about the chances for widespread cooperation.
“History has shown that unless theyre forced to, people wont reveal any information, for obvious reasons,” said Avi Rubin, associate professor of computer science and technical director of the Information Security Institute at Johns Hopkins University, in Baltimore. “On the other hand, we still dont have good protective measures yet. They need to allocate more funding to research. They should let those of us who know what were doing do it.”
Referring to the contentious history of the plan, Bush today said, “Securing cyberspace is an extraordinarily difficult strategic challenge that requires a coordinated and focused effort from our entire society—the federal government, state and local governments, the private sector, and the American people.”
“To engage Americans in securing cyberspace, a draft version of this strategy was released for public comment, and ten town hall meetings were held around the Nation to gather input on the development of a national strategy,” the president added. “Thousands of people and numerous organizations participated in these town hall meetings and responded with comments. I thank them all for their continuing participation.
Safety in numbers
The national strategy focuses on five areas deemed crucial to network security:
- Priority 1: Build a national security response system
- Priority 2: Create a threat and vulnerability reduction program
- Priority 3: Develop a national security training program
- Priority 4: Secure governments cyberspace
- Priority 5: Enhance international cooperation
- eWEEK Special Report: Bushs Cyber-Security Plan
- National Strategy to Secure Cyberspace