WASHINGTON–The governments second highest-ranking information security official said the nations critical network infrastructure is clearly vulnerable to a concerted attack, but legislation or other forms of government intervention are not the answer to the problem.
Howard Schmidt, the vice chairman of the Critical Infrastructure Protection Board, said Monday that he believes a combination of public-private partnerships and market pressure on software vendors is the right approach to boosting the security of the countrys networks.
“The governments role is bringing people to the table and encouraging them talk and adopt best practices,” Schmidt said during a Webcast panel discussion on protecting the nations critical infrastructure. “Were trying to reduce the additional regulation on industry.”
To that end, the board is developing a plan for a new government center that would provide early warning and analysis of security events such as the Code Red worm or widespread network-intrusion attempts. Tentatively dubbed the Cyber Warning and Information Network, the center would serve as a nerve center for government information security officials during large-scale security events.
The center is meant to mirror the operation centers that the government set up to handle the Y2K rollover.
Some of the other panel members werent so sure that change could come about without some form of government guidance.
“We need to have some kind of legislation,” said Peggy Weigle, CEO of Sanctum Inc., a security vendor based in Santa Clara, Calif. “Security today has just simply not been a core value. We need a little more of a push from the government along with some guidelines.”
Alan Kirby, vice president of engineering at Okena Inc., in Waltham, Mass., suggested a different approach, urging Schmidt to encourage ISPs to install egress filters to limit outgoing attack traffic. He also said the government could best serve industry and citizens by setting a good example.
“The government should act as a moral authority to encourage the use of better software engineering practices,” Kirby said.
Schmidt, the former chief security officer at Microsoft Corp., said that the Critical Infrastructure Protection Board should deliver its comprehensive security strategy report to the president sometime this summer. He added that the board is currently poring over the more than 150 responses it got to its request for proposals for the GovNet private network.
