Washington politicians are frequently denounced for moving too slowly to respond to emerging problems, and while the adage has proven true regarding the federal sector's response to cyber security thus far, the U.S. government is making slow progress in addressing the issue, experts maintain.
A panel of government and private sector security officials presenting at the ongoing RSA Conference 2008 this week admitted that Congress and the White House should have moved faster to address cyber security challenges, both within the U.S. and in terms of protecting national interests abroad.
But legislators are trying desperately to play catch-up and make headway in some areas of bolstering related laws and policies, the experts said.
Congress, White House begin cutting red tape
In addition to President Bush's recent cyber security initiative, most details of which remain classified, Congress is attempting to break down bureaucratic barriers that have made it hard to create new laws and policies governing cyber security and the prosecution of computer-based crimes, said Rep. James Langevin (D-RI), who was given a public policy award at the show for his work on the problem.
"Cyber security has been one of those areas that was largely ignored by the government, and we got a huge wake-up call when we realized how vulnerable we are to cyber-penetration across all areas of government," Langevin said.
"But at least now we are looking at how secure federal government networks are and taking some of the steps needed to better secure [them]. At the president's direction we are creating this new cyber security initiative, so we feel that the federal government is moving in the right direction."
In addition to finally receiving greater support for security-related efforts from the White House, there are ongoing efforts within Congress to reduce some of the bureaucratic issues that have made the federal government's response extremely challenging -- namely by reducing the number of committees that lawmakers working in the area must report to in the course of trying to advance their efforts.
"A lot of this is boiling down to collaboration. We often try everything but collaboration first -- and I can tell you this because there are dozens of oversight committees overlooking the Department of Homeland Security -- but we're working with Congress to get through some of the knotty issues," said Greg Garcia, assistant secretary for cyber security and communications for the Department of Homeland Security.
"This is true for all of us. We need to strengthen federal networks and get our own house in order. And that also applies to everyone else, because we are all connected," Garcia said. "The federal government can manage their network, and hopefully you can manage yours as well. We're only as strong as the weakest link."
Private sector experts agreed that Washington is finally getting more serious about cyber security, and they observed that some work in the area, such as the Federal Desktop Core Configuration (FDCC) standard -- aimed at speeding security patching times -- and mandates requiring all parties supplying software to the federal government to test their products for security vulnerabilities, will have significant long-term impact.
Allen Paller, director of research at the SANS Institute, said that those specific examples prove the government can make significant improvements when legislators are able to isolate the right opportunities to do so.
"People saw what could work so they made these national mandates around software sales and systems patching, and every company in the nation could do the same type of things to help themselves," Paller said. "By working with the vendors instead of blaming software companies for these problems, this type of effort can be helpful for everyone else."
Tough issues remain
Despite those operational improvements; other private sector representatives said the government has not yet addressed some of the toughest issues around computer and Internet security, including the creation of laws that will make it easier for prosecutors to bring cyber-criminals to justice.
Robert Holleyman, chief executive of the Business Software Alliance, said his constituents remain hopeful, yet discouraged, that they will see improvement in those areas anytime soon.
"We really need to ask what's the national policy and [look at] how to deal with legal loopholes that exist today," Holleyman said. "We're making some progress, as with laws that better define the use of botnets and other attacks, but so many people are still finding that their machines have been compromised and we need [legal] solutions to that.
"Part of the challenge is getting Congress to move on these issues. We've supported broader federal legislation for data breaches, around notification, around how people are informed. But the political realities are that it remains highly unlikely that this will get accomplished," he said. "There are so many constituencies involved in the process and in some senses they're only getting started with these problems."
Related content:
Government lags cyber crime fight, says report
Cyber crisis test sends Feds back to security school
Hactivism attacks could rise, warns security expert
icon.
