January 8, 2003 4:45 PM PST

Panel lets security makers off the hook

Related Stories

Homeland security waiting for Wi-Fi

December 4, 2002

CIA warns of Net terror threat

October 29, 2002

Cybersecurity plan lacks muscle

September 19, 2002
Security software and hardware makers should not have to submit their products for mandatory performance testing, a federal advisory council said Wednesday.

Members of the National Infrastructure Advisory Council (NIAC), a presidentially appointed panel, voted during a conference call Wednesday afternoon to remove language from a draft cybersecurity report that could have required that all "security products that protect critical infrastructure" undergo strict review.

The advisory report is scheduled to be sent to President George W. Bush in the next month, and any legal requirements it recommends imposing on the private sector would have to be approved by Congress.

Union Pacific Chairman and CEO Richard Davidson, chairman of NIAC, began the call by saying that the performance testing requirement is "probably not as palatable to the IT companies and probably is a little too strong in terms of regulation recommendations."

Davidson's note of caution was echoed by Cisco Systems CEO John Chambers. "We found that mandatory testing and evaluation testing and procedures in the area of security is something that has actually slowed down innovation and is always two to three steps behind," Chambers said. He suggested that this could result in a regulation that meets a lowest common denominator requirement.

Akamai Technologies' George Conrades said he would support the government's taking a market approach--using its purchasing power--to oversight of the cybersecurity industry. This would help quell concerns about slowing down innovation, the company chairman and CEO said. Conrades also agreed with the removal of the word "mandatory" from the report.

Margaret Grayson, CEO of network security firm V-One, suggested that certain "products be required to interoperate with each other." Other NIAC members, including Chambers, spoke out against the proposal, and Grayson eventually amended the testing requirement to become only advisory.

President Bush created the NIAC by executive order in Oct. 2001, after the Sept. 11 terrorist attacks, and appointed most members to it a year later.

The crafting of the NIAC recommendations is linked to the unveiling in September of a draft White House proposal recommending that industry and individuals take greater care in securing data rather than recommending tough new laws and regulations requiring specific industry segments to secure themselves.

 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.