The top U.S. cybersecurity official wants Congress to come up with ways to promote adoption of security technologies, and he sees a tax break as one possible incentive.
For example, Garcia is asking for Congress to think of ways to promote more purchases of security technology or technology with security already built in. He's not asking for regulation of the industry. He opposes that, thus going against some who have advocated backdoors in encryption technology so law enforcement can read the encrypted files of criminal suspects.
Q: You've been on the job almost six months now. You've said that after the first week you felt like a laptop getting a download from a supercomputer. What do you feel like now? Garcia: I feel like a supercomputer. We are really poised for some successes this year. When I say it is downloading a supercomputer into a laptop, it was because the cybersecurity and communications mission is so huge, and, of course, it's learning your way around the bureaucracy. But in mid-December I briefed the secretary on my objectives and he understood it, and he gave me the marching orders to go execute.
What we need to be able to do is to articulate how it is that investing in security is going to accrue more benefits back to the company.
Now it's February and I've got my leadership team in place, and so I'm feeling much more complete as an organization that we have the intellectual firepower (and) we have people with years of government experience who understand how to get things done. So, I'm feeling very confident.
You're the first person to have this more elevated role and title as assistant secretary. Is it important that you are an assistant secretary--does it make your job easier? Garcia: I noticed it on my first week on the job. I think what everybody was looking for is someone who is the focal point for cybersecurity and communications security. Somebody who can actually follow through when the private sector is asked to commit resources to do something like a national risk assessment (or) to do something like partnering with the government on operational capabilities.
A lot of problems in the past existed because there was not someone of this level managing the mission. It really took place with fits and starts because there wasn't someone senior enough to have the influence and the authority, not just within DHS, but across all government agencies. I am able to say: "This will be," and I can get things done. People recognize that, and they were eager for it.
You plan on calling on Congress to think of ways to provide incentives so people will enhance security. What incentives would drive security investments? Garcia: All the stakeholders have different business models: financial services companies, banks, insurance companies, for example. What is persuasive to them as a business case so they would invest $1 million in an information technology system with security features and invest in training?
Globalization does present risks, but ultimately the test is not where something is made, but how it is made.
I think Congress plays an important role in its oversight capacity. What laws are in existence that (deter) investment in security, and what laws ought to be written that will help push the market toward investment that will strengthen our security? Is it insurance? Get better rates on insurance. Are there tax incentives that can come from this? Relief from liability?
There are a lot of different ideas that have been discussed by the private sector, by Congress. I want a more concerted effort, a series of hearings that really look at some of the different critical infrastructure sectors. What we need to be able to do is to articulate how it is that investing in security is going to accrue more benefits back to the company.
Ultimately, you would hope that Congress in some way would make it more interesting for businesses, organizations and universities to invest in security? Garcia: There may be no need for legislation. What I'm suggesting is that this conversation needs to take place in a methodical way. Just the existence of that conversation may get different sectors to think creatively about how companies can invest and feel good about the investment knowing that there is a return.
...unless every person in the organization is properly trained and doesn't do idiotic things like take home sensitive data or give out their authentication information.
The most secure cryptography is worthless under these circumstances. The most advanced network defenses completely fail when you have stupid people.
Instead of hiring a hack to be in charge of this important area, why didn't they hire a someone with real technical background who is well versed in computer security?
There is a saying is computer security circles, security features != secure features.
Web giant is spending $120 million to beef up its Mountain View, Calif., headquarters, according to filings with the city reviewed by the San Jose Mercury News.
The Samsung Galaxy Mini 2 S6500 could make its debut at the Mobile World Congress in Barcelona later this month, according to a leaked promotional image.
MIT creates a simulation to celebrate the 50th anniversary of Spacewar. A relic of the early days of minicomputers, it was one of the first computer video games and set the stage for many others, including Asteroids.
The most secure cryptography is worthless under these circumstances. The most advanced network defenses completely fail when you have stupid people.
Instead of hiring a hack to be in charge of this important area, why didn't they hire a someone with real technical background who is well versed in computer security?
There is a saying is computer security circles, security features != secure features.