- Related Stories
-
Homeland Security flunks cybersecurity prep test
May 26, 2005 -
Feds eye new cybersecurity post
May 16, 2005 -
Homeland Security panel picks controversial chief
April 6, 2005 -
Thumb twiddling on cybersecurity
October 21, 2004 -
Digital Agenda: Homeland Security
October 20, 2004
Is the cybersecurity division next?
Like FEMA, the U.S. government's cybersecurity functions were centralized under the Department of Homeland Security during the vast reshuffling that cobbled together 22 federal agencies three years ago.
Auditors had
"When you look at the events of Katrina, you kind of have to ask yourself the question, 'Are we ready?'" said Paul Kurtz, president of the Cyber Security Industry Alliance, a public policy and advocacy group. "Are we ready for a large-scale cyberdisruption or attack? I believe the answer is clearly no."
The department, not surprisingly, begs to differ. "Cybersecurity has been and continues to be one of the department's top priorities," said Homeland Security spokesman Kirk Whitworth.
But more so than FEMA, the department's cybersecurity functions have been plagued by a series of damning reports, accusations of bureaucratic bungling, and a rapid exodus of senior staff that's worrying experts and industry groups. The department is charged with developing a "comprehensive" plan for securing key Internet functions and "providing crisis management in response to attacks"--but it's been more visible through press releases such as one proclaiming October to be "National Cyber Security Awareness Month."
Probably the plainest indication of potential trouble has been the rapid turnover among cybersecurity officials. First there was Richard Clarke, a veteran of the Clinton and first Bush administrations who left his post with a lucrative book deal. Clarke was followed in quick succession by Howard Schmidt, known for testifying in favor of the Communications Decency Act, then Amit Yoran and Robert Liscouski.
The top position has been vacant since Liscouski quit in January. In July, Homeland Security Secretary Michael Chertoff pledged to fill the post but has not named a successor.
"I sure wouldn't take that job," said Avi Rubin, a professor specializing in cybersecurity at Johns Hopkins University. "It only has a downside."
If an Internet meltdown happened--perhaps a present-day rendition of the 1988 worm created by Robert Morris, which forced administrators to disconnect their computers from the network to try to stop the worm from spreading--Homeland Security's cybersecurity official would wield little power yet shoulder all the blame, Rubin said. "The person who was cybersecurity czar would be out of a job and would be blamed, even though it might have been someone else not following a policy."
Other top-level staff have been departing: The deputy director of Homeland Security's National Cyber Security Division, a top official at the Computer Emergency Response Team, the undersecretary for infrastructure protection and the assistant secretary responsible for information protection have all left in the past year.
A promotion in the works
Raising the profile of cybersecurity efforts inside Homeland Security has garnered some support in the U.S. House of Representatives.
Earlier this year, Rep. Zoe Lofgren, a California Democrat, and Rep. Mac Thornberry, a Texas Republican, reintroduced legislation from the previous congressional session that would create an assistant secretary for cybersecurity.
The much talked-about position would report directly to the Homeland Security secretary, on equal footing with posts that oversee the nation's physical infrastructure. Under current department structure, the top cybersecurity official is buried in a few levels of bureaucracy beneath the Homeland Security chief.
"Creating an assistant secretary is far more than just an organizational change," Thornberry said when introducing the bill. "It is an essential move to assure that cybersecurity is not buried among the many homeland security challenges we face."
The proposal was ultimately wrapped up in the broader Homeland Security Authorization Act for 2006 and has been approved by the House. But since May, it has been sitting in front of the Senate Homeland Security committee, which has not indicated when further action will occur.
Outside observers are holding out hope for Chertoff's departmental reorganization announced in July. As part of the reshuffling, he hired Stewart Baker, former general counsel to the National Security Agency and a well-respected technology lawyer, to be assistant secretary for policy. Baker is waiting for Senate confirmation.
"It's been a mess for over four years, and hopefully the new folks will fix this," said Jim Lewis, director of the technology and public policy program at the Center for Strategic and International Studies.
"In the previous incarnation, DHS and the Homeland Security Council didn't really know what to do with cyber--it's been a deer-in-the-headlights experience for them," Lewis said. "It's not clear who's even in charge. When you look at all the different committees who
See more CNET content tagged:
cybersecurity, homeland security, Richard Clarke, department, Hurricane Katrina
Gathering all pertinent information related to the collateral damage and making estimates of the amount and type(s) of logistics required alone took more than a day due to the wide destruction in that area.
And getting together the sheer amount of logistics required takes at least another day or two at best.
Nagin on the other hand had over 250 school busses and all of the city busses to his avail but didn't use them.
Thus let's not drag FEMA in when FEMA isn't to be blamed. EMA is first response... FEMA is called in later. But both usually respond AFTER the damage has been caused.
The city and state are responsible for planning evacuations of that scale and if they are unable to handle it... they can request for FEMA support, but that request must be received prior to FEMA being able to step on the states toes. That's how state regulations were created and how they still work.
So as for why FEMA didn't respond earlier... who made the call to request assistance. Nagin didn't, Blanco didn't...
As for CyberSecurity heading for a FEMA like catastrophe... Now that the first part of this article has been de-bunked... what similar catastrophe is that?
There are numerous threats which continue to cause worries about our internet. But here too... it's not the CyberSecurity team which DHS heads that will thwart the problem as much as it is each individual ISP's acceptance and implementation of the effective methods to thwart off such attacks.
But with so many concious objectors and lack of support from ISP's... they're gonna be the future Nagin and Blanco runner-ups if they don't get their cyber-threat-ears out there and start taking more responsibility where the first line of responsibility should be taken.
SPAM is one very good example. SPAM continues to be sent out with spoofed addresses even though that was declared illegal over 1.5 years ago. ISP's are the first line of defense. But many today still don't do anything to stop it. Blocking outgoing port 25 would go a long way to reduce a good amount of SPAM, but they do nothing about it.
Just like Nagin and Blanco... so don't go trying to pin the tail on the elephant in the white house when it belongs on the local donkey!
Walt
2) What type of attacks? Well, how about taking down DNS servers? That'd take down the whole Internet. Not to mention attacks on supposedly closed-off infrastructure networks (something like the most recent season of "24").
There's also the issue of numerous FEMA no-bid contracts. Yes, that again! So don't try to put all the blame on the local party hacks, FEMA created its own disaster. The point of this story is that DHS Cybersecurity is another FEMA waiting to happen. Will we all be surprised when it happens, when Congress calls for yet another blue- ribbon committee after the fact? When the Schummer-Feinstein-Boxer-Sharpton-Jackson hacks swoop down and again try to make it a purely Republican issue? Well at least CNET readers won't be surprised.
Gathering all pertinent information related to the collateral damage and making estimates of the amount and type(s) of logistics required alone took more than a day due to the wide destruction in that area.
And getting together the sheer amount of logistics required takes at least another day or two at best.
Nagin on the other hand had over 250 school busses and all of the city busses to his avail but didn't use them.
Thus let's not drag FEMA in when FEMA isn't to be blamed. EMA is first response... FEMA is called in later. But both usually respond AFTER the damage has been caused.
The city and state are responsible for planning evacuations of that scale and if they are unable to handle it... they can request for FEMA support, but that request must be received prior to FEMA being able to step on the states toes. That's how state regulations were created and how they still work.
So as for why FEMA didn't respond earlier... who made the call to request assistance. Nagin didn't, Blanco didn't...
As for CyberSecurity heading for a FEMA like catastrophe... Now that the first part of this article has been de-bunked... what similar catastrophe is that?
There are numerous threats which continue to cause worries about our internet. But here too... it's not the CyberSecurity team which DHS heads that will thwart the problem as much as it is each individual ISP's acceptance and implementation of the effective methods to thwart off such attacks.
But with so many concious objectors and lack of support from ISP's... they're gonna be the future Nagin and Blanco runner-ups if they don't get their cyber-threat-ears out there and start taking more responsibility where the first line of responsibility should be taken.
SPAM is one very good example. SPAM continues to be sent out with spoofed addresses even though that was declared illegal over 1.5 years ago. ISP's are the first line of defense. But many today still don't do anything to stop it. Blocking outgoing port 25 would go a long way to reduce a good amount of SPAM, but they do nothing about it.
Just like Nagin and Blanco... so don't go trying to pin the tail on the elephant in the white house when it belongs on the local donkey!
Walt
2) What type of attacks? Well, how about taking down DNS servers? That'd take down the whole Internet. Not to mention attacks on supposedly closed-off infrastructure networks (something like the most recent season of "24").
There's also the issue of numerous FEMA no-bid contracts. Yes, that again! So don't try to put all the blame on the local party hacks, FEMA created its own disaster. The point of this story is that DHS Cybersecurity is another FEMA waiting to happen. Will we all be surprised when it happens, when Congress calls for yet another blue- ribbon committee after the fact? When the Schummer-Feinstein-Boxer-Sharpton-Jackson hacks swoop down and again try to make it a purely Republican issue? Well at least CNET readers won't be surprised.
Getting a mega-bureaucracy like DHS and its Cybersecurity organization to meet their national cybersecurity responsibilities by throwing more and new bureaucrats at the multiple holes left in the Org. Chart, works counter to circumventing a future FEMA-like Cyber-Calamity.
The departure in January 2005 of Liscouski, a non-techie career Intel cop, was no great loss. He was bureaucratic ?Nero? who both fiddled and oversaw the musical chairs in the Office of the Cybersecurity Czar as knowledgeable Cybersecurity Czar techies like Clarke, Schmidt, Yoran came, got frustrated and left.
Top bureaucrat Liscouski pretended he was facilitating and aiding these Cybersecurity Czars in performing and conducting important cybersecurity and physical-infrastructure protection technical work while he apparently was only overseeing, implementing and pursuing a policy of benign Cyber-neglect. Then, in January 2005, when faced with having to work for the new, incoming DHS Chief, lawyer Michael Chertoff, he ?cut and ran? out with the exiting crowd.
These sweeping leadership and staff changes in DHS?s structure in 2005 only served to further delay creation and delivery of an implementable National Plan for Critical Cybersecurity Infrastructure and the ?smart? Cybersecurity solutions to go with it.
Jim Lewis of CSIS said, "It's been a mess for over four years, and hopefully the new folks will fix this." Sad to say that Jim Lewis is dreaming the impossible dream if he thinks throwing a new crop of bureaucrats at the National Cybersecurity problem will fix it. JP B-)
Getting a mega-bureaucracy like DHS and its Cybersecurity organization to meet their national cybersecurity responsibilities by throwing more and new bureaucrats at the multiple holes left in the Org. Chart, works counter to circumventing a future FEMA-like Cyber-Calamity.
The departure in January 2005 of Liscouski, a non-techie career Intel cop, was no great loss. He was bureaucratic ?Nero? who both fiddled and oversaw the musical chairs in the Office of the Cybersecurity Czar as knowledgeable Cybersecurity Czar techies like Clarke, Schmidt, Yoran came, got frustrated and left.
Top bureaucrat Liscouski pretended he was facilitating and aiding these Cybersecurity Czars in performing and conducting important cybersecurity and physical-infrastructure protection technical work while he apparently was only overseeing, implementing and pursuing a policy of benign Cyber-neglect. Then, in January 2005, when faced with having to work for the new, incoming DHS Chief, lawyer Michael Chertoff, he ?cut and ran? out with the exiting crowd.
These sweeping leadership and staff changes in DHS?s structure in 2005 only served to further delay creation and delivery of an implementable National Plan for Critical Cybersecurity Infrastructure and the ?smart? Cybersecurity solutions to go with it.
Jim Lewis of CSIS said, "It's been a mess for over four years, and hopefully the new folks will fix this." Sad to say that Jim Lewis is dreaming the impossible dream if he thinks throwing a new crop of bureaucrats at the National Cybersecurity problem will fix it. JP B-)
- Could DHS organize a pee-up
- by n3td3v April 25, 2008 2:02 PM PDT
- Could DHS organize a pee-up in a brewery? Its great for us europeans to see U.S struggling on the smaller things in life. Pitty you guys only know how to drop bombs and kill thousands upon thousands of innocent women and kids in Iraq from 40,000ft up in the air. Pitty your armed forces are completely useless on the ground. Kinda reminds me of Katrina really. If it don't involve fighter jets, then U.S are ill-prepared for anything.
- Like this Reply to this comment
-
(40 Comments)