Interesting article on NPR about whether businesses should foot the bill for a Cyber War.
The Lieberman-Collins bill before congress would help pay to secure the nation's critical infrastructure like the power grid, water treatment plants, and the financial system. Does the government have a duty to protect the rest of the country?
I think it's a great question. One reason, the first sentance of this blog post - it's not "A" cyber war that we're talking about here...we can't talk about it like it isn't already happening. It's the current cyber war. If a city was hit by a tornado or hurricane, there is always disaster assistance that is available. It's important to a country, especially during a war to help rebuild so that the country can keep on functioning.
Another reason - can a small business really protect itself from a cyber attack from a government?
On the flip side of the issue of course, is risk tolerance. Businesses don't take security seriously largely because they don't need to. The only reason some companies have security programs is so they can comply with the Payment Card Industry Data Security Standards (PCI-DSS), and even then it is largely ignored (as we saw was the case with Sony last year). People are excellent judges of risk. As identity theft grows, they will tend to get better at creating passwords. Businesses, too, need to learn from these issues. But until the WAll Street Journal is covering a story about how a fortune 500 company closed it's doors because of a security breach, businesses won't invest what they need to to protect themselves. Despite Sony's breach last year, they are still in business and their stock seems to have been barely effected.
If the government steps in, then, and prevents businesses from having to deal with the ramifications of a security threat, then businesses never will treat the issue seriously.
Showing posts with label Joe Lieberman. Show all posts
Showing posts with label Joe Lieberman. Show all posts
Tuesday, May 8, 2012
Monday, March 19, 2012
McCain vs. Lieberman - SecureIT vs. Cybersecurity Act of 2012
Senator John McCain along with 5 other Republican senators released their counterproposal to the Lieberman-Collins Cybersecurity Act of 2012 released last month. The bill is called the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information and Technology (Secure IT) Act. Let me start by saying that when I see a bill that cleverly named so as to have an acronym that is readable, I immediately wonder how serious the authors of a bill are about its passage. I can't think of any bills off the top of my head that have actually passed that have been so named. HIPAA? Sarbanes Oxley? Digital Millenium Copyright Act?
I'm not sure how long it took McCain and the other Senators to write their counterproposal bill. It isn't clear whether the bill was already in progress or whether they started last month after hearing about the competing legislation. In any event, McCain’s bill was introduced only a week after the Lieberman bill. The Lieberman purports to have been the result of 3 years of negotiation and research. Mostly, the McCain bill appears to be a hodgepodge of the Cybersecurty Act of 2012 and other preexisting bills, with a ton of deletions and insertions of partisan elements.
Let’s look at the similarities and differences between the two bills:
Both bills have some provision for a Federal Cyber Scholarship-for-service program. The McCain bill copies word for word the first paragraph of the Lieberman bill. Where the Lieberman bill has provisions for how many scholarships are to be given (1,000) and provides for full tuition, the McCain bill provides no guidance on how many scholarships will be given, and only provides for tuition for 2 years of study. The Lieberman bill requires students to enter into a commitment for the same amount of time they spent in school, while the McCain bill requires one and a half times.
If I were a student, I’m not sure I’d be interested in the McCain offer. Less money for longer indentured servitude? Unfortunately, not many students would be able to sign up for the McCain proposal, since the McCain bill specifies that no additional funding will be allocated for Cybersecurity. This means that any money for scholarships would have to be carved out of departments individual budgets…presumably why the McCain bill doesn’t specify a specific number of scholarships. Presumably that number would be close to 0.
No new funding is problematic where issues of national security and defense come into play. If the national air traffic control network, for example, needs to be completely scrapped and a new secure network needs to be deployed, how could that be accomplished under the McCain bill? The FAA would have to carve that out of its budget, and small upgrades would have to happen over a long period of time. This is perhaps why Lieberman and Rockefeller have been so outspoken in their criticism of the McCain bill since the counterproposal.
The Lieberman bill has several sections that the McCain bill is missing entirely:
The McCain bill has several sections that the Lieberman bill is missing:
The Lieberman bill only mentions High Performance Computing once to make one small amendment while the McCain bill focuses on it for several pages. My only thought here is why? McCain’s changes to the High Performance Computing act of 1991 don’t even really have anything to do with security. The changes mostly read as funding modifications, which make me think this whole bill is about pork, and not security.
The Criminal Penalties section amends the Computer Fraud and Abuse Act, but mostly focuses on stiffening penalties and forfeiture of property directly or indirectly gained by said fraud and abuse. While these are okay goals of the act and could potentially be added to the Lieberman bill, the miss the point of the reality of hacking today. The most successful hackers operate internationally and are very difficult to capture. The McCain bill does nothing to address this new reality.
I'm not sure how long it took McCain and the other Senators to write their counterproposal bill. It isn't clear whether the bill was already in progress or whether they started last month after hearing about the competing legislation. In any event, McCain’s bill was introduced only a week after the Lieberman bill. The Lieberman purports to have been the result of 3 years of negotiation and research. Mostly, the McCain bill appears to be a hodgepodge of the Cybersecurty Act of 2012 and other preexisting bills, with a ton of deletions and insertions of partisan elements.
Let’s look at the similarities and differences between the two bills:
Both bills have some provision for a Federal Cyber Scholarship-for-service program. The McCain bill copies word for word the first paragraph of the Lieberman bill. Where the Lieberman bill has provisions for how many scholarships are to be given (1,000) and provides for full tuition, the McCain bill provides no guidance on how many scholarships will be given, and only provides for tuition for 2 years of study. The Lieberman bill requires students to enter into a commitment for the same amount of time they spent in school, while the McCain bill requires one and a half times.
If I were a student, I’m not sure I’d be interested in the McCain offer. Less money for longer indentured servitude? Unfortunately, not many students would be able to sign up for the McCain proposal, since the McCain bill specifies that no additional funding will be allocated for Cybersecurity. This means that any money for scholarships would have to be carved out of departments individual budgets…presumably why the McCain bill doesn’t specify a specific number of scholarships. Presumably that number would be close to 0.
No new funding is problematic where issues of national security and defense come into play. If the national air traffic control network, for example, needs to be completely scrapped and a new secure network needs to be deployed, how could that be accomplished under the McCain bill? The FAA would have to carve that out of its budget, and small upgrades would have to happen over a long period of time. This is perhaps why Lieberman and Rockefeller have been so outspoken in their criticism of the McCain bill since the counterproposal.
The Lieberman bill has several sections that the McCain bill is missing entirely:
- Information Sharing
- Public Awareness Reports
- International Cooperation
The McCain bill has several sections that the Lieberman bill is missing:
- High Performance Computing
- Criminal Penalties
The Lieberman bill only mentions High Performance Computing once to make one small amendment while the McCain bill focuses on it for several pages. My only thought here is why? McCain’s changes to the High Performance Computing act of 1991 don’t even really have anything to do with security. The changes mostly read as funding modifications, which make me think this whole bill is about pork, and not security.
The Criminal Penalties section amends the Computer Fraud and Abuse Act, but mostly focuses on stiffening penalties and forfeiture of property directly or indirectly gained by said fraud and abuse. While these are okay goals of the act and could potentially be added to the Lieberman bill, the miss the point of the reality of hacking today. The most successful hackers operate internationally and are very difficult to capture. The McCain bill does nothing to address this new reality.
Wednesday, February 22, 2012
McCain Disses the Department of Homeland Security, Dashes Hopes for Security Bill in 2012
Senator John McCain last week dissed the Department of Homeland Security, stating that the NSA is better suited to preventing cyberattacks. Wait, what? The NSA has tremendous cyber capabilities, don't get me wrong. But wasn't DHS formed to prevent the kinds of bureaucratic nightmares of sharing information between agencies. The DHS has a National Cybersecurity Center charged with protecting US Government communications networks.
This comes after a bipartisan committee of Senators including Joe Lieberman, Jay Rockafeller, and Susanne Collins brought a new bill last week that, at least on paper, had a good chance of passing this year. McCain and 8 other Senators rushed to criticize the bill, potentially dashing any hopes of passing a Cybersecurity bill this year. This bill is purported to have incorporated many of the proposals on Cybersecurity over the past several years, so potentially it was on the fast track to passage...and maybe it still does.
The Senator could have just as easily said that the FBI should be in charge of preventing cyberattacks. The issue of CyberSecurity is like a hot potato. Should the Department of Defense and the NSA have the ball? Or DHS and the NCS? Or the Department of Justice and the FBI? How do you determine whether an attack is coming from a government or an individual? A crime syndicate or a hacktivist group? Ultimately prevention and education, like this bill supports, are the best ways of keeping us all out of trouble...aside from unplugging our computers. Hopefully that doesn't get lost.
This comes after a bipartisan committee of Senators including Joe Lieberman, Jay Rockafeller, and Susanne Collins brought a new bill last week that, at least on paper, had a good chance of passing this year. McCain and 8 other Senators rushed to criticize the bill, potentially dashing any hopes of passing a Cybersecurity bill this year. This bill is purported to have incorporated many of the proposals on Cybersecurity over the past several years, so potentially it was on the fast track to passage...and maybe it still does.
The Senator could have just as easily said that the FBI should be in charge of preventing cyberattacks. The issue of CyberSecurity is like a hot potato. Should the Department of Defense and the NSA have the ball? Or DHS and the NCS? Or the Department of Justice and the FBI? How do you determine whether an attack is coming from a government or an individual? A crime syndicate or a hacktivist group? Ultimately prevention and education, like this bill supports, are the best ways of keeping us all out of trouble...aside from unplugging our computers. Hopefully that doesn't get lost.
Subscribe to:
Posts (Atom)