Bush unveils final cybersecurity plan

NEWS

The Bush administration signed off on Friday on the final version of the United States' strategy for protecting the Internet and securing information systems. The policy statement, called the National Strategy to Secure Cyberspace, largely backs off from mandating that companies adopt certain measures. Instead, it calls for the government to work with private industry to create an emergency response system to cyberattacks and to reduce the nation's vulnerability to such threats. "Securing cyberspace is an extraordinarily difficult strategic challenge that requires a coordinated and focussed effort from our entire society -- the federal government, state and local government, the private sector and the American people," President George W. Bush wrote in a letter introducing the document. The strategy document still doesn't address criticism that its lack of regulations render it toothless. For example, previous, unpublished drafts had included measures that would have forced Internet service providers to offer firewalls to their users and would have required wireless hardware makers to improve security. The document released Friday has been reorganised to focus on five policy initiatives and places much of the oversight with the newly established Department of Homeland Security. The five major efforts laid out by the strategy are: to create a cyberspace security response system, to establish a threat and vulnerability reduction program, to improve security training and awareness, to secure the government's own systems, and to work internationally to solve security issues. The document continues to advocate government-industry cooperation rather than regulation as a solution to Internet security problems. Regulation, security industry experts argue, would increase costs without guaranteeing better protections. Among specific recommendations, the plan calls for

Adoption of a warning and incident information network
A single Department of Homeland Security contact for the federal government and industry to report incidents
Cyberattack exercises on government agencies to gauge the impact of such attacks
The Department of Commerce to examine security issues related to IPv6
The Department of Homeland Security to recommend that ISPs adopt a "code of good conduct"
The Department of Energy and other concerned agencies to develop best practices for securing distributed control systems, such as SCADA

"They (the administration) have done a good job," said Deepak Taneja, chief technology officer for security firm Netegrity. "It's a whole lot better than where we were at the end of last year." The Department of Homeland Security will be responsible for creating a comprehensive national plan to secure "key resources and critical infrastructure of the United States", the plan said. The DHS will also be responsible for responding in the event of a crisis, for providing technical assistance to the government and private industry, for coordinating efforts between agencies, and for performing and funding research to support homeland security. Taneja stressed that to date, no serious attack has occurred that affected the Internet significantly. "Just a few weeks ago, we had the Slammer worm," he said. "It was bad, but it could have been a lot worse. If it had been worse, it would have been a cybersecurity emergency." A response system would be critical in the future for dealing with such attacks, he said. However, Bruce Schneier, chief technology officer for managed security service provider Counterpane Internet Security, is sceptical that the government can effectively lead the way to better security. "Like everything else, the proof is in the funding and execution," he said. He pointed to the fact that the government's networks are frequently attacked and breached, despite attempts to close the holes, as an indication of how effective the plan might be. Other industry executives commended the strategy document as a good first step, but they said that more is needed. "We have a presidential strategy, and that's good, but it's only a first step," said Dan Burton, vice president of government affairs for security firm Entrust. "If you look at the report, it is fairly strong as to government action. It is fairly strong in Internet management and how industry and government can work together to secure the Internet. But it's virtually silent on how the industry can improve the governance of their own IT systems." Even if the government can secure its own systems and work with industry to improve the security of the public Internet infrastructure, the whole exercise is for naught if companies stumble in securing their own systems, he said. "The Internet has to be secure, and the government has to be secure, but unless those private systems are secure, then the Internet is still at risk," he said.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

ike fuelband is great for every healthminded person ! to work out! theres this website called textme4free.com that you can use to text anywhere in...

37 minutes ago by bordero on Nike's FuelBand wristband gamifies exercise

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

3 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

7 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

8 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

9 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

11 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

1 day ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

1 day ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

2 days ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint