www.internetnews.com/security/article.php/3570596 Cyber Security Group Flunks Washington By Roy Mark December 13, 2005
WASHINGTON -- Neither the Bush administration nor Congress is providing significant leadership or legislation to secure the United States against cyber attacks, a security trade association charged Tuesday. In its first public criticism of the White House and lawmakers' efforts to follow up on President Bush's 2003 much-ballyhooed National Strategy to Secure Cyberspace, the Cyber Security Industry Alliance (CSIA) said Washington has taken only "limited steps" to improving the security of the nation's infrastructure. The steps are so limited, the CSIA contends, that it gave both the White House and Congress a D for their efforts in 2005. "Currently, there is little strategic direction or leadership from the executive branch in the area of information security," said Paul Kurtz, CEO of the CSIA. "Ensuring the resiliency and integrity of our information infrastructure and protecting the privacy of our citizens should be higher on the priority list for our government." Kurtz said this year's massive data breaches, a barrage of security vulnerabilities and the disruption of communications during Hurricane Katrina highlight the urgent need for improved information security preparedness and response. Instead, Congress has so far failed to pass either data-breach disclosure or spyware legislation. Lawmakers did approve creating the new position of Assistant Secretary of Cyber Security with the Department of Homeland Defense, but the White House has yet to fill the slot. "Six months downstream, it's time to put a person in that place," Kurtz said. "Part of leadership is delegation." Kurtz called the 2004 Homeland Security Presidential Directive calling for the United States to reduce identity fraud and protect personal privacy a "toothless tiger with no money attached to it." Kurtz also noted government cyber-security funding has been cut. "CSIA believes the government has a responsibility to lead, set priorities, coordinate and facilitate protection and response," Kurtz said. To underscore the economic impact of Washington's inaction on cyber security, the CSIA also issued its first Digital Confidence Index (DCI), benchmarking the confidence of Americans in the country's information infrastructure. The first numbers came up with a DCI ranking of 58 on a 100-point scale. The DCI benchmarks six areas of U.S. confidence: finance, health data, telecommunications, Internet, consumer data and power grids. "A score of 58 on the DCI is less than a passing grade. That's not a good sign," said James Lewis, director of the Technology and Public Policy Program for the Center of Strategic and International Studies. "It's getting kind of old that we're not making progress." Lewis added, "The effect of a loss of confidence in the networks Americans rely on every day for business transactions, electricity, personal and business communications and even health services will be felt over time." Having flunked Washington's 2005 cyber security efforts, the CSIA, whose members include Entrust, RSA Security, McAfee and Symantec, challenged lawmakers and the administration to a new set of goals. CSIA's 2006 agenda will address implementing national laws on data breach notification and spyware, filling the Assistant Secretary of Cyber Security position and increasing funding for cyber-security research and development. The purpose of our [agenda] is not to dwell on past events or direct blame on any one institution," Kurtz said. "Rather, we wanted to assess where we are today in terms of protecting the integrity of the information infrastructure so that we can determine which steps need to be taken to make improvements." You are a subscribed member of the infowarrior list. Visit www.infowarrior.org for list information or to unsubscribe. This message may be redistributed freely in its entirety. Any and all copyrights appearing in list messages are maintained by their respective owners.
