Wanted: Stronger U.S. Cybersecurity

WASHINGTON -- U.S. President George W. Bush's former cybersecurity advisor has blasted his old boss's efforts within the federal government, and another expert is urging Congress to force more corporate attention to cybersecurity.

The Bush administration's Department of Homeland Security is moving too slowly in organizing its National Cyber Security Center, said Richard Clarke, former special advisor to the president for cyberspace security. He testified Tuesday before the House Committee on Government Reform's Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census.

Security Officer Wanted

The White House Office of Management and Budget needs to hire a full-time chief information security officer to focus on cybersecurity, Clarke says.

The president's National Strategy to Secure Cyberspace, released in mid-February, cannot move forward without the Homeland Security cybersecurity center, said Clarke. He left the White House two months ago and is now a consultant. The department has failed to "recruit a cadre of nationally recognized cybersecurity experts," Clarke said.

"I would hope that with cybersecurity we can do more to raise our defenses before we have a major disaster," Clarke added. "The problems we've had to date are minor compared to the potential."

Clarke also called on Congress to fund vulnerability scanning sensors on all federal networks. He recommended federal agencies outsource their cybersecurity projects and withhold money from the vendors if the agencies get failing cybersecurity grades.

Michael Vatis, director of the Institute for Security Technology Studies at Dartmouth College, agreed with Clarke that government response to cybersecurity is lacking. Hundreds of cybersecurity jobs, including top posts, that were to move from the FBI, the Federal Computer Incident Response Center, and other agencies to the new Homeland Security Department are unfilled, Vatis noted.

"It could take over a year before we get back to where we were in our ability to respond to cyberattacks," Vatis said, blaming a "gaping void" in leadership from the Bush administration.

Progress Cited

But Mark Forman, associate director of information security and electronic government for the White House Office of Management and Budget, defended the Bush administration efforts to make federal agencies more secure.

The number of federal systems meeting several cybersecurity goals has risen rapidly since 2001, Forman said. In 2001, only 40 percent of federal systems had up-to-date system security plans, he said. By 2002, that number had risen to 61 percent. Forman said he'd match those improvements against those of any company in the private sector, although he admitted the numbers are "still too low."

Forman assured the committee that cybersecurity is a top priority in the Bush administration, and he noted that the Homeland Security Department has only been an official agency since March 1. As the department organizes, Congress will see "significant action" in the area of cybersecurity, he added.

"I pledge to you that the administration is focused on [cybersecurity] all the way to the highest level," Forman told the committee.

Clarke disputed Forman's claim that the federal government efforts match cybersecurity in the private sector. He singled out the banking industry as an example where cybersecurity is taken more seriously than in the U.S. government. That's the case because banks usually have high-ranking officers responsible for security, he said.

"Who is the highest-level official in the Department of Homeland Security whose full-time job is cybersecurity?" Clarke asked. "What office in the Department of Homeland Security does nothing but cybersecurity? How many people in OMB have that full-time responsibility? The answers to those questions are pretty frightening."

Forman didn't answer Clarke's questions, instead saying cybersecurity shouldn't be separated from the other responsibilities of agency chief information officers.

Enlisting Business

Bush and former President Bill Clinton have used a "soapbox strategy" by urging the private owners of more than three-quarters of the country's computer infrastructure to handle its cybersecurity, Vatis said. He said Congress should consider new regulations modeled after federal medical privacy laws to provide incentives to private companies.

Vatis offered a few examples, including tax incentives to improve security technology and requiring public companies to disclose results of independent security audits. Congress could also require companies to report security lapses, he said.

But Clarke and Forman disagreed that companies should reveal their security problems. Keeping customers happy is a better incentive for private firms to protect private information than any bill Congress could pass, they said. Clarke agreed with subcommittee chairman Adam Putnam (R-Florida), who suggested that encouraging use of cybersecurity insurance, and then examining the premiums paid, should show which companies are working to prevent breaches.

"I think we want to avoid regulation," Clarke said. "The thought of having federal cybersecurity regulation or federal cybersecurity police scares me to death."

Fourteen of 24 major federal agencies received failing cybersecurity grades in a congressional report released in November 2002. "What are we doing wrong?" he asked. "That's just unacceptable."

Putnam asked if other national governments are doing better than the U.S., and both Clarke and Vatis agreed that none are. "The good news is nobody's ahead of us," Clarke said. "The bad news is we're pretty bad. As long as we have well-known vulnerabilities that are cheaply exploited, someone will do it."