Slashdot Log In
New Legislation Would Federalize Cybersecurity
Posted by
samzenpus
on Wed Apr 01, 2009 11:27 PM
from the big-brother-security dept.
from the big-brother-security dept.
Hugh Pickens writes "Senators Jay Rockefeller and Olympia J. Snowe are pushing to dramatically escalate US defenses against cyberattacks, crafting proposals in Senate legislation that could be introduced as early as today, that would empower the government to set and enforce security standards for private industry for the first time. The legislation would broaden the focus of the government's cybersecurity efforts to include not only military networks but also private systems that control essentials such as electricity and water distribution. 'People say this is a military or intelligence concern, but it's a lot more than that,' says Rockefeller, a former intelligence committee chairman. 'It suddenly gets into the realm of traffic lights and rail networks and water and electricity.' The bill, containing many of the recommendations of the landmark study 'Securing Cyberspace for the 44th Presidency' (PDF) by the Center for Strategic and International Studies, would create the Office of the National Cybersecurity Adviser, whose leader would report directly to the president and would coordinate defense efforts across government agencies. The legislation calls for the appointment of a White House cybersecurity 'czar' with unprecedented authority to shut down computer networks, including private ones, if a cyberattack is underway. It would require the National Institute of Standards and Technology to establish 'measurable and auditable cybersecurity standards' that would apply to private companies as well as the government. The legislation also would require licensing and certification of cybersecurity professionals."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
It will be named.... (Score:2, Funny)
Not such a good idea (Score:5, Interesting)
I side with Vinge in believing that segmentation of the network is a sure indicator of a government going feral.
Bruce
Re:Not such a good idea (Score:5, Insightful)
Yeah but what can we do? We're just a bunch of people that bitch and moan on slashdot.
If only there was some respected, well known figures in the tech world that could try and get the ear of people that mattered.
If only there was someone that already had advised the Obama administration, other national governments and even spoke at the UN that could raise the concerns with people that matter. :)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Bruce
Re: (Score:2)
* Appoint people who know how to do all of the above, or who will listen to people who would give them good advice.
SB
Re:Not such a good idea (Score:5, Insightful)
Personally I don't trust government to:
In choosing democracy we've (wisely) given up some effectiveness in government in order to avoid having dictators. However this current government seems to have gone off the deep end, insanely grabbing power, and then not knowing what to do with it once they have it.
On the bright side, after the coming mass-inflation, they essentially won't have any power due to the fact that they'll have no money (at least, no money that's worth anything). On the depressed realistic side, how can we reasonably expect our representative government to manage money/things when half the population is incapable?
Parent
Re:Not such a good idea (Score:4, Insightful)
I know it is a national pastime in America to be as negative about government and politicians as possible, and unfortunately it isn't all unjustified. But if you can't see anything good or positive even in your worst enemy, you are seriously blinkered; and what is worse, you cut yourself off from the possibility to communicate from a common basis and thus from any chance of exerting any influence. Isn't this what keeps all the stupid regional wars going for generations? The Middle East, Sri Lanka, Northern Ireland until recently, much of Africa etc etc.
Your all-out, negative attitude actually plays into the hands of lousy politicians - they want you to think it is hopeless to try to change things, so they can't go on and line their own pockets they way they know best.
Parent
Re:Not such a good idea (Score:5, Insightful)
How so? Attaching some strings to the tax money they pump into failed businesses?
You clearly haven't been paying attention. Apart from trying to tax bonuses with unconstitutional laws, they've bailed out some companies while letting others fail with no clear motive, they've bailed out companies when letting them fall into bankruptcy would likely be a better option, they've spent a lot of money on projects that won't particularly help the economy all that much, they've spent so much money that inflation will be hard to avoid in the near future (and you REALLY don't want inflation during a recession), they've sent unclear messages about what they are trying to accomplish (some have speculated that Bernanke's ultimate goal is to never be accused of not spending enough), and on top of it they've proposed a budget that will triple the national debt in 10 years, and double it in five. If you want to go back a little farther, we can talk about starting two wars, not a great idea to begin with, but more importantly they were waged with clear incompetence from the beginning.
As for the new cyber-security initiative being flawed, compared to what? The baseline is: nothing.
I don't know if you are trolling here, or if you just haven't read the article, but they want the power to shut down any network they want. This is significantly worse than nothing, for reasons pointed out by Bruce above.
Sometimes it is better to do nothing. As the saying goes, "Don't just do something, stand there!"
Parent
Re: (Score:3, Insightful)
they've bailed out some companies while letting others fail with no clear motive
Actually, the motive is very clear, at least in the case of General Motors. It's spelled "Labor Unions".
Pretty simplistic view of a complex situation. It might also be spelled "saving one of the last major US owned industrial companies". Or maybe it's spelled "preventing the uncontrolled and disastrous collapse of economies of Michigan and Ohio." What's it spelled when both the UAW and bond holders of GM are told by the Obama administration they both need to make major concessions or GM will go bankrupt? Or what's the spelling of the cost of sorting out the pension mess would exceed the amount we've loane
Speciation Of The Internet (Score:2)
"a government gone feral"
I argue that it's an inevitable outcome of ecological diversification of information and the Internet. It's not just occurring in the United States. The internet is "speciating", evolving differentiation in order to limit infectious memes.
http://www.realmeme.com/roller/page/realmeme?entry=global_differentiation [realmeme.com]
Is our government nuts?
Well, yes.
But that's a separate issue.
Re:Not such a good idea (Score:5, Informative)
- Not abuse access to data held by said companies
Let me get this straight, NSA (the agency recommended for the job according to tfa) will conduct "ongoing audits" of private networks owned by the utilities (telecoms too?) and nowhere does it say that this does not include access mountains of data held by those utilities on just about every person in the US
Parent
Re: (Score:3, Insightful)
Re:Not such a good idea (Score:4, Insightful)
I think that the government needs to have a hand in every industry that profits off of people's misfortunes.
Wow. I mean, just mega-wow. Are you serious?
The government is already involved in every industry that profits off of people's misfortunes. The automotive insurance industry exists in its current form because it was able to purchase legislation which mandates its use. The medical insurance agency, big pharma, the banks that mushroomed all these mortgages all out of proportion to what they should have been (besides which, while I do believe in caveat emptor I also believe that of all things you should be able to trust that a bank will act conservatively most of the time) and the RIAA all function under bought-and-paid-for legislation.
If you think more government intervention in these things is going to improve them, think again.
Parent
Rockefeller and Snowe? (Score:4, Interesting)
Cybersecurity 'Standards" (Score:5, Insightful)
Until your elected representatives fully understand that any public infrastructure networks should not be connected to the 'Internet' -for any reason- any discussion of 'cybersecurity' is simply wasted words. WTF does it take for these 'public officials' to realize that critical infrastructure networks need to be completely isolated and secured from the hostile environment that the 'Internet' has become?
Re:Cybersecurity 'Standards" (Score:5, Insightful)
Parent
Actually they do (Score:5, Insightful)
Parent
Re: (Score:2)
2. It would have been nice to never have connected these utilities to the in
Re: (Score:3, Informative)
I don't need no education (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Banking?
The same story applies. Your bank account details are so precious that they should never be exposed on the internet. And yet you do use online banking. The benefit in convenience outweighs the security risk.
The same convenience applies to water, electricity, traffic lights and other parts of the public infrastructure. If we can manage the risk through security protocols, then using the public internet for remote management makes for increased efficiency.
Increased efficiency is a good goal. If the on
Right! (Score:5, Insightful)
Maybe we could legislate some openness instead.
Never was the "It's a Trap" Tag More Appropriate (Score:5, Interesting)
Large vendors are behind this. With all the extra security certifications and processes that small businesses (or independent/open source developers) will be required to apply because of "security" open source would be closed out of the market by this.
Please watch this very carefully. Red Hat and free software companies actually large enough to have lawyers, please, please, please sniff out the rats.
Re:Never was the "It's a Trap" Tag More Appropriat (Score:5, Informative)
What about SELinux?
Isn't it NSA sponsored?
Parent
Re: (Score:2)
Sooo... (Score:2)
The April Fools crap is over now? It's a silly day anyway.
If this is not an Aprils Fools joke thats... (Score:2, Insightful)
Re: (Score:2)
Bang!
Re: (Score:2)
Don't be naive. Did you really think the Internet would remain some wild-wild-west fantasy of freedom?
Individual freedom is the antithesis to Political control.
Re: (Score:2)
The link is to WaPo. I think they're a bit stodgy to be playing April Fools jokes. And if they did, it would be geared toward a more general audience.
Enforcing compliance... (Score:5, Interesting)
If passed, this could have the effect of a de-facto outlawing of Linux. For example, consider the typical business small business owner's plight: he uses Windows mostly on the desktop, but has a few Linux servers handling things like mail and print services.
I understand the government wants to ensure "cyber security" - whatever that means - but they, of all organizations, are the least qualified to implement it. The conflict of interest between big business and government interests is just too great for this to be anything but a tremendous waste of time and money.
And this without even considering the larger question of why the government should have any control over the software private users run on their own computers.
Re: (Score:2)
The only possible path from:
1 Government forces all businesses to use standarized crap software.
is:
2 Standarized crap software is thoroughly raped and even infants can enter any complying business.
3 Businesses remove crap software.
Re:Enforcing compliance... (Score:4, Informative)
I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications, so it would be silly to assume that they wouldn't write legislation in such a way that such OSes would be included.
I imagine something of a "security certification requirements" that the ruling body of each OS would put forth (i.e., each Linux distro would put forward a list, as well as Microsoft for Windows, Apple for OS X, etc). This list would be submitted to the government/whatever authority, and they would use this list in testing whether or not individual IT installations are complicit. The list, if implemented, would also have to assure that the OS's operation would meet the government's "cyber-security requirements".
In other words, I don't imagine the government would completely ignore Linux to give a leg-up on Microsoft. Not only would that fall in the face of the whole anti-trust suit with MS, but also the government would have to shut down its own systems running non-MS operating systems. That approach doesn't appear to make any sense.
Parent
I'm not comfortable with this (Score:2)
Haven't we already been under attack for a while? Granted, I'm no expert in this field but haven't foreign nations been attacking the US for a while? Wasn't there a story a couple of days ago about GhostNet?
I heard a lot of tin foil hat people talking about an "i-Patriot Act" but I thought it was a lot of nonsense. When the government tries things like this and says they will work in a way as to try and not infringe on privacy, how many actually believe them.
The biggest concern I have would be the power
Capability based security (Score:3, Interesting)
Until we get operating systems that can run code without having to trust it, we're going to keep getting the same crap, over and over.
Linux isn't the answer. Hell, even SElinux isn't the answer.
Start reading up on Eros, Keykos and Capros to see about systems that might actually solve the security issues once and for all.
Re: (Score:3, Insightful)
+1. Problem is, current CPUs themselves are buggy and exploitable, so you still need a verifier, and if you need that you may as well have a VM and a JIT. Unfortunately the major VMs that have the building blocks to be capability-secure -- such as CLR and JVM -- threw it all away with their standard library designs.
There's also a hidden side of capability security: preventing data, or more generally causality, from leaking in or out of a given piece of code. If there's an API exposed to untrusted code th
I haven't read the article yet, but... (Score:2)
I sure hope there is some mention of a court order before shutting down anything, whether public or private. Even if it is in such a way where they do it first, then get the court order within like 72 hours.
Software Mono-Culture (Score:2)
Because the one thing we've learned from having software mono-culture is that its a Good Thing(tm).
Now we're attempting to fix the problem by having federally mandated mono-culture? Please!
And as someone who has worked for companies that have developed government specs, I can assure you that the process will be corrupted as to bias towards certain vendors. Any required feature that can be patented will be, and any open-source implementation will be sued out of existence.
I think lobbying is afoot! (Score:4, Insightful)
It creates a czar, so I'm against it (Score:3, Insightful)
Re: (Score:2, Insightful)
it sounds anti-democratic
What if it sounded pro-democratic? Would be better?
Imo, It does not matter how it sounds. It IS anti-democratic.
I mean that's against people.
And then (Score:3, Funny)
the terrorists build a CIP device, and then storm the White House, and then they get bioweapons in DC.
april fools (Score:2)
as in, the legislators, not the day
Re: (Score:2)
I think it's "+1 Underrated"
To smite the mod, be a metamod.
Re: (Score:2)
Underrated? A whole five words, that nonetheless manages to be inane and pointless? I disagree vehemently.
Your comment about smiting mods is rather non sequitur; as of now there has not been any moderation on that comment. Also, there's nothing 'meta' about the moderation these days: a lamentable change in policy.
Re: (Score:3, Insightful)
Misery loves company. That's why many Statists will drag the rest of society down to their level. We must all suffer together so we may be bonded together with a closer kinship they say. Ya, right. Uh huh. Sure....
And people wonder how the horrors of Communism rears its ugly head throughout the world.
Re:Last one out.... (Score:5, Interesting)
This may be a late April fools joke by government standard, but it sure contains plausible concerns.
Concerning the document, I would say that it isn't a joke, but you may have to express some concerns about if the proposed methods are causing more problems than they are solving.
If you shut down a whole network, then you also cut off the owners of possible infected computers from the services that may help them to clean them up. This has been tried before within larger companies which just ended in a deadlock, nothing was done at all until the network was up again. In effect - you got an ultimate D.o.S attack!
If anything - put more effort into hunting down and apprehending the perpetrators. This will give a much better result in the long term. In effect - follow the money.
Another approach would be to put more effort into hardening of operating systems and tools for operating system management. SELinux is one good example, but unfortunately this only works to some extent and it only covers one area of security measures.
One detail that also is cause for concern is ISP:s that migrates from several routed segments to a large segment where switches are used instead. It makes sense from an economic perspective, but it's not making sense from a security perspective. This means that more computers can be joined into dark nets using private IP addresses for internal communication, which in turn can make attacks even better coordinated.
Large switched segments where private IP addresses propagates can also result in new intriguing ways of obscuring file sharing traffic and other traffic that is to be masked. This can result in the funny effect of making a whole town suspected of possession of child pornography.
Parent
China also has the max of the death penalty for ha (Score:3, Interesting)
China also has the max of the death penalty for hacking. Russia does not care about hackers going after the us and taking our money Likely a kick back kind of thing in Russia.