Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

 



Forgot your password?
typodupeerror
Security Government Politics News

New Legislation Would Federalize Cybersecurity 194

Posted by samzenpus
from the big-brother-security dept.
Hugh Pickens writes "Senators Jay Rockefeller and Olympia J. Snowe are pushing to dramatically escalate US defenses against cyberattacks, crafting proposals in Senate legislation that could be introduced as early as today, that would empower the government to set and enforce security standards for private industry for the first time. The legislation would broaden the focus of the government's cybersecurity efforts to include not only military networks but also private systems that control essentials such as electricity and water distribution. 'People say this is a military or intelligence concern, but it's a lot more than that,' says Rockefeller, a former intelligence committee chairman. 'It suddenly gets into the realm of traffic lights and rail networks and water and electricity.' The bill, containing many of the recommendations of the landmark study 'Securing Cyberspace for the 44th Presidency' (PDF) by the Center for Strategic and International Studies, would create the Office of the National Cybersecurity Adviser, whose leader would report directly to the president and would coordinate defense efforts across government agencies. The legislation calls for the appointment of a White House cybersecurity 'czar' with unprecedented authority to shut down computer networks, including private ones, if a cyberattack is underway. It would require the National Institute of Standards and Technology to establish 'measurable and auditable cybersecurity standards' that would apply to private companies as well as the government. The legislation also would require licensing and certification of cybersecurity professionals."
This discussion has been archived. No new comments can be posted.

New Legislation Would Federalize Cybersecurity

Comments Filter:
  • Standardized KeYing NETwork.
    • by jank1887 (815982)
      how can the first reply be redundant?
      • by rts008 (812749)

        It is deliberate by /., allegedly designed to cut down on inane first posts just trying to be first posts...or something.

        It has backfired, though. Since all first posts are automagically down-modded, then what do you have to lose by inane first posts for the sake of first post?

        From the /. FAQ(note the date-this is not new by any means):

        What's up with "First Post" comments?

        "First Post" comments are one of those odd little memetic hiccups that come out of nowhere and run amok. Basically, people with altogethe

  • Not such a good idea (Score:5, Interesting)

    by Bruce Perens (3872) * <bruce@perens.com> on Wednesday April 01, 2009 @11:35PM (#27426943) Homepage Journal
    I don't tremendously trust the government to:
    • Maintain competence in a technical topic undistorted by political agendas.
    • Be free of influence from deep-pockets technical companies to the disadvantage of smaller and disruptive players.
    • Be platform-indepependent in their requirements and certification process.
    • Segregate the power to turn off segments of the network to manage attacks vs. turning them off to manage other issues such as some mis-guided concept of "piracy", etc.

    I side with Vinge in believing that segmentation of the network is a sure indicator of a government going feral.

    Bruce

    • by rackserverdeals (1503561) on Thursday April 02, 2009 @12:04AM (#27427087) Homepage Journal

      Yeah but what can we do? We're just a bunch of people that bitch and moan on slashdot.

      If only there was some respected, well known figures in the tech world that could try and get the ear of people that mattered.

      If only there was someone that already had advised the Obama administration, other national governments and even spoke at the UN that could raise the concerns with people that matter. :)

      • Re: (Score:3, Insightful)

        by fferret (58662)
        Speak for yourself. I'm a /.er who bitches, moans, and runs two private networks, the one at work, and the one at home. I agree that the government cannot be trusted to be impartial, but I also agree that cooperative action must be taken to forestall a network issue. Perhaps the best way to handle this would be a mutual cooperation agreement between the upstream ISP, and the private network admin. That would be sufficient for most problems. Since the Internet is non-deterministic, anything widespread e
        • We can't trust the private sector to spend money to actively protect these same systems, and they are key to our survival. There have already been hundreds of successful attacks on these systems throughout the nation. Each utility does their own thing, which means differing levels of protection, if any, across like utilities within the same state or region.

          Controlling potable water is critical. There needs to be similar security on flood control systems. The Army Corps of Engineers, Civil Works side
      • Your sig is dumb. You can buy 1U dual opteron systems for like $150. I have one I'll sell you for that price, in fact. It's an IBM with IPMI and 2GB, expandable to 12GB.

      • by furby076 (1461805)

        Yeah but what can we do?

        A lot of election races are dead-heat races. Imagine if you organized a grass-roots program to vote for the guy you wanted who supported your viewpoints? You would be surprised how powerful a large, organized, voting block can be when it wants to influence an elected official (or a potential one).
        You could run for office - start small and work your way up. Eventually make the correct changes
        You could create websites, or write well-written articles to get them published in general newspapers (not special

      • Yeah but what can we do? We're just a bunch of people that bitch and moan on slashdot. If only there was some respected, well known figures in the tech world that could try and get the ear of people that mattered. If only there was someone that already had advised the Obama administration, other national governments and even spoke at the UN that could raise the concerns with people that matter. :)

        We all could have not voted for Obama, as I know many of us did. If we would have made better choices (and I'

      • Re: (Score:3, Interesting)

        by Bruce Perens (3872) *
        Yes, if I work really hard at it I can get admitted to see the policy analysts for various politicians. It's not like they drop everything to talk to me. If I want to do this I'm going to have to start collecting donations (again) because it is otherwise a pretty fast path to being broke, with the days out of work for travel and meetings, paying for flights, etc.

        Bruce

    •   * Appoint people who know how to do all of the above, or who will listen to people who would give them good advice.

      SB

    • by phantomfive (622387) on Thursday April 02, 2009 @12:32AM (#27427209) Journal
      Optimist! :)

      Personally I don't trust government to:
      • Maintain competence. Period.
      • Be free of influence from deep-pocket companies. Period.
      • Come up with any sort of sane requirements. Period.
      • Manage power in any way that doesn't attempt to increase their own.

      In choosing democracy we've (wisely) given up some effectiveness in government in order to avoid having dictators. However this current government seems to have gone off the deep end, insanely grabbing power, and then not knowing what to do with it once they have it.

      On the bright side, after the coming mass-inflation, they essentially won't have any power due to the fact that they'll have no money (at least, no money that's worth anything). On the depressed realistic side, how can we reasonably expect our representative government to manage money/things when half the population is incapable?

      • by timeOday (582209)

        this current government seems to have gone off the deep end, insanely grabbing power, and then not knowing what to do with it once they have it.

        How so? Attaching some strings to the tax money they pump into failed businesses? We certainly seem headed for a bad economy, but allowing it to implode unimpeded may well have been even worse. There are no good options.

        As for the new cyber-security initiative being flawed, compared to what? The baseline is: nothing. Assuming the govt. will fail at policing

        • by phantomfive (622387) on Thursday April 02, 2009 @02:43AM (#27427587) Journal

          How so? Attaching some strings to the tax money they pump into failed businesses?

          You clearly haven't been paying attention. Apart from trying to tax bonuses with unconstitutional laws, they've bailed out some companies while letting others fail with no clear motive, they've bailed out companies when letting them fall into bankruptcy would likely be a better option, they've spent a lot of money on projects that won't particularly help the economy all that much, they've spent so much money that inflation will be hard to avoid in the near future (and you REALLY don't want inflation during a recession), they've sent unclear messages about what they are trying to accomplish (some have speculated that Bernanke's ultimate goal is to never be accused of not spending enough), and on top of it they've proposed a budget that will triple the national debt in 10 years, and double it in five. If you want to go back a little farther, we can talk about starting two wars, not a great idea to begin with, but more importantly they were waged with clear incompetence from the beginning.

          As for the new cyber-security initiative being flawed, compared to what? The baseline is: nothing.

          I don't know if you are trolling here, or if you just haven't read the article, but they want the power to shut down any network they want. This is significantly worse than nothing, for reasons pointed out by Bruce above.

          Sometimes it is better to do nothing. As the saying goes, "Don't just do something, stand there!"

      • by jandersen (462034) on Thursday April 02, 2009 @03:20AM (#27427707)

        I know it is a national pastime in America to be as negative about government and politicians as possible, and unfortunately it isn't all unjustified. But if you can't see anything good or positive even in your worst enemy, you are seriously blinkered; and what is worse, you cut yourself off from the possibility to communicate from a common basis and thus from any chance of exerting any influence. Isn't this what keeps all the stupid regional wars going for generations? The Middle East, Sri Lanka, Northern Ireland until recently, much of Africa etc etc.

        Your all-out, negative attitude actually plays into the hands of lousy politicians - they want you to think it is hopeless to try to change things, so they can't go on and line their own pockets they way they know best.

        • You are right, government doesn't have to be bad, and it could be worse, however, the truth of the matter is, there is a high level of incompetence in the US government right now. The infrastructure is falling apart (we literally had a bridge fall down while people were driving over it), the social security has needed some fixes for a while now that were obvious, and yet no one has fixed them; the list goes on. If you can't take care of the basics, if you can't even maintain a balanced budget (which is wh
          • by jandersen (462034)

            ...the truth of the matter is, there is a high level of incompetence in the US government right now. The infrastructure is falling apart (we literally had a bridge fall down while people were driving over it), the social security has needed some fixes for a while now that were obvious, and yet no one has fixed them; the list goes on. If you can't take care of the basics, if you can't even maintain a balanced budget (which is where California especially is), then you fall into the category of incompetent. I stand by the four points I made in my previous post.

            Oh, come on, be reasonable. The current administration is not responsible for the mechanical failings of infrastructure that is - what, several years old? And the same goes for social security etc - and they are desperately trying to fix things. And apart from that, if you want to achieve anything in the way of changing the way things are, being contrary and unreasonable is not the way forward; that only tells that you have given up and gone into sulking mode. The system is a huge and unwieldy juggernaut,

            • Also, I challenge your sweeping claim that "Government Is Incompetent" - as if everybody in all of every government is a moron, more or less.

              I didn't say that. I'm sure there are plenty of individual competent people in government, but the combined whole of government has shown itself to be incompetent. This is true of the current government.

              That is a situation I believe a lot of people in America are in now, so they will understand how it works: you still have to pay your bills and you also have to pay off your new debt - and it is very difficult to balance the budget in that situation.

              If you are in this situation, the solution is to reduce your spending, consolidate your debt, and begin to pay it off. Our current government has gone the opposite way, by spending significantly more than has ever been spent before. Under Obama's plan, the national debt will grow more in three years than

        • by moeinvt (851793)

          " . . . unfortunately it isn't all unjustified."

          I don't hear too many gripes that I think are "unjustified", especially in this forum.

          "if you can't see anything good or positive even in your worst enemy, you are seriously blinkered;"

          Glad that you've accepted the fact that our government is our worst enemy. Oh btw, they do a pretty good job with the national parks system and postal service, so they aren't 100% bad. However, if you base your expectations for any new Federal government initiative on your obs

    • "a government gone feral"

      I argue that it's an inevitable outcome of ecological diversification of information and the Internet. It's not just occurring in the United States. The internet is "speciating", evolving differentiation in order to limit infectious memes.

      http://www.realmeme.com/roller/page/realmeme?entry=global_differentiation [realmeme.com]

      Is our government nuts?
      Well, yes.
      But that's a separate issue.

    • by clarkkent09 (1104833) on Thursday April 02, 2009 @01:09AM (#27427329)
      Missed an important one:

      - Not abuse access to data held by said companies

      Let me get this straight, NSA (the agency recommended for the job according to tfa) will conduct "ongoing audits" of private networks owned by the utilities (telecoms too?) and nowhere does it say that this does not include access mountains of data held by those utilities on just about every person in the US
    • Re: (Score:2, Interesting)

      by Deanalator (806515)

      I think that this is a great idea.

      I think that the government needs to have a hand in every industry that profits off of people's misfortunes.

      Medical companies have no financial incentive to keep people healthy the same way that infosec companies have no financial incentive to secure the nation's infrastructure. Instead of research scientists working for cures we have greedy corporations that have risen up, trying to sell the antidote of the day.

      What if, instead of hoarding 0day and designing proprietary c

      • Re: (Score:3, Insightful)

        by Toonol (1057698)
        For every positive what if, I can construct a negative one, and it's more likely to come true. We want the government that governs least; that's the best (to paraphrase). When any action from the government is likely to make the problem worse (evidence: I point to the economy), the best course is to forbid it from meddling at all.
      • by drinkypoo (153816) <martin.espinoza@gmail.com> on Thursday April 02, 2009 @06:59AM (#27428383) Homepage Journal

        I think that the government needs to have a hand in every industry that profits off of people's misfortunes.

        Wow. I mean, just mega-wow. Are you serious?

        The government is already involved in every industry that profits off of people's misfortunes. The automotive insurance industry exists in its current form because it was able to purchase legislation which mandates its use. The medical insurance agency, big pharma, the banks that mushroomed all these mortgages all out of proportion to what they should have been (besides which, while I do believe in caveat emptor I also believe that of all things you should be able to trust that a bank will act conservatively most of the time) and the RIAA all function under bought-and-paid-for legislation.

        If you think more government intervention in these things is going to improve them, think again.

        • All of the cases you cited are instances where corrupt government officials sold power to the corporations, which is the opposite of government control.

          What I am suggesting is sending more tax dollars towards research and development that helps all the people in the united states. This research should be run by people that are answerable to voters, not shareholders. There are industries out there (infosec included) that would make the people safer and more secure if the goal was more about helping people

    • by idiotnot (302133)

      Why does one word seem to come to mind with all four of those points......that word being "Microsoft?"

      * Think Senators Rockefeller or Snowe have ever knowingly used Linux, much less heard of NetBSD?
      * Platform standardization! TCO! Integration!
      * It only works with Windows.
      * Hi, there, DRM!

      But, you know, you have to give it a chance. Enough hopeychange, plus a new federal center for cybersecurity in West Virginia, and we'll be _great_.

      • by drinkypoo (153816)

        Think Senators Rockefeller or Snowe have ever knowingly used Linux, much less heard of NetBSD?

        Primarily developed by the US National Security Agency, [SELinux [wikipedia.org]] was released to the open source development community under the GPL on December 22, 2000 and merged into the mainline kernel 2.6.0-test3, released on 8 August 2003.

    • by cayenne8 (626475)
      "I don't tremendously trust the government..."

      You had me at this point.

  • by cusco (717999) <brian...bixby@@@gmail...com> on Wednesday April 01, 2009 @11:35PM (#27426945)
    Do either of them have any clue about what they're legislating? Hope they've got someone on their staffs who know the difference between a SCADA system and a server farm, because I'm quite sure they don't. The alternative is that they've let the intel agencies and the security industry write the legislation, which is just about the worst possible alternative.
  • by actionbastard (1206160) on Wednesday April 01, 2009 @11:47PM (#27427001)
    "measurable and auditable cybersecurity standards" that would apply to private companies as well as the government.

    Until your elected representatives fully understand that any public infrastructure networks should not be connected to the 'Internet' -for any reason- any discussion of 'cybersecurity' is simply wasted words. WTF does it take for these 'public officials' to realize that critical infrastructure networks need to be completely isolated and secured from the hostile environment that the 'Internet' has become?
    • by jofny (540291) on Thursday April 02, 2009 @12:00AM (#27427067) Homepage
      "Public Officials" have absolutely -nothing- to do with where "public infrastructure" networks are connected since this "public infrastructure" is almost exclusively -privately- owned. You really, really don't want the federal government making these decisions. Really.
      • Actually they do (Score:5, Insightful)

        by actionbastard (1206160) on Thursday April 02, 2009 @12:08AM (#27427101)
        'Public officials' are responsible for making sure that infrastructure like traffic lights, water systems, sewage systems, and the like, are completely secure and isolated from any 'public' network like the 'Internet'. If the control systems for these critical systems are connected to the 'Internet', every citizen should be outraged at the complete disregard for the security -or lack thereof- for these systems.
        • by jofny (540291)
          1. The people who own those assets are responsible for it, at the end of the day. In many cases, they're private companies which are free to figure out how to run their own businesses as they see fit. In some cases, it's a sort of mixed situation where they're owned by local municipalities with some of the same constraints (and sometimes additional constraints) as privately owned utilities. Finally, some are nationally regulated.

          2. It would have been nice to never have connected these utilities to the in
        • That the phone system is a network? That traffic lights are often networked, and have to be remotely accessible? Etc. etc. etc.

          There's more to networking than "the internet".

    • Re: (Score:3, Informative)

      by jofny (540291)
      As an aside, if you do actually want to get educated on current efforts, start here: http://www.dhs.gov/xprevprot/programs/editorial_0827.shtm [dhs.gov]
      • Common sense approaches to system security tell me that if I was in charge of these systems they would be secured by every means possible. There is absolutely no excuse for exposing critical infrastructure to attack by every thirteen year old Romanian hacker on the planet because I was not familiar with the latest means to secure my networks. This is, after all, the 21st Century.
        • by jofny (540291)
          You obviously do need an education here. Go check out the actual reality of the situation, how about? As I said, read the NIPP. Then HSPD-7 which generated it. Then look at the sector specific plans. Then check out the archives of SCADASEC for some asset-owner perspectives. Maybe you'll come away with a better idea of the grey, in-progress state it's in, the progress that's been (or not) made, and what the financial and operational constraints are. Some of it sucks. Some of it's good. Mostly, it's an evolv
    • by ljw1004 (764174)

      Banking?

      The same story applies. Your bank account details are so precious that they should never be exposed on the internet. And yet you do use online banking. The benefit in convenience outweighs the security risk.

      The same convenience applies to water, electricity, traffic lights and other parts of the public infrastructure. If we can manage the risk through security protocols, then using the public internet for remote management makes for increased efficiency.

      Increased efficiency is a good goal. If the on

  • Right! (Score:5, Insightful)

    by koterica (981373) on Wednesday April 01, 2009 @11:48PM (#27427011) Journal
    Because US government officials ALWAYS make good technical decisions. Because the placement of officials is NEVER based on politics rather than skill.

    Maybe we could legislate some openness instead.
    • by wiredog (43288)

      Neil Armstrong was a government official. Employed by government officials. In a government program.

  • by Anonymous Coward on Wednesday April 01, 2009 @11:50PM (#27427023)

    Large vendors are behind this. With all the extra security certifications and processes that small businesses (or independent/open source developers) will be required to apply because of "security" open source would be closed out of the market by this.

    Please watch this very carefully. Red Hat and free software companies actually large enough to have lawyers, please, please, please sniff out the rats.

  • The April Fools crap is over now? It's a silly day anyway.

  • ...trying to get under the wire, then please just fucking shoot me.
    • Bang!

    • Don't be naive. Did you really think the Internet would remain some wild-wild-west fantasy of freedom?

      Individual freedom is the antithesis to Political control.

    • The link is to WaPo. I think they're a bit stodgy to be playing April Fools jokes. And if they did, it would be geared toward a more general audience.

  • by gillbates (106458) on Thursday April 02, 2009 @12:15AM (#27427143) Homepage Journal

    If passed, this could have the effect of a de-facto outlawing of Linux. For example, consider the typical business small business owner's plight: he uses Windows mostly on the desktop, but has a few Linux servers handling things like mail and print services.

    1. Government inspector pays a visit.
    2. Government inspector verifies the desktops have the latest Microsoft patches and antivirus installed.
    3. Inspector then moves on to the server room, where Linux is installed. Inspector can't determine that "latest Microsoft patches are installed", so machines are marked as non-compliant.
    4. The business owner has 15 days to rectify the "non-compliant" situation. His IT guy tries to explain to the government inspector that Linux is its own operating system; that it doesn't need patches from Microsoft, indeed, that it can't even run said patches...
    5. Goverment inspector's response: "You have to install the latest patches from Microsoft. If your software doesn't support the latest patches, you have to upgrade."
    6. Small business has no choice but to move their servers to Windows so that Government inspector will sign off on compliance certificate. Score one for Microsoft, scratch one Linux installation.

    I understand the government wants to ensure "cyber security" - whatever that means - but they, of all organizations, are the least qualified to implement it. The conflict of interest between big business and government interests is just too great for this to be anything but a tremendous waste of time and money.

    And this without even considering the larger question of why the government should have any control over the software private users run on their own computers.

    • In the name of cyber-security, you will be required to run government-approved software. Which, if it isn't outright insecure in the first place (I'm looking at you Microsoft!) will provide a convenient avenue for the government to insert its own backdoors for spying on the public at large.
    • While were at it, why not use OS hooks to cap the user's bandwidth so they *cannot* download more than the large telecomms think they should.
    • Oh, and what a convenient way to stop piracy. Look! this government required security software reports back to the studios when a filesharing client is installed.
    • Why bother knocking down the door, when the Virtual Search Warrant (TM - Microsoft) will allow the police to keep us all "safer" by allowing law enforcement to check our computers for illegal content...
    • by Thanshin (1188877)

      The only possible path from:

      1 Government forces all businesses to use standarized crap software.

      is:

      2 Standarized crap software is thoroughly raped and even infants can enter any complying business.
      3 Businesses remove crap software.

    • by rennerik (1256370) on Thursday April 02, 2009 @01:55AM (#27427445)

      I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications, so it would be silly to assume that they wouldn't write legislation in such a way that such OSes would be included.

      I imagine something of a "security certification requirements" that the ruling body of each OS would put forth (i.e., each Linux distro would put forward a list, as well as Microsoft for Windows, Apple for OS X, etc). This list would be submitted to the government/whatever authority, and they would use this list in testing whether or not individual IT installations are complicit. The list, if implemented, would also have to assure that the OS's operation would meet the government's "cyber-security requirements".

      In other words, I don't imagine the government would completely ignore Linux to give a leg-up on Microsoft. Not only would that fall in the face of the whole anti-trust suit with MS, but also the government would have to shut down its own systems running non-MS operating systems. That approach doesn't appear to make any sense.

      • I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications...

        Absolutely (and not just in "certain applications"). Ask google about something called "Trusted Solaris". There's a DoD org that's responsible for producing "blessed" versions of all major (and many minor) OS and software packages called the DODIIS. (Yes, you pronounce it "dodus".)

      • I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications, so it would be silly to assume that they wouldn't write legislation in such a way that such OSes would be included.

        By saying it would be silly to assume [...], you assume competence...

    • Wasn't TCP/IP suite made JUST for handling the Ultimate War?
      I mean after all the greatest (and probably the only) strength of IP is automatic re-routing in case of disruptions.
      So, an attack against even 80% of our TCP/IP-based internet would still result in the rest of 20% routers taking the traffic and still deliver...
      This is a clear case of Government spying on us.
      And i thought Obama was a nice man...

    • Which, if it isn't outright insecure in the first place (I'm looking at you Microsoft!) will provide a convenient avenue for the government to insert its own backdoors for spying on the public at large.

      Be aware that any backdoors that are inserted by friendly forces can be used by the enem(y|ies) to compromise said weakened systems. If you know *anything* about security (or have been on /. sometime in the past five years) you already know that "security through obscurity" is no security at all. Despite what conventional wisdom tells you, the ignorant CEOs and CTOs of the government world are (almost always) advised by some very bright, clueful folks.

    • by jefu (53450)

      Indeed. My university has a deal with another university that allows us to use their classrooms on the other university's campus. That campus has wireless and it is protected by requiring the systems that connect to it to run a specific piece of software - which is supposed to ensure that your machine is virus free and all (yah,right). That software runs only on Windows (and recently on Macs), thus they have effectively precluded the use of Linux on their campus network. All, of course, in the name o

    • I hope you don't mind me pasting that post into a letter I'm sending Olympia Snowe as one of her constituents.
    • by gruhnj (195230)

      3. Inspector then moves on to the server room, where Linux is installed. Inspector can't determine that "latest Microsoft patches are installed", so machines are marked as non-compliant.

      The FederalGgovernment uses Linux as well and there are published security standards for it. The NSA and DISA both publish security guides and implementation guidelines for Linux. NSA Secure Configuration Guides [nsa.gov] DISA STIGS [disa.mil]. This will require training for your typical enforcement droid but is not out of reach. To say that regulation would require Microsoft only is ignoring the fact that *nix is very much in use in the Federal Government

    • by CompMD (522020)

      A real American should have the following step between 3 and 4, possibly negating the rest:

      3.5) Lock inspector in server room, turn off lights, announce over intercom into server room you are going to turn on the halon to demonstrate he is non-compliant with your halon-survival procedures.

  • Haven't we already been under attack for a while? Granted, I'm no expert in this field but haven't foreign nations been attacking the US for a while? Wasn't there a story a couple of days ago about GhostNet?

    I heard a lot of tin foil hat people talking about an "i-Patriot Act" but I thought it was a lot of nonsense. When the government tries things like this and says they will work in a way as to try and not infringe on privacy, how many actually believe them.

    The biggest concern I have would be the power

  • by ka9dgx (72702) * on Thursday April 02, 2009 @12:30AM (#27427199) Homepage Journal

    Until we get operating systems that can run code without having to trust it, we're going to keep getting the same crap, over and over.

    Linux isn't the answer. Hell, even SElinux isn't the answer.

    Start reading up on Eros, Keykos and Capros to see about systems that might actually solve the security issues once and for all.

    • Re: (Score:3, Insightful)

      by jhantin (252660)

      +1. Problem is, current CPUs themselves are buggy and exploitable, so you still need a verifier, and if you need that you may as well have a VM and a JIT. Unfortunately the major VMs that have the building blocks to be capability-secure -- such as CLR and JVM -- threw it all away with their standard library designs.

      There's also a hidden side of capability security: preventing data, or more generally causality, from leaking in or out of a given piece of code. If there's an API exposed to untrusted code th

      • by ka9dgx (72702) *
        Yes, covert channels will always be an issue, as with physical security... but I think we can agree that specifying the capabilities to be given to a piece of code is a much saner way to do things than to be forced to trust your code.
  • I sure hope there is some mention of a court order before shutting down anything, whether public or private. Even if it is in such a way where they do it first, then get the court order within like 72 hours.

    • Court order???
      What are you? A moron?
      This is the new American man!
      Where we free Senators who have been convicted of corruption, and refuse to prosecute presidents who broke laws.
      But damn it, we send kids to jail for 25 years for taking photos of themselves or stealing an apple...
      The French should demand that USA return back the Statue of Liberty: after all when a cop could shoot you down like a dog and not face jail for the crime, this country does not have liberty...

  • Because the one thing we've learned from having software mono-culture is that its a Good Thing(tm).

    Now we're attempting to fix the problem by having federally mandated mono-culture? Please!

    And as someone who has worked for companies that have developed government specs, I can assure you that the process will be corrupted as to bias towards certain vendors. Any required feature that can be patented will be, and any open-source implementation will be sued out of existence.

  • by TheLeopardsAreComing (1206632) on Thursday April 02, 2009 @12:47AM (#27427265)
    1.) Instead of a Czar, I like "Commissioner Of The Internets" 2.)Issues like this make me question where these senators get their information. They obviously do not know the current technology well enough to create laws involving it... maybe we should focus more on the lobbyist groups that funded their campaigns and figure out who benefits the most from this!
    • by spauldo (118058)

      How about "Commissioner Gordon of the Internets"? Then vigilante justice on those spammer assholes would be only a phone call away. The Batcomputer could probably use an upgrade.

      'Course, while fighting LOLCATwoman might be worthwhile, Batman's distrust of the Penguin might make him a bit biased...

  • by carlzum (832868) on Thursday April 02, 2009 @12:55AM (#27427291)
    Anything involving a new "czar" invariably fails to achieve its objectives and shows disregard for our rights. Joe Biden is credited with coining the term "Drug Czar" and was a vocal proponent of making it a cabinet level appointment. Ironically, the current administration has downgraded the post to a non-cabinet level position. I hate the term and wish it would go away, it sounds anti-democratic and seems to act accordingly.
    • Re: (Score:2, Insightful)

      by TrueRecord (1101681)

      it sounds anti-democratic

      What if it sounded pro-democratic? Would be better?
      Imo, It does not matter how it sounds. It IS anti-democratic.
      I mean that's against people.

  • And then (Score:3, Funny)

    by Amazing Quantum Man (458715) on Thursday April 02, 2009 @01:21AM (#27427357) Homepage

    the terrorists build a CIP device, and then storm the White House, and then they get bioweapons in DC.

  • as in, the legislators, not the day

  • [The bill] would require the National Institute of Standards and Technology to establish "measurable and auditable cybersecurity standards" that would apply to private companies as well as the government. It also would require licensing and certification of cybersecurity professionals. "

    And any of us who went public with information on illegal/un-ethical wiretapping or gross incompetence would lose their license.

    That'll shut up those pesky security professional/privacy advocates.

  • Federalizing cybersecurity?

    FUCK THAT!

    Big Brother already has a hell of a time keeping the US's *physical* borders secure, with all of the politically-correct bullshit that is allowing drug smugglers, human traffickers, illegal aliens, and other less-desirable what-not to cross the border illegally at will.

    If you want an idea on how it will go, take all the political-correctness and bureaucratic hurdles that have prevented effective enforcement of physical borders. Then, substitue *your* computer for the con

  • Effective laws? (Score:2, Interesting)

    by mo'o ahi (633487)

    While I applaud the Senators' efforts to assist in securing cyberspace, historical efforts to legislate cyber-security have not proven effective. (that was tough to say with a straight face) To wit, examine the Government's own record: Currently all federal agencies are required to follow strict guidelines/policy, yet the average info-security grade given by OMB, for FY2007 was a C-. How far would you get in life if your average grade was a C-? I'd guess the average Slashdotter had better than a 1.7 avera

  • Most of what everyone is going on is speculation. We don't have the bills to read so we don't know. It could simply be limited to private companies that provide electricity and power for all we know, or any public infrastructure-based system.

    Just calm down, wait until the bills are even introduced, read it, pick it apart, contact your Senator and express your dismay over the project.
    • by shentino (1139071)

      I doubt special interest groups would let it rest.

      Besides, we at /. know that Microsuck can't make a decent secure product. Why should using them even be an option? Let alone mandated by a team of techies that were probably cherry picked by MS friendlies in the first place?

  • And what is this stuff about "water"?

    Sorry, but the States own the waterways.
  • My chief worry is actually not so much about "increased powers" - I suspect they can already do most of this in one way or another. But centralising things means that an attacker only needs to find one weakness, so to speak, and then they would be able to wreak havoc on a grand scale.

  • Right after the conficker worm hits everybody hard, we finally get someone with brains doling out a new regulation that makes companies responsible for their work environment, even on the PC.
    Awesome, I hope they come out with proper fines and hierarchy of payment levels.

    Now if they could do this with recycling, it would be really great.

  • Had a discussion with one of my security guys and he had a very insightful point. Security is the best when there is a disparate security apparatus, where I might use X, Y, and Z vendors for my security solution and my competitor uses A, B, and C. This creates complexity for malicious hackers due to complexity created by this disparity. By mandating standards, the Government creates a target that security vendors have to reach and have no incentive to go beyond that standard. This might create an unintende

  • Obviously, the "enlightened self-interest" of companies doesn't work, given the constant reports of breakins.

    And for those who don't realize (like Jane Q. Public), utilities like the electric grid, and municipal water and gas supplies, are computer controlled (no! duh!), and in some cases, Dilbert managers have had the controls made accessible via the 'Net, rather than an air gap between their control systems and the 'Net.

    A year or two ago, over in the UK, there was a train accident - don't remember if it w

    • by Python (1141)

      So, yeah, it *is* what we need.

      "It" is the problem. The federal government is not qualified to set the standards or manage them. For example, look at FISMA - an unmitigated FAILURE in security. Its an excercise in building paper forts around computers and networks - and this is the BEST the federal government can do.

      The federal government can not provide IT, the problem is one of design. Systems are not designed for the threats they face, and the federal government is worse than ill-equiped to lead that effort - its not only part o

    • by BeanThere (28381)

      The benefits don't outweigh the negatives, and the potential for abuse is too high. You seem to think a system needs to work 100% or it's not working. Nonsense, we can certainly tolerate the odd incident here and there, like we do with everything else in life. The idea of Windows computers controlling things like the electricity grid and nuclear power stations sounds scary to me too, but if it was really such a problem as to warrant this kind of intervention, there would be incidents all the time. Things ar

  • In finance, companies routinely send questionnaires to each other to ascertain whether security standards are being enforced. The problem is, the questions are often disconnected from the actual tasks and practices - one-size-fits all queries. Since the questions are generally more-than-half bullshit, you can imagine how the answers come out. The buzzword compliance ratio runs high. Measures that promote or enforce actual security - not so much.

    Having more law from the government for this will accomplish on

Old programmers never die, they just branch to a new address.

Working...