Federal NOC To Be Modeled After Incidents.org / DS

An anonymous reader writes "Computerworld is covering in more detail the new Federal 'Cybersecurity Center.' The article explains that unlike some earlier rumors indicated, the center will not try to build a super-carnivore, but instead use voluntary reports. It will be similar to the SANS Institute's Internet Storm Center, which summarizes contributions submitted to DShield.org. This system of voluntary contributors has been shown to be effective in the past by issuing early warning for a number of major Internet worms, like Code Red, Ramen and SQLSnake. Unlike Symantec's 'for pay ' Deep Sight service, which publishes alerts only to paying members, Incidents.org is a free service."

Comments

Duplicating private sector

[sjanich]

WOUldn't it make more sense to instead of spending money building something like incidents.org, to fund incidents.org partially with grant money from the feds, so that it can beef up somewhat, and create a Federal liason team? They would spend less and get their goal quicker.

Re:Duplicating private sector

[RollingThunder]

Not if you want to start doing DShield-like data correlation, but from the ubersecure (snicker) internal government systems.

People would have an absolute bird if it got out that attempted access logs from #insert government agency here# were being sent to a NGO for correlation.

Although I won't deny that some greenbacks for incidents.org would be a great idea.

IT purchases must be _certified_ for security?

[cfadam]

Did anyone else notice this statement:

"In an interview with Computerworld last month, Clarke said the plan may include a governmentwide policy that requires all IT purchases to be independently certified for security prior to approval."

I would like to know what it takes for a product to get "independently certified for security", and how would/does this affect OSS?

(If this has been posted and answered in the past, please mod me down.)