New Legislation Would Federalize Cybersecurity

Hugh Pickens writes "Senators Jay Rockefeller and Olympia J. Snowe are pushing to dramatically escalate US defenses against cyberattacks, crafting proposals in Senate legislation that could be introduced as early as today, that would empower the government to set and enforce security standards for private industry for the first time. The legislation would broaden the focus of the government's cybersecurity efforts to include not only military networks but also private systems that control essentials such as electricity and water distribution. 'People say this is a military or intelligence concern, but it's a lot more than that,' says Rockefeller, a former intelligence committee chairman. 'It suddenly gets into the realm of traffic lights and rail networks and water and electricity.' The bill, containing many of the recommendations of the landmark study 'Securing Cyberspace for the 44th Presidency' (PDF) by the Center for Strategic and International Studies, would create the Office of the National Cybersecurity Adviser, whose leader would report directly to the president and would coordinate defense efforts across government agencies. The legislation calls for the appointment of a White House cybersecurity 'czar' with unprecedented authority to shut down computer networks, including private ones, if a cyberattack is underway. It would require the National Institute of Standards and Technology to establish 'measurable and auditable cybersecurity standards' that would apply to private companies as well as the government. The legislation also would require licensing and certification of cybersecurity professionals."

Comments

Last one out....

[theshowmecanuck]

Shut the light off.

Re:Last one out....

[Z00L00K]

This may be a late April fools joke by government standard, but it sure contains plausible concerns.

Concerning the document, I would say that it isn't a joke, but you may have to express some concerns about if the proposed methods are causing more problems than they are solving.

If you shut down a whole network, then you also cut off the owners of possible infected computers from the services that may help them to clean them up. This has been tried before within larger companies which just ended in a deadlock, nothing was done at all until the network was up again. In effect - you got an ultimate D.o.S attack!

If anything - put more effort into hunting down and apprehending the perpetrators. This will give a much better result in the long term. In effect - follow the money.

Another approach would be to put more effort into hardening of operating systems and tools for operating system management. SELinux is one good example, but unfortunately this only works to some extent and it only covers one area of security measures.

One detail that also is cause for concern is ISP:s that migrates from several routed segments to a large segment where switches are used instead. It makes sense from an economic perspective, but it's not making sense from a security perspective. This means that more computers can be joined into dark nets using private IP addresses for internal communication, which in turn can make attacks even better coordinated.

Large switched segments where private IP addresses propagates can also result in new intriguing ways of obscuring file sharing traffic and other traffic that is to be masked. This can result in the funny effect of making a whole town suspected of possession of child pornography.

Re:Last one out....

[jonaskoelker]

Concerning the document, I would say that it isn't a joke, but you may have to express some concerns about if the proposed methods are causing more problems than they are solving.

Wait, the government is displaying (potential) ham-fisted incompetence, and you think "ah! That must be a joke!".

You're not cynical enough to be on /.

It will be named....

[feepness]

Standardized KeYing NETwork.

Re:It will be named....

[jank1887]

how can the first reply be redundant?

Re:It will be named....

[Anonymous Coward]

What's wrong with that? We already have cyberdyne.jp/english making robotic exoskeletons.

Re:It will be named....

[rts008]

It is deliberate by /., allegedly designed to cut down on inane first posts just trying to be first posts...or something.

It has backfired, though. Since all first posts are automagically down-modded, then what do you have to lose by inane first posts for the sake of first post?

From the /. FAQ(note the date-this is not new by any means):

What's up with "First Post" comments?

"First Post" comments are one of those odd little memetic hiccups that come out of nowhere and run amok. Basically, people with altogether far too much spare time sit and reload Slashdot, hoping that they will get the "First Post" in a discussion. This is one of those things that the moderation system was designed to clean up, and for the most part, it works. "First Post" comments usually get moderated down as off-topic almost instantly.

Answered by: CmdrTaco
Last Modified: 6/12/00

[my emphasis]

Obligatory: You must be new here. :-)

Not such a good idea

[Bruce Perens]

I don't tremendously trust the government to:

• Maintain competence in a technical topic undistorted by political agendas.
• Be free of influence from deep-pockets technical companies to the disadvantage of smaller and disruptive players.
• Be platform-indepependent in their requirements and certification process.
• Segregate the power to turn off segments of the network to manage attacks vs. turning them off to manage other issues such as some mis-guided concept of "piracy", etc.

I side with Vinge in believing that segmentation of the network is a sure indicator of a government going feral.

Bruce

Re:Not such a good idea

[rackserverdeals]

Yeah but what can we do? We're just a bunch of people that bitch and moan on slashdot.

If only there was some respected, well known figures in the tech world that could try and get the ear of people that mattered.

If only there was someone that already had advised the Obama administration, other national governments and even spoke at the UN that could raise the concerns with people that matter. :)

Re:Not such a good idea

[shadowbearer]

  * Appoint people who know how to do all of the above, or who will listen to people who would give them good advice.

SB

Re:Not such a good idea

[phantomfive]

Optimist! :)

Personally I don't trust government to:

• Maintain competence. Period.
• Be free of influence from deep-pocket companies. Period.
• Come up with any sort of sane requirements. Period.
• Manage power in any way that doesn't attempt to increase their own.

In choosing democracy we've (wisely) given up some effectiveness in government in order to avoid having dictators. However this current government seems to have gone off the deep end, insanely grabbing power, and then not knowing what to do with it once they have it.

On the bright side, after the coming mass-inflation, they essentially won't have any power due to the fact that they'll have no money (at least, no money that's worth anything). On the depressed realistic side, how can we reasonably expect our representative government to manage money/things when half the population is incapable?

Re:Not such a good idea

[clarkkent09]

Missed an important one:

- Not abuse access to data held by said companies

Let me get this straight, NSA (the agency recommended for the job according to tfa) will conduct "ongoing audits" of private networks owned by the utilities (telecoms too?) and nowhere does it say that this does not include access mountains of data held by those utilities on just about every person in the US

Re:Not such a good idea

[timeOday]

this current government seems to have gone off the deep end, insanely grabbing power, and then not knowing what to do with it once they have it.

How so? Attaching some strings to the tax money they pump into failed businesses? We certainly seem headed for a bad economy, but allowing it to implode unimpeded may well have been even worse. There are no good options.

As for the new cyber-security initiative being flawed, compared to what? The baseline is: nothing. Assuming the govt. will fail at policing the networks of critical infrastructure is like assuming the govt. will fail at policing the streets, which is manifestly false. Our police and courts aren't perfect, but they're a far sight better than anarchy, and all-in-all well worth the taxes that support them. Certifying cybersecurity professionals may not be a 100% guarantee, but again, the baseline is no certification. I'm glad dentists and doctors have to be certified, even though malpractice isn't fully eliminated.

Re:Not such a good idea

[Deanalator]

I think that this is a great idea.

I think that the government needs to have a hand in every industry that profits off of people's misfortunes.

Medical companies have no financial incentive to keep people healthy the same way that infosec companies have no financial incentive to secure the nation's infrastructure. Instead of research scientists working for cures we have greedy corporations that have risen up, trying to sell the antidote of the day.

What if, instead of hoarding 0day and designing proprietary crypto, the National Security Agency actually published their research publicly? What if their research allowed Americans to make secure phone calls with each other, instead of finding new ways to wiretap us? What if, with all their unlimited funding, they released their static analysis methods to the public and actually made America a more secure place?

Re:Not such a good idea

[phantomfive]

How so? Attaching some strings to the tax money they pump into failed businesses?

You clearly haven't been paying attention. Apart from trying to tax bonuses with unconstitutional laws, they've bailed out some companies while letting others fail with no clear motive, they've bailed out companies when letting them fall into bankruptcy would likely be a better option, they've spent a lot of money on projects that won't particularly help the economy all that much, they've spent so much money that inflation will be hard to avoid in the near future (and you REALLY don't want inflation during a recession), they've sent unclear messages about what they are trying to accomplish (some have speculated that Bernanke's ultimate goal is to never be accused of not spending enough), and on top of it they've proposed a budget that will triple the national debt in 10 years, and double it in five. If you want to go back a little farther, we can talk about starting two wars, not a great idea to begin with, but more importantly they were waged with clear incompetence from the beginning.

As for the new cyber-security initiative being flawed, compared to what? The baseline is: nothing.

I don't know if you are trolling here, or if you just haven't read the article, but they want the power to shut down any network they want. This is significantly worse than nothing, for reasons pointed out by Bruce above.

Sometimes it is better to do nothing. As the saying goes, "Don't just do something, stand there!"

Re:Not such a good idea

[fferret]

Speak for yourself. I'm a /.er who bitches, moans, and runs two private networks, the one at work, and the one at home. I agree that the government cannot be trusted to be impartial, but I also agree that cooperative action must be taken to forestall a network issue. Perhaps the best way to handle this would be a mutual cooperation agreement between the upstream ISP, and the private network admin. That would be sufficient for most problems. Since the Internet is non-deterministic, anything widespread enough to require a national response is going to have probably brought down the net anyway. Top-tier ISPs, (if they don't already) should have co-op agreements in place. This means that the fed only has to coordinate with the Tier 1 ISPs on national/international issues. I would also point out that the government cannot (and in many cases will not,) act to preserve data that it considers irrelevant to it's current concerns.

Re:Not such a good idea

[jandersen]

I know it is a national pastime in America to be as negative about government and politicians as possible, and unfortunately it isn't all unjustified. But if you can't see anything good or positive even in your worst enemy, you are seriously blinkered; and what is worse, you cut yourself off from the possibility to communicate from a common basis and thus from any chance of exerting any influence. Isn't this what keeps all the stupid regional wars going for generations? The Middle East, Sri Lanka, Northern Ireland until recently, much of Africa etc etc.

Your all-out, negative attitude actually plays into the hands of lousy politicians - they want you to think it is hopeless to try to change things, so they can't go on and line their own pockets they way they know best.

Re:Not such a good idea

[Toonol]

For every positive what if, I can construct a negative one, and it's more likely to come true. We want the government that governs least; that's the best (to paraphrase). When any action from the government is likely to make the problem worse (evidence: I point to the economy), the best course is to forbid it from meddling at all.

Re:Not such a good idea

[phantomfive]

You are right, government doesn't have to be bad, and it could be worse, however, the truth of the matter is, there is a high level of incompetence in the US government right now. The infrastructure is falling apart (we literally had a bridge fall down while people were driving over it), the social security has needed some fixes for a while now that were obvious, and yet no one has fixed them; the list goes on. If you can't take care of the basics, if you can't even maintain a balanced budget (which is where California especially is), then you fall into the category of incompetent. I stand by the four points I made in my previous post.

This is why it is important that we have more transparency in government, so we can see what they are doing and can do something about it if they do stupid things, like this lame law, for example.

Re:Not such a good idea

[idiotnot]

Why does one word seem to come to mind with all four of those points......that word being "Microsoft?"

* Think Senators Rockefeller or Snowe have ever knowingly used Linux, much less heard of NetBSD?
* Platform standardization! TCO! Integration!
* It only works with Windows.
* Hi, there, DRM!

But, you know, you have to give it a chance. Enough hopeychange, plus a new federal center for cybersecurity in West Virginia, and we'll be _great_.

Re:Not such a good idea

[drinkypoo]

I think that the government needs to have a hand in every industry that profits off of people's misfortunes.

Wow. I mean, just mega-wow. Are you serious?

The government is already involved in every industry that profits off of people's misfortunes. The automotive insurance industry exists in its current form because it was able to purchase legislation which mandates its use. The medical insurance agency, big pharma, the banks that mushroomed all these mortgages all out of proportion to what they should have been (besides which, while I do believe in caveat emptor I also believe that of all things you should be able to trust that a bank will act conservatively most of the time) and the RIAA all function under bought-and-paid-for legislation.

If you think more government intervention in these things is going to improve them, think again.

Re:Not such a good idea

[drinkypoo]

Think Senators Rockefeller or Snowe have ever knowingly used Linux, much less heard of NetBSD?

Primarily developed by the US National Security Agency, [SELinux] was released to the open source development community under the GPL on December 22, 2000 and merged into the mainline kernel 2.6.0-test3, released on 8 August 2003.

Re:Not such a good idea

[Anonymous Coward]

every sentence in the main paragraph of your post could be appended with "in my opinion". you present all of these thing like facts to support your earlier statement, but they are all opinions

Re:Not such a good idea

[hoooocheymomma]

I think that the government needs to have a hand in every industry that profits off of people's misfortunes.

How incredibly naive of you to think that government involvement keeps businesses honest. You need to understand that A) The government needs to make money too, and they will do it in unscrupulous ways just like private industry, and B) The government, like private industry is filled with PEOPLE. People make selfish decisions whether they are part of the government or not.

Instead of research scientists working for cures we have greedy corporations

Swap private sector for public, and the summary will merely change to: Instead of research scientists working for cures we have bureaucrats who can't get fired, have guaranteed raises, and will inevitably scratch the backs of contractors so that they can get a ridiculously high paying contractor job that makes use of their government contacts once they retire (much earlier than private sector workers) from the government with a taxpayer-funded pension.

My wife works for the government and I work for a government contractor.

Re:Not such a good idea

[hoooocheymomma]

the truth of the matter is, there is a high level of incompetence in the US government right now

No. The truth of the matter is, there is a high level of incompetence in the human race at any given time. The problem with the government is not that it is filled with idiots who are less competent than the private sector. The problem with the government is that it is just as unreliable as the private sector, only once you let the government control something, they NEVER give it up.

Re:Not such a good idea

[furby076]

Yeah but what can we do?

A lot of election races are dead-heat races. Imagine if you organized a grass-roots program to vote for the guy you wanted who supported your viewpoints? You would be surprised how powerful a large, organized, voting block can be when it wants to influence an elected official (or a potential one).
You could run for office - start small and work your way up. Eventually make the correct changes
You could create websites, or write well-written articles to get them published in general newspapers (not specialized magazines).

Lot's of stuff out there that you can do...or you can, as you said, bitch on /.

Re:Not such a good idea

[moeinvt]

" . . . unfortunately it isn't all unjustified."

I don't hear too many gripes that I think are "unjustified", especially in this forum.

"if you can't see anything good or positive even in your worst enemy, you are seriously blinkered;"

Glad that you've accepted the fact that our government is our worst enemy. Oh btw, they do a pretty good job with the national parks system and postal service, so they aren't 100% bad. However, if you base your expectations for any new Federal government initiative on your observations over the past 10-20 years, you can be reasonably assured that it's going to be detrimental to the average citizen. I seriously cannot remember the last time a new Federal law was passed that I actually thought was going to improve something. You could cheer me up by refreshing my memory.

" . . .you cut yourself off from . . .any chance of exerting any influence."
" . . .lousy politicians . . . want you to think it is hopeless to try to change things,"

After failing to stop telecom immunity(revised FISA law), renewal of the Patriot Act, TARP, and the AIG bailouts, it's easy to get discouraged, but I use my dis-satisfaction as a motivating factor for my political activism. You can be sure I'll at least send letters and e-mails to my elected officials telling them that their new cyber-security idea sucks ass. I'm really disappointed in Senator Snowe (R, ME), because she has been an advocate for net neutrality in the Senate. Guess that idea has fallen off the table now that they can't blame a Republican majority for blocking it.

Re:Not such a good idea

[McGruber]

If only there was someone that already had advised the Obama administration, other national governments and even spoke at the UN that could raise the concerns with people that matter. :)

Sounds like a job for the BSG cast.

Re:Not such a good idea

[Anonymous Coward]

Thats the problem isent it?

In the US, the government is in a power struggle. Dems vs Reps, Authority vs People, etc. However you want to frame it, you cannot escape the problem that the president has LOTS of power (all of the "real" power, anyways), and under the president are lots of people with their own agendas, and they can use the power of the president to suit that agenda.

Anyone appointed is likely to push their agenda (even if that agenda is "freedom" and "power to the people"), but even they did a good job and worked only to protect national security, the next president or person appointed could easily overstep their bounds (they might, for example, try to stop all the crackers in good spirit, but turn things into another sex registry or other over-the-top law).

For this to actually work, it would probably be best if its run from within the military, with no power to prosecute or turn over to the cops/feds any information. Of course, this assumes the military is both competent, and that they would take this task as seriously as they do gaurding nuclear weapons and other more convention military functions (read: any power struggle would not be tolerated). If they dident, then it would probably be run by someone whos agenda is not strictly national security, but more along the lines of a cop or worse.

Re:Not such a good idea

[jandersen]

...the truth of the matter is, there is a high level of incompetence in the US government right now. The infrastructure is falling apart (we literally had a bridge fall down while people were driving over it), the social security has needed some fixes for a while now that were obvious, and yet no one has fixed them; the list goes on. If you can't take care of the basics, if you can't even maintain a balanced budget (which is where California especially is), then you fall into the category of incompetent. I stand by the four points I made in my previous post.

Oh, come on, be reasonable. The current administration is not responsible for the mechanical failings of infrastructure that is - what, several years old? And the same goes for social security etc - and they are desperately trying to fix things. And apart from that, if you want to achieve anything in the way of changing the way things are, being contrary and unreasonable is not the way forward; that only tells that you have given up and gone into sulking mode. The system is a huge and unwieldy juggernaut, and it is just not possible to rip the steering wheel around and turn the thing on a plate.

Also, I challenge your sweeping claim that "Government Is Incompetent" - as if everybody in all of every government is a moron, more or less. Take your example with maintaining a balanced budget - have you ever been in a situation where you have been forced into debt? And where you only earned just enough to get by before you got into debt? That is a situation I believe a lot of people in America are in now, so they will understand how it works: you still have to pay your bills and you also have to pay off your new debt - and it is very difficult to balance the budget in that situation. That is the situation the governments on all levels are in right now - they have to go out and spend a lot of money they don't have, because otherwise everything falls apart, and they can't increase their income, 'cause that means either increasing taxes on a population that can't pay them, or, God forbid, taking money from those that are seriously loaded. So the budget is unbalanced. They are doing their best, and it just isn't enough.

As for bridges falling down and the social security failing - well what do you expect, when regulations have been lax and governmental programmes have been underfunded for years - probably something like 8 years, if I am not much mistaken - it can hardly be otherwise.

I think you are perfectly right that more transparency is needed on all levels of government; but equally important is a populace that is willing and able to do the work needed, and go and find out about things - in many cases people just don't give a damn.

Re:Not such a good idea

[DrgnDancer]

Do NOT hand cyber-security over to the military. Gods, I've never work with people so capable of coming with pointless security regulations, excess paperwork, and generally over the top requirements while still not managing to really secure anything. It's amazing.

Re:Not such a good idea

[Mr. Firewall]

they've bailed out some companies while letting others fail with no clear motive

Actually, the motive is very clear, at least in the case of General Motors. It's spelled "Labor Unions".

Re:Not such a good idea

[Crazy Taco]

Yeah but what can we do? We're just a bunch of people that bitch and moan on slashdot. If only there was some respected, well known figures in the tech world that could try and get the ear of people that mattered. If only there was someone that already had advised the Obama administration, other national governments and even spoke at the UN that could raise the concerns with people that matter. :)

We all could have not voted for Obama, as I know many of us did. If we would have made better choices (and I'm not saying John McCain was it), we might not have a government that is trying to nationalize everything that moves. The first step would be a deep clean of congress, voting out about 90% of the incumbents, but a really good second step would be not voting for people like Obama, who cling to irrational ideas that say government intervention in private industry is successful and helpful, despite how often the 20th century has proven them wrong. People that can't learn form history shouldn't be in office.

I know we don't have any statesmen on slashdot that have the ear of those in power, but the slashdot effect would suggest we could wield large amounts of power at the ballot box.

Re:Not such a good idea

[hrvatska]

they've bailed out some companies while letting others fail with no clear motive

Actually, the motive is very clear, at least in the case of General Motors. It's spelled "Labor Unions".

Pretty simplistic view of a complex situation. It might also be spelled "saving one of the last major US owned industrial companies". Or maybe it's spelled "preventing the uncontrolled and disastrous collapse of economies of Michigan and Ohio." What's it spelled when both the UAW and bond holders of GM are told by the Obama administration they both need to make major concessions or GM will go bankrupt? Or what's the spelling of the cost of sorting out the pension mess would exceed the amount we've loaned to GM? The spelling of not wanting hundreds of thousands of additional long term unemployed during the worst recession in 75 years would be interesting, too.

Yeah, Obama has a political debt to the UAW, but the reason the administration is going to such extraordinary lengths for GM extend beyond just that debt. That you see the entire situation as boiling down to supporting unions says more about your ideology than what's actually at stake.

Re:Not such a good idea

[Anonymous Coward]

I don't know if you are trolling here, or if you just haven't read the article

Come on, this is Slashdot. We never RTFA.

Re:Not such a good idea

[Bruce Perens]

Yes, if I work really hard at it I can get admitted to see the policy analysts for various politicians. It's not like they drop everything to talk to me. If I want to do this I'm going to have to start collecting donations (again) because it is otherwise a pretty fast path to being broke, with the days out of work for travel and meetings, paying for flights, etc.

Bruce

Re:Not such a good idea

[phantomfive]

Also, I challenge your sweeping claim that "Government Is Incompetent" - as if everybody in all of every government is a moron, more or less.

I didn't say that. I'm sure there are plenty of individual competent people in government, but the combined whole of government has shown itself to be incompetent. This is true of the current government.

That is a situation I believe a lot of people in America are in now, so they will understand how it works: you still have to pay your bills and you also have to pay off your new debt - and it is very difficult to balance the budget in that situation.

If you are in this situation, the solution is to reduce your spending, consolidate your debt, and begin to pay it off. Our current government has gone the opposite way, by spending significantly more than has ever been spent before. Under Obama's plan, the national debt will grow more in three years than in Bush's entire eight. To use your analogy, this is equivalent to a normal american who has huge credit card debt responding by getting a new higher limit credit card and then spending it all on a new boat. Not a good idea.

Of course, the up-side to so much spending is that the resulting inflation will make the debt much easier to pay off.

I think you are perfectly right that more transparency is needed on all levels of government; but equally important is a populace that is willing and able to do the work needed, and go and find out about things - in many cases people just don't give a damn.

You are right, incompetence in government stems directly from people not being aware, or not caring. An extremely obvious example of this is the Iraq war: Bush wouldn't have been able to do it if 80% of the people weren't in favor of the war. When a large portion of the country is running their own deficits, it's hard for the government to feel motivated to do any differently.

Basically two things are needed: openness and a populace that cares. Right now the trend is headed towards openness, and as people are realizing the effect government can have in their lives, they are starting to care more. So it's a trend in the right direction.

Re:Not such a good idea

[phantomfive]

every sentence in the main paragraph of your post could be appended with "in my opinion". you present all of these thing like facts to support your earlier statement, but they are all opinions

This is not a valid argument of anything, and adds nothing to the conversation. The things I asserted are true. If you believe they are not, show me why they are not instead of your empty, meaningless accusation. I can easily make the same assertion with regards to any topic, for example, "You say evolution is science, but that is clearly just your opinion." Looks pretty silly, doesn't it?

Re:Not such a good idea

[Anonymous Coward]

They only brought up the idea of taxing the bonuses of companies that received massive bailout funds, not everyone's. And that was a bill in the House, it was DOA at the Senate, never became law. The rest of your rant is pretty absurd. It sounds like you rail against government power while blaming the government for not magically fixing everything.

Your point about the deficit is equally amusing. Do you know what happened when the last guy tried to balance the budget under these sorts of economic problems? Herbert Hoover kicked off the Great Depression.

Right now, we're in the unenviable position where, as absurd as this sounds, the government is the least corrupt of the institutions.

Re:Not such a good idea

[cayenne8]

"I don't tremendously trust the government..."

You had me at this point.

Re:Not such a good idea

[Anonymous Coward]

Yes, and I don't tremendously trust the federal goverment not use the powers in this bill to further coerce compliance with statist agendas when recalcitrant state governments, corporations, and individuals "just say no". Apparently they're worried that the power to withhold their largesse with our own money is not going to be enough as the fan keeps getting hit with s...tuff.

Also, there is no reason to think this won't be used on behalf of the IP cartel, which basically owns the Senate, and against everyone else, including the public weal. Absolute power, etc.

rg "hitler won the war after all" b

Re:Not such a good idea

[Mr. Firewall]

Pretty simplistic view

And according to Occam's Razor, probably the right one.

One must make an awful lot of assumptions to accept your explanation -- one of which is that this President is actually competent -- and you still haven't explained why GM (for instance) is being rewarded for failure while many others are left twisting in the wind. My explanation, on the other hand, is sufficient to explain the situation.

To me, this says a lot more about your ideology than anything else.

Re:Not such a good idea

[Deanalator]

Blah for pessimism.

Yes, OF COURSE corruption will always damage any system, and no system is free from corruption.

In general, the government answers to the voters, and corporations answer to their shareholders. In service based industries, pure capitalism works fine, but when it comes to my health and my security I would rather have an elected entity in place rather than a corporation looking to maximise their profit margins.

Of course government should not expand where it is not needed, and I would never dream of handing all security matters over to the government, but wouldn't you rather have a system in place that you can vote down in two years rather than allowing some corporation the ability to monopolise on the fear of the people?

Re:Not such a good idea

[Anonymous Coward]

Ah, sarcasm.

rg "we have met the enemy and he is us" b

Re:Not such a good idea

[Deanalator]

All of the cases you cited are instances where corrupt government officials sold power to the corporations, which is the opposite of government control.

What I am suggesting is sending more tax dollars towards research and development that helps all the people in the united states. This research should be run by people that are answerable to voters, not shareholders. There are industries out there (infosec included) that would make the people safer and more secure if the goal was more about helping people than making profit.

I believe that this is one of the primary tasks of a government. Security should not just go to the highest bidder, it should be available to all citizens.

Re:Not such a good idea

[hoooocheymomma]

Blah for pessimism.

You don't understand. I'm not saying anything pessimistic. I'm simply stating that it's naive to think that because a person got a job in a government agency, it makes him more honest than a person who got a job in the private sector.

In general, the government answers to the voters, and corporations answer to their shareholders.

I can't believe you think it works this way. If you're LUCKY, your government officials will answer to the voters. They don't have to motherfucker. They can answer to *their* shareholders, aka special interest groups, more powerful members of their own party, people they owe favors to, etc. On the flip side. Yes, in bad companies, CEOs make decisions based on the demands of unethical, out-of-touch shareholders, but in a *good* company, the shareholders want what is best for the consumers because it means happier, more frequently returning customers.

You called me pessimistic for saying that the government won't help things. That is because you can't get it through your head that there is *NO* difference between people who work for the government and people who don't work for the government. Where a difference does come into play is when it comes to relinquishing power.

a system in place that you can vote down in two years

What are you smoking? You don't get to vote shit down in two years. Never. Did you get a chance to vote down the DHS? Will the new Administration give you a chance to vote down the President's new salary of double what it once was? The United States government ONLY grows. They don't eliminate jobs. The only way it's possible for government jobs to effectively go away is for people to retire/die, and not refill the position. But the rate at which that happens is so much lower than the rate at which new jobs are created. And you know what? Government workers are so rarely the ones doing the actual work anyway. If the government were to take control of cybersecurity, several new government jobs would be created, and then they would just contract that shit out to somebody like me, and at that point, it would be impossible to make any new, smart decisions on how to do things because it would require new regulations and votes from congress to take any kind of action that's not specifically outlined in your SOPs.

Re:Not such a good idea

[dave562]

The job of the government is not to help the people. If people need help, they need to help themselves. If the government gets in the way of the people helping themselves, the government needs to be replaced by people who won't get in the way. If people were to act justly, with benevolence and courtesy and respect for each other, we wouldn't need the government at all.

Re:Not such a good idea

[phantomfive]

They only brought up the idea of taxing the bonuses of companies that received massive bailout funds, not everyone's.

Can you seriously say in all honesty that you thought I didn't know this? I'm pretty sure 99% of the people who read it knew what I was talking about.

The rest of your rant is pretty absurd. It sounds like you rail against government power while blaming the government for not magically fixing everything.

You're failure to understand it does not imply its absurdity. Why do you think I blame the government for not magically fixing everything? Come up with factual arguments that show you've read what I said and I will answer you.

Your point about the deficit is equally amusing. Do you know what happened when the last guy tried to balance the budget under these sorts of economic problems?

Sure, but implying the great depression was caused from trying to balance the budget is a non sequitur. Also, there is a middle ground between 'not balancing the budget' and 'increasing spending so much that it's projected to spend more than all previous presidents combined.'

Right now, we're in the unenviable position where, as absurd as this sounds, the government is the least corrupt of the institutions.

Indeed you may be correct. Not a very happy situation, is it?

Re:Not such a good idea

[hrvatska]

Let's go with Wikipedia's definition of Occam's Razor, which states that the explanation of any phenomenon should make as few assumptions as possible, eliminating those that make no difference in the observable predictions of the explanatory hypothesis or theory. As long as we're misusing Occam, we may as well throw in the quote from Einstein, "Make everything as simple as possible, but not simpler."

Economic considerations make a large difference in considering what actions the Obama administration has taken in regard to GM. In December, Bush authorized $13 billion in aid. It certainly wasn't for love of the UAW that drove him, and there's no reason to assume it was the primary motivation for the Obama administration either.

It's reasonable to assume that economic considerations drove Obama and his economic advisors to delay a GM bankruptcy until it could be executed with as little disruption to the economy as possible. Through the fall, estimates I was seeing of job losses from a GM bankruptcy ranged from half a million up. Ford Motor Company said last fall that if GM went bankrupt it may force them into bankruptcy due to shared suppliers being under stress. Toyota said a GM bankruptcy would adversely affect its North American operations. There is no other industrial corporation in the US whose bankruptcy could be as massively disruptive. The economy doesn't need massively disruptive at this point. If they go bankrupt the government needs a plan to make sure it's as minimally disruptive to the economy as possible. The money loaned to GM bought time to do that. And the new chief executive GM was forced to take from the Obama administration appears to be preparing everyone for a structured bankruptcy.

So, what other company has the Obama administration permitted to fail that would have as significant an impact as GM's failure?

Rockefeller and Snowe?

[cusco]

Do either of them have any clue about what they're legislating? Hope they've got someone on their staffs who know the difference between a SCADA system and a server farm, because I'm quite sure they don't. The alternative is that they've let the intel agencies and the security industry write the legislation, which is just about the worst possible alternative.

Re:Rockefeller and Snowe?

[NoNAU]

Cusco,
Since they do not ( know what they are legislating ), the real concern is what they will come up with to 'ensure that all the bases are covered'. Read on.
- Since private networks will be " monitored ", 'they' ( not us obviously ) will need to be sure that some such are not hiding from them. Hence, ALL IT traffic must be monitored, all networks must be pre-authorized, and the only way to do that is to control everything - who has what operating system, who has what else, who is behind each address - physical, static and/or dynamic IP, who communicates with whom, and perhaps all the way down to who is using an ' excess ' amount of electricity - as a way to track those stealthy farms of systems & connections.
- And of course 'they' will want to know who is trying to hide in other ways, such as developing new protocols, new encryptions, new groups, private sources of power, and on and on.
- This will all be too much to monitor or legislate, and hence watch out for some 'catch all' things to appear, such as individual identity 'presences' which are both physical cards and electronic trackers and enablers.

To all, If you find my concerns about where all of this will lead to be too troubling or 'over the top', just recall what it is that the jack-booted ones of the left fear most - and that is freedom and liberty.

Re:Rockefeller and Snowe?

[Anonymous Coward]

...The alternative is that they've let the intel agencies and the security industry write the legislation, which is just about the worst possible alternative.

Intel agencies, maybe. Payoff to Microsoft, maybe. Defense agencies and contractors, almost certainly. It's based on recommendations from the CSIS, which is a think tank associated with Ford/Carter era policy and defense wonks like Nunn, Kissinger, Breshinski, Scowcroft, etc. The usual Dem suspects. Isn't Tim one of their boys?

Still stupidly and egregiously fascist. Or communist. Same diff.

rg "on the back seat of a bus on Highway 41" b.

Re:Rockefeller and Snowe?

[einhverfr]

Of course they don't! To them the intertubes is a series of nets....

The real issue though is that few people around government have ANY idea the complexity of these problems. I have just begun to develop a mathematical/algebreic system for modelling security of computer networks and it is quite intereting the challenges involved in doing this. However, I can't find anyone who has tried to tackle this problem before mathematically, let alone anyone who has succeeded. The goal of such a system would be to:

1) Mathematically prove that an isolated network is sufficiently isolated as to make it IMPOSSIBLE to attack via automated network tools from an arbitrary point.
2) Mathematically represent the security of a network's ability to contain and detect compromises.
3) Mathematically represent relatice security and containment controls such that one can determine how secure critical systems in fact are.

go ahead

[TrueRecord]

New laws -> new prisoners -> new prisons -> new slave market

Re:go ahead

[Anonymous Coward]

I patented that!

You owe me bigtime, bucko!

Re:go ahead

[TrueRecord]

My kingdom knows no patents.

Re:go ahead

[Anonymous Coward]

Where's my -1, Retarded mod option?

Re:go ahead

[Anonymous Coward]

-> profit! ?

Re:go ahead

[shentino]

I think it's "+1 Underrated"

To smite the mod, be a metamod.

Re:go ahead

[knappe duivel]

You must be new here. AC's don't get to mod.

Re:go ahead

[Anonymous Coward]

However, mods who wish to comment must do so anonymously, or else undo their moderations.

Again, where's my -1 Retarded mod?

Re:go ahead

[Tenebrousedge]

Underrated? A whole five words, that nonetheless manages to be inane and pointless? I disagree vehemently.

Your comment about smiting mods is rather non sequitur; as of now there has not been any moderation on that comment. Also, there's nothing 'meta' about the moderation these days: a lamentable change in policy.

Sure, why not

[Anonymous Coward]

They already have arbitrary control over hiring, firing, and wages at private companies, why not authority over private networks too? If we're becoming neofascist, may as well go whole hog.

The current situation is living proof of the old saying, people get the government they deserve.

Re:Sure, why not

[Anonymous Coward]

I'd hardly call it arbitrary control. Yes, the government told Wagonner he had to quit, but that was in exchange for GM getting billions of dollars of government loans.
Had it been just the government coming in and saying "Fire him" without anything for them, I'd agree with you. But it wasn't. It was a deal in exchange for a lot of government help that they were under no obligation to give at all.
Heck Wagonner could have told the government to bugger off, if he'd thought it was a bad deal.
But he didn't. He (and presumably the board) figured the loans were more important for the company that for him to stay on as head, so he left.

(Posting anonymously, because I've already modded comments to this story.)

Subject

[z-j-y]

HA-HA. April Fools!

More Than Meets The Eye

[hypnolizard]

Got to be some self-interest behind this. Who are the lobbyists?

Re:More Than Meets The Eye

[Anonymous Coward]

Microsoft?

Re:More Than Meets The Eye

[Anonymous Coward]

Name a defense company. It's a veritable Who's Who of Beltway Bandits.

Cybersecurity 'Standards"

[actionbastard]

"measurable and auditable cybersecurity standards" that would apply to private companies as well as the government.

Until your elected representatives fully understand that any public infrastructure networks should not be connected to the 'Internet' -for any reason- any discussion of 'cybersecurity' is simply wasted words. WTF does it take for these 'public officials' to realize that critical infrastructure networks need to be completely isolated and secured from the hostile environment that the 'Internet' has become?

Re:Cybersecurity 'Standards"

[jofny]

"Public Officials" have absolutely -nothing- to do with where "public infrastructure" networks are connected since this "public infrastructure" is almost exclusively -privately- owned. You really, really don't want the federal government making these decisions. Really.

Re:Cybersecurity 'Standards"

[jofny]

As an aside, if you do actually want to get educated on current efforts, start here: http://www.dhs.gov/xprevprot/programs/editorial_0827.shtm

Re:Cybersecurity 'Standards"

[ljw1004]

Banking?

The same story applies. Your bank account details are so precious that they should never be exposed on the internet. And yet you do use online banking. The benefit in convenience outweighs the security risk.

The same convenience applies to water, electricity, traffic lights and other parts of the public infrastructure. If we can manage the risk through security protocols, then using the public internet for remote management makes for increased efficiency.

Increased efficiency is a good goal. If the only argument against it is the unlikely risk that "terrorists might switch off our electricity supply" -- a risk that so far has no basis in fact -- then we should go for it.

Re:Cybersecurity 'Standards"

[Anonymous Coward]

"measurable and auditable cybersecurity standards" that would apply to private companies as well as the government.

Until your elected representatives fully understand that any public infrastructure networks should not be connected to the 'Internet' -for any reason- any discussion of 'cybersecurity' is simply wasted words. WTF does it take for these 'public officials' to realize that critical infrastructure networks need to be completely isolated and secured from the hostile environment that the 'Internet' has become?

So, explain then how nuclear power station operators would then surf the web without connection between meltdowns ?
Or are they supposed to bring their own pron to work on an ipod ?

Re:Cybersecurity 'Standards"

[Bob the Super Hamste]

I would say that it is more that management of public infrastructure needs to realize that it should not be connected to the public internet. Unfortunately this won't happen because it is cheaper to have a worker be able to access their e-mail and a SCADA system from one computer than to have one for accessing SCADA and one for e-mail and all the other garbage the want.

Right!

[koterica]

Because US government officials ALWAYS make good technical decisions. Because the placement of officials is NEVER based on politics rather than skill.

Maybe we could legislate some openness instead.

Re:Right!

[wiredog]

Neil Armstrong was a government official. Employed by government officials. In a government program.

CIP device

[Veramocor]

Hopefully the terrorists won't get hold of the CIP device.

Re:CIP device

[sheph]

I did a double take when I heard that on 24. :) I've been living and breathing CIP for the past two years. I wish there were such a thing as a CIP device; a black box that you just drop in to the network that magically makes your organization CIP compliant. It sure would make my job a lot easier. In all seriousness though it really seems to be more about creating the illusion of security rather than actually making systems more secure. It's totally political, and only marginally productive in my opinion anyway.

Never was the "It's a Trap" Tag More Appropriate

[Anonymous Coward]

Large vendors are behind this. With all the extra security certifications and processes that small businesses (or independent/open source developers) will be required to apply because of "security" open source would be closed out of the market by this.

Please watch this very carefully. Red Hat and free software companies actually large enough to have lawyers, please, please, please sniff out the rats.

Sooo...

[NoobixCube]

The April Fools crap is over now? It's a silly day anyway.

How about one good joke

[fat_mike]

We all know that today is/was April 1st. We all know Slashdot will roll out a whole bunch of crappy jokes. It is getting really old.

Here's a thought...how about one really well thought, well planned, actually funny joke.

If this is not an Aprils Fools joke thats...

[Phizzle]

...trying to get under the wire, then please just fucking shoot me.

Re:If this is not an Aprils Fools joke thats...

[isa-kuruption]

Bang!

Re:If this is not an Aprils Fools joke thats...

[DigiShaman]

Don't be naive. Did you really think the Internet would remain some wild-wild-west fantasy of freedom?

Individual freedom is the antithesis to Political control.

Re:If this is not an Aprils Fools joke thats...

[guyminuslife]

The link is to WaPo. I think they're a bit stodgy to be playing April Fools jokes. And if they did, it would be geared toward a more general audience.

government?

[Anonymous Coward]

christ... what is this world coming to?

Please please please

[boogerme0]

Please let this be an April Fools joke.

Actually they do

[actionbastard]

'Public officials' are responsible for making sure that infrastructure like traffic lights, water systems, sewage systems, and the like, are completely secure and isolated from any 'public' network like the 'Internet'. If the control systems for these critical systems are connected to the 'Internet', every citizen should be outraged at the complete disregard for the security -or lack thereof- for these systems.

Re:Actually they do

[jofny]

1. The people who own those assets are responsible for it, at the end of the day. In many cases, they're private companies which are free to figure out how to run their own businesses as they see fit. In some cases, it's a sort of mixed situation where they're owned by local municipalities with some of the same constraints (and sometimes additional constraints) as privately owned utilities. Finally, some are nationally regulated.

2. It would have been nice to never have connected these utilities to the internet in the first place, but as they are now there extracting them can be extremely difficult.

3. If you think having something as politically hampered, slow moving, and expensive as the US government take control of privately or local government owned utilities, you haven't dealt much with the federal government.

If you think response has been slow and crappy so far? Just imagine the world's largest bureaucracy running national cyber security and trying to keep up with evuhl -insert country of choice- hackers. That's a good solution, really!

The Real Deal, and I can prove it

[Anonymous Coward]

It's not an april fools post. The news article it links to is from 3/31/09.

What a shitty world you Statists are creating

[Anonymous Coward]

What a shitty world you Statists are creating.

Of course, in your Orwellian DoubleThink, Memory Hole, I am sure when this fails you'll just blame it on Bu$Hitler & the Jews.

Re:What a shitty world you Statists are creating

[DigiShaman]

Misery loves company. That's why many Statists will drag the rest of society down to their level. We must all suffer together so we may be bonded together with a closer kinship they say. Ya, right. Uh huh. Sure....

And people wonder how the horrors of Communism rears its ugly head throughout the world.

Re:What a shitty world you Statists are creating

[smoker2]

Yeah, like Britain, Germany, France, the Netherlands, Sweden, Norway, Spain, Italy, Belgium - in fact most civilised countries in the world.

If you want to live in a dog eat dog world go and do it. See how long you last. I don't believe communism is responsible for the recent financial meltdown, throwing people out of work and their homes.
Idiot.
At the rate the world population is growing, you will either get along with others peacefully or you will engage in constant war. No one group or person has any more intrinsic rights than any other, so why pretend they do ? Unless you want everything YOUR own way of course, which marks you out as a selfish asshole, no better than Madoff.

I don't need no education

[actionbastard]

Common sense approaches to system security tell me that if I was in charge of these systems they would be secured by every means possible. There is absolutely no excuse for exposing critical infrastructure to attack by every thirteen year old Romanian hacker on the planet because I was not familiar with the latest means to secure my networks. This is, after all, the 21st Century.

Re:I don't need no education

[jofny]

You obviously do need an education here. Go check out the actual reality of the situation, how about? As I said, read the NIPP. Then HSPD-7 which generated it. Then look at the sector specific plans. Then check out the archives of SCADASEC for some asset-owner perspectives. Maybe you'll come away with a better idea of the grey, in-progress state it's in, the progress that's been (or not) made, and what the financial and operational constraints are. Some of it sucks. Some of it's good. Mostly, it's an evolving, complex situation that is being worked on.

Re:I don't need no education

[Anonymous Coward]

The other thing is, the government is all about security, but there are different levels of security across the whole "Gov" realm of things. The Navy lets their programmers have full admin rights on their boxes, the Army (mostly) doesn't let anyone have admin rights on their boxes and there are still government entities out there that are still running Windows 2000 boxes on their networks - something that was supposed to be flat out banned two or so years ago...

The major problem is, the government hires people they believe deserve the position the most. Notice I said "deserve" - not most fully qualified. I just came from an entity as a contractor were I knew more than a recently hired sysadmin and a security guy put together - and I was a Database Admin. Those guys got those positions because they were prior military - if someone like me applies for the same exact position, they get priority over myself since they were in.

Great system to take care of your own, but when it comes to networks, security, etc - it means you leave your systems wide open. The Databases I ran had run in standard install form for 4 years. When I showed up, I started securing everything and it made life difficult for programmers (I took SA access away, booted them off Production boxes, etc), but they let me do it. The security guy these idiots hired took a newly installed server with no security updates, connected it up to the network and started pulling Windows Updates - when it was brought to the attention of management - "He's just doing his job how he wants..." Needless to say, I no longer work there because I'm not going to be responsible if a box gets rooted.

Oh, and my interview - no technical questions, it was a personality test with "Rate x skill on 1 to 10" questions... The government must look at itself for security before it starts looking at others.

Enforcing compliance...

[gillbates]

If passed, this could have the effect of a de-facto outlawing of Linux. For example, consider the typical business small business owner's plight: he uses Windows mostly on the desktop, but has a few Linux servers handling things like mail and print services.

1. Government inspector pays a visit.
2. Government inspector verifies the desktops have the latest Microsoft patches and antivirus installed.
3. Inspector then moves on to the server room, where Linux is installed. Inspector can't determine that "latest Microsoft patches are installed", so machines are marked as non-compliant.
4. The business owner has 15 days to rectify the "non-compliant" situation. His IT guy tries to explain to the government inspector that Linux is its own operating system; that it doesn't need patches from Microsoft, indeed, that it can't even run said patches...
5. Goverment inspector's response: "You have to install the latest patches from Microsoft. If your software doesn't support the latest patches, you have to upgrade."
6. Small business has no choice but to move their servers to Windows so that Government inspector will sign off on compliance certificate. Score one for Microsoft, scratch one Linux installation.

I understand the government wants to ensure "cyber security" - whatever that means - but they, of all organizations, are the least qualified to implement it. The conflict of interest between big business and government interests is just too great for this to be anything but a tremendous waste of time and money.

And this without even considering the larger question of why the government should have any control over the software private users run on their own computers.

• In the name of cyber-security, you will be required to run government-approved software. Which, if it isn't outright insecure in the first place (I'm looking at you Microsoft!) will provide a convenient avenue for the government to insert its own backdoors for spying on the public at large.
• While were at it, why not use OS hooks to cap the user's bandwidth so they *cannot* download more than the large telecomms think they should.
• Oh, and what a convenient way to stop piracy. Look! this government required security software reports back to the studios when a filesharing client is installed.
• Why bother knocking down the door, when the Virtual Search Warrant (TM - Microsoft) will allow the police to keep us all "safer" by allowing law enforcement to check our computers for illegal content...

Re:Enforcing compliance...

[TrueRecord]

This way Linus will return home to Europe and will be free do whatever he wants with the kernel and he will forget the states like a nightmare.

Re:Enforcing compliance...

[Thanshin]

The only possible path from:

1 Government forces all businesses to use standarized crap software.

is:

2 Standarized crap software is thoroughly raped and even infants can enter any complying business.
3 Businesses remove crap software.

Re:Enforcing compliance...

[rennerik]

I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications, so it would be silly to assume that they wouldn't write legislation in such a way that such OSes would be included.

I imagine something of a "security certification requirements" that the ruling body of each OS would put forth (i.e., each Linux distro would put forward a list, as well as Microsoft for Windows, Apple for OS X, etc). This list would be submitted to the government/whatever authority, and they would use this list in testing whether or not individual IT installations are complicit. The list, if implemented, would also have to assure that the OS's operation would meet the government's "cyber-security requirements".

In other words, I don't imagine the government would completely ignore Linux to give a leg-up on Microsoft. Not only would that fall in the face of the whole anti-trust suit with MS, but also the government would have to shut down its own systems running non-MS operating systems. That approach doesn't appear to make any sense.

Re:Enforcing compliance...

[hyfe]

-1 Nutcase.

Seriously, did you even read the summary? Did the mods? Critical infrastructure will be audited. Small business owners don't run critical infrastructure. Home users aren't running critical infrastructure off their DSL-lines. You could argue using the slippery slope argument, but saying that the government shouldn't inspect critical infrastructure (power grid, telephone system, water supply) because in the future they might restrict home users illegal file-sharing is so disconnected from reality it's utterly scary.

Furthermore, regarding their competence. They're not all idiots. Alot of governmental work is setup in ways that doesn't exactly promote talent, but they're still not raging retards. There are plenty of people that are fully aware that the wast majority of infrastructure doesn't run Windows. Hell, a lot of these systems were created long before DOS existed.

However, you are correct in that there will probably be a couple of silly results.. like a non-networked Win98 pc being audited. This could be a good thing though, because the 'if it works, don't touch it' mentality that often happens in real life quote often isn't a good long-term strategy.

As an aside, as a foreigner (just to ensure I don't get modded up), I'm absolutely flabbergasted that the wast majority of "omfg the government is scary"-americans seem to be republicans. The republicans are the ones who illegally wiretapped you. They're the ones who threw away habeas corpus. They're the ones who allowed torture and imprisoned foreigners for years without any sort of trial or oversight. I just honestly cannot believe they still got 45.66% of the vote. That is just utterly insane. New leader sure, but same party. Are you all daft?

Re:Enforcing compliance...

[Anonymous Coward]

DUMBASS everyone knows that Linus Torovaldis is from RUSSIA!

Re:Enforcing compliance...

[TrueRecord]

FYI, there's Europe in Russia too.
Btw, One of his grandfathers, Ernst von Wendt,lived in Russia in 1917 and even took sides in the Russian civil war at that time.
Nowadays in Russia AFAIR there are no patents for algorithms. So...

Re:Enforcing compliance...

[Anonymous Coward]

Wow...nice straw-man there. Could you possibly squeeze in a bit more FUD?

This type of argument against ANY idea just makes the case for the idea that much stronger.

Re:Enforcing compliance...

[Anonymous Coward]

I don't think the poster is nuts. I've seen them do it.

They come in, scan the network, any given machine is labeled "blessed" or "other". "Blessed" means "Windows at a certain patch level".

The also scan the computers physically (HD scan) and use a similar criteria for continued operation.

I've literally seen government security scanning teams go through a shop with sheets of red and blue stars, sticking them on the front of computers. Red means you can't power it on.

All of the computers may have proper accreditation and approval, with a paper trail, including Linux systems, but they still grade the shop using their own PASS/FAIL report. Meaning the shop looks better in the overall report if it's all patched Windows ("100% PASS") with no odd paperwork or allowances.

It's worth remembering how bills are written in the USA. It's not based on any particular rationale; it's based on lobbyist requests.

All the lobbyists W/R/T compute infrastructure basically work for Microsoft or some network scanning company. They are looking to make a lot of money if their proprietary toolkit becomes mandatory at all government or infrastructure sites.

And it's not "Democrat" or "Republican". When it comes to pork or political favors for some powerful or wealthy constituency, the party affiliation of any given politician is about as meaningful as the color of a whore's shoes.

Re:Enforcing compliance...

[freedom_india]

Wasn't TCP/IP suite made JUST for handling the Ultimate War?
I mean after all the greatest (and probably the only) strength of IP is automatic re-routing in case of disruptions.
So, an attack against even 80% of our TCP/IP-based internet would still result in the rest of 20% routers taking the traffic and still deliver...
This is a clear case of Government spying on us.
And i thought Obama was a nice man...

Re:Enforcing compliance...

[Anonymous Coward]

The government does run Linux of a certain red headgear type. I assume this is because they actually have the funds to get certified at various security levels.

Posting AC for obvious reasons.

Re:Enforcing compliance...

[ion.simon.c]

I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications...

Absolutely (and not just in "certain applications"). Ask google about something called "Trusted Solaris". There's a DoD org that's responsible for producing "blessed" versions of all major (and many minor) OS and software packages called the DODIIS. (Yes, you pronounce it "dodus".)

Re:Enforcing compliance...

[ion.simon.c]

Which, if it isn't outright insecure in the first place (I'm looking at you Microsoft!) will provide a convenient avenue for the government to insert its own backdoors for spying on the public at large.

Be aware that any backdoors that are inserted by friendly forces can be used by the enem(y|ies) to compromise said weakened systems. If you know *anything* about security (or have been on /. sometime in the past five years) you already know that "security through obscurity" is no security at all. Despite what conventional wisdom tells you, the ignorant CEOs and CTOs of the government world are (almost always) advised by some very bright, clueful folks.

Re:Enforcing compliance...

[jefu]

Indeed. My university has a deal with another university that allows us to use their classrooms on the other university's campus. That campus has wireless and it is protected by requiring the systems that connect to it to run a specific piece of software - which is supposed to ensure that your machine is virus free and all (yah,right). That software runs only on Windows (and recently on Macs), thus they have effectively precluded the use of Linux on their campus network. All, of course, in the name of "security".

Re:Enforcing compliance...

[Anonymous Coward]

I was hoping someone would bring this up. The NSA and DoD are actually a LOT more competent than /. would like to give them credit for. I personally ran a number of Trusted Solaris/Hardened RedHat/BSD/etc. systems that were fully approved to run on highly sensitive systems. Open source is not the devil to the government, it just is harder for them to evaluate (as patches and udpates can be coming in at a higher rate / from more sources than they can necessarily keep up with). A specific version/patchset can almost always be run through the approval process.

Re:Enforcing compliance...

[Anonymous Coward]

And how about embedded systems. Every CPU has an operating system, even if it is as simple as a PIC running a big ass REPL.

Re:Enforcing compliance...

[gruhnj]

3. Inspector then moves on to the server room, where Linux is installed. Inspector can't determine that "latest Microsoft patches are installed", so machines are marked as non-compliant.

The FederalGgovernment uses Linux as well and there are published security standards for it. The NSA and DISA both publish security guides and implementation guidelines for Linux. NSA Secure Configuration Guides DISA STIGS . This will require training for your typical enforcement droid but is not out of reach. To say that regulation would require Microsoft only is ignoring the fact that *nix is very much in use in the Federal Government

Re:Enforcing compliance...

[CompMD]

A real American should have the following step between 3 and 4, possibly negating the rest:

3.5) Lock inspector in server room, turn off lights, announce over intercom into server room you are going to turn on the halon to demonstrate he is non-compliant with your halon-survival procedures.

Re:Enforcing compliance...

[jonaskoelker]

I'm pretty sure the government and military also runs Linux/BSD/Unix in certain applications, so it would be silly to assume that they wouldn't write legislation in such a way that such OSes would be included.

By saying it would be silly to assume [...], you assume competence...

Re:Enforcing compliance...

[qralston]

If passed, this could have the effect of a de-facto outlawing of Linux.

Not a chance. Believe it or not, the NSA and the DoD actually know what Linux is. And a lot of their advice for securing Unix and Linux systems is actually quite good.

And this without even considering the larger question of why the government should have any control over the software private users run on their own computers.

They shouldn't.

But they don't need to have that control. All they have to do is say that any system that is owned by the federal government or interoperates with federal government systems has to comply with the security guidelines. They'll get the states to fall in line via the usual mechanism: by withholding federal funding until they agree to implement the federal guidelines at the state level.

And if you're thinking, "Well, that only affects people who are the government, contract with the government, or work with the government," ponder that thanks to Bush and Obama, that combined class of people will shortly be the majority.

Re:Enforcing compliance...

[Tim MacDonald]

And suddenly specialized operating systems and wireless systems will start sprouting up shortly after they announce the patches for the network kill switch. And remember, you won't have any ISP service either, because they'll be shut down too. I propose a giant mesh network that exists expressly through the 802.11x standard (or maybe something better) and bluetooth networks, with all traffic encrypted. Suddenly this mesh version of Internet2 will become instantly popular, and then the government is considered largely useless and will be subsequently overthrown. BTW, isn't it true that most internet traffic runs through the US? Wouldn't this cybersecurity czar be able to shut down the entire 'net at the push of a button? I'm not too sure how my government would respond to that (probably with open arms, while we have that idiot as Minister Prime).

Please stop saying "cyber"

[Anonymous Coward]

No no no, please stop it. Cyber must go.

Re:Never was the "It's a Trap" Tag More Appropriat

[shentino]

What about SELinux?

Isn't it NSA sponsored?

I'm not comfortable with this

[diewlasing]

Haven't we already been under attack for a while? Granted, I'm no expert in this field but haven't foreign nations been attacking the US for a while? Wasn't there a story a couple of days ago about GhostNet?

I heard a lot of tin foil hat people talking about an "i-Patriot Act" but I thought it was a lot of nonsense. When the government tries things like this and says they will work in a way as to try and not infringe on privacy, how many actually believe them.

The biggest concern I have would be the power to shut off networks. If there is a widespread attack that will hurt the most vulnerable, wouldn't shutting the system off hurt even more? For example, if the nations hospital networks were under attack, would we really want to shut those off? Or even traffic lights, does that sound like a good idea to anyone?

Maybe someone here with more knowledge about cybersecurity can correct or alleviate my concerns.

Re:Never was the "It's a Trap" Tag More Appropriat

[ElectricTurtle]

Mod parent up.

Capability based security

[ka9dgx]

Until we get operating systems that can run code without having to trust it, we're going to keep getting the same crap, over and over.

Linux isn't the answer. Hell, even SElinux isn't the answer.

Start reading up on Eros, Keykos and Capros to see about systems that might actually solve the security issues once and for all.

Re:Capability based security

[jhantin]

+1. Problem is, current CPUs themselves are buggy and exploitable, so you still need a verifier, and if you need that you may as well have a VM and a JIT. Unfortunately the major VMs that have the building blocks to be capability-secure -- such as CLR and JVM -- threw it all away with their standard library designs.

There's also a hidden side of capability security: preventing data, or more generally causality, from leaking in or out of a given piece of code. If there's an API exposed to untrusted code that allows it to detect its environment -- even so simple as the default object hash code or a way to get the current time -- you have a covert channel waiting to bite you.

Re:Capability based security

[ka9dgx]

Yes, covert channels will always be an issue, as with physical security... but I think we can agree that specifying the capabilities to be given to a piece of code is a much saner way to do things than to be forced to trust your code.

Speciation Of The Internet

[broward]

"a government gone feral"

I argue that it's an inevitable outcome of ecological diversification of information and the Internet. It's not just occurring in the United States. The internet is "speciating", evolving differentiation in order to limit infectious memes.

http://www.realmeme.com/roller/page/realmeme?entry=global_differentiation

Is our government nuts?
Well, yes.
But that's a separate issue.

I haven't read the article yet, but...

[Antony-Kyre]

I sure hope there is some mention of a court order before shutting down anything, whether public or private. Even if it is in such a way where they do it first, then get the court order within like 72 hours.

Re:I haven't read the article yet, but...

[freedom_india]

Court order???
What are you? A moron?
This is the new American man!
Where we free Senators who have been convicted of corruption, and refuse to prosecute presidents who broke laws.
But damn it, we send kids to jail for 25 years for taking photos of themselves or stealing an apple...
The French should demand that USA return back the Statue of Liberty: after all when a cop could shoot you down like a dog and not face jail for the crime, this country does not have liberty...

Software Mono-Culture

[scorp1us]

Because the one thing we've learned from having software mono-culture is that its a Good Thing(tm).

Now we're attempting to fix the problem by having federally mandated mono-culture? Please!

And as someone who has worked for companies that have developed government specs, I can assure you that the process will be corrupted as to bias towards certain vendors. Any required feature that can be patented will be, and any open-source implementation will be sued out of existence.

Still haven't found a +5 funny yet.

[captnbmoore]

but it is still early.

No, it is Liberal Facsism

[Anonymous Coward]

You can even read the book or the blog

Re:No, it is Liberal Facsism

[jgtg32a]

I don't overly pay attention, but since that book came out it seems like leftists don't call right-wingers Nazi's as much.

Has anyone else noticed this?

I think lobbying is afoot!

[TheLeopardsAreComing]

1.) Instead of a Czar, I like "Commissioner Of The Internets" 2.)Issues like this make me question where these senators get their information. They obviously do not know the current technology well enough to create laws involving it... maybe we should focus more on the lobbyist groups that funded their campaigns and figure out who benefits the most from this!

Re:I think lobbying is afoot!

[spauldo]

How about "Commissioner Gordon of the Internets"? Then vigilante justice on those spammer assholes would be only a phone call away. The Batcomputer could probably use an upgrade.

'Course, while fighting LOLCATwoman might be worthwhile, Batman's distrust of the Penguin might make him a bit biased...

It creates a czar, so I'm against it

[carlzum]

Anything involving a new "czar" invariably fails to achieve its objectives and shows disregard for our rights. Joe Biden is credited with coining the term "Drug Czar" and was a vocal proponent of making it a cabinet level appointment. Ironically, the current administration has downgraded the post to a non-cabinet level position. I hate the term and wish it would go away, it sounds anti-democratic and seems to act accordingly.

Re:It creates a czar, so I'm against it

[TrueRecord]

it sounds anti-democratic

What if it sounded pro-democratic? Would be better?
Imo, It does not matter how it sounds. It IS anti-democratic.
I mean that's against people.

And then

[Amazing Quantum Man]

the terrorists build a CIP device, and then storm the White House, and then they get bioweapons in DC.

Federalize my ass

[Anonymous Coward]

Government has no place dictating these things.

april fools

[circletimessquare]

as in, the legislators, not the day

Just to make you shut up

[DreamerFi]

[The bill] would require the National Institute of Standards and Technology to establish "measurable and auditable cybersecurity standards" that would apply to private companies as well as the government. It also would require licensing and certification of cybersecurity professionals. "

And any of us who went public with information on illegal/un-ethical wiretapping or gross incompetence would lose their license.

That'll shut up those pesky security professional/privacy advocates.

What about voting machines?

[Anonymous Coward]

That might be a good place to start.

Obvious solution

[Anonymous Coward]

Geeze, do these government guys never learn? Don't worry guys John McClane and Sam Fischer are on the case. Relax and go back to doing... whatever it is you do.

FUCK THAT.....!

[IHC Navistar]

Federalizing cybersecurity?

FUCK THAT!

Big Brother already has a hell of a time keeping the US's *physical* borders secure, with all of the politically-correct bullshit that is allowing drug smugglers, human traffickers, illegal aliens, and other less-desirable what-not to cross the border illegally at will.

If you want an idea on how it will go, take all the political-correctness and bureaucratic hurdles that have prevented effective enforcement of physical borders. Then, substitue *your* computer for the concept of a national border.

Scary thought, huh?

Effective laws?

[mo'o ahi]

While I applaud the Senators' efforts to assist in securing cyberspace, historical efforts to legislate cyber-security have not proven effective. (that was tough to say with a straight face) To wit, examine the Government's own record: Currently all federal agencies are required to follow strict guidelines/policy, yet the average info-security grade given by OMB, for FY2007 was a C-. How far would you get in life if your average grade was a C-? I'd guess the average Slashdotter had better than a 1.7 average.

Further, they seem to think that if NIST establishes "measurable and auditable cybersecurity standards", then all will be right with the world. NEWSFLASH - The Fed already has that for the entire GOV, and while many agencies have improved it has not shown to be the panacea they intended. According to OMB's report out 3 weeks ago(go to page 9), the DOD, the agency with the most important security concerns and highest risk (and consequently the most stringent InfoSecurity program) is failing miserably.

Funny, if you read the FISMA top page, it refers to 'cost-effective' security programs, but nowhere does it mention effective programs...

New legislation is not the answer - holding people accountable is. [to keep this relatively short I'm not going to expand on this - you know how to find the laws]

As one previous poster noted, a bunch of us posting here is not going to change anything. So, I will end this with a call to action for all Slashdotters - write a letter to your Senator and Congressman and let them know (using clear, thoughtful words) that this is an f'ing stupid idea and that they should not support it.

Find your congressman

Find your senator

I'd just like to point out...

[magamiako1]

Most of what everyone is going on is speculation. We don't have the bills to read so we don't know. It could simply be limited to private companies that provide electricity and power for all we know, or any public infrastructure-based system.

Just calm down, wait until the bills are even introduced, read it, pick it apart, contact your Senator and express your dismay over the project.

Re:I'd just like to point out...

[shentino]

I doubt special interest groups would let it rest.

Besides, we at /. know that Microsuck can't make a decent secure product. Why should using them even be an option? Let alone mandated by a team of techies that were probably cherry picked by MS friendlies in the first place?

just as i suspected

[YouDoNotWantToKnow]

communists, terrorists and now hackers, what is next, aliens?

COmpare and Contrast

[senorpoco]

Both China and Russia have enormous 'cyber-armies', for want of a better word. Funded, organized and made up of proud nationalistic young people. America has hacker culture, mocked, criminalized and alienated. Who do you think is better prepared? America has the manpower and the ingenuity it just needs to bring hackers and IT culture in general in from the cold, make it something to aspire not just to get beaten up in highschool over.

Arms

[Anonymous Coward]

If this makes it to the house and senate its time to take arms against our government.

This soulds like a disaster waiting to happen.

[Jane Q. Public]

And what is this stuff about "water"?

Sorry, but the States own the waterways.

My worry

[jandersen]

My chief worry is actually not so much about "increased powers" - I suspect they can already do most of this in one way or another. But centralising things means that an attacker only needs to find one weakness, so to speak, and then they would be able to wreak havoc on a grand scale.

If it has to be secure, keep it off the internet!

[Anonymous Coward]

From the Summary: "People say this is a military or intelligence concern, but it's a lot more than that," says Rockefeller, a former intelligence committee chairman. "It suddenly gets into the realm of traffic lights and rail networks and water and electricity."

TRAFFIC LIGHTS, RAIL NETWORKS, AND OTHER LIFE THREATENING DEVICES SHOULD NOT BE ON THE INTERNET!!! Why not make a seperate network (IPv6?) that is regulated and encrypted up the wazoo with no privacy and criminal penalties for doing rude stuff, like spamming?

Re:Last one out....bad episode of twilight zone

[Anonymous Coward]

As I see big brother re-run of the twilight zone using my streamed video feed
from the government server farm, I'm asked for my DRM CLIP TV chip passcode....to watch!
They've already censored most of it with web filters and such. What next.. either
I turn the IP channel or disconnect from it.

Cost-performance

[Mathinker]

> I don't need no education

I like Pink Floyd's music as much as the next man, but quoting them, out of context, in a forum which is supposed to be for informed debate won't get you brownie points, at least with me. The opposite, in fact.

> Common sense approaches to system security tell me that if I was in charge of
> these systems they would be secured by every means possible.

OMG, I'm glad that you aren't in charge of things. Do you have any idea how much it would cost to secure them "by every means possible"? That would include large vaults and armed guards, eh? Like with everything else, you have to evaluate advantages and disadvantages and make a decision. Not fly off the handle like you're doing. This doesn't mean I disagree that connecting the systems to the Internet might be a bad idea. Assuming the systems do need communications, you'll still need to connect them to some other network, and you'd have to secure that network instead. BTW, if you want that network to be hermetically isolated from attack, you'd probably have to build it from scratch, at an enormous cost.

Frankly, I'd guess that using specially certified VPNs running between specialized embedded endpoints which run off of non-writable memories might be secure enough, even if it used the Internet as a communications medium.

Re:Never was the "It's a Trap" Tag More Appropriat

[SirGarlon]

NSA started SELinux but stopped development several years ago. Or at least, stopped sharing what they developed. ;-)

OT sig comment

[drinkypoo]

Your sig is dumb. You can buy 1U dual opteron systems for like $150. I have one I'll sell you for that price, in fact. It's an IBM with IPMI and 2GB, expandable to 12GB.

Re:OT sig comment

[rackserverdeals]

But are the parts new and under warranty?

but will this *improve* anything?

[Anonymous Coward]

too often the us gov. steps in to fix something and the problem gets worse because it just becomes mired in beaurocracy. the conaumer majority needs to grok security first. that hasnt happened yet because people dont want the resposibility. apologies for the apostrophies my delve does not have a key for one.

You do realize

[wiredog]

That the phone system is a network? That traffic lights are often networked, and have to be remotely accessible? Etc. etc. etc.

There's more to networking than "the internet".

China also has the max of the death penalty for ha

[Joe The Dragon]

China also has the max of the death penalty for hacking. Russia does not care about hackers going after the us and taking our money Likely a kick back kind of thing in Russia.

YOU Voted for them

[Anonymous Coward]

The wackos on the right warned you about Obama's agenda of bigger government. Get used to it. This is what you voted for.

All you folks in Europe did your part too. Thanks.

Smaller government helps to prevents this and so does limiting the taxes collected.

Uninformed people, afraid of "something" whether it is child molesters, medical research, climate change, genetic research, or computers will always ask the government to "protect them" rather than becoming informed. It is up to all of us to become informed and tell the current leaders what we want. We are a republic, not a democracy by design.

Re:YOU Voted for them

[Ashriel]

I just wanted someone to undo all that had been done in the last eight years. It seems I'll not even get that.

So tell me, which of the two allowed parties do I vote for for a smaller, less centralized government that makes civil liberties paramount?

conficker anyone?

[hesaigo999ca]

Right after the conficker worm hits everybody hard, we finally get someone with brains doling out a new regulation that makes companies responsible for their work environment, even on the PC.
Awesome, I hope they come out with proper fines and hierarchy of payment levels.

Now if they could do this with recycling, it would be really great.

Re:conficker anyone?

[Anonymous Coward]

This shows how ignorant you are about network security and patch management. There are several 0-day vulnerabilities that exist in many Operating Systems. It has been no secret that Companies like Microsoft will leave those vulnerabilities unpatched for a long time until their hand is forced by either bad publicity or a worm/virus is written to take advantage of it.

Take the conficker worm for example. Considering that this nasty thing takes advantage of a vulnerability in the RPC service to run code since the Windows 2000 OS, it means that we have been vulnerable for 8 years to this thing! How in the world can you say that a company should be liable for this type of problem? They can't modify the code for Windows! It's proprietary and illegal to attempt it since the code is IP. Furthermore you really need the source code and there is not a chance in heck that MS is releasing source code!

Additionally if we have several "Professional" coders, security experts, and experienced people having trouble with things like this, what makes you think a dude in a suit who's primary skill is "Congressional Lying" can do a better job or offer a better system? Face it! Technology moves too fast for congress!

Now if they did implement a giant DoS kill switch via government control, I can see it now. Companies maliciously writing code to have a competitor shut down! With all the trouble already out there it would be easy to constantly subject a company to the threat of a government shutdown! Just wait until the only time that script kiddes have on their hands is to play hacker all day! The government will be playing musical network killing!

We can't even properly handle spam yet! Lets solve that before we start going China on the internet!

Foreign invasion

[Ancalimar]

As much as I agree with the fears of significant government intrusion, I also have to say that national cyberdefense is every bit as important, and rapidly more so, than national military defense. Without a unified strategy of national defense, we've left ourselves extraordinarily vulnerable to attack. And although we have some cyber 'militias' in the country, we have no such dedicated, professional group. Imagine getting paid well and fairly by the government to develop and promote secure systems!

Thoughts

[Stormcrow309]

Had a discussion with one of my security guys and he had a very insightful point. Security is the best when there is a disparate security apparatus, where I might use X, Y, and Z vendors for my security solution and my competitor uses A, B, and C. This creates complexity for malicious hackers due to complexity created by this disparity. By mandating standards, the Government creates a target that security vendors have to reach and have no incentive to go beyond that standard. This might create an unintended consequence that net security value goes down due to similar approaches.

My current research is centered on the reimbursement systems of the Centers for Medicare and Medicaid Services (CMS). I have noticed that CMS and Congress are good at making decisions that focus on some hot button issue, without considering the fallout of those decisions. For example, the Prospective Payment System (PPS) of Medicare and Medicaid has lowered health quality due to changes in incentive. Conversely, the proposed fixes to PPS, Pay for Performance (P4P) and non-payments of Hospital Acquired Conditions (HACs) are regressive in nature, targeting the urban and rural poor disproportionally.

The fact of these unintended consequences that the government creates gives me a nice, warm feeling on the future of cyber security.

It's what we need

[whitroth]

Obviously, the "enlightened self-interest" of companies doesn't work, given the constant reports of breakins.

And for those who don't realize (like Jane Q. Public), utilities like the electric grid, and municipal water and gas supplies, are computer controlled (no! duh!), and in some cases, Dilbert managers have had the controls made accessible via the 'Net, rather than an air gap between their control systems and the 'Net.

A year or two ago, over in the UK, there was a train accident - don't remember if it was a derailment, or a passenger train running into a freight train - because some idiot teenage cracker had gotten into the rail line's control system and screwed with the actual switches on the tracks.

So, yeah, it *is* what we need.

                mark

Re:It's what we need

[Anonymous Coward]

So get rid of idiot managers, and create the needed "air gap"?

No, my bad. You're right. Lets just bend over, and let our politicians and bankers sodomize us.

Re:It's what we need

[Python]

So, yeah, it *is* what we need.

"It" is the problem. The federal government is not qualified to set the standards or manage them. For example, look at FISMA - an unmitigated FAILURE in security. Its an excercise in building paper forts around computers and networks - and this is the BEST the federal government can do.

The federal government can not provide IT, the problem is one of design. Systems are not designed for the threats they face, and the federal government is worse than ill-equiped to lead that effort - its not only part of the problem, it fans the flames of the problem by forcing agencies to buy products not based on their technical merits but on bulk purchasing agreements, non-bid contracts, "certification programs" (look the EAL nonsense) and other nonsense. If you want security and IT to get worse, put the federal government in a position to rule over these things in private sector.

Re:It's what we need

[BeanThere]

The benefits don't outweigh the negatives, and the potential for abuse is too high. You seem to think a system needs to work 100% or it's not working. Nonsense, we can certainly tolerate the odd incident here and there, like we do with everything else in life. The idea of Windows computers controlling things like the electricity grid and nuclear power stations sounds scary to me too, but if it was really such a problem as to warrant this kind of intervention, there would be incidents all the time. Things are working fine, stop being scared.

Just use a secure OS

[mizzouxc]

I'd recommend the world go away from the 10 million zombie Microsoft and move to a more secure, stable OS such as Linux. As more people use Linux, sure, security issues will arise but they'll also be more easily fixed.

***computer store scenario***
Me: I'd like to buy an OS
Clerk: What do you plan to use it for.
Me: I'd like to spread the confiker worm
Clerk: Here's the latest version of Windows Ultimate, it'll do just fine. That'll be $399+tax please.

I would, but....

[Anonymous Coward]

then please just fucking shoot me.

I would, but there's no freaking ammo left on the shelves of all the gunshops and sporting goods stores around here. Everybody is hoarding ammo in preparation of the SHTF and waiting for the big reset button to get pushed, which looks to be getting closer ever day.

Worse yet...

[wireloose]

We can't trust the private sector to spend money to actively protect these same systems, and they are key to our survival. There have already been hundreds of successful attacks on these systems throughout the nation. Each utility does their own thing, which means differing levels of protection, if any, across like utilities within the same state or region.

Controlling potable water is critical. There needs to be similar security on flood control systems. The Army Corps of Engineers, Civil Works side of the house, manages flood control throughout the country with specialized data centers. It's already tough enough to do that job well with Mother Nature throwing constant change-ups. Can you imagine what might happen if someone took over those systems and created disasters?

Water and energy sources can't be taken too lightly. If someone malicious shuts down power, you lose critical services, such as heating, cooking, and the ability to read Slashd

Re:Worse yet...

[fferret]

I take your point, but frankly, anyone who connects command & control system to an external network, let alone The Internet is just asking for trouble. I can see remote access out-of-band, using dialback and caller ID screening. Also, we cannot let ourselves get stampeded into more regulation by fearmongering like this. Folks who take the time to think about it will realize that this rapidly becomes a game of diminishing returns. If you think the budget deficit's big now, just wait until we add a new agency, and regulations for them to enforce. I might add that we are going to trust the Fed to get it right, and these are the people who could not get systems implemented for the IRS, the FAA, etc. Need I go on? Ah, but I hear you say, they can hire some of the best and brightest consultants in the business! Sure, but they've done that before as well. How's that new FBI case management system working out for ya, Sparky?

Re:Worse yet...

[Langalf]

Excuse me, but I work for an electrical utility, and you have no idea what you are talking about.

Where are the citations for the "hundreds of successful attacks"?

Are you at all familiar with the NERC Critical Infrastructure Protection Standards adopted by FERC as federal law for electrical utilities? Utilities are hardly allowed to "do their own thing" in this regard.

Re:Worse yet...

[Ashriel]

I take your point, but frankly, anyone who connects command & control system to an external network, let alone The Internet is just asking for trouble.

Bingo.

I can see the need for greater security regarding banks and, well, anyone who asks for your credit card number online, but infrastructure shouldn't even be targetable to begin with. Why do flood control systems need to be connected to the internet? Power generators? I call shenanigans (not on this article, which is real, but on the government). They're talking about infrastructure now, but it's just to get us acclimated to the government messing around with private networks in general.

I knew a cybersecurity czar was coming - it was a point on the president's platform - but I thought it would be security for the government, not interference in private affairs.

What this will do is create expensive, nonsensical regulations that smaller private companies have a difficult time complying with. To me, it seems like the first step in forcing the small-time business offline.

Re:Worse yet...

[Anonymous Coward]

Maybe he overstated, but I was certainly able to find references to a bunch of appropriate information. I'm not gonna spend my time looking up hundreds for you, though.

Kevin Poulsen, Slammer worm crashed Ohio nuke plant network,
http://www.securityfocus.com/news/6767

http://www.washingtonpost.com/wp-dyn/content/article/2008/01/18/AR2008011803277.html

http://www.mitre.org/work/tech_papers/tech_papers_08/08_1145/08_1145.pdf

http://www.nrc.gov/reading-rm/doc-collections/news/2003/03-108.html

http://www.cyberdefenseagency.com/news-20060531.php

http://www.gao.gov/new.items/d08526.pdf

http://www.tswg.gov/subgroups/ps/infrastructure-protection/documents/The_Myths_and_Facts_behind_Cyber_Security_Risks.pdf

http://csrc.nist.gov/groups/SMA/fisma/ics/documents/Maroochy-Water-Services-Case-Study_briefing.pdf

And then there is this report that FERC provided the Hill, based on audit findings of widespread noncompliance with recmmendations on security:
http://www.coalpowermag.com/ops_and_maintenance/Hill-Backing-New-FERC-Powers-on-Grid-Cyber-Attacks_151.html

And from SANS: "Based on a careful statistical analysis of validated control system
incidents at 22 major corporations, the answer is that the need to
secure SCADA and Control Systems is no myth. In fact, the incidents are
far more widespread than commonly believed, the targets more wide
ranging and attackers are not who we think they are. Even more ominous,
the data shows that getting into most control systems is surprisingly
easy. The good news is data also shows that there are effective
solutions for SCADA systems security. The webcast will close with a
discussion of these practical and cost effective measures, particularly
with respect to policy creation and management for new industry
regulations like NERC CIP -002-009."

"Sherstobitoff said the U.S. is being hardest hit, with government and public utility sites particularly popular." - Panda Software, April 2008

Security Operation Modes for Enhancement of Utility Computer Network Cyber-Security

Lin Wang; Mander, T.; Cheung, H.; Nabhani, F.; Cheung, R.

Power Engineering Society General Meeting, 2007. IEEE

Volume , Issue , 24-28 June 2007 Page(s):1 - 8

Digital Object Identifier 10.1109/PES.2007.386185

Summary:Concerns for utility computer networks' security and reliability are growing rapidly due to increasing utility devices with connections to external networks. This aggravates vulnerability of utility networks to cyber-attacks through external connections. Though encryption can provide security for user data transmissions, encryption itself could not provide protections against traffic

Re:Worse yet...

[Langalf]

Ok, so you cite two attacks from four years before the NERC CIP standards were adopted, one about foreign electric plants (not part of the US system), two about a problem at an Australian water plant, an opinion piece, a few reports emphasizing the need for cybersecurity, and a piece about the upcoming legislation.

I repeat, where is the evidence of hundreds of successful attacks on US electrical utility systems? I am not trying to minimize the problem, but measures are being taken to deter this threat. Implying that the industry and government are not addressing the threat is alarmist and misleading.

Re:Worse yet...

[wireloose]

Sorry, haven't been on lately. I don't know about the other submitter, but this is current information: http://online.wsj.com/article/SB123914805204099085.html And watch for more. (If the information is let out into the public.) Note the article specifically states that the majority of these penetrations were NOT discovered by the company managing the infrastructure, but rather by intelligence services. In other words, the utility provider employees like you are perhaps unaware. If you want evidence, you'll have to find some on your own. My only point is that there have been a lot of breakins, and the utility companies aren't all the same in implementing standards like NERC in consistent fashions. Everyone interprets regulatory standards a little differently, hence variations in methods/technologies for addressing the standards.

Obviously it's a shadowy world and the public at large isn't going to get to see all the information gathered: "Authorities investigating the intrusions have found software tools left behind that could be used to destroy infrastructure components, the senior intelligence official said. He added, "If we go to war with them, they will try to turn them on."

I think this article is evidence that I do know what I'm talking about, regardless of your insulting response. You don't know anything about me or what I do or have done, but you were quick to judge. Now I ask, what do you really know about what's going on in your own industry if you aren't aware of these kinds of things?

I accept your apology. 'nuff said.

Re:Worse yet...

[Langalf]

Ah, heck with it. I am not going to get into a p***ing match with someone I do not know and does not know me, where neither of us has a clue as to the others' qualifications to pontificate on anything.

I too have read the article you cite, and it is long on "OMG, the apocalypse is coming" and devoid of any factual content. Yeah, right, this is so secret that the government cannot even tell the affected industries what to fix. BS.

I do apologize for my knee-jerk snotty response. I get so tired of people reading all the scare stories (especially our legigators) and responding with over-the-top controls of industries they don't even understand.

The only thing I sort-of agree with...

[Anonymous Coward]

...and only in a marginal way, is the licensing and certification of cybersecurity professionals... but not to be required for private business systems, only to be applied to government systems. All engineers, admins, and programmers who build, implement and work on government systems should be required to be certified and licensed, in order to weed out some of the incompetence in government cybersecurity, and private compter systems and networks should be left the fuck alone by the government.

Slippy Slope to Stalin or SkyNet

[manlygeek]

The government can't find its own navel with a mirror, 500,000 pages of regulation, a constellation of GPS satelites, Echelon, and an Army Divison. What makes anyone think they can handle the cybersecurity for themselves much less every little mom and pop organization. Oh yes, they are only talking about critical privately held assets now, but this is a slippery slope to grab control of every computer on the planet. I have "free" anti-virus software installed on all my systems at home because I take classes at a local community college and of course they don't want a virus getting into the network from my house. So far it's voluntary. But sooner or later even individual personal computers will be spotlighted as the hole in the dike that still needs plugging. And when that happens, we'll all have mandatory hardware based security built in and controllable by the Government. After that, when NIST is telling us what a "virus" is, sooner or later, any "unproductive" or "harmful" speech that doesn't serve the common good will be the virus that needs squashed. At that point its just a matter of time before Stalin shuts me down for such speech, or they create a master AI program (SkyNet) who decides that the only leak still needing plugged is the pesky Carbon Based Life forms that pollute the planet and introduce viruses into the otherwise virtual perfection that the Internet has become.

Are we helpless?

[Anonymous Coward]

Why not go ahead and take the time to put together a well thought out and formulated letter to your respective senator, and outline your concerns with these bills?

Why not inform them that if they support bills like this, they are not only acting against the best interest of their state, but of the entire country?

Finally, why not inform them that if they act against their people's best interest, i.e. treasonous-ly, that they will no longer be welcome in the state that they are "representing"?

What happened to the good old days, when a politician screwed over the people he worked for, and they slathered hot tar all over his body, and dumped feathers on him???

Surely I'm not the only one who saw this coming, when Rockefeller got up and started whining about the internet being the #1 national security threat? How long are we going to sit around and let the people we selected to represent us get cowed into selling off the few illusory rights we have left for the benefit of some Wallstreet bigots?

Am I way off on all of this? Is this a lost cause? Or do people really believe this is in our best interest???

Maybe this really wont stop until we are actually living a real life Orwellian nightmare?

Jay Rockefeller?

[cagrin]

Rockefeller wouldn't be interested in locking down the internet, to suppress information about the activities and history of his banking family would he? video series: Money as Debt

I hope you don't mind..

[GargamelSpaceman]

I hope you don't mind me pasting that post into a letter I'm sending Olympia Snowe as one of her constituents.

Good Idea - Bad Idea

[someSnarkyBastard]

Good Idea - Securing various parts of our nation's infrastructure against cyber-attack. Bad Idea - Leaving the job to politicians or one of their appointees. Who knows, maybe we will luck out and someone competent will take the post. I'm not holding my breath though. Besides, how would a single government office be able to effectively coordinate security efforts across several disparate industries and networks? The best I would hope for the government to do is write up a set of standard security procedures that any company could and should follow (e.g. strong passwords, patch your systems, lock down users, don't run as root, etc.) and push for greater end-user education to help prevent social-engineering and phishing attacks (don't open email attachments, don't install crap from the web, don't give anyone your personal info, don't automatically click yes to everything, etc).

Standards - blech

[wytcld]

In finance, companies routinely send questionnaires to each other to ascertain whether security standards are being enforced. The problem is, the questions are often disconnected from the actual tasks and practices - one-size-fits all queries. Since the questions are generally more-than-half bullshit, you can imagine how the answers come out. The buzzword compliance ratio runs high. Measures that promote or enforce actual security - not so much.

Having more law from the government for this will accomplish one thing: greater standardization of these questionnaires. This will contribute to an illusion of security, and give companies greater CYA capability, based on their show of compliance with the legislated standard. Greater CYA capability leads to lowered concern with actually being secure, since meeting the standard becomes prioritized over actual results.

Ah, but the certification industry will prosper, as each firm shells out thousands for workshops so they can get someone on staff into full buzzword compliance.

Mod parent up

[Mr. Firewall]

The reason s/he posted as anonymous coward is obvious: s/he has karma to protect.

Now please do the right thing and make an exception to the usual rules about not modding ACs.

Re:China also has the max of the death penalty for

[Anonymous Coward]

So how are Chinese hacking groups like "Honker Union" and the "Red Hacker Alliance" allowed to operate?

I just got an xbox 360 a few days ago...

[gd23ka]

... and its security is impressive. It's a trusted computing platform and I
would think also a field test. The system has been hacked once or twice,
exploiting a weakness in the system call interface of the hypervisor and
through game exploits, however Microsoft is not seeing by far the kind of
hacking and repurposing of their hardware that Sony has. (Spoofing the DVD
copy protection is not hacking the box, running your own code on it is).

Now with this kind of legislation all kinds of ahem 'Change' can be mandated
through private enterprise right onto your desktop. Your ISP could at some
point be made to only accept trusted computing platform devices on their
network. Those tcp systems would when connecting also be required to handshake
with an authentication system to show they are in fact tcp devices. And
since they are tcp devices you will not be in control of your machine anymore.
You will not be able to run any code that has not been approved and signed.
Also with your data you will be at the mercy of whatever policy whatever future
authority might set for it. The RIAA wants to nondiscriminately remove all
mp3 files from your system? The next time your box downloads a mandatory update
those files will be gone and no way you're getting them back on an encrypted
hard drive (nooo.. YOU don't have that key, the trusted platform module has it
and it isn't giving it to you, just to your tcp aware hard drive).

In the end they will be able in complete control over your system, they will
be able to mandate what you do with your data, what apps you run, how often
and for how much (pay per use schemes). They will also be able to run what
they want on your box without you ever knowing. (Also think about that most
computers nowadays come with built in cameras and mikes hint hint).

Sounds like a neat piece of legislation, given what you can do with it in the end.

They are ReThuglican Jews

[Anonymous Coward]

They are ReThuglican Jews

Hello IPv6

[dave562]

If there were ever a driver for IPv6 implementation, this is it. Big Brother is looming large on this one. Of course it's for our security. In the end, we will have IPv6 addresses on the power meters so that the government can punish people who use too much power (in the guise of saving the environment of course). The traffic cameras will have addresses (in the guise of finding lost children of course). Every citizen will be given their own address at birth. Good bye SSN, hello 01:32:fd:...., That number will jump from device to device with them. ("You want phone service? Sure, just give me your IPv6 identifer.") I can't wait until they integrate the phone system with a DNS like system. That will make it super easy to protect us from problems, because they can instantly find us at any time. Just think of all the wonderful possibilities that can come from cyber security! I can see it now...

tracert joeqpublic

Tracing route to joeqpublic [01:32:fd:...]
over a maximum of 9999 hops:

1 BigBrotherDataCenter.Pentagon.Washington.DC.USA
2 EpicPrivacyInvasionDataWarehouse.USA
3 California.USA
4 Southern.California.USA
5 LosAngeles.Southern.California.USA
6 90012.LosAngeles.Southern.California.USA
7 Starbucks.90012.LosAngeles.Southern.California.USA
8 350SGrand.Starbucks.90012.LosAngeles.Southern.California.USA
9 Register01.350SGrand.Starbucks.90012.LosAngeles.Southern.California.USA
10 iPhone.joeqpublic

Trace complete.

Just think of how many jobs can be created! People are going to need to setup all those nodes, and keep them running. Device manufacturers are going to have to their devices certified as BigBrotherCompliant. There are going to need to be working groups, and policy councils, and advocacy teams, and, and and.... I bet there are bureaucrats somewhere right now getting big fat hard-ons thinking about how long it will take to implement this kind of crap (for the good of the citizens of course).

TSA

[ponraul]

Does this mean that I'll have to take off my shoes before I load /.?

The Establishment wants control of the Internet

[Anonymous Coward]

This is the Establishment's Attempt to block future "Ron Paul Revolutions" from taking place on the internet.

The establishment already controls the newspapers, TV and Radio Networks.

The internet threatens their messages that Bailouts, Stimulus, Cap and Trade are necessary.

Call your senators to block this bill.