Slashdot Mirror
New Legislation Would Federalize Cybersecurity
Hugh Pickens writes "Senators Jay Rockefeller and Olympia J. Snowe are pushing to dramatically escalate US defenses against cyberattacks, crafting proposals in Senate legislation that could be introduced as early as today, that would empower the government to set and enforce security standards for private industry for the first time. The legislation would broaden the focus of the government's cybersecurity efforts to include not only military networks but also private systems that control essentials such as electricity and water distribution. 'People say this is a military or intelligence concern, but it's a lot more than that,' says Rockefeller, a former intelligence committee chairman. 'It suddenly gets into the realm of traffic lights and rail networks and water and electricity.' The bill, containing many of the recommendations of the landmark study 'Securing Cyberspace for the 44th Presidency' (PDF) by the Center for Strategic and International Studies, would create the Office of the National Cybersecurity Adviser, whose leader would report directly to the president and would coordinate defense efforts across government agencies. The legislation calls for the appointment of a White House cybersecurity 'czar' with unprecedented authority to shut down computer networks, including private ones, if a cyberattack is underway. It would require the National Institute of Standards and Technology to establish 'measurable and auditable cybersecurity standards' that would apply to private companies as well as the government. The legislation also would require licensing and certification of cybersecurity professionals."
I side with Vinge in believing that segmentation of the network is a sure indicator of a government going feral.
Bruce
Bruce Perens.
Do either of them have any clue about what they're legislating? Hope they've got someone on their staffs who know the difference between a SCADA system and a server farm, because I'm quite sure they don't. The alternative is that they've let the intel agencies and the security industry write the legislation, which is just about the worst possible alternative.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
"measurable and auditable cybersecurity standards" that would apply to private companies as well as the government.
Until your elected representatives fully understand that any public infrastructure networks should not be connected to the 'Internet' -for any reason- any discussion of 'cybersecurity' is simply wasted words. WTF does it take for these 'public officials' to realize that critical infrastructure networks need to be completely isolated and secured from the hostile environment that the 'Internet' has become?
Sig this!
Because US government officials ALWAYS make good technical decisions. Because the placement of officials is NEVER based on politics rather than skill.
Maybe we could legislate some openness instead.
Large vendors are behind this. With all the extra security certifications and processes that small businesses (or independent/open source developers) will be required to apply because of "security" open source would be closed out of the market by this.
Please watch this very carefully. Red Hat and free software companies actually large enough to have lawyers, please, please, please sniff out the rats.
...trying to get under the wire, then please just fucking shoot me.
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
'Public officials' are responsible for making sure that infrastructure like traffic lights, water systems, sewage systems, and the like, are completely secure and isolated from any 'public' network like the 'Internet'. If the control systems for these critical systems are connected to the 'Internet', every citizen should be outraged at the complete disregard for the security -or lack thereof- for these systems.
Sig this!
Common sense approaches to system security tell me that if I was in charge of these systems they would be secured by every means possible. There is absolutely no excuse for exposing critical infrastructure to attack by every thirteen year old Romanian hacker on the planet because I was not familiar with the latest means to secure my networks. This is, after all, the 21st Century.
Sig this!
If passed, this could have the effect of a de-facto outlawing of Linux. For example, consider the typical business small business owner's plight: he uses Windows mostly on the desktop, but has a few Linux servers handling things like mail and print services.
I understand the government wants to ensure "cyber security" - whatever that means - but they, of all organizations, are the least qualified to implement it. The conflict of interest between big business and government interests is just too great for this to be anything but a tremendous waste of time and money.
And this without even considering the larger question of why the government should have any control over the software private users run on their own computers.
The society for a thought-free internet welcomes you.
What about SELinux?
Isn't it NSA sponsored?
Misery loves company. That's why many Statists will drag the rest of society down to their level. We must all suffer together so we may be bonded together with a closer kinship they say. Ya, right. Uh huh. Sure....
And people wonder how the horrors of Communism rears its ugly head throughout the world.
Life is not for the lazy.
Until we get operating systems that can run code without having to trust it, we're going to keep getting the same crap, over and over.
Linux isn't the answer. Hell, even SElinux isn't the answer.
Start reading up on Eros, Keykos and Capros to see about systems that might actually solve the security issues once and for all.
1.) Instead of a Czar, I like "Commissioner Of The Internets" 2.)Issues like this make me question where these senators get their information. They obviously do not know the current technology well enough to create laws involving it... maybe we should focus more on the lobbyist groups that funded their campaigns and figure out who benefits the most from this!
Anything involving a new "czar" invariably fails to achieve its objectives and shows disregard for our rights. Joe Biden is credited with coining the term "Drug Czar" and was a vocal proponent of making it a cabinet level appointment. Ironically, the current administration has downgraded the post to a non-cabinet level position. I hate the term and wish it would go away, it sounds anti-democratic and seems to act accordingly.
This may be a late April fools joke by government standard, but it sure contains plausible concerns.
Concerning the document, I would say that it isn't a joke, but you may have to express some concerns about if the proposed methods are causing more problems than they are solving.
If you shut down a whole network, then you also cut off the owners of possible infected computers from the services that may help them to clean them up. This has been tried before within larger companies which just ended in a deadlock, nothing was done at all until the network was up again. In effect - you got an ultimate D.o.S attack!
If anything - put more effort into hunting down and apprehending the perpetrators. This will give a much better result in the long term. In effect - follow the money.
Another approach would be to put more effort into hardening of operating systems and tools for operating system management. SELinux is one good example, but unfortunately this only works to some extent and it only covers one area of security measures.
One detail that also is cause for concern is ISP:s that migrates from several routed segments to a large segment where switches are used instead. It makes sense from an economic perspective, but it's not making sense from a security perspective. This means that more computers can be joined into dark nets using private IP addresses for internal communication, which in turn can make attacks even better coordinated.
Large switched segments where private IP addresses propagates can also result in new intriguing ways of obscuring file sharing traffic and other traffic that is to be masked. This can result in the funny effect of making a whole town suspected of possession of child pornography.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
the terrorists build a CIP device, and then storm the White House, and then they get bioweapons in DC.
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
While I applaud the Senators' efforts to assist in securing cyberspace, historical efforts to legislate cyber-security have not proven effective. (that was tough to say with a straight face) To wit, examine the Government's own record: Currently all federal agencies are required to follow strict guidelines/policy, yet the average info-security grade given by OMB, for FY2007 was a C-. How far would you get in life if your average grade was a C-? I'd guess the average Slashdotter had better than a 1.7 average.
Further, they seem to think that if NIST establishes "measurable and auditable cybersecurity standards", then all will be right with the world. NEWSFLASH - The Fed already has that for the entire GOV, and while many agencies have improved it has not shown to be the panacea they intended. According to OMB's report out 3 weeks ago(go to page 9), the DOD, the agency with the most important security concerns and highest risk (and consequently the most stringent InfoSecurity program) is failing miserably.
Funny, if you read the FISMA top page, it refers to 'cost-effective' security programs, but nowhere does it mention effective programs...
New legislation is not the answer - holding people accountable is. [to keep this relatively short I'm not going to expand on this - you know how to find the laws]
As one previous poster noted, a bunch of us posting here is not going to change anything. So, I will end this with a call to action for all Slashdotters - write a letter to your Senator and Congressman and let them know (using clear, thoughtful words) that this is an f'ing stupid idea and that they should not support it.
Find your congressman
Find your senator
China also has the max of the death penalty for hacking. Russia does not care about hackers going after the us and taking our money Likely a kick back kind of thing in Russia.