Slashdot Mirror
White House Tackling the Economics of Cybersecurity
GovTechGuy writes "White House Cybersecurity czar Howard Schmidt will be hosting a meeting Wednesday with the Secretaries of DHS and Commerce in which he is expected to discuss the administration's new attempt to change the economic incentives surrounding cybersecurity. Right now, launching attacks on private companies is so cheap and relatively risk-free that there's almost no way that industry can win. The White House could be considering things like tax incentives, liability and insurance breaks, and other steps to try and get companies to invest in protecting their networks. It's also likely to dovetail with a step up in enforcement, so hackers be wary."
I mean, an insurance company won't insure your house if you don't put a lock on the door, so why should anyone care for cyber-security if a company doesn't take any measures to protect itself?
If you've got a network worthy of necessary security, it's not that hard to set up a linux firewall between your router and your gateway.
The major targets of hackers these days are financial in nature: account numbers or systems authorized to perform wire transfers.
The real solution to security is not to give companies more incentive to secure their information, but to give hackers less incentive to hack. Make a standard, PKI-based, government-regulated solution for financial transactions. Require that all transactions be digitally signed by smart cards, for example. Ensure that someone possessing your account numbers or even your passwords could not use them to transfer money from your account.
It sounds like they are going after the wrong incentives right now...
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
First things first. I propose that the U.S. government tap the creative forces of the 4chan, worth1000 and Fark Photoshop communities for a cost-effective and highly creative solution to replace the godawful uninspiring motivational posters being distributed by the United States Office of the Director of National Intelligence, Office of the National Counterintelligence Executive :
Check 'em out here: http://www.ncix.gov/publications/posters/index.html
"ONCIX does not provide printed copies of our posters. These materials are NOT copyrighted, and you are welcome to download, print, and disseminate our posters freely to promote greater counterintelligence awareness."
http://www.object404.com
Why are we still trying to do this job with inefficient humans! We just need one good CyberMonkey Officer to train the rest of the Corps, and viola! Peace through superior MonkeyPower!
This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
Anything with the word cyber in it is automatically bullshit as far as I'm concerned, so lets dig a little deeper. Who is coming to this meeting?
Among those invited is Larry Clinton, president of the Internet Security Alliance, which represents a range of critical private security industries concerned about cybersecurity.
Ah, the Internet Security Alliance. And who do they represent? No major software or hardware companies are listed. (Symantec doesn't count) Funny enough, I see companies like Raytheon, Boeing, and Lockheed Martin. I'm just speculating (you know, this being /. and all), but something tells me the good ol' boys of the defense industry are trying to get another gravy train started up here.
E pluribus unum
how about getting off of windows? to bad OS/2 died as why is the hole filled windows have to run on ATM's?
if getting of windows is to hard about the fixing the apps with big security holes in them / apps that need admin mode to run.
I love this idea!
If the companies take taxpayer money to secure their networks and their networks become compromised, does that mean we (the taxpayers) get to sue for breach of contract?
WHAT?!
I see you are still working on your mastery of "of/off." I would keep practicing your "to/too" though.
I think this is a step in the right direction. In the US, we've long faced problems with trying to figure out how to incentivize good behavior, rather than simply discouraging the bad. Yet one of the largest problems facing down the threat of hacking and corporate espionage is acknowledging when there's been a breach. Nobody wants to admit it!
My dad used to call an approach of rewarding appropriate behavior and non-rewarding inappropriate behavior as the "carrot and stick" approach: dangle the carrot, if they don't go along, whack 'em with the stick!
My thoughts on a few carrots we could use at the federal level:
1. Certification process for government contractors. A security-certified contractor can get preferential placement on government contracts on the point scale already in place.
2. Exploit awareness networking. Implement a real-time scorecard for corporations that report attacks against them, both those foiled and those in which there was a breach. Once again, apply good behavior credits toward the contract bidding process.
Sticks:
A. Mandatory public service for convicted attackers. And I'm not talking about cleaning up the garbage in Central Park. I'm talking about the sentence for hacking a company is mandatory time spent serving that company. I mean, if I hacked the Wendy's network and had to spend a few months dumping out their grease-buckets, I might think twice next time.
B. Incentivize whistleblowing with rewards for people who turn their companies in. Now, this might sound a little bit 1984-esque, but if there were a tangible reward and promised anonymity, I think we'd find employees and competitors working very hard to learn if the target company was hacked or not.
Just a couple of random musings. What other carrots & sticks could we use?
Matthew P. Barnson
I learn what I think when I read what I write
Require banks to pay for every single breach that is their fault. Right now, it's the merchants who get screwed. If someone walks into one of the retail outlets I consult for with a fake ID, matching fake credit card, and walks out with the merchandise, 9 times out of 10 there is some obscure rule that wasn't followed that will allow the cardholder to get their money back, and the bank to get their money back, leaving the merchant with the option to take cash only or take the hit and continue doing business. "Cybercrime" -- or as I like to call it, 21st Century Crime -- only gets worse from here.
This is free market capitalism at it's finest, where the costs always find their way to the entity with enough money to pay the bill, but not enough to fight the system that forces them to pay. Unfortunately, the government not giving two shits about small businesses has been old news for some time. Hopefully people are going to wise up and realize that you don't do away with the government, just the lobbyists and corporate revolving door that is currently ruining it.
military complex and start banging the drums, its time for another cyberwar/security/terror/fud article. This is just information security with a shiny new name
Good people go to bed earlier.
I'm amused this appears on the same page as the discussion about liability for breaches. We all know that enforcing large, public, and expensive fines is the only solution that corporations will pay any attention to. In fact, why not make CIOs (and CEOs?) personally liable.
You mean like how, last year, they lowered taxes for most Americans for the first time in generations? May I suggest that you find a better source (several would be good) for your information about how your government operates?
If companies were at risk of "cyber-attack", they'd take appropriate precautions. If they're not at risk, they wont; it's a waste of money.
If it was feasable to attack corporations for profit, people would be doing it. if it's not, they wont try.
"Right now, launching attacks on private companies is so cheap and relatively risk-free that there's almost no way that industry can win" ... and yet, it's business as usual.
If that were true, then companies would be getting ransacked right now.
The market forces are in balance. Therefore; corporations already have the appropriate level of security.
Just an excuse for more government controll.
Define "lowering" taxes. Are you considering the total tax burden, or just personal income tax? Yeah, I thought so.
Also, "lowering" taxes doesn't do any good if you don't cut spending, anyway.
If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
When is the government going to lower taxes? It certainly won't be in this lifetime....
Preparedness for cyber attacks is currently a joke. I have experience in cooperating with the FBI, SEC, and FINRA to address vulnerabilities at online banks and stock brokers. Is anyone aware of companies or agencies that are hiring in this line of work that I could apply to?
-- I was raised on the command line, bitch