New Bill Would Put DHS In Charge of 'Critical' Private Networks

GovTechGuy writes "A new bill unveiled Wednesday by House Homeland Security chairman Bennie Thompson (D-Miss.) would give the Department of Homeland Security the authority to enforce federal cybersecurity standards on private sector companies deemed critical to national security. The Homeland Security Cyber and Physical Infrastructure Protection Act of 2010 authorizes DHS to establish and enforce risk and performance-based cybersecurity standards on federal agencies and private sector companies considered part of the country's critical infrastructure. Such firms include utilities, communications providers and financial institutions."

Comments

What's the alternative

[jeffmeden]

Considering how much a lot of those companies rely on their network infrastructure, if there isn't a provision for this then perhaps the alternative is to be prepared to take over the whole organization if/when they are crippled by an attack. I am not one for heavy handed government but someone needs to light the fire under these guys.

Re:What's the alternative

[Xiph]

The problem is that this will mean that they end up forcing critical infrastructure projects to rely on rot13 encryption.

Re:What's the alternative

[lgw]

Has the DHS demonstrated that they are any smarter than the current crop? Is an enforced monculture somehow better for security than a variety of solutions? Is the DHS going to be immune to carefully chosen campaign contributions at the federal level, resulting an an all-Microsoft infrastructure?

The way IT for banks is regulated, by creating standards that the banks must comply with but not dictating specific solutions, might work OK here. But I have no faith that that's where "OMG, the government needs more power" is going to end up.

Re:What's the alternative

[mcvos]

My first thought was: why does national security even rely on private networks? But if there's one thing that the mortgage crisis taught us, it's that quite a lot of our economy can be easily messed up by a handful of irresponsible banks. Of course the same is true for telecommunication companies and our communication infrastructure.

Re:What's the alternative

[jeffmeden]

"The Homeland Security Cyber and Physical Infrastructure Protection Act of 2010 authorizes DHS to establish and enforce risk and performance-based cybersecurity standards on federal agencies and private sector companies consider part of the country's critical infrastructure."

It does sound like a standards-based, not a "take over" approach. The crisis alternative (as we found out during the financial crisis) is for a takeover/bailout of the entire organization when internal processes fail to account for risk. When it comes to a bank's bottom line, you might argue that they have free will to self destruct. When it comes to utilities that we rely on for life and liberty, mandating the least risky approach isn't overkill if you ask me.

Re:What's the alternative

[Anonymous Coward]

Apparently the term "of course" is synonymous with "this is a troll...

Re:What's the alternative

[TrisexualPuppy]

And how hard is it to apply what you have hopefully learned with the rest of the legislation passed in the ten years?

Repeat after me. This legislation exists to build a presence.

At the best, it will do what the FAA's legislation has done to General Aviation over the past fifty years. Overregulation of federal standards which cripples usefulness/availability and stagnates innovation because new ideas are either illegal to implement, or they become too expensive to try. Give it five or ten years, and we will of course have the need for DHS to be able to overtake the Internet during "national technological emergencies" declared by the president. These boys would already have had that kind of legislation in place if any security problem really did exist on the Net and we had been attacked because of it.

Re:What's the alternative

[Anonymous Coward]

Exactly man. Exactly.

Re:What's the alternative

[mysidia]

Considering how much a lot of those companies rely on their network infrastructure, if there isn't a provision for this then perhaps the alternative is to be prepared to take over the whole organization if/when they are crippled by an attack. I am not one for heavy handed government but someone needs to light the fire under these guys.

The alternative is to require that they develop their own standards, and be subject to periodic penetration tests sponsored by the government.

If a government pen test against them succeeds, then they will be seriously penalized, or compelled to hire a 'government approved firm', implement that firm's requirements, and pass another government pen test, or face serious penalties and losing their right to run the critical service.

If they refuse to comply, also, the results of the government test will be immediately published so the public will know that the service is vulnerable.

Re:What's the alternative

[jeffmeden]

Not to straw man your other arguments, but the FAA has managed to keep people alive at an unprecedented rate. Considering the aviation disasters that befall less regulated nations on a regular basis (and even other transportation methods in our own nation,) I would have to politely decline the notion that the FAA is overstepping it's bounds. As someone who has put on a lot of miles in the air, I prefer to take my planes well regulated and safe, as opposed to innovative and in a crater.

Re:What's the alternative

[pete6677]

"be subject to periodic penetration tests sponsored by the government"

Just like commercial airline passengers.

Re:What's the alternative

[arivanov]

This approach is similar to what other countries have been taking for a while. The governments pretty much slept through the Internet becoming the predominant telecommunication medium and the awakening has been rather rude for all of them.

Nearly all other governments have taken similar steps. It is actually positive that USA has put some legal framework behind it. That has not been the case with other big-8 countries where the various three symbol abbreviated agencies have forced a number of changes on the infrastructure without any legal framework to back them up.

Do we like it or not - this is something that could not be avoided. It is probably better if it is done legally, above board and with clear and well defined game rules instead of a cloak and dagger.

Re:What's the alternative

[Anonymous Coward]

Must be coming from a doctor or shark with too much money to think or care.

Re:What's the alternative

[Anonymous Coward]

As a utility operator trying to get vendors to follow basic security protocols is dificult as they claim no law says we have to be secure. I am fighting the issue now. I know security is a good idea, but they claim there is no requirement to be secure.

Re:What's the alternative

[hedwards]

The problem is that with the banks the collateral damage from allowing them to fail was more or less catastrophic, at least as bad as what we'd seen in the depression of the 1890s and the equally horrific Great Depression. Taking steps ahead of time would've eliminated the necessity to step in like that at the last moment.

It's not like it wasn't common knowledge that those corporations had grown to the point where they weren't competing.

Re:What's the alternative

[mysidia]

Just like commercial airline passengers.

No... well.. it's a free-market solution. Instead of dictating a particular supposed solution require that they actually solve the problem, and require them to prove they solved it with both outsider and insider pen testing. An attempt by skilled hackers to compromise is less expensive than implementing huge "best" practices lists and hoping one of those practices sticks and prevents the bad guys.

Pen tests can more easily take into account new threats, since the 'things tested' aren't/shouldn't be fixed ahead of time. Pen testers can be incentivized to innovate, by paying a bounty to a pen tester who successfully compromises a target and can document every step, with full logs and traces, including any failed attempts, to prove they compromised it and did so in the exact way they say they did.

The airline equivalent would be the government periodically hiring very good actors that meet the profile of the threat for that particular flight, to "pose as a bad guy trying to sneak items on planes that are supposed to be disallowed.

If one of the agents succeeds, then the airline is to be penalized for their lax security.

Instead we have this dysfunctional TSA that reportedly doesn't even succeed at what it's supposed to do, and makes airline travel a living hell for legitimate travelers.

Re:What's the alternative

[networkconsultant]

Didn't DHS already have issues with their own corporate network security?
Major DHS Security Fail!

Re:What's the alternative

[FiloEleven]

No, if the banks had been allowed to fail we would have entered a new utopia where money doesn't matter and people's net worth was based on how much good they could do in the world. As such, the "richest" people would have been the best people, and they could use the resources at their disposal to bring about world peace, the end of hunger, and OMG ponies!

See how easy it is to make unsupported counterfactual arguments?

Re:What's the alternative

[Reziac]

That's all well and good for people who don't have a voice in the decision to accept or decline risk, or people who are risk-averse (which has its place; craters are not typically a quality flying experience). But I think what the OP was getting at, is that there are now strictures that affect even people willing to take their own risks with new development, so it doesn't happen.

Re:What's the alternative

[Anonymous Coward]

Israel. Enough said.

Re:What's the alternative

[Amouth]

the "DHS" is at ever corner reminding me of history

http://en.wikipedia.org/wiki/Gleichschaltung

sure so far it's not as bad or nearly as fast.. but every step it takes is in the same direction.

Re:What's the alternative

[Anonymous Coward]

OP's talking about GA, not commercial flights.

Re:What's the alternative

[mlts]

I wonder if the US government should set up another backbone, similar to SIPRnet and NIPRnet. Call it "BIPRnet", this would be a backbone for large businesses to communicate with each other, for example bank "A" to credit card handler "B". It would be pre-assigned which machines could communicate to which, so if bank "A"'s machine tries to communicate to bank "C"'s machine without some form of process of opening ports, it will be automatically refused. This way, an attacker would have to find a gateway machine on the backbone to compromise, then try to find one of the relatively few machines on "BIPRNet" that the box can communicate with to try to break into.

This would narrow down greatly the way a box can be attacked, as well as remove critical business traffic off the Internet, unless going through an encrypted gateway [1].

[1]: A real encrypted gateway that both half-routers have a preshared key and/or a public key both know and not certificate based. This keeps someone from getting access to a third party master CA and firing up a MITM attack.

Re:What's the alternative

[falconwolf]

Considering how much a lot of those companies rely on their network infrastructure, if there isn't a provision for this then perhaps the alternative is to be prepared to take over the whole organization if/when they are crippled by an attack. I am not one for heavy handed government but someone needs to light the fire under these guys.

As Benjamin Franklin wrote: ""They that can give up Essential Liberty to obtain a little temporary safety deserve neither Liberty nor Safety." We already have too many governmental computer security organizations, we don't need another. But even if one is needed who says DHS is any better at computer security than any other agency?

Falcon

Re:What's the alternative

[element-o.p.]

While I wouldn't say the FAA is overstepping its bounds, I would certainly argue they tend to be (IMHO) unnecessarily heavy handed in the general aviation segment. I've been a pilot since 1991, and one of the first categories of aviation that captured my interest after I got my pilot's license was what is euphemistically called "amateur-built, experimental" airplanes. The reason why the experimental airplanes were so fascinating is that is where *all* of the innovation in light airplanes was taking place. To the best of my knowledge, there were no *certified* single-engine piston airplanes being manufactured that were made of anything other than aluminum, tube and fabric (like a Super Cub) or wood. No piston engines had any kind of electronic engine controls or electronic fuel injection, even though such technology had been used in automotive engines for about a decade. A fast certified airplane piston single could do about 180, maybe 200, mph. More common speeds were between about 100-120 mph. In short, the "state of the art" for certified, piston-powered, single-engine airplanes had remained frozen for about 20 years.

Meanwhile companies making experimental "kitplanes" -- which did not need FAA certification to fly -- were churning out fiberglass hot rods that routinely hit 300+mph, using all kinds of advanced technology. One guy featured in a mid-90s issue of "Kitplanes" designed and built his own glass cockpit (i.e., CRT displays for navigation and engine monitoring instrumentation; IIRC, he still used analog gauges for airspeed and attitude) and outfitted it to a Lancair 320 that he had built. When asked why certified airplanes lagged so far behind the kitbuilt market, airplane manufacturers invariably gave the same two answers: liability costs and certification costs. The situation has improved marginally since the FAA approved the Light-Sport category in the early 2000's (2003, I think?), but three out of five piston singles that Cessna currently sells are still 50 year old designs: the 172, 182 and 206.

Bringing all of this back on-topic, this is what I desperately DON'T want to happen to the Internet. Can you imagine if we were all still running W2K because that was all that could legally be connected on-line, due to the prohibitive cost of certifying another operating system to connect to the Internet? What if the government decides that open source software is impossible to certify, since anyone can modify the source code, and therefore, the regulators can never be sure that the web server or web browser you compiled from source *really* meets certification requirements? It's a stretch, but that's essentially happened to general aviation. Ultimately, excessive government regulation stifles innovation. I really don't want to see that happen on-line.

Re:What's the alternative

[element-o.p.]

So instead of suffering a little pain and cleaning the cruft out now, we prolong the agony with life support? I'm sorry, but that just doesn't seem like a good idea to me.

Re:What's the alternative

[element-o.p.]

Do we like it or not - this is something that could not be avoided. It is probably better if it is done legally, above board and with clear and well defined game rules instead of a cloak and dagger.

Yeah, because we've seen how well that has worked with the Constitution. Without that legal, above board, clear and well defined game rule on the government, the TLAs could just lock people away on a foreign island*, "not torture" them in violation of the eight amendment**, prohibit owners or managers of legitimate businesses from seeking legal advice when the TLAs come looking for information on their clients***, or take away other rights that have been guaranteed in the Constitution****. If you think simply making something "legal and above board" will keep the Feds from slowly encroaching on our rights, I think recent history proves you are sadly mistaken.

*Guantanamo, if that wasn't already obvious
**waterboarding, ditto
***NSLs, ditto
****Alberto Gonzalez and the right to habeus corpus; see also the sixth and eighth amendments and tell me how well we've lived up to that in Guantanamo.

Re:What's the alternative

[Anonymous Coward]

Of course if you put your money behind the wrong candidate, won't take long to get your company destroyed during an "emergency".

Re:What's the alternative

[murfguy]

I personally do not believe more gov't is the answer! Fact of the matter is the gov't could not propery run a brothel that it had taken over due to taxes in an environment where both brothels and gambling are legal. A free market system would be the best environment where peer pressure from the ethical counterparts would work best. Unfortunately, the ethics of the business community is also lacking.

What is the determination?

[databyss]

I'll assume they can designate any forum they don't like as critical to national security due to terrorists using it to communicate.

Re:What is the determination?

[LordLimecat]

That has absolutely nothing to do with whats being proposed, according to TFA. This is about setting network security requirements and enforcing them, not shutting down threats of any kind. Grats on not reading the summary tho.

Re:What is the determination?

[AmberBlackCat]

I'm certain part of their network security requirements would be that you have to be positively identified in order to use the internet. But it won't necessarily include any requirement for that identity to be kept away from corporations.

It feels like

[Rosco P. Coltrane]

a deaf man telling others how to sing. Maybe they should get their act together before giving lessons...

Re:It feels like

[Belial6]

I was thinking more along the lines of a child molester telling others how to use the internet.

Re:It feels like

[crypticwun]

Wow! Way to pull out the 3 year old report featuring Capitol Hill theater!
Of course, I would be more comfortable if they would explicitly state that TSA, a part of DHS, was precluded from having any (cyber) authorities.

I'll sit over here

[Megaweapon]

and wait for the Republicans to fight this government intervention tooth and nail. .........

Re:I'll sit over here

[elrous0]

Only if someone attaches an amendment that hurts corporations or the rich in some way. Then they'll become George Washington fighting the British.

Republicans, we fight to get the government off your back!!*

* If you're rich or a corporation

Re:I'll sit over here

[schmidt349]

Sorry, the Republicans only fight government intrusion if it lacks the magic words "national security" and your annual income is above $250,000.

In this instance what they can do for you is a visit from Ann Coulter, who will shriek "why do you hate America SO MUCH" loud and shrill enough to shatter all the glass in your house.

Re:I'll sit over here

[Anonymous Coward]

I just look forward to watching Repubs try to reduce the deficit without touching their two sacred budget cows, military spending aka "welfare" and benefits for seniors aka "voters"

Re:I'll sit over here

[EraserMouseMan]

I work for a "rich corporation". We have not had the means to increase our staff in over 2 years. Over that period nobody has gotten raises or bonuses either. The Democrats would like to see the Bush tax cuts expire and see the balance sheet of corporations take an additional 3% tax hit. Lovely.

Re:I'll sit over here

[c6gunner]

Sorry, the Republicans only fight government intrusion if it lacks the magic words "national security" and your annual income is above $250,000.

Guess you haven't been following the airport-scanner debacle.

Re:I'll sit over here

[IgnoramusMaximus]

That is due to the tremendous difference between the Democrats and the Republicans:

During the Republican reign within the last 50 years, the average, inflation-adjusted US worker's income increased -1% and the average CEO's income increased 500%. This stands in great contrast to the Democrats, under whom the average US worker's income increased -1% and that of the CEO mere 400%.

This shocking difference explains the dire straights your poor, rich corporation is in, thus necessitating further belt-tightening, "shared sacrifices" and other "austerity" measures...

Re:I'll sit over here

[divisionbyzero]

and wait for the Republicans to fight this government intervention tooth and nail. .........

You'll be waiting a long, long time. Chances are that most of the companies that would benefit from this legislation (i.e. large IT shops) donate more money to the Republicans than the Democrats. You act as if there is a fundamental difference in the parties rather than rationalizations for supporting whichever group gives the party more money. Neither of the parties believe in the principles which they espouse. They simply cater their rhetoric to whomever gives them more votes or money. This kind of stitched together ideology is full of contradiction. The Republican party as it exists now is a great example.

Re:I'll sit over here

[hedwards]

What's fucked up about the US is that "austerity measures" is just a code word for we're going to cut funding to things which even out the income distribution and welfare. So, that we can send the money to the rich who apparently are capable of printing money. Also that people are more concerned with the welfare of parasitic billionaires that the folks that actually produce the wealth.

I'm really curious as to where the wealth in the US comes from, because it apparently doesn't actually involve anybody having to work for it.

Re:I'll sit over here

[IgnoramusMaximus]

If you want to get serious about it, it all can be traced to the societal psychosis of celebrity worship that presents life as one gigantic casino: "You *too* can be a WINNER!!" (in tiny print: your odds are 1 in 4 billion, disqualifying conditions will apply, see lawyer before entering etc).

The con-men who benefited from this worked tirelessly for decade upon decade to slowly reshape the entire economy and the "common wisdom" of Americans to the point that things like "Credit Default Swaps" and "5th tier derivatives" are looked upon not only as a serious endeavor but as a legitimate "investment", while some 200 years back they would be seen as a joke of a scam.

Similarly, the average worker has become so confused that he disassociates his lot in life and reality from his make-believe "future" of a billionaire "winner". He is also told (and most amazingly he believes it) that the casino winners are wholly and single handedly responsible for him even having a roof over his head and food to eat and that he should be grateful to them for it and defend them, his current "benefactors" and future "peers" - no doubt in his mind about that, from any and all harm.

In short, America (and most of the "business" world) has become a vicious caricature of what a sane economy looks like and where the least valued activity (and lowest paid) is actual work to produce anything and the most revered kind of activity is high-stakes gambling with con-job money.

Some people believe, and I tend to agree with them, that the pivotal point at which this enormous scam became mainstream (at least in the financial realm) was when the fiat currencies became the norm instead of an exotic weirdness confined to impoverished countries run by "rulers" who sat on their suitcases ready to escape in the middle of the night at the first sign of the populace starting to catch on...

Re:I'll sit over here

[mcgrew]

If you think you're getting a raise because your employer is getting a tax break, you're incredibly naive.

You're not getting a raise unless your employer thinks you're worth the extra money and is afraid you'll jump ship to somewhere that's paying better than he is.

If he doesn't have anough workers to produce all the goods he sells, he'll hire more workers regardless of his taxes.

If he has workers standing around because they're not selling enough goods, somebody's getting laid off, taxes or no taxes.

Tax cuts for the rich only benefit the rich; they'll just squirrel the money away. The poor and middle class will spend their money, putting it right back into the economy, which sells more stuff, which gives your employer incentive to not lay you off, or even hire more workers.

You've been had. Stop listening to people who have a motive to mislead you -- like your rich employer.

Re:I'll sit over here

[Anonymous Coward]

What's fucked up about the US is that "austerity measures" is just a code word for we're going to cut funding to things which even out the income distribution and welfare. So, that we can send the money to the rich who apparently are capable of printing money. Also that people are more concerned with the welfare of parasitic billionaires that the folks that actually produce the wealth.

And what disturbs me about the prospects for action are exemplified by a news piece on NPR a few days ago where the announcer listed some of the "cost cutting" measures that have been floated as ways to help reduce the deficit -- increasing the retirement age, increasing the amount of wages subject to Social Security taxes, eliminating the mortgage-interest deduction... From where I sit, not one of them cuts any costs; every single one of them is a revenue increase that allows the government to bring the budget more into balance without actually having to cut anything. If the Tea Party is serious about cutting the deficit, I want to see them do it by reducing government spending, not by squeezing more money out of the citizenry. Prove to me that you can control your spending, then maybe I'll trust you to rework the tax structure.

Re:I'll sit over here

[Anonymous Coward]

Why this is modded funny is beyond me. Insightful is more like it.

Into the Probulator!

[snspdaarf]

If this passes, does it mean I have to have the "new" patdown, or can I opt for the "classic", before I can enter the server room? And, if I can only bring in four ounces of soda, my productivity is gonna go to hell.

Re:Into the Probulator!

[dkleinsc]

"My fellow Earthicans, we enjoy so much freedom it's almost sickening. We're free to choose which hand our sex-monitoring chip is implanted in. And if we don't want to pay our taxes, why, we're free to spend a weekend with the Pain Monster."
- Richard Nixon's Head

Safe to say this is where we're heading.

Re:Into the Probulator!

[natehoy]

It gets worse. You can't have a patch cable longer than 3 inches per new regulations. They have to check you for illegally-long patch cables, and the "new grope" isn't going to cut it, nor is the Play{boy|girl} Scanner. I'd suggest bringing your own disposable gloves, just in case budget cuts are dictating too-aggressive recycling.

And, no, you can't have more than three ounces of liquid, remember? "The number of the counting shall be three and three shall be the number of the counting, thou mayest not proceedest to four. Five is right out."

The good news is you can probably hollow out a laptop battery and remove all that perfectly legal explosive Thermite-like Lithium-Ion stuff and replace it with illegal contraband Mountain Dew. But think of the CHILDREN, man!

Re:Into the Probulator!

[element-o.p.]

I'm okay with four ounces. That's about how much espresso I make in the morning, anyway. (That corn syrup in soda is muy evil! :)

Re:Into the Probulator!

[mcgrew]

Ain't that America, you and me
Ain't that America, somethin' to see
Ain't that America, almost free....
Little pink houses for you and me

(yes, I changed a word or two)

Wording is vague.

[chemicaldave]

What do they mean by "enforce federal cybersecurity standards"?

If that just means new security standards that companies have to meet, then I can't see the harm in that

Demanding exclusive admin access? Now it's complicated.

Re:Wording is vague.

[Rosco P. Coltrane]

If that just means new security standards that companies have to meet, then I can't see the harm in that

When the standards are defined and enforced by incompetents, they tend to be useless, costly and bad for productivity.

Re:Wording is vague.

[chemicaldave]

It's certainly the right idea if standards are all they're pushing. But I agree, the DHS shouldn't be involved in this. I can't see why they are in the first place other than someone used the word "terrorist".

Re:Wording is vague.

[Anonymous Coward]

Just like most IT...

Re:Wording is vague.

[bsDaemon]

DHS is likely involved since they have a Federal mandate allowing them to operate in Civilian-space internally to the US, something NSA isn't really allowed to do for corporations (hence why similarly-skilled contractors were recommended to help with the incident response for Google re: China), but can do for government and military outfits. As I noted above, I strongly suspect that the DHS rules will be based on FIPS standards as well as slightly modified policy and technology guidelines from the IAD and CNSS. As long as they don't try to do this from scratch using a copy of 'Security+ For Dummies' as a guideline, then this might actually turn out alright.

Re:Wording is vague.

[LordLimecat]

If that just means new security standards that companies have to meet

That seems to be just what theyre asking for, according to the article.

Im not exactly clear why the DHS would be super good at proposing network security requirements though

Re:Wording is vague.

[locallyunscene]

Thank you. I agree, defining standards are okay, but DHS should be the last one selected to do it. Networks like these need security not security theater.

Re:Wording is vague.

[macshit]

Im not exactly clear why the DHS would be super good at proposing network security requirements though

Is there anything the DHS is good at?

I suppose one way to look at it is: they probably suck massively at network security, just as they do at everything else; since we've already thrown tons of other random powers at them, why not this...

[head explodes]

Re:Wording is vague.

[dgatwood]

I think we'd be far better off if the government weren't coming up with the standards in any significant way. They've shown little understanding of security (and particularly computer security) in the past. Far better if they instead pass laws that simply mandate certain types of companies conduct regular security audits by their choice of external auditors, coupled with penalties if those audits find that the companies are not following established industry standards.

Alternatively, the government could create a standards organization consisting of industry leaders and security researchers to create and maintain appropriate standards if they don't think the existing industry standards are good enough.

Either way, HomeSec is already too big and bloated to be useful. The last thing we need is for them to do more.

Re:Wording is vague.

[iivel]

Most of the DHS standards come from combined work with NIST, US-CERT and the NSA. They're all pretty good at what they do.

Re:Wording is vague.

[anegg]

I would expect the ultimate goal is for such systems to be overwatched by the new US "Cyber Command" being set up at Fort Meade.

Re:Wording is vague.

[fishbowl]

Right, and they are going to send their best and brightest to do the "enforcement" part. Right.

Re:Wording is vague.

[ebuck]

What do they mean by "enforce federal cybersecurity standards"?

If that just means new security standards that companies have to meet, then I can't see the harm in that

Demanding exclusive admin access? Now it's complicated.

I think it means two second turnaround time on an unauthorized illegal wiretap. Possibly it means a "data retention" policy of holding all data for two years as DHS can't figure out what they want to access, yet.

Re:Wording is vague.

[GameboyRMH]

Far better if they instead pass laws that simply mandate certain types of companies conduct regular security audits by their choice of external auditors

The usual big auditing firms - KPMG, Ernst & Young, probably PWC too - do feelgood paper IT security audits and are a big fat joke if you really want your security assessed.

Of course the problem is you need a nice well-known name to point to, even if your (customers') data is being hauled out by the truckload via a dead-simple URL hack right under the auditors' noses...but, but, $WELL_KNOWN_COMPANY just audited our security!

Re:Wording is vague.

[Platinumrat]

But think of it. It will be a way of keeping those foreign companies away from supplying equipment to "critical infrastruct" projects. Oh wait, no it won't.... There'll be some exemptions somewhere if it inconveniences CEO earnings.

Re:Wording is vague.

[dgatwood]

Heh. This is, sadly, true. Which is why there should be an appropriate standards body in charge of saying what does and does not constitute a proper audit. Just not a government-controlled standards body.

Re:Wording is vague.

[GameboyRMH]

I think government and private standards bodies would just screw things up in different ways...a government standards body would probably just take the opportunity to erode civil liberties and make a power grab, and a private standards body would go for a solution that is most profitable to it's most influential members, but as cheap as possible otherwise. Either way you end up with an ineffective and harmful set of standards.

I'd vouch for a government-controlled standards body if they could demonstrate that they had the slightest idea what the hell they were doing when it comes to computer/network security. I'm sure the NSA does, but that's not their job. So it would either end up with the Deparment of Hopeless Stupidity or the Air Force Interweb Cyber Tube Commandos.

Better Yet

[ciderbrew]

Stop spending Tax, giving yourself more powers. You should have rules in place for internal departments and for any company that is THAT important, surely any contract set up would require some terms and conditions.

Financial Institutions

[homes32]

great. like we don't have enough regulation in this area as it is.

Re:Financial Institutions

[mcgrew]

If financial regulations were properly regulated the economy wouldn't have melted down and we wouldn't have had to bail the banks out.

Pirates, not terrorists, are probably first

[elrous0]

Why do I have a sneaking suspicion that this law will be applied WAY more often to fight torrent sites than it will ever be used to fight actual terrorists?

Re:Pirates, not terrorists, are probably first

[Rosco P. Coltrane]

Why do I have a sneaking suspicion that this law will be applied WAY more often to fight torrent sites than it will ever be used to fight actual terrorists?

Torrent sites that aren't taken over by russian virus makers, where the files you download are guaranteed genuine and not cheap porn movies that have been renamed, certified safe by the government? Yeah, I'm all for that.

Re:Pirates, not terrorists, are probably first

[LordLimecat]

Why do I have the sneaking suspicion you didnt even read the summary, much less the article? This bill is about requiring certain standards to be met by certain vital private sector companies. How on earth would you even get at torrent sites under this bill, require them to upgrade to the latest version of cisco IOS?

Re:Pirates, not terrorists, are probably first

[elrous0]

Because part of the "critical infrastructure" of this bill are ISP's. And part of the "new security regulations" could easily include shit like blocking torrent sites on both the front-end and back-end (because they pose a virus threat to our security, of course).

Re:Pirates, not terrorists, are probably first

[c6gunner]

That's retarded. If your government is corrupt and insane enough to use that kind of convoluted reasoning, I'd be much more worried about them taking away your right to free speech because it could lead to "spreading of terrorist propaganda", or your right to unreasonable search and seizure because "anyone could be a sucide bomber". If you think your government is THAT bad, get the fuck out of the country NOW, while you still can.

Re:Pirates, not terrorists, are probably first

[FiloEleven]

Torrent sites ARE vital, dammit! And even though Russia and Sweden are little-known backwaters of the USA, they are still part of the USA and deserve the same protections that the more popular states get!

Competence

[Anonymous Coward]

Considering that the DHS is probably one of the most dysfunctional, incompetent departments in the entire federal government, I find that more frightening than the terrorists.

Re:Competence

[Anonymous Coward]

as i just started working for the dhs as a contractor looking from the outside in, and i couldn't agree with you more.....

Re:Competence

[Anonymous Coward]

I work for IT for FEMA... this is the LAST thing they need to be sticking their fingers in...

TRUST BUT VERIFY !!

[Anonymous Coward]

Only TERRORISTAS would be concerned. Are you concerned? You are a TERRORISTA !!

What's critical?

[girlintraining]

As we saw with anti-terrorism spending, what's deemed critical and what truly is hasn't exactly ever been the same.

Re:What's critical?

[Anonymous Coward]

In fact, the DHS have demonstrated a DISTURBING lack of understanding of "Critical" by applying no protection where the real problem is and spending billions on new scanners and paying people tofonsdle our junk. In the end, they've no business protecting anything if they can't get this much right.

Lame Duck

[MikeB0Lton]

As if they haven't spent enough tax dollars they don't have.

As Ben Franklin said ...

[Anonymous Coward]

They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety

Re:As Ben Franklin said ...

[deapbluesea]

As said by an anonymous coward. Nice job.

This is the race to facism at its finest.

[mr_mischief]

I'm sure "federal cybersecurity guidelines" for a network include having Federal employees shutting down general non-critical access and putting control of the network under FEMA control whenever there's a disaster. That's great for a network owned by the Federal government. It's an abomination against the rights of the people and private companies to do those things to a commercial network on which millions of people rely for their own uses.

It's called "socialism" when the government takes over industry for the people. It's called "facism" when the government takes over industry to enhance the power of the government. Somehow I just can't see the government taking over control of networks the citizens use as benefiting the people more than the government.

Re:This is the race to facism at its finest.

[UnknowingFool]

Depends on what "guidelines" mean. There are government guidelines in many aspects of life today. For example what additives are allowed to be put in food products. That "fat free" and "low fat" have precise meanings, and a pack of beef hot dogs can't claim they are "low fat" without adhering to guidelines. Also how strong concrete columns must be when building a highway overpass, etc.

If guidelines are used to outline what are minimum levels of security, then it sets a basic level of expectation. For example, locking down unnecessary ports. Sometimes the default configuration has something open like telnet, web server, etc. Right now there are informal guidelines that most admins follow. Putting down something formal might be a good idea.

Re:This is the race to facism at its finest.

[mr_mischief]

The bill says the government agency in charge of enforcement designates exactly which companies are covered, puts forth the requirements for security for that company, approves or disapproves the specific security plan the company submits to meet those criteria, can audit the implementation of the plan, and can fine the business $100,000 per day per incident of noncompliance. That's what the word "guidelines" means here.

Under the bill, the DHS would have the authority to tell you how to operate your network and the authority to issue you a sizable civil fine for failing to meet their criteria without a finding against you in court. What's more is that the they get to decide who is under their own control.

Seems like fasicism marching on...

[Anonymous Coward]

What's surprising is that this bill is coming from someone thought to be a Democrat.

Re:Seems like fasicism marching on...

[Attila Dimedici]

Why is that surprising?

Re:Seems like fasicism marching on...

[kilfarsnar]

It's becoming clearer to you now, isn't it?

Re:Seems like fasicism marching on...

[anegg]

There is no political party that has exclusive claims on the ability to seize power and wield it.

Not necessarily monoculture

[bsDaemon]

This move doesn't necessitate a monoculture, it just depends on how they write the law and how those in charge of implementing it end up crafting regulations. As long as they're only enforcing standards and not a standard implementation, then its probably OK, as you stated in the second part of your post. For instance, if the regulation states that networks which have any convergence points with the public internet have, at all crossover points, IDS/IPS systems in place which meet a certain level of ability, then its up to the firm who owns the network to decide whether to go with a solution from Cisco, Juniper, Sourcefire, or another vendor, or to roll something home-grown as long as they can meet the requirements.

I'm sure most of the organizations which will be affected by this will already have most, if not all, the necessary security mechanisms in place. However, they may be out of date to some degree, not properly monitored, and some smaller organizations may be missing large swaths of helpful security infrastructure and best practices because it just hasn't "been an issue" for them in the past. This is probably a fairly direct result of the Stuxnet work/virus. Whether Federal mandates are actually going to help remains to be seen, but if they follow sane policy frameworks such as those outlined by the NSA IAD and the CNSS then this ought to be fine.

Since this is Slashdot, I'm sure at least a plurality will focus on the "private" in critical private network, as evidenced by the air quotes around 'Critical' in the lead line of the story, however when we're talking about power, water, and communications systems critical probably isn't strong enough a word to describe them, and their ability to operate is largely a result of government-enforced monopolies and government-enforced easements, so I wouldn't really call them 'private' either.

Re:Not necessarily monoculture

[anegg]

I have been involved in government IT security for many years now as an employee of a government contractor often hired to perform various parts of the government security process. One of the biggest problems with the government security "standards" and "processes" in place now is that there is practically no cost feedback to the controls. The policies all say that the cost of the controls should be commensurate with the value of the system being protected, but many of the security "approvers" demand gold-plated security, and are often opposed to signing off on anything less. (Hey - you can't be held responsible for a security problem in a system you approved if you simply never approve any systems.) There are numerous government systems operating either "unauthorized" or under "temporary waivers" (for years and years) because the security folks wouldn't sign off the controls.

These problems are with the government policing the government. I can't imagine it would be any different when they are enforcing the standards on commercial companies. Although private enterprises can and do go underboard with security, government monitors are almost certain to go overboard. I have some (but limited) experience reviewing IT security for commercial entities (financial services firms, oil and gas firms, pharmaceuticals) and they often "get" most of what needs to be done... with a few lapses (like connecting SCADA networks to the regular corporate network, which is also connected to the Internet).

If the approach is to have a few *simple* rules (like networks over which critical infrastructure communicates must be isolated from corporate networks that are attached to the Internet), then I think some government oversight wouldn't be bad. But if the approach is to require private enterprise to demonstrate compliance with full-blown government IT security C&A with the government doing the certification, I would predict drastic increases in costs, without necessarily dramatically increasing actual security.

Re:Not necessarily monoculture

[cayenne8]

I guess again..I just don't trust them.

Who's to say WHAT is a critical business infrastructure? Sure, it may start now with financial institutions, the power grid, etc...things I think many people could agree upon. But as with all govt. regulations....you will get scope creep, it is just the nature of the beast.

Look at the recent discussion here about the move to force many if not most websites to conform to new ADA guidlines?!?!

In that argument, they said the *MIGHT* not force private, small websites to comply....might not??

Once the Feds can get into private companies and tell them what to do...it is kinda like the mob, they get more and more and more involved. Once this starts spilling over into small businesses...the cost of regulations will likely knock a lot of the smaller guys off, and close the market to new competition from smaller businesses.

Re:Not necessarily monoculture

[LifesABeach]

I question, "Why the DHS?" In retrospect to the 'Katrina' event, and how DHS helped American citizens then; I see no reason to believe that the DHS won't repeat itself when it is involved in another 'opportunity in which to excel.' And now the TSA, a love child of the DHS has basically created an environment in which Horses Asses can be generated, without the need for the rest of the Horse. There's a reason why the rest of the Horse should be attached.

Re:Not necessarily monoculture

[hedwards]

As opposed to the current business practice of bolting on a tin can solution to a gold plated problem? I mean seriously, corporations rarely if ever spend enough on cyber security. A lot of the massive exploits were only accomplished because the corporation that got ripped off wasn't even implementing the most basic policies.

Having the government threaten to take over their network if they aren't properly secure it would likely go a long ways towards them actually behaving responsibly, even if the government never does it.

Re:Not necessarily monoculture

[slick7]

There's a reason why the rest of the Horse should be attached.

We could always let FEMA handle it.

Re:Not necessarily monoculture

[mcgrew]

FEMA's problem is it's now a part of DHS. From what I've read, it was quite responsive before that happened.

When tornados tore through my neighborhood the city acted quickly; VERY quickly. IEMA (Illinois' version of FEMA) took weeks, FEMA took months.

Re:Not necessarily monoculture

[Reziac]

Further, I wonder what would be defined as 'critical'. Certainly it would start with infrastructure, but at some point it's going to creep into everything at every level, as nearly every gov't regulatory function before it has done. Twenty years from now your home network could conceivably be deemed 'critical' because you happen to work for the power company.

Re:Not necessarily monoculture

[cayenne8]

Man...triple whammy this week.

In addition to the Feds taking over our Internet, and other fun stuff...looks like Senate Bill SB 510 apparently passed.

The he Food Safety Modernization Act is so broadly worded...that it could really kill out local farmer's markets, organic farmers....and the parts I don't like, may make it legal only for big companies like our friends at Monstanto, to be in charge of storing and distributing seeds.

Man...what is the deal these days with the Feds and the intrusiveness? I mean..it doesn't get much more basic that FOOD.

Re:Not necessarily monoculture

[deapbluesea]

But if the approach is to require private enterprise to demonstrate compliance with full-blown government IT security C&A with the government doing the certification

The government C&A approach should be enough for anyone in the know to run screaming from this. It basically amounts to a massive enumeration and mapping of the entire network, performed on an unrealistic schedule by people who don't necessarily know what they are looking for, then the autogeneration of mountains of paperwork based on the mapping, followed by a signature by a CEO type that basically says he is criminally liable for any security breaches henceforth. When we did this process my work site several years back, we actually wheeled in three carts carrying 6 file boxes each filled with the paperwork that the certifying authority was being asked to sign. The worst part? Aside from verifying that all systems were patched to approved levels, I can't say what kind of security that process guaranteed.

Now imagine the private sector doing this for a government authority. IRS anyone?

Re:Not necessarily monoculture

[mcgrew]

It could be worse.

(WASHINGTON) . An agreement was reached on an amendment co sponsored by North Carolina Sen. Kay Hagan to the Food Safety Modernization Act, which is being considered by the U.S. Senate. The amendment protects small producers from excessive government regulations in the bill. The final version of the bill is likely to be voted on in the Senate soon.

"This amendment is a critical change to the food safety legislation and will protect our small producers from excessive government red tape," Hagan said in a press release. "Senator Tester and I worked with our colleagues to ensure this amendment's inclusion in the final food safety bill, and this protection will benefit small farmers across North Carolina. Agriculture is our state's largest industry, and I am working in the Senate to ensure we can grow jobs in this tough economy."

Under the amendment, small producers will continue to be regulated at the state and local level. The amendment applies to small producers who sell most of their food directly to consumers, local restaurants and retailers within a 275 mile radius, and producers that earn $500,000 or less in annual sales.

Re:Not necessarily monoculture

[slick7]

It could be worse.

It is. Two words, Codex Alimentarius.

DHS DHS.. it sounds so familiar...

[Anonymous Coward]

remind me why it wouldn't be such a great idea to give them a say in this process?

New security rules from DHS

[Jason_D_Berg]

All employees accessing sensitive networks must now remove their shoes...

important changes

[glebovitz]

I hope they don't require a genital pat down to use the Internet.

Re:important changes

[Anonymous Coward]

But that's exactly what I use the internet *for*!

(captcha: harden)

Re:important changes

[snspdaarf]

Judging from what eventually comes back on almost any google search, I suspect the internet is used to get ready for a genital pat down.

Re:important changes

[Anonymous Coward]

Well, that might not be so bad depending on which sites you happen to be visiting ...

Re:important changes

[Anonymous Coward]

I hope they don't require a genital pat down to use the Internet.

Wouldn't that just be considered foreplay?

Re:important changes

[ikkonoishi]

Some would consider that a feature.

Re:important changes

[Anonymous Coward]

If you're going on the Internet, you were just going to do it yourself anyway, this way the government gets to feel like they're doing something useful.

Re:important changes

[Anonymous Coward]

yes, they'll get a lot of stick for doing that.

Re:important changes

[Anonymous Coward]

Are you kidding? That would be wonderful while visiting *ahem* certain sites.

Re:important changes

[Anonymous Coward]

Catch-22. If the Internet is used to prepare for a genital pat down, and a genital pat down is required before using the Internet, we've reached a deadlock. An oddly apropos denial of "service."

Re:important changes

[Anonymous Coward]

I know right? Ill never again search for what i think is a simple phrase, like 'I'll be in my lab'

Re:important changes

[The Wild Norseman]

I hope they don't require a genital pat down to use the Internet.

You're not married, are you?

Proactively fighting post terror.

[retech]

So if they do this like their other wonderful policies I cringe to think of what will happen...

Those companies will see their mail servers flooding the net with botnet spam. Their websites will be littered with porn pop-ups. The and all of their secure transactions will no doubt authenticate via a .ru connection.

Think about it

[pjt33]

You obviously haven't thought this through. Remember, torrent sites steal billions of dollars from hard-working cinematographers. Where do you think that money is going if not to tiny camps in inaccessible parts of distant countries in order to wreak damage and destruction in the heartland of America? Honestly, this stuff is so basic that any junior congressman could understand it...

Re:Think about it

[elrous0]

Remember kids, downloading Harry Potter is downloading T E R R O R I S M ! ! !

Alternatives

[Ukab the Great]

Or we could ban software companies lobbying to lower security standards and we could push for changing government pay grade scales for security experts so gov't actually has a chance of competing for talent with the private sector.

New corporate dilemma

[way2trivial]

choices, choices

do we want to be "too big to let fail" or "not critical to national security"

No.

[moxley]

No.

Not entirely a bad idea

[dbIII]

Somebody should get those Diebold ATMs off the public internet and back on a WAN like they should be.

Like PCI compliance?

[Anonymous Coward]

If this is done in a similar manner as PCI compliance for handling credit card information then I wholeheartedly welcome this addition. I see no reason not to have the government set a baseline of security for crucial infrastructure (everything patched, firewall in place, no open relay mail servers, etc).

I think this is one of those situations where the devil is in the details. This could be a good or bad thing but it all comes down to the implementation and enforcement of such a program. I'm as worried as the next guy to have DHS poking around in my systems but that's not necessarily what this entails.

Insanity

[anorlunda]

If you want to send any enterprise down the tubes, start by giving one group the authority and another the responsibility. DHS wants to dictate standards but when the next big blackout occurs will DHS rush to accept the blame?

Have we considered the risk of self-inflicted damage caused by ill-conceived government-mandated software?

You don't need to be a libertarian to see that this is insanity.

Obligatory Vader...

[digitaldc]

Vader says...

Who can spot the real problem?

[GameboyRMH]

private sector companies considered part of the country's critical infrastructure.

*Insert Jeopardy music here*

"Enforce Standards" != "In Charge Of"

[sirwired]

DHS has been given authority to ensure critical networks are up to federal security standards. Apart from the discussion of if this will be useful, this does not, in any way, put them "In Charge" of the networks.

Re:"Enforce Standards" != "In Charge Of"

[mu51c10rd]

As anyone aware of the "security and accreditation" program of the DoD can tell you, this will just spawn another army of government contractors doing audits on the basics. Just like SoX was supposed to prevent large corporate breakdowns (didn't help the latest round of collapses like Lehman Brothers and Merrill Lynch), this will not help. It will merely feed the pockets of the big government contractors and not "secure" anything.

Re:"Enforce Standards" != "In Charge Of"

[The Wild Norseman]

DHS has been given authority to ensure critical networks are up to federal security standards. Apart from the discussion of if this will be useful, this does not, in any way, put them "In Charge" of the networks.

And what happens when a company controlling a network fails those federal security standards? "The power to destroy a thing, controls a thing."

A million dollar fine perhaps? Who will then pay for the fine? The company itself, right? What if the company cannot pay because the fines are too high? The company can't fail, it's a part of our nation's critical network infrastructure. So what then?

And why are you sure of this?

[sirwired]

Before you go ranting and accusing the government of fascism, maybe you could actually, you know, READ the proposed legislation, and then cite the passage where you have found this provision?

Re:And why are you sure of this?

[mr_mischief]

The standards won't be in the legislation, which you can be sure most of the Congress hasn't read anyway. The law will just assign some agency (most likely DHS itself) with setting the guidelines. Those guidelines will give some office of the agency or the President the authority over when to switch from an everyday set of guidelines to a stricter set for "national emergencies".

Why don't you follow your own advice to read the bill? Then you'd see that if it's passed:

• the agency sets the standards (section 224, subsection c)
• the director of the agency determines which private networks are covered (section 224, subsection e)
• the agency approves up the specific plan for each private network (sec. 224 f)
• the operator of the private network must pay to certify that they meet the criteria
• the operator must submit to government audits (224 i)
• the private network operator could be fined up to $100,000 per day for each instance of noncompliance (224 m)

So, what type of government exactly puts a private company under such close regulation of day-to-day business to assure the company reinforces the stability of the regime?

ROFL...

[Anonymous Coward]

I work IT for FEMA, I can tell you first hand that DHS's network is one of the most hosed up messes I have ever seen... this is the last thing we need.

i see this to be about

[nimbius]

as useful as PCI (Payment Card Industry) standards. a great idea with loads of rules to keep things on the right track, but no real punishment for repeat offenders or major breeches. in short: just another meeting on my calendar.

DNS Verisign USA

[54mc]

DNS moving from the hands of Verisign and into the hands of the government? Sounds like "Out of the frying pan and into the fire" to me.

MOD PARENT UP!!!

[Anonymous Coward]

This post rings the bells of justice and enlightenment

U.S. control of internet slipping in 3,2,1

[unity100]

First, the bill to censor internet and get ahold of any domain name, with a court order

now, the ability for a single department of u.s. government, without requiring a court order, to control private networks,

Couple these two with the draconian and stupid copyright/patent laws in usa, and you can see that it wont take a few months after this for u.n. or eu to come up with an alternative, international or european authority to govern domain names and ip numbers.

way to go, u.s., cutting the leg you are standing on. any other country would cut its own real legs (metaphorically) rather than risk losing the de facto control of internet.

maybe it was high time.

I'm picturing this.

[fishbowl]

A DHS uniformed guy on a folding chair in front of the server closet in the 4-member IT dept of a small company that is, among other things, a defense contractor. This uniformed guy checks the sysadmin's badge each of the 20-50 times a day he goes into the server closet. The rest of the time he sits there doing search-a-word puzzles or watching a portable tv or whatever. I'm as horrified by this image as I am amused by it.

Re:I'm picturing this.

[fotbr]

Don't forget the eventual progression into full-body scanners and enhanced patdowns before being allowed into your server room.

Re:I'm picturing this.

[realityimpaired]

If your sysadmin needs to physically open and access the server cabinet 20-50 times a day, somebody's not doing their job right....

you will ?

[unity100]

you will have to forget before doing that, the fact that ACTA was initiated, prepared and cooked and started being pushed around in republican term in congress, senate and admn., before 2006. at 2006, it was already during international negotiations stage, first by being pushed to canadians.

DHS not NSA... umm NO

[Anonymous Coward]

I worked in the security industry for many years and we had contracts with a number of government departments, major ISPs, and enterprise businesses. Our talks with the DHS ended when they suggested making a Windows-based version of our Linux-based network security server. The conversation went something like this:

Us: "Sure we could do it, but it would cost more, be slower, and have poorer performance because we wouldn't be able to modify the OS directly to support what we need. You'd need a significant number more machines to do the same task, each machine would cost more, and the project would be delayed at least a year while we developed it and went through the security certification process again. Additionally, the security would be weaker and these should be high security systems as they have access to all the traffic running through your network and are already managing the traffic."

DHS Security Guy: "I think that's the way we want to go."

Us: "Do you mind if we ask why?"

DHS Security Guy: "I don't like managing non-Windows systems."

Maybe things have changed over there in the last few years but... dear god! They were some of the most incompetent Microsoft loving fuckwits ever. We had a contract with Microsoft at the time and they were cool with our Linux based solution and were even considering installing custom Linux systems of their own design to supplement the limitations of their Juniper routers with regard to network traffic management and security.

Social hacker's wet dream

[Anonymous Coward]

If this is anything like the DoD or rest of the governments security policies it will drastically reduce the productivity of those using these 'critical networks'. And of course lets not forget the all the post-it notes with passwords on them this will create!

Follow the money

[barzok]

How would this benefit Rep. Thompson's campaign & PAC funding? "Defense Electronics" firms are the #3 contributor to his campaign & leadership PAC for 2009-2010. "Computers/Internet" were #3 for the 2008 campaign.

http://www.opensecrets.org/politicians/summary.php?cid=N00003288

Re:Follow the money

[geekoid]

What are you talking about? I don't see defense electronics or computers/internet on that page. I do see donors this would hurt.

Re:Follow the money

[barzok]

Try http://www.opensecrets.org/politicians/summary.php?type=C&cid=N00003288&newMem=N&cycle=2010 & http://www.opensecrets.org/politicians/summary.php?cycle=2008&type=C&cid=N00003288&newMem=N

I linked to the default page, and indicated which options to select to get the results I saw.

Feel Safe

[morgauxo]

Senator Palpatine will protect us!

TSA is under DHS

[scorp1us]

So we'll have the same policy for fliers as packets? Deep, humiliating inspections?

Here's one letter-writer

[Byzantine]

Representative Thompson is my congressman. He'll be getting a letter from me expressing my opposition to this measure.

Hmmm.

[Anonymous Coward]

Why does the DHS think they have a better solution to this than the private companies?

From what I know all the smart people go to the private companies, NOT the government in order to get better pay.

You can't fight security with legislation

[Anonymous Coward]

A simpler solution is to keep your executables and data separate and don't allow write access to the executables - simples ;)

I wouldn't even support that.

[khasim]

Instead of mandating what should be deployed, stick to testing the defences of the companies.

Fine them if the DHS crackers can gain access.

As a side benefit, it would discourage the monoculture. Different companies would deploy different systems and that would make it almost impossible for a single attack to crack them all.

Any Better?

[TheNinjaroach]

I think this begs the question, why does anyone believe that government goons would be more capable at managing a network than the private IT goons who built it?

Personally ...

[PPH]

... I welcome our fondling overlords.

Wrong - DOI is

[Anonymous Coward]

The Department of the Interior is the worst government entity. DHS - who gives us the TSA - is a close second.

I'm experiencing deja moo

[russotto]

...that is, I've seen this bull before. At least twice, previously phrased as an "internet kill switch". Unfortunately, the problem with bad ideas is they're almost certainly to eventually become law.

Define 'critical'

[PPH]

I have no problem with contractors agreeing to some sort of security standard as a condition of doing business with the government. At least they are going in to their relationship with their eyes open. But what constitutes a 'critical' network? And can the feds put my system on the list without my input?

If I offer some goods or services and one day, a customer walks in my front door with a GSA credit card, does that make me a vendor to the government? If they say 'we simply must have your product/service to perform our function' does that make it critical? Can I throw them out the door?

Re:Define 'critical'

[Shoten]

The DHS defines "Critical Infrastructure and Key Resources" on this website: http://www.dhs.gov/files/programs/gc_1189168948944.shtm ("Key Resources" refer to things like national monuments that, while relatively irrelevant to the operation of the nation, are nonetheless impossible to replace and likely targets of attack.)

It's not a matter of being a vendor to government, it's a matter of being an industry (not a company) where industry-wide failures would result in material impact to the security of the country due to interdependencies. If there's an impact to the petroleum products distribution infrastructure, for example, then there's no gasoline, avgas, or diesel. Trucks can't resupply supermarkets, planes can't deliver goods or passengers, and in short order, first responders (cops, firemen, ambulances) can't travel except on a very limited basis. That doesn't make the gas station a critical asset, since an awful lot of gas stations can get shut down without mucking up the works...people will just have longer lines as they go to fewer stations. But, on the other hand, the petroleum depots...well, since one of those services an enormous area...one of those is quite critical.

Great

[denshao2]

Let's get some outsiders who are totally unfamiliar with what we do to fix our problems for us in emergencies.

Re:Great

[Anonymous Coward]

Ah! You've worked with an outsourcing firm too!

S.510

[Anonymous Coward]

DHS is taking over everything.

real world costs

[Anonymous Coward]

Gov mandated stuff, along with allowing just totally insane lawsuits to go forward with decades old equipment, well above what is really required, has driven the cost of a new cessna 172 to HALF A MILLION DOLLARS. This should be like 50 grand new by now with modern manufacturing techniques, etc. This model is the most produced airplane ever, it works, etc. So instead of people being able to use a brand new plane, they are forced to try and keep old rattle traps flying that should have been (and would have been) scrapped years ago, because it is the only affordable way to own a small plane today for most people.

So expect compliance and so forth in other areas to see similar price hikes. Not to mention the dotgov "owning" everything, a worrying trend.

The US by original design was supposed to be different from all other nations, people were supposed to deal a lot more with their own security in exchange for a lot more freedom.

As a side note, Ron Paul has introduced legislation to kill off all that TSA nonsense in the airports now.

Man I wish he had gotten elected instead of mclame or obummer. Perople just will never learn that if they elect the media picked for you "front runner" candidates they brainwash people into supporting it is the same old shit after the elections, and it never fails. I've watched this happen over and over again for decades now.

If RP had gotten in, the wars would be over, he as in CinC would have just ordered them all home, those stupid too big to fail banks would have gone bankrupt and those toxic derivatives destroyed like they deserve to be, GM would have been busted up and some new blood and new ideas would have taken over their factories and be producing real innovative transportation products, the Fed would have been taken down several notches and the treasury put back up to create new money without charging ourselves interest, the explosive growth of gov mc jobs that pay way more than they should would have ended, and a host of other freedom and economic "makes sense" measures at least brought to the forefront for debate.

I have no idea how shitty things have to get to get the herd to realize this either. Doing the same thing over and over again and expecting different results is mega cuckoo.

Re:real world costs

[Anonymous Coward]

Americans rejected Ron Paul not because they are "the herd," but because they love gov't entitlement programs like Medicare and Social Security. Whine all ya like, but as long old people are the majority of the voting bloc, nothing's gonna change, hombre.

Re:real world costs

[element-o.p.]

Don't know why you posted AC. That is, IMHO, one of the most insightful posts I've seen in a long while. Well said.

How about the TSA?

[Anonymous Coward]

Lets just put the TSA in charge, maybe they can grope each packet.
That will keep us safe.

Good

[geekoid]

they clearly aren't doing it themselves, and there is no market choice in these situations.

Rules == Programs

[rlglende]

Engineers and programmers have the answer to these questions, if only we apply our various understandings.

Do you want to be given the task of designing and implementing a real-time control system for an open system, that is, a system which has major inputs that are not under your control?

Programming for an open system is a conceptual oxymoron. Can't be done.

Even before considering the human/social system, which always leads to the regulators being taken over by the regulatees, and before we realize that the response times of legislation and regulators is orders of magnitude slower than the environment being regulated, regulations don't work because they are trying to do the impossible.

You can't point to regulations that 'work' at a system-level. The FDA is a fine example : a very simple mandate "rules and regulations to make food and medicines safe", yet it has become protection from competition for the few remaining drug companies, drugs are still remarkably unsafe, very few new drugs are developed, the costs of drugs are very high, and the drug companies have thus become one of the major owners of our government. We continue to die because we can't afford the drugs, because they are unsafe and because the needed drugs have not been developed because of the very high costs.

It seems to me that the only laws that make sense are ones that require honesty : In any exchange of value, both sides must disclose all the information needed by the other side to make an intelligent judgment and must check that the other party has indeed understood that information, and this requirement is proportional to the value being exchanged.

Clearly, the regulatory model has not worked. Clearly, it cannot work, based on elementary understanding of mathematical chaos, computational complexity and the emergent properties of systems.

This

Save us Cory Doctorow!

[billybob_jcv]

Fiction is becoming reality.

too big to fail

[Anonymous Coward]

I disagree. What they have done now by not allowing them to fail is to further put all of us at risk for an even worse catstrophic failure in the future. Those quadrillion dollar bets on bets on bets on bets need to go! They are absolutely NOT critical for an international economy, they exist only to further enrich those massive economic skimmers called "central banks". It's a con game and they used threats and extortion to get bailed out when they did fail.

Bankruptcy exists for one good reason, to eliminate failed business models. Those goons have WAY to much power and influence over the entire rest of the REAL economy, and needed to be eliminated and reduced in size and worth to what they are really worth, which is most definitely *not* QUADRILLIONS of dollars like the latest estimates of all their toxic derivatives are allegedly worth..

Too big to fail should mean too big to exist in the first place.

captcha ="nicking" or stealing. How appropriate.

Just for your edification

[rickb928]

This is the sort of idea that gets the Libertarians and other radical right-wing types all up in arms, screaming about socialism, government power grabs, and the need to throw the whole bunch out and put in toll roads and pay-as-you-go government.

They're still wackadoodles, and still marginalized, but this is their bread and butter.

A stupid idea, unless, of course, you are willing to cede to the federal government both responsibility and authority to run the country directly. Not just govern, but operate.

Me? I'm opposed to it on these grounds:

1. The apparent assumption is that private industry can't be trusted to do this. As a rebuttal, consider that private industry has more to lose on their own than if DHS takes over. Beyond that, is DHS demonstrably better at security than private industry has been, at least in these scnearios?

2. Despite the obvious security concerns, and the potential harm to our nation, how did government get appointed to the position of protecting us from ourselves? Is this a Constitutional exercise of power? I propose it is UNConstitutional on its face.

3. Regulation, perhaps, is a better path. The Clean Air and Clean Water acts offer some experience with the government dictating how things should be done. Yes, we are better off. Does the same apply to industrial network security? Well, maybe not.

Let's get on the phones and kill this, so we don't have to wait for another election cycle to convince the retards in Washington that we are not at all amused. Ok?

NSA should have this jurisdiction

[MikeRT]

If anyone is going to do this, it should be the NSA, not DHS. Why, you ask, would I trust a military agency over DHS?

1) The NSA is regulated by DoD regulations which prevent it from working as a domestic law enforcement agency.

2) The NSA can very rarely share information with law enforcement because its methods are not legally admissible in most court cases (and they're not supposed to be, since the NSA's purpose is to support the military and operations abroad where civilian courts don't even have jurisdiction in many scenarios).

3) The NSA actually knows what it's doing with its own infosec, unlike DHS.

Deus Ex

[Syberz]

Am I the only one who finds similarities with how the DHS is getting more and more control over things, just like FEMA did in the first Deus Ex game? That didn't end well...

Snide but pointless

[Anonymous Coward]

Firstly, one does not eat, drive, watch or otherwise consume "income". It's obvious that both American workers and CEOs now consume more, of better stuff, receive better medical care with treatments that were not dreamed of 50 years ago, casually use communication services that only super-rich could afford 50 years ago, etc.

Some of us think this happened because politicians of the US ruling parties did not overly concern themselves with how much people *should* be, in their view, paid for everything they do. In the countries where ruling parties ran their economies so that no one profited overmuch, life mostly sucked for most of the people.

And yeah, I was born in one of these, called the "USSR". Look for it on the map. Salary caps, price controls, and other "wealth redistribution" worked really well for it.

Re:Snide but pointless

[IgnoramusMaximus]

Firstly, one does not eat, drive, watch or otherwise consume "income". It's obvious that both American workers and CEOs now consume more, of better stuff, receive better medical care with treatments that were not dreamed of 50 years ago, casually use communication services that only super-rich could afford 50 years ago, etc.

Except, of course, the inevitability and the "better" nature of the "stuff" is in the eye of the beholder. That is, would this "stuff" be unavailable in any other scenario and does it actually improve lives? The answer is "no" to both questions for much of this "stuff". Today a typical household leads a far more hectic and slavish life-style than mere 50 years ago: both parents must work to support the family, while 50 years back a single-income household was the norm and not only could one parent afford to stay at home but that one income allowed for the house and everything in it (and even the car) to be fully paid for. Today this is a fantasy, nearly 90% of American households have negative net worth, that is everything they "own" actually belongs to the bank. That is not what I would call an "improvement", unless you are a banker or a member of the super-rich aristocracy who owns the banks of course.

So I find your method of measurement of "progress" in piles of disposable plastic crap from China and $90 bucks a month cable-TV full of brain-destroying "contents", coupled with $20,000 balances on 25% interest credit cards to be rather suspect. Also I am rather confident that contrary to what you appear to believe, civilization would have somehow managed to grind on without Twitter and Facebook.

And yeah, I was born in one of these, called the "USSR". Look for it on the map. Salary caps, price controls, and other "wealth redistribution" worked really well for it.

I find smug bragging by the believers in the "free market" about how inferior, deficient and ill-conceived the Soviet economic system was and how that lead to its inevitable collapse, whilst in the middle of the collapse of the oh-so-superior capitalist "free market" economies to be rather pathetically amusing. Next thing I am expecting to hear is how the West is not "really" "free market" and how it wasn't "pure" enough ... at which point some communists will probably cut in with the exact same tune except with Marxism as the lyrics.

In actuality both share the same core problem: a small group of individuals managed to pervert the entire thing at everybody else's expense because both systems turned out to be helpless against powerful thieves and because accumulation of wealth and power is self-accelerating. And if the crooks are called "commissars" and "comrades" or "CEOs" and "bankers" makes very little difference in the end.

Re:Snide but pointless

[cusco]

Indeed. And bad as life might have been under Stalin or Mao, life under their predecessors was considerably worse. One need look no further than Cuba, and compare the lot of the average Cuban over the last 60 years with that of the average Guatemalan or Colombian over that same time period to see that capitalism doesn't automatically lead to a better life.

Re:Snide but pointless

[IgnoramusMaximus]

And bad as life might have been under Stalin or Mao, life under their predecessors was considerably worse.

Quite so. It never ceases to amaze me that all "true believers" in the religion of capitalism never get this point: the communist revolution would not have happened and succeeded if the crony capitalists of the day did not organize these nations into hell-holes where rare, glittering palaces of thieving capitalist aristocracy peppered the land surrounded by a sea of starvation and abject poverty. A great majority of Russians and Chinese saw communist ideology, with all of its warts, as a vast improvement. It was only many decades later when mindless consumerism managed to topple the ponderous state-capitalist order (they actually never got as far as communism in practice) but not before the former penniless peasant slaves had all of their kids university educated and feeling indignantly entitled to Levi's Jeans and Sony color TVs.

Actually, it is not that all of the capitalism-or-bust priests do not get it, some studiously pretend not to see it because a tiny island of astronomical wealth amongst a sea of poverty is what their "ideal", dog-eat-dog, "Darwinian" world looks like: after all where would all the slavish, trembling chamber maids to do the laundry and polish one's precious Ming Dynasty vases come from otherwise?

Critical Networks such as

[ThatsNotPudding]

4chan.

"Communications"

[Caerdwyn]

Such firms include utilities, communications providers and financial institutions.

Thus giving DHS full regulatory authority to, though that "enforce" word, monitor your ISP and your bank real-time (something the NSA was never allowed to do legally).

And once again Big Brother's tendrils are set to grow.

Where is this power derived from?

[G3CK0]

I just had another look at Article One, Section Eight of our Constitution, and do not see anything that could grant this type of authority - am I missing something?

Software

[Anonymous Coward]

That's because software for the most part isn't required to have a warranty. Change that, that it must be free from glaring defects and suitable for purpose, the same as any other "product" that can get patents, and overnight they will take software and the internet WAY more seriously with regards security.

Title is totally misleading

[Shoten]

This bill doesn't put DHS in charge of anything at all, any more than the IRS is in charge of your finances just because you have to report income, or the SEC runs private companies because they have to comply with certain regulations to maintain transparency. What it does is mandate a NIST 800-53-based approach to securing the networks. That approach actually works pretty well, but it's a fair amount of work since you end up looking at groups of systems in terms of the processes they perform together (like a specfic database server, the middleware server that accesses it for a specific application, and the web server that provides a presentation layer for the middleware) when thinking about security.

The problem with this bill isn't the standards that it mandates, or that DHS would be the entity yelling at companies for failing to comply...it's that "Critical Infrastructure" industries, in legislative terms, refers to 17 different industries, which in combination are an ENORMOUS amount of our economy. One of them, for example, is the IT sector. Dropping a regulatory requirement like this on all of them at once, simultaneously, will be very good for people who do security consulting for a living (like me) but will be hell on the thousands of companies that will have to scramble to get into compliance.

WOOOHOOO!!!!

[GameboyRMH]

The good news is you can probably hollow out a laptop battery and remove all that perfectly legal explosive Thermite-like Lithium-Ion stuff and replace it with illegal contraband Mountain Dew. But think of the CHILDREN, man!

"Natehoy sets a high score by an unprecedented margin in the Slashdot Defeat Airport Security Championships with astronomical Irony points! AND THE CROWD GOES WIIIILLLD!" *AHHHHHHHHHHH*

"Unbelievable! It's gonna take one hell of a performance to top this one Tom! We've just witnessed history in the making!"

Big government serves big business

[countertrolling]

The basic intent of the bill was to wipe out the competition. All the problems with the food supply so far have been traced back to the big operators. And yet we see: "Outreach to food industry sectors.."

This poll (probably fairly accurate) shows 12% supporting the bill. Clearly it must pass :-/ Bad democrats! This is another trophy on the mantle for the republicans if they ever wanted to play it right.

More info

This is like health "care" "reform" for food. A bureaucratic wonderland to create a culture that could put us in danger of a real famine. Eh, time to cull the population, I guess. Drown 'em in paperwork. It's madness, I tell ya.. Madness!

From what I can gather from the amendment is that it only delays enforcement on small and "very small" business for one and two years respectively.

It's a very horrible bill, as toxic as anything that has passed over the last ten years, giving the feds permission to march onto your farm on any pretext of "food safety". You can bet this "cyber security" bill is no different in the draconian powers this gives to the government.

DHS is the LAST group that I want security from

[Anonymous Coward]

I know some of the top ppl that went into DHS. They were F'ing IDIOTS. Hell, just look at what they consider Secured. They get cracked REGULARLY themselves. Yet, they are going to secure the USA private network?

This absolutely should the NSA that does this, not the idiots from DHS.

economy

[Anonymous Coward]

Rightly so. After all torrent sites ARE thieving millions and billions from content creators that deserve to be paid.

And where is the facsist takeover?

[sirwired]

I like how you completely ignored my original point. Where did ANY of that bill include DHS being able to seize networks in the event of a disaster? I did read it (hence my original challenge.) A provision like that is NOWHERE in there. At all. Not even close.

Your summary is that of a 100% bog-standard regulatory bill. You could have substituted the word "meatpacking plant", "stock brokerage", "bank", "electric utility", "airline", "insurance company", "monopoly", or "drug manufacturer" for "private network" in your summary and you would have summarized just about every U.S. regulatory bill written any time starting around the beginning of the 20th century. One of the functions of government is to regulate many different classes of private commerce. The constitution says they can do so, and pretty much every government outside of Somalia does this (or at least pretends to.)

Oh, and the one bullet you didn't include a cite for: "the operator of the private network must pay to certify that they meet the criteria." Looked for that in the bill, and I can see why you didn't include a cite. It's not there. (I searched for pay, cost, costs, and certify.) Did you just make it up? Just like the evil plot to sieze the networks in an emergency?

Re:And where is the facsist takeover?

[mr_mischief]

If you don't call coming up with the plan, sending it for approval, rewriting parts of it in case of rejection, implementing it, doing increased internal audits not just to your security standards but to make sure you don't get fined, and bumping up staffing just so the government audits don't take your staff's productivity to zero during the audit a cost then either you're just absolutely clueless about network management, you're being very short-sighted, or you're just trying to pick a fight. When have you ever known of any "bog-standard regulatory bill" that didn't cost a business money in order to prove their compliance? In fact, if you actually searched for "certify" you must have been sloppy to miss the entire paragraph:

‘‘(i) ENFORCEMENT CERTIFICATIONS, AUDITS
AND
  INSPECTIONS.—The sector-specific agency or first-party
  regulatory agency, in enforcing the requirements under
  subsection (c), shall require an entity with a cybersecurity
  plan approved under subsection (g) to certify that the cy-
  bersecurity plan has been implemented, and may conduct
  announced or unannounced audits and inspections of any
  such entity to determine compliance.

You don't have to own something to control it. I'm not talking about a GM-style forced buyout. One way in which this control could be (although this particular would depend on requirements put forth and possibly the operator's answer) asserted is for the accepted plan to require a government response team in the event of a breach, attack, or heightened risk profile. Yeah, that's speculation, but the Obama administration has a history already of stepping in to tell businesses how to operate in a crisis even when terrorism and warfare have nothing to do with their issues. The sub-department proposed has a wide latitude as the bill is stated for making recommendations and accepting or rejecting plans. Yes, this is speculation, but it's informed speculation.

Currently, the bill provides for the US CERT to respond to a reported incident at the invitation of the operator of the private network. That wording would be quick and easy to change by the time it was passed, for one. During such a response they are supposed to, according to the act, coordinate with the private operator and recommend a response. There's nothing in the bill that limits the response to the private operator shoring up some aspect of security on the network. Having CERT, intelligence, or military network folks proactively respond with a counterattack is spelled out in the Federal network portion of the bill, and it is not barred by the private networks portion of the bill. The CERT running the network or some other agency taking it over for a period of time being the recommended action in response to an attack is also not barred. All it makes clear is that it (under current wording, which of course as a bill is subject to change) requires that the CERT be invited by the network operator. Yet it doesn't bar that invitation being a standard part of the accepted and recommended security plan.