Slashdot Mirror
New Bill Would Put DHS In Charge of 'Critical' Private Networks
GovTechGuy writes "A new bill unveiled Wednesday by House Homeland Security chairman Bennie Thompson (D-Miss.) would give the Department of Homeland Security the authority to enforce federal cybersecurity standards on private sector companies deemed critical to national security. The Homeland Security Cyber and Physical Infrastructure Protection Act of 2010 authorizes DHS to establish and enforce risk and performance-based cybersecurity standards on federal agencies and private sector companies considered part of the country's critical infrastructure. Such firms include utilities, communications providers and financial institutions."
I'll assume they can designate any forum they don't like as critical to national security due to terrorists using it to communicate.
Hmmm witty sig or funny sig? Maybe elitest techy sig!
and wait for the Republicans to fight this government intervention tooth and nail. .........
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with
Has the DHS demonstrated that they are any smarter than the current crop? Is an enforced monculture somehow better for security than a variety of solutions? Is the DHS going to be immune to carefully chosen campaign contributions at the federal level, resulting an an all-Microsoft infrastructure?
The way IT for banks is regulated, by creating standards that the banks must comply with but not dictating specific solutions, might work OK here. But I have no faith that that's where "OMG, the government needs more power" is going to end up.
Socialism: a lie told by totalitarians and believed by fools.
Stop spending Tax, giving yourself more powers. You should have rules in place for internal departments and for any company that is THAT important, surely any contract set up would require some terms and conditions.
If that just means new security standards that companies have to meet, then I can't see the harm in that
When the standards are defined and enforced by incompetents, they tend to be useless, costly and bad for productivity.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
It's certainly the right idea if standards are all they're pushing. But I agree, the DHS shouldn't be involved in this. I can't see why they are in the first place other than someone used the word "terrorist".
Considering that the DHS is probably one of the most dysfunctional, incompetent departments in the entire federal government, I find that more frightening than the terrorists.
As we saw with anti-terrorism spending, what's deemed critical and what truly is hasn't exactly ever been the same.
#fuckbeta #iamslashdot #dicemustdie
As if they haven't spent enough tax dollars they don't have.
They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety
I'm sure "federal cybersecurity guidelines" for a network include having Federal employees shutting down general non-critical access and putting control of the network under FEMA control whenever there's a disaster. That's great for a network owned by the Federal government. It's an abomination against the rights of the people and private companies to do those things to a commercial network on which millions of people rely for their own uses.
It's called "socialism" when the government takes over industry for the people. It's called "facism" when the government takes over industry to enhance the power of the government. Somehow I just can't see the government taking over control of networks the citizens use as benefiting the people more than the government.
This move doesn't necessitate a monoculture, it just depends on how they write the law and how those in charge of implementing it end up crafting regulations. As long as they're only enforcing standards and not a standard implementation, then its probably OK, as you stated in the second part of your post. For instance, if the regulation states that networks which have any convergence points with the public internet have, at all crossover points, IDS/IPS systems in place which meet a certain level of ability, then its up to the firm who owns the network to decide whether to go with a solution from Cisco, Juniper, Sourcefire, or another vendor, or to roll something home-grown as long as they can meet the requirements.
I'm sure most of the organizations which will be affected by this will already have most, if not all, the necessary security mechanisms in place. However, they may be out of date to some degree, not properly monitored, and some smaller organizations may be missing large swaths of helpful security infrastructure and best practices because it just hasn't "been an issue" for them in the past. This is probably a fairly direct result of the Stuxnet work/virus. Whether Federal mandates are actually going to help remains to be seen, but if they follow sane policy frameworks such as those outlined by the NSA IAD and the CNSS then this ought to be fine.
Since this is Slashdot, I'm sure at least a plurality will focus on the "private" in critical private network, as evidenced by the air quotes around 'Critical' in the lead line of the story, however when we're talking about power, water, and communications systems critical probably isn't strong enough a word to describe them, and their ability to operate is largely a result of government-enforced monopolies and government-enforced easements, so I wouldn't really call them 'private' either.
Thank you. I agree, defining standards are okay, but DHS should be the last one selected to do it. Networks like these need security not security theater.
And how hard is it to apply what you have hopefully learned with the rest of the legislation passed in the ten years?
Repeat after me. This legislation exists to build a presence.
At the best, it will do what the FAA's legislation has done to General Aviation over the past fifty years. Overregulation of federal standards which cripples usefulness/availability and stagnates innovation because new ideas are either illegal to implement, or they become too expensive to try. Give it five or ten years, and we will of course have the need for DHS to be able to overtake the Internet during "national technological emergencies" declared by the president. These boys would already have had that kind of legislation in place if any security problem really did exist on the Net and we had been attacked because of it.