New Bill Would Put DHS In Charge of 'Critical' Private Networks

GovTechGuy writes "A new bill unveiled Wednesday by House Homeland Security chairman Bennie Thompson (D-Miss.) would give the Department of Homeland Security the authority to enforce federal cybersecurity standards on private sector companies deemed critical to national security. The Homeland Security Cyber and Physical Infrastructure Protection Act of 2010 authorizes DHS to establish and enforce risk and performance-based cybersecurity standards on federal agencies and private sector companies considered part of the country's critical infrastructure. Such firms include utilities, communications providers and financial institutions."

Comments

What's the alternative

[jeffmeden]

Considering how much a lot of those companies rely on their network infrastructure, if there isn't a provision for this then perhaps the alternative is to be prepared to take over the whole organization if/when they are crippled by an attack. I am not one for heavy handed government but someone needs to light the fire under these guys.

Re:What's the alternative

[lgw]

Has the DHS demonstrated that they are any smarter than the current crop? Is an enforced monculture somehow better for security than a variety of solutions? Is the DHS going to be immune to carefully chosen campaign contributions at the federal level, resulting an an all-Microsoft infrastructure?

The way IT for banks is regulated, by creating standards that the banks must comply with but not dictating specific solutions, might work OK here. But I have no faith that that's where "OMG, the government needs more power" is going to end up.

Re:What's the alternative

[mcvos]

My first thought was: why does national security even rely on private networks? But if there's one thing that the mortgage crisis taught us, it's that quite a lot of our economy can be easily messed up by a handful of irresponsible banks. Of course the same is true for telecommunication companies and our communication infrastructure.

Re:What's the alternative

[TrisexualPuppy]

And how hard is it to apply what you have hopefully learned with the rest of the legislation passed in the ten years?

Repeat after me. This legislation exists to build a presence.

At the best, it will do what the FAA's legislation has done to General Aviation over the past fifty years. Overregulation of federal standards which cripples usefulness/availability and stagnates innovation because new ideas are either illegal to implement, or they become too expensive to try. Give it five or ten years, and we will of course have the need for DHS to be able to overtake the Internet during "national technological emergencies" declared by the president. These boys would already have had that kind of legislation in place if any security problem really did exist on the Net and we had been attacked because of it.

Re:What's the alternative

[jeffmeden]

Not to straw man your other arguments, but the FAA has managed to keep people alive at an unprecedented rate. Considering the aviation disasters that befall less regulated nations on a regular basis (and even other transportation methods in our own nation,) I would have to politely decline the notion that the FAA is overstepping it's bounds. As someone who has put on a lot of miles in the air, I prefer to take my planes well regulated and safe, as opposed to innovative and in a crater.

Re:What's the alternative

[pete6677]

"be subject to periodic penetration tests sponsored by the government"

Just like commercial airline passengers.

Re:What's the alternative

[FiloEleven]

No, if the banks had been allowed to fail we would have entered a new utopia where money doesn't matter and people's net worth was based on how much good they could do in the world. As such, the "richest" people would have been the best people, and they could use the resources at their disposal to bring about world peace, the end of hunger, and OMG ponies!

See how easy it is to make unsupported counterfactual arguments?

It feels like

[Rosco P. Coltrane]

a deaf man telling others how to sing. Maybe they should get their act together before giving lessons...

I'll sit over here

[Megaweapon]

and wait for the Republicans to fight this government intervention tooth and nail. .........

Re:I'll sit over here

[IgnoramusMaximus]

That is due to the tremendous difference between the Democrats and the Republicans:

During the Republican reign within the last 50 years, the average, inflation-adjusted US worker's income increased -1% and the average CEO's income increased 500%. This stands in great contrast to the Democrats, under whom the average US worker's income increased -1% and that of the CEO mere 400%.

This shocking difference explains the dire straights your poor, rich corporation is in, thus necessitating further belt-tightening, "shared sacrifices" and other "austerity" measures...

Re:I'll sit over here

[divisionbyzero]

and wait for the Republicans to fight this government intervention tooth and nail. .........

You'll be waiting a long, long time. Chances are that most of the companies that would benefit from this legislation (i.e. large IT shops) donate more money to the Republicans than the Democrats. You act as if there is a fundamental difference in the parties rather than rationalizations for supporting whichever group gives the party more money. Neither of the parties believe in the principles which they espouse. They simply cater their rhetoric to whomever gives them more votes or money. This kind of stitched together ideology is full of contradiction. The Republican party as it exists now is a great example.

Re:I'll sit over here

[hedwards]

What's fucked up about the US is that "austerity measures" is just a code word for we're going to cut funding to things which even out the income distribution and welfare. So, that we can send the money to the rich who apparently are capable of printing money. Also that people are more concerned with the welfare of parasitic billionaires that the folks that actually produce the wealth.

I'm really curious as to where the wealth in the US comes from, because it apparently doesn't actually involve anybody having to work for it.

Re:I'll sit over here

[IgnoramusMaximus]

If you want to get serious about it, it all can be traced to the societal psychosis of celebrity worship that presents life as one gigantic casino: "You *too* can be a WINNER!!" (in tiny print: your odds are 1 in 4 billion, disqualifying conditions will apply, see lawyer before entering etc).

The con-men who benefited from this worked tirelessly for decade upon decade to slowly reshape the entire economy and the "common wisdom" of Americans to the point that things like "Credit Default Swaps" and "5th tier derivatives" are looked upon not only as a serious endeavor but as a legitimate "investment", while some 200 years back they would be seen as a joke of a scam.

Similarly, the average worker has become so confused that he disassociates his lot in life and reality from his make-believe "future" of a billionaire "winner". He is also told (and most amazingly he believes it) that the casino winners are wholly and single handedly responsible for him even having a roof over his head and food to eat and that he should be grateful to them for it and defend them, his current "benefactors" and future "peers" - no doubt in his mind about that, from any and all harm.

In short, America (and most of the "business" world) has become a vicious caricature of what a sane economy looks like and where the least valued activity (and lowest paid) is actual work to produce anything and the most revered kind of activity is high-stakes gambling with con-job money.

Some people believe, and I tend to agree with them, that the pivotal point at which this enormous scam became mainstream (at least in the financial realm) was when the fiat currencies became the norm instead of an exotic weirdness confined to impoverished countries run by "rulers" who sat on their suitcases ready to escape in the middle of the night at the first sign of the populace starting to catch on...

Better Yet

[ciderbrew]

Stop spending Tax, giving yourself more powers. You should have rules in place for internal departments and for any company that is THAT important, surely any contract set up would require some terms and conditions.

Re:Wording is vague.

[Rosco P. Coltrane]

If that just means new security standards that companies have to meet, then I can't see the harm in that

When the standards are defined and enforced by incompetents, they tend to be useless, costly and bad for productivity.

Pirates, not terrorists, are probably first

[elrous0]

Why do I have a sneaking suspicion that this law will be applied WAY more often to fight torrent sites than it will ever be used to fight actual terrorists?

Re:Pirates, not terrorists, are probably first

[Rosco P. Coltrane]

Why do I have a sneaking suspicion that this law will be applied WAY more often to fight torrent sites than it will ever be used to fight actual terrorists?

Torrent sites that aren't taken over by russian virus makers, where the files you download are guaranteed genuine and not cheap porn movies that have been renamed, certified safe by the government? Yeah, I'm all for that.

Re:Wording is vague.

[chemicaldave]

It's certainly the right idea if standards are all they're pushing. But I agree, the DHS shouldn't be involved in this. I can't see why they are in the first place other than someone used the word "terrorist".

Competence

[Anonymous Coward]

Considering that the DHS is probably one of the most dysfunctional, incompetent departments in the entire federal government, I find that more frightening than the terrorists.

What's critical?

[girlintraining]

As we saw with anti-terrorism spending, what's deemed critical and what truly is hasn't exactly ever been the same.

Lame Duck

[MikeB0Lton]

As if they haven't spent enough tax dollars they don't have.

This is the race to facism at its finest.

[mr_mischief]

I'm sure "federal cybersecurity guidelines" for a network include having Federal employees shutting down general non-critical access and putting control of the network under FEMA control whenever there's a disaster. That's great for a network owned by the Federal government. It's an abomination against the rights of the people and private companies to do those things to a commercial network on which millions of people rely for their own uses.

It's called "socialism" when the government takes over industry for the people. It's called "facism" when the government takes over industry to enhance the power of the government. Somehow I just can't see the government taking over control of networks the citizens use as benefiting the people more than the government.

Not necessarily monoculture

[bsDaemon]

This move doesn't necessitate a monoculture, it just depends on how they write the law and how those in charge of implementing it end up crafting regulations. As long as they're only enforcing standards and not a standard implementation, then its probably OK, as you stated in the second part of your post. For instance, if the regulation states that networks which have any convergence points with the public internet have, at all crossover points, IDS/IPS systems in place which meet a certain level of ability, then its up to the firm who owns the network to decide whether to go with a solution from Cisco, Juniper, Sourcefire, or another vendor, or to roll something home-grown as long as they can meet the requirements.

I'm sure most of the organizations which will be affected by this will already have most, if not all, the necessary security mechanisms in place. However, they may be out of date to some degree, not properly monitored, and some smaller organizations may be missing large swaths of helpful security infrastructure and best practices because it just hasn't "been an issue" for them in the past. This is probably a fairly direct result of the Stuxnet work/virus. Whether Federal mandates are actually going to help remains to be seen, but if they follow sane policy frameworks such as those outlined by the NSA IAD and the CNSS then this ought to be fine.

Since this is Slashdot, I'm sure at least a plurality will focus on the "private" in critical private network, as evidenced by the air quotes around 'Critical' in the lead line of the story, however when we're talking about power, water, and communications systems critical probably isn't strong enough a word to describe them, and their ability to operate is largely a result of government-enforced monopolies and government-enforced easements, so I wouldn't really call them 'private' either.

Re:Not necessarily monoculture

[anegg]

I have been involved in government IT security for many years now as an employee of a government contractor often hired to perform various parts of the government security process. One of the biggest problems with the government security "standards" and "processes" in place now is that there is practically no cost feedback to the controls. The policies all say that the cost of the controls should be commensurate with the value of the system being protected, but many of the security "approvers" demand gold-plated security, and are often opposed to signing off on anything less. (Hey - you can't be held responsible for a security problem in a system you approved if you simply never approve any systems.) There are numerous government systems operating either "unauthorized" or under "temporary waivers" (for years and years) because the security folks wouldn't sign off the controls.

These problems are with the government policing the government. I can't imagine it would be any different when they are enforcing the standards on commercial companies. Although private enterprises can and do go underboard with security, government monitors are almost certain to go overboard. I have some (but limited) experience reviewing IT security for commercial entities (financial services firms, oil and gas firms, pharmaceuticals) and they often "get" most of what needs to be done... with a few lapses (like connecting SCADA networks to the regular corporate network, which is also connected to the Internet).

If the approach is to have a few *simple* rules (like networks over which critical infrastructure communicates must be isolated from corporate networks that are attached to the Internet), then I think some government oversight wouldn't be bad. But if the approach is to require private enterprise to demonstrate compliance with full-blown government IT security C&A with the government doing the certification, I would predict drastic increases in costs, without necessarily dramatically increasing actual security.

Re:Not necessarily monoculture

[cayenne8]

I guess again..I just don't trust them.

Who's to say WHAT is a critical business infrastructure? Sure, it may start now with financial institutions, the power grid, etc...things I think many people could agree upon. But as with all govt. regulations....you will get scope creep, it is just the nature of the beast.

Look at the recent discussion here about the move to force many if not most websites to conform to new ADA guidlines?!?!

In that argument, they said the *MIGHT* not force private, small websites to comply....might not??

Once the Feds can get into private companies and tell them what to do...it is kinda like the mob, they get more and more and more involved. Once this starts spilling over into small businesses...the cost of regulations will likely knock a lot of the smaller guys off, and close the market to new competition from smaller businesses.

Re:Not necessarily monoculture

[LifesABeach]

I question, "Why the DHS?" In retrospect to the 'Katrina' event, and how DHS helped American citizens then; I see no reason to believe that the DHS won't repeat itself when it is involved in another 'opportunity in which to excel.' And now the TSA, a love child of the DHS has basically created an environment in which Horses Asses can be generated, without the need for the rest of the Horse. There's a reason why the rest of the Horse should be attached.

Re:Not necessarily monoculture

[hedwards]

As opposed to the current business practice of bolting on a tin can solution to a gold plated problem? I mean seriously, corporations rarely if ever spend enough on cyber security. A lot of the massive exploits were only accomplished because the corporation that got ripped off wasn't even implementing the most basic policies.

Having the government threaten to take over their network if they aren't properly secure it would likely go a long ways towards them actually behaving responsibly, even if the government never does it.

Re:Not necessarily monoculture

[Reziac]

Further, I wonder what would be defined as 'critical'. Certainly it would start with infrastructure, but at some point it's going to creep into everything at every level, as nearly every gov't regulatory function before it has done. Twenty years from now your home network could conceivably be deemed 'critical' because you happen to work for the power company.

Re:Not necessarily monoculture

[deapbluesea]

But if the approach is to require private enterprise to demonstrate compliance with full-blown government IT security C&A with the government doing the certification

The government C&A approach should be enough for anyone in the know to run screaming from this. It basically amounts to a massive enumeration and mapping of the entire network, performed on an unrealistic schedule by people who don't necessarily know what they are looking for, then the autogeneration of mountains of paperwork based on the mapping, followed by a signature by a CEO type that basically says he is criminally liable for any security breaches henceforth. When we did this process my work site several years back, we actually wheeled in three carts carrying 6 file boxes each filled with the paperwork that the certifying authority was being asked to sign. The worst part? Aside from verifying that all systems were patched to approved levels, I can't say what kind of security that process guaranteed.

Now imagine the private sector doing this for a government authority. IRS anyone?

Re:What is the determination?

[LordLimecat]

That has absolutely nothing to do with whats being proposed, according to TFA. This is about setting network security requirements and enforcing them, not shutting down threats of any kind. Grats on not reading the summary tho.

Re:Wording is vague.

[locallyunscene]

Thank you. I agree, defining standards are okay, but DHS should be the last one selected to do it. Networks like these need security not security theater.

important changes

[glebovitz]

I hope they don't require a genital pat down to use the Internet.

Re:important changes

[snspdaarf]

Judging from what eventually comes back on almost any google search, I suspect the internet is used to get ready for a genital pat down.

Think about it

[pjt33]

You obviously haven't thought this through. Remember, torrent sites steal billions of dollars from hard-working cinematographers. Where do you think that money is going if not to tiny camps in inaccessible parts of distant countries in order to wreak damage and destruction in the heartland of America? Honestly, this stuff is so basic that any junior congressman could understand it...

"Enforce Standards" != "In Charge Of"

[sirwired]

DHS has been given authority to ensure critical networks are up to federal security standards. Apart from the discussion of if this will be useful, this does not, in any way, put them "In Charge" of the networks.

DHS not NSA... umm NO

[Anonymous Coward]

I worked in the security industry for many years and we had contracts with a number of government departments, major ISPs, and enterprise businesses. Our talks with the DHS ended when they suggested making a Windows-based version of our Linux-based network security server. The conversation went something like this:

Us: "Sure we could do it, but it would cost more, be slower, and have poorer performance because we wouldn't be able to modify the OS directly to support what we need. You'd need a significant number more machines to do the same task, each machine would cost more, and the project would be delayed at least a year while we developed it and went through the security certification process again. Additionally, the security would be weaker and these should be high security systems as they have access to all the traffic running through your network and are already managing the traffic."

DHS Security Guy: "I think that's the way we want to go."

Us: "Do you mind if we ask why?"

DHS Security Guy: "I don't like managing non-Windows systems."

Maybe things have changed over there in the last few years but... dear god! They were some of the most incompetent Microsoft loving fuckwits ever. We had a contract with Microsoft at the time and they were cool with our Linux based solution and were even considering installing custom Linux systems of their own design to supplement the limitations of their Juniper routers with regard to network traffic management and security.

Follow the money

[barzok]

How would this benefit Rep. Thompson's campaign & PAC funding? "Defense Electronics" firms are the #3 contributor to his campaign & leadership PAC for 2009-2010. "Computers/Internet" were #3 for the 2008 campaign.

http://www.opensecrets.org/politicians/summary.php?cid=N00003288

TSA is under DHS

[scorp1us]

So we'll have the same policy for fliers as packets? Deep, humiliating inspections?

NSA should have this jurisdiction

[MikeRT]

If anyone is going to do this, it should be the NSA, not DHS. Why, you ask, would I trust a military agency over DHS?

1) The NSA is regulated by DoD regulations which prevent it from working as a domestic law enforcement agency.

2) The NSA can very rarely share information with law enforcement because its methods are not legally admissible in most court cases (and they're not supposed to be, since the NSA's purpose is to support the military and operations abroad where civilian courts don't even have jurisdiction in many scenarios).

3) The NSA actually knows what it's doing with its own infosec, unlike DHS.