Slashdot Mirror


President Obama Unveils $19 Billion Plan To Overhaul U.S. Cybersecurity

erier2003 writes: President Obama on Tuesday unveiled an expansive plan to bolster government and private-sector cybersecurity by establishing a federal coordinator for cyber efforts, proposing a commission to study future work, and asking Congress for funds to overhaul dangerously obsolete computer systems. His newly signed executive orders contain initiatives to better prepare college students for cybersecurity careers, streamline federal computer networks, and certify Internet-connected devices as secure. The Cybersecurity National Action Plan also establishes a Federal Privacy Council (to review how the government stores Americans' personal information), creates the post of Chief Information Security Officer, and establishes a Commission on Enhancing National Cybersecurity.

29 of 185 comments (clear)

  1. Let me be clear by erapert · · Score: 4, Informative

    "I only intend to improve the cybersecurity of the government while doing everything I can to undermine the security of regular peon-- er-- people."

    1. Re:Let me be clear by alvinrod · · Score: 3, Insightful

      Also, if it turns out to be anything like the healthcare.gov project, I question how effective it would be in terms of improving security.

      This sounds like a classic government program designed to funnel public money into the hands of a few private contractors or corporations. Remind me why the Republicans are opposed to this again.

  2. 19 Big Ones by Mr+D+from+63 · · Score: 4, Funny

    And that's just what it will take to clean up Hillary's email.

  3. First.... by saloomy · · Score: 3, Insightful

    They rule encryption is a form of a weapon, with restrictions on export. Then they want to ban encryption. Pray-tell, how is the govt going to certify anything as secure without the most robust encryption technologies and practices currently available? Or does it mean, certified backdoored?

    1. Re:First.... by gstoddart · · Score: 2

      LOL ... are you expecting a rational reconciliation between the fact that you can't undermine security and enhance security at the same time?

      For you and I, that would be cognitive dissonance. For people who think they can pass laws around technical problems, the wishful thinking just keeps going.

      Not understanding the technology makes it far easier to pass terrible laws about the technology and then fail to understand why those laws don't work.

      But, part of the problem is they fall short on some basic security things ... and that stuff probably does need some fixing.

      --
      Lost at C:>. Found at C.
  4. Re:Obongo by __aaclcg7560 · · Score: 4, Informative

    Overlooking the fact that George W. front loaded the debt for Obama by not paying for Medicare reform and tax cuts, and keeping two wars off the books.

  5. Oh fuck, he's appointing a COORDINATOR!! by NotDrWho · · Score: 4, Funny

    Looks like your days are numbered, black hats!!

    --
    SJW's don't eliminate discrimination. They just expropriate it for themselves.
  6. What he's saying is... by VAXcat · · Score: 4, Funny

    If you like your privacy, you can keep your privacy.

    --
    There is no God, and Dirac is his prophet.
  7. Re:EOs suck by Zephyn · · Score: 3

    Next you realize that 'unveiling a plan' and 'asking Congress for funding' have nothing to do with executive orders, and maybe, just maybe, resolve to not be such a knee-jerk when you see the name of a political figure that you regularly disagree with.

  8. Re:Obongo by kwiecmmm · · Score: 2

    I wish I had points to vote this up.

  9. Re:And never mind... by thaylin · · Score: 2

    That really shows that this is about politics and not governing. The GOP has decided to stop governing and take their ball home if they dont get exactly what they want.

    --
    When you cant win, ad hominem.
  10. The endless contractor cycle has to stop by ErichTheRed · · Score: 4, Interesting

    Most of the "cybersecurity holes" can be tracked down to some contractor slapping in an insecure installation of -whatever- to do the bare minimum needed to keep the contract. This is what needs to be fixed -- contracts need to be monitored closely and terminated in cases of poor performance. Security is a human error thing mostly:
    - Not removing default passwords and accounts
    - Leaving ports open and services running that aren't necessary
    - Not keeping up with product versions and patch cycles
    - Leaving unencrypted disks full of data on trains or in cars that get broken into

    The problem is that even big companies can't manage to get this right, let alone government agencies. Big companies fall prey to the same mentality of just hiring contractors. Even the NSA did this -- if there was ever an organization that needed to do their own in-house IT, that's definitely #1 on the list. Employees will care about security when employers start demanding it.

    The solution, which is nearly impossible to implement, is to make everyone involved step their game up. Hire real, full time employees who are committed to the agencies' or companies' missions at a level slightly above "I can keep my job." Make sure everyone is trained and double-check work.

    1. Re:The endless contractor cycle has to stop by NotARealUser · · Score: 2

      I've worked for companies that had pretty much all full time employees, and a stable workforce that was probably too dedicated to their company. Yet they had security issues too. I found that over-management actually encouraged mistakes in coding, even if it was their intention to help.

      I think the real issue here is that we expect managers, whether they be government officials or actual managers, to motivate people into providing better security. The truth is that every year, more inexperienced people enter the workforce while the experienced ones leave to retire. No matter how much security cheer-leading you can do, eventually, you get new people who screw up just because of lack of experience.

      I don't think this is a management issue at all. This is a technical issue that should be addressed technically. We can build better automated security checking that helps educate programmers where their code is lacking. We can pair new tech workers with more established workers, etc. But I don't think you are going to spend or manage your way about this issue. We will always have the dichotomy of experienced intruders targeting systems weakened by inexperienced tech workers (and vice versa).

      The solution is to accept the risk of these things happening and just doing the best you can to automate testing and educate newcomers. Security will always be an issue as long as your systems are accessible to users.

  11. Re:Part of the budget by __aaclcg7560 · · Score: 2

    C) The budget has more spending than previous budgets.

    Never mind that the Republicans led the way in busting the budget caps in last year's budget deal.

    http://www.responseaction.com/Article/mcconnell-boehner-seek-bust-spending-caps

  12. Re:And never mind... by bondsbw · · Score: 2

    Not that I like dysfunctional government, or the Republicans in control, but it's not like he listens to them either when he implements major laws via executive order.

    On that note, let's not forget that each expansion of government power, no matter how tiny, accumulates and is passed on to future administrations. Donald Trump is already proclaiming those powers to be his if elected. Trump with that much power scares me a hell of a lot more than Obama.

    --
    All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
  13. Re:Cool by ArmoredDragon · · Score: 2, Insightful

    Seems more like pork to me. The problem with cybersecurity right now mainly comes from basically anybody and everybody running old shit that is vulnerable. A classic example is Android 2.3 devices that people still carry around. And of course, large companies that have obsolete OSes still running on the public internet.

    This whole IoT mess is only going to make it much worse. What's needed are rules establishing a minimum standard to raise the bar for longer term security updates. I.e. rules to the effect of requiring manufacturers to provide security updates for no less than 7 years after first product general availability to market. Also provide some kind of source escrow so that if the company folds the firmware can be released as completely open source, complete with signing keys where applicable.

    Also something needs to be done about the DDoS as a service situation. The primary target should be end users who harbor compromised systems connected to a broadband ISP. For example, if they're found to be participating in a DDoS attack, whether they are a willing participant or not, they are to have their internet connection throttled to 128kbit until they have cleaned their systems.

  14. Re: Cool by Anonymous Coward · · Score: 3, Insightful

    He's a lame duck, and Trump is just gonna undo anything he signs into law, so what's the point? Might as well just brush up on his golf game. Fore!

    Trump? The entire Republican Party has been attempting to undo everything Obama ever did since the day he took office. I wouldn't be surprised if they declared him an unperson before they're done.

    I understand that the Replublicans and Democrats have different philosophies, but this wholesale eradication crusade that they've adopted is beyond reason.

  15. Re:Gridlock by rsborg · · Score: 3, Insightful

    Republicans reject it before it even comes out and refuse to read it.

    Because "Obama"

    Which is why when Sanders is elected president in November, I can look forward to more entertaining gridlock, proposals that aren't "Republican-lite". Because if gridlock from a Democratic president is all we'll get, we might as well get propose some nice socialist ideas and get some nice leftward Overton window movement.

    --
    Make sure everyone's vote counts: Verified Voting
  16. Re:Part of the budget by tekrat · · Score: 2

    Yes, but you'll never *that* reported on Fox News -- as far as they are concerned, it's the Liberal that Spend, Spend, Spend.

    Never mind the Republicans are the ones pushed through that expensive boondoggle called the F-35 -- a multi-role aircraft that doesn't perform any of it's intended roles.

    --
    If telephones are outlawed, then only outlaws will have telephones.
  17. Re:Gridlock by SirSlud · · Score: 2

    "Only democrats spend tons of money" says area man with no grip on reality.

    --
    "Old man yells at systemd"
  18. What a waste of money by Snotnose · · Score: 2

    All he has to do is get the NSA to work for good instead of evil. Problem solved with no additional money spent.
    Oops, there's the problem. "No additional money spent" means a program will never get off the ground in Washington.

  19. Re: Cool by Archangel+Michael · · Score: 2

    Try disobeying an Executive Order. Then you'll realize that they are considered "law".

    Now, if what you're saying is that we can ignore them without consequences, then I'm in full agreement (in principle). But we all know that laws aren't meant for the rich and powerful, only us serfs.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  20. F-35 by Vasheron · · Score: 2

    No doubt this will turn into the F-35 of IT security: badly designed, poorly implemented, over budget, behind schedule, and ultimately ineffective.

  21. Good and evil by Okian+Warrior · · Score: 4, Insightful

    Republicans reject it before it even comes out and refuse to read it.

    Because "Obama"

    Oh, be fair now...

    Remember that Obamacare website? How high quality was that?

    How about Obamacare itself? Did cementing health insurance companies into federal law fix any problems?

    How about closing Gitmo? How did that work out?

    Hell, how about his stance on telecom immunity? How's that working out for us?

    Or making up new immigration law by executive order?

    Or ordering the assassination of a US citizen? (With no trial, and by authority of a secret law.)

    Really. If you want to blame gridlock on the merits of the situation, then do so.

    Otherwise, to the casual observer it would appear that "because Obama" is a perfectly valid reason to oppose something.

    Because, you know, "good and evil".

  22. Re:Gridlock by Tablizer · · Score: 2

    This shows that a party repeating a BS meme works on some people.

    Reagan and W are the biggest "recent" spenders; and did it during non-recessions such that "stimulus" cannot be a justification. Both started during a recession, but failed to shut off the spigot after the economy improved.

    W spent on war, DHS, Medicare Part D, and his tax cuts and refunds worsened the debt problem.

  23. More slops for the trough by bradley13 · · Score: 2

    Great, yet another federal bureaucracy (actually, two) to get in the way and generally screw things up.

    Really, it's just another way to feed taxpayer funds to political friends, all under a "feel good" title.

    --
    Enjoy life! This is not a dress rehearsal.
  24. Re:And never mind... by Straif · · Score: 2

    When the Dems were in control of the Senate they rarely even bothered to pass a budget (one of their primary functions), let alone listen to the executive proposals. When Reid did decide to actually propose a budget (apparently he scheduled "Plan next years budget" for Feb 29th one year so a reminder only popped up every 4) it wasn't based off of Obama's proposals because Obama's budget proposals (when submitted) we so ridiculous they couldn't even garner Democrat support.

    --
    Of course that's just my opinion...... you could be wrong!
  25. Another EO? by erp_consultant · · Score: 2

    Another Executive Order? Is that the only way that things get done these days? Did Obama even bother to try to work with Congress? I think not. The only thing coming out of the Oval Office these days are EO's so the process is obviously being abused.

    I think we should change the rules on what Executive Orders are and how they can be used. Currently they are being used as a way to push forward whatever the President wants - regardless of what Congress votes on or what the majority of American citizens want. If Congress cannot come to an agreement on a bill then it should not become a law.

    If we are going to have a system of government where the President passes all the laws (and, by the way, an EO is NOT a law) then we should just abolish the Congress and have a King. Welcome to Indonesia West.

  26. Re:And never mind... by Straif · · Score: 2

    Obama should scare you more because his abuse of EO's and Presidential Memorandum actually were put into action. Trump is so egotistical and crazy that it could actually be a good thing if, heaven help the world, he ever was elected because the legislative branch would finally step in and put and end to blatantly unconstitutional use of EO's and PM's. The one thing that could possibly unite both Reps and Dems would be passing legislation to limit the President Trumps (shiver) executive overreach.

    The US might finally get back to the way the government was suppose to operate with the legislative making the laws and the executive faithfully enforcing them.

    I'm also pretty sure a President Trump would do something to get himself impeached within the first 2 years anyway.

    --
    Of course that's just my opinion...... you could be wrong!