This is basically what the US government is telegraphing to those who want to attack our infrastructures. This conclusion of mine for the most part was confirmed today when I read the
ThreatChaos post about the National Cybersecurity Center director (
Rod Beckstrom)
resigning, after only a year in office and little accomplished - not due to his lack of trying I might add.
Read his resignation letter, which is
posted here. It's very telling of the issues in the agency. His two main complaints and reasons for leaving are power fights with NSA (re.; no power or authority to do the job he was given), and lack of funding. It sounded like this new center was doomed from the start.
He said he had only 3 people on his staff and 5 weeks of funding. What? No wonder couldn't get much completed. This office's mission was to address the lack of cyber security within the US Federal government and it's expected to accomplish this with 3 people and no funding?
The other main issue has to do with fighting with the
NSA over the program. The NCSC is in
DHS yet the NSA wants this role and according to
Beckstrom's letter some in DHS were putting up roadblocks in his way. To make matters more difficult the
Director of National Intelligence is
putting his support behind the NSA.
Now another year has gone by and cyber security is still not a priority for the US Federal government and the mess still exists. Many Federal agencies are doing cyber security work that overlaps with each other and a central coordinating agency still does not exist.
One idea I'm hearing is the creation of a new armed forces branch to be in charge of cyber security and I think that's a great idea. A decision needs to be made soon and we need to get moving with improving our nations cyber security from both a defensive and offensive standpoint. Our adversaries aren't waiting, they continue to attack and breach our defenses.
There is one piece of good news however: on February 9th, 2009 President Obama issued a directive to conduct an immediate cyber security review of all plans, programs, and activities underway throughout the government dedicated to cyber security. They have 60 days to complete it.
Press release here. I'm glad they are trying but I'm not holding my breath that decisions will be made soon (re.; weeks) after this review is completed and it's entirely possible we'll still be waiting by the next election cycle this November.
My plea to the policy makers in the US Federal government: stop advertising our confusion and uncertainty,
make the decisions that need to be made,
execute on those decisions, and start
showing our adversaries we are serious about cyber security before it's too late. Oh and by the way, there are plenty of good people in the private industry that are willing to help you.
If you are interested in the recent US Office of Personnel Management (OPM) data breach you'll want to check out the following articles and blog posts. For those not familiar with this breach, see here.
Richard Bejtlich has a great blog post regarding what Einstein and Continuous Diagnostic Monitoring (CDM) does and does not. He talks about a debate going on in the Federal govt. about CDM and the misconception they have about it. Statements are being tossed around that CDM searches for nefarious actors once they are already in networks. Richard rightly points out that CDM does not do this but rather it is a vulnerability management program which searches for known cyber flaws. Read more about this here:
