Highlights
– President Bush announces new funding for cyber security initiatives
– Federal government plans to monitor internal network traffic in order to prevent future attacks
– Government may also monitor the private sector to prevent future attacks
– Critics point to problems with the announced cyber security initiatives
After years of repeated cyber attacks and the theft of untold amounts of valuable data it appears that the United States government is finally getting serious about improving its cyber security.
Increased Threat
Many of the known attacks appear to have been designed for financial gain, espionage, or a combination of both. For example, ongoing reports of cyber espionage attacks sponsored by China’s People’s Liberation Army continue to make headlines. Additionally, the Central Intelligence Agency (CIA) recently announced that allegedly hackers attacked power generation facilities overseas and disrupted an undisclosed city’s electrical supply. The hackers subsequently demanded payment to discontinue attacks.
Due to these high-profile attacks the US government appears to have finally become serious about protecting its digital infrastructure. Within the past few months the US government has announced a number of initiatives and boosted funding for programs designed to improve its ability to detect, disrupt, and deter future cyber attacks on the US’s public and private infrastructure.
New Defenses
One such major initiative was a US$6 billion plan recently announced by President Bush to construct a monitoring system to protect the federal government’s digital infrastructure from ongoing attacks by rival nations, terrorists, criminals, and rogue hackers.
The main thrust of this plan appears to be an effort spearheaded by the Office of Management and Budget (OMB). The OMB’s Trusted Internet Connections (TIC) program aims to reduce the number of federal government’s Internet gateways from over 1,000 to approximately 50. This reduction, in combination with robust traffic patterns and content analysis, would enhance the federal government’s ability to monitor inbound and outbound data communications on federally owned networks.
Angst in the Private Sector
As the federal government is not the sole target of cyber attacks, the government intends on re-purposing the technology developed from this monitoring program for use in the private sector, as it is believed that numerous private sector defense contractors have come under sustained attack from malicious actors intent on stealing data on classified military technology.
Although there is a clear need to secure the private sector’s digital infrastructure, concerns abound over the government’s proposal to monitor its digital communications. Marc Rotenberg, director of the Electronic Privacy Information Center, equates the proposed monitoring to the National Security Administration’s (NSA) warrant-less wiretapping program. It should therefore be expected that a number of important details and deals between the government and the private sector would need to be worked out before this program is implemented in the private sector.
Other Critics
Furthermore, while most security experts agree that reducing the available “attack surface,” in this case the number of Internet Gateways, is an important first step, it is equally important to harden the existing digital infrastructure to prevent those attacks that do slip through from succeeding. According to Howard Schmidt, former vice chairman of the president’s Critical Infrastructure Protection Board and special adviser to the White House on cyberspace security, “Securing a network is not the same as securing the data. When you look at securing government systems, there needs to be a lot of restructuring of the architecture — legacy hardware, software and applications. None of those were designed to operate in the high threat environment we operate in today. All of that needs to be ripped out and replaced.”
As such, these steps announced by the federal government to enhance the security of the country’s digital infrastructure are only important first steps. Many tough political and technical decisions about the shape of existing programs remain.
