Government Cloud Authors: Elizabeth White, Pat Romanski, Dana Gardner, Liz McMillan, Gopala Krishna Behara

Related Topics: Cloud Security, Government Cloud

Cloud Security: Blog Feed Post

CTO Perspectives on Cyber Security Bill

Protecting Cyberspace as a National Asset Act of 2010

On June 10, 2010, the US Senate Homeland Security and Governmental Affairs Committee (HSGAC) unveiled a major cybersecurity bill designed to modernize, strengthen, and coordinate US Cyber defenses.

Senators Collins, Carper and Lieberman introduced this bill with the clear articulation to defend not just federal networks but the Internet itself.  As portion of the announcement recorded by TalkRadioNews is below:

The bill itself is named the “Protecting Cyberspace as a National Asset Act of 2010.”

It creates an Office of Cyber Policy in the White House with a director accountable to the public to lead all federal cyberspace efforts and devise national cyberspace strategy.  A National Center for Cybersecurity and Communications within the Department of Homeland Security, also led by a director accountable to the public, to enforce cybersecurity policies through the government and even the private sector.

Some key aspects of this Bill, from the site of the HSGAC:

  1. Creation of an Office of Cyberspace Policy in the Executive Office of the President run by a Senate-confirmed Director, who will advise the President on all cybersecurity matters. The Director will lead and harmonize federal efforts to secure cyberspace and will develop a national strategy that incorporates all elements of cyberspace policy, including military, law enforcement, intelligence, and diplomatic.  The Director will oversee all related federal cyberspace activities to ensure efficiency and coordination.
  2. Creation of a National Center for Cybersecurity and Communications (NCCC) at the Department of Homeland Security (DHS) to elevate and strengthen the Department’s cyber security capabilities and authorities. The Director will regularly advise the President on efforts to secure federal networks.  The NCCC will be led by a Senate-confirmed Director, who will report to the Secretary. The NCCC will include the United States Computer Emergency Response Team (US-CERT), and will lead federal efforts to protect public and private sector cyber and communications networks.
  3. Updates the Federal Information Security Management Act (FISMA) to modernize federal agencies practices of protecting their internal networks and systems. With strong leadership from DHS, these reforms will allow agencies to move away from the system of after-the-fact paperwork compliance to real-time monitoring to secure critical systems.
  4. Requiring the NCCC to work with the private sector to establish risk-based security requirements that strengthen cyber security for the nation’s most critical infrastructure that, if disrupted, would result in a national or regional catastrophe.
  5. Requiring covered critical infrastructure to report significant breaches to the NCCC to ensure the federal government has a complete picture of the security of these sensitive networks.  The NCCC must share information, including threat analysis, with owners and operators regarding risks to their networks. The Act will provide specified liability protections to owners/operators that comply with the new risk-based security requirements.Creation of a responsible framework, developed in coordination with the private sector, for the President to authorize emergency measures to protect the nation’s most critical infrastructure if a cyber vulnerability is being exploited or is about to be exploited. The President must notify Congress in advance before exercising these emergency powers. Any emergency measures imposed must be the least disruptive necessary to respond to the threat and will expire after 30 days unless the President extends them.  The bill authorizes no new surveillance authorities and does not authorize the government to “take over” private networks.
  6. Development of a comprehensive supply chain risk management strategy to address risks and threats to the information technology products and services the federal government relies upon. This strategy will allow agencies to make informed decisions when purchasing IT products and services.
  7. Requiring the Office of Personnel Management to reform the way cyber security personnel are recruited, hired, and trained to ensure that the federal government has the talent necessary to lead the national cyber security effort and protect its own networks.

Now some analysis:

  1. By ensuring the White House will have a Senate-confirmed Director, it will help underscore for the executive branch that this issue should be taken a bit more serious.  Sounds like a prudent thing for the Congress to do.
  2. Creating a National Center for Cybersecurity and Communications (NCCC) in DHS with a leader also confirmed by the Senate sends a similar message, but it also empowers an individual and group to do something that no one has been authorized to do before (at least no one under the rank of President). This office will have authority to lead across government.  As a CTO with enterprise experience I respect this kind of position.  I am convinced you cannot defend large enterprises without the smart application of both central authority and decentralized action.  If you try with either of those missing you fail.  I am not worried about too much technical authority being drawn into one location, there are too many forces at play to keep that power from being abused and, if the person and staff are picked carefully, they will avoid making decisions that impact missions in a negative way.  Notice I have caveated my opinion here.  The nation must choose wisely and put a very smart technology leader in this position.  Someone who can enforce the right standards and give direction when required but can back off and let agency IT leaders run things when required and that person must be smart enough to know when and how to decide what to decide about.
  3. Updating FISMA is long overdue.  Moving towards real-time monitoring is GREAT!  It is the only way I know of to move towards enhancing both security and functionality at the same time.
  4. Naming the NCCC as the focal point for coordination with the federal sector is also a solid move.  It goes without saying, but the NCCC should be staffed and led by very savvy, very social, very action-oriented people.  Without social leaders with high emotional intelligence we stand the risk of getting what we have always gotten here.
  5. As a CTO, I applaud the measures this Bill describes for removing artificial impediments to information sharing.  Government and industry need trust-based relationships and unfortunately too many laws and behaviors that flow from those laws, like FOIA, have damaged those relationships.  Addressing them head on is the right thing to do.  Technologically there are few issues here.  Issues are in policy and the Bill seems to do a good job at addressing some big ones.
  6. Development of a comprehensive supply chain management strategy is another great goal I am glad to see.  There has been a great deal of action lately in establishing coordination mechanisms with senior IT leadership in the country and I believe this will serve as a good foundation for development of a strategy like this.
  7. The human side of technology is one that also needs significant attention and it is good seeing the Bill address this head-on by requiring OPM to reform the way the government leads cyber security personnel.

Some concluding thoughts:

  • I wish I would have raised another issue with the staffers.  I feel bad about this, but I have something I would like to add to the Bill.  I guess I’m too late, but maybe I can get my input to the SSCI or HPSCI instead.  I want to suggest that the US Intelligence Community be tasked with providing a detailed yearly cyber intelligence threat assessment  for unclassified dissemination. The IC does a good job of providing some counterintelligence assessments and frequently mentions cyber in open fora like Congressional Testimony, but I believe this issue deserves a focused, NIE-like report dedicated to this topic.  Of course the IC should also be tasked with support to the NCCC.
  • I found the Bill was full of smart information coordination and information sharing language and constructs.
  • The great work of folks at NSA, Cyber Command (including legacy organizations like JTF-GNO and JFCC-NW), STRATCOM, DHS, NCICC, US CERT, FBI, DC3 and many others must continue and I believe the language in this bill is very respectful of the great work that these groups have been doing.
  • I wonder who the first CTO of the NCCC will be?  That is going to be one cool job!

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder of Crucial Point and publisher of CTOvision.com

IoT & Smart Cities Stories
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
Nicolas Fierro is CEO of MIMIR Blockchain Solutions. He is a programmer, technologist, and operations dev who has worked with Ethereum and blockchain since 2014. His knowledge in blockchain dates to when he performed dev ops services to the Ethereum Foundation as one the privileged few developers to work with the original core team in Switzerland.
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more busine...
Whenever a new technology hits the high points of hype, everyone starts talking about it like it will solve all their business problems. Blockchain is one of those technologies. According to Gartner's latest report on the hype cycle of emerging technologies, blockchain has just passed the peak of their hype cycle curve. If you read the news articles about it, one would think it has taken over the technology world. No disruptive technology is without its challenges and potential impediments t...
If a machine can invent, does this mean the end of the patent system as we know it? The patent system, both in the US and Europe, allows companies to protect their inventions and helps foster innovation. However, Artificial Intelligence (AI) could be set to disrupt the patent system as we know it. This talk will examine how AI may change the patent landscape in the years to come. Furthermore, ways in which companies can best protect their AI related inventions will be examined from both a US and...
Bill Schmarzo, Tech Chair of "Big Data | Analytics" of upcoming CloudEXPO | DXWorldEXPO New York (November 12-13, 2018, New York City) today announced the outline and schedule of the track. "The track has been designed in experience/degree order," said Schmarzo. "So, that folks who attend the entire track can leave the conference with some of the skills necessary to get their work done when they get back to their offices. It actually ties back to some work that I'm doing at the University of San...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the...