US-CERT

...now browsing by tag

 
 

CzarWars Episode II: A lack of the Cojones

Monday, August 10th, 2009

CzarWars Episode II:  A lack of the Cojones

Hathaway is out, and a game of musical chairs is being played to see who gets stuck with the undesirable position of Cybersecurity Coordinator.  There are a number of personal reasons why no one would want to take the job. Whoever is finally selected will likely be lobbying on behalf of a number of interests. They will come in with the understanding they will have no effect on the state of the nation’s cybersecurity, and use the position to influence policies that will benefit the groups he or she represents.  This comes as no surprise after several tarot readings were done asking who the cyberczar would be. At this point a hokey religion and ancient superstition seems to be just as insightful as any of the industry analysts.

I don’t think it’s necessary to go into any great detail about the Hathaway’s resignation. It is important to note that she will remain at her position until August 21. This could possibly indicate a timeframe for the finalization of the selection process for her replacement. She stated that her reasons for leaving were personal. Some have suggested she may move into the private sector and work for her former boss Mike McConnell at Booz Allen Hamilton.

All of the likely czar choices are circling around trying to get seated before the music ends. Who ever is left standing will have to take the czar job. Everyone else will find themselves in various consulting positions where they can affect change, and receive a competitive salary. 

The czar position is one that nobody wants. In addition to Hathaway, let’s not forget that Rod Beckstrom stepped down from his position citing fears over NSA involvement. Now the DHS cybersecurity official, Mischel Kwon, has stepped down from her position as director of US-CERT.  I starting to wonder what the hell is going on up there in the District of Columbia. It could be that Alexander is exercising his power from the NSA to align things to his benefit.  Maybe we are just wasting time waiting for the announcement of the coordinator.


Among those who told the White House thanks but no thanks, The Washington Post reports: former Republican U.S. Rep. Tom Davis of northern Virginia, Microsoft executive Scott Charney, Symantec Chairman John Thompson and retired Air Force Gen. Harry Raduege Jr., the former Defense Information Systems Agency director and co-chair of the Commission on Cybersecurity for the 44th Presidency, which proposed the White House establish a cybersecurity post that has more influence than the job Obama described.


If agency CIOs, CISOs and others responsible for securing government IT are awaiting the appointment of the cybersecurity coordinator to get their marching orders, they’re wasting time. In reality, what will happen in the White House in the coming weeks will have little or no bearing on what agency security managers must do now to perform their jobs.

It’s not like we don’t need a fall guy, someone who can speak to the public about events like the recent electronic attacks on US and Korean networks.  It’s been over two months now since the position of ‘coordinator’ was announced, and it seems like we are headed in the opposite direction of actually filling the position.  Other then acting as a scapegoat, there are a number of other reason why this is something that should have been resolved before the first of June.


•  There is a lot of money being spent on cybersecurity everyday – with no comprehensive strategy. Not only are individual agencies spending millions of dollars on cybersecurity but a highly classified, multiyear, multibillion-dollar project, approved by the Bush Administration called CNCI — or “Cyber Initiative” – had a budget of $30 billion. This initiative was implemented with the goal to secure government, commercial and critical infrastructure computer systems against foreign and domestic intruders. We are talking big bucks here. Would you as a CISO let your business areas spend on security initiatives as they please without any coordination, communication or strategy?  

•  Critical infrastructure needs immediate help. Our critical infrastructure needs help. It is antiquated, prone to viruses and worms, and people doing stupid things ultimately leading to costly disruptions in service. Add to this the potential threats associated with foreign government hackers (Electricity Grid in U.S. Penetrated By Spies) and you’ve got an urgent matter on your hands. Other critical infrastructure breaches (FAA says info on 45,000 workers stolen in data breach) and commercial data losses (Hackers Breach Heartland Payment credit card system) brings no consolation.

•  FISMA has utterly failed at securing government infrastructure. We have all come to realize that FISMA has done little to improve the security of government systems, and created an additional layer of processes and a healthy revenue stream for beltline consulting companies. The Cybersecurity Czar needs to take over the responsibility of ensuring FISMA 2.0 is in line with the current realities on the ground and is able to change the focus from “compliance” to security.  

•  Capture the momentum and excitement. I have never seen such optimism and excitement in the security industry for a government initiative. Security experts and the industry at large is offering to help in whatever capacity they can to improve the nation’s cybersecurity posture. We need to seize the opportunity and come up with a defined strategy (not high level goals and objectives) and strong leadership that can channel this energy into positive action.

•  Perception is almost as important as reality. Many people hailed Mr. Obama’s speech on May 27thas a strong warning to our adversaries that we are serious about security. The recommendations from the cybersecurity review were also heralded as the right first step. But nothing has happened since. We don’t have a plan, any specifics on how those recommendations will be implemented nor a Cybsersecurity Coordinator. By not following it up with action, what message are we sending? We need to at least be perceived as taking security seriously.

I expected the response to the recent attacks on Korean and American systems to be a big wake up call. Instead of the expected Gulf of Tonkin type of response, as time has passed the coverage slowed to a trickle and finally dried up.  It seems the government and military’s incident response tactic is to sweep the event under the rug (so far as the media is concerned).    Things are going to continue to get worse, and while the real techies are hard at work trying to come up with solutions, there is no public face for America’s security solution.  


Most notably, as my colleague Robert McMillan has reported, a botnet of about 50,000 infected computers has been waging a war against U.S. government websites and causing headaches for businesses in the U.S. and South Korea.
“The attack started Saturday, and security experts have credited it with knocking the U.S. Federal Trade Commission’s (FTC’s) Web site offline for parts of Monday and Tuesday. Several other government Web sites have also been targeted, including the U.S. Department of Transportation (DOT),” McMillan wrote, offering this quote from an unnamed DOT spokeswoman: “The DOT has been experiencing network incidents since this past we
ekend. We are working with the U.S. Computer Emergency Readiness Team [US-CERT] at this time.”

Meanwhile, a South Korean researcher investigating the attacks has uncovered a sizable hit list of sites in and out of government, including some high-profile targets in the banking sector.

Maybe Obama is doing the right thing. The last thing we really need is some new jerk coming in and forcing more standards on the security professionals.  The czar would just be one more person in the cycle not actively perusing a solution, and causing more work for everyone else. This factor may already be understood by the corporations and government. There have been numerous employment offers in the public and private sectors for cyber related work. We should see a workforce in the tens-of-thousands in just a couple of years. At which point we may actually need a ‘coordinator’ to manage the new work force.


The response at most agencies has been to turn to outside contractors to perform sensitive work. That’s led to situations such as the one at the Department of Homeland Security, where contractors accounted for 83 percent of the chief information officer’s staff last year.
The report urged the White House cyber czar to enhance training and giving departments expanded authority to hire specialized talent. And it urged Congress to ramp up funding for training programs and scholarships to build a pipeline of qualified workers.

We are still left with the question of who will be the next cyber czar, the position which is officially vacant now.  At this point it seems that no one can fathom who would be willing to take the job, so a tarot reading is just as accurate in this situation as anyone’s opinion.

So what did the cards say?

•  person will be duped in to it for the money and power. they will have neither
•  czar will be duped into thinking they have the power to change the world. talented and naive. a final scapegoat
•  czar has power over nothing. strong beliefs. world behind them, will seem powerful.
•  czar will be well intentioned non-noob restricted by beurocracy and destined for failure

The czar will take the job for the money, and the power, and actually believe they can make a difference. Unfortunately there is no one so seemingly Idealistic and Naive in Washington, except for the President himself. Interestingly enough, though I was focusing on the identity of the new czar, the results give an excellent description of Obama.  
While all of that is painfully obvious in relation to the czar position, I have never seen the cards fall like that before.  While an entertaining anecdote on this story, the fact remains that we are apparently no closer to finding the czar.  This, however, might not be such a big deal. We already know that no one really wants the job any way.
Names of possible candidates seem to pop up to the surface every so often.  It is difficult to determine if they are legitimate candidates, or have just thrown their names into the media for the extra attention.  My current favorite is Franklin D. Kramer.


Franklin D. Kramer:
Distinguished Research Fellow at the Center for Technology and National Security Policy.
Assistant Secretary of Defense for International Security Affairs from March 1996 to February 2001
Deputy Assistant Secretary for European and NATO Affairs from January 1996 to March 1996
Principal Deputy Assistant Secretary of Defense for International Security Affairs from 1979 to 1981
Special Assistant to the Assistant Secretary of Defense for International Security Affairs from 1977 to 1979


“Mr. Kramer is the chairman of the board of the World Affairs Council of Washington, D.C.; chairman of the Committee on Asian and Global Security of the Atlantic Council and on the Executive Committee of the board; a Capstone Professor at George Washington University Elliott School of International Affairs; and on the board of directors and board of advisers of other organizations. Mr. Kramer has been a partner with the Washington, D.C. law firm of Shea and Gardner. Mr. Kramer received a B.A. cum laude from Yale University in 1967 and a J.D. magna cum laude from Harvard Law School in 1971.”


This puts Mr. Kramer in Yale at the same time as George Bush and John Kerry.  There is no specific mention as to if he was also a member of the Skull and Bones society.  His credentials make him the most likely candidate yet. He is a Washington insider, accustomed to dealing with security, and his research fellowship implies an understanding of technology.  Currently he is consulting in the private sector, and is tied to the green movement by serving as director and executive vice president at “Changing World Technologies”.   


Mr. Kramer has served as a director of LSI since September 2001. Since February 2004, Mr. Kramer has been an independent consultant. From March 2001 to May 2005, Mr. Kramer was a lawyer with Shea & Gardner, now Goodwin Procter LLP. Mr. Kramer served as a director of Changing World Technologies, Inc., a privately held energy and environmental service company from February 2002 to April 2006. From February 2002 to December 2003, Mr. Kramer served as Executive Vice President of Changing World Technologies. From January 2004 to January 2006, Mr. Kramer served as a consultant to Changing World Technologies. From March 1996 through February 2001, Mr. Kramer served as Assistant U.S. Secretary of Defense for International Security Affairs. Mr. Kramer currently serves on the boards of directors and board of advisors of various organizations and private companies. Since March 2007, Mr. Kramer has been an Operating Advisor for Pegasus Capital.



Pegasus identifies complex situations where financial, legal or governmental issues might deter conventional investors and creates value by exploring options like revising a business model, entering new markets, introducing new products or technologies, and entering into strategic partnerships.

This sounds like the sort of thing that would be right up the czar’s alley. Working around laws and regulations would help the Intelligence industry quite a bit.  This brings up the question as to who are the so-called ‘security experts’ that are pushing the recommendation for the czar position?  I’ve got a hunch that it’s the same people pushing for the Cybersecurity act, who stand to profit the most from this racket; the Intelligence Industrial Complex. Kramer could tie the .gov, .mil, and .com sectors together for their own benefit.


Hathaway took herself out of the running for the job, most likely because she realized that despite her qualifications, she wasn’t going to get the post. “I wasn’t willing to continue to wait any longer, because I’m not empowered right now to continue to drive the change,” she told The Washington Post. “I’ve concluded that I can do more now from a different role,” most likely in the private sector.
(As an aside, it’s unlikely that she’ll return to the Office of the Director of National Intelligence – where she was on loan to the White House to conduct the “60-day” review of the federal cybersecurity pos
ture – because her “rabbi,” Adm. Mike McConnell, resigned as national intelligence director at about the time she took on the White House assignment. McConnell returned to the business consultancy Booz Allen Hamilton, where they both had worked before coming to the ODNI. Will she rejoin McConnell?)


We are looking at the return of the cold war, and we are unprepared.

Click to continue »

Cyberspace Policy Review – 2009 "The cyberSpace Race"

Saturday, June 6th, 2009

Analysis of the Cyberspace Policy Review

Essentially they want a well regulated internet to protect the economy, and defend the nation. This will require international acceptance of standards to protect against state sponsored cyber war. The government is organized to address this problem. They intend to centralize control over cyber security. A new position of Cyber Security Coordinator will be created as a White House level position. This person will work closely with a number of agencies and the Executive Office of the President.

They are comparing the current cyber security situation to the Space Race. With specific mention to the launch of Sputnik, it seems like the U.S. is still pretty bitter about that. The upside to this will be the creation of jobs during the current recession. In order to achieve their goals they intend to further blend the existing government activities with private ones.

According to the document this is a ‘Digital Revolution‘, with their main focus being on the protection of economic and national security. In specific they fear industrial and military espionage, including actions such as the theft of valuable data including corporate and military secrets. There is also the threat to non-cyber infrastructure such as the power grid, where they site SCADA as an example. Last but not least they mention their concerns on privacy. Unfortunately for the people, this concern is monetary, with the focus on the economic damage caused by identity loss and fraud.

Behind this policy review are people referred to as ‘stakeholders’. They seem to be the cyber-sycophants determined on funneling as much funding to their own coffers as possible. Much of this Review parallels the direction of the Cyber Security act. It has been drawn up on much of the same Congressional testimony, and official reports as the Act.

There are some legal issues which will have to be dealt with, some of them possibly Constitutional. To reassure the public they will be kept safe at all costs, the report mentions multiple times the existing Executive Orders which give the Government the power to seize complete control over communications in time of an emergency. At the moment that power would go to the Department of Homeland Security, the concept of an eFEMA is not factually that far off base. In regards to the international impact of such a decision, the Department of State has the authority over foreign communication policy. According to the Review, the Secretary of Homeland Security is responsible for the protection of critical infrastructure, including information networks.

However the Secretary’s power does not cover Federal systems. For this the Comprehensive National Cyber security Initiative was created. The goal of the CNCI is the consolidation of law enforcement, intelligence, counterintelligence, and military capabilities to address the full spectrum of cyber threats. The head of the CNCI stepped down out of concern for the public based on the direction of the current cyber strategies.

To replace him they have created a new White House level position. The Cyber Policy Officer, will report to the National Security Council and the National Economic Council. There also is the established Communications Infrastructure Interagency Policy Committee (ICI-IPC), which is chaired by the NSC and the Homeland Security Council. The ICI-IPC is focused on “achieving an assured, reliable, secure, and survivable global information and communications infrastructure and related capabilities”.

Whoever is appointed by the President to the position of policy official, will be supported by Presidential authority, support and resources. They will receive assistance from at least two Senior Directors from the NSC, and one Senior Director and appropriate staff from the NEC. One of their duties will be to consult with the Federal governments Chief Technology Officer, and Chief Information Officer, in addition to the appropriate people within the Office of Management and Budget and The Office of Science and Technology Policy.

The Goal is to create a central position of leadership within the White House, a figurehead who will be responsible for establishing security policy, as well as responding to cyber-emergencies. There are a number of agencies which have already been created such as the National Security and Telecommunications Advisory Committee, the National Infrastructure Advisory Council, the Critical Infrastructure Partnership Advisory Council, and the Information Security and Privacy Advisory Board. These groups will be evaluated by the policy official with the goal of optimization, and elimination of redundancy, which basically amounts to the consolidation of power within the White House.

The stakeholders involved in the Cyberspace Policy Review discussed a variety of options to coordinate and oversee cyber security. The Joint Interagency Cyber Task Force (JIACTF) currently is responsible for this. If you have read the previous articles, you might find it interesting to know that this task force works under the Director of National Intelligence. The former DNI is cited in both the Cyber security Act as well as this Policy Review. He is currently employed as SR. Vice president of one of the largest recipients of government cyber security and intelligence contracts. The Review states explicitly that “unless and until such an office is established, the work of the JIACTF will continue”. The Director of National Intelligence is in charge of all the intelligence agencies, which in turn outsource most of their work to private corporations.

It is no wonder the Review explains that goals consistent with U.S. Constitutional Principles may make certain activities conducted by the Federal government more difficult. Keeping their best interests at heart, they feel the need to partner with Congress. The goal of this partnership is to benefit from Congressional knowledge and experience, in order to properly please the industrial lobbyists represented there.

At the state level, representatives from the National Governors Association, feel that cyber security is the weakest link in the protection of their states. While they already receive funding from Homeland Security which can go to cyber security, historically the grant funds have not been prioritized for that purpose.

The digital revolution includes the Smart Grid program as well as the Next Generation Air Traffic System, which receive funding from the new bailout bill. To sustain this revolution they wish to educate the public beginning in the first year of school. A cyber security education program would teach digital safety, ethics, and security, with the hopes of creating a technologically advanced workforce. The review even goes so far as to recommend a public safety campaign similar to the Smokey Bear fire safety campaign. Likely with accompanying catchy public service announcements stating that ‘only you can prevent malicious worm propagation’ (don’t copy that floppy anyone?). Along this same thread it is suggested that Celebrities, the computer generation, and new media should be used to deliver this message of cyber security awareness.

The reason for this education campaign is an underlying fear that the United States will fall behind other nations in the cyberSpace Race. Why else would they have brought up the whole Sputnik thing? They state that talented IT employees are in high demand, but the number of people receiving related education has been in sharp decline for several years. Thankfully the National Science Foundation, and the DHS offer grants and scholarships, with 80% of those who receive them getting government jobs. The National Centers of Academic Excellence in Information Assurance Education and Research, which was founded by the National Security Agency, and lately co-sponsored by the DHS, works to promote education in information assurance in 38 states and DC. The Defense Department also sponsors the Information Assurance Scholarship Program in the same institutions.

Now that you’ve bit the hook, and they’ve reeled you in, they want to keep you fresh. The Review mentions a plan for “shared training across agencies and into the private sector”. Blending the oft mentioned public-private partnership, they would like to have public-private employees as well. In reality this is not likely much different then the current situation. I could imagine a scenario where they would begin to trade top talent like the professional sports leagues. This could lead to some interesting results with IT ‘stars’ demanding higher pay because of their ‘skills’.

Another reason for the necessity for a tight public-private partnership is that the private sector “designs, builds, owns, and operates most of the network infrastructures”. Aside from a hostile take over, the best option is partnership. Likewise the corporations involved depend on the government’s protection from various threats, so it is a mutual arrangement. I mentioned in a previous article how they are attempting to create a monopoly. The Review actually cites the Sherman Antitrust Act in reference to private sector concerns about “certain federal laws” that might impede their partnership. Thanks to the Trade Secrets act and the Critical Infrastructure Information Act, the parties involved will not need to be concerned with the Freedom of Information Act.

We can be sure there will be no conflict of interest specifically concerning the multinational owners of major private government consulting operations. The Review suggests tailored solutions to handle such situations. One of them is to adopt a system similar to that which is used in Britain. Called the consultancy model, vetted private information security providers are used as a nexus to combine data.

Taking it to the next level, the Review suggests the government consider focusing on “game-changing” areas things such as behavioral and incentive based solutions. Something similar to the vouchers I have mentioned previously, tax breaks could be offered to those who choose to become early adopters of the new system.

Since the Internet is a global system, it is important to partner with the international community. Once the government comes up with their domestic plan, they hope to spread it around the world with love like they have done with democracy, bringing like minded nations together to discuss acceptable norms, implementation of standards, and “use of force”. “New agreements between governments and industry may need to be documented to enable international information sharing, as well as strategic and operational collaboration”. The U.S. will help other countries build legal frameworks, and work with allies to ensure the stability and global interoperability of the Internet.

When the Taliban unleashes their cyber army, the government wants to be prepared. The Review states the need for a coordinated joint response from the government, the private sector, and its allies. As a defensive measure is suggested that some sort of system be put into place before an attack happens, a sort of early warning system and cyber defensive grid. Only the White House has the authority to react to such an event. The policy official would be responsible in this situation, which underlines the necessity for centralization of National cyber emergency management.

The Cyber security act mentioned the National Institute of Standards and Technology ignoring classifications of national security on systems. Similarly the Review mentions the problems that arise from the “existing legal, but artificial, distinctions between national security and other federal networks”. With regards to the Review it pertains to the dispersion of federal cyber incident response across many federal departments. It is mentioned that legislation might be required to consolidate this response, to harmonize or enhance as necessary the different departments.

The defensive strategy will begin with the development of “a set of threat scenarios and metrics” that can be used for “risk management decisions, recovery planning, and prioritizing of R&D”. The ICI-IPC would be in charge of making enforceable rules for incident reporting, while the CNCI would continue to improve “federal network defenses”. In addition there is a plan called the Trusted Internet Connection program, whose goal is to reduce the number of government network connections.

For the moment “the Defense Department is responsible for aggregating information on network health and status, attempted intrusions, and cyber attacks for its networks, the Intelligence Community for its networks, and US-CERT for civilian federal agencies and to some extent the private sector”. The Review suggests the government should assist in preventing, detecting, and responding to cyber incidents by leveraging existing resources such as the Multi-State Information Sharing and Analysis Center, and the 58 existing State and local Fusion Centers.

According to the Review, “security classification and clearance requirements” inhibit information sharing. Policies governing the “collection, use, retention, and dissemination of information” need to be audited as they “present significant barriers”. The “Federal government should help the research community gain access with appropriate controls, to cyber security-related event data that could be useful to develop tools.”

Once they figure out the domestic file sharing, they plan to expand it internationally, sharing data with allies, and seeking “bilateral or multilateral” agreements. This international collaboration might upset some of their domestic partners. However since they depend on the government for “the common defense of privately-owned critical infrastructures”, most of the stakeholders have “indicated a willingness to work toward a framework under which the government would pursue malicious actors and assess with information and technical support to enable private-sector operators to defend their own networks”. Private sector operators “such as the World Bank and the International Monetary Fund” are specifically mentioned as institutions that should be defended.

As medical records are digitized, the Smart Grid technology is implemented, along with the Next-Generation Air Traffic Control system; there will be an increasing need for information security. One way to achieve this is to develop a “next-generation of secure computers and networking for national security applications”. The goal is to “harness the full benefits of innovation to address cyber security concerns”.

Cloud Computing, “introduces new policy challenges for the private sector and governments around the globe”, it “presents challenges for law enforcement, the protection of privacy, and civil liberties”. This could prove to be difficult for the government if a terrorist’s data was in the cloud in a country that did not conform to the international standards. On the other hand, as a side note, if your data exists in a cloud in a foreign country then your rights to that data might only be covered by their law.

DARPA, the guys that brought us the Internet, see the “defense of current Internet Protocol-based networks as a losing proposition”. They suggest “an independent examination of alternate architectures”. As of March 2009 they have begun analysis of alternatives. In the mean time it is suggested the government focus on research and development into “game-changing technologies”, which build on “existing Networking and Information Technology Research and Development strategies”.

One of these game-changers might be the development of “an opt-in array of interoperable identity management systems”. It is being developed based on the findings of The National Science and Technology Council’s subcommittee on Biometrics and Identity Management. The goal is to create a national standard of biometric identification at the federal level. This technology would become available for private operators, and emergency services. Part of securing the Nations cyberspace, the Smart Grid and the new air traffic control system, will involve the adoption of  technology to verify the identity of whoever is using the services.

This doesn’t do any good if the hardware or software is compromised during manufacture. Because much of the hardware is constructed overseas, there are “concerns about the potential for easier subversion of computers and networks through subtle hardware or software manipulations”. Examples of these are the counterfeit products that have turned up in various places. Called “supply chain attacks”, this manipulation can be “virtually impossible to discover”. To protect against this, the Review suggests the U.S. should “define procurement strategies”. Such strategies would be based on work by the National Security Agency and the Defense Department, “to create market incentives for security to be part of hardware and software product designs”.

National security and emergency preparedness are two of the main concerns of the government. When there is some event of national emergency, federal and local agencies depend on the national communications infrastructure. Many of the services such as the Emergency Operations Centers are beginning to use new technologies. Enhanced 9-11 call centers are using Voice Over Internet Protocol in some cases. So these facilities also now require direct cyber defense. Homeland Security is “working toward the goal of providing national security and emergency users with access to the converged information services of next-generation networks”. This includes the authorization of the President “to use, control, or close communications services, systems, and networks”. A public-private National Coordinating Center exists to “assist in the initiation, coordination, restoration, and reconstruction of communications services or facilities”.

Cyber security is the two faces of a single coin. One side is the Federal government, its agencies, departments, and alphabet soup. The flip side is private business and corporations. The two sides depend on one another for survival, and therefore are very willing to share the middle ground. If one was to remove the emblems from the obverse and reverse of the coin, you would be left with a homogenous metallic slug. At the core of the national cyber defense strategy is the alloy consisting of the public-partnership. To maintain the value of this partnership, it is very important for it to become the international standard. Steps will be taken to prevent the production of counterfeits, but eventually the plan is to replace it with something modern and more secure.

Twitter links powered by Tweet This v1.8, a WordPress plugin for Twitter.

Get Adobe Flash player