Connect with us

Cybersecurity

Commerce Dept. Recommends Public-Private Partnership on Cybersecurity

WASHINGTON, June 9, 2011 – The Department of Commerce released its Cybersecurity, Innovation and the Internet Economy green paper on Wednesday, advising cooperation between the government and private sector to implement ways to address cybersecurity issues.

The Internet Policy Taskforce, a department-wide group created in April 2010, wrote the green paper with the goal of addressing the pressing issues surrounding cyber security.

Published

on

WASHINGTON, June 9, 2011 – The Department of Commerce released its Cybersecurity, Innovation and the Internet Economy green paper on Wednesday, advising cooperation between the government and private sector to implement ways to address cybersecurity issues.

The Internet Policy Taskforce, a department-wide group created in April 2010, wrote the green paper with the goal of addressing the pressing issues surrounding cyber security.

Global online transactions have grown annually and currently account for $10 trillion in global trade. There has also been an increase in malware; between January 2009 and December 2010 the number of malware attacks doubled. In 2010, there were 55,000 new viruses, worms, and spyware threats.

“Our economy depends on the ability of companies to provide trusted, secure services online. As new cybersecurity threats evolve, it’s critical that we develop policies that better protect businesses and their customers to ensure the Internet remains an engine for economic growth,” said Commerce Secretary Gary Locke in a statement.

The green paper suggests that the government should support the creation of national code of conduct to deal with cybersecurity vulnerabilities. The new code of conduct should be created through a public-private collaboration rather than governmental edict. In addition to a code of conduct, the government hopes that industry will develop a set of standards which can be universally adopted.

“By increasing the adoption of standards and best practices, we are working with the private sector to promote innovation and business growth, while at the same time better protecting companies and consumers from hackers and cyber theft,” said Locke.

To protect consumers and business from the economic damages sustained by cyber-attack, the green paper suggestions the creation of cyber insurance. According to the paper, the market for cyber insurance would range from $450-500 million. Before any cyber insurance product is created however, industry must first determine how best to evaluate the costs of cyber-attacks.

In order to expand knowledge on potential cyber-attacks and vulnerabilities the report recommends the establishment of a National Initiative for Cybersecurity Education that would coordinate and fund research.

In addition to educating the business community about cyber-attacks and threats, the report recommends the addition of cyber protection to current digital literacy programs.

To further knowledge of cyber threats, the green paper recommends that the U.S. expand international collaboration: “The fact that cybersecurity is not defined by national borders and that the United States cannot afford to ignore global consideration…..The importance of engaging with our international partners early and often on matters related to standards development and policies is an essential starting place.”

In order to protect consumers, the report asks Congress to create a law that creates a framework for the notification of customers when electronic records have been breached. This recommendation is very similar to legislation currently proposed by Sen. Patrick Leahy (D-VT), the Personal Data Privacy and Security Act. Leahy’s bill would establish a national standard for the notification to consumers by corporations when data breaches occur.

The full green paper can be found here.

 

Rahul Gaitonde has been writing for BroadbandBreakfast.com since the fall of 2009, and in May of 2010 he became Deputy Editor. He was a fellow at George Mason University’s Long Term Governance Project, a researcher at the International Center for Applied Studies in Information Technology and worked at the National Telecommunications and Information Administration. He holds a Masters of Public Policy from George Mason University, where his research focused on the economic and social benefits of broadband expansion. He has written extensively about Universal Service Fund reform, the Broadband Technology Opportunities Program and the Broadband Data Improvement Act

Cybersecurity

Biden On Lookout for Cyberattacks with Russia Massing on Border of Ukraine

The president says that, in the past, Russia has taken covert military actions.

Published

on

Photo of President Joe Biden on Thursday

WASHINGTON, January 20, 2022 – President Joe Biden said Thursday that the administration will be on the lookout for Russian cyberattacks in Ukraine as Russia’s President Vladimir Putin may be edging closer to invading Ukrainian territory.

Biden warned that, in the past, Russia has launched aggressive computer attacks that, while perhaps falling short of overt military action, have been daunting cyber-offensives of “military” officials not wearing Russian uniforms.

The comments came at the beginning of Thursday’s meeting of Biden’s Infrastructure Implementation Task Force. Biden briefly addressed rising tensions surrounding Ukraine.

Many critics of Russia, including Biden, have said that they Putin will pounce.

During his remarks, Biden said Moscow would “pay a heavy price” should it move any Russian troops across the Ukrainian border.

Following his foreign policy comments, Biden turned his attention to the planned task force talks on implementing the Infrastructure Investment and Jobs Act signed on November 15, 2022.

He turned to former New Orleans Mayor Mitch Landrieu, the administration’s unofficial “infrastructure czar,” to offer comments on the administration’s progress to press.

Biden specifically addressed the law’s implications for ongoing supply chain issues.

Since the back half of 2021, the world has faced historic shipping delays on a variety of commercial goods as global manufacturing systems continue struggling to grapple with the coronavirus pandemic and workforce shortages exacerbated by it.

Specifically, the tech industry has faced chronic shortages of semiconductor chips, perhaps worse than most other commodities. The shortages have crippled many digital industry supply chains. products.

Biden said that with the infrastructure law investment in physical infrastructure, including additional highways to alleviate traffic on the nation’s roads, will allow goods to be transported faster through existing supply chains.

Continue Reading

Cybersecurity

Telework Here to Stay, But Devices Need Beefed Up Security

The future of teleworking will need upgraded security.

Published

on

Allen McNaughton, sales director at Infoblox

WASHINGTON, January 19, 2022 – Remote work is here to stay, but that means getting up to speed on securing websites is critical, said a director at an information technology security company Wednesday.

At a Business of Federal Technology event, which posed the question “is hybrid forever?,” Kiran Ahuja, director of the U.S. Office of Personnel Management, said “hybrid remote work and telework policies are clearly helping not only federal agencies, but literally every single office, company, and organization in this country.”

But while Allen McNaughton, sales director at security company Infoblox, agreed that telehealth is “here to stay, no doubt about it,” he also made clear that the reality of hybrid work is not effective without protected technology.

“When you have telework, when you have people that can work anywhere in the world, the world is now your attack surface,” says McNaughton. McNaughton noted that there is now a greater opportunity for hackers to install malware on unsecure devices.

The country has already been gripped by high-profile cyberattacks, including on software company SolarWinds, oil transport company Colonial Pipeline, and meat producer JBS USA.

Some of the attackers simply gained access because devices had simple default passwords, raising concern among security experts about how prepared people are for full-time remote work and school.

Continue Reading

Cybersecurity

Congress Must Avoid ‘Overly Prescriptive’ Incident Reporting To Avoid Missing Larger Cyberattacks

Too many reports could burden federal officials, said the executive director of the Alliance for Digital Innovation.

Published

on

Rep. Debbie Shultz
Rep. Debbie Schultz, D-Florida

WASHINGTON, January 11, 2022 — The executive director of an organization that pushes information technology reform in government testified Tuesday in front of the House Oversight committee that any incident reporting requirements that Congress is considering should not burden officials so much that they end up missing more serious breaches of cybersecurity.

Ross Nodurft of the Alliance for Digital Innovation told lawmakers studying the reform of the Federal Information Security Management Act, a 2002 law which implements an information security and protection program, that the amended legislation should consider keeping Congress abreast of incidents, but should be mindful of how it defines a security problem.

“As Congress considers defining major incidents or codifying vulnerability response policies, any legislation should be mindful of the dynamic nature of responding to cybersecurity challenges facing government networks,” Nodurft said. “If Congress is overly prescriptive in its definition of an incident, it runs the risk of receiving so many notifications that the incidents which are truly severe are missed or effectively drowned out due to thee frequency of reporting,” he said in prepared remarks.

The comments come on the heels of a year that included major cybersecurity attacks, including the attacks on software company SolarWinds, oil transport company Colonial Pipeline, which prompted a Senate hearing on the matter. The House Oversight committee released details of its investigation into some of the breaches in November.

The comments also come after lawmakers proposed new reporting requirements on companies. Those proposed laws would make it mandatory that small and large companies report incidents to the government so they can best prepare a response to protect Americans.

In July, Sens. Mark Warner, D-Virginia, Marco Rubio, R-Florida, and Susan Collins, R-Maine, introduced the Cyber Incident Notification Act of 2021, which requires federal and private sector cybersecurity intrusions to be reported to the government within 24 hours.

Cyber incident reporting was recently left out of a Senate bipartisan version of the National Defense Authorization Act.

Lead cybersecurity officials in government have been calling for mandatory breach reporting to government. Brandon Wales, executive director of the Cybersecurity and Infrastructure Security Agency, told the same Oversight committee in November that Congress should force companies to share that kind of information. Last summer, a Department of Justice official said he supports mandatory breach reporting.

In October, Secretary of State Antony Blinken announced the department intends to create a new cyber bureau to help tackle the growing challenge of cyber warfare.

Agency roles should be clarified

Rep. Debbie Schultz, D-Florida, talked about the varied organizations and institutions in her state that have been affected by cyberattacks and threats, including the Miami-based software company Kaseya, which experienced a major ransomware attack.

Schultz stated that there are two entities that are critical to federal cybersecurity: the Cybersecurity and Infrastructure Security Agency and the Office of the National Cyber Director.

Grant Schneider, senior director of cybersecurity services, Venable, said that the Office of the National Cyber Director acts as a conductor in the framework of FISMA. These organizations work with other organizations, such as the National Institute of Standards and Technologies, and the Office of Management and Budget.

With so many organizations, Nodurft explained how important it is for the roles within these organizations to be defined. He talked about how important it is for agencies to know where to turn to report cyberattacks. In part with this, he continued, agencies who “are proactively trying to mitigate their cyber risks” need clear reporting channels and clear areas of jurisdiction to go to for various issues.

According to Nodurft, these defined roles would “make it much easier for [agencies] to work together, to build a broader defensive structure.”

Continue Reading

Recent

Signup for Broadband Breakfast

Get twice-weekly Breakfast Media news alerts.
* = required field

Trending