NET • Fiends

cyberterrorism

new Richard Clarke Cpls Morrison & Medders international China NSA IntelSec tech Special Collections Service NIMA Tenet targets InQTel Ptech CCS JASON Amdocs & Comverse Megiddo Mormon tech F. Carlucci Carlyle Group telcomm NatSec kereitsu OnStar RPVs mayfly stray cat snoopbots & security StaySafeOnline.info security strategies NIPC NIST CRSC Infowar Politech CSI WashTech (Wash.Post) professionals cold war facilities DEW Michael Riconosciuto Tempest N.Richard Wagner

Internet traffic affected by electronic attack
1.25.03   CNN

With the growth of the Internet came a new way to spread viruses: e-mail. "Melissa" (1999), "Love Bug" (2000) and "SoBig" (2003) were among a slew of fast-moving threats that snarled millions of computers worldwide by tricking people into clicking on e-mail attachments and launching a program that automatically sent copies to other victims.
Although some of the early viruses overwhelmed networks, later ones corrupted documents or had other destructive properties. Compared with the early threats, "the underlying technology is very similar (but) the things viruses can do once they get hold of the computer has changed dramatically," said Florida Institute of Technology computer science prof. Richard Ford.

Later viruses spread through instant-messaging and file-sharing software, while others circulated faster than ever by exploiting flaws in Windows networking functions. More recently, viruses have been created to steal personal data such as passwords or to create relay stations for making junk e-mail more difficult to trace.
Suddenly, though, viruses weren't spreading as quickly. Virus writers now motivated by profit rather than notoriety are trying to stay low-key, lest their creations get detected and removed, along with their mechanism for income.

Many of the recent malicious programs technically aren't even viruses, because they don't self-replicate, but users can easily get infected by visiting a rogue Web site that takes advantage of any number of security vulnerabilities in computer software.
Although worldwide outbreaks aren't as common these days, "believe it or not there's exponentially more malware today than there ever was," said McAfee Inc.'s Avert Labs research manager Dave Marcus. "We find 150 to 175 new pieces of malware every single day. Five years ago, it would have been maybe 100 new pieces a week".

Symantec Corp. formed the same year Skrenta unleashed "Elk Cloner," but it dabbled in non-security software before releasing an anti-virus product for Apple's Macintosh in 1989. Today, security-related hardware, software and services represent a $38 billion industry worldwide, a figure IDC projects will reach $67 billion in 2010.
Even as corporations and Internet service providers step up their defenses, though, virus writers look to emerging platforms, including mobile devices and Web-based services like social-networking sites.
"Malware writers can't assume you are on PCs or won't want to limit themselves to that," said Symantec's security response dir. Dave Cole.

That's not to say Skrenta should get the blame anytime someone gets spam sent through a virus-enabled relay or finds a computer slow to boot because of a lingering pest. After all, there no evidence virus writers who followed even knew of Skrenta or his craft.
Fred Cohen, a security expert who wrote his Ph.D. dissertation in 1986 on computer viruses, said the conditions were right, and with more and more homes getting computers, "it was all a matter of time before this happened".
In fact, a number of viruses preceded "Elk Cloner," although they were experimental or limited in scope. Many consider Skrenta's the first true virus because it spread in the wild on the dominant home computers of its day.

"You had other people even at the time saying, `We had this idea, we even coded it up, but we thought it was awful and we never released it,'" said Skrenta, who is now heading Blekko Inc., a month-old startup still working in stealth mode.
Where was his restraint? Skrenta replied: "I was in the ninth grade."

		Town Hall meetings held Denver CO   Chicago IL Portland OR   Atlanta GA future Town Hall meetings planned San Antonio TX   Philadelphia PA Boston, MA   Pittsburgh PA NYC NY   Phoenix AZ   San Diego, CA President's Critical Infrastructure Protection Bd After a review initiated at the outset of the Administration, President Bush signed Executive Order 13231 (Critical Infrastructure Protection in the Information Age) in October, 2001 creating the President's Critical Infrastructure Protection Board. The Board is the central focus in the Executive Branch for cyberspace security. It is composed of senior officials from more than 20 departments and agencies. The President created a series of interagency committees that report to the Board on issues such as Education, Research, Incident Response, and Interdependencies. President's Critical Infrastructure Protection Board   Sept.18, 2002 Subject: A National Strategy to Secure Cyberspace President Bush directed the development of a National Strategy to Secure Cyberspace to ensure that America has a clear road map to protect a part of its infrastructureso essential to our way of life. On the pages that follow is a draft of that road map, developed in close collaboration with key sectors of the economy that rely on cyberspace, State and local govts, colleges and universities, and concerned organizations. These public-private partnerships that formed in response to the President's call have developed their own strategies to protect the parts of cyberspace on which they rely. They are made available online today. Other groups, representing other sectors, have recently formed, and have begun the process of developing strategies. Town hall meetings were held around the country, and fifty three clusters of key questions were published to spark public debate. Even more input is needed. This unique partnership and process is necessary because the majority of the country's cyber resources are controlled by entities outside of govt. For the Strategy to work, it must be a plan in which a broad cross-section of the country is both invested and committed. 8 more town hall meetings will be held around the country in the next few weeks to further solicit and receive the views of concerned citizens. Comments on the National Strategy to Secure Cyberspace may be sent via the feedback link at www.securecyberspace.gov by November 18, 2002. The National Infrastructure Advisory Committee, leaders from the concerned sectors of industry, academia, and State and local govt will add their comments and advice to that received from the town hall meetings and web site. The President will review and approve the Strategy in the next several months. Technology will continue to change rapidly. New vulnerabilities and threats will be uncovered. Elements of our present programs may be determined to be ineffective in the future. America's cybersecurity strategy must be dynamic and continually refreshed to adapt to the changing environment. For the foreseeable future, two things will be true: America will rely upon cyberspace and the Federal govt will seek a continuing broad partnership to develop, implement, and refine a National Strategy to Secure Cyberspace. We invite you to closely review the proposed strategy and share your input and expertise. Richard A. Clarke, chair Howard A. Schmidt, vice chair Cyberthreats not to be dismissed, warns Clarke   1.3.03   Dan Verton Computerworld U.S. ignored warning signs before: 2 attempts by al- Qaeda in 1994 to use airplanes as weapons, as well as public statements in 2000 about terrorists being trained as pilots. Now PCIPB chair Clarke is trying to prevent new warning signs from being ignored, signs that al-Qaeda's brand of terrorism has a growing cyber element and that the nation's economy is at risk. Before taking his current post Oct.2001, Clarke advised 2 presidents on cybersecurity and served as the country's first counterterrorism coordinator. Most of his time now is spent raising awareness of the changing nature of terrorism and the increasing relevance of cyberterrorism to the stated goals of groups such as al-Qaeda. "Cyberspace still is underappreciated as a threat, and the solutions aren't as obvious as they are with physical security ," said Clarke during an exclusive interview with Computerworld late last month. "We have no clue as a country how to protect our cyberspace. It is a totally different kind of issue." Clarke said vulnerabilities in the nation's critical infrastructure stem mainly from unknown security holes in widely deployed software and from the constant influx of new technologies that often have unintended consequences for security. One of his biggest concerns is the growing use of wireless technologies, he said. There have already been cases in Spain & Japan in which PC-based worms have infected hundreds of next-generation cell phones, tricking them into dialing local 911 emergency systems, Clarke added. "Now, if you're a terrorist, the first thing you might want to do before an attack is take down the 911 system," he said. According to Clarke, 9.11.01 was a turning point for the national effort to protect cyberspace. "Before, [al-Qaeda] was interested in killing as many people as possible," he said. "After, [Osama bin Laden] starts talking about destroying the American economy. And he starts to talk about going after U.S. economic infrastructure. You could drive around a lot of truck bombs and really not do a lot of damage to the economic infrastructure because it's so diverse & dispersed. But if you do it in cyberspace, you might have the ability to hit the entire financial services network simultaneously."   [ NatSec marketing: Speculation of projected terror in lieu of actual crime prevention. ] Clarke said he's aware that many people doubt terrorist organizations' willingness & ability to carry out strategic cyberattacks against the U.S. But he said it's his job to think differently about the future and to do what some officials failed to do in months leading up to 9.11.01. "There are a lot of different people who can conduct cyberwarfare," Clarke said. "There are countries that are creating cyberwarfare units. There are criminal groups engaging in cybercrime. There are also some terrorist groups we know are looking at using cyberattack tools. But I don't spend a lot of time trying to figure out who's going to be the next attacker." Eliminating al-Qaeda, for example, "won't end the threat to us from cyberspace," he said. Therein lies the challenge, according to Clarke. The U.S. needs to take the target of cyberspace away from its enemies by eliminating vulnerabilities, he said.
1 3 7 11 15 19 23 31 33 35 39 49 53 57	Introduction Cyberspace Threat and Vulnerabilities: A Case for Action National Policy & Guiding Principles Highlights _ Level 1: Home User and Small Business _ Level 2: Large Enterprises _ Level 3: Critical Sectors Federal Govt State and Local Govt Higher Education Private Sector _ Level 4: National Priorities _ Level 5: Global Summary of Recommendations Acronyms
Introduction Issued earlier this year, the National Strategy for Homeland Security addresses a very specific and uniquely challenging threat—terrorism in the U.S.—and provides a comprehensive framework for organizing the efforts of Federal, State, local and private organizations whose primary functions are often unrelated to national security. Cyberspace is essential to both homeland security and national security; its security and reliability support the economy, critical infrastructures, and national defense. Accordingly, the National Strategy to Secure Cyberspace is an implementing strategy, which supports both the National Strategy for Homeland Security and the National Security Strategy of the U.S.. The National Strategy to Secure Cyberspace describes initiatives to secure U.S. information systems against deliberate, malicious disruption and to foster an increased national resiliency. This Strategy, together with a complementary Homeland Security Physical Protection Strategy, provides the strategic foundation for the nation's efforts to protect its infrastructures. Strategy as Place This document, together with the accompanying online material from the private sector and academia, is a Strategy of the steps the U.S. will take to secure the information technology networks and systems that are necessary for the nation's economy, defense, and critical services to operate. Those networks, and the related information technology equipment and software that make them work together, make up our cyberspace. This Strategy is a place where many parts of our nation will describe what they plan to do, and what their strategy is to secure their part of cyberspace. In this Strategy, readers will see plans from and for a diverse group of Americans: teachers, military officers, privacy experts, doctors, stock brokers, police, civil servants, computer scientists, State govt officials, corporate CEOs, and Federal officials. It is also a place where Americans can get advice, whether they are a home user of the Internet, a small business person, the Chief Information Officer of a "small cap" enterprise, a city mayor, a State Governor, a Chief Executive Officer of a Fortune 100 company, or a member of the board of directors of a company of any size. Strategy as Process This Strategy is not written in stone. The President's Critical Infrastructure Protection Board (PCIPB) plans to periodically issue, online, new releases of the Strategy as it evolves. The introduction to each release will highlight updates from the previous version. Component strategies were developed by stakeholders and customers of cyberspace. Representatives of companies that own and operate critical infrastructures came together to draft how banking and finance, electric power, railroads, and other sectors could secure their parts of cyberspace. Community colleges and major universities teamed to plan for securing cyberspace at academic institutions. Big city police and small town sheriffs collaborated on the cyberspace security needs of law enforcement. Congressional committees in both houses held hearings on cybersecurity and related topics. Dozens of national associations met and devoted thousands of hours in developing contributions to this Strategy. These groups have developed strategies for how they will help secure the portions of cyberspace that they own or operate, because each user of cyberspace must play a role in securing it. That fact does not absolve the Federal govt of its responsibilities, which are many & outlined in the Strategy. It does, however, underline the reality that the Federal govt alone cannot secure cyberspace. We must all do our part. We will be as successful as the sum of those efforts. The Strategy Will Evolve   as more of the nation devises strategies for securing parts of cyberspace;   as component strategies become more detailed and refined with experience;   as technology changes and brings new security challenges and capabilities;   as more is learned about changing vulnerabilities and threats;   as consensus forms on ideas proposed for discussion in earlier releases; and,   as some of the initial ideas mature. To stimulate debate and discussion, the President's Board solicited the views of experts across the country on what are the key issues and questions that should be addressed by the Strategy. The accumulated questions were then placed on web pages sponsored by a govt agency, an association, and a private organization. Many citizens offered their views. This initial release of the Strategy proposes answers for most of the questions and places others in "Agenda Boxes" for continued national dialogue. As a further part of the national dialogue, the President's Critical Infrastructure Protection Board hosted public town meetings in the spring of 2002, prior to the initial release of the Strategy. These meetings were held in cities around the country. In addition, the Commerce Dept's Critical Infrastructure Assurance Office (CIAO) sponsored meetings with State & local govt officials from several States, which incl national-level conferences held in Austin TX 2.12-13.02, and Princeton NJ 4.23-24.02. Following the Internet launch of the initial release, additional town meetings and State forums may be held as part of the effort to maintain national dialogue on securing cyberspace. Additional meetings around the country are possible and initial planning is underway. Further details will be posted on the web site, www.securecyberspace. gov, as events are confirmed. The National Strategy to Secure Cyberspace supplements other strategies The National Strategy to Secure Cyberspace supplements the National Strategy for Homeland Security and the National Security Strategy of the U.S.. Its "Policy and Principles" section, together with President Bush's Executive Order 13231, provides the Administration's policy guidance on cyberspace security. Some sections of this Strategy are more detailed than others. However, as the Strategy evolves in subsequent editions, it will attempt to address all of the major problems of cybersecurity in appropriate detail. The Strategy is a roadmap for the Administration, the Congress, State and local govts, sectors of the economy, higher education, and the American Internet consumer. The recommendations are directed at many audiences, including the Administration itself. The Strategy does not substitute for the normal decision-making process about budgets and policies. While there are many recommendations in the Strategy that do not require additional resources, those that do will be considered in the normal processes. Many of the recommendations will become the work of the President's Critical Infrastructure Protection Board and its interagency committees. Subsequent editions of the Strategy will reflect the decisions made in the FY04 budget process and the work of the Board and its committees, as well as progress by individual departments and agencies.

Strategy for Cyberspace, in Cyberspace The printed version of this release references places in cyberspace where strategies developed by various groups, as well as other useful material, may be found. Because of size limitations, the hard copy does not contain the text of all references. However, the online version contains hyperlinks to referenced materials. In this paper document, you will find these core components of the Strategy:   the Case for Action: Cyberspace Threats and Vulnerabilities;   the Policies and Principles Guiding the Strategy;   Highlights of the Strategy; and,   5 Levels of the National Strategy (the home user, the large enterprise, critical sectors, the nation, and the global community).

Throughout the 5 levels in the online version, agenda boxes will highlight: levels R1 Recommendations Specific actions that govt and nongovt entities can take to promote cybersecurity. P1 Programs Existing efforts in cybersecurity D1 Discussions Issues highlighted for continued analysis, debate, and discussion.

In the paper document, "Recommendations and Programs and Discussions" will be summarized at the end of each level. Over time, "Discussions" should either result in "Recommendations" or end with no action. Similarly, "Recommendations" should evolve. In some instances they might become initiatives undertaken by individuals or private organizations.
In other cases, they may become efforts or programs sustained by govt. Because of the changing nature of cyberspace some of the recommendations might be discarded if, on closer examination, they are determined not to be feasible or cost effective as programs. Subsequent releases of the Strategy will update these outcomes.

The Strategy is hyperlinked to documents and web pages owned and operated by nongovt organizations, trade associations, academic institutions, State and local govts, and corporations. Their content is determined by them alone and their inclusion does not constitute automatic acceptance of their views by the Federal govt. They are included because the National Strategy is not intended to be a Federal govt prescription, but rather a participatory process.
Please join this process to help secure cyberspace, so that the U.S. can continue to reap the benefits of the Information Technology Revolution in education, health sciences, the economy, E-Govt, and national defense. Only by securing cyberspace can the next level of benefit it offers be tapped to its full potential.

Cyberspace threats & vulnerabilities: a case for action

Case for Action - key themes   Cyber incidents are increasing in number, sophistication, severity, and cost.   The nation's economy is increasingly dependent on cyberspace; this has introduced unknown interdependencies & single points of failure.   A digital disaster strikes some enterprise every day. Infrastructure disruptions have cascading impacts, multiplying their cyber and physical effects.   Fixing vulnerabilities before threats emerge will reduce risk.   It is a mistake to think that past levels of cyber damage are accurate indicators of the future. Much worse can happen.   The common defense of cyberspace depends on a public-private partnership.   Everyone must act to secure their parts of cyberspace.

A week after the terrorist attacks on September 11, a less physically destructive but economically significant attack was striking leading financial services firms a few blocks away from the World Trade Center site. Its significance was not in the amount of damage caused, which was considerable, but because it may foreshadow what we could face in the future. The attack was called NIMDA ("ADMIN" spelled backwards), and for a nation that has become dependent on computer networks, it was a wake-up call. NIMDA was an automated cyber attack, a blend of a computer worm and a computer virus; it propagated across the nation with enormous speed and tried several different ways to infect computer systems it invaded, until it got in and destroyed files. It went from nonexistent to nationwide in an hour, lasted for days, and attacked 86,000 computers.

NIMDA caused significant problems in well-protected industries, forcing firms offline, shutting down customer access, and requiring some firms to rebuild systems entirely. The actual financial cost of the NIMDA attack is unknown because there is no consistent method to track such damage.

However, industry sources estimate that the overall financial impact of cyber attacks resulting from malicious code could have been $13 billion in the year 2001. Two months before NIMDA, a cyber attack called Code Red had infected 150,000 computer systems in 14 hours, causing billions of dollars in losses. Such attacks demonstrate the growing sophistication and destructiveness of cyber attacks. The volume of attacks is also up: Carnegie Mellon University's Computer Emergency Response Team's [CERT] Coordination Center reported 3,700 attacks in 1998, and at current rates will report over 110,000 in 2002. Other teams report similar, dramatic growth in cyber attacks. That trend is likely to continue.

A nation now fully dependent on cyberspace
For the U.S., the Information Technology Revolution quietly changed the way business and govt operate. Without a great deal of thought about security, the nation shifted the control of essential processes in manufacturing, utilities, banking, and communications to networked computers. As a result, the cost of doing business dropped and productivity skyrocketed. The trend towards greater use of networked systems continues. By 2002, our economy and national security are fully dependent upon information technology and the information infrastructure. A network of networks directly supports the operation of all sectors of our economy— energy (electric power, oil and gas), transportation (rail,air, merchant marine), finance and banking, information and telecommunications, public health, emergency services, water, chemical, defense industrial base, food, agriculture, and postal and shipping.

The reach of these computer networks exceeds the bounds of cyberspace. They also control physical objects such as electrical transformers, trains, pipeline pumps, chemical vats, radars, and stock markets. At the core of the information infrastructure upon which we depend is the Internet, a system originally designed to share unclassified research among scientists who were assumed to be uninterested in abusing the network. It is that same Internet that today connects into millions of other computer networks, which, make most of the nation's essential services work. While the Internet has grown enormously and globally, it has also grown increasingly insecure. People in almost every country on the globe can access a network that, in turn, is ultimately connected to networks that run critical functions in the U.S..

Cyber attacks on U.S. information networks occur regularly and can have serious consequences such as disrupting critical operations, causing loss of revenue and intellectual property, or loss of life. Countering such attacks requires the development of robust capabilities where they do not exist today, if we are to reduce vulnerabilities and identify and deter those with the capabilities and intent to harm national infrastructures.

A range of threats A spectrum of actors conduct attacks against the information infrastructure. They range from "script kiddies" who download malicious software from the Internet to carry out the equivalent of annoying graffiti attacks in cyberspace; to hackers who merely want to demonstrate their destructive skills; to trusted "insiders" who exploit their access to computer systems to cause damage; to criminal organizations that engage in fraud, extortion, and theft in cyberspace; and to terrorists and potential enemy nation states spying on us now, and developing plans that would enable them, in a future conflict, to damage our economy and weaken or control the physical and cyber systems the U.S. needs to fight back. Identifying those who did or might attack provides an opportunity to not only stop them and bring them to justice (whether, for example, through arrests in the case of criminals, or military means in the case of acts of information warfare), but also to learn their skill sets and better focus national protection efforts.

An excerpt from a letter to the President from 50 scientists, computer experts and former intelligence officials. Consider the Following Scenario … A terrorist organization announces one morning that they will shut down the Pacific Northwest electrical grid for six hours starting at 4pm; they then do so. The same group then announces that they will disable the primary telecommunication trunk circuits between the U.S. East and West Coasts for a half day; they then do so, despite our efforts to defend against them. Then, they threaten to bring down the air traffic control system supporting New York City, grounding all traffic and diverting inbound traffic; they then do so. Other threats follow, and are successfully executed, demonstrating the adversary's capability to attack our critical infrastructure. Finally, they threaten to cripple e-commerce & credit card service for a week by using several hundred thousand stolen identities in millions of fraudulent transactions, if their list of demands are not met. Imagine the ensuing public panic and chaos. What makes this scenario both interesting and alarming is that all of the aforementioned [types of] events have already happened, albeit not concurrently nor all by malicious intent. They occurred as isolated events, spread out over time; some during various technical failures, some during simple exercises, and some during real-world cyber attacks. All of them, however, could be effected through remote cyber attack…

Reduce vulnerabilities, in the absence of known threats
While the nation must deal with specific threats, waiting to fix any important vulnerability in the critical infrastructure until learning of an impending attack by an identified attacker is an unacceptably risky strategy for potential victims. Both the Code Red and NIMDA cyber attacks of 2001 burst onto the nation's networks with little or no warning and spread so fast that many victims did not have a chance to hear the alarms. Even if they had, many victims did not have time, knowledge, or tools to protect themselves. Creating defenses against these attacks would have taken days in some cases.

A key lesson from these cyber attacks and others like them is that those who rely on networked computer systems need to identify and remedy their vulnerabilities now, rather than wait for an attacker to be stopped or until alerted of an impending attack. No one has yet been arrested for launching the Code Red or NIMDA attacks. However, it is important to note that computer attacks are serious felonies and perpetrators are being caught with increasing regularity.
Identifying vulnerabilities by having a group of trained professionals complete an information technology security audit can take 2-3 months. Remedying the most serious vulnerabilities by creating a multi-layered defense and a resilient network may take several additional months. Then the process must be regularly repeated.

New vulnerabilities requiring continuous response
The process of securing networks & systems must be continuous because new vulnerabilities are created or discovered regularly. CERT/CC notes that not only are cyber incidents and the number of attacks increasing at an alarming rate, so too are the number of vulnerabilities that an attacker can utilize. Identified computer security vulnerabilities, problems with software and hardware that permit unauthorized entry or damage to a network, more than doubled in the last year, with 1,090 separate vulnerabilities reported in 2000, and 2,437 reported in 2001. Installing a network security device is not a substitute for a constant focus on keeping defenses up to date.

In a recent survey by the Computer Security Institute, 90 percent of respondents used anti-virus software, but 85 percent had been damaged by a virus. In the same survey, 89 percent had installed computer firewalls and 60 percent had intrusion detection systems, yet 90 percent reported security breaches had taken place and 40 percent had their systems penetrated from outside their network. The majority of security vulnerabilities can be mitigated with good security practices. As these survey numbers indicate, good security practices include not just installing those devices, but operating them correctly and keeping them current, including regular patching and virus updates.

Cybersecurity and opportunity cost
For individual companies and for the national economy as a whole, improving computer security often requires investing attention, time, and money. President Bush requested that Congress increase funds to secure Federal computers by 64 percent in FY03.
President Bush's investment in securing Federal computer networks will eventually reduce expenditures through cost saving E-Govt solutions, modern enterprise management, and by reducing opportunities for waste and fraud.

For the national economy and, in particular, for the information technology industry, the dearth of trusted, reliable, secure information systems is a barrier to future growth. Much of the promise and potential of continued growth in the economy, as a result of the Information Technology Revolution, has yet to be realized. That unrealized opportunity, including e-commerce and business-to-business (B2B) activity, is in part deterred by computer security risks. Vulnerability in cyberspace places more than transactions at risk; it can jeopardize intellectual property, business operations, infrastructure services and consumer trust.

Investment in cybersecurity is not just more costly overhead. There is a return on security investment. Surveys have repeatedly shown that:   the costs associated with a severe computer attack are likely to be greater than the preemptive investment in a cybersecurity program would have been; and,   designing strong security into the information systems architecture of an enterprise can reduce overall operational costs by enabling cost-saving processes such as remote access and customer or supply chain interactions that could not occur in networks lacking appropriate security. These results suggest that with greater awareness of the issues, companies may find benefit in increasing their level of cybersecurity. Greater awareness and voluntary efforts are critical components of this Strategy.

Individual & national risk management
Prior to the events of September 11, damage from overseas terrorist networks in the U.S. had been very limited. In one day that changed. One estimate places the increase in cost to our economy from attacks to U.S. information systems at 400 percent over four years. While those losses remain relatively limited, that too could change abruptly.

Every day in America an individual company, or a home computer user, suffers damage and losses from cyber attacks that, on an individual level, are significant, perhaps even catastrophic. The ingredients exist for that kind of damage to also occur on a national level, to the networks and systems upon which the nation depends:

  the vulnerabilities of the nation's systems are many and well known.

These factors mean that no strategy can completely eliminate risk, but the nation can and must act to manage risk responsibly and to minimize the potential damage that could be done by exploiting vulnerabilities. By noting this in a public document, we are not telling potential foes something that they and others do not already know. In 1997, a Presidential Commission identified the risks in a seminal public report. In 2000, the first national plan to address the problem was published. In 2001, President Bush, citing these risks, issued an Executive order making cybersecurity a priority issue and increased funding to secure Federal networks.
In 2002, the President moved to consolidate & strengthen Federal cybersecurity agencies.

Govt alone cannot secure cyberspace
Yet despite this awareness and these measures, the risk continues to our national information networks and the critical systems they manage. Reducing that risk requires an active, unprecedented, partnership among diverse components of our country and our global partners.
The Federal govt should not and, indeed, could not, secure the computer networks of privately owned banks, energy companies, transportation firms, or other parts of the private sector. The Federal govt should not intrude into homes and small businesses, into universities, or local agencies and departments to create secure computer networks.

Each American who depends on cyberspace, the network of information networks, must secure that part that they own or for which they are responsible. The Federal govt can help to empower Americans to do just that, by:

  The U.S. should work with individual nations and with nongovtal organizations (e.g., Forum of Incident Response and Security Teams (FIRST)), and international organizations (e.g., International Telecommunications Union (ITU)), to promote the establishment of national and international watch and warning networks that will be designed to detect and prevent cyber attacks as they emerge. In addition, such networks could help support efforts to investigate and respond to attacks.

6 tools for empowerment discussed for each level of audience
The Strategy provides a roadmap to help Americans understand their part in securing cyberspace. To make this roadmap easier to use, it is divided into audience levels: Level 1 for home users and small businesses, Level 2 for large enterprises, Level 3 for sectors including govt, private industry, and higher education, Level 4 for national issues and efforts, and Level 5 for discussion of global issues. Each of these levels and their sub-levels will have its own strategic goal. These goals will be supported by strategic actions that the nation will take to achieve the goals.

6 tools for empowerment (see page 11) will help drive corresponding strategic actions at each level. Some or all of the 6 tools may be employed at each level. For example, "Awareness & Information" will help empower the home user as well as private sector employees & Federal workers to secure their portion of cyberspace.
Roles & partnerships will be identified and described at all levels. Not every tool will be appropriate for every level, but, taken together, these tools will underpin all of the nation's efforts to secure cyberspace.

level 1   Cyber attacks on home user & small business

Former U.S. attorney finds skills carry over to Microsoft   4.21.08   Costas Paris Wall St Journal Katharine Bostick, who for 11 years served as a U.S. govt atty investigating and prosecuting cases as varied as fraud, international drug smuggling and money laundering, now serves as Microsoft Corp.'s senior director of legal and corporate affairs in Asia Pacific. She joined Microsoft in 2001 and leads its regional efforts to combat cybercrime. The company credits her with developing and implementing its regional initiatives to protect the public from growing Internet threats, including malicious code, botnets, spam, online fraud and other cyberattacks, in cooperation with govts, companies, law enforcement and consumers. One important focus is improving protection for children who might be victims of computer-facilitated crimes, Microsoft says. Immediately prior to joining Microsoft, Ms. Bostick was chief of the Organized Crime Drug Enforcement Task Force for the Pacific region in the U.S. attorney's office in San Francisco. Before that she had served as an assistant U.S. attorney in New York, the Narcotic and Dangerous Drug Section at the U.S. Justice Dept, and in Northern California. Ms. Bostick earned her law degree at the University of California at Berkeley. Before that, she received a bachelor of science degree in economics from Santa Clara University, also in California. She is licensed to practice law in New York, California and Washington, D.C. WSJ: You moved from managing people in the public sector to managing people in the private sector. What's the difference? Ms. Bostick: The public and private sectors both provided vital experience, because it's partnerships that enable the best results in the area I am focused on now: fighting cybercrime. Core values of integrity, honesty and being respectful apply to my job as a federal prosecutor and in Microsoft. The one difference at Microsoft is that you push your team to be self-critical. You ask them to look internally and ask what we could have done better, even if something was successful. [At Microsoft] I need to ensure that our legal teams are integrated into the business, understand the business and listen to the needs of our business teams. Our role is to ensure that the overall business environment allows for growth and innovation, and that we achieve that success by doing the right things in the right way. We work to protect the public by ensuring the Internet is safer and more secure. WSJ: Of the countries across Asia, which is the most difficult to deal with? Ms. Bostick: Often, the most challenging can be where you can achieve the most success. For example, China has certainly been a journey with many challenges, and there is no quick fix as far as intellectual-property rights are concerned. In early April, the U.S. attorney general discussed the largest-ever joint operation between the FBI and the People's Republic of China against a major counterfeit-software organization worth half a billion dollars. It was an historic, win-win situation because 10 years ago this type of action wouldn't have been possible. Today's actions are the result of years of diplomatic, legislative and public-private partnerships to build an environment that promotes innovation and protects intellectual property. When you work with foreign governments or law enforcement, the key is to win their trust, and this is an ongoing learning process, which varies from country to country.   [ Straight from the mouth of Karen Crowder ] WSJ: What was the biggest lesson you learned from your first job? Ms. Bostick: In my first job, as a cashier and hostess at a restaurant, I saw employees at the cash register ringing zero-value receipts for customers who didn't check or take the receipts, and then pocketing the money. Management figured out what was happening and revised the checkout process to ensure accountability for each cashier. At Microsoft and with my team, I try to ensure that we have processes in place that ensure we have a culture of accountability and integrity. I try to focus on developing employees and teams who do not take short cuts to win, and I emphasize that the best way to serve our customers is to win the right way, which doesn't mean winning at any cost.

What can happen What it means Hard Drive Crashing A common problem caused by computer viruses on home and small business computers has been extensive damage to files, software, and operating systems that can leave the user with a blank screen and costly repair bills. Often, more importantly, the small business owner or home user may lose irreplaceable data, such as customer records or personal correspondence. Identity Theft Information stored on a home computer may provide a hacker with enough personal data that the thief could apply for a credit card or identification in the user's name. Credit Theft Rather than applying for a new credit card, a thief might just use credit card data on the hard drive of a home user or small business to buy products online and have them shipped to a drop site, such as a commercial "mail box" store. Tunneling When employees work at home and then transfer files to a computer at the office, there is a potential that someone could remotely gain access to the home PC and place a secret file in a document that ends up on the company system. Extortion For the small businesses, someone may access the customers names and credit card numbers and threaten to post that information on a Web site, unless the business owner pays up. Zombies Automatic programs search for systems that are connected to the Internet, but are unprotected, take them over without the owner's knowledge, and use them for malicious purposes. Compromise of Private Information Some viruses send private or confidential files from a user's hard drive to people in the user's email address book. Table 1-1 Discussion of Strategy Five Steps to Safety There are many places a homeowner, parent, or small business person can turn for help in avoiding security problems on the Internet. Before reviewing the helpful web sites cited below, consider these five simple steps: 1. Use a Tough Password: Hackers use software that is commonly available on the Internet to guess passwords and gain access to personal accounts and computers. It is important to use a strong password and change it on a regular basis. Strong passwords usually include: • at least eight digits; • a mix of upper and lower case letters; • a random mix of letters and numbers (not just numbers at the end); and, • keyboard symbols (#,$,&, *). Home users should change their password at least once every six months, perhaps when the clocks change to daylight saving time and back to standard time. 2. Maintain an Updated Virus Protection Program: New viruses appear weekly and the new ones are the most frequent source of damage. The virus protection programs that come installed on the computer are quickly out of date, but they can be kept current by enrolling with the antivirus company for an update program. Many update programs now offer automatic notification of new data, so that the user does not need to remember to go to the antivirus site every week. 3. Update Patches: Many commonly used software programs (operating systems, web browsers, e-mail readers, and others) are regularly discovered to have security holes or flaws. The software companies issue the equivalent of "recall notices," but unlike a similar notice from a car company, it may not appear in the mail. Typically, a user has to go to the software company's web page to discover the problem and the solution. The solution is usually a small amount of additional software that can be downloaded over the Internet. These fixes, called "patches," are recommended for most home users and small businesses running uncomplicated systems. (In larger systems, the patch must be analyzed first to see if it will create conflicts with other programs.) 4. Filtering: Parents may want to consider managing their children's Internet use with software that allows them access to age-appropriate sites and materials. Many ISPs offer such software or filters, or they can be obtained from private vendors. In addition to filtering inappropriate sites, a parent may wish to limit the people from whom their child can receive e-mail. Most ISPs allow users to filter by listing the addresses from which they are willing to receive e-mail on all e-mail accounts they maintain, or just on their children's. 5. If you Have a Cable Modem, Digital Subscriber Line (DSL), Satellite or Other High Speed Connection: A high-speed connection that is always connected to the Internet (or more often than with dial up modems) makes the home user or small business an attractive target for the "bots" that search the Internet automatically for insecure connections. Even with updated virus software and current patches, smart "bots" can find a way to get into a system without the user knowing it. To prevent such covert entries, those with broadband connections (e.g., DSL, cable, satellite or wireless) should have additional software, known as a "firewall." Firewalls can be easily configured to close the many doors to the Internet that all computers have, leaving open only the few that people typically use (e.g., for e-mail and web browsing). A user can specify what Internet programs are trusted to enter, and require all others to knock and be granted permission. Where to go for General Cybersecurity Advice An alliance of govt agencies, corporations, and nongovt organizations have joined to form the "National Cyber Security Alliance" to help home users, parents, and small businesses. Their web site is filled with helpful information and links to other sites with additional data. Go to: www.StaySafeOnLine.info. For Small Businesses Small business persons may want to seek cybersecurity ideas from local programs at nearby community colleges or chambers of commerce. On the national level, the Federal govt's Small Business Administration (www.sba.gov) and the not-for-profit National Federation of Small Businesses (www.nfib.com) can also provide assistance. In many larger cities, the National Infrastructure Protection Center partners with local businesses, the FBI, and academic experts in chapters of "Infragard", a grass roots public-private partnership for cybersecurity and against cybercrime, www.infragard.net. In some metropolitan areas, the U.S. Secret Service sponsors a publicprivate partnership for cybersecurity related to financial institutions, credit cards, and cell phone theft. These groups are called the "Electronic Crimes Task Forces," www.usss.gov/ectf.htm. In addition, the Computer Security Division of the National Institute of Standards and Technology maintains a computer security resources web page which provides helpful links to other centers of expertise where users can locate more alerts, software updates, and lists of the most common security threats, www.csrc.nist.gov. For Parents and Teachers In addition to the web sites already noted above that provide filters and teaching ideas, there are additional resources online that can help plan curricula, provide children with good advice, and help parents to decide what is safe: The "CyberSmart School Program" is designed for teachers and provides lesson plans and professional development material. See www.cybersmart.org. "NetSmartz" is designed to teach children directly about what to watch out for when surfing the net. See www.netsmartz.org. "Get NetWise" is a resource for families trying to decide what they should consider about their children's web access. See www.getnetwise. org. The Information Technology Association Foundation sponsors "Cybercitizen Awareness," which teaches teenagers about ethics online and the risks of cybercrime. Its site also provides material for teachers, parents, and smaller children. See www.cybercitizenship.org. 17 RECOMMENDATIONS Specific actions that govt and nongovt entities can take to promote cybersecurity.* R1-1 Because automated hacking programs scan the Internet for unprotected broadband connections to exploit, those home users and small businesses planning to install a DSL or cable modem should consider installing firewall software first. (Some Internet service providers (ISPs), offer firewall software with DSL or cable modem set up.) Once firewall software is installed, it is important to regularly update it by going to the vendor's web site. R1-2 Because new computer viruses are introduced every week, home users and small businesses should regularly ensure that they are running an up-to-date "antivirus system." (Some antivirus vendors offer automatic updates online. Some Internet service providers scan all incoming e-mail for viruses before the e-mail gets to the user's computer.) R1-3 Because new viruses often come as e-mail, home users should use caution when opening e-mail from unknown senders, particularly those with attachments. To reduce the number of unknown senders, home users should consider using software that controls unsolicited advertisements, called "spam." (Some ISPs offer programs to block spam. Some ISPs also offer to block all incoming e-mail except from those friends and associates that the user selects.) R1-4 Home users should also regularly update their personal computer's operating systems (such as Microsoft Windows, Linux) and major applications (software that browses the Internet or creates documents, charts, tables, etc.) for security enhancements by going to the vendors' web sites. (Some software vendors offer automatic updates online.) R1-5 Internet service providers, antivirus software companies, and operating system/application software developers should consider joint efforts to make it easier for the home user and small business to obtain security software and updates automatically and in a timely manner, including warning messages to home users about updates and new software patches. PROGRAMS Existing efforts in cybersecurity. P1-1 Stay Safe Online web site: An alliance of govt agencies, corporations, and nongovt organizations have come together to form the National Cyber Security Alliance to help home users, parents, and small businesses. Their web site is filled with helpful information and links to other sites with additional data. Go to www.StaySafeOnline.info. P1-2 FTC "Guide for E-Consumers," www.ftc.gov/bcp/conline/pubs/alerts/glblalrt.htm. P1-3 FTC "How to Be Web Ready," www.ftc.gov/bcp/conline/pubs/online/webready/index.htm. P1-4 FTC "How to Protect Kids' Privacy Online," www.ftc.gov/bcp/conline/pubs/online/kidsprivacy.htm. P1-5 InfraGard: In many larger cities, the National Infrastructure Protection Center partners with local businesses, the FBI, and academic experts in chapters of InfraGard, a grass roots publicprivate partnership for cybersecurity and against cybercrime www.Infragard.net. P1-6 The Internet Fraud Complaint Center (IFCC) is a partnership between the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C) www1.ifccfbi.gov/index.asp. P1-7 American Library Association, "The Librarian's Guide to Cyberspace for Parents and Kids," www.ala.org/parentspage/greatsites/ guide.html. P1-8 The FTC, U.S. Secret Service, the FBI, and others have formed the "Consumer Sentinel" to help consumers get the facts on frauds from Internet cons, prize promotions, work-at-home schemes, and telemarketing scams to identity theft and make it easy to file fraud complaints so they can be shared with law enforcement officials across the nation www.consumer.gov/sentinel/. P1-9 DOJs Computer Crime Web site: information regarding a wide variety of computer crime and computer security issues, including a children's Cyberethics page and a link to invite DOJ experts to speak www.cybercrime.gov. DISCUSSIONS Issues highlighted for continued analysis, debate, and discussion. D1-1 The biggest business in America is small business. Working through the SBA, many small businesses are able to obtain loans guaranteed by the Federal govt. Increasingly, the cybersecurity of small business can impact its employees and the broader economy. Should SBA loans require an IT security checklist? D1-2 How can parents and children create a useful dialogue about securing their families' cyberspace? Cybersecurity is an area where parents and children each bring their own experience and expertise. By sharing these experiences, families can improve the cybersecurity of their household and contribute to an overall increase in America's cybersecurity. AGENDA LEVEL 1: The Home User and Small Business *Note: The feasibility and cost effectiveness of these recommendations will vary across entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them. The strategic goal is to encourage and empower large enterprises to establish secure systems. This goal can be achieved through a range of voluntary initiatives including: • raising the level of responsibility; • creating corporate security councils for cybersecurity, where appropriate; • implementing A.C.T.I.O.N.S. (defined in the table, infra) and best practices; and, • addressing the challenges of the borderless network, mainframe security, instant messaging and other technologies. Issues and Challenges The development of a resilient cyber infrastructure that supports the longterm economic development of the nation depends in large part on the security of large enterprises. Large enterprises do not operate in isolation. Rather, they provide a constant flow of data that helps to drive the U.S. economy. Resiliency enables the nation to protect, detect, respond, and recover from cyber-based attacks. Developing this essential economic attribute is a collective challenge that can only be achieved through the corporate actions of large enterprise operators. Large enterprises can play a unique role in developing this resiliency by ensuring that security is an integral component of their individual architectures, network operations, and management. The massive networks that facilitate the transactions of the U.S. economy constitute both our strength and our vulnerability. The economic consequences of cyber attacks on businesses do more than impact the short-term bottom line of a company. Rather such events can compromise intellectual property and sensitive research that can lead to long-term macroeconomic loss. Moreover, security breaches can place customer data at risk and erode confidence and trust in an enterprise and its affiliates. Cyber vulnerabilities can significantly damage large enterprises, if not remediated. Moreover, these same vulnerabilities can be exploited to harm other systems outside the enterprise and even infrastructures. Cybersecurity is one of the most complex challenges facing large enterprises today. Technical and policy challenges, global interconnections, and Internet-based commerce complicate the provision and management of enterprisewide security. Cybersecurity is a moving and dynamic target. There is no one-size-fits-all solution, or special technology, that will make an enterprise secure. In fact, 100 percent security is not a possibility in today's interconnected environment. Ultimately, addressing cybersecurity within an enterprise is more than a technical problem, it is a management challenge. The scope of the risks presented by cybersecurity can be effectively managed by engaging senior leadership and by involving the corporate board of directors. Cybersecurity may warrant close attention from the board of directors. Considering security only after an incident has occurred places the business, the customers, and even the country at risk. In contrast, effective governance of cybersecurity promotes growth, productivity, and shareholder confidence. Discussion of Strategy Raise the Level of Responsibility The board of directors plays a vital role in the corporate system. Shareholders ultimately own corporations. Corporate boards are accountable to shareholders, and, in turn, managers are accountable to the board. Raising the responsibility for cybersecurity to the level of the board of directors can have significant enterprisewide results. The board can better understand its enterprise by asking a series of questions about the Questions corporate boards, financial analysts and investors should ask: 1. What board members are responsible for IT security and risk management oversight? Do these members provide an annual report to the board? 2. Who is the senior most corporate official responsible for IT security and to whom is he or she directly accountable? 3. How often do the CEO and COO review IT security and the overall corporate risk management? 4. What internal IT security policies exist and do they involve annual training of all employees? 5. Are the security controls of the company's computer systems sufficient to prevent unauthorized access to files, alterations of data, loss or theft of trade secrets and assets? LEVEL 2: LARGE ENTERPRISES LEVEL 2: LARGE ENTERPRISES sufficiency of the organization's security structure and controls. To better understand the scale, scope, and effectiveness of enterprise cybersecurity, some boards, through an appropriate board committee, require periodic reporting by management. The U.S. Dept of Commerce uses its Critical Infrastructure Assurance Office (CIAO) as its lead office to partner with the private sector to help promote the importance of information security management and assurance to senior managers and directors. The CIAO has been working with the Institute of Internal Auditors (IIA) to help raise awareness about critical infrastructure protection in the context of a large enterprise. The IIA teamed with the National Association of Corporate Directors, the American Institute of Certified Public Accountants, and the Information Systems Audit and Control Association to host a series of informative summits across the country. These highly successful events heightened the awareness of corporate directors and top managers of their key role in safeguarding the information assets of the organizations they oversee. Towards a Corporate Security Council Today's diffuse security threats require new thinking and approaches. For example, some large enterprises may want to consider creating a corporate security council consisting of key members of the company with security-related responsibilities. Corporate officials with risk management and security-related responsibilities could form the core of such a team. These officials may include: • The Chief Operating Officer (COO); • The Chief Information Officer (CIO); • The Chief Technology Officer (CTO); • The Chief Information Security Officer (CISO)/ Chief Security Officer (CSO); • The Chief Risk Officer (CRO); • The Privacy Officer; and, • The official responsible for physical security. These officials can coordinate preparedness plans to ensure that cybersecurity is factored into the operations of the enterprise. Because a failure in cybersecurity can compromise intellectual property, customer data, and business operations, it is important that the key decision makers and technical officials are brought together. Furthermore, they can advise the CEO in a crisis and coordinate the execution of their contingency and continuity plans in response to cybersecurity incidents. The resiliency of large enterprises contributes directly to resiliency of the macro economy, and ultimately, the nation. A.C.T.I.O.N.S. and Best Practices There are a wide range of A.C.T.I.O.N.S. that can be undertaken to facilitate the integrity, reliability, availability, and confidentiality of the enterprise. (Figure L2-1) A.C.T.I.O.N.S. AND BEST PRACTICES Authentication Implement processes and procedures to authenticate, or verify, the users of the network. This may include techniques such as PKI using smart cards, secure tokens, biometrics, or a combination of efforts. Configuration management Plan enterprise architecture and deployment with security in mind. Manage configurations to know exactly what hardware, operating systems and software are in use, including specific versions and patches applied; create robust access and software change controls, segregate responsibilities; implement best practices; and, do not use default security settings. Training Train all employees on the need for IT security and ensure that security is factored into developing business operations. Foster an enterprise culture of safety and security. Incident response Develop an enterprise capability for responding to incidents, mitigating damage, recovering systems, investigating and capturing forensic evidence, and working with law enforcement. Organization network Organize enterprise security management, IT management, and risk management functions to promote efficient exchange of information and leverage corporate knowledge. Network management Create a regular process to assess, remediate, and monitor the vulnerabilities of the network; consider developing automated processes for vulnerability reporting, patching, and detecting insider threats. Internal and external IT security audits can also supplement these efforts. Smart procurement Ensure that security is embedded in the business operations and the systems that support them. Embedding security is easier than "bolting it on" after the fact. Figure L2-1 21 The Borderless Network One of the most dramatic challenges to enterprise security is the borderless corporate network. The rapid adoption of networking and business-to-business (B2B) commerce has eroded the once well-defined borders of corporate networks. Today's enterprises are so interconnected that when enterprises take on joint ventures they may end up with virtual insiders. Virtual insiders are the people connected to a network that the owner does not know are there. These connections are not recorded in the enterprise management plan and can often result when a contractor grants access to a subcontractor. Ubiquitous connectivity is driving fundamental changes in the approaches to enterprise security management. These changes are, in turn, requiring new research, tools, and approaches. Mainframe Computers Mainframe computers continue to play important roles in large enterprises. However, security policies and practices tend to focus on desktop computers, network servers, network devices, the Internet, and pervasive computing devices – to the exclusion of mainframe computers. Mainframe security personnel have been redeployed or recruited toward new opportunities. Advances in mainframe technology and connection to the Internet have created new risks and vulnerabilities rendering existing mainframe security policies and practices obsolete. Furthermore, the frequency and rigor of qualified mainframe audits have deteriorated to the point they are no longer capable of identifying these threats. Organizations and govt agencies must refresh their security polices, practices and technologies as vigorously as elsewhere or risk exploitation from new threats. Instant Messaging Instant messaging (IM) programs present another point of vulnerability to large enterprise systems. For example, IM programs can by-pass firewalls and antiviral scanners allowing malicious code, unauthorized intruders, and valuable data to covertly move in and out of enterprise systems. Enterprises should adjust their computer security polices to appropriately account for the risk presented by IM programs. Insider Threats Approximately 70 percent of all cyber attacks on enterprise systems are believed to be perpetrated by trusted "insiders." Insiders are trusted people with legitimate access rights to enterprise information systems and networks. Such trusted individuals can pose a significant threat to the enterprise and beyond. The insider threat can arise from the intentional malice of a disgruntled employee or accidentally from the poor security practices of a careless or unaware employee. Whether the threat is intentional or accidental, the results are often the same—damage, disruption, and loss of data. Effectively mitigating the insider threat requires policies, practices and continued training. Three common policy areas which can reduce insider threat include: (1) access controls, (2) segregation of duties, and (3) effective policy enforcement. • Poor access controls enable an individual or group to inappropriately modify, destroy, or disclose sensitive data or computer programs for purposes such as personal gain or sabotage. • Segregation of duties is important in assuring the integrity of an enterprise's information system. No one person should have complete control of any system. Failing to properly segregate the computer duties of an organization's staff can dramatically increase the risk of errors or fraud. • Effective enforcement of an enterprise security policy can be challenging and requires regular auditing. New automated software is beginning to emerge which can facilitate efficient enforcement of enterprise security. These programs allow the input of policy in human terms, translation to machine code, and then monitoring at the packet level of all data transactions within, and outbound from, the network. Such software can detect and stop inappropriate use of networks and cyber-based resources. 22 PROGRAMS Existing efforts in cybersecurity. P2-1 CIAO and the Institute of Internal Auditors have been working to train and raise awareness about the importance of understanding IT security in the context of the overall enterprise mission www.iia.org. P2-2 The National Threat Assessment Center (NTAC) with the CERT/Coordination Center is presently conducting a study on this critical topic. Using their experience from previous studies—the Exceptional Case Study Project and the Safe School Initiative—NTAC hopes to build a more complete understanding of this threat to enterprise IT security. For more information on this topic, look in detail at the full Strategy or view the NTAC web site at www.survey.cert.org/Insider Threat to learn how you can participate, anonymously, in the study. P2-3 The Internet Security Alliance has recently issued a "Common Sense Guide for Senior Managers," which includes the organization's top ten recommended information security practices www.isalliance.org. P2-4 Many critical infrastructure industries have formed information sharing and analysis centers (ISACs) in order to disseminate cybersecurity information to their respective sectors. P2-5 In many larger cities, the National Infrastructure Protection Center partners with local businesses, the FBI, and academic experts in chapters of InfraGard, a grass roots public-private partnership for cybersecurity and against cybercrime www.infragard.net. DISCUSSIONS Issues highlighted for continued analysis, debate, and discussion. D2-1 Cybersecurity is a constant process which requires regular assessments and remediation. Accordingly, cybersecurity can be enhanced with regular IT security audits. How often should large enterprises have cybersecurity audits performed by outside auditors? D2-2 Cybersecurity is an integral component of a company's operations. When a company makes cybersecurity a management issue, it can better protect its intellectual property and its business operations. What should financial analysts and investors ask companies about their security programs before investing? D2-3 How can large enterprises facilitate the identification and implementation of best practices for cybersecurity? D2-4 Should the National Security Telecommunications Advisory Committee and the National Infrastructure Assurance Council examine the need and possible benefits of establishing an independent organization, similar to the accounting profession, which would develop standards, guidance, and auditing procedures for IT security enterprises? AGENDA LEVEL 2: Large Enterprises RECOMMENDATIONS Specific actions that govt and nongovt entities can take to promote cybersecurity.* R2-1 CEOs should consider forming enterprisewide corporate security councils to integrate cybersecurity, privacy, physical security, and operational considerations. R2-2 CEOs should consider regular independent Information Technology (IT) security audits, remediation programs, and reviews of best practices implementation. R2-3 Corporate boards should consider forming board committees on IT security and should ensure that the recommendations of the chief information security official in the corporation are regularly reviewed by the CEO. R2-4 Corporate IT continuity plans should be regularly reviewed and exercised and should consider site and staff alternatives. Consideration should be given to diversity in IT service providers as a way of mitigating risks. R2-5 Corporations should consider active involvement in industrywide programs to: (a) develop IT security best practices and procurement standards for like companies; (b) share information on IT security through an appropriate information sharing and analysis center (ISAC); (c) raise cybersecurity awareness and public policy issues; and, (d) work with the insurance industry on ways to expand the availability and utilization of insurance for managing cyber risk. R2-6 Corporations should consider joining in a public-private partnership to establish an awards program for those in industry making significant contributions to cybersecurity. R2-7 (1) Enterprises should review mainframe security software and procedures to ensure that effective technology and procedural measures are being utilized, (2) IT vendors and enterprises employing mainframes servers should consider developing a partnership to review and update best practices of mainframe IT security and to ensure that there continues to be an adequate trained cadre of mainframe specialists; and, (3) IT security audits should include comprehensive evaluations of mainframes. *Note: The feasibility and cost effectiveness of these recommendations will vary across entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them. DRAFT The Federal govt's strategic goal is to significantly improve the cybersecurity1 of Federal information and information technology. To achieve this goal, each agency will be expected to create and implement the following formal three-step process to achieve greater security: • step one — identify and document enterprise architectures; • step two — continuously assess threats and vulnerabilities, and understand the risks they pose to agency operations and assets; and, • step three — implement security controls and remediation efforts to reduce and manage those risks. In addition, to assist the individual agencies in implementing the foregoing three-step process, the following overarching structures and processes will be implemented under the Federal govt IT security program through the following actions: • exercise budget and security oversight (OMB); to hold govt agencies accountable for systems security; • explore greater use of cross-govt acquisition and centralized management; • conduct overarching reviews by the Executive branch Information Systems Security Committee to identify, recommend, and coordinate Federal security enhancements; • establish an Office of Information Security Support Services within the Federal govt; • develop a Federal response plan to manage cyber incidents and prepare for contingencies; and, • explore whether specific criteria for independent security reviews and reviewers are necessary and whether contractor certification is necessary. Issues and Challenges The security of the Federal govt is the collective responsibility of its depts and agencies. Accepting anything less than excellence in Federal computer security places the nation and the American people at risk. Historically, the Federal govt did not consider information security systemically; instead, it often merely "tacked on" security as an afterthought —reacting to threats, vulnerabilities, and attacks as they arose, rather than anticipating and attempting to avoid problems. To overcome this deficiency, OMB established a govtwide IT security program, as required by law, to set IT security policies and perform oversight of Federal agency compliance with security requirements. This program is based on a cost-effective, risk-based approach. Agencies must ensure that security is integrated within every investment. This approach is designed to enable Federal govt business operations, not to unnecessarily impede those functions. Federal Govt IT Security Remediation Process A key step to ensure the security of Federal information technology is to understand the current state of the effectiveness of security and privacy controls in individual systems. Once identified, it is equally important to maintain that understanding through a continuing cycle of risk assessment. This approach has long been suggested by the General Accounting Office, is reflected in OMB security policies, and is featured in the Govt Information Security Reform Act of 2000 (GISRA). OMB is responsible for the development and oversight of the implementation of govtwide policies, principles, standards, and guidelines for Federal govt computer security programs. Within a statutory framework, OMB issues security policies and ensures that security is appropriately integrated with capital planning and budget guidance. Oversight is achieved largely in the following ways: via the budget and capital planning process, independent program reviews, annual agency program reviews, independent Inspector General (IG) evaluations, agency reports to OMB, agency security corrective action plans, and an annual OMB report to Congress. Through the implementation of GISRA, Federal agencies are required to conduct annual security reviews of all programs and systems, and IGs perform annual independent evaluations of an agency's security program and a subset of systems. These reviews and evaluations, along with other applicable security reviews, identify an agency's security performance gaps. To ensure that those gaps are addressed, agencies are required to develop corrective action plans for every system and program where a weakness was found. Corrective action plans for agency systems are tied directly to each agency's funding request for the system—OMB funding approval for systems is contingent upon correction of outstanding security weaknesses. Additionally, agencies must ensure that security has been incorporated and security costs reported for every IT investment through the Federal capital planning process. OMB policy stipulates that specific lifecycle security costs be identified, built into, and funded as part of each LEVEL 3: THE FEDERAL GOVT 1 Note: The term "cybersecurity" used in the Federal govt section of this document is synonymous with the term "computer security" used in OMB guidance. system investment. Failure to do so results in disapproval of funding for the entire system. On a quarterly basis, agencies report their progress in closing their security performance gaps. Annually, OMB reports the results of agency security reviews and IG evaluations to Congress. The annual reviews identify weaknesses and vulnerabilities and, for the first time, across the Federal govt, there is a detailed understanding of IT security performance gaps. More importantly, through the development and use of corrective action plans, the Federal govt has a uniform process to track progress in fixing those weaknesses. The annual status reports focus on management-level issues to ensure that security is viewed as an essential management function. OMB agrees with GAO, agency IGs, and other experts that a sound management foundation is essential to ensure that important, but lower-level, technical security details are adequately addressed. Corrective action plans and quarterly updates are the next step for Federal agencies to reflect the status of corrective actions for specific agency programs and systems. These corrective action plans include an identification of all management, operational, and technical security weaknesses, the estimated resources needed to correct the weaknesses, the projected timeline for corrective action, and whether corrections are on track. Current Gaps and Weaknesses OMB's first report to Congress on govt information security reform in February 2002 identified six common govtwide security performance gaps. For the most part, these gaps are not new or surprising. OMB, along with GAO, and agency IGs, have found them to be problems for at least six years. The evaluation and reporting requirements of GISRA have given OMB and Federal agencies an opportunity to develop a comprehensive, cross-govt baseline of agency IT security performance that has not been previously available. These weaknesses include: 1. Lack of senior management attention. Senior leaders must consistently establish and maintain control over the security of the operations and assets for which they are responsible. As GISRA recognizes, security is a management function which must be embraced by each Federal agency and agency head. 2. Lack of performance measurement. Agencies must be able to evaluate the performance of officials charged with implementing specific requirements of GISRA. To evaluate agency actions, agencies must measure job and program performance, i.e., how senior leaders evaluate whether responsible officials at all levels are doing their jobs. They must be able to evaluate the performance of officials charged with securing agency operations and assets. Virtually every agency response regarding performance implies that there is inadequate accountability for job and program performance related to IT security. 3. Poor security education and awareness. Agencies must improve security education and awareness. General users, IT professionals, and security professionals need to have the knowledge to do their jobs effectively before they can be held accountable. 4. Failure to fully fund and integrate security into capital planning and investment control. Security must be built into and funded within each system and program through effective capital planning and investment control. As OMB has done for the past two years in budget guidance, Federal agencies were instructed to report on security funding to underscore this fundamental point. Systems that do not integrate security into their IT capital asset plans will not be funded. 5. Ensuring that contractor services are adequately secure. Agencies must ensure that contractor services are adequately secure because most Federal IT projects are developed and many operated by contractors. Therefore, IT contracts, including those for telecommunications, need to include adequate security requirements. Many agencies reported no security controls in contracts or no verification that contractors fulfill any requirements that may be in place. Additionally, the OMB report discusses pervasive security flaws found in many of today's commercial software products. These flaws go well beyond security to the very performance of the products themselves, and it is time to address this problem at a national level. 6. Failure to detect, report, and share information on vulnerabilities. Far too many agencies have virtually no meaningful system to test or monitor system activity; therefore they are unable to detect intrusions, suspected intrusions, or virus infections. This places individual agency systems and operations at great risk since response depends on detection. Perhaps most significant is not detecting and reporting IT security problems could cause cascading harm. America's vastly inter-networked environment also means shared risk with the best security being only as strong as the weakest link. Early warning for the entire Federal community starts first with detection by individual agencies, not incident response centers at the FBI, GSA, DOD, or elsewhere. The latter can only know what is reported to them, reporting can only come from detection, and guidance for corrective action depends upon both. This need is thus not a technical one, but a management one. Additionally, it is critical that agencies and their components report all incidents in a timely manner to GSA's Federal Computer Incident Response Center and appropriate law enforcement authorities, such as the FBI's National Infrastructure Protection Center, as required by GISRA. Additional issues and challenges have also been identified: Authentication: Key to Cybersecurity Intruders gaining access to systems by pretending to be the authorized user can do immense harm. As described in NIST's "Introduction to Computer Security"—The NIST Handbook (located at www.csrc.nist.gov/), there are three basic means to ensure the identification and authentication of users—applying something the user knows (password), applying something the user has (token or smart card), and applying something the user is (biometric information). The weakest and most commonly used method of identification and authentication is applying something a user knows. Why is it the weakest? Because would-be intruders (and auditors) often successfully discern passwords through both pretext conversations with unsuspecting users and relatively simple technical means. If an intruder were to obtain the password of an agency employee, he would gain the same trusted privileges as the employee and could operate behind the firewall, use and interfere with system resources, and gain real-time access to sensitive data. What is more, the intruder might also have access to other systems in the domain. If the victim employee had administrator or super-user privileges, the intruder would likewise acquire those privileges and could have unlimited access to the entire network and the information on it. What is worse, the intruder could acquire valuable information and an understanding of system weaknesses, escape without detection, perhaps share what they have learned with others, and return another day to inflict even greater damage. Inconsistent Contingency Planning Among the lessons learned from security reviews following the events of September 11, was that Federal agencies had vastly inconsistent, and in most cases incomplete, contingency capabilities for their communications and other systems. Contingency planning is a key element of cybersecurity. Without adequate contingency planning and training, agencies may not be able to effectively handle disruptions in service and ensure business continuity. Continuity plans cannot simply be written and placed on the shelf. These plans must be tested on a regular basis to ensure that agency employees are fully aware of their roles and responsibilities. 24 DRAFT N AT I O N A L S T R AT E G Y T O S E C U R E C Y B E R S PA C E Discussion of the Strategy Agency-Specific Measures In order to fully realize the intent of GISRA, the Federal govt must have a comprehensive and cross-cutting approach to improving cybersecurity. Clearly, cybersecurity is not a "one-size-fits-all" solution. However, there are three elements that are central to attaining and maintaining robust cyber security for the Federal govt. These include: • identifying and documenting enterprise architectures; • continuously assessing threats and vulnerabilities, and understanding the risks they pose to agency operations and assets; and, • implementing security controls and remediation efforts to reduce and manage those risks. Step One — Identify and Document Enterprise Architectures. As a matter of OMB policy, each agency must identify and document their enterprise architecture, including developing an authoritative inventory of all operations and assets, and all agencies IT systems, critical business processes, and their inter-relationships with other organizations. This will produce a govtwide view of critical security needs. The Federal govt is now integrating OMB and Federal CIO Council govtwide enterprise architecture activities and the Critical Infrastructure Assurance Office's Project Matrix efforts. The integration is intended to better identify and document agency and cross-govt core processes, areas of unnecessary duplication, and areas where planned redundancy is lacking. Modeling and evaluating potential implications of threats and vulnerabilities on cross-agency business processes will also benefit from the integration efforts. Step Two — Continuously Assess Threats and Vulnerabilities, and Understand the Risks they Pose to Agency Operations and Assets. Commercial automated auditing and reporting mechanisms are now available to validate the effectiveness of the security controls across a system and are essential to continuously understand risks to those systems. Some, but not all, civilian agencies have taken steps to increase the use of these automated tools. More agencies need to do so. Therefore, the Federal govt will drive the greatly expanded use of effective automated tools to detect intrusions, conduct periodic vulnerability assessments, actively manage and preempt threats, and continuously audit the security posture of information technology systems. (See recommendation R3-5.) As agencies expand their use of automated tools, the Federal govt will consider whether benefits derive from consolidated acquisition, operation, and management of those tools. One possible approach, but certainly not the only one, could be to centrally deploy and manage them from FedCIRC. Such consolidation could standardize and automate vulnerability identification and reporting—one of the six significant weaknesses identified in OMB's February 2002 security report to Congress. Automated tools on agency networks could continuously assess system vulnerabilities, collect and analyze firewall and intrusion detection audit logs, audit configuration and security policy controls, and automatically report the results to FedCIRC. Automated tools can be helpful in analyzing data, providing forward-looking assessments, and alerting agencies of unacceptable risks to their operations. At the same time however, it is important that individual agencies and program officials within them continue to take responsibility and be held accountable for the security of the operations and assets under their control. Separating responsibility and accountability sends the incorrect signal that security is not their job—it is. Thus any centralization will be carefully considered before being adopted. (See recommendation R3-3) Step Three — Implement Security Controls And Remediation Efforts To Reduce or Manage Those Risks. The implementation of security controls that maintain risk at an acceptable level and test the controls to ensure that they continue to be effective can often be accomplished in a relatively brief amount of time. However, the remediation of vulnerabilities is a much more complex challenge. Software is constantly changing and each new upgrade can introduce new vulnerabilities. As a result, vulnerabilities need to be assessed continuously. Remediation often involves "patching," or installing pieces of software or code that are used to update the main program. The remediation of Federal systems must be planned in a consistent fashion. In addition, the Federal govt should explore more secure network protocols as they develop and assess how their adoption and implementation could benefit agency operations. When it is shown that such secure protocols can have a cost-effective benefit on agency operations, the Federal govt should lead in adopting and implementing them. Identifying and Authenticating Users and Maintaining Authorization Through the electronic govt e-Authentication initiative and other means, the Federal govt is promoting a continuing chain of security for all Federal employees and processes, including the use where appropriate of biometric smart cards for access to buildings and computers, and authentication from the moment of computer log on. The benefits of such an approach are clear. To establish and maintain secure system operations, organizations must ensure that the people on the system are who they say they are and are doing only what they are authorized to do. Identifying and authenticating each system user is the first link in the system security chain, and it must take place whenever system access is initiated. Many authentication procedures used today are inadequate and, even correctly configured passwords can often be obtained from users. However, as GAO and others frequently report, passwords are not being changed from the system default, are often incorrectly configured, and are rarely updated. By promoting multi-layered identification and authentication—the combined use of strong passwords, smart tokens, and biometrics—the Federal govt will eliminate many significant security problems that it has today. Through the ongoing e-Authentication initiative, the Federal govt will review the need for stronger access control and authentication; explore the extent to which all depts can employ the same physical and logical access control tools and authentication mechanisms; and, consequently, further promote consistency and interoperability. System Configuration Management Using the Board's Executive branch Information Systems Security Committee and the govtwide architecture development activities, OMB is exploring ways to promote greater uniformity of systems throughout the Federal enterprise, and to simplify and unify security processes to increase efficiency and effectiveness. Through the budget process, the Federal govt will drive agency investments in commercially available automated tools to assist them in ensuring the accurate maintenance of their architectures and system configuration. As discussed in the Federal CIO Council's "Practical Guide to Federal Enterprise Architecture," configuration management is critical to an architecture maintenance program. See the CIO Council's "Guide" at www.itpolicy.gsa.gov/mke/archplus/ea_guide.doc. The guide also describes the need for periodic configuration audits as an architecture control feature. Automated tools are now widely available commercially to perform such audits. Configuration control has incidental and important benefits to security, i.e., controlling system configuration permits agencies to more effectively and efficiently enforce policies and permissions and more easily install antivirus definitions and other software updates and patches across an entire system or network. Improved Security in Govt Outsourcing and Procurement Through a joint effort of OMB's Office of Federal Procurement Policy, the Federal Acquisition Regulations Council, and the Executive branch Information Systems Security Committee, the Federal govt is identifying ways to improve security in agency contracts and evaluating the overall Federal procurement process as it relates to security. Agencies maintaining the security of outsourced operations was one of the key weaknesses identified in OMB's February 2002 security report to Congress. Additionally, the Federal govt is conducting a comprehensive review of the NIAP, to determine the extent to which it is adequately addressing the continuing problem of security flaws in commercial software products. This review will include lessons-learned from implementation of the Dept of Defense's July 2002 policy requiring the acquisition of products reviewed under the NIAP or similar evaluation processes. That policy stipulates that if an evaluated product of the type being sought is available for use, then the DOD component must procure such evaluated product. If no evaluated product is currently available, the component must require prospective vendors to submit their product for evaluation to be further considered. Following this program review, the govt will evaluate the costeffectiveness of expanding the program to cover all Federal agencies. If this proves workable, it could both improve govt security and leverage the govt's significant purchasing power to influence the market and begin to improve the security of all consumer information technology products. The Federal govt recognizes that past efforts such as this have failed, but believes that the heightened level of govt and consumer concerns over significant flaws in information technology products warrants renewed efforts. Framework for the Strategy Hold Agencies Accountable Since the beginning of his Administration, the President has called for better management of the Federal govt. Beginning with his Budget Blueprint in February 2001, continuing in the FY 2002 and 2003 budgets, and in his Management Reform Agenda, the President has repeatedly spelled out a clear agenda for govt reform. The President has ordered the pursuit of five govtwide initiatives that together will help govt achieve better results. See www.whitehouse. gov/omb/budget/fy2002/mgmt.pdf. Because much of what is required to develop and sustain an effective security program is a solid management foundation, the Federal govt is using the President's Management Agenda to build that foundation and drive the reform of its security program. One of the management agenda's initiatives—expanded E-Govt— harnesses the power of information technology and the Internet to make govt more productive. The National Strategy to Secure Cyberspace complements these efforts by making sure that the E-Govt initiative ("E-Gov"), and the infrastructure it relies upon, are secure. The Federal govt will then be better able actively to anticipate threats and vulnerabilities, preempt them where possible, and survive them when preemption is not possible. In this way, the Federal govt will set an example for all owners and operators of the nation's cyber infrastructure. To achieve this standard of performance, good intentions and good beginnings are not the measure of success. Rather, the govt will require demonstrated performance and results. In order to ensure accountability and measure performance in cyber security, the Administration will do three things: • Analyze Empirical Evidence of Agency Performance to Evaluate Compliance. GISRA required the Federal agencies to perform an annual independent evaluation of their information security program and practices. The results of these evaluations are reported to OMB. These reports include an accounting of all security weaknesses in agency systems and programs and a detailed corrective action plan with milestones and timelines. These reports are tied to the budget process and agency information technology funding requests to OMB must account for the lifecycle costs for security or they will not be approved. OMB uses this data to score the agencies' security performance. The first round of security reporting is reflected in OMB's February 2002 security report to Congress. See www.whitehouse. gov/omb/inforeg/fy01securityactreport.pdf. • Chart Agencies Progress Using the Management "Scorecard." For each of the President's Management Agenda initiatives, OMB has adopted an Executive branch management "scorecard" —a simple "traffic light" grading system common today in well-run businesses. Green indicates success, and yellow shows mixed results. Within the E-Gov "scorecard," OMB measures agency performance with respect to security. See www.whitehouse.gov/omb/memoranda/m02-02.html. • Base Agency Funding Decisions on Demonstrated Cybersecurity Performance. Over the next three years the Federal govt will likely spend approximately $20 billion on IT security— including research and development. OMB will continue to use both the "scorecard" and the GISRA security reporting to inform budget decisions for agency requests for information technology. OMB policy is clear: requests for information technology will not be funded or resources will be reallocated if the agency has shown poor security performance or if it has not included security requirements in the life-cycle costs for each investment. See OMB's security investment policy, www.whitehouse.gov/ omb/memoranda/m00-07.html. 26 These measures will help to ensure that each agency does its part to improve and maintain the overall Federal govt security posture by developing and maintaining a solid security management foundation upon which operational and technical security controls are built. This management foundation includes assigning clear and unambiguous authority and responsibility for security, holding officials accountable for fulfilling those responsibilities, and integrating security requirements into budget and capital planning processes. Establish an Office of Information Security Support Services The "build once, use many" approach demands a central organization to manage and finance some of the initiatives. Moreover, the increasing complexity of information technology security is placing significant pressure on many (especially small) agencies to effectively address their security requirements. For the civilian agencies, an office in the proposed Dept of Homeland Security could perform this operational support function. Operating under OMB oversight, this office could include resources from other agencies and could assist the agencies, OMB, NIST, the CIAO, and others in meeting their responsibilities. (See recommendation R3-9.) Federal Cyber Incident Response Plan The Incident Response Committee of the President's Critical Infrastructure Protection Board is developing a cyber annex to the Federal Response Plan (FRP) maintained by FEMA (www.fema.gov/rrr/frp/ frpintro.shtm). The FRP establishes a process and structure for the systematic, coordinated, and effective delivery of Federal assistance to address the consequences of any major disaster or emergency declared under the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended (42 U.S.C. 5121, et. seq.). The cyber annex will identify lead agency roles, authorities, and policy governing Federal cyber response in the event of a large-scale cyber threat or attack. The annex will have a supplement with a comprehensive contingency plan detailing the Federal govt's response to large-scale cyber incidents. A valuable by-product of the foregoing effort will be to evolve incident response capabilities toward greater efficiency and improved coordination. An essential component of this enhanced capability is greatly improved analysis and warning, including moving from a retrospective view to a forward-looking one. The Federal govt is also working to consolidate, and make uniform, agencies contingency and disaster recovery planning for their telecommunications networks and information systems. Security Preparedness Exercise To test the civilian agencies security preparedness and contingency planning, the Federal govt is considering the use of a scenario based exercise to evaluate the impact of a threat on a selected cross-govt business process. One such possibility could include govtwide cybersecurity exercises. This approach is similar to that employed in 1998 by the Dept of Defense in an effort known as "Eligible Receiver" and would be developed with the cooperation of each participating agency. The exercise would include most security disciplines—including physical, operations, information, and systems. Among other things, it would prove or disprove the notion that today's agency-specific exercises and isolated tests on individual systems do little to reveal how low probability events result in high consequences on interconnected systems and processes. Weaknesses discovered will be included in agency GISRA corrective action plans. (See recommendation R3-8.) Explore Creation of a Separate Federal Telecommunications and Information Systems Infrastructure Federal policy currently stipulates that each agency must plan and provide for the continuity of its operations including communications. Such planning and service provision should be consistent across the govt, and depts considering creating new capabilities should examine cross-agency sharing arrangements. The Federal govt will continue to assess the technical viability and cost effectiveness of various options that provide for the continuity of operations during service outages such as VPNs, "private line networks," and others. (See recommendation R3-6.) Consider Developing Specific Criteria for Independent Security Reviews and Reviewers and Certification With the growing emphasis on security comes the corresponding need for expert independent verification and validation of agency security programs and practices. GISRA and OMB's implementing guidance require that agencies' program officials and CIOs review at least annually the status of their programs. Few agencies have available personnel resources to conduct such reviews, and thus they frequently contract for such services. Agencies and OMB have found that contractor security expertise varies widely from the truly expert to less than acceptable. Moreover, many independent verification and validation contractors are also in the business of providing security program implementation services; thus, their program reviews may be biased towards their preferred way of implementing security. Indeed, last year, OMB learned that some security service providers were also contracted by the same agency to perform annual GISRA program reviews. Even the perception of a conflict of interest should be avoided when evaluating the security of an agency network. The Federal govt will explore whether private sector security service providers to the Federal govt should be certified as meeting certain minimum capabilities including the extent to which they are adequately independent. The national security community has begun such certifications for security service providers working in that sensitive environment and lessons learned from their experience will be applied in considering the cost effectiveness of this approach for other areas of the Federal govt. Among the possible elements of such an approach could be limiting contract awards to service providers that meet specific published criteria that address both the level of security expertise (including a thorough understanding of all govt requirements) and their relative independence. To ensure independence, agencies could be prohibited from employing their existing (or recent past) security services contractors as their security program reviewer. None of the foregoing should be viewed as diminishing the role of agency Inspectors General under GISRA. OMB continues to see the IGs as a linchpin to agency security performance improvement. In fact, there are direct benefits to the IGs from implementing this plan—they would have an additional source of independent and expert information upon which they could also rely. (See recommendation R3-2.) Overarching Reviews by the Board's Executive Branch Information Systems Security Committee In addition to the efforts described earlier, the OMB-chaired Committee is reviewing a number of security issues that will promote greater benefits for securing agency business operations. To view the impact and effects of security policies on agency programs and business operations, this Committee includes officials from across a number of communities within the Federal govt, including Chief Information Officers, Chief Financial Officers, Inspectors General, Procurement Executives, small agencies, operational program officials (business lines), human resources officials, and budget officials. Among the Committee's current and planned activities are a gap analysis of current policies and processes, an evaluation of the viability of a govtwide common methodology for grading risks, and a review of the desirability of developing uniform security practices or benchmarks for similar operations, assets, and systems. The latter two efforts reflect our "build once, use many" approach. Gap Analysis of Current Policies and Processes This review is addressing whether there are gaps in the coverage of current IT security policies, standards, and guidance for non-national security applications: Do they meet the needs of the depts and agencies with respect to the level of detail and coverage and adequately assist agencies improving security performance? The Committee is also examining whether existing policy development processes are efficient, effective, consider input from all relevant agencies and organizations, and produce results in a timely manner. Where improvement is needed the Committee is providing appropriate recommendations. Grading Risks This review is examining the current risk assessment practices of agencies and other organizations and will determine whether a uniform scheme under which all agencies grade risks is viable and desirable. The group has begun assessing whether a common methodology across the govt enterprise (e.g., including specific metrics for identifying high, medium and basic risk exposures) would reduce complexity, simplify the use of risk-based security controls, and facilitate interoperability and information sharing across agencies. In reviewing this issue, the Committee is proving or disproving several assumptions. First, all agency operations and assets require some level of security. Second, effective security demands an understanding of the acceptable level of risk. Third, the business requirements to share information within and across agencies, with industry, and with the public (especially in light of the September 11 terrorist attacks) has increased, and is complicated by differing approaches to grading risk. Fourth, a uniform risk-grading process will assist agencies in applying corresponding security controls. Fifth, a uniform risk-grading process will assist developing corresponding security requirements. Uniform Security Practices or Benchmarks for Similar Operations, Assets, and Systems The Committee will examine the viability of developing, and the potential benefits derived from, uniform security practices that apply to high, medium, and basic risk applications as determined in the grading risk activity described above. The group will explore whether implementing, maintaining, and monitoring security for operations that are similar across the depts and agencies will reduce costs and improve the security of such similar operations. Several assumptions will also be tested in this area. First, many agency programs and IT operations are essentially the same (e.g., e-mail and web servers, financial systems, general support systems or networks) and so too are the associated security requirements. Second, uniform security practices that consolidate in one place all applicable security policies and technical guidance would simplify and reduce costs for achieving the adequate level of security for similar activities. Third, uniform security practices are viable once uniform risk grading is in place. Cross-govt Steps One of the goals for many of these efforts is to unify and simplify security programs and processes and build security consistency across the govt. This "build once, use many" approach for govtwide security is consistent with the approach used for E-Gov initiatives and OMB's guidance to the agencies for preparing their FY 2004 budget requests. That guidance states that OMB "will give priority consideration to IT investments that leverage technology purchases across multiple entities." For more on OMB's FY 2004 budget guidance, see www.whitehouse.gov/omb/circulars/a11/01toc.html. Major Strategic Goals • Create collaborative partnerships with State and local govt and the private sector • Ensure adoption of leading-edge information technologies as offensive weapons in the prevention and detection of terrorism • Drive national and international information integration and information delivery standards • Develop innovative service delivery models and business models that enable govt to use information held outside the govt arena Immediate Objectives • Lead the integration of information essential to homeland security across Federal agencies (horizontal integration) • Drive the integration of information essential to homeland security among and between Federal, State, and local govt, and the private sector (vertical integration) • Guide the enablement of the National Strategy for Homeland Security through appropriate use of information technology capabilities, products, and services Major Risks to be Addressed • Maintaining privacy while enhancing security • Aligning policy and laws with desired outcomes • Leveraging cultural beliefs and diversity to achieve collaborative change • Consolidating redundant or duplicative efforts • Overcoming political and cultural barriers • Ensuring appropriate security measures for new technology Major Efforts in a Proposed Information Integration Strategy • Development of a business-driven Homeland Security Enterprise Architecture • Implementation of a National Homeland Security Portal (World Wide Web site) • Consolidation of Federal "Watch-out" lists • Multi-State Sharing of Law Enforcement Information • Establishment of a digital National Homeland Security Information clearing-house • Application of digital Intelligent Agents to the prevention and detection of terrorism 29 INFORMATION INTEGRATION AND INFORMATION TECHNOLOGY FOR HOMELAND SECURITY A key goal to protect our nation's infrastructure is to ensure that there is a national environment—addressing people, process, and technology—that enables the integration of essential information for combating terrorism among Federal, State, local, and private sector entities. We must put in place mechanisms that provide the right information to the right people all the time. With the use of information technology, homeland security officials throughout the U.S. will have complete and common awareness of threats and vulnerabilities, as well as knowledge of the personnel and resources available to mitigate those threats. Officials will receive the information they need from all levels of govt and the private sector so that they can anticipate threats and respond rapidly and effectively. This information integration will better enable officials to protect the physical and cyber infrastructure, secure our country's borders, prevent biological or chemical attacks, and provide an effective first response to a terrorist or natural disaster incident. To guide information integration, the President proposed the RECOMMENDATIONS Specific actions that govt and nongovt entities can take to promote cybersecurity. R3-1 In order to enhance the procurement of more secure IT products, the Federal govt, by 4Q FY03, will complete a comprehensive program performance review of the National Information Assurance Program (NIAP) to determine the extent to which NIAP is cost effective and targets a clearly identified security gap; whether it has defined goals to close the gap; whether it is achieving those goals; and the extent to which program improvements, streamlining, or expansion are appropriate and cost effective. R3-2 The Federal govt, by 3Q FY03, will assess whether private sector security service providers to the Federal govt should be certified as meeting certain minimum capabilities. R3-3 The Federal govt, by 3Q FY03, using the E-Govt model, will explore the benefits (including reducing resource pressures on small agencies) of greater cross-govt acquisition, operation, and maintenance of security tools and services. R3-4 Through the ongoing E-Authentication initiative, the Federal govt, by 2Q FY03, will explore the extent to which all depts can employ the same physical and logical access control tools and authentication mechanisms to further promote consistency and interoperability. R3-5 Federal depts should continue to expand the use of automated, enterprisewide security assessment and security policy enforcement tools and actively deploy threat management tools to preempt attacks. By 2Q FY03, the Federal govt will determine whether specific actions are necessary (e.g., through the policy or budget processes) to promote the greater use of these tools. R3-6 The Federal govt will continue to assess the technical viability and cost effectiveness of various options that provide for the continuity of operations during service outages, such as VPNs, "private line" networks, and others. R3-7 The Federal govt should lead in the adoption of secure network protocols. The Federal govt will review new secure network protocols as they are published to determine whether they fill a security gap and whether their adoption would have a cost-effective impact on the operations and security of the Federal govt. R3-8 By the end of 2Q FY03, the Federal govt will consider the cost effectiveness of a scenario-based security and contingency preparedness exercise for a selected cross-govt business process. Should such an exercise take place any security weaknesses shall be included as part of agencies' GISRA corrective action plans. R3-9 OMB, in conjunction with the CIO council,will determine on a case by case basis whether to employ a lead agency concept for govtwide security measures. The alternatives will generally include GSA, NIST, the proposed Dept of Homeland Security, and the Dept of Defense. PROGRAMS Existing efforts in cybersecurity. P3-1 National Security Agency www.nsa.gov/isso/index.html P3-2 National Infrastructure Assurance Partnership www.niap.nist.gov/ P3-3 OMB security program/budget process /GISRA reporting www.whitehouse. gov/omb/inforeg/infopoltech.html P3-4 E-Govt initiative www.egov.gov/ P3-5 Enterprise architecture Project Matrix www.ciao.gov/Federal/ P3-6 NIST Computer Security Resource Center www.csrc.nist.gov/ P3-7 Federal CIO Council www.cio.gov P3-8 The General Services Administration's PKI bridge and Federal Telecommunications System security levels www.gsa.gov, Federal Computer Incident Response Center www.fedcirc.gov DISCUSSIONS Issues highlighted for continued analysis, debate, and discussion. D3-1 Should Federal agencies be required to comply with a maximum time limit for the implementation of patches for known vulnerabilities? D3-2 Should the CIAO or CISO be different than the CIO? D3-3 How should civilian agencies expand use of PKIs for specific situations? N AT I O N A L S T R AT E G Y T O S E C U R E C Y B E R S PA C E State and local govts have set strategic goals for achieving and maintaining the ability to protect critical information infrastructures from natural events and intentional acts that would significantly diminish State and local govts capacity to maintain order and to deliver essential public services. Issues and Challenges States provide services that make up the "public safety net" for millions of Americans and their families. Services include essential social support activities as well as critical public safety functions, such as law enforcement and emergency response services. States also own and operate critical infrastructure systems, such as electric power and transmission, transportation, and water systems. They play a catalytic role in bringing together the different stakeholders that deliver critical services within their State to prepare for, respond to, manage, and recover from a crisis. Delivering critical services unique to their roles and responsibilities within our Federalist system makes State govt a critical infrastructure sector in its own right. Many of these critical functions carried out by States are inexorably tied to IT—including making payments to welfare recipients, supporting law enforcement with electronic access to criminal records, and operating State-owned utility and transportation services. Preventing cyber attacks and responding quickly when they do occur, ensures that these 24/7 systems remain available and in place to provide important services that the public needs and expects. Information technology systems have the potential for bringing unprecedented efficiency and responsiveness from State govts for their residents. Citizen confidence in the integrity of these systems and the data collected and maintained by them is essential for expanded use and capture of these potential benefits. Discussion of Strategy With an increasing dependence on integrated systems, State, local, and Federal agencies have to collectively combat cyber attacks. Sharing information to protect systems is an important foundation for ensuring govt continuity. States have adopted several mechanisms that assist in sharing information on cyber attacks and in reporting incidents. These mechanisms are continually being modified and improved as new policy emerges and as technological solutions become available. In addition, States are exploring options for improving information sharing both internally and externally. These options include enacting legislation that provides additional funding and training for cybersecurity and forming partnerships across State, local, and Federal govts to manage cyber threats. Some mechanisms that many States are using to address cyberspace security include: • Governance Structure. Many States have an IT security governance structure that guides and enacts cybersecurity policy for the State. Functions may include making policy recommendations to the Governor or establishing a restoration priority list of agencies if multiple agencies are disabled concurrently. In many cases, the cybersecurity board includes all branches of govt and affected agencies. Additionally, some States are including local govts in the governance structure, recognizing that local and State systems may be interconnected. • Establishment of the Roles of the State Chief Information Officer (CIO) and Chief Information Security Officer (CISO). CIOs and CISOs oversee security policy and the implementation and maintenance of critical information systems. • State Homeland Security Initiatives. Homeland Security Directors recognize that the States' cyber systems are at high risk for terrorist threats. With this in mind, States are shoring up network infrastructure and implementing authentication and authorization processes for State information systems. State policymakers and technologists are making outreach efforts to the public to educate them on how to protect their own information systems at home. Law Enforcement State and local govts play an important role in the emergency law enforcement sector. Emergency Law Enforcement Services (ELES), as a critical infrastructure sector, is included within the emergency services sector. The continued operation of the ELES sector during a time of crisis is essential to the rule of law, the protection of the general welfare, the preservation of civil liberties and privacy rights, and consequence management. More than 18,000 Federal, State, and local agencies comprise the ELES sector. Responses from more than 1,500 of these agencies to a sectorcommissioned information systems vulnerability survey reveal that these organizations have become increasingly reliant on information and communications systems to perform their critical missions. The threat against such systems continues to grow. Sector agencies also depend on other critical infrastructures, such as energy and telecommunications, which are also vulnerable to both cyber and physical disruption. 31 LEVEL 3: STATE AND LOCAL GOVTS Gap Analysis This ELES sector critical infrastructure protection plan presents the sector's initial strategy for ensuring its continuing ability to perform critical emergency law enforcement functions. The plan represents the combined efforts of the National Infrastructure Protection Center (NIPC), the designated lead agency for the ELES sector, and the ELES Forum, a group of senior law enforcement executives from State, local, and non-FBI Federal agencies. The Forum was created to support the development of the ELES plan, to be national advocates for emergency law enforcement issues, and to conduct liaison activities with the ELES community. The plan presents the sector's framework for identifying its most critical assets, assessing their vulnerability to attack, and developing remediation and mitigation plans. The plan also provides information on the National Infrastructure Protection Center's (NIPC) threat alert and notification system and on various infrastructure and information security-related training programs. A companion Guide for State and Local Law Enforcement Agencies provides tools that sector agencies can use when implementing the activities suggested in the plan. The guide serves as the sector baseline infrastructure protection education and awareness program document. Each law enforcement agency operates independently and is responsible for its own critical infrastructure protection. Therefore, the success of any sectorwide program depends on the voluntary efforts of each of these organizations to undertake the activities suggested in the plan. At the national level, the ELES sector leadership will continue to serve as the sector representative in cross-sector planning and implementation activities. RECOMMENDATIONS Specific actions that govt and nongovt entities can take to promote cybersecurity.* R3-10 State and local govts should consider establishing IT security programs for their depts and agencies, including awareness, audits, and standards. State, county, and city associations should consider providing assistance, materials, and model programs. R3-11 State and local govts should consider participating in the established information sharing and analysis centers (ISACs) with similar govts. R3-12 State and local govts should consider expanding training programs in computer crime for law enforcement officials, including judges, prosecutors, and police. The Federal govt could assist in coordinating such training and explore whether funding assistance is feasible. PROGRAMS Existing efforts in cybersecurity. P3-9 The National Association of State Chief Information Security Officers www.nascio.org/. NASCIO published a report entitled, "Public-Sector Information Security: A call to Action for Public Sector CIOs." P3-10 The National Governors Association www.nga.org/. P3-11 The National League of Cities www.nlc.org/nlc_org/site/. DISCUSSIONS Issues highlighted for continued analysis, debate, and discussion. D3-4 How can Federal, State, and local govts enhance coordination and crisis management for cybersecurity? D3-5 What special legal or policy challenges might States face in developing an interstate ISAC? AGENDA LEVEL 3: CRITICAL SECTORS — State and Local Govts 32 *Note: The feasibility and cost effectiveness of these recommendations will vary across entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them. Institutions of Higher Education (IHEs)—universities, four-year colleges, community colleges—in the U.S. have set goals to adopt and implement a level of information system and network security to protect sensitive information, and to prevent its systems from being used for attacks on others. To achieve that goal, IHEs have identified the following framework for action: • make IT security a priority in higher education; • revise institutional security policy and improve the use of existing security tools; • improve security for future research and education networks; • improve collaboration between higher education, industry, and govt; and, • integrate work in higher education with the national effort to strengthen critical infrastructure. Issues and Challenges As recent experience has shown, many insecure computer systems traceable to the campus networks of higher education have been collectively exploited by hackers as a platform from which to launch denial-of-service attacks and other threats to unrelated systems on the Internet. Such attacks harm not only the targeted systems, but also the owners of those systems and those who desire to use their services. IHEs are subject to such exploitation for two reasons: (1) they possess vast amounts of computing power; and, (2) they allow relatively open access to those resources. The computing power owned by IHEs is extensive, covering over 3,000 schools, many with research and significant central computing facilities. Research and education institutions represent approximately 15 percent of all the advertised domains on the Internet. To the extent that IHEs systems can be penetrated and "hijacked" for the purpose of launching cyber attacks against third-party systems (the "zombie" phenomenon). They unwittingly place other sectors at risk. IHEs also hold much information for and about students and staff that is either private or confidential. Sensitive information (such as patient information and medical records, student information, personnel records, and sensitive research data) is maintained within university system databases. Such information must be protected and kept private. Moreover, vulnerabilities in one trusted network create vulnerabilities in many networks. Accordingly, IHEs must consider the broader implications of their cybersecurity. While IHEs must maintain privacy of information and prevent malicious use of their systems, they also must provide an environment in which students can learn, and research can be conducted efficiently. These two needs do not necessarily conflict, but must both be considered as IHEs identify their strategy for securing their part of cyberspace. Discussion of Strategy IHEs' Action Plan–Steps Completed and Those to be Taken The higher education community, collectively, has been actively engaged in efforts to organize its members and coordinate action to enhance cybersecurity on America's campuses. Most notably, through EDUCAUSE, the community has raised the issue of the National Strategy's development with top leaders of higher education, including the American Council on Education and the Higher Education IT Alliance. Significantly, through this effort, top university presidents have adopted a 5-point Framework for Action that commits them to give IT security high priority and to adopt the policies and measures necessary to realize greater system security. America's colleges and universities have also adopted an agenda of further activities to address the challenges of IT security and information assurance. For example, along with the National Science Foundation (NSF), EDUCAUSE is organizing a series of four workshops. The first of these workshops will bring together leaders in higher education to establish principles for a security strategy that can also support higher education's mission. Representatives from the university research community will also meet to identify the problems, issues, and solutions associated with securing faculty and student research activities. 33 LEVEL 3: HIGHER EDUCATION Task Force on Computer and RECOMMENDATIONS Specific actions that govt and nongovt entities can take to promote cybersecurity.* R3-13 Each college and university should consider establishing a point-of-contact, reachable at all times, to Internet service providers (ISPs) and law enforcement officials in the event that the school's IT systems are discovered to be launching cyber attacks. R3-14 Colleges and universities should consider establishing together: (a) one or more information sharing and analysis centers (ISACs) to deal with cyber attacks and vulnerabilities; (b) model guidelines empowering Chief Information Officers (CIOs) to address cybersecurity; (c) one or more set of best practices for IT security; and, (d) model user awareness programs and materials. PROGRAMS Existing efforts in cybersecurity. P3-12 EDUCAUSE and Internet2 established the Task Force on Computer and Network Security www.educause.edu/security. P3-13 EDUCAUSE Workshop series with National Science Foundation. P3-14 EDUCAUSE Outreach and awareness program to leaders and associations in higher education. DISCUSSIONS Issues highlighted for continued analysis, debate, and discussion. D3-6 What are the merits of adopting a model set of authorities for IHE CIOs, the academic institution, and the nation? (An example of such authorization can be found at http://www.itpo.iu.edu/Resolution.html R5-3 The U.S. should work together with Canada and Mexico to identify and implement best practices for securing the many shared critical North American information infrastructures.
R5-4 The U.S. should work through international organizations and in partnership with industry to facilitate dialogue and partnership between foreign public and private sectors on information infrastructure protection, and to promote a global "culture of security." R5-5 Each country should be urged to appoint a national cyberspace coordinator.
R5-6 The U.S. should draw upon the global science and technology base by pursuing collaborative research and development in cybersecurity.
56 *Note: The feasibility and cost effectiveness of these recommendations will vary across entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them.

acronyms
AICPA American Institute of Certified Public Accountants
BGP Border Gateway Protocol
CIAO Critical Infrastructure Assurance Office
CISO Chief Information Security Officer
CNSS Committee on National Security Systems
CWIN Cyber Warning and Information Network
DARPA Defense Advanced Research Projects Agency
DCS Digital Control System
DDoS Distributed Denial of Service Attack
DoS Denial-of-Service attacks
DSL Digital Subscriber Line
FBIIC Financial and Banking Information Infrastructure Committee (of the PCIPB)
FCC Federal Communications Commission
FedCIRC Federal Computer Incident Response Capability
FEMA Federal Emergency Management Agency
FIRST Forum of Incident Response and Security Teams
FTC Federal Trade Commission
FY Fiscal Year
GISRA Govt Information Security Reform Act of 2000
GSA General Services Administration
ICANN Internet Corporation for Assigned Names and Numbers
IETF Internet Engineering Task Force
IHE Institution of Higher Education
IP Internet Protocol
ISAC Information Sharing and Analysis Center
ISP Internet Service Provider
IT Information Technology
ITU International Telecommunications Union
LAN Local Area Networks
NACD National Association of Corporate Directors
NCS National Communications Systems
NERC North American Electric Reliability Council
NIAC National Infrastructure Assurance Council
NIAP National Information Assurance Partnership
NIPC National Infrastructure Protection Center
NISAC National Infrastructure Simulation and Analysis Center
NIST National Institute of Standards and Technology
NS/EP National Security/Emergency Preparedness
NSA National Security Agency
NSC National Security Council
NSF National Science Foundation
NSTAC National Security Telecommunications Advisory Committee
OECD Organization for Economic Cooperation and Development
OMB Office of Management and Budget
OSTP Office of Science and Technology Policy
PCIS Partnership for Critical Infrastructure Security
PCIPB President's Critical Infrastructure Protection Board
R&D Research and Development
SBA Small Business Administration
SCADA Supervisory Control and Data Acquisition
SFS Scholarship for Service (NSF hosted)
TCP/IP Transport Control Protocol / Internet Protocol
VPN Virtual Private Network
WAN Wide Area Networks
WLAN Wireless Local Area Network

international Saudis block 2,000 websites 7.31.02   Alfred Hermida BBC If you tried to look at Rolling Stone magazine on the web from Saudi Arabia, you would find that access has been denied. You would not have much luck either if you tried the American women's lifestyle site iVillage.com. These sites are among the 2,000 blocked by Saudi Govt, a Harvard Law School has found. Most of the blacklisted sites were sexually explicit or about religion. But also caught in the net were sites about women, health, drugs and pop culture. "We found blockage of quite a bit of content beyond political content and pornography," said Ben Edelman, one of the researchers behind the report. "We found the blocking of content about women's history or sites about bathing suits. So if you want to buy something to swim in, they seem to treat that as if it were pornographic in Saudi Arabia," Mr Edelman told the BBC pgm Go Digital. For the study, Jonathan Zittrain and Benjamin Edelman at Harvard tested 64,000 websites, with the full collaboration of the Saudi Govt. "Saudi Arabia was willing to let us test their proxy servers," said Mr Edelman. "They were willing to connect to their version of the internet to let us find what they allow and what they don't. Most other countries have not been willing when asked." The Saudis are also open about their censorship of the web. If a site is blacklisted, the user is directed to a page that explicitly informs him or her that access to the site has been denied. This contrasts to other countries like China, where a surfer simply gets an error message. It means they do not know if the site is blocked or if there is something wrong with the connection. Saudi Arabia filters all internet traffic through a central array of proxy servers maintained by the Internet Services Unit (ISU). The servers route and filter all internet traffic. "Our internet service is unique in the way it preserves our Islamic values, filtering the internet content to prevent the materials that contradict with our beliefs or may influence our culture is one of ISU tasks," says the ISU site. The researchers found that many of the blocked sites were sexually explicit. "It comes as no surprise that the same countries that would be concerned about certain books & newspapers crossing their borders would also be concerned to find similar information crossing their borders electronically over the internet," said Mr Edelman. But sites about religion, humour and music also figured prominently, among them film studio, Warner Brothers. "We weren't expecting them to block big California media companies," he said. "It's possible there is something particular offensive the Saudi Govt about a singer's lyrics or a musician hostile to their politics." Also blocked were most of the major personal homepage domains, including geocities.com and members.aol.com, as well as sites about women's rights, perhaps unsurprising in a country where women are not even allowed to drive. Anyone trying to get around the censorship would have trouble, as the researchers found that the Saudis also blocked proxy servers allowing a way around the filtering restrictions. "Even if you manage to find a proxy server that works on one day, you never really know if its going to be there the next day," said Mr Edelman. "Perhaps more seriously, since all accesses are logged, it's quite possible that the Saudi Govt could be watching what you are doing." Saudi Arabia is one of dozens of govts around the world trying to control what their citizens see online. But only a few, such as Vietnam, China and the United Arab Emirates, actually attempt to filter their entire national internet traffic. "There was an instance when it looked like the internet would be a free source of information," said Mr Edelman. "At the present time, there are plenty of forces trying to constraint who does what on the internet. It is looking like the internet of tomorrow might be very different from the internet of today."

The cost of China's web censors ¹ 9.23.03   Mary Hennock BBC Edward Zeng has spent 5 years building Beijing's best-known internet cafe chain Sparkice and the past 12 months shutting it down. Although profitable, the cafes had become too much trouble, he says. "The govt recently has very tight regulations." Sparkice had 20 cafes, whose coffee & stylish interiors appealed to sophisticates and put them in the top end and price bracket of a sector more associated with Formica benches & bare floors. Rougher venues charged as little as 1 yuan (12 US cents ) for an hour's surfing and were packed with teenagers. China's authorities have spent the summer tightening up supervision of the internet, clamping down first on domestic web portals, then internet cafes and foreign-owned portals such as Google & Yahoo. Every internet cafe in Beijing was closed for safety checks after a fatal fire in June. To win relicensing, owners had to accept tougher web filtering technologies, something industry sources believe was long planned. Of 2,400, only 30 have reopened so far, and prices are at least 4x higher. The cafe closures came soon after police raids on major Chinese internet service providers (ISPs), followed by partial service shut-downs, enforcement of filters and stricter oversight of chat rooms and bulletin boards. In September, the authorities shifted to blocking overseas portals Google and AltaVista, two of the most popular. Human rights activists have long worried about China's digital censorship. "You have a lot of talent, not to mention money, that is being directed into controlling rather than stimulating the use of the web," says PricewaterhouseCoopers accountants partner Ken DeWoskin in Beijing. "It's an enormous tax in terms of time & cost that is introduced into the use of the internet for research … everything is slow as molasses," he says. China's elderly patriarchs see censorship as justified by the need for social stability to grow the economy and meet the needs of their huge population. Many of today's internet billionaires started out as insubordinate slackers, similar to the high school students who crowded Beijing's internet bars and allegedly neglected their schoolwork. "The really smart internet entrepreneurs come out of the teenage gaming parlours and compulsive teenage activity," says Mr DeWoskin. China's internet expansion pgm is flourishing. The country claims the world's second biggest online community, and economic growth was a healthy 7% last year. The leadership wants information technology to provide 5% of China's gross domestic product by 2005, though analysts view 3% as more feasible. Analysts believe the latest internet crackdown on cafes and ISPs is about creating a framework of controls within which a sanitised sector can grow. "It's about leverage," says Beijing-based IT analysts BDA China managing dir. Duncan Clark. Digital spying is part of China's online economy that has received major investment. Human rights activists believe the effort employs 30,000 people. Since 2000, they say, China's web filtering has overtaken Saudi Arabia's in scale. The firewall now surrounds the country, not just a few cities. It works by scanning for suspect words as digital documents cross intl gateways and needs big banks of servers. "Dozens if not hundreds of software engineers," are involved, says California-based software designer Safeweb chair & co-founder Stephen Hsu. Safeweb monitors China's web spies in order to help Chinese surfers dodge censorship and gain access to blocked foreign websites. It has licensed its anti-blocking software, Triangleboy, to the CIA, whose venture capital arm In-Q-Tel made a $1m investment in the co. Triangleboy works by turning PCs outside China into gateways to proxy servers and emailing real-time lists of live proxy addresses to take surfers over China's firewall. Ironically, Professor Hsu admits Safeweb itself has discussed controls on its censorship-busting software in order to gain access to US public funds for a proposed trial of its software in tandem with broadcaster Voice of America.

Safeweb "agreed with VoA to put a filter on the server side" to screen out pornography, said Professor Hsu, acknowledging that homosexual rights sites could be blanked too if they are deemed to have "adult content". "In dealing with the political world here in the US, in so far as those resources are going to come from the US govt we have to be realistic," he said.

It's impossible to know how much is China spending on digital spying and censorship because the same technology is imported by multinationals to give their local plants the same protection against viruses & hackers as elsewhere, says BDA China's Mr Clark. "There is a legitimate inflow for dual use technology," he points out, estimating the Chinese market at approaching $100m a year.
Sales by intl telecoms firms to build China's internet backbones are huge & well documented, $1bn in 2001 for Cisco Systems alone. It seems likely much of the technology being used by China's security services was designed & supplied by foreign firms. Speculation centres on how knowingly they did it, whether they modified it.

In Mr DeWoskin's view, the ties between the IT sector & intelligence services are so deep & long- standing that "99% of it is absolutely common firewall technology that is used by govts around the world". Meanwhile, the Communist Party seems confident that acceptable commercial savvy will always find ways to flourish within the firewall.
With investment from UK bank HSBC, Mr Zeng has refocused Sparkice as an e-commerce supplier for foreign retailers trying to source cheap, high quality goods in China.

---

§ite map courtesy of FreeFind

presented by §

OCIAL JUSTICE