US President George W Bush's former cybersecurity advisor
has criticised the efforts within the federal government at
congressional hearings yesterday (8 April).The Bush administration's Department of
Homeland Security (DHS) is moving too slowly in organising its
National Cybersecurity Centre, and the White House Office of
Management and Budget needs to hire a full-time chief information
security officer to focus on cybersecurity, said Richard Clarke,
former special advisor to the president for cyberspace
security.
The president's National Strategy to Secure
Cyberspace, released in mid-February, cannot move forward without
the Homeland Security cybersecurity centre, Clarke said, who left
the White House two months ago and is now a consultant.
The department has failed to "recruit a cadre
of nationally recognised cybersecurity experts", he said.
"I would hope that with cybersecurity we can
do more to raise our defences before we have a major disaster,"
Clarke added. "The problems we’ve had to date are minor compared to
the potential."
Clarke also called on congress to fund
vulnerability scanning sensors on all federal networks and
recommended federal agencies outsource their cybersecurity projects
and withhold money from the suppliers if the agencies get failing
cybersecurity grades.
Michael Vatis, director of the Institute for
Security Technology Studies at Dartmouth College, agreed with
Clarke that the US government response to cybersecurity is
lacking.
Hundreds of cybersecurity jobs, including top
posts that were to move from the Federal Bureau of Investigation,
the Federal Computer Incident Response Centre and other agencies to
the Homeland Security Department remain unfilled.
"It could take over a year before we get back
to where we were in our ability to respond to cyber attacks," Vatis
said, blaming a "gaping void" in leadership from the Bush
administration.
But Mark Forman, associate director of
information security and electronic government for the White House
Office of Management and Budget, defended the Bush administration
efforts to make federal agencies more secure.
The number of federal systems meeting several
cybersecurity goals has risen rapidly since 2001, Forman said. In
2001, only 40% of federal systems had up-to-date system security
plans.
By 2002, that number had risen to 61%. Forman
said he would match those improvements against any company in the
private sector, although he admitted the numbers are "still too
low".
Forman insisted that cybersecurity was a top
priority in the Bush administration, and he noted that the Homeland
Security Department has only been an official agency since 1 March.
As the department organises, congress will see "significant action"
in the area of cybersecurity, he added.
"I pledge to you that the administration is
focused on [cybersecurity] all the way to the highest level,"
Forman told the committee.
Clarke disputed Forman's claim that the
federal government matches up with cybersecurity efforts in the
private sector. He singled out the banking industry as one area
where cybersecurity is taken more seriously than in the US
government. Banks usually have high-ranking officers responsible
for security.
"Who is the highest level official in the
Department of Homeland Security whose full-time job is
cybersecurity?" Clarke asked. "What office in the Department of
Homeland Security does nothing but cybersecurity? How many people
in OMB have that full-time responsibility? The answers to those
questions are pretty frightening."
Forman did not answer Clarke's questions,
instead saying that cybersecurity should not be separated from the
other responsibilities of agency chief information officers.