Commerce wants ideas on cyber strategy for online businesses
Connecting state and local government leaders
The department is seeking input on its recommendation to establish voluntary codes of responsible behavior for noncritical companies doing business online.
The Commerce Department is seeking comment on its proposal to establish voluntary codes of behavior to improve the cybersecurity of companies doing business online.
The initial report, “Cybersecurity, Innovation and the Internet Economy,” lays out a framework for promoting better IT security in a sector of growing importance to the nation’s economic well-being but which falls outside of the critical infrastructure.
In a Federal Register notice the department asks for comment on 45 questions about the business sectors being addressed, the risks it faces and appropriate responses to them, as well as the government’s role in protecting them.
Related coverage:
White House cyber plan would expand role of DHS, private sector
Can US get international cooperation on Internet conduct?
“The department hopes to spur further discussion with Internet stakeholders that will lead to the development of a series of administration positions that will help develop an action plan in this important area,” the notice states.
The report is part of a series of proposals from the Obama administration in response to the 2010 Cyberspace Policy Review. These include the National Strategy for Trusted Identities in Cyberspace released in April and a proposal for comprehensive cybersecurity legislation and an International Strategy for Cyberspace, both released in May.
The Homeland Security Department is charged with assisting in securing critical infrastructure that is owned and operated by the private sector. DHS, with the help of sector-specific agencies, would designate companies covered by this designation and develop a framework for cybersecurity.
The Commerce Department has focused on companies that fall outside the critical designation but still are critical to a growing online economy, which it has labeled the Internet and Information Innovation Sector. A “general lack of investment” in cybersecurity has put these businesses and their customers at risk, according to the Internet Policy Task Force created within Commerce last year to address the problem.
“Despite increasing awareness of the associated risks, broad swaths of the economy and individual actors, ranging from consumers to large businesses, do not take advantage of available technology and processes to secure their systems, and protective measures are not evolving as quickly as the threats,” the department said in the Federal Register notice.
The task force’s job is to help prioritize risks in this business sector so they can be addressed effectively, and to define the government’s role in protecting it. It has recommended creating nationally recognized but voluntary codes of conduct for the businesses, including the adoption of standards and best practices for cybersecurity such as automated tools and the use of standards such as the federal Common Criteria, as well as employment of DNSSEC.
The practices would be voluntary, but “the government should consider more proactively promoting their implementation and use,” the report states.
The report also recommends education and research programs to develop better business cases for cybersecurity investment and increase awareness of risks and available defenses. Improved international cooperation also is needed for shared research and development and for establishing consistent national policies.
The task force now is looking for additional input from follow-up questions to help crafting a final strategy. Comment should be e-mailed by Aug. 1 to SecurityGreenPaper@nist.gov with the subject line “Comment of Cybersecurity Green Paper.” Comments will be posted at www.ntia.doc.gov/internetpolicytaskforce.
NEXT STORY: Continuous monitoring has some growing up to do