CIO Council: Lack of funding hinders security
The Chief Information Officers Council has begun projects to help agencies improve security practices, but members say a lack of funding and oversight is hamstringing the efforts.
The Chief Information Officers Council has begun projects to help agencies improve security practices, but members say a lack of funding and oversight is hamstringing the efforts.The CIO Council last month introduced a Web site that will give agencies access to a database of security best-practice documents.The site, at , lets users post security best practices for others to see. The CIO Council's Security, Privacy and Critical Infrastructure Protection Committee, the Agency for International Development and Computer Sciences Corp. developed the site. The group launched the site last month at an Armed Forces Communications and Electronics Association security conference in Washington.Conventional wisdom says that if an organization talks about its practices or publicizes its weaknesses, it could become a target. But the site seeks to mirror the tactics used by hackers, said James P. Craft, AID's information systems security officer and chairman of the CIO Council's Security Practices Subcommittee.Hackers are organized into a collaborative community that shares ideas and information about hardware and software weaknesses, Craft said. The goal of the best-practices site is to bring that same collaboration to government security efforts, he said.Mary Schanken, an analyst with the National Security Agency, said the site will not post specific technical data about weaknesses. It will post policies and practices to help agencies.When agencies submit best-practices information, NSA and the National Institute for Standards and Technology will review it to determine whether the document is valid and that it meets some elemental criteria, said Marianne Swanson, a NIST computer specialist.'It's not a full-blown review,' she said. 'As long as there aren't any glaring problems' and it does not expose vulnerabilities, the data will be posted on the Web site in about a week, she said.Getting organizations to share their best practices will be a daunting task, Swanson said. But officials remain optimistic.'We're proud of this initial effort,' said John Gilligan, chief information officer for the Energy Department and co-chairman of the council's security committee.The Web site is only one project the council has undertaken; it is part of a broader effort to publicize government security work, Gilligan said.The council is also designing standard criteria that agencies can use to assess the security of their systems.The group started that project after Rep. Steve Horn (R-Calif.) suggested grading agencies on their security efforts, as he had graded agency year 2000 work. Gilligan said the goal is to create a set of standards so agencies will know how they are being judged by oversight organizations.The council will issue the guide this month, he said.It has been difficult to pursue governmentwide critical infrastructure protection projects, Gilligan said. 'We are not structurally well-postured' to deal with cybersecurity, he said.The Federal Computer Incident Response Capability team, which provides governmentwide advisories, is funded primarily by the General Services Administration, Gilligan said. For 2000, it received $3 million. For 2001, GSA wants to raise FedCIRC's budget to between $15 million and $20 million.Even that funding level will be inadequate, Gilligan said. But it is difficult to get Congress to focus on IT security because there is no single organization with governmentwide jurisdiction over it, he said.The council is working to do a better job of highlighting federal security projects and the need for funds, Gilligan said.Sen. Robert Bennett (R-Utah), who led the Senate's year 2000 panel, said administration and congressional leaders generally view government as a cluster of vertical organizations. Security problems, however, cut across those organizations, he said.'We are not structured to deal with that,' Bennett said.
bsp.cio.gov
Taking aim
Security problems cut across organizations, Sen. Robert Bennett says.
bsp.cio.gov
Taking aim
 | CIO Council members say posting the best security policies and practices on its Web site will help feds collaborate on protection efforts. But the site will not include specific security data. |
NEXT STORY: Scientists begin returning to Los Alamos lab