Two years later, U.S. still not prepared to secure cyberspace, report warns

Nearly two years after declaring that cyberspace is a critical national asset, little progress has been made in improving the nation’s cybersecurity, according to the Center for Strategic and International Studies.

The assessment is made in a follow-up to “Securing Cyberspace for the 44th Presidency,” the 2008 report created by CSIS for the incoming president that called for a government-led approach to cybersecurity.

“Our 2008 report concluded that cybersecurity is now one of the major national security problems facing the United States and that only a comprehensive national strategy consistent with U.S. values would improve the situation,” CSIS said.

The follow-up, “Cybersecurity Two Years Later,”  includes recommendations for key challenges that remain to be met.

“We thought then that securing cyberspace had become a critical challenge for national security, which our nation was not prepared to meet,” the new assessment says. “In our view, we are still not prepared.”

Related coverage:

Obama to revamp cybersecurity policy, will name cybersecurity coordinator

White House just getting started on cybersecurity

The 2008 report was favorably greeted by the administration and its recommendations were reflected in the May 2009 Cyberspace Policy Review, which declared that the status quo in cybersecurity no longer was acceptable and that the “White House must lead the way forward.” The review set out a 10-step, near-term action plan that included creation of the position of a White House cybersecurity coordinator, a position that has been filled by Howard Schmidt.

But implementation of many recommendations has been mixed, in part because of other crises and priorities that have taken precedence and because of concerns about government regulation. “Cybersecurity unavoidably takes second place to more immediate concerns, such as the wars or the economy,” the new report says.

Events over the past year illustrate the need for aggressively pursuing cybersecurity, however. “2010 should have been the year of cybersecurity,” the report says. It began with the announcement in January of a major breach of Google and other large companies, saw the compromise of Defense Department networks, included the spread of the Stuxnet worm in industrial control systems, and ended with annoying denial-of-service attacks over WikiLeaks.

These events “show how the United States is reliant on, but cannot secure, the networks of digital devices that make up cyberspace,” CSIS’ report states. “As a nation, we must do more to reduce risk, and we must do it soon.”

But current approaches to cybersecurity rely on voluntary cooperation between the public and private sectors without a central point of control and authority, and underestimate the challenges of sharing information between the private sector and government, CSIS concludes. The government needs to take a leadership role in cybersecurity.

“Expecting the private sector to defend against these professional opponents is like saying we can use our airlines to defend our national airspace against enemy fighter aircraft,” the reports states. “We still have no defense against advanced cyber power.”

CSIS identified 10 key areas of cybersecurity where progress should be made over the next two years:

1. Coherent organization and leadership for federal efforts for cybersecurity and recognition of cybersecurity as a national priority. The United States still lacks an integrated national cybersecurity strategy, with primary responsibility divided between the departments of Defense and Homeland Security. A new strategy is needed with clear lines of authority rather than appeals to cooperation.
2. Clear authority to mandate better cybersecurity in critical infrastructure and develop new ways to work with the private sector. Regulation needs to impose the lightest possible burden, be flexible rather than prescriptive, and be developed in partnership with industry, but some regulation is needed.
3. A foreign policy is needed using all tools of U.S. power to create norms, new approaches to governance and consequences for malicious actions in cyberspace. International engagement has become even more important in the last two years as nations seek to extend sovereign control into cyberspace. Cyberspace is not a commons; other countries have realized this and are acting to protect their own sovereign interests.
4. An expanded ability to use intelligence and military capabilities for defense against advanced foreign threats. The creation of Cyber Command is a major step forward for the United States. However, use of military capabilities will require resolving a number of doctrinal and policy issues, including when a military response is appropriate and how cyber actions would be authorized.
5. Strengthened oversight for privacy and civil liberties, with clear rules and processes adapted to digital technologies. There is a persistent belief that cybersecurity must inevitably damage privacy. The administration needs to work off a sound and transparent set of principles to ensure that privacy and civil liberties are protected and to strengthen institutions so that those principles become real.
6. Improve authentication of identity for critical infrastructure. The new “National Strategy for Trusted Identities in Cyberspace” takes a tentative step toward fixing this problem, but it does not go far enough for critical applications. The biggest challenge for the NSTIC and its new National Program Office in the Department of Commerce will be to increase incentives for people to use online authentication.
7. Build an expanded workforce with adequate cybersecurity skills. There is agreement that rapid action is needed to increase the number and skill level of those who practice in this area. However, as with much else in cybersecurity policy, the problem has been identified, initial steps have been taken, but there has been slow progress in changing the situation from where we were two years ago.
8. Change federal acquisition policy to drive the market toward more secure products and services. The federal government can use its purchasing power to incentivize the development of more secure products and services.
9. A revised policy and legal framework to guide government cybersecurity actions. Legislation introduced in 2010 began the process of examining how to modernize existing legislation, and several committees continue to review existing legislation. This is a good start for a long overdue task, but absent any forcing event, we expect a long debate over the appropriate legal framework for cybersecurity.
10. Research and development (R&D) focused on the hard problems of cybersecurity and a process to identify these problems and allocate funding in a coordinated manner. Fundamental weaknesses in the Internet’s mechanisms and networking protocols increase risk. R&D can often take years to produce results, so the best measurement of progress in the next two years will be sustained funding and attention to modernizing Internet technologies.