In the aftermath of the 9/11 terrorist attacks, and the panic that followed a series of Anthrax-laden letters mailed to members of the US government, a new debate on cybersecurity and its relation to national infrastructure was raised among those in the former Bush administration. This was how it was recounted by Tom Ridge, former governor of Pennsylvania and the nation’s first Homeland Security Secretary.
“At the time…we believed – perhaps more than some others did – that information security was critical to operational security, and as a government, we had to be very concerned about operational security because we depend on the private sector to provide the fundamental services to keep government running”, Ridge told the audience. It was at this point in 2003 that the National Strategy to Secure Cyberspace began in earnest, as part of the nation’s greater National Homeland Security Initiative. As a special adviser for cyberspace security to then-president George W Bush, Howard Schmidt was instrumental in developing the Secure Cyberspace strategy.
Ridge was joined by Schmidt, who also served as President Obama’s cybersecurity coordinator until the summer of 2012 – during the RSA Conference discussion. Much as the call has gone out recently, as evidenced by Obama’s executive order on cybersecurity and critical infrastructure, many in government saw the need more than a decade ago to promote a framework that would allow for greater cooperation between the private and public sector with regard to cyber threat information sharing, Ridge noted.
As early as 2002, Schmidt added, information security experts consulted by the Bush administration were at work on drafting such a framework and collecting comments from interested stakeholders both within and outside the government.
Issues like infrastructure interdependency meant the draft document was “about awareness, it was about threat assessment, and it was about information sharing”, Ridge commented. “It was a fairly significant document, not just yesterday, but I think today and for tomorrow”.
Several key programs were implemented at the time, as Schmidt outlined, including establishment of the National Cyberspace Security Response System, the nation’s threat vulnerability reduction program, and the United States Computer Emergency Readiness Team (US-CERT) under Ridge’s leadership as the nation’s first Department of Homeland Security (DHS) Secretary.
“As we rolled out the notion of a national cybersecurity strategy, focusing on critical infrastructure”, Ridge continued, the standards that the government uses has to be consistent with those it would like to see employed by the private sector – and developing these standards requires collaboration from both sides. Also, he asserted, “if you are involved in a digital system in any way…you have a responsibility to help secure this extraordinary network upon which our national security, and economic security, depend”.
Complex Sausage Making
Schmidt echoed Ridge’s assessment, acknowledging that his recent post in the Obama White House served advisory roles in both national security and among the admiration’s economic advisors – underlining that cybersecurity and critical infrastructure are not simply physical security issues. The framework, he added, allows the nation to examine these cybersecurity issues from a national security perspective while at the same time evaluating security strategies for any counterproductive economic effects. After leaving this post recently, Schmidt admitted that not all of the 20-plus pieces of cybersecurity legislation being considered by Congress were effective in his opinion.
“Some were pretty good”, he noted, while others left him asking what members of Congress were thinking. “Others, in some cases, were conflicting which each other”, and did not clearly establish a proper chain of command among government agencies. After being approached by Senate Majority Leader Harry Reid (D-NV), Schmidt said the administration began crafting a legislative package that attempted to bridge gaps between the various stakeholders, in an attempt to form some consensus.
Regardless of this attempt to form a greater agreement about the nation’s current security posture and what was needed to rectify the shortcomings, action by Congress will be required to implement a long-term solution, Schmidt admitted. That is, until the recent executive order, which expedited the process in the absence of Congressional action.
Commenting on a recent op-ed both gentlemen wrote for Politico regarding Congress’ inaction, Ridge said “there comes a point in time that the frustration of the body politic about the cyber situation in where we must say to the group – Republicans and Democrats – this is a challenge, this is a problem, you run to win, you win to govern – start governing and deal with this issue”. The op-ed piece was not meant to criticize either the Congress or the Obama administration regarding inaction, but Ridge said he hoped it raised awareness about the urgency of the issue, including the fact that many of the competing cybersecurity bills had common elements that could serve as a source of action – rather than procrastination.
“Quit making the perfect the enemy of the good”, he proclaimed. “We have made enormous progress in cybersecurity [over the last two decades]. We can accelerate that progress, and it would be helpful if we could get Congress to get together, forget about being Democrats and Republicans, and just bring in those common provisions that everyone feels good about and advance it that way…that was the purpose of the op-ed”.
From the Office of the President…
As for the recent cybersecurity executive order signed by Obama, Schmidt is unconcerned with the political source, and added that he only cares about advancing the agenda of securing the nation’s digital infrastructure. Inaction, and fielding questions from Congress about what may have went wrong in a disaster situation, would be the wrong tactic, and with potentially calamitous consequences. What the executive order does, he asserted, was take the original National Strategy to Secure Cyberspace principle to share threat information between the public and private sectors, and move it from the realm of something that nation should have into something the nation must do – with an accompanying framework to implement it.
The former ‘cyber czar’ also voiced his support for NIST’s role in developing the information sharing framework, calling them “the honest broker”, a group of scientists that “think much like we do”, referring to the audience of information security professionals at the RSA Conference.
While the executive order is a voluntary framework, Schmidt sees the US government’s procurement power as fundamental to making it more compulsory across technology providers and owners of critical infrastructure services. To “raise the level for all”, he said, vendors will need to demonstrate that they meet these established standards.
Ridge said he had a slightly different take on the subject, but admitted that “anytime the president of the United States is in the headlines talking about cybersecurity, I think that’s a good thing” – comments which earned him a hardy round of applause from the audience. “But for the president to have to sign an executive order directing the federal government to give unclassified information when a risk is directed toward a specific target is almost incredulous to me – that the president has to tell them to do what you and I would think they would do naturally”.
The former DHS Secretary takes issue with some of the inconsistencies in the executive order, which from the outset speaks of “voluntary standards” but also makes reference to “imposing requirements – presumably on the private sector companies operating” in certain areas under the watchful eye of sector-specific regulatory bodies. “It’s just troubling to me”, Ridge surmised, but nonetheless sees the order as a “foundation” for creating a cybersecurity framework at the national level – and not an overall long-term solution.