Rome Burns. We Fiddle.

Rome Burns. We Fiddle.

Those who welcome the Obama Administration’s announcement last week that it is issuing an executive order to set up a national Cyber Threat Intelligence Integration Center, might want to think some more about that. This came as part of Obama’s White House Summit on Cybersecurity and Consumer Protection at Stanford University on Friday. The stated purpose of the Center is to “integrate all data from government agencies and the private sector, and disseminate it appropriately.”

I’m not sure what disseminate it appropriately means and I would argue that you don’t either. I’m also not sure that any government agency that I can think of is going to be willing to share anything. If history is a fair guide, then we know that U.S. intelligence agencies have had their own silos of information about cybersecurity and cyberterrorism for years and have been doggedly stingy about sharing anything with anybody.

Top executives from several powerful Silicon Valley “private sector” companies, (Facebook's Mark Zuckerberg, Yahoo's Marissa Mayer and Google's Larry Page) did not attend the summit amid ongoing and increasing concerns about government surveillance. Really? However, Bank of America and PG&E did attend which may tell us all we need to know.

The third problem is that the Center as described will rely on private sector participation, which means private sector cost, which will never get private sector funding. While the security community is always big on information sharing, they have zero impact on spending. There are no businesses that I know of including Google that will spend money to give the Federal Government data out of some sense of national pride or patriotism.

Cooperation with the private sector has always been a major tenet of the Obama administration's approach to cybersecurity, but it has repeatedly met with at best a lukewarm reaction in the past.

As an example of our government intelligence community’s view of information sharing with the private sector, the recent Sony breach is a good example (and, no … I am never giving up on my theory of that breach until proven wrong). The U.S. National Security Agency (reportedly) knew in advance about the attack because it had penetrated North Korea’s computer systems, but did not warn Sony it claims now because its mandate is to protect national security and not the private sector. So, great start huh?

My other favorite part of this whole thing is the announcement that the Center will initially have a staff of 50 and a budget of US$35 million and will be led by James Clapper, the Director of National Intelligence.

Yes, this would be the same James Clapper who lied to Congress under oath about the NSA's activities, denying the agency had spied on Americans, only to be unmasked by Edward Snowden's revelations. No, I am not making this up.

In addition to the phot-op rich announcement in Silicon Valley, The White House forgot to tell Congress about its plan to establish the new intelligence center, leaking the information to the Washington Post on Monday instead.

This of course prompted several senators to dash off a letter to President Obama, calling for among other things, Clapper's immediate dismissal.

So, what we have here is a large, grandiose announcement that sounds like a great plan for everybody to stick their oars in and start rowing in the same direction to support a centralized program led by a known criminal with $35 million of our taxpayer dollars, presumably to work together with Darpa-Dan down the street with another $500 million, while all of the agencies and private businesses stand on the docks with their oars in their pockets.

In the meantime, the cyber-outlaws are laughing and scratching while perpetrating the largest bank heist in history, hacking into 100 banks in 25 countries and stealing over $300 million and counting, even as you read this.

It "takes a lot more than a speech, handshake and a promise to build complex, robust and scalable information sharing systems," said Ken Westin, senior security analyst at Tripwire. "Like many others, I really want to see this program work, but a lot of us are skeptical because we understand the complexities and pitfalls of getting something like this done."

Obama said, explaining the order. “Everybody is online, and everybody is vulnerable.” Amen, brother.

Federal Unified Cyber Knowledge Education and Distribution - an acronym worthy of this effort! Obama's initiative is just an effort to appear as if the government cares. Oh, and Facebook announces they will have a threat information sharing service soon. Will they be publishing their source code? :-)

回复

要查看或添加评论,请登录

Steve King, CISM, CISSP的更多文章

  • Connected Device Security: A Growing Threat

    Connected Device Security: A Growing Threat

    Many cybersecurity analysts have warned of the rapidly emerging threat from an expanded IoT space. And as you have…

    3 条评论
  • China’s Ticking Time-Bomb.

    China’s Ticking Time-Bomb.

    It should now be clear to even the casual observer that China has been spying on us for years and stealing reams of…

    7 条评论
  • Comparing Major Crises To COVID-19: A Teachable Moment

    Comparing Major Crises To COVID-19: A Teachable Moment

    Lessons from past financial crises might prepare us for the long and short-term effects of COVID-19 on the economy and…

  • The Escalating Cyber-Threat From China

    The Escalating Cyber-Threat From China

    A Modern-day Munich Agreement In an article penned back in May of 2015 in a policy brief published by the Harvard…

    1 条评论
  • Cybersecurity: Past, present, future.

    Cybersecurity: Past, present, future.

    We have made a flawed assumption about cybersecurity and based on that assumption we have been investing heavily on…

    15 条评论
  • Three Marketing Tips for Improved Conversion Rates

    Three Marketing Tips for Improved Conversion Rates

    While we are all devastated to one degree or another by this outbreak and with the knowledge that it will likely change…

  • Coronavirus in the Dark.

    Coronavirus in the Dark.

    So, yes. It is now very clear that the outbreak of the COVID-19 virus and the concomitant investor panic leading to a…

    13 条评论
  • Panicky Investors Issue Dire Warning On Coronavirus

    Panicky Investors Issue Dire Warning On Coronavirus

    Sequoia Capital just issued a dire warning to its portfolio companies. “Coronavirus is the black swan of 2020.

    5 条评论
  • AI in Cybersecurity? Closing In.

    AI in Cybersecurity? Closing In.

    "AI Needs to Understand How the World Actually Works" On Wednesday, February 26th, Clearview AI, a startup that…

    8 条评论
  • Do CapitalOne Shareholders Have a Case Against AWS?

    Do CapitalOne Shareholders Have a Case Against AWS?

    An adhesion contract (also called a "standard form contract" or a "boilerplate contract") is a contract drafted by one…

    1 条评论

社区洞察

其他会员也浏览了