[iwar] [fc:Feds.Eye.Setting.Software.Standards.Software.Makers.Warned.to.Improve.Security.-.Or.Else]

From: Fred Cohen (fc@all.net)
Date: 2001-10-03 13:32:00

Next message: Fred Cohen: "[iwar] [fc:Can.Your.Organization.Survive.a.Cybercrime?]"
Previous message: Fred Cohen: "[iwar] [fc:MUSLIM.NATIONS.SAY.MIDEAST.CRISIS.SPURS.TERRORISM]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200110032032.NAA18944@big.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Wed, 3 Oct 2001 13:32:00 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:Feds.Eye.Setting.Software.Standards.Software.Makers.Warned.to.Improve.Security.-.Or.Else]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Feds Eye Setting Software Standards Software Makers Warned to Improve Security - Or Else
By Tech Live staff

Oct.  3 - If software companies don't start doing a better job of fixing
vulnerabilities in their products, they could face formal government
standards, a top federal official warned Monday. 

The comments came from John Gilligan, acting chief information officer
(CIO) for the Air Force and a representative of the Federal CIO Council,
a government body tasked with addressing IT security issues. 

 During an FBI cybersecurity briefing in Washington Monday, Gilligan
said the rise in malicious code attacks in recent years - from the
Melissa virus to the recent Nimda worm - highlights key vulnerabilities
that, if exploited, could lead to attacks capable of crippling the US
economy and communications network.  The interdependence of computers on
the Internet means "we are only as strong as the weakest link," Gilligan
said. 

Software Patches Only Offer Temporary Solution

 Part of the problem, he said, is that software makers too often take a
"find and patch" approach to designing products, releasing software with
latent security holes on the assumption that the problems will be found
and fixed later. 

"None of us can afford the cost of a continual race against would-be
cyberattackers using the current 'find and patch' approach to deal with
latent vulnerabilities in commercial software packages," Gilligan said. 
"Simply the economic cost of this 'find and patch' mode of operating is
enormous."

Gilligan said increased political tensions following the September 11
terrorist attacks on the World Trade Center and the Pentagon are likely
to result in an escalation of computer-based attacks in the future. 
Software makers need to either voluntarily change product design and
release cycles to reflect this heightened threat or risk formal
government intervention, he said. 

Gilligan's warning comes less than a week after a Gartner Research
report urged businesses to replace Microsoft Internet Information
Services Web server software immediately with products from other firms
with a better track record of dealing with security holes. 

Although Gilligan praised Microsoft for its "aggressive actions" to
improve internal security processes, that still is not enough, he said. 

"I think the first step is to establish a set of standards," Gilligan
said.  "Beyond that, the next step would be to, through some contractual
or legal expectation, have some reinforcement of that.  And I think what
we'll see is an evolution of that over the upcoming months."

Cybersecurity Could Be a Major Issue for Homeland Security Office

 According to Allan Paller of the nonprofit SANS Institute, which often
works with the FBI to assess computer threats, industry leaders already
have begun the process of setting formal security standards for software
under a project sponsored by the Center for Internet Security. 

Moreover, cybersecurity could soon be a top issue with the newly created
Office of Homeland Security, Gilligan said.  Over the next couple of
months, Gilligan said he and the other members of the Federal CIO
Council plan to work with the newly created agency to make increased
cybersecurity part of the overall US domestic defense plan. 

Copyright 2001 TechTV, Inc. 

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:Can.Your.Organization.Survive.a.Cybercrime?]"
Previous message: Fred Cohen: "[iwar] [fc:MUSLIM.NATIONS.SAY.MIDEAST.CRISIS.SPURS.TERRORISM]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:53 PST