White House said to plan executive order on cybersecurity

SAN FRANCISCO (Reuters) - The White House is preparing to direct federal agencies to develop voluntary cybersecurity guidelines for owners of power, water and other critical infrastructure facilities, according to people who said they had seen recent drafts of an executive order.

The prospective order would give the agencies 90 days to propose new regulations and create a new cybersecurity council at the Department of Homeland Security with representatives from the Defense Department, Justice Department, Director of National Intelligence and the Department of Commerce, a former government cyber-security official told Reuters.

"It tells those who have the ability to regulate to go forth and do so," said the person, who is currently outside the government and spoke on condition of anonymity in order to preserve access to government officials.

The draft executive order includes elements of what had been the leading cybersecurity overhaul bill in the Senate, which was defeated this summer amid opposition from industries opposed to increased regulation.

Senate Homeland Security Committee Chairman Joe Lieberman, an independent and one of the principal authors of that bill, on Monday urged the White House to issue such an order.
"The Department of Homeland Security has clear authority, if directed by you, to conduct risk assessments of critical infrastructure, identify those systems or assets that are most vulnerable to cyber attack and issue voluntary standards for those critical systems or assets to maintain adequate cybersecurity," Lieberman wrote to President Barack Obama.

The document has been circulating among the agencies and might go to top officials for their comments as soon as this week, another person involved in the process said.
A spokeswoman for the administration's National Security Council, Caitlin Hayden, confirmed that an order was being considered but would not provide details. "We're not commenting on the elements," Hayden said.

PUBLIC-PRIVATE COOPERATION

Former White House cybersecurity policy coordinator Howard Schmidt said the proposed order would also ask DHS to confer with independent agencies, such as electric regulators and others that don't answer to the president, to see who would take responsibility on cybersecurity.

The hope, said Schmidt, who has seen a recent draft, is that if those agencies won't let DHS act they would do it themselves, as the Securities and Exchange Commission did in October when it issued guidance on when companies should disclose cyber attacks.

The Commerce Department and the Pentagon declined to comment. Spokespeople for Lieberman and for Senator John Rockefeller, another Democratic leader on the issue who has asked for an executive order, said their offices had not been given copies of the draft.
Cybersecurity has become a major issue in Congress and for the White House, with intelligence officials warning of constant exploration of protected computer systems by hackers and both past incursions and the likelihood of more damaging future attacks on electric plants, banks and stock exchanges.

As of two weeks ago, the planned order did not include any penalties for companies that fail to adhere to the standards. or rewards for those who do. "There are no carrots or sticks," one person with a recent copy said.

If the order emerges before the election in November, it could become an issue in the campaign. Leading Republicans faulted the Lieberman bill as too onerous. The U.S. Chamber of Commerce, which also criticized that bill, declined to comment on Monday on the merits of a prospective order.

But Lieberman said his bill had been watered down in pursuit of a compromise and asked in his letter Monday that Obama explore means for making the standards mandatory.
Both Lieberman and administration officials have said they will still seek legislation, which could go further in many ways. It might, for example, provide liability protection for companies that share information with government officials or that meet the standards but still get hacked.

(Reporting by Joseph Menn in San Francisco; editing by Todd Eastham)

2012 Cybercrime Report - Cost to consumers: $20.7 billions

Click here: 2012 Cybercrime Report

Former Hacker: Today’s Hacks Are All About the Money

Former Hacker: Today’s Hacks Are All About the Money Hackers have changed since the days of The Matrix. While most hackers used to hold iconoclastic ideals, with aspirations to “shock the system” for a perceived common good, today’s hacker/cracker community is more concerned with making a quick buck...........

Rise Is Seen in Cyberattacks Targeting U.S. Infrastructure

July 26, 2012

By DAVID E. SANGER and ERIC SCHMITT (New York Times

ASPEN, Colo. — The top American military official responsible for defending the United States against cyberattacks said Thursday that there had been a 17-fold increase in computer attacks on American infrastructure between 2009 and 2011, initiated by criminal gangs, hackers and other nations.

The assessment by Gen. Keith B. Alexander, who heads the National Security Agency and also the newly created United States Cyber Command, appears to be the government’s first official acknowledgment of the pace at which America’s electricity grids, water supplies, computer and cellphone networks and other infrastructure are coming under attack. Those attacks are considered potentially far more serious than computer espionage or financial crimes. 

General Alexander, who rarely speaks publicly, did not say how many attacks had occurred in that period. But he said that he thought the increase was unrelated to the release two years ago of a computer worm known as Stuxnet, which was aimed at taking down Iran’s uranium enrichment plant at Natanz. 

When the worm inadvertently became public, many United States officials and outside experts expressed concern that it could be reverse-engineered and used against American targets. General Alexander said he saw no evidence of that. 
General Alexander, as head of the N.S.A., was a crucial player in a covert American program called Olympic Games that targeted the Iranian program. But under questioning from Pete Williams of NBC News at a security conference here, he declined to say whether Stuxnet was American in origin; the Obama administration has never acknowledged using cyberweapons. 

General Alexander said that what concerned him about the increase in foreign cyberattacks on the United States was that a growing number were aimed at “critical infrastructure,” and that the United States remained unprepared to ward off a major attack. On a scale of 1 to 10, he said, American preparedness for a large-scale cyberattack is “around a 3.” He urged passage of legislation, which may come to a vote in the next week, that would give the government new powers to defend private computer networks in the United States. The legislation has prompted a struggle as American companies try to avoid costly regulation on their networks, and some civil liberties groups express concern about the effect on privacy. 

General Alexander said that the administration was still working out rules of engagement for responding to cyberattacks. Because an attack can take place in milliseconds, he said that some automatic defenses were necessary, as was the president’s involvement in any decisions about broader retaliation.

He confirmed that under existing authorities, only the president had the power to authorize an American-directed cyberattack. The first such attacks occurred under President George W. Bush. 

The Pentagon has said previously that if the United States retaliated for an attack on its soil, the response could come in the form of a countercyberattack, or a traditional military response. 

General Alexander spoke in a 75-minute interview at the Aspen Security Forum at the Aspen Institute here. The New York Times is a media sponsor of the four-day conference. Another conference speaker, Matthew Olsen, the director of the National Counterterrorism Center, addressed the escalating “hot war” between Israel and Iran and Iranian-backed groups like Hezbollah.

Iran has blamed Israel for assassinations of several of its nuclear scientists. Israel has accused Hezbollah operatives backed by Iran of carrying out the suicide bombing last week that killed five Israeli tourists and a local bus driver in Bulgaria. 

The United States has said Iran was behind a thwarted plot last fall to kill Saudi Arabia’s ambassador to the United States. 

“Both with respect to Iran and Hezbollah, we’re seeing a general uptick in the level of activity around the world in a number of places,” Mr. Olsen said.

Mr. Olsen did not address the Bulgaria attack, but he said the plot to kill the Saudi envoy in Washington “demonstrated that Iran absolutely had the intent to carry out a terrorist attack inside the United States.” MORE IN U.S. (12 OF 27 ARTICLES) Quiet Duo Forged Road Deal for U.S. and Pakistan Read More »

Computer Scientists Break Security Token Key in Record Time

The Flame Burning Inside Stuxnet

Interesting article. Check it out.
The Flame Burning Inside Stuxnet

BTOD (Bring Your Own Device) Whitepaper

Good whitepaper: BYOD (Bring Your Own Device). See how companies are coping with the influx of these devices in the workplace. Click here.