Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Let's end pass-the-buck security

By Winn Schwartau , Network World , 04/12/2004
Schwartau

At InfowarCon in 1997, one of the first public debates was held on who should protect the private sector (an economic national security asset) from the "bad guys" - not just from hacking, but also international espionage and terrorism. There were two camps. One suggested that the government should take the protective lead. The other camp said, "No, keep the Feds out of my company. We'll take care of ourselves."

Then came Sept. 11, and the interdependence between all our infrastructures became clear; we are all in this together. So the Department of Homeland Security was formed to be the catch-all of security, including cybersecurity, for the U.S.

In December, Rep. Adam Putnam (R-Fla.), chairman of the House Government Reform Committee's Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, released the 2003 federal computer security report card for the U.S. government. The DHS received a failing grade, and the average score for the entire federal government was a dismal D. The Feds failed cybersecurity responsibility for their own systems, yet they want to guide the private sector's efforts.

So how much in information security has changed in the last 20 years? Next to nothing, and in many ways, things have gotten worse. Last month, the General Accounting Office (GAO) reported there were 1.5 million reported cyberattacks against government facilities in 2003, a threefold increase over 2002.

I speak to senior management across the country, and too many of them feel that the DHS has it covered and that they don't have to spend bottom-line dollars on security. They're passing the buck to the Feds, who are in no better shape and perhaps measurably less responsible than the rest of us.

The GAO and endless other reports cite what we have known for years: Companies need to take responsibility for their own security. We have seen some positive movement in that direction with security awareness, but these efforts tend to be aimed at employees, ignoring the group that can do the most good: senior management.

How many managers understand the real security issues we face, much less are able to discuss the intricacies of their interdependence? How many managers follow the same advice and policy directives they expect their staff to follow? How many managers know their counterparts at competitive organizations who all face the same threats?

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Magic Quadrant for Application Delivery Controllers

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise

This paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Webcasts

Transforming the Enterprise WAN Edge: Video from Cisco

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.