Recently I had to write a chapter for a textbook when the original author forgot to write it. <smile> While I was researching the topic, I used some resources in infrastructure protection and information warfare that might interest some readers. This column will be a bit of a collage of neat stuff that you may have overlooked but that bears attention and even rereading.

The famous Marsh Report (“Critical Foundations: Protecting America’s Infrastructures”) is the Report of the President’s Commission on Critical Infrastructure Protection which met through part of 1996 and 1997 and led to Presidential Decision Directive 63 (PDD-63) on Critical Infrastructure Protection. 

The 1999 RAND Corp. report entitled “Countering the New Terrorism” by Ian O. Lesser, Bruce Hoffman, John Arquilla, David Ronfeldt and Michele Zanini is a fascinating short (174-page) review of asymmetric warfare (the application of inexpensive, relatively easy tools and methods against sophisticated targets). Chapter Three on “Networks, Netwar, and Information-Age Terrorism” will be particularly interesting to readers of this column.

That same year, the General Accounting Office (now called the Government Accountability Office) issued its report GAO/T-AIMD-00-7, “Critical Infrastructure Protection: Fundamental Improvements Needed to Assure Security of Federal Operations”. This was the statement of Jack L. Brock, Jr., the Director of Governmentwide and Defense Information Systems Accounting and Information Management Division. He was testifying before the Subcommittee on Technology, Terrorism and Government Information of the Committee on the Judiciary of the U.S. Senate. His testimony began:

“GAO and IG reports issued over the last 5 years describe persistent computer security weaknesses that place federal operations such as national defense, law enforcement, air traffic control, and benefit payments at risk of disruption as well as fraud and inappropriate disclosures. Our most recent analysis, of reports issued during fiscal year 1999, identified significant computer security weaknesses in 22 of the largest federal agencies. These included weaknesses in (1) controls over access to sensitive systems and data, (2) controls over software development and changes, and (3) continuity of service plans. These types of weaknesses increase the risk that intruders or authorized users with malicious intentions could read, modify, delete, or otherwise damage information or disrupt operations for purposes, such as fraud, sabotage, or espionage. This body of audit evidence led us, in February 1997 and again in January 1999, to designate information security as a governmentwide high-risk area in reports to the Congress.”

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services. CV online.