The Other Shoe Drops on Cybersecurity Legislation

With all the discussion about #cybersecurity legislation this week, a small but important story has gone largely ignored.  On Thursday, the European Parliament called the development of global standards for cybersecurity regulation ending the current "ad hoc" international efforts http://bit.ly/buNBkC

The idea is to create broader legislation and regulation outside of the European union.  This represents an aggressive approach to controlling the many challenges around this issue including global regulation and cooperation rarely seen or suggested. "Despite the borderless nature of the #Internet, international regulation of #online security does not yet exist, resulting in a multiple abuses from small-scale theft and identity fraud to espionage and mass attacks that shut down a business or utility."

Meanwhile crucial piece of US #cybersecurity legislation is moving closer to becoming law after being approved during a Commerce, Science & Transportation Committee hearing Wednesday. 

The #Cybersecurity Act, S. 773, aimed at protecting critical U.S. network infrastructure against cybersecurity threats by fostering collaboration between the federal government and the private sector (#public/private partnership) firms that maintain that infrastructure, is now on its way to the Senate floor.


The Cybersecurity Act calls for a revision of cybersecurity processes and oversight in government, the facilitation of public-private partnerships on keeping computer systems safe, the funding of cybersecurity research, and the hiring of more cybersecurity specialists.  Companion legislation that would create the national cybersecurity adviser position -- the National Cybersecurity Advisor Act, S.778 -- is still pending before the Senate Committee on Homeland Security and Government Affairs.

This past February saw the passage of House cybersecurity bill called the Cybersecurity Enhancement Act of 2009 (HR 4061), first introduced by Rep. Daniel Lipinski (D-IL) last year. That bill funds research and development for a comprehensive cybersecurity plan that would involve the cooperation of several federal agencies http://nyti.ms/bEQpCk

So where is this conversation going?   Global I think but with the United States and Europe leading.  Perhaps they have the most to fear and/or protect.  After all it appears these governments have biggest target on their backs. This will take a while to wind itself through the legislative processes that be, but the future is clear.  Governments have finally heeded the alarm bells, and they are responding.

Why San Diego and Maryland Should Work Together on a National Cybersecurity Effort

Recently Maryland stepped publicly to say that they want to become "the Silicon Valley of cybersecurity". In a report published by the the state, Governor Martin O'Malley says that Maryland has the assets, including a "cluster" of required IT capabilities, to support the federal government's growing cybersecurity requirements.

The report, titled "CyberMaryland," cites Maryland's higher education, R&D, technology workforce, and base of businesses and government agencies as reasons it's well suited to play a central role in cybersecurity.

I applaud Maryland's proactive approach and suggest that San Diego become part of this dialog. Instead of competing with Maryland, I suggest that we reach out and Partner with the state to support their efforts while bolstering our own prospects as a West Coast beacon on cybersecurity. In combating the problem of cyber security, many cities and states must emerge as leaders of cyber and Maryland and San Diego have first mover advantages.

San Diego is well suited to lead cyber from the West Coast, nationally and even internationally due to it's unique characteristics as a community. Collaborative law enforcement, military presence, world class universities focusing on cyber, a border with Mexico and many other factors favor San Diego as a center of cyber excellence.

Governor O'Malley says that "Maryland is poised to lead the nation's war on cyber crime," O'Malley serves co-lead on homeland security for the National Governors' Association Public Safety Task Force and on the U.S. Homeland Security Advisory Council.

Included in the Maryland report is a proposal to establish, via federal funding and a public-private partnership, a National Center of Excellence for Cybersecurity in the Maryland. Potential components will include a "new technology incubator, testing labs, education, and training."

The report also recommends aligning Maryland's cybersecurity initiatives with those of the Obama Administration and developing the state's "brand" as a cybersecurity epicenter.

Maryland does have several advantages in this pursuit. The state is home to more than 50 federal facilities and a dozen military installations. Several government agencies involved in cybersecurity are headquartered in Maryland or have facilities there, including the National Security Agency, Intelligence Advanced Research Projects Activity, and National Institute of Standards and Technology. The DOD's Defense Information Systems Agency plans to relocate to Fort Meade in Maryland next year.

Defense Secretary Robert Gates issued an order last June to establish the U.S. Cyber Command, with a purpose of centralizing the U.S. military's cybersecurity operations. At the time, Gates indicated that Maryland was a preferred location.

While Maryland is well positioned on the East Coast, San Diego is well positioned to serve the needs of the West Coast. We also have a cluster of IT related technologies but our real strength comes in the form of collaboration.

In helping the organize San Diego around cyber as part of the ESET's Securing Our eCity "Model City" project www.securingourecity.org, I have seen stakeholders from government, private and non-profit, education, military step up to support San Diego's need to organize around cyber.

Securing Our eCity "Model City" Stakeholders Meeting Attracts 100 Leaders from Around the US

We are excited to share an near overwhelming and positive response from private and public entities from San Diego, the State of California and Washington DC regarding our Securing Our eCity – Model City Project meeting being held this Wednesday, January 27th at the SDSU Alumni Center in San Diego.

We have over 100 high level stakeholder participants already confirmed. Representatives from the U.S. Department of Homeland Security; Secretary of Emergency Management Agency for the State of California, Mr. Matt Bettenhausen; State of California, Chief Security Information Officer, Mark Weatherford; Attorney General, Karen Hewitt, The Honorable Mayor of San Diego, Jerry Sanders and Industry leaders including representatives from AT&T, Sempra Energy, SAIC, Barney and Barney, Intuit and many more, will be present for our interactive discussion on San Diego becoming a model cyber secure city.

We see SOeC Model Cyber City Project as foundational to the national success of community based cyber security initiatives in 2010. During the first week of December 2009, the Securing Our eCity (SOeC) and National Cyber Security Alliance (NSCA) we held seventeen meetings and touched twenty-nine organizations in San Diego. Fundamentally, we have gained support from the five segments that comprise a city and will allow us, with their engagement, to build out a model cybersecure city template which can be rolled out across North America. The five groups include:

· Government
· Law enforcement
· Education
· Industry
· Community

All key stakeholders have agreed to meet in January and further build the foundation for the model cyber city. We have another twenty to twenty-five organizations that our current stakeholders recommended that we reach out to and potentially invite to join our stakeholder meeting.

We are very excited that you and fellow leaders from the federal, state and local agencies, industry, non-profit associations, law enforcement and our greater San Diego community are able to join us at the Securing Our eCity – Model City Project meeting on 27 January 2010.

We look forward to the participation of all these public and private groups this week in an interactive discussion about how to make San Diego a "model" for cyber security awareness, preparedness and education throughout the nation.

Meeting details:
Securing Our eCity – Model City Project
SDSU Alumni Center
55th Street and Hardy, San Diego, CA
Grand Ballroom

Noon – 5PM
Reception following immediately until 6:30PM

Third Time is a Charm - 3rd APWG/NCSA Online Messaging Convention Meeting

Recently I attended the 3rd APWG/NCSA Online Consumer Messaging Convention meeting in Seattle, WA. This meeting with graciously sponsored by Microsoft. The focus on this working group has been to meet the important challenge laid out by the Obama Administration, http://preview.tinyurl.com/n9jobu

The Online Consumer Messaging Convention was formed as a public/private partnership to craft and propagate essential online safety messages for the general public. Like the "Smokey the Bear" and "Friends Don't Let Friends Drive Drunk" campaigns, a new cyber security ad campaign will seek to create broad awareness and education among the US population about the importance of cyber security best practices.

The Coalition continues to expand to include new members keen on creating a unified cyber security message. The Coalition includes private companies such as Microsoft, Google, Facebook, MySpace, Intuit, SAIC, Paypal, Verisign, Symantec, McAfee, ESET, RSA, Costco, Wal-mart, and association and government members such as National Cyber Security Alliance, Anti Phishing Working Group (the primary organizers of this effort), American Banking Association, US Chamber of Commerce, FTC, IRS, Department of Homeland Security and The White House.

At this meeting, we focused on selecting a quality organization to help lead the development of the actual unified message for cyber. Several RFPs were collected by companies interested in creating the message on behalf of the organization. Proposals were presented and verbally supported by the 3 finalists groups.

While the first 2 working meetings have focused on group organization, establishment of a clear and concise agenda and education of Coalition members about the issues involved, this meeting is getting to the key work the Coalition set out to do.

This has included educational presentations about cyber security education by Carnegie Melon University http://preview.tinyurl.com/66lvtt and Palo Alto Research center http://www.parc.com/, legal advisement around legal entity and IP matters, and cause marketing by The Ad Council http://preview.tinyurl.com/dandg7

The next meeting will take place at the end of RSA in San Francisco on March 5th. This group continues to be a strong example of he power of public/private partnership in addressing the complex issues around making the US a cyber safe nation.

2nd APWG/NCSA Online Consumer Messaging Convention

Last week I attended the 2nd APWG/NCSA Online Consumer Messaging Convention meeting in Washington DC. Rising to an important challenge laid out by the Obama Administration, http://preview.tinyurl.com/n9jobu the Online Consumer Messaging Convention has formed a public/private partnership to craft and propagate essential online safety messages for the general public. Like the "Smokey the Bear" and "Friends Don't Let Friends Drive Drunk" campaigns, a new cyber security ad campaign will seek to create broad awareness and education among the US population about the importance of cyber security best practices.

The Coalition believes that this education is essential to secure and make safe our governmental, military, financial and banking, healthcare and other corporate IT infrastructures and use of the Internet.The Coalition includes private companies such as Microsoft, Google, Facebook, MySpace, Intuit, SAIC, Paypal, Verisign, Symantec, McAfee, ESET, RSA, Costco, Wal-mart, and association and government members such as National Cyber Security Alliance, Anti Phishing Working Group (the primary organizers of this effort), American Banking Association, US Chamber of Commerce, FTC, IRS, Department of Homeland Security and The White House.

The context of this Coalition is wholly agnostic and nonpartisan. The group is working actively to add members to raise our profile in a "big tent" approach that will ensure the Coalition's success and therefore the benefits the general public.

The first 2 working meetings have focused on group organization, establishment of a clear and concise agenda and education of Coalition members about the issues involved. This has included educational presentations about cyber security education by Carnegie Melon University http://preview.tinyurl.com/66lvtt and Palo Alto Research center http://www.parc.com/, legal advisement around legal entity and IP matters, and cause marketing by The Ad Council http://preview.tinyurl.com/dandg7

The next meeting will take place at Microsoft's offices in Seattle in early to mid November of this year.

ESET Secures | San Francisco Rats, Bugs

ESET Secures | San Francisco Rats, Bugs & Maggots | ESET Ads in SF

Posted using ShareThis

Unified Messaging Meeting Held in Los Angeles

I had the opportunity to be part of a very interesting meeting recently in Los Angeles. Held at the offices, of Myspace (part of the News Corp's Fox Interactive Media Group), a group of 25+ companies gathered to discuss the need for unified messaging for cyber security education.

The companies in attendance included Myspace, Facebook, Microsoft, Google, RSA, Costco, Wal-Mart, Intuit, Symantec, McAfee, Trend Micro, AVG and my company ESET. Background and educational lectures where provided by experts from Carnegie Mellon and Palo Alto Research Center.

The mission of this group was to develop an action to develop unified messaging as part of a a national umbrella awareness campaign similar to the 1970s "Give a hoot, don't pollute" http://preview.tinyurl.com/dlt9ku anti-pollution campaign and the Smokey the Bear "Only you!" http://www.smokeybear.com/ a campaign which is now 65 years old.

On May 29th, 2009, President Obama's in his "Remarks by the President on Securing our Nation's Infrastructure" http://preview.tinyurl.com/n9jobu called for a public/private partnership to develop a national campaign. I think our group is working to rise to the occassion.

The next step's for our working group is meet in August in Washington D.C. to meet with government leaders from the Department of Homeland Security and a number of other stakeholders such as the US Chamber of Commerce to enroll their support for the initiative.

12th Annual 2009 NYS Cyber Security Conference

I particpated in excellent panel discussion on June 3-4 in Albany, New York at 12th Annual Cyber Security Conference. The event brought together top experts in cyber security (see presenter bios) http://www.cscic.state.ny.us/security/conferences/security/2009/call.cfm

The 2009 Conference was co-sponsored by the NYS Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) and the University at Albany's School of Business and College of Computing and Information. CSCIC's has been leading and coordinating New York State's cyber security efforts and the University's academic excellence in information assurance combine made it a must-attend event.

The event has become New York State's premier cyber security conference, and attendance has increased five-fold since it began.

I participated with Securing The Perimeter: A Public-Private Sector Discussion on Cyber Security with a number of other panelists including:

Perry Blanchard , Albany CountyThomas Duffy , Deputy Director, NYS Office of Cyber Security and Critical Infrastructure CoordinationMatthew Eggers , Manager, National Security and Emergency Preparedness Department, U.S. Chamber of CommerceCarlos Kizzee, Director, Strategic Initiatives, Critical Infrastructure Cyber Protection and Awareness, National Cyber Security Division, U.S. Department of Homeland SecurityAlan MacQuoid , Associate, Booz Allen Hamilton

The panel discussion focused on the fact that business leaders must not overlook the importance of cyber security as a national concern and policy issue. Last year, federal prosecutors cracked one of the largest cyber crime operations ever committed. They charged nearly a dozen people from five different countries with identity theft and credit card fraud. Also, U.S. members of Congress reported that hackers gained access to Congressional office computers over a period of several months. Both incidents, and several others more recently, indicate a need for greater urgency to protect U.S. communications and information systems.

The U.S. Chamber of Commerce and the U.S. Department of Homeland Security have been visiting several cities in recent months to increase businesses' awareness of, and investments in, cyber security from an enterprise risk management perspective. The Chamber-DHS partnership allows leading experts from federal, state and local government, and industry to bring cyber security practices to the wider business community.

Through its network of state and regional partners, Chamber is coordinating grassroots outreach to business owners and operators and incorporating participation from government stakeholders. In short, the partnership aims to increase greater awareness of the potential consequences from a cyber attack, and to underscore the importance of integrating cyber security into enterprise risk management, emergency management, and business continuity planning, preparedness, and training initiatives.

Obama Grappling with the Politics of Cyber Security

Defense Secretary Robert Gates sent a memo to the Pentagon last week creating a new military command dedicated to cyber security. Gates' memo mandates that the National Security Agency (NSA) is to lead this effort, at least as it pertains to matters of national defense.

Gates' approach signals the Obama Administration’s plans to centralize and elevate cyber security as a major national-security issue. Obama was quick to point out later in the week that Gates' memo intended to set policy for military related issues only, including the use of both defensive and offensive weapons to counteract cyber threats.

This approach still leaves the matter of what the government's role in protection and hardening the public Internet will be, though it's widely known that the NSA will not be able to successfully accomplish its mission without some regulation or control of the public Internet.

Mr. Gates said that he intends "to recommend that Lt. Gen. Keith Alexander, director of the National Security Agency, take on the additional role as commander of the Cyber Command with the rank of a four-star general."

There was no comment from the Melissa Hathaway camp. Hathaway is currently the acting senior director of cyber-security for the National Security and Homeland Security Councils.

In late April Hathaway spoke about a public-private collaboration and threats to national information security at the annual 2009 RSA Conference in San Francisco. Her plans at the time were less than concrete and some speculate that there was some displeasure inside the Obama Administration about Hathaway 60-day review of the plans, programs, and activities throughout the government that address the US' communications and information infrastructure (i.e., cyberspace).

A white house blog on March 2nd stated that "the purpose of the review is to develop a strategic framework to ensure that our initiatives in this area are appropriately integrated, resourced and coordinated both within the Executive Branch and with Congress and the private sector."

The Obama Administration appears to be a bit perplexed about how to manage privacy advocates who are leery of NSA leadership in cyber security vs. the Dept. of Homeland Security which has never fully built competency to handle the many complex technical and infrastructure related issues.

Reuters Story about ESET's "Securing Our eCity" Initative

ESET is sponsoring an important new educational campaign called Securing Our eCity. Launched initially in San Diego, this progam seeks to provide cyber security training to businesses across the nation.

You can find the full story at http://www.reuters.com/article/pressRelease/idUS203859+20-May-2009+BW20090520

An excerpt follows:

The Securing Our eCity initiative was developed as a way to educate and protectconsumers and businesses from the growing threat of cybercrime. The regionalevents will include discussions about online risk factors, including today`sfive biggest online threats, the various ways computer users can fall victim tocybercrime and real-life San Diego cybercrime case studies. Attendees will alsoreceive tips on how to stay safe online and will learn about technologies andtools that help reduce and/or prevent cybercrime.

When/Where:

* Wednesday, May 27, 2009, 12:15 - 1:15 p.m. PTSan Diego State University, Arts & Letters (AL) 101, 5500 Campanile Dr., SanDiego, Calif. 92182*

Thursday, May 28, 2009, 7:30 - 8:30 a.m. PTSan Diego State University, Geology, Math & Computer Science (GMCS) 313, 5500Campanile Dr., San Diego, Calif. 92182

* Thursday, May 28, 2009, 12:15 - 1:15 p.m. PTSan Diego State University, Geology, Math & Computer Science (GMCS) 313, 5500Campanile Dr., San Diego, Calif. 92182

* Friday, May 29, 2009, 5 - 6 p.m. PTSan Diego Chamber of Commerce, Golden Boardroom, 402 West Broadway, San Diego,Calif. 92101

* Monday, June 1, 2009, 8 - 9 a.m. PTUniversity of California, San Diego Extension Sorrento Mesa Center, Room 116,6925 Lusk Blvd., San Diego, Calif. 92121

* Tuesday, June 2, 2009, 8 - 9 a.m. PTUniversity of California, San Diego Extension Mission Valley Center, Ste. 102,404 Camino Del Rio South, San Diego, Calif. 92108

* Wednesday, June 3, 2009, 12 - 1 p.m. PTSan Diego Chamber of Commerce, Golden Boardroom, 402 West Broadway, San Diego,Calif. 92101

* Thursday, June 4, 2009 6 - 7 p.m. PTBonita Library, 4375 Bonita Rd., Bonita, Calif. 91902To register for the event, please visit www.securingourecity.org/news.php, and,to find out how you can become involved in the initiative, please visitwww.securingourecity.org.