Security expert: U.S. would lose cyber war
Tuesday, February 23, 2010 20:16The U.S. government, if confronted in a cyber war today, would not come out on top, a former U.S. director of national intelligence said Tuesday. “If the nation went to war today, in a cyber war, we would lose,” Mike McConnell told a U.S. Senate committee. “We’re the most vulnerable. We’re the most connected. We have the most to lose.”
McConnell, director of national intelligence from 2007 to 2009, predicted that the U.S. government would eventually get heavily involved in protecting cyber security and in regulating private approaches to cyber security. Testifying before the Senate Commerce, Science, and Transportation Committee, McConnell also predicted that the U.S. would make little improvements in its cyber security before a “catastrophic” attack will cause the government to get involved.
[ InfoWorld's Roger Grimes explains how to stop data leaks in an enlightening 30-minute Webcast, Data Loss Prevention, which covers the tools and techniques used by experienced security pros. ]
“We will not mitigate this risk,” said McConnell, now executive vice president for the national security business at Booz Allen Hamilton. “We will talk about it, we will wave our hands, we’ll have a bill, but we will not mitigate this risk.”
After a major attack, the government will step in to secure the Internet, McConnell predicted. “We’re going to morph the Internet from something that’s referred to generally as dot-com to something that we call dot-secure,” he said. “When [online] transactions move billions of dollars, or when transactions route trains up and down the East Coast or control electric power … the basic attributes of security must be endorsed.”
Government intervention is needed, added James Lewis, director of the Technology and Public Policy Program at the Center for Strategic and International Studies, a Washington, D.C., think tank. Private-sector fixes to the nation’s cyber security problems haven’t been effective, he said.
The Internet was designed as a global commons that polices itself, but that model has failed, Lewis added. “Instead, we’ve got the Wild West,” he said. “Many will say we should let the market fix cyber security. I’m familiar with this one, because I, myself, wrote it in 1996, and I’m still waiting. Government needs to give the market a kick.”
Early last year, Senators Jay Rockefeller (D-W.Va.) and Olympia Snowe (R-Me.) introduced a bill that would create new cyber security regulations for private companies designated as critical infrastructure. The senators have rewritten the Cyber Security Act several times after complaints from the private sector, but the bill would also require a national licensing and certification program for cyber security professionals. Under the bill, it would be illegal to provide some cyber security services without being licensed and certified.
Some versions of the bill would have also allowed the U.S. president to order that parts of the Internet under attack be shut down. Lewis praised the bill, saying it provides a “broad rethinking” of the nation’s approach to cyber security.
