Will Obama’s New Cyber-Security Plan Make a Difference? We Can Only Hope

This morning, US President Barack Obama unveiled the outlines of a change in direction for US cyber-security policy. The first announcement relates to the creation of a new military command that will centralize and expand on existing cyber-war-fighting capabilities. This is overdue, and should bring more coherence to efforts that were already spread out between several different military branches, notably the Army, Navy and Air Force), and the intelligence services. The NSA, for example, has long had a “red-team” offensive capability in addition to defensive corps. As I understand it, the new military cyber-command will reside in the Department of Defense. Less clear is whether the new organization will just be a military operation, or whether it will also take over parts of the intelligence services’ capabilities.

The second part of today's announcements, the Cyberspace Policy Review, seeks to reform the way the US Government secures itself, its agencies and critical infrastructure like the stock exchanges. As reported in a story in the New York Times, the reforms will create a new office residing in the White House that will report to both the National Economic Council and the National Security Council. The remainder of this blog post analyzes what the plan, which was unveiled at 11 today, recommends.

Where We Came From

But first, a little background. Most security-watchers know that the last big attempt to improve government security was FISMA, the Federal Information Security Management Act. The Act codified an approach to protecting government systems. It required all federal agencies to assess the risk of their information systems, implement minimum baseline security controls as defined by NIST, and most critically, certify and accredit that each agencies' systems had in fact implemented the required security controls. The tangible outcome of the process was a related “scorecard” exercise undertaken by the House Oversight and Government Reform Committee. The idea was to give letter grades (A through F) to each agency.

In theory, this sounds like a good idea. In practice, it did little to improve security. The evidence is everywhere. We've all read the reports in the news about perfidious Chinese hackers, opportunist Ruskies and the like snooping around federal systems and systematically looting them of all their treasures. The picture painted in the press is of a government whose variously-accredited and certified systems are nonetheless wide-open to hackers. While it's hard for most people to get a real sense of the scope of the problem from the papers, people I've spoken to who do government contract work for a living tell me that the stories we've seen are just the tip of the iceberg. And on a personal note, I can tell you that in my past I've helped investigate an incident involving an attack on a military weapons program by foreign attackers. So the dangers seem clear and present to me.

What’s Wrong with the Current Approach?

So, what's wrong with FISMA, and what does this review address? In my view, FISMA serves a useful function because it defines how the risk assessment, control selection and audit processes are supposed to work at a federal level. This is a good, but it is important to remember that FISMA is mostly about compliance with a security program and its processes, and not about the effectiveness of the security itself. Practically speaking, what FISMA and the annual House scorecarding ritual did was:

• Create incentives to “finish the audit” rather than make systems more secure
• Force answers to the wrong question: “are you accredited” rather than “how secure are you?”
• Conflate compliance with security
• Create a strange new vocabulary out of step with the private sector. (Ask Goldman Sachs or Bank of America about the importance of their “accredited systems” and they will look at you like you have two heads)
• Focus on inputs (controls) rather than outputs (KPIs and attacks)
• Divert vast amounts of cash to auditors and other “process”-focused Beltway Bandits

And beyond FISMA, the current approach did not:

• Effectively share attack and intrusion data with the private sector
• Coordinate the federal agencies with shared responsibilities for security: Homeland Security, Defense, Justice, Energy, Treasury and others
• Consolidate responsibilities for cyber-defense and responding to attacks

What the Review Recommends

The review recommends the following 10 actions, which I have reprinted and lightly edited:

1. Appoint a cybersecurity official responsible for coordinating the Nation’s policies and activities with dual reporting to the National Security Council and National Economic Council. The new policy chief would establish a new NSC directorate to coordinate interagency strategy and policy
2. Prepare an updated national strategy to secure the information and communications infrastructure
3. Designate cybersecurity as one of the President’s key management priorities and establish performance metrics
4. Designate a privacy and civil liberties official to the NSC cybersecurity directorate
5. Identify legal issues and recommend policies that would clarify roles, responsibilities, and the agency authorities needed to coordinate cybersecurity-related activities across the Federal government
6. Initiate a national public awareness and education campaign to promote cybersecurity
7. Develop U.S. Government positions for an international cybersecurity policy framework and strengthen international partnerships in this area
8. Prepare a cybersecurity incident response plan; enhance public-private partnerships to streamline, align, and provide resources to increase their contributions and engagement
9. Conduct R&D on game-changing technologies that have the potential to enhance the security, reliability, resilience, and trustworthiness of digital infrastructure
10. Build a cybersecurity-based identity management vision and strategy that addresses privacy and civil liberties interests, leveraging privacy-enhancing technologies for the Nation.

What the Review Gets Right

• Correctly identifies that there are too many barriers for inter-governmental collaboration, and with the private sector. Some of these barriers are organizational, and others are legal. For example, under what legal authority could the government acquire attack data from a privately held stock exchange? Another example: do liability (discovery) fears prevent the private sector from sharing data? Aligning the legal régime with simple common sense would be terrific.
• Focuses on intrusion detection and response (outcomes) rather than the checklists (inputs). I noticed, for example, that the words “accreditation” and “certification” appear nowhere in the document, while “intrusion” appears 14 times.
• Earmarks R&D dollars to find and develop new security technologies. This is too important to be left solely to the private sector.
• Calls out preservation of civil liberties as an explicit goal, with participation from the private sector and what the review calls the “privacy community,” which I can only imagine means organizations like the EFF, EPIC, and the Ponemon Institute. This is the sort of language that we would never have seen in, for example, a plan authored by the President's predecessor.

Where It Misses Opportunities

• Places too much faith in “consumer education” around topics like fraud and identity theft. Consumers know very well that the internet is a dangerous place, full of predators and identity thieves. The government should instead be asking, why is the information consumers have on their PCs so valuable? And what can the government do to move authentication beyond the broken password paradigm most users follow today?
• Too timid with respect to identity management. True, the report mentions expanding the HSPD-12 federal credentialing and authentication programs across the government, which is good. And it does recommend the US government “develop policies that encourage the development of a global, trusted eco-system that protects privacy rights and civil liberties.” That is great, but the report could have gone further and recommended the US do what many European countries have already done: make the government a “trust anchor” as the source for national digital identities.
• Misses an opportunity to mobilize action on existing critical infrastructure, notably SCADA (energy) and transportation, particularly the air-traffic control system. These areas are only hinted at in the review, and these few mentions lack a high degree of urgency.

Overall, there is more to like about the Cyberspace Policy Review than dislike. It correctly shifts the emphasis from process to outcomes, and makes pragmatic recommendations on how to remove barriers to getting things done. This is all good.

What it Means for the Private Sector

For Forrester customers in the commercial and private sectors, the Cyberspace Policy Review will not mean much in the very short term. The document merely recommends changes to the direction of future US policies. We are a long way off from seeing legislation that would obligate enterprises to do anything differently than they are doing today. However, over the medium term the recommendations will inform policy decisions lawmakers must make. As a result, I expect the private sector can expect:

• Increased focus on sharing security incident data with sector ISACs and with the government — on a voluntary basis, at first
• Increased government involvement in setting direction for identity management — probably stopping just short of a national digital identity initiative
• Gradual removal of anti-trust and discovery/liability disincentives to share security information
• Much stronger focus on incident response and penetration testing, both at the federal level and as a recommended industry “best practice”

Overall, the document signals quite clearly that our previous approaches were not working. One might say that Hope — something President Obama campaigned on — will not be sufficient when to comes to cyber-security. Ironic, no?

I'd recommend you read the Cyberspace Policy Review yourself to draw your own conclusions. It is about 75 pages, and not a difficult read. As always, I value your comments and e-mails.

Data Toxicology

As most Forrester customers know, data security has rocketed to the top of the list of CISO priorities for 2009, even considering the down economy. Our Business Data Services group has published some excellent quantitative research on this subject, which we've summarized in report form for Forrester customers. I refer you to Jonathan Penn's excellent The State of Enterprise Security 2008 to 2009 for more details. But for those of you who want the sound bite, 90% of CISOs said that data security was either "important" or "very important" on their proirity lists for this year. That trumped disaster recovery, identity and access management and regulatory compliance.

The elevation in importance of data security has, in turn, spurred interest in several security product categories, notable data leak prevention (DLP). According to the survey data I just cited, about 38% of enterprise customers have DLP implemented already. Another 21% are planning to implement it this year. That's an amazing expected uptick in adoption considering the overall state of the security market (flat or slightly up). And of course, if you are a DLP vendor, this is very good news indeed.

Digging deeper, though, what's been most interesting in the dozens of customer calls I've had since January 1 has been the amazing consistency of much of the interest. We are clearly getting past the Early Adopter stage of adoption, and are now well into Early Majority. I'd say about 2/3 of the enterprise customer inquiries I've fielded have been around product selection: Who are the leading vendors? Is the incumbent vendor who provides my anti-virus software a good choice for DLP also? What are the most important qualities in selecting a DLP product?

As an analyst, these are the kinds of questions I expect to hear at this stage of adoption. But what's most striking are the questions I have not heard. Here's what nobody seems to be asking about:

• What can I do to persuade my boss?
• How do I justify the investment?

You might be asking yourself, Why is this? How come the usual justification questions aren't coming up for this particular purchase decision?  Based on my conversations with clients, the answer to this is clear: may enterprises are living in mortal fear of suffering from a toxic data spill. Put simply, certain types of customer information have become highly toxic. The most commonly cited toxic data are:

• Customer names and addresses, when combined with one or more of the following: 
• Government identifiers (taxpayer ID, SSN) 
• Health care identifiers
• Bank account details 
• Cardholder data (number, expiration date)  

Just like asbestos, these data types have become toxic when airborne. Why? Because they have monetary value. Robust black markets have arisen to acquire, buy, sell and barter customer information at "market prices," particularly credit cards. We don't track this kind of thing, but I'd refer you to some of the research done by Symantec and others if you want to know what "street prices" these data types are fetching.

Of course, if the toxic data problem related solely to black-market selling, that alone would not explain the interest in DLP. And here's where the second driver kicks in: the mushrooming number of state and federal statutes and regulations around data breach disclosure. PCI is a key driver too: although it isn't a statute per se, it is a contractual agreement that many enterprises are subject to.

These two issues -- increased toxicity of customer data, and mandates designed to protect that toxic data -- are the primary reason DLP is taking off. About 80% of the time, enterprises evaluating DLP are doing it because of toxic data problem. They are not doing it primarily because of the fear of leaking more ethereal forms of intellectual property, like product plans or sales forecasts. Yes, we do hear that IP protection is driving some interest. It's just not the primary driver -- at least not amongst the mainstream adopters who are now kicking the tires and exploring their options.

In future posts and in my written research, I'll examine the follow-on phases of DLP adoption: that is, what do you do once you have it? How do you use DLP successfully within organizations? Based on the conversations I've been having with customers, we are already seeing some very sharp and distinct trends with successful adopters. Stay tuned!

Lost Laptops Get the Press; Server Breaches Cause More Stress

In the next few weeks, Forrester Research will release my report, Forrester TechRadar: Database and Server Data Security, Q1 2009. In this report, we describe how the risks of theft, corruption and abuse has made securing data stored on servers and in databases much harder. To help security and risk professionals plan their next decade of investments in server data security, the report describes current and future state of 8 important technologies: centralized key management, data classifiers for security, data discovery scanners, data obscurity tools, database activity monitoring, database encryption, outbound web application filtering, and tape and backup encryption.

As part of the process of researching some of the business drivers for this report, I analyzed data from DataLossDB, a public database containing information on data loss events reported in the press and to governmental organizations as required by various disclosure laws. The data makes for fascinating study, and I urge our readers to take a look at it if they want to see what's been going on in the whole area of data breaches. Best of all, I know some of the principals involved in the project, and they are doing a terrific job.

Some of the analysis nuggets we mined from the database are fascinating. I thought I'd share one here, as excerpted from the report:

• "Bulk customer data remains the coin of the realm for thieves. Personally identifiable information that enterprises keep about customers is often used to manufacture identities and open credit lines. According to the Open Security Foundation’s DataLoss DB, 67% of 553 reported data theft incidents in 2008 targeted Name and Address or Social Security Numbers.... Data loss type 'Stolen laptop' was the most common, at 20% of incidents (112 incidents).
• "Databases remain target-rich environments. A significant proportion of sensitive information resides on web-based applications connected to databases. While lost and stolen laptops remain the most common source of lost data, according to DataLoss DB, hacks were the second-most common kind in 2008 (16%, or 88 incidents). Non-exhaustive analysis of these incidents shows that the vast majority were hacks against web applications, typically using SQL injection or other common techniques. Hacking incidents, generally against SQL servers, were extremely effective, with an average of 200,000 records disclosed per incident.
• "By contrast, lost, stolen and missing laptops and computers resulted in one-eighth as few lost records. Of 154 incidents of type LostComputer, LostLaptop, MissingLaptop, StolenComputer, StolenComputer/StolenDrive, StolenLaptop, StolenLaptop/StolenDocument, StolenLaptop/StolenMedia, and StolenLaption/StolenTape, the total records affected was 4 million. Average records per incident was 26,270, with a standard deviation of 89,665."

So the punchline is this: if you believe the numbers (and my analysis), servers tend to be 8-10x more radioactive than endpoint computers. I will likely be recommending a few methodological changes to the DataLoss DB schema to capture a few more pieces of information and make analyses such as mine more credible.

In the meantime, I'd love to hear from blog readers on the subject of data breaches. What kinds of data are "toxic" for your organization? How are you protecting them? We'd like to hear from you.