Forwarded from: William Knowles <wk@private> http://www.gcn.com/online/vol1_no1/40564-1.html By William Jackson GCN Staff 04/26/06 A small office of the Homeland Security Department has released a draft cybersecurity checklist intended to help enterprises focus on the real-world consequences of security breaches. The U.S. Cyber Consequences Unit was created by DHS to provide analysis of economic and strategic consequences of cyberattacks on critical infrastructure and to evaluate the cost-effectiveness of countermeasures. As part of this work, director and chief economist Scott Borg and research director John Baumgarner began on-site visits to evaluate systems in critical industry sectors. "We started seeing huge vulnerabilities," Borg said Wednesday at the GovSec conference in Washington, where the draft document was released. Most of the systems were compliant with current security checklists and best practices. "And portions of those systems were extraordinarily secure. But they were Maginot Lines," susceptible to being outflanked. The problem is that existing best practices are static lists based on outdated data. The new USCCU list shifts the focus from perimeter security to monitoring and maintaining internal systems. The problem with perimeter security is that there is always some way to circumvent it, Borg said. "We are way into diminishing returns on our investments in perimeter defense," he said. "To deal with it now, you have to think of the problem of cybersecurity not from a technical standpoint, but by focusing on what the systems do, what you could do with them and what... the consequences [would] be." The list is based on real-world experience and on economic analysis of breaches. Surprisingly, the researchers found that simply shutting a system down is not the biggest threat in most areas of critical infrastructure. "Shutting things down for two or three days is not that costly," Borg said. The larger threat is disruption of systems in ways that are not immediately evident. The checklist contains 478 questions grouped into six categories: hardware, software, networks, automation, humans and suppliers. "All of the things we are talking about are already under way," Borg said, but some of the items in the checklist have no cost-effective commercial solutions. Borg said he hopes industry will step up to the plate to create solutions, and that government will adapt its acquisition policies to create incentives for these developments. Borg said there is no schedule for final DHS approval of the draft. Additional information about the checklist is available from Borg at mailto: scott.borg (at) usccu.us. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ================================================================ C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Wed Apr 26 2006 - 23:04:37 PDT