Feds take 'cyber Pearl Harbor' seriously

Federal agencies are bracing for a cyberattack of historic proportions — what some observers call a cyber Pearl Harbor. Although the government said it does not know of any threats of such an attack, officials say a recent denial-of-service attack by Russian nationalists against Estonia’s government is a wake-up call.“If Estonia is vulnerable, are we?” asked Michael Castagna, the Commerce Department’s chief information security officer. “Estonia was able to weather the huge attack, but could the United States or the world afford to be cut off from the Web? This is a good example of why we need a culture of security.” Bush administration officials have been preparing in a variety of ways to harden the government’s cyberdefenses against a massive cyberattack, which could disable large portions of the Internet on which government operations depend. One recent step was an Office of Management and Budget memo requiring agencies to use standard Microsoft Windows desktop and laptop PC configurations. That policy will make it easier for federal agencies to automatically apply software security patches. Other recent administration actions include issuing a memo that asks agencies to protect personal information on government computers by requiring two-factor authentication for access to those computers. With those and other measures, the federal government will improve IT security, experts say.White House officials also are working on a Homeland Security Presidential Directive that would provide guidelines for agencies to respond to a cyberattack. Sources confirmed that administration officials, the National Security Council and others have discussed the new directive. “Just what is the order of battle and rules of engagement?” asked a former federal official with knowledge of the directive. “Do we get congressional resolution or public debate? Will launching a counter-counterattack mean I’m violating the Computer Fraud and Abuse Act? The most defenseless common Joe will take the brunt of any counterattack.”White House spokesman Scott Stanzel said in an e-mail message that the administration has made no announcements about a new directive.  In an unusual action, the CIO Council met May 16 at a secure location in Washington to discuss cybersecurity and nation-state attacks, two federal information technology leaders said. One of them, Ed Meagher, the Interior Department’s deputy chief information officer, would not offer any details because the information was classified, but he said the meeting was about IT security.Classified briefings for CIOs are extremely rare, said Glenn Schlarman, former chief of OMB’s Information Policy and Technology Branch, referring to the classified meeting of the CIO Council. An OMB spokeswoman said “the briefing was intended to ensure all CIOs are aware of the current state of play in the cyberworld and that they are working to take proper steps to secure their government assets accordingly.”Government sources said the meeting was not called in response to the Estonia attack, but they said it was addressed at the meeting.The Estonia attack highlights how cyberattacks are becoming another factor in international politics, Meagher said. “The FBI believes that the next terrorist attack will coincide with a cyberattack,” he said.