Lieberman's cybersecurity bill leans on buying power

051810liebermanNGins (May. 18) - Under Sen. Lieberman's proposal, acquisition officers would be better informed about security features and flaws. Harry Hamburg/AP

Sen. Joe Lieberman, I-Conn., plans to unveil a bill soon that aims to beef up cybersecurity inside and outside government by using agencies' mammoth collective purchasing power to demand safeguards in information technology products, a Senate Democratic aide said on Monday.

The House and Senate are working on a bill that would update the 2002 Federal Information Security Information Management Act, a law widely criticized for requiring agencies to fill out reports showing they have complied with security policies rather than asking them to take specific actions to secure networks.

The House Oversight and Government Reform Committee is expected to vote on a FISMA reform bill possibly this week. Lieberman, who chairs the Homeland Security and Governmental Affairs Committee, is expected to fold a companion Senate bill sponsored by committee member Sen. Thomas Carper, D-Del., into a comprehensive cybersecurity package.

Lieberman's proposal would reform government procurement by "creating a system that requires acquisition officers in the federal government to have the knowledge that they need about the vulnerabilities in products," but would stop short of blacklisting certain technologies, said Deborah Parkinson, a Democratic staffer on the Senate committee. She explained officials would be better informed about product security features and security deficiencies, which would have a ripple effect on shaping the security posture of the IT market.

Some IT industry players have raised concerns about a procurement provision in the House bill that would require the government to develop a list of technologies, in order of priority, that agencies should use to automate security functions. Vendors say the list would prematurely pick winners and losers in a market that is constantly changing and the provision could unintentionally hamper innovation.

Parkinson was speaking at a discussion hosted by the Woodrow Wilson International Center for Scholars on threats to national security posted by the Internet. The talk focused on the search for strategies to deflect such threats inside and outside government while also protecting the free flow of information across national boarders.

Other priorities in Lieberman's Senate bill include elevating cybersecurity within the Homeland Security Department and creating a permanent White House cybersecurity officer to replace the current cyber czar position President Obama established using his regulatory authorities. Obama or any future president can eliminate the position unless Congress codifies it. In addition, the Lieberman bill would include provisions aimed at recruiting and retaining federal employees with information security expertise.

The committee's ranking Republican Sen. Susan Collins, R-Maine, opposes the idea of a White House cyber czar. She has argued the position should be in DHS, pointing out the department already has experience conducting the aggressive system monitoring and testing that such a job demands.

During Monday's panel, Parkinson explained Lieberman's rationale for placing the cybersecurity director in the White House. "When you are talking about cybersecurity, you are not just talking about homeland security," she said. But Lieberman's proposal simultaneously would strengthen DHS' role in coordinating federal cybersecurity, Parkinson added.

Perhaps one of the greatest cyberthreats confronting the nation is an attack by a foreign entity at war with the United States, not an assault by criminals, said Forrest Hare, a Defense Department staffer within the Office of Undersecretary of Defense for Intelligence, who said he was not speaking on behalf of the department.

"An able nation state could potentially take down power to some part of the country. We clearly expect the nation's critical infrastructure to be at risk [during war]," he said. But "one-off criminal masterminds doing that -- why would they do that?"

Marcus Sachs, a former National Security Council staff director, said most important, the government needs a policy that defines cyberspace. "Is it a military place where we fight future battles? Is it a space for economic prosperity?" he said during the discussion. Formulating such a policy would give the United States a chance to fix weaknesses in the existing network infrastructure, said Sachs, who now serves as executive director for national security and cyber policy at Verizon.

For example, the government and the private sector currently are building the so-called smart grid, a power distribution network that will deliver electricity and usage data to improve reliability, security and efficiency.

"The smart grid in its final form will look very much like the Internet," Sachs said. "One option is to make it part of the Internet. Another option is to create a completely separate network. What you learn from the smart grid you may be able to take back and apply to the Internet."