Opinion
DHS and Cybersecurity: Yes, No, Maybe So?
[FUD Watch with CSO Senior Editor Bill Brenner] A lot of smart people think the Department of Homeland Security is too inept to handle our online defenses. But moving cybersecurity elsewhere won't necessarily solve the larger problem
By Bill Brenner, Senior Editor
My security source, via Twitter, pointed out that despite DHS' shortcomings, the agency's cybersecurity people are doing some "super cool" stuff. She wasn't at liberty to explain what those cool things are.
Here's a current colleague on Facebook arguing for cybersecurity's move from DHS to someone else's turf: "DHS has not really knocked it out of the park when it comes to cybersecurity. The problem, IMHO, is that the political appointments at DHS go far too low in the organization, and cybersecurity was spread too thin. I like CSIS' guidance that it be moved to the Executive Branch and attached to the NSC. Frankly, after six years, it's just time to try something new."
I suggest something in the middle: Let DHS continue to handle cybersecurity but also create a stronger oversight entity from within the Executive Branch, similar to the creation of a director of national intelligence separate from CIA. True, the latter entity's record isn't great so far, but it's another example of changing the leadership rather than the responsibilities.
One could also argue that having two such layers in the government would be a lot like practicing defense-in-depth. Not a sure thing, but possible.
That's how I see it. It's time for the readers to weigh in.
About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD - overhyped security threats that ultimately have little impact on a CSO's daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry's most egregious FUD, send an e-mail to bbrenner@cxo.com.Other stories by Bill Brenner
DHS
Security Directions: A Virtual Conference
Available On Demand Sept. 30 - Dec. 30
Join us for a virtual event with candid, expert information on top security challenges and issues - all from the comfort of your desktop.
Protecting PII: How to Work with IT to Manage Risk
Understand the critical nature of the test data privacy problem and get tips on how to work with IT to implement a test data privacy program.



