CSO’s (Sarcastic) Cybersecurity Strategy Draft Suggestions

In September, President Bush’s cybersecurity adviser Richard Clarke and his second-in-command, Howard Schmidt, released a long-anticipated treatise on how to secure cyberspace—and then announced that despite all the hoopla, the 65-page strategy was actually only a draft. At Whitehouse.gov, the duo invited the public to offer feedback by Nov. 18, 2002 (e-mail feedback@cybersecurity.gov). In the spirit of giving them what they asked for, we humbly suggest 10 ways to improve the draft.

1. Sure, we’re a little biased, but the CSO and CISO receive only four mentions in 65 pages. Forget e-mail, if we had a nickel for each mention, we could almost call Richard Clarke personally.
2. More clever acronyms. A.C.T.I.O.N.S. stands for: Authentication, Configuration management, Training, Incident response, Organization network, Network management and Smart procurement. For future reference, A.Y.K.M. stands for Are You Kidding Me?
3. Even more of an escape clause for CFOs, beyond the disclaimer that all suggestions will vary in “cost effectiveness.”
4. A less printer-friendly version with even smaller type. There’s a chance that the current document is readable with an electron microscope.
5. Fewer bold mandates that will scare vendors, such as: “The software industry should consider promoting more secure out-of-the-box installation and implementation of their products.” A.Y.K.M.?
6. And do they have to be so pushy? Clarke and Schmidt should replace the 74 occurrences of the phrase “should consider” with something like, “should perhaps think about whether or not they might want to….”
7. Instead of crashing our computers, how about a one-page PDF referring readers to any list of best security practices released by Gartner, Giga or Meta Group in the past three years.
8. Clarke and Schmidt should consider completely removing the word regulate from the final version.
9. There must be one thing left in the document to offend someone. Find that thing and take it out.