Did the National Strategy for Securing Cyberspace Wimp Out?

The new version of the National Strategy to Secure Cyberspace was released on Valentines Day, and it comes forth with a clear requirement. That the government lead by example.

Thats praiseworthy, for sure. But, unlike the longer draft strategy released for public comment last September, the final draft says not a word about regulating the private sector in matters of security, and is almost as silent on what companies should actually do next. Alan Paller, director of the SANS Institute, describes the report as a wonderful description of the problem. A Washington Post story the day after the strategy was released was entitled, Cyber Security Strategy Depends on Power of Suggestion. And Paller told the public radio show Marketplace, The problem is that the suggestions that are being made are too soft.

Indeed, a quick look at the executive summary of the report shows that, in the list of actions to be undertaken, verbs like foster, encourage, promote and understand far outnumber verbs like provide, secure, create or, god forbid, fund. (You wont find that last one in there at all, honestly.)

In general, security experts dis the report as having let industry and the private sector off the hook, though they give the government a nod for trying to get its own house in order. Leaving it to the vendors is basically the path weve been following&and the whole reason we have the problems that we have, Eugene H. Spafford, a security expert and Purdue professor told the Post.

On the other hand, industry reps unsurprisingly praise the hands-off report.

Because the report originated in the White House (though it was released by the Department of Homeland Security), the authors arent required to disclose how input received in the comment period influenced the revised draft. Its no secret though, that technology and telecom companies lobbied hard against any regulation.

Did the government give in too much? Did they wimp out on creating a cybersecurity strategy with teeth and end up mouthing platitudes? Does this strategy make you feel secure? Let us know.