Senate Bill Would Give Feds Bigger Cybersecurity Role

Two U.S. senators are proposing legislation that would give federal officials significant new authority to create and enforce data security standards both for government agencies and key parts of the private sector.

The Cybersecurity Act of 2009, which was introduced by Sens. Olympia Snowe (R-Maine) and Jay Rockefeller (D-W.Va.), would empower the National Institute of Standards and Technology (NIST) to establish “measurable and auditable” security standards for all networks and systems run by federal agencies, government contractors and businesses that support critical infrastructure services. In addition, NIST would be charged with developing a standard for testing and accrediting software built by or for those groups.

The bill also calls for the creation of a national cybersecurity adviser’s office within the executive office of the president. Under the proposal, the new operation would be modeled after the Office of the U.S. Trade Representative and would have the power to compel federal agencies to comply with government security mandates.

According to a statement posted on Snowe’s Web site Wednesday, the new legislation is aimed at reinforcing ongoing cybersecurity efforts within the government while also ensuring that proper safeguards are implemented for critical infrastructure targets within the private sector, such as banking and power systems.

Cyberattacks against those systems “could literally shut down our way of life,” the statement warned. It went on to describe the cybersecurity threats facing both the government and key private-sector systems as one of the country’s most urgent national security problems. “It is abundantly clear we must unite on all fronts to confront this monumental challenge,” Snowe said. “If we fail to take swift action, we, regrettably, risk a cyber-Katrina.”

“We must protect our critical infrastructure at all costs,” Rockefeller added. “From our water to our electricity, to banking, traffic lights and electronic health records, the list goes on.”

Snowe noted that the bill “loosely parallels” a set of cybersecurity recommendations contained in a report released late last year by a commission set up by the Washington-based Center for Strategic and International Studies.

The proposed legislation comes in the midst of a 60-day review of federal cybersecurity programs that was ordered by President Barack Obama and is being led by Melissa Hathaway, who worked during the Bush administration as a “cyber-coordination executive” in the Office of the Director of National Intelligence.

In addition, there have been increasing calls for for a comprehensive national strategy on cybersecurity as well as stronger government leadership to ensure that security initiatives are implemented effectively.

Hathaway’s much-anticipated report is expected to touch upon the need for more effective public-private partnerships in the area of information security, as well as regulations and incentives that are most likely to engender cooperation between the government and the private sector. It remains unclear, though, whether the report will call for the creation of cybersecurity office within the White House or recommend a more decentralized organizational model.

The bill introduced by Snowe and Rockefeller would require federal agencies, contractors and private-sector owners of critical infrastructure networks to prove that they’re in compliance with NIST’s new security standards. Meanwhile, NIST’s director would be responsible for ensuring that software vendors and distributors comply with the envisioned rules on software security.

Other provisions in the bill include the following:

The creation of new state and regional cybersecurity centers to assist small and midsize companies on information security matters. The designation of a federal agency to serve as a clearinghouse for security threat and vulnerability data across both the public and private sectors. The development by the Department of Commerce of a cybersecurity licensing and certification program. If the bill is passed as written, security professionals looking to work for the federal government or for companies in critical infrastructure industries would have three years to get licensed. A separate requirement calling for the Commerce Department to set up a cybersecurity dashboard that can provide real-time information on security threats and vulnerabilities all federal systems. The establishment of a Secure Products and Services Acquisitions Board that would be responsible for certifying that IT products purchased by the government meet prescribed security standards.Not everyone is convinced that new regulations aimed at the private sector would help improve data security, though.

“Security is an attitude, and it’s hard to legislate attitude,” said Brian Chess, founder and chief scientist at Fortify Software Inc., a security vendor in San Mateo, Calif. “It has more to do with understanding the impact of insecure software on the organization.”

Grant Gross of the IDG News Service contributed to this story.