October is Cyber Awareness Month, which means that cyber news is in abundance. However, the cyber issue that continues to gain the most attention is the evolving debate over the nature of the relationship between the federal government and private industry when it comes to cybersecurity. Should the government be more involved in how private companies handle cybersecurity? Or should they back away, and allow private companies to make their own decisions when it comes to cybersecurity? This is the question lurking behind the scenes of many cyber reports hitting the newsstands today.
Take the recent story on the possibility of biometrics replacing passwords as a primary security measure. The story hit the news after White House cybersecurity coordinator, Michael Daniel, made the statement that biometric scanning devices will become the norm for identity confirmation online. The story was covered by the WashingtonTimes, USAToday, SC Magazine, and Yahoo News. So what do these recent reports have to do with the current tensions between government and private industry? The answer lies behind Mr. Daniel’s reasons for making the announcement in the first place. SC Magazine reported Mr. Daniel stating that passwords are a “terrible” security mechanism, and that organizations should improve on their use of encryption. This is a perfect example of what appears the be the current administration’s trend for handling the cybersecurity tension with private companies: leave the private industry alone, but make suggestions. Is this the best way to balance the interests of these two sectors of society? Or should the government be more involved in regulating the industry’s cybersecurity measures?
According to a Bloomberg report, some feel that the number one thing the government can do is get out of the way. The report quotes Ajay Banga, the Chief Executive Officer of MasterCard, who is pushing for the government to eliminate legal barriers to sharing information and move away from a posture that blames companies for cyber attacks. On the other hand, according to a WashingtonTimes report, there are concerns inside the White House that almost all private companies when left to their own devices have a habit of not paying enough attention to cybersecurity threats. Nevertheless, the report also notes that as of yet, the Obama administration has been reluctant to push legislation that would require private companies to take any specific cybersecurity measures. In fact, according to a USAToday report, the Obama administration has given up trying to pass one big cybersecurity bill, and is opting to break up the legislation into bite-size chunks that lawmakers are more likely to approve.
There are also pragmatic reasons for looking outside legislation for potential solutions. The WashingtonTimes report goes on to quote Mr. Daniel: “the speed of regulation does not move at the speed of technology” and thus the government has to be “mindful” that any regulations will probably be outdated by the time they are issued. In the meantime, the administration has launched a “Cybersecurity Framework,” which the report describes as the “result of a yearlong private-sector led effort to develop a voluntary how-to guide for organizations in the critical infrastructure community to enhance their cybersecurity.” This “Framework” fits the trend of “suggesting” rather than “requiring” cybersecurity measures to the private industry.
The United States is not alone when it comes to dealing with the cybersecurity tensions between the government and private industry. SC Magazine recently reported on the “mutual suspicion” between police and the private sector in the UK when it comes to issues of cybersecurity. For the full report, click here.
President Barack Obama believes cyber terrorism is one of the biggest threats to national security and says the White House is bracing for a possible doomsday scenario if hackers can successfully penetrate government and business computer systems, the FOX Business Network reported. Will the current balance of control between the government and private industry over cybersecurity provide Americans will adequate protection from a cyber attack? Only time will tell.
Leave a Reply