Melissa Hathaway Interview
President Obama has tasked Melissa Hathaway with conducting a 60-day review of the nation’s cybersecurity policies.
Hathaway has been working as a cybercoordination executive for the Office of the Director of National Intelligence. She chaired a multiagency group called the National Cyber Study Group that was instrumental in developing the Comprehensive National Cyber Security Initiative, which was approved by former President George W. Bush early last year. Since then, she has been in charge of coordinating and monitoring the CNCI’s implementation.
Although, honestly, the best thing to read to get an idea of how she thinks is this interview from IEEE Security & Privacy:
In the technology field, concern to be first to market often does trump the need for security to be built in up front. Most of the nation’s infrastructure is owned, operated, and developed by the commercial sector. We depend on this sector to address the nation’s broader needs, so we’ll need a new information-sharing environment. Private-sector risk models aren’t congruent with the needs for national security. We need to think about a way to do business that meets both sets of needs. The proposed revisions to Federal Information Security Management Act [FISMA] legislation will raise awareness of vulnerabilities within broader-based commercial systems.
Increasingly, we see industry jointly addressing these vulnerabilities, such as with the Industry Consortium for Advancement of Security on the Internet to share common vulnerabilities and response mechanisms. In addition, there’s the Software Assurance Forum for Excellence in Code, an alliance of vendors who seek to improve software security. Industry is beginning to understand that [it has a] shared risk and shared responsibilities and sees the advantage of coordinating and collaborating up front during the development stage, so that we can start to address vulnerabilities from day one. We also need to look for niche partnerships to enhance product development and build trust into components. We need to understand when and how we introduce risk into the system and ask ourselves whether that risk is something we can live with.
The government is using its purchasing power to influence the market toward better security. We’re already seeing results with the Federal Desktop Core Configuration [FDCC] initiative, a mandated security configuration for federal computers set by the OMB. The Department of Commerce is working with several IT vendors on standardizing security settings for a wide variety of IT products and environments. Because a broad population of the government is using Windows XP and Vista, the FDCC imitative worked with Microsoft and others to determine security needs up front.
Subscribe to comments on this entry
Randall • February 24, 2009 2:42 PM
If I could her send one message, it’d be that insecure public systems are a much bigger threat than secure communication.
Intelligence should be more targeted and likely less SIGINT-focused than it is. (See anything written by James Bamford recently.) Shutting off one of the giant contracts to listen in on targeted Americans’ international phone calls would probably free up enough cash to do real work towards hardening Internet infrastructure — DNS security, anyone? — bulletproofing SCADA systems, and so forth. And plenty of funds could be left over for targeted intelligence work that would be more useful than this dragnet stuff.
Big changes like that might be above her pay grade. But there’s a real tradeoff between allowing lawful intercept on the one hand and securing critical parts of the Internet on the other — crypto isn’t all of security, but it’s a necessary piece. And we can’t have both perfect intercept and the strongest security possible; when Capstone tried to achieve that, it failed and slowed down the deployment of strong crypto.
Given the crypto vs. intercept tradeoff, it’s much more important to deploy the best tools we’ve got than to give NSA’s intercept people (or law enforcement) everything they want.