Clarity and Execution: The Next Steps in Cyber-Security

Q: Given your extensive experience dealing with national cyber-security issues, what is your assessment of the current state of cyber-security?

A: A couple of thoughts come to mind. First, I would say the cyber-attacks we are seeing are increasingly sophisticated. They are multipronged. They morph. They spread more quickly. And they are causing significant damage in terms of downtime and having to rebuild systems, and in terms of the loss of intellectual property and identity-related information -- in other words, identity theft. So the gravity or severity of what's going on is increasing.

My second point would be that while there is an increasing awareness that we have cyber-security problems, there is little understanding of what to do about it.

Q: Based on the viciousness of the attacks we are seeing, are the attacks exploiting vulnerabilities at a much faster rate?

A: Speed of propagation is one issue. Then the virus writers' ability to identify and take advantage of vulnerability -- that period of time is going down as well. I think this is occurring because virus writers are starting to take advantage of technology to improve their capabilities. For example, they are sharing files in peer-to-peer networks in what you might call the underground.

Q: That computer underground has existed for many years. In your assessment, is this expanding and becoming more sophisticated?

A: Yes. Which gets back to the second point I made. Now people are talking about cyber-security problems, and there is a heightened sense of awareness about this. People on the street are aware cyber-attacks are taking place. They are concerned about it, but there isn't an understanding about what to do. There is confusion at multiple levels. There is confusion at the large enterprise level. There is confusion at the small- or medium-size enterprise level. And there is confusion among home users as to exactly what they need to do. The Cyber Security Industry Alliance would like to bring clarity to the situation -- not simply increase awareness of the problems, but increase understanding about what can be done to make systems more secure.

Q: It seems to me this increased understanding would require a better differentiation of the threats so reasonable strategies could be adopted based on security concerns.

A: To be frank, it would be extremely difficult to educate all users on the nature of threats and how they are evolving. Things are moving too fast. I think they will always move too fast. You have to create a level of understanding and offer solutions to those in a position to affect overall security. That means working with large enterprises, Internet service providers, governments -- federal, state and local -- and large educational institutions to improve cyber-security. In other words, it is going to be difficult to educate 250 million Americans -- not to mention the rest of the world -- on what they need to