*From SANS, who have been complaining about this even longer than I have.
–US Legislators Want to Increase DHS's Cyber Authority
(July 22 & 23, 2015)
US legislators have introduced a bill that would give the Department of
Homeland Security (DHS) a greater role in overseeing the cyber security
of federal agencies. The FISMA Reform Act would give DHS the authority
to conduct risk assessments on federal networks and use defensive
measures without the permission of an agency.
http://www.scmagazine.com/senators-introduce-bill-to-expand-dhs-oversight-of-federal-gov-domain/article/428227/
http://www.nextgov.com/cybersecurity/2015/07/senators-want-give-dhs-new-cybercom-powers-thwart-civilian-agency-hacks/118368/?oref=ng-HPtopstory
http://media.scmagazine.com/documents/137/272387111-fisma-reform-2015_34087.pdf
[Editor's Note (Pescatore): I don't think DHS has shown the competency,
capability or capacity on the operational side of cybersecurity to
fulfill such a role. There is a really, really big difference between
"conducting risk assessments" and implementing "defensive measures
without the permission of an agency." The biggest security shortcomings
at government agencies start with asset and configuration management and
vulnerability visibility/remediation - which is what the DHS CDM program
that began in 2013 was supposed to improve, but has barely gotten moving
yet.
(Murray): Recent studies (e.g.,
https://info.veracode.com/state-of-software-security-report-volume6.html)
and breaches have demonstrated that government remains the "soft
underbelly" of our "cyber defense." While government operates only ten
percent of the IT infrastructure, its inability to put its house in
order diminishes its ability to lead.
(Henry): The Comprehensive National Cybersecurity Initiative (CNCI) was
authorized and FUNDED in 2007, specifically to address the cybersecurity
needs of US government networks. Time and again I hear of some US
strategy or policy, like this one, as if it's a new initiative or idea.
The CNCI had a component to update FISMA and enable DHS to
oversee/protect all USG civilian networks: EIGHT YEARS AGO. Yet here
we sit, suffering from the results of the OPM breach, as if it was some
unforeseen catastrophe we could do nothing about. Unacceptable...]
