Q&A: RSA CEO sees lack of leadership in U.S. cybersecurity efforts

Computerworld - Art Coviello wears multiple hats. As president and CEO of RSA Security Inc., he is responsible for the company's vision and long-term strategy. He is also a founding member and co-chair of the Standards Committee of the Cyber Security Industry Alliance (CSIA), which is a consortium of technology companies. In that capacity, he was appointed co-chair of the National Cyber Security Summit's Corporate Governance Task Force reporting to the U.S. Department of Homeland Security. In an interview with Computerworld, Coviello talked about the lack of federal leadership on cybersecurity issues, the challenges of information-sharing and RSA's recent acquisition of fraud management software vendor Cyota Inc.
The CSIA recently criticized the federal government for its apparent failure to act on recommendations to improve cybersecurity. What exactly is the problem? [Former White House counterterrorism chief] Dick Clarke, in his last act working for the White House, pulled together in early 2003 a strategy for the president to secure cyberspace. That was in 2003. I was in a task force around corporate governance and reported out to the Department [of Homeland Security]. We are heading out into 2006, and the government has done absolutely nothing to execute on their own strategy. I think it is entirely appropriate that the Cyber Security Industry Alliance and industry leaders call attention to that fact. We are pleased that [Department of Homeland Security Secretary Michael] Chertoff announced that he is going to appoint an assistant secretary [for cybersecurity]. But that was almost six months ago. OK, we had Hurricane Katrina, and he's been preoccupied. But when oh when are we going to get that assistant secretary, and when are we going to start executing on a strategy that was laid out almost three years ago?

Among the failures mentioned by the CSIA was the continued lack of information sharing between government and the private sector on cybersecurity matters. The idea of information sharing is a pretty comprehensive and complex topic. The reason is, while the technologies exist, getting together the people and the process part of it is a lot harder. Is the profile of somebody in the FBI equal to the profile of somebody in the CIA or the DHS? How are you going to get all of these agencies to agree on what level of access is going to be adequate for people at various levels in the government? What kind of access are you going to give to somebody from the FBI to the CIA database? What kind of access are you going to