White House cybersecurity chief defines cyberthreat

Computerworld - Richard Clarke, chairman of the president's Critical Infrastructure Protection Board, recently spoke with Computerworld reporter Dan Verton about the nature and potential of the threat to the nation's critical infrastructure and what he sees as his biggest challenges with respect to national cybersecurity.

Excerpts from the interview follow:

Q: Can you briefly explain the cybersecurity threat for those who still may not be sure who or what the enemy is?

A: There's a spectrum of threats out there, some of which we experience every day. That spectrum runs from [individuals] who simply vandalize Web pages to those who conduct nuisance denial-of-service attacks. That's on the low end, which is usually conducted by young hackers -- so-called script kiddies.

In the middle, you have criminals who conduct fraud and industrial espionage online. The middle range of threats is usually carried out by organized crime, companies and also nation-states.

Coming next week: Computerworld's in-depth look at the IT response to the Sept. 11, 2001, attacks.

I think we have to anticipate that a smart opponent would use some of these asymmetric tactics against us. In the larger scenarios, the private sector would be the targets for attack, either by terrorist groups or nation-states because those groups would seek to disrupt the national economy.

Q: What are the greatest challenges facing the private sector in terms of cybersecurity, particularly with respect to your mission of building an effective public/private partnership that can provide for a common defense?

A: The first problem we've always had was awareness. However, the awareness problem has diminished greatly for two reasons. People in boardrooms asked themselves after Sept. 11, "How secure is our company?" Also, there have been a lot of cyberattacks, which have doubled in the last year.

The second problem facing companies is determining what is a good product, who's a good service provider and what they should be asking for. Most people think the first thing to do is to run out and buy a firewall or an intrusion-detection system. But that doesn't even begin to solve your problems. You need to have a continuous process of looking for vulnerabilities and you need to have a layered defense. We passed the 2,000 mark a few months ago in terms of known vulnerabilities that we have to deal with.