Former Bush official blasts government cybersecurity

IDG News Service - At a congressional hearing yesterday, President George W. Bush's former cybersecurity adviser blasted the administration's efforts within the federal government, and another expert called for Congress to force companies to pay attention to cybersecurity.
The U.S. Department of Homeland Security is moving too slowly in organizing its National Cyber Security Center, and the White House Office of Management and Budget (OMB) needs to hire a full-time chief information security officer to focus on cybersecurity, said Richard Clarke, former special adviser to the president for cyberspace security.
The president's National Strategy to Secure Cyberspace, released in mid-February (see story), can't move forward without the Homeland Security cybersecurity center, said Clarke, who left the Bush administration two months ago and is now a consultant (see story). The Homeland Security Department has failed to "recruit a cadre of nationally recognized cybersecurity experts," he said.
"I would hope that with cybersecurity we can do more to raise our defenses before we have a major disaster," Clarke added. "The problems we've had to date are minor compared to the potential."
Clarke, testifying at the House Committee on Government Reform's Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, also called on Congress to fund vulnerability scanning sensors on all federal networks. In addition, he recommended that federal agencies outsource their cybersecurity projects and withhold money from the vendors if the agencies get failing cybersecurity grades.
Michael Vatis, director of the Institute for Security Technology Studies at Dartmouth College in Hanover, N.H., agreed with Clarke that the U.S. government response to cybersecurity is lacking. Hundreds of cybersecurity jobs, including top posts, that were to move from the FBI, the Federal Computer Incident Response Center and other agencies to the new Homeland Security Department are unfilled, he noted.
"It could take over a year before we get back to where we were in our ability to respond to cyberattacks," Vatis said, blaming a "gaping void" in leadership from the Bush administration.
But Mark Forman, associate director of information security and electronic government at the OMB, defended the administration's efforts to make federal agencies more secure.
The number of federal systems meeting several cybersecurity goals has risen rapidly since 2001, he said. In 2001, only 40% of federal systems had up-to-date system security plans, he said. By 2002, that number had risen to 61%. Forman said he would match those improvements against any company in the private sector, although he acknowledged that the numbers are "still too low."
Forman assured the committee that cybersecurity is a top