Home > Security

Computerworld - When the White House released the National Strategy to Secure Cyberspace in February last year, the guiding principle was to make it a "living document" capable of changing with the times and meeting the needs of a diverse Internet community.
But in the year since its release, the strategy has had little or no impact on the security plans and investments of many of the companies that were supposed to be integral to its implementation, corporate IT executives say. And although some critical-infrastructure sectors have heeded the government's call to action, many corporate users still view the plan as irrelevant to the challenges they face.
"Although we all do our best in thinking strategically about issues like [the national strategy], they are at the bottom of any list I have," said John Spencer Jr., vice president of operations and CIO at the American Society of Health-System Pharmacists in Bethesda, Md. "What's the payoff?
"I have existing budgets that change by the day, I'm trying to patch the holes in my Microsoft-based infrastructure daily and weekly, [and] new and different variants of viruses are running rampant," Spencer said. "I could give you a list of 100 things like this that I'm addressing by the minute, day and week. I can see cause and effect related to these issues, but not so with this strategy."
Begging vs. Regulating
For IT managers like Spencer, "cause and effect" translates into detailed justification for increasing resources to do what the U.S. Department of Homeland Security's National Cyber Security Division (NCSD) is asking of companies across the country: to belly up and take the lead in securing cyberspace. The threatened alternative: unwanted regulation.
The irony is that in the private sector, the onset of new regulations -- regulations that have nothing to do with the DHS -- has in fact forced improvements in cybersecurity, users and analysts say.

Richard Clarke, former chairman of the President's Critical Infrastructure Protection Board

For example, Davidson Healthcare in Lexington, N.C., along with every other company in the health care industry, faces on April 15 the non-negotiable activation of the Health Insurance Portability and Accountability Act, which requires enhanced security to protect private patient data.
Unlike HIPAA, however, the release of the national strategy "hasn't necessarily provided any [justification] for additional funding," said Kevin Buchanan, director of IT at Davidson Healthcare. "HIPAA is not a recommendation; it's federal law. And when I say something is a federal requirement, senior managers can't argue with that."
In addition to HIPAA and laws that cover