Senate bill would give feds bigger cybersecurity role in private sector

Computerworld - Two U.S. senators are proposing legislation that would give federal officials significant new authority to create and enforce data security standards both for government agencies and key parts of the private sector.

The Cybersecurity Act of 2009, which was introduced by Sens. Olympia Snowe (R-Maine) and Jay Rockefeller (D-W.Va.), would empower the National Institute of Standards and Technology (NIST) to establish "measurable and auditable" security standards for all networks and systems run by federal agencies, government contractors and businesses that support critical infrastructure services. In addition, NIST would be charged with developing a standard for testing and accrediting software built by or for those groups.

The bill also calls for the creation of a national cybersecurity adviser's office within the Executive Office of the President. Under the proposal, the new operation would be modeled after the Office of the U.S. Trade Representative and have the power to compel federal agencies to comply with government security mandates.

According to a statement posted on Snowe's Web site Wednesday, the new legislation is aimed at reinforcing ongoing cybersecurity efforts within the government while also ensuring that proper safeguards are implemented for critical infrastructure targets within the private sector, such as banking and power systems.

Cyberattacks against those systems "could literally shut down our way of life," the statement warned. It went on to describe the cybersecurity threats facing both the government and key private-sector systems as one of the country's most urgent national security problems. "It is abundantly clear we must unite on all fronts to confront this monumental challenge," Snowe said. "If we fail to take swift action, we, regrettably, risk a cyber-Katrina."

"We must protect our critical infrastructure at all costs," Rockefeller added. "From our water to our electricity, to banking, traffic lights and electronic health records — the list goes on."

Snowe noted that the bill "loosely parallels" a set of cybersecurity recommendations contained in a report released late last year by a commission set up by the Washington-based Center for Strategic and International Studies.

The proposed legislation comes in the midst of a 60-day review of federal cybersecurity programs that was ordered by President Barack Obama and is being led by Melissa Hathaway, who worked during the Bush administration as a "cybercoordination executive" in the Office of the Director of National Intelligence.

In addition, there have been increasing calls for for a comprehensive national strategy on cybersecurity as well as stronger government leadership to ensure that security initiatives are implemented effectively.