Feeds

US Congress wants hack teams for self-penetration

While girding power grid

SANS - Survey on application security programs

The United States Congress this week delved further into the country's cybersecurity preparedness as members introduced two bills designed to protect federal networks and electric power grids from attacks.

One bill, dubbed the US Information and Communications Enhancement Act of 2009, would mandate the formation of hacker teams that would actively try to penetrate government networks. Current laws focus more on generating reports that detail vulnerabilities and defenses to them than putting security into practice, many security experts say.

Sponsored by Senator Tom Carper of Delaware, the bill would also establish a National Office for Cyberspace that would be responsible for carrying out cybersecurity policy. Additionally, it would create a council of chief information security officers who would stay in touch with CISOs from each federal agency to share information about the latest threats.

A separate bill introduced this week by Representative Bennie Thompson of Mississippi is aimed at strengthening the US power grid against attack. The so-called Critical Electric Infrastructure Protection Act would give federal regulators more power to respond to emergencies involving infrastructure that transmits electricity. Among other things, the Federal Energy Regulatory Commission could issue "emergency rules or orders" when an attack is imminent.

The bills come three weeks after a separate piece of legislation was introduced in the Senate that would give the president unprecedented authority over the nation's critical infrastructure, including the power to shut down or limit traffic on private networks during emergencies.

While by no means perfect, the flurry of bills is a cause for hope, some security experts believe.

"My reaction to all of these is that it seems the nation has reached a tipping point - Congress is speaking for the country saying this problem is bad enough to act - CSIS said we are losing the cyber wars," Alan Paller, director of research for the SANS Institute, wrote in an email, referring to a recent report by the Center for Strategic and International Studies. "Urgency is high. It is time to stop talking and start fixing." ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.