Feeds

Phone, internet corps SNUB US government's cybersecurity ABCs

20 computer defences rejected by telecoms industry

Business security measures using SSL

Phone companies and ISPs in the US have convinced a top advisory panel to hold back the American government from forcing a set of basic IT cybersecurity standards on them.

The Federal Communications Commission (FCC) set up a group of experts to figure out if the communications industry should be forced to adapt 20 "critical security controls", designed to stop or mitigate known attacks on computer systems.

But the panel informed the FCC in a report that there isn't a consensus among the key players that the recommended security checks are appropriate for telcos and ISPs - and that the commission should instead "encourage" companies to use them.

The report concluded:

While the 20 controls have been effective in guiding security management in enterprise and government institutions, the communications sector participants believe that some unique aspects of managing diverse multi-tenant communications networks will require additional evaluation in order to determine the extent to which the 20 Controls protect network infrastructure directly; as well as to determine the applicability of the 20 Controls to communications sector.

The full review can be found here [PDF]. Skip to page 15 for the 20 controls - they range from keeping tabs on the number of authorised and unauthorised devices to controlled use of privileged accounts.

The group - which included experts from state authorities and non-profits along with representatives from firms such as AT&T, Sprint, Verizon and Microsoft - said the FCC needed to carry out a further review of cybersecurity practices and what standards should apply to the comms industry.

The US government has said that the security of electronic systems and protection of national infrastructure from hackers are top priorities, but it's having trouble passing new laws without defining the standards companies should be measured against. The private sector is also resisting any attempts to turn voluntary standards into potentially expensive enforced regulations.

Last month, President Barack Obama issued an executive order for the establishment of voluntary minimum standards for any companies dealing with critical infrastructure.

The 20 cyber-controls came from secret lists of security measures that could stop known attacks on computers; the lists were compiled by government agencies including the NSA, FBI and the UK's Communications-Electronics Security Group (CESG) and computer security companies such as Mandiant and McAfee. ®

Protecting against web application threats using SSL

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.