White House asks companies for help with new government computer network

[InfoSec News <isn () c4i org>]

http://www.siliconvalley.com/docs/news/svfront/042802.htm

Wednesday, Oct. 10, 2001 

WASHINGTON (AP) -- After one day on the job, the president's
cyberspace security adviser asked computer companies Wednesday to help
design a new secure telecommunications network for government use.

Richard Clarke said he wants the network, called GOVNET, to be
separate from the Internet to keep it safe from hackers or terrorists.

Government agencies would use GOVNET for voice and data
communications, and possibly for videoconferences presidential
advisers have used since the Sept. 11 attacks.

``Planning for this network has been going on for several months,''
Clarke said in a memo to the industry.

The nation's counterterrorism chief for more than a decade, Clarke has
pressed private industry to increase computer security by improving
its own products.

``We'll be working even more with them in the future, to secure our
cyberspace from a range of possible threats, from hackers to criminals
to terrorist groups, to foreign nations, which might use cyber war
against us,'' Clarke said Tuesday when his new job was announced.

> From his previous post at the National Security Council, he warned
that America's fledgling Internet was vulnerable to a ``digital Pearl
Harbor'' that could badly disrupt communications.

Those warnings were echoed Wednesday on Capitol Hill, where experts
told Congress that part of the problem is that current computer
systems were not designed with security in mind.

``Security cannot be easily or adequately added on after the fact and
this greatly complicates our overall mission,'' Purdue University's
Eugene Spafford said. ``The software and hardware being deployed today
has been designed by individuals with little or no security training,
using unsafe methods, and then poorly tested.''

The government relies on all types of technology companies -- for
personal computer software to public telephone networks.

Recent independent reviews have shown computers at many government
agencies are open to a hacker attack. In theory, GOVNET would be
impervious to outside assault -- particularly from lone young hackers,
the most common Internet attacker.

The chairman of the House Science Committee, Rep. Sherwood Boehlert,
said research and development on computer security has not kept pace
with growing threats.

``To put it simply, we need more people to be doing more creative
thinking about computer security. That's what our adversaries are
doing,'' said Boehlert, R-N.Y.

University of Virginia professor William A. Wulf said that because not
enough government money is spent on computer security research,
experts tend to be conservative. ``Out of the box thinking in an area
of scarce resources doesn't get funded,'' he said.

The GOVNET proposal could cost billions of dollars.

The government wants the network up and running six months after a
contractor is picked, although there is no deadline for the contract
to be awarded.

``A system like this can help us break through the cloud of the
Internet and provide a separate network where the integrity of
government information can be protected,'' said Sen. Robert Bennett,
R-Utah, a leader on computer security issues.

Many parts of the government, including the CIA and the Defense
Department, operate separate classified networks. Mark Rasch, a former
Justice Department computer crimes prosecutor, said those networks
could be expanded and integrated to form GOVNET.

An additional challenge is that GOVNET would have limited value
because it could not access the World Wide Web.

A better way, Rasch suggested, might be to improve the ways sensitive
information is encrypted and sent over public networks such as the
Internet.

``We're not building new highways so we can move tanks and troops from
one place to another,'' Rasch said. ``We build the highways so they
can handle the transfer of both cars and trucks and, if necessary,
tanks and troops.''



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.