Could US repel a cyberattack?

The nation's defense relies on a small group that operates on a tiny budget and with little clout, experts say.

from the June 7, 2007 edition

Page 2 of 3

Page 1 | 2 | Page 3

US cybersecurity team is limited

In the case of a major attack on this country, the US-CERT in the Department of Homeland Security may not have the same ability to take charge, analysts say.

"They do not have the central pull that [CERTs] have in other countries," says Jose Nazario, a senior security researcher at Arbor Networks. He says that the early development of the Internet here contributed to more independent security efforts, and private companies are sometimes loathe to share information with competitors. "The lack of clout can be frustrating. Internet Service Providers here in the States are generally free to ignore [US-CERT] if they want to, and there are some shady providers here."

The situation is improving, says Jerry Dixon, the acting director of the Department of Homeland Security's National Cyber Security Division, which runs US-CERT. He points to the rising number of incident reports of suspicious Internet activity from the private sector as well as government agencies, which are coming in at eight times the level of fiscal 2005.

Much work remains to be done, says Mr. Dixon, particularly in terms of developing state-level preparedness efforts and in preparing for an incident in which several major networks were attacked simultaneously.

"I'm not going to paint a total rosy picture," he says. But "I think we're in a pretty good position to deal with the issue."

Some analysts believe the private sector shouldn't be forced to report and otherwise participate in these kinds of DHS initiatives – except for companies that occupy four key sectors: finance, telecommunications, energy, and government services – such as those that provide checks to senior citizens.

And DHS must know which elements of the private sector would be vulnerable during a cyberattack, Mr. Lewis says. "To say we don't know which banks would stay online is unacceptable," he says.

1 | Page 2 | 3 | Next Page