To date, the Fed’s information security record is decidedly mixed, with numerous examples of great ideas that either never get implemented or which take forever, due to bureaucratic foot dragging.

In the article, Patricia Titus of Unisys, mentions the example of FISMA (the Federal Information Security Management Act) which has taken almost seven years to get working. But keep reading.

In similar vein, HIPAA (the Health Insurance Portability and Accountability Act), which has the laudable goal of protecting patients’ sensitive personal information, was enacted by the U.S. Congress in 1996, yet they only got around to enforcement last year.

The bill tasks NIST (National Institute for Standards and Technology) with developing a framework of metrics (“you can’t understand something unless you can measure it”) and compliance tests. That is an excellent idea since NIST is more immune to political interference than, say the DOD.

However, NIST has already developed and published most of those security concepts over the past several years. Take a look. But most federal agencies seem to have ignored them, attested to by the abysmally low ratings federal departments have received in FISMA audits, mostly Cs, Ds, and Fs, year after dreary year.

FISMA itself has had only limited success. This past February, the DOD and other Federal agencies proposed a new approach in an effort to move away from the annual FISMA security compliance audit: a heavily paper-based process developed by, yes, the NIST.

The proposed Consensus Audit Guidelines (CAG) for assessing network security emphasize automated controls (such as automated inventory of hardware and software), secure configurations for hardware, software and network devices, and continuous vulnerability testing and remediation.

Another question mark over the proposed federal legislation is the usual elephant in the room: BUDGET. Will Congress and the White House mandate adequate dollars for federal agencies to acquire, deploy, and train employees on the necessary hardware and software security tools?

Only time will tell.

To the parties quoted in this article, what have the Goliaths done for you to make your nets any safer? “Nothing!” because Cisco, RSA, McAfee, etc. only use Layer 2&3 of the OSI Model . These are the S/W layers which Roger Schell PhD (Shannon Lecture Series) & Professor Caeili, and many others define as: “they are hackable, even with encryption.” Thanks to small OEM’s like us using “100% Science”, we can “Prevent” most of these breaches today!

Well Unisys we will give you a second chance, after all we are now past the K street lobby and the B–h/ C—y greed. If we are good enough for the Canadian Govt. Dept of Public Safety (DHS), US Navy, US AF, Irish Allied Bank, the NYBd. Of Trade, Passaic City. NJ Data Centers, etc.,. It’s about time we woke up, and if we are smart we won’t blow it this time around. Legislation is great but it doesn’t create a solution like ours. The Standards exist, that we used coupled with the Science— OSI-Layer One, Common Criteria, PCI-DSS, & DARPA 98. You may want to consider inviting me to testify & contribute in drafting the proper specifications. America is now on a roll…….Let’s finally team and get it right the first time. To that end, we are pleased to License every North American Defense Contractor or OEM as our contribution to being able to fast track hardening up our civilian and regular govt installations with affordable commercial grade H/W & S/W that is 100% transparent to any network running today.
DtX was born in the ashes of 911 and today it’s in production. That’s our contribution..
BobP/CEO
ContinuumP@gmail.com