With all the talk about cyberattacks and the fears that the problem is growing, you would think the federal government doesn't have a clue about how to prevent them. But that is just not so. The Senate Judiciary Subcommittee on Terrorism, Technology and Homeland Security heard from a number of experts on Tuesday, offering their advice on how the government should best secure government and private-sector critical infrastructure networks.

About 80 percent of cyberattacks could be prevented if agencies conducted good network monitoring and had good policies in place, the committee was told. Richard Schaeffer, the NSA's information assurance director, added that simply adhering to already known best practices would sufficiently raise the security bar so that attackers would have to take more risks to breach a network, "thereby raising [their] risk of detection."

So what's the problem? Well, public apathy and ignorance, according to Larry Clinton, president of the Internet Security Alliance.

Corporate and government entities that collect and store the public data, "do not understand themselves to be responsible for the defense of the data," said Clinton, whose group represents banks, telecoms, defense and technology companies, as well as other industries that rely on the Internet.

"The marketing department has data, the finance department has data, etc., but they think the security of the data is the responsibility of the IT guys at the end of the hall," he added.

Philip Reitinger, director of the National Cyber Security Center at the Department of Homeland Security, said that end users also need to be made aware of the simple things they can do to protect themselves--such as keeping software and anti-virus up to date. "We need to, as a nation and as an IT eco-system, continue to make it more simple for people to institute protections to determine if they've been compromised and to make sure they stay secure," Reitinger said.

For more on this congressional hearing:
- see this Federal Computer Week article [1]

Related Articles:
Feds seek new tools to fight cyberattacks [2]
U.S. government overwhelmed by cyberattacks [3]