Fwd: cnn.com - Homeland Security seeks cyber counterattack system(Einstein 3.0)

Wed Oct 8 00:31:07 UTC 2008

On Tue, 7 Oct 2008, Steven M. Bellovin wrote:
> On Tue, 7 Oct 2008 14:07:04 -0400 (EDT)
> Sean Donelan <sean at donelan.com> wrote:
>
>> On Tue, 7 Oct 2008, Valdis.Kletnieks at vt.edu wrote:
>>> On Tue, 07 Oct 2008 11:30:11 CDT, "J. Oquendo" said:
>>>> What about exceeding the minimum requirements for a change.
>>> (I think you'll find that if somebody is actually willing to *pay*
>>> for more security, there's plenty of outfits who are more than
>>> happy to make it happen)
>>
>> What should the US Government buy for more security?  And how can the
>> US Government make sure they actually get what they are paying?
>>
>>
> Right.  The US government is a *huge* operation.  Suppose you were the
> CIO or the CSO for the US government (excluding the classified stuff)
> -- what is the proper cybersecurity strategy?

Quit.

More seriously though, you are far more likely to be in charge of 
certifying products for acquisition, and run after the different offices, 
agencies and organizations for cooperation. So a first step would be to 
try and make yourself useful to them, and develop personal relationships 
with those who do want to work with you, in order to start facilitating 
information sharing and incident response.

I'd also try and get as many logs, flows, etc. I can get and build a main 
monitoring system.

Being in "charge" is simply not possible or practical.

Following the networks is indeed the first step.

 	Gadi.

>
> 		--Steve Bellovin, http://www.cs.columbia.edu/~smb
>