A cybersecurity gold rush is under way amid widespread confusion about how the federal government will oversee efforts to protect the nation’s computer networks. A flurry of new legislation has compounded the chaos as companies try to sort out what products and services various agencies will be acquiring.
An onslaught of proposed new laws and the creation of additional bureaucracies, such as the White House cybersecurity coordinator’s office and U.S. Cyber Command, have set in motion an industry scramble. Contractors are trying to make sense of the morphing regulatory and business landscape as they seek to tap into an $80 billion a year information-technology funding pool that, unlike other portions of the national-security budget, is expected to grow over the next five years.
Cybersecurity has been a significant source of business for the IT industry for many years — particularly from the Defense Department. But companies are forecasting growth in the coming years not just in military contracts but also in work with civilian agencies. Much of the legislation now moving through Capitol Hill will expand the role of the Department of Homeland Security in cyberwarfare, which should fuel contracting opportunities. The explosion of Web 2.0, cloud computing, social media and other Internet-based technologies has triggered a demand for encryption and firewall systems to shield government networks from intruders. As fears escalate, the industry is unleashing waves of new products and services that are now being marketed outside the traditional circle of military customers.
Reports of security incidents at federal agencies increased by more than 400 percent between 2006 and 2009, according to the Government Accountability Office.
In addition to benefiting from a greater demand for cybersecurity products, the industry projects its business will expand because there will be more agencies involved, often with overlapping functions. Cyberwarfare programs at the Defense Department are spread throughout the military services, several agencies and major commands. Internal competition is expected to intensify among organizations that don’t want to relinquish their turf. Another key advantage for the industry is that the government heavily relies on the private sector for technical expertise. The White House has launched a new initiative to speed up the hiring of in-house talent, but such programs could take years to achieve tangible results.
The U.S. government has a “desperate shortage of people who can design secure systems, write safe computer code, and create the ever more sophisticated tools needed to prevent, detect, mitigate and reconstitute systems after an attack,” said a recent study by the Center for Strategic and International Studies.
Experts have questioned the government’s dependence on contractors as subject matter experts, which can create conflicts of interest. Industry often is put in a position to advise the government on how to defend networks, for instance, and at the same time companies worry about their job security and sustaining a revenue stream from government clients. Private companies own and operate about 85 percent of global networks, including those used by the military.
Howard Schmidt, White House cybersecurity coordinator, recently hosted a meeting with industry executives where he called for “partnering” between the public and private sectors in pursuit of better protection of the nation’s networks. Such rhetoric, however, ignores the reality that what may be in the government’s best interest may be detrimental to the industry’s bottom line, noted James Lewis, a CSIS analyst who specializes in cybersecurity.
Many companies distrust the government’s rhetoric about working in partnership, concluded an informal poll taken by retired Air Force Lt. Gen. Harry D. Raduege Jr., who co-chairs a cybersecurity commission under President Obama.
The environment today promotes dysfunction, rather than cooperation, said retired Air Force Gen. Ronald E. Keys, a senior advisor at the Bipartisan Policy Center. “You have the dysfunction of government bureaucracy, and you have the dysfunction of proprietary and profit motive,” he said at a recent conference hosted by the Washington D.C. Chapter of the Armed Forces Communications and Electronics Association.
Significant barriers stand in the way of public-private cooperation, experts said. No incentives exist for private companies to share sensitive information about the security of their networks.
Somehow, industry and government will have to find a way to reconcile competing interests, said Ellen McCarthy, president of the Intelligence and National Security Alliance. “It’s a delicate balance,” she said at the AFCEA conference.
Only the government has the power to offer incentives to the private sector, she said. It could offer tax breaks or safe harbors to companies willing to exchange information freely.
The contracting system encourages stovepipes and turf warfare rather than teamwork, said Guy Copeland, chairman of the Cross-Sector Cybersecurity Working Group, which brings together government and private entities for monthly discussions.
Any form of public-private teamwork will be tough to achieve when the government itself is so internally divided. The commander of U.S. Cyber Command, Army Gen. Keith Alexander, said his organization lacks comprehensive visibility of the entire Defense Department’s digital domain because military networks are not integrated. This limits Cybercom’s ability to prevent attacks, Alexander said. “We do not have a common operating picture for our networks,” he said recently. “We need to build that.” Plugging this gap will require not just new technology but also extensive coordination among the military services and other federal agencies, Alexander said.
Congress, meanwhile, is trying to boost the capabilities of the Department of Homeland Security to protect domestic networks and the national infrastructure.
Sen. Joseph Lieberman, I-Conn., who chairs the Homeland Security and Governmental Affairs Committee, is proposing the creation of a National Center for Cybersecurity and Communications within DHS. It would protect non-defense, public sector and private sector networks from cyberattacks. DHS already has this responsibility through a presidential directive, but has “insufficient authority to carry it out.” Lieberman said.
“For far too long our approach to cybersecurity has been disjointed and uncoordinated,” said Maine Sen. Susan Collins, the committee’s ranking Republican.
Amid such head-spinning legislative and bureaucratic upheaval, some contractors are taking a wait-and-see attitude.
“From an industry perspective: you have to watch what’s going on and figure out what you can provide,” said Paul Strasser, senior vice president of Dynamics Research Corp., a federal IT contractor.
Many companies are rushing to offer new products to the government without realizing that the bigger needs are in training and certification of IT personnel, he said in an interview. A new policy from the Office of Management and Budget requires annual reports to Congress of agencies’ compliance with the Federal Information Security Management Act. The Department of Homeland Security is hiring more contractors to help train managers to comply with the flow of regulations, said Strasser.
Companies that are able to provide those services will be rewarded, he said. In the federal cybersecurity world, often too much emphasis is placed on technology when in fact many security breaches occur because employees are not properly trained, he said. “We have to be careful that we don’t focus so much on the technology that we forget about the management and people side of the equation.”
One of the biggest vulnerabilities in government systems is that agencies use software applications, especially web-based, that are not secure, he said. “That’s pretty fertile ground that needs to be addressed.”
The need for this expertise only will become greater once the government starts moving to a new, more advanced category of Internet-based software which is known as Web 3.0. Cybersecurity firms seeking to capture that market will have to figure out how to build behavioral models to predict how intruders may hack into those systems.
Companies that have lived in the federal IT universe for some time are seeing a “second wind” in the cybersecurity market, said Jackson Shaw, senior director at Quest Software. “It’s not just the increased awareness, but also that the government is funding more of these big-ticket projects.”
Many of the lucrative cybersecurity jobs will not be designing flashy technologies but performing basic “blocking and tackling,” said Steve Lawrence, Quest’s vice president for federal sales. “We don’t do exciting stuff.”
Richard Schaeffer, information assurance director at the National Security Agency, said that 80 percent of intrusions could be prevented if the government did nothing but implement the best practices and tools available today. But it is hard for the government to do that, said retired Air Force Lt. Gen. Charles Croom, former director of the Defense Information Systems Agency, who now heads cybersecurity programs at Lockheed Martin Corp.
“Why aren’t we doing that?” he asked during a recent interview.
The biggest problem for the government is that networks are too big and unmanageable, Croom said. The Defense Department alone has 7 million users apread across 15,000 networks. None of these networks is connected to the others and the protection of the systems is carried out by individual agencies using outdated manual techniques. This is why Lockheed sees a growing market for automation software that can take the humans out of the cybersecurity loop, Croom said. That alone can take care of the 80 percent of the security needs, he said. “But no matter what you do you’re still going to have intrusions.”
The government has not been able to prevent attacks because it doesn’t know how to get ahead of the intruder, Croom said. “Today, we react. Everything is after the fact.” Lockheed, like other firms, is trying to capture new business in gaming, behavior analysis and pattern recognition that would give a network manager a reasonably accurate picture of where the next attack may come from. “We believe that can be done,” said Croom.
Lockheed also is pursuing federal cybersecurity dollars via a new product called “IronClad,” a USB flash drive that shrinks a laptop’s hard drive – including the entire operating system, software applications and files – into an encrypted thumb drive. It costs between $550 to $700 per unit. “We’ve built a smart network around each drive, so IT managers have round-the-clock control of and visibility into the status and security of every device,” Croom said.
The race for cyberdollars will only become more competitive as newcomers jump in and incumbent firms fight to preserve their advantage. That is a major concern for some contractors who worry that in this cutthroat environment it will be difficult to collaborate among agencies, commands and corporations to defeat a common enemy.
“Defense spends far too much money on contractors who do not ‘play well together,’” said a military contractor who was not allowed to speak on the record. Stovepipes are part of the culture in the federal government and its contractors, the source said, but it has gone too far. As agencies become more dependent on information networks, the culture is putting lives at risk. “I don’t want a soldier out there on the ground with a handheld device dialing into someplace that can be tracked, and he can get shot.”
Eric Beidel contributed to this report.