Professor Eugene H. Spafford, executive director of the Center for Education and Research in Information Assurance and Security (CERIAS), says the coordinator will probably have no authority over budget and policy, and thus will have difficulty getting the attention of cabinet secretaries, agency heads and CEOs.

President Obama's White House announcement falls short of candidate Obama's campaign promises first made at a town hall meeting at Purdue last year.

President Obama announced the creation of the position last Friday when releasing an administration report on national infrastructure and cybersecurity. Spafford says the president did well to highlight some of the major problems involved. However, Spafford said, President Obama’s White House announcement falls short of candidate Obama’s campaign promises first made at a town hall meeting at Purdue last year.

“The president said that the appointee will have ‘regular access’ to him. That is not the same as an adviser. And this is a difference that can mean a lot in Washington circles,” Spafford said.

Spafford compared the position to a largely ineffectual position in the Bush administration in 2001. He fears the failure to announce an appointment indicates the White House may be having a difficult time filling the new position appropriately. He also has expressed concern that economic advisers will have veto authority over the new position.

“The risk to our nation’s cybersecurity is not going to go away with a continuation of minimal investment and wishful thinking,” Spafford said. “Given the current stress in the economy, I don’t expect any meaningful actions to be approved that cost anything; we will still have the mindset that ‘cheapest must be best’ or ‘it can wait a little longer.’ That will simply make the problems more expensive and difficult to fix in later years.”

Spafford has worked with government, law enforcement, corporate, and academic officials including two U.S. presidents, the FBI, departments of Justice and Energy, the U.S. Air Force, Microsoft, Intel, Unisys, and the National Science Foundation. He is the 2009 recipient of the Computing Research Association’s Distinguished Service Award “for his long and effective leadership on issues of computer security and policy, professional responsibility, and the Internet.” He has testified before Congress many times on cybersecurity and has been a source for the major U.S. television networks and media outlets such as The New York Times and Washington Post.

In Related News:

• Survey suggests economy could lead to cybercrime increase
• Obama Whitewashes Iran
• Historian: Obama will affect how we remember Lincoln on the 200th anniversary
• Obama campaign unlawfully misuses proprietary firearms industry media list says trade association
• Barack Obama to visit Purdue for national security discussion

News via Lafayette Indiana Online

Expert: Obama’s new cybersecurity ‘coordinator’ position lacks clout, authority

Led by antivirus software giant McAfee Inc., the study, titled “Unsecured Economics: Protecting Vital Information,” found that companies lost an estimated $4.6 billion in intellectual property last year as a result of cybercrime. It warns that the global recession could push those numbers even higher.

The study, conducted by CERIAS, found that companies lost an estimated $4.6 billion in intellectual property last year as a result of cybercrime.

The study will provide a basis for a panel discussion at Purdue’s Center for Education and Research in Information Assurance and Security’s 10th annual symposium Tuesday (March 24) and Wednesday (March 25). The discussion will be 9:45 a.m. Wednesday, and for more information on the symposium visit http://www.cerias.purdue.edu/site/symposium2009

McAfee looked to the center — also known as CERIAS — to conduct the study. The center is based on bringing researchers together with commercial, nonprofit and government organizations that have an interest in information security. In this case, the researchers were a pair of Purdue faculty in management.

“CERIAS involves various disciplines in research programs that are driven by real problems,” said Eugene H. Spafford, the center’s executive director. “We were able to match experts in different areas to the research that McAfee needed.”

The researchers surveyed chief information officers of about 800 companies in the United States, the United Kingdom, Germany, Japan, China, India and Brazil.

Karthik Kannan and Jackie Rees, professors of management in Purdue’s Krannert School of Management, helped put together a 25-question survey. Vanson Bourne, a company in England, provided mailing and translation services.

“This was the first true global report on the security of digital intellectual property,” Rees said. “A lot had been done previously, but very piecemeal and incrementally. This survey focused on information security, but with the idea that intellectual property from the business and commercial perspective is critical. Our intent was to assess and understand the nature of the problems, and we found that not everyone is operating on the same level.”

McAfee announced the findings on Jan. 29.

Among the researchers’ findings:

• Cyberthieves have moved beyond basic hacking and stealing credit card data and personal credentials. An emerging target is intellectual property.
• More and more vital digital information, such as intellectual property and sensitive customer data, is being lost in the transfer between companies and continents. The average company has $12 million worth of sensitive information residing abroad.
• The global economic crisis is poised to create a “perfect storm” in information security risks as companies face increased pressures to reduce spending and cut staff. That has the potential to lead to more porous defenses and increased opportunities for cybercriminals. Forty-two percent of respondents interviewed indicated that laid-off employees are the biggest threat caused by the economic downturn.

“Many firms are moving sensitive information and data across borders,” Kannan said. “This study provides insights into what risk factors firms consider as important when moving the data. The study also raises public policy questions about how countries should respond in order to improve their perceptions. This is the first study to focus on perceptions of the firms regarding various countries.”

CERIAS has worked with McAfee on previous projects and is routinely involved with the business world through its Industry Partners program. The program involves 13 companies and organizations that help fund the center. Those partners can access CERIAS research, get information from a wide variety of areas and get an early hiring advantage from a pool of Purdue graduate students who will soon hit the job market.

“The students who go through the CERIAS program are attuned to industry’s issues because their education involves real-world experiences,” Spafford said. “The opportunities in this growing field are reflected in our enrollment. Since the center was founded in 1998, we have awarded 105 doctoral degrees in information security. We’re projecting it will be 150 by May 2010.”

McAfee completed the survey in the fall, and Purdue’s researchers spent December and early January analyzing the results.

“We are connected around the world in this global economy, but we don’t have the rules, the same laws or the same attitudes about protecting information,” Spafford said. “The theft of intellectual property is a real problem, and it’s another layer affecting the economy. It’s going to take cooperation among governments, private industry and the people who work in the areas of information security to bring cybercriminals to justice and lessen the problem.”

In Related News:

• Expert: Obama’s new cybersecurity ‘coordinator’ position lacks clout, authority
• National information security experts to speak at Purdue symposium
• Purdue, Bose McKinney offer intellectual property workshops

News via Lafayette Indiana Online

Survey suggests economy could lead to cybercrime increase