The Press has Me all Confused

Posted December 4th, 2008 by

So, what’s the deal?  Have a look through the following articles:

And wow, you would think that either the anti-FISMA cabal was on strike this month.  Even Alan Paller’s comments are toned down.  What gives?

But then again, maybe it’s just all part of the transition honeymoon–if you say things enough times, then eventually somebody picks up on it and recommends it to a committee and then it’s true.

My Bike the Transition Bottlerocket photo by Tom Grundy Photo.

Now at this point I start to get cynical, and here is why.  Everybody agrees that cybersecurity (been working with the Government for too long, I don’t even cringe at the word) is this phenomenally important thing that we all should do something about.  But since it’s a cost, for the most part it never actually happens.

In other words, it’s exactly the same problem that CISOs in private enterprise, the banking industry, and insurance has been dealing with for a “long” time: everybody wants security, but they don’t want to pay for it.

And the last article I have to give y’all today is this one from  Programs and ideas are great and all, but the CISO inside me knows that things won’t get done until there is a budget behind it.  That’s why the National Strategy to Secure Cyberspace hasn’t gone much of anywhere until the standup and subsequent funding of the National Cybersecurity Division and the National Infrastructure Protection Plan (yes, you could argue that they need much more funding than they currently have, but you can’t stand up something that big that fast).

Maybe I’ve come back around to the classic argument: talk is cheap, security isn’t.  And when transition fever comes to the Beltway, everybody has something to talk about.  =)

Similar Posts:

Posted in FISMA, Rants | 2 Comments »

2 Responses

  1.  Former Federal CISO Says:

    Then I’ll go ahead and say it. FISMA has squandered massive amounts of resources on measuring the wrong things in the wrong way. It is compliance for the sake of compliance with practically nothing to do with security. Our systems have been thoroughly compromised, even the ones in agencies with a silly “A” grade, because FISMA measures compliance, not security. FISMA has been a waste of resources from Day One, but there is a shred of hope that a new FISMA and a new administration might actually get it right.

  2.  rybolov Says:

    I tend to disagree, and my argument is scattered throughout my blog.

    However, the only thing I’ll comment right now is that I don’t believe the solution to regulation problems is more regulation.

Leave a Comment

Please note: Comment moderation is enabled and may delay your comment. There is no need to resubmit your comment.

Visitor Geolocationing Widget: