It was a long time coming, but Howard Schmidt's appointment as White House Cybersecurity Coordinator was a welcome development, both because this is a reprisal of a role Schmidt held under the second President Bush-so he clearly knows the politics and pitfalls that await-and because he's couldn't be any more of an expert in the security issues at hand.
But with the latest brouhaha with China and malware-related losses rising, where Schmidt's priorities ought to be, and what he can accomplish, are matters for significant debate. Tom Kellermann, who chairs the Threats Working Group for the Commission on Cybersecurity for the 44th Presidency (CSIS), believes banks and governments are losing ground to the cyber criminals. He cites an alarming statistic: nearly half of 56,000 cases of known wire fraud in the past dozen years occurred in the past two years.
Kellermann's advice to Schmidt? Help create a G-20 cyber action crime task force akin to the Financial Action Task Force set up by the G-7 in 1989 (now G-8) to put the brakes on money laundering and terrorist financing. He may just be giving us a glimpse of what's contained in the next and final CSIS report due out this month.
"We need a real focus on international information sharing. Howard Schmidt needs to galvanize cooperation internationally. It's absolutely critical," says Kellermann, who is also a vp at Core Security Technologies.
Because Schmidt is nested in the White House rather than a single government agency, he's closer to the center of power and as such has a better shot at securing the nation's banking networks and systems. The first report from CSIS released in late 2008 concluded cybersecurity will not be achieved if overseen by any one agency or, as is the case of the financial sector, the U.S Treasury. Rather, it needs a czar operating at the highest level of government, namely the White House.
When it comes to cybersecurity, one of bankers' top concerns is identity management, according to Shawn Johnson, chairman of the Financial Services Sector Council for Critical Infrastructure Protection and Homeland Security (FSSCC) and chairman of the investment committee at State Street Global Advisors.
"You can have events where a cyber terrorist might want to destroy [a server or network]. One of the things we are looking at is identity management over the phone, in person and online," says Johnson.
The FS-ISAC, which reports into the FSSCC and acts under federal mandate to make sure threat information is shared, is deep in preparations for a cybersecurity drill that will test participant reaction and contingency plans to a simulated attack on the payments system.
"We are focusing on payment processes because that where the attacks against financial institutions, processors and businesses have been focused. Cyber criminal gangs know that's where the money is," says FS-ISAC executive director Bill Nelson. Of particular concern are phishing attacks using bogus e-mails to access accounts and SQL injections to penetrate and compromise institutional databases.
Nelson says Johnson and the FSSCC will take the lead on initial contact with Schmidt, but that the FS-ISAC would have a role in such a high level meeting.
What would he tell Schmidt?
"The number one issue is collaboration to share relevant and actionable information especially for remediation. It's not just pushing information out to us. We could push information to them and help the government. It's a two-way street. The government can do a lot, but they don't know the financial sector," he says.
