The Field Report
There are 18,000 banking institutions in the U.S., and somebody has to blog about their breaches, concerns and security successes.

July 31, 2009 - Eric Chabrow
Comments (0) Read All Posts (254)Two months after a major presidential address that outlined the job's responsibilities as part of a major administration cybersecurity policy initiative, the cybersecurity coordinator's post remains unfilled. At least 30 people have been interviewed for the post, according to a former high-level executive branch IT official with ties to the White House.
Why would anyone want this |
A White House spokesman late Friday would neither confirm nor deny the number of people the White House has vetted for the job or whether Hathaway remains a candidate, saying the administration does not comment on personnel matters.
The spokesman pointed out that the president will be personally involved in selecting the cybersecurity coordinator, but hasn't done so yet, in part, because he's been focused on other pressing matters.
The names of former White House computer security advisers Howard Schmidt and Paul Kurtz along with Frank Kramer, a one-time assistant defense secretary, have been prominently mentioned for the job.
Among those who told the White House thanks but no thanks, The Washington Post reports: former Republican U.S. Rep. Tom Davis of northern Virginia, Microsoft executive Scott Charney, Symantec Chairman John Thompson and retired Air Force Gen. Harry Raduege Jr., the former Defense Information Systems Agency director and co-chair of the Commission on Cybersecurity for the 44th Presidency, which proposed the White House establish a cybersecurity post that has more influence than the job Obama described.
Indeed, the job Obama described isn't seen as influential enough to attract some of those being courted by the White House. "I do believe there are some issues with the level and role of the position that have some folks in pause mode," said another well-connected former White House official.
Though the president pledged the cybersecurity coordinator would have access to him, he or she would report directly to two masters: Gen. James Jones and Lawrence Summers, national security and economic advisers, respectively. The prospect of having two bosses with strong personalities and who don't necessarily see eye-to-eye on some key issues isn't seen as an attraction of the job, especially to a candidate who wants to help shape and not just coordinate cybersecurity policy. "Why would anyone want this job?" one of the former officials asked.
And, the turf battle wouldn't be just between the National Security Council and National Economic Council, but with the Department of Homeland Security and the National Security Agency that control much of the government's operational IT security within civilian agencies and defense establishment, respectively. "The person in the role will have no authority over the departments and agencies with regard to budget and operations; they will not be able to broadly influence the private sector; there is some 'squabbling' over which agency will have the lead for cybersecurity - NSA, DHS cybersecurity division or Air Force cyber command - and how the president's cyber czar will interact for policy development and direction," another well-tied ex-White House official said.
Thus, the job could be a thankless one. One challenge is how to judge whether the coordinator is successful in the job. The blame likely would be swift against the cybersecurity coordinator should a major assault or breach occur against government or national critical IT infrastructures, even if the adviser has no operational control. If no significant cyber disruption occurs, there's likely to be little credit given to the coordinator several rungs removed from the president.
Another challenge in finding a qualified cybersecurity coordinator could be the pay, which likely would be under $200,000 a year, a pittance when compared with what some of the prospective candidates earn in the private sector. Still, many public servants have forfeited higher pay to work in the government, especially if they are granted real authority.
To many, the cybersecurity coordinator's job is perceived as a glorified traffic cop, an official who brings together key parties to synchronize the government's approach to IT security, but in itself doesn't have the weight to help create policy. Perhaps if the president pledges to give the cybersecurity coordinator real influence in shaping federal cybersecurity policy - as many leading government and IT security experts have suggested - the post wouldn't be so hard to fill.
Also read:
NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems..Next Topic
DoJ: Report to Congress on Implementation of Section 1001 of the USA PATRIOT Act..Next Topic
NIST SP 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy..Next Topic
NIST Guide to Security for WiMAX Technologies (Draft)..Next Topic
OMB Memorandum: New Reporting Instructions for FISMA..Next Topic
NIST IR 709: Cryptographic Key Management Workshop Summary (Draft)..Next Topic