Bill would give feds role in private sector cybersecurity

Legislation aims to reinforce government cybersecurity while also ensuring safeguards are implemented for critical infrastructure such as banking and power systems

Two U.S. senators are proposing legislation that would give federal officials significant new authority to create and enforce data security standards both for government agencies and key parts of the private sector.

The Cybersecurity Act of 2009, which was introduced by Sens. Olympia Snowe (R-Maine) and Jay Rockefeller (D-W.Va.), would empower the National Institute of Standards and Technology (NIST) to establish "measurable and auditable" security standards for all networks and systems run by federal agencies, government contractors and businesses that support critical infrastructure services. In addition, NIST would be charged with developing a standard for testing and accrediting software built by or for those groups.

[ Lawmakers have been calling for new cybersecurity regulations. | A congressionally sponsored report offered President Obama some far-reaching recommendations. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

The bill also calls for the creation of a national cybersecurity adviser's office within the executive office of the president. Under the proposal, the new operation would be modeled after the Office of the U.S. Trade Representative and would have the power to compel federal agencies to comply with government security mandates.

According to a statement posted on Snowe's Web site Wednesday, the new legislation is aimed at reinforcing ongoing cybersecurity efforts within the government while also ensuring that proper safeguards are implemented for critical infrastructure targets within the private sector, such as banking and power systems.

Cyberattacks against those systems "could literally shut down our way of life," the statement warned. It went on to describe the cybersecurity threats facing both the government and key private-sector systems as one of the country's most urgent national security problems. "It is abundantly clear we must unite on all fronts to confront this monumental challenge," Snowe said. "If we fail to take swift action, we, regrettably, risk a cyber-Katrina."

"We must protect our critical infrastructure at all costs," Rockefeller added. "From our water to our electricity, to banking, traffic lights and electronic health records - the list goes on."

Snowe noted that the bill "loosely parallels" a set of cybersecurity recommendations contained in a report released late last year by a commission set up by the Washington-based Center for Strategic and International Studies.