Private sector experts agreed that Washington is finally getting more serious about cyber-security, and they observed that some work in the area, such as the Federal Desktop Core Configuration (FDCC) standard -- aimed at speeding security patching times -- and mandates requiring all parties supplying software to the federal government to test their products for security vulnerabilities, will have significant long-term impact.
Allen Paller, director of research at the SANS Institute, said that those specific examples prove the government can make significant improvements when legislators are able to isolate the right opportunities to do so.
"People saw what could work so they made these national mandates around software sales and systems patching, and every company in the nation could do the same type of things to help themselves," Paller said. "By working with the vendors instead of blaming software companies for these problems, this type of effort can be helpful for everyone else."
Tough issues remain
Despite those operational improvements, other private sector representatives said the government has not yet addressed some of the toughest issues around computer and Internet security, including the creation of laws that will make it easier for prosecutors to bring cyber-criminals to justice.
Robert Holleyman, chief executive of the Business Software Alliance, said his constituents remain hopeful, yet discouraged, that they will see improvement in those areas anytime soon.
"We really need to ask what's the national policy and [look at] how to deal with legal loopholes that exist today," Holleyman said. "We're making some progress, as with laws that better define the use of botnets and other attacks, but so many people are still finding that their machines have been compromised and we need [legal] solutions to that.
"Part of the challenge is getting Congress to move on these issues. We've supported broader federal legislation for data breaches, around notification, around how people are informed. But the political realities are that it remains highly unlikely that this will get accomplished," he said. "There are so many constituencies involved in the process and in some senses they're only getting started with these problems."