I found an interesting Chart the other day on the White House Web site,
https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/omb_presidents_it_budget_for_fy_2016_summary_chart.pdf that shows who won and who lost in the IT budget battles. The biggest winner between budgets for 2015 and 2016 is The Office of Personnel Management - yes, the same one that lost all of our security clearance data and failed to correct even basic things like how they do administrative log-ins across their networks. They got a 48% increase in their budget. This is a lot like the people who pay millions for bridge repair after the bridge has fallen into the lake at rush hour. A little money for fix-up might have saved the bridge.
Looks like the Department of Housing and Urban Development lost the most, 16%. These are good figures for the guys who do marketing and write proposals, but not much use to anybody else. Look at the bottom numbers on this chart, and you realize we spend way more on Information Technology than any government should.
I happened to read Linda Cureton's article called 3 Reasons We Don't Need Federal CIOs [http://www.informationweek.com/government/leadership/3-reasons-we-dont-need-federal-cios/a/d-id/1297423] who used to be CIO for NASA. I have to agree with the way she looks at this. There is no "enterprise" in the Fed and every agency runs its IT like it was the only agency in our government. IT is not a respected profession in the C-suite of the agencies. It is all about mission, whatever it might be. But...
Security is still part of the CIO's responsibility and that is not going away. We have yet to hear from the CIO at OPM, who appeared at her hearing because she had to but said very little after "my comments were added to those of the preceding speaker". Yes, so she couldn't talk about who was really responsible for the decision to take a chance on the operation of a system that was full of holes. Next thing we know, her emails will go missing.
The Chinese must be laughing out loud at the incompetence of this agency. Nobody who got one of those letters from OPM is laughing.
Monday, June 29, 2015
Thursday, June 25, 2015
Clapper on OPM
In today's Wall Street Journal, Damian Paletta says James Clapper, Director of National Intelligence, says China was behind the OPM hack and that deterrence of these kinds of action are partially at fault.
Deterrence strategy falls to the National Security Council which seems to have done next to nothing to prevent the Chinese from continuing to go faster at their collection of information from both US Industries and government offices. That reluctance has cost us more than we know. We can't allow the Chinese to do what they want while we try to keep their support for a dubious deal with Iran on nuclear weapons. That deal is falling apart as we speak, so if they were relying on China's help, they are wasting what breath they have left.
Deterrence is nonexistent. While China sucks our industries dry of trade secrets, plans, strategies and teaming arrangements, they continue to plow ahead with their economic growth. That strategy is working very well for them, and not so well for us. Do we really need Chinese support so much that we want to sell our own companies out to get it?
Deterrence strategy falls to the National Security Council which seems to have done next to nothing to prevent the Chinese from continuing to go faster at their collection of information from both US Industries and government offices. That reluctance has cost us more than we know. We can't allow the Chinese to do what they want while we try to keep their support for a dubious deal with Iran on nuclear weapons. That deal is falling apart as we speak, so if they were relying on China's help, they are wasting what breath they have left.
Deterrence is nonexistent. While China sucks our industries dry of trade secrets, plans, strategies and teaming arrangements, they continue to plow ahead with their economic growth. That strategy is working very well for them, and not so well for us. Do we really need Chinese support so much that we want to sell our own companies out to get it?
Do We Want to Fight China?
The Chinese have a rule of engagement that says they fight when they are ready, and not before. Note that not every country follows that rule, usually to their detriment. What the OPM and a stream of other hacks shows is their readiness to engage, acknowledge their hacking with in-your-face attacks that can be traced to China, and overt acts in the South China Sea. Think of these as warnings.
Sony and South Korea's banking targets (North Korea was held responsible), are equal warnings. Both were destructive and intended to show us that the next big fight will not be the theft of data from private and government sources. It will be a damaging attack against the core services of our country, businesses especially. Lots of information will be released to the public and systems will be destroyed.
That is part of the game of war played by governments. Usually, the basic rules require covert engagement, something the Chinese have done by denying something so easily traced to them. The usual approach is to use deterrence as a way of persuading them that this is not a good idea. Do we have a good deterrence here? No.
So, if they are ready to fight and we don't have a good deterrence, we have to fight too. Are we ready? The military is ready and thinks it can fight, but this war is not about the military capability of a country. Can our businesses withstand an attack if it came? We can't afford to wait to find out. The attack on South Korea cost $500M to repair, and they are a small country. I hope our government has let our industries know how that attack was done and what they should be doing about deflecting a similar effort here.
Sony and South Korea's banking targets (North Korea was held responsible), are equal warnings. Both were destructive and intended to show us that the next big fight will not be the theft of data from private and government sources. It will be a damaging attack against the core services of our country, businesses especially. Lots of information will be released to the public and systems will be destroyed.
That is part of the game of war played by governments. Usually, the basic rules require covert engagement, something the Chinese have done by denying something so easily traced to them. The usual approach is to use deterrence as a way of persuading them that this is not a good idea. Do we have a good deterrence here? No.
So, if they are ready to fight and we don't have a good deterrence, we have to fight too. Are we ready? The military is ready and thinks it can fight, but this war is not about the military capability of a country. Can our businesses withstand an attack if it came? We can't afford to wait to find out. The attack on South Korea cost $500M to repair, and they are a small country. I hope our government has let our industries know how that attack was done and what they should be doing about deflecting a similar effort here.
Subscribe to:
Posts (Atom)