To be sure, American businesses are just as big a target and are exposed to just as severe a degree of cyber threats as U.S. government agencies. They also display just as varied levels of preparedness to defend themselves. Whose responsibility is it, when you consider that many businesses are considered “critical infrastructure” — such as defense contractors, financial, telecommunications, power and transportation companies – and are integral to national security?

William J. Lynn III, deputy defense secretary, and Air Force General Ken Chilton, head of the U.S. Strategic Command (STRATCOMM, which encompasses the U.S. Cyber Command) warn of these escalating threats from cyber espionage and computer crimes, and encourage greater cooperation between the federal government and private industry. The U.S. CERT (Computer Emergency Readiness Team) has been developing the Einstein project since 2004, an intrusion detection system (IDS) that monitors the network gateways of government departments and agencies for unauthorized traffic.  Currently dubbed Einstein 2, its pending third generation deployment (Einstein 3) will not only monitor but also actively block and prevent cyber intrusions.  Businesses that are at risk can ask to come under the protection of the Einstein program; for the time being Einstein is a start in the right direction in protecting critical infrastructure businesses.

“Einstein 2 is like a 1999 Mustang with a little rust,” said James Lewis, a cyber security expert and senior fellow at the Washington-based Center for Strategic and International Studies. “For some companies it isn’t a big deal, but for others who haven’t done much to secure their networks, it would be a good idea.”

There still exists considerable policy discussion as to who will administer this program to private industry.  One possible choice would be the Department of Homeland Security (DHS). There is no question that this needs to become as high a priority as the decision enabling the U.S. Cyber Command to lead the way for military cyber defense.  The risks to national security with an exposed private sector infrastructure are too high.

For more information about cyber, listen to an on-demand Webcast — “Sharing and Layering in Cyber Investigations“.