[ISN] DHS vows to protect info on national database

[InfoSec News]

http://www.washingtontechnology.com/news/1_1/daily_news/27812-1.html

By Alice Lipowicz
Staff Writer
01/24/06

The Homeland Security Department has stepped up assurances that it
will maintain the confidentiality of critical infrastructure
information submitted to the National Asset Database, according to the
newly revised draft National Infrastructure Protection Plan Base Plan
version 2.0.

DHS will evaluate all requests to view the database and will grant
access only to select DHS employees and others on a "tightly
controlled, need-to-know" basis, the revised plan states.

The new language is set forth in the 234-page national infrastructure
protection plan distributed by DHS this week. The plan was delivered
by e-mail via NIPP at dhs.gov.

The plan establishes a work and time frame for assessing
vulnerabilities and risks and coordinating protections for 17 critical
infrastructure sectors, including IT and telecommunications.  
Cybersecurity is treated as a cross-sector responsibility. The
department will accept comments until Feb. 6.

DHS' assurances about database access appear to address concerns
raised by IT executives and others over protecting confidentiality of
the information they might submit on specific vulnerabilities within
their sectors.

One fear raised by IT industry members is that disclosing weak spots
in their own networks may result in leaks that can be exploited by
competitors.

"We've been concerned about what [DHS] can do to protect the IT
infrastructure information and how they can help protect the critical
assets," said Greg Garcia, vice president of information for the
Information Technology Association of America in Arlington, Va., who
is involved with the IT Sector Coordinating Council organization
efforts.

IT industry members have asked for "originator control" for specific
information they provide to the database, so they can be assured of
its protection, Garcia said. However, that term does not appear in the
new document.

Garcia, contacted today, said he was still reviewing the language
proposed by DHS to give access on a need-to-know basis and to selected
employees only.

The new plan version updates an earlier 175-page draft National
Infrastructure Protection Plan released in November 2005. It reflects
changes in response to nearly 7,000 public comments received on the
previous version, according to a statement from DHS officials.

The new document also contains more information on cybersecurity
initiatives, international cooperation and the goal of resilience.  
"Resilient" and "resiliency" are mentioned 26 times in the updated
plan versus 18 times in the initial draft.

Other changes include a new executive summary, clarification of
all-hazards linkages, and explanations of requirements pertaining to
the risk management framework, according to DHS in a statement.