BankInfoSecurity.com - Information Security News, Regulations, & Education

Banking Information Security Blogs

Comments (1)

Read All Posts (106)

Hathaway Speech Lacks Substance

April 23, 2009 - Tom Field

Tom Field
She did a Geithner.

In making her first public appearance since delivering her long-awaited cybersecurity review to President Obama last week, Melissa Hathaway took to the stage at the RSA Conference in San Francisco on Wednesday. And she did exactly what Treasury Secretary Timothy Geithner was criticized for when he made his first public appearance to discuss how the Obama administration would tackle economic recovery.

When it came down to what scores of people lined up three-deep for 30 minutes to hear - specifics of Melissa Hathaway's recommendations to the President - she said nothing. 

She said nothing.

Oh, she had an amusing Mission Impossible-theme opening that drew some laughs, and she managed to find a tie-in to the conference theme, Edgar Allan Poe, by reading a selection of his work "A Dream."

But when it came down to what scores of people lined up three-deep for 30 minutes to hear - specifics of her recommendations to the President - she said nothing.

I take that back. She said this:

"After the President and his Administration have had an opportunity to carefully review our report, we will begin discussing the results publicly."

The problem is: The RSA crowd thought it was going to hear some of those results yesterday. After two weeks of buzz that Hathaway was going to be a last-minute keynote speaker - and within days of delivering her eagerly-awaited report - attendees were excited. Cybersecurity has been the buzz of the conference, and speakers stoked the anticipation, hinting in their own presentations that Hathaway's speech would steal the show.

Well, attendees might have felt ripped off, but not for all the right reasons.

Instead, all Hathaway really did was hint that she'd recommended that cybersecurity be headquartered in the White House. Not where in the White House, mind you, nor certainly how. But there.

After that, lacking any specifics to chew on, the crowd focused on the shortcomings of it all. Like Geithner before her, Hathaway fell victim to nitpicking. She stood stoically behind the podium for her entire speech. She read straight from loose papers. Didn't answer any questions. Made baffling references to Hollywood movies and Poe.

The reactions I heard as I left the auditorium?

"That was brutal!"

"It was bad!"

"She read a poem?!"

Mind you, not everyone was so critical. There were attendees who were pleased to see cybersecurity and the administration so high on each other's agendas.

"I think it was quite impressive to have Melissa with the seal of the POTUS on stage at RSA," says Randy Sabett, a Washington, D.C. attorney who served on the Cyber Security for the 44th Presidency commission. "As I've been telling people here, this reminds me of Pacino in Devil's Advocate telling Keanu 'This is our time.' In this case, this is the time for cybersecurity."

To be fair, it probably was unrealistic for anyone to think that Hathaway would come to the RSA Conference and offer up any specifics of a report the White House hasn't even commented on yet. No doubt, her hands were tied. As Sabett reminds me, "No one ... expected her to preempt the President."

But didn't the administration learn from the Geithner debacle? That sometimes, really, it's better to say nothing than to open your mouth and ... well, say nothing?

When Geithner made his gaffe, the market tanked. Thankfully, the nation's financial markets weren't keyed in on Hathaway's speech on Wednesday. But some of the world's greatest private-sector security minds were, and many of them left that auditorium with an overwhelming sense of being underwhelmed.

This may indeed be the time for cybersecurity. But if that's so, then it's also an unprecedented opportunity for the federal government to partner with the private sector to protect the critical information infrastructure. And you'd think the RSA show would be a great public stage upon which to build excitement for that partnership.

It's time to talk about something. And the Obama administration has to stop sending representatives out to talk about nothing.


digg del.icio.us reddit
Share
Print Print

Post a Comment

Please login or register to post a comment
Username:  
Password:
Remember Username?
Comments
Tom,

I think it's unrealistic to expect much substance to be revealed so early in this politically delicate cycle. Western Governments hesitate to intervene in cybersecurity. To move cybersecurity into the White House is in itself a significant move -- partly symbolic and partly practical. It will take a little while to sort out, and for fresh policy measures to be formulated for release.

If you're hungry for governmental announcements, look at the US Homeland Security Committee chairman's remarks at the recent CI hearings in Washington (http://hsc.house.gov/hearings/index.asp?ID=185):

"The payment card industry’s effort to shift risk appears to have contributed to our current state of insecurity, and I am concerned that as long as the card industry is writing the [PCI] Standards, we will never see a more secure system. We in Congress must seriously consider whether we can continue to rely on industry created and enforced standards, particularly if they are inadequate to address ongoing threats."

And the Cybersecurity subcommittee chairwoman opened the hearings with these stinging observations:

"The US is being blown away by security investments overseas, and our 1950’s era system is making us a weak link in the security chain. Magnetic stripe-based technology is outmoded and inherently less secure when compared to smart cards or other developing technologies. While I am deeply concerned about our security, the payment card industry and issuing banks should be ashamed about the current state of play and doing everything possible to immediately institute improvements in infrastructure."

This should shake things up a bit!

In my view, it's high time that PCI is exposed for the security consultants' gravy train that it really is. Since when did any audit stop concerted organised crime? What we need to combat cybercrime is better infrastructure, not more policies and audits, and there are signs that politicians now get this.
Posted by swilson@lockstep.com.au on April 23, 2009 @ 4:06 PM