Monthly Archive for September, 2009

So Dave Mortman wrote:

I don’t disagree with Adam that we need raw data. He’s absolutely right that without it, you can’t test models. What I was trying to get at was that, even though I would absolutely love to have access to more raw data to test my own theories, it just isn’t realistic to expect that sort of access in the legal and business environment we have today. So until things change, we have to figure out another way to get at the data.

First off, I don’t disagree with why Dave is going where he’s going, but I think it’s built on a mis-read of where we are, and a strategic error regardless.

Where we are: we do have raw data. It’s coming to us from unexpected sources, and we’re getting more of it day by day. We’d like more details, we’d like more consistency and we’d like more depth, and each of those will come.

But far more important is the strategic error of asking for something that isn’t the fullness of what we want, and the risk that the cover-up club will use it to avoid the real goal by talking about how much progress we’ve made sharing models.

You almost never get anything you don’t ask for. If we have a list of requests, the top of the list is data, data and data.

Further, I declare that this is a realistic request, and attach precisely the level of proof that the good Mr. Mortman did when asserting that “it just isn’t realistic.”

Not that I’m opposed to model sharing. We just need to recognize it for the poor substitute that it is, and keep our eyes on the real goal.

Speaking of where your eyes are, that’s Claire, she’s represented by Specs Model Management. And as the title says, quite distracting.

Over on his Guerilla CISO blog, Rybolov suggests that we ask the Data.gov folks for infosec data using their Suggest a data set page. It sounds like a good idea to me! I took his request and built on it. Rather than breaking the flow with quotes and edit marks, I’ll simply say the requests are mostly his work, the context mine.

I’d love feedback before I submit this next week.

Dear Data.gov,

Thank you for the opportunity to suggest data which would be in the public interest to release or make more available. I applaud your mission of improving and updating your site with a wide variety of data.

Today, the public is sorely lacking in data about information security outcomes, that is, what really goes wrong, and how often. The government gathers a great deal of data on federal enterprise security under FISMA and many regulations. It gathers a good deal of information about consumer issues at the FBI and FTC. It may seem that this sort of information falls under the sensitive data exemption which you call out on your suggestion page. I believe that’s not the case, and so before summarily rejecting this request, I ask that you consider the following.

First, it is understood that enterprise security is a challenge, and security failures are widespread. These range from tax records unsecured to sensitive plans showing up on peer to peer filesharing networks are widespread. A great many government security failures are documented in the DatalossDB.org, a project of the Open Security Foundation. It is disgraceful that hobbyists must comb through news reports to make this data available in a better way than Data.gov.

Second, security failings are consistent and not improving. Failings are documented as far back as a GAO report, “Computer Related Crimes in Federal Programs” submitted to Congress in April, 1976. Stripped of jargon and brands, and updated to reflect re-organizations of government departments, the issues and recommendations could be issued today and few people would notice. Data.gov could make available data about what goes wrong that would allow researchers and scientists to assess their advice. The importance of cyber-security has caused President Obama to dedicate a speech to it, order a 60 day special review, etc. The general availability of this data would support and enhance the President’s goals in securing cyber-space.

Third, some small subset of the data may represent on-going issues which are not yet remediated, rather than past issues which have been addressed. These are clearly sensitive, and drawing attention to them would have negative operational consequences. At the same time, there is a public interest in oversight and accountability, and I urge you to consider partial, redacted, or summarized data releases as you balance that sensitivity. For example, information on how many issues each department has open, how long they have been open, and how severe they are is unlikely to change the daily flood of attacks focusing on the Federal information infrastructure.

Therefore, most of the data I am requesting is not sensitive, and its rapid release serves an important public interest.

I am requesting:

Complete responses from the Departments and Agencies to the FISMA reporting requirements for FY2004-2009 based on OMB Memoranda 04-25, 05-15, 06-20, 07-19, 08-21, and 09-29.

Raw incident data for years 2005-2007 as reported to OMB and summarized in their report to Congress on FY2007 FISMA performance and published at http://www.whitehouse.gov/omb/inforeg/reports/2007_fisma_report.pdf

Raw incident data for years 2007 and later in any type and format which would allow a researcher to compile data similar to the Verizon Data Breach Incident Report available at http://www.verizonbusiness.com/resources/security/reports/2009_databreach_rp.pdf

Data collected by the FTC and/or FBI on identity theft, broken down by type and duration, making clear the differences between credit card and other short term thefts and SSN, drivers license, or other longer term impersonation.

This information is necessary for researchers to study the effectiveness of information security management techniques and regulatory schemes and for industry to propose changes to national-level information security management frameworks and legislation such as FISMA. This information for the most part has been released in a summary format to Congress and the release of the complete dataset on data.gov would greatly aid the information security community.