U.S. government unveils computer security standards

Information Management Journal, Sep/Oct 2002 by Swartz, Nikki

Research firm Gartner recently estimated that through 2005, 90 percent of computer attacks will use known security flaws for which a solution is available but has not been installed. To combat this problem, the U.S. government is releasing standards and a software program to help computer users and businesses configure their systems for maximum security against hackers and thieves.

It's a seal of approval for computers that comes in the form of a small program that probes machines for known security flaws and makes suggestions on how to eliminate holes used by hackers. The program will be available free to anyone and mandated for some federal agencies. The security standards were created for computers that run on the Microsoft Windows 2000 operating system.

All Department of Defense computers must meet the standards immediately, and the White House is considering whether to require the rest of the government to comply as well. Experts say the key to success will be extending the standards to home and business users, making them simple enough for the public to understand, and ensuring they stay ahead of increasingly sophisticated computer attackers. The effort has brought together some of the biggest names in business. Companies such as Intel Corp., Chevron, and Visa, helped create the standards and are encouraging their use.

Getting various government agencies to agree on one standard was no easy task. Experts at the Center for Internet Security, the National Security Agency, and Commerce's National Institute for Standards and Technology initially had three different proposals for standards. According to a White House advisor, the agencies wanted to make the standard easy enough for federal network engineers to make the changes. The government created the software tool that grades computer security so that all users, from engineers to top executives, can understand how secure their computers are and how to improve weaknesses.