Chapter 6: Why a National Strategy to Secure Cyberspace Is Important

---

Overview

IT managers have many concerns about cybersecurity, with 84 percent of those surveyed for this book stating that they believe that at some time in the future, terrorists will launch cyberattacks against the United States. Another 11 percent remained undecided about the potential threat of cyberattacks, while only 3 percent stated that they did not consider cyberattacks to be inevitable. (More details on the survey are shown in Chapter 2.)

The annual Computer Crime and Security Survey conducted by the Computer Security Institute (CSI) with the participation of the Computer Intrusion Squad of the San Francisco office of the FBI provides an annual look at the impact of computer crime in the United States. Respondents in those studies reported, among other things, that average annual total losses over the three years prior to 2000 were $120,240,180, while average annual losses during 2001 reached $377,828,700.

A CIO KnowPulse Poll of 170 CIOs conducted in fall 2001 revealed that the majority (67%) of CIOs is not very confident or not at all confident that law enforcement will provide their companies with sufficient advance warning of a threat to computer systems. Another 27 percent is somewhat confident, with only 2 percent feeling very confident, and 2 percent feeling extremely confident. While nearly one-half (49%) of CIOs have been given additional responsibility or accountability for security infrastructure since September 11, 2001, more than one-third (39%) still do not have cybersecurity experts on staff or contracted. Just under half (47%) will increase the company's budget for information security following the September 11, 2001, terrorist attacks on the United States.

This chapter explores why a national strategy to secure cyberspace is important to the United States. Areas covered include the following:

• The DHS cybersecurity organization

• The nature of information warfare

• The emergence of the blended threat

• Redefining cyberattacks in the age of terrorism

• Measuring the impact of cyberattacks

---