NS-TIC

Accepting Applications for Online Course Cyber Security Law and Policy

Course is October 1 to November 18, 2012

Once again, the Institute for National Security and Counter-Terrorism (INSCT) will be offering the online course "Cyber Security Law and Policy," which tackles one of the most critical national security threats of our time.

INSCT is an innovative interdisciplinary research center that addresses key national and international challenges of security, terrorism and counterterrorism, post-conflict reconstruction, and community resilience. Established at Syracuse University College of Law in 2003 through Director and Professor William C. Banks' vision, the Institute's mission is to advance student-based research, analytical proficiency, education, and public service on law and policy changes in the fields of national and international security.

Cyber Security Law and Policy is designed to exist at the cutting edge of the dynamic development of networked computers and their potential impact on national security. Students will delve into the critical debate regarding how best to balance upholding civil liberties while effectively addressing security challenges presented by the Internet age. The course, taught by Professor William Snyder, provides an invaluable benefit to mid-career professionals in both the public and private sectors, and engages students in a comprehensive dialogue and interdisciplinary study of the scope and gravity of the current and potential threats to U.S. interests in cyberspace.

Participation in this six-week course provides students with a balance of asynchronous sessions which can be done anytime and scheduled live sessions. Weekly discussions will be conducted in real time, providing students with an opportunity to discuss their thoughts and reflections with Professor Snyder and fellow students. No computer science expertise is required.

Continuing Education Units (CEUs) from Syracuse University as well as a Certificate of Completion through INSCT are available to those who complete the course. An application has been submitted for approval to award Continuing Legal Education (CLE) credit. Continuing education credit for specific professions may be available.

For all the details, check out our new web site for this course at www.cybersecuritylaw.us. An application packet is available there, or directly from this link.

For more information, please contact:

Marlene Diamond | Administrative Specialist
Institute for National Security and Counterterrorism (INSCT)
402 MacNaughton Hall
Syracuse University
Syracuse, New York, 13244
t 315.443.2284 e mhdiamon@law.syr.edu 

Thanks!

Keli Perrin | Assistant Director
Institute for National Security and Counterterrorism (INSCT)
Syracuse University

Accepting Applications for Online Course Cyber Security Law and Policy

NSTIC finalists notified: SecureIDNews

On 4/10, SecureIDNews reported that the National Institute of Standards and Technology (NIST) has notified 27 finalists of "grants that would pilot portions of the identity ecosystem for the [NSTIC]."  The article said that the finalists must decide whether to announce their status.  I'll keep my eyes open for any such announcements.  The finalists are likely made up of state and local government agencies, major companies, business start ups, and universities. 

From here, the finalists must submit full proposals to NIST by May 10th.  After that, NIST will choose 5 to 8 proposals that will receive a total of $10 million. 

A bit of background on NSTIC.

A new theory of digital identity - Risk - SC Magazine Australia

The March 14, 2012, edition of SC Magazine, Australian Edition, includes Part B of a two part series on “A New Theory of Digital Identity.”  Part A was entitled “Federated Identity: Easier said than done.”  Part B is entitled, “The Ecology and Natural History of Digital Identity,” and includes this view of the U.S. National Strategy for Trusted Identities in Cyberspace:

Truthfully, the ecosystem anticipated by The Laws of Identity and the National Strategy for Trusted Identities in Cyberspace (NSTIC; see http://www.nist.gov/nstic) is an elaborate IT architecture with predefined and often novel roles for all players. At the time of writing, NSTIC is far from complete, with many anticipating that special new legislation will be needed to allocate liability when using privately issued identities. Nobody yet knows if the system is sustainable by the private sector. The prefix “eco” is optimistic.

I think that is correct.

The entire article can be read at: A new theory of digital identity - Risk - SC Magazine Australia - Secure Business Intelligence .

NSTIC commits $2.5 million to build governance body | ZDNet

ZDNet reports on March 14, 2012, that the National Institute of Standards of Technology is offering grant money “to establish an independent steering committee led by the private sector that works in conjunction with the federal government to support” the National Strategy for Trusted Identities in Cyberspace, quoting  Jeremy Grant, senior executive adviser for identity management at NIST and the head of NSTIC Program Office.  According to the ZDNet:

The government’s national identity strategy is committing up to $2.5 million over the next two years to fund an organization that will establish and oversee a steering committee that is the linchpin to securing private- sector participation in its plan.

The full article from ZDNet can be found at: NSTIC commits $2.5 million to build governance body | ZDNet . The NIST’s “RECOMMENDATIONS FOR ESTABLISHING AN IDENTITY ECOSYSTEM  GOVERNANCE STRUCTURE,” dated February of 2012, are available in PDF format at http://www.nist.gov/nstic/2012-nstic-governance-recs.pdf . 

NSTIC Lives To Fight Another Day: FierceGovernmentIT

On November 20th, 2011, David Perera wrote for FierceGovernmentIT on the status of NSTIC.  Again, NSTIC is a nifty idea for an "online identity ecosystem" that would allow for the transition away from passwords and towards better cybersecurity.  Thankfully, President Obama decided to fund NSTIC to the tune of $16.5 million dollars.  There was some worry about NSTIC's demise.  Perera noted that the program had requested $24.5 million.

Hopefully we'll hear a bit more about NSTIC now...

NSTIC Planning Proceeding Despite Uncertain Funding: FierceGovernment

On October 24th, 2011, David Perara wrote for FierceGovernment on how NSTIC should still move forward with pilot programs in the current fiscal year despite uncertain funding.  This was according to Jeremy Grant, the senior executive advisor of the National Institute of Standards and Technology (NIST).  The House of Representative's 2012 NIST appropriations bill would give the agency no money for NSTIC pilots, while the Senate version of the bill would fund the program with $24 million.  Grant assumed that the money for the NSTIC pilot program would still come through despite the funding concerns. 

The pilot program refers to an NIST program that will seek to experiment with the identity ecosystem in certain government and private sectors.  Grant intends to set up multiple pilot programs that span multiple sectors including banking, online commerce, and state government.  Grant hopes that various industrial sectors will bid on the NSTIC pilot programs, allowing those companies to demonstrate that the identity ecoystem, in miniature, is indeed feasible. 

The source article can be found here.

NSTIC Lays Out a Compelling Identity Ecosystem Vision: WindowsITPro

On October 13th, 2011, Sean Deuby wrote for WindowsITPro on how NSTIC works, the concept of the identity ecosystem, and possible issues that need to be addressed in order to make NSTIC a reality.  Noting that even though our use of the web for sensitive transactions has grown dramatically, there's still many online transactions we can't perform because of the question of identity.  Phishing malware attacks and news stories about hacking always leaves the question "Is this person who he says he is?"  Unfortunately, passwords just aren't cutting it anymore.  As Jeremy Grant, manager of the NSTIC program office, likes to say, “We think the password is fundamentally insecure and needs to be shot.”

This is where NSTIC and the Identity Ecosystem comes in.  The Identity Ecosystem is a user-centric online environment made up of a set of agreed upon standards, policies, and technologies that support transactions ranging from fully authenticated to anonymous and high or low value.  NSTIC isn't necessarily a national ID system, but more of an acknowledgment that secure transactions on the Internet need a common framework that both identity providers and service providers agree to work within.  Moreover, NSTIC isn't inventing any new technology, but rather, using existing technology like smart cards and digital certificates to create a network supporting trust IDs that can be used by all parties.  The identity ecosystem could allow the consumer to make secure online transactions by using a smartphone.

Of course, the successful implementation of NSTIC would be a boon for businesses; with more online security, consumers would be more likely to do their business online, and new areas of online business like online healthcare could open up.  Further, Mr. Deuby notes that NSTIC would also have to be voluntary: "consumers must have choices for who they want as an identity provider, and consumer demand will encourage more identity providers and service providers to join the ecosystem."  However, NSTIC comes with its drawbacks.  First,  an identity ecosystem is far from deployment.  Second, the concept of creating identities warehouses raises both privacy concerns and the prospect of "hyper-identity theft" if someone were able to break into an identity provider.  Even so, Mr. Deuby finds that NSTIC is a vision of how things should be; the private sector just has to step it up and figure out how to make it a reality.

The source article can be found here.

White House Notes Progress of NSTIC

In an October 14, 2011 entry on the White House Blog, Cybersecurity Coordinator Howard Schmidt reports that the Federal Chief Information Officer has just issued a memorandum requiring Executive departments and agencies to “accept approved externally-issued credentials” as they upgrade certain websites.

Of particular note is the information that “Equifax, Google, PayPal, Symantec and Wave Systems” have all had “their credentialing solutions certified to meet Federal security and privacy requirements.”

Clearly implied, however, is disappointment that the private sector has not committed more fully to the National Strategy for Trusted Identities in Cyberspace:

To date, a handful of identity providers have undergone or are undergoing the Federal approval process. We are eager to see – particularly at the higher levels of credential assurance – a larger, vibrant pool of accredited identity providers to provide more choices for people and Federal agencies. … Now we look to the private sector to support our efforts and reap the collective benefits.

The full White House blog posting is appended, below.

In praise of chaos: The Economist

On October 1st, 2011, The Economist published two articles on the controversy surrounding government's attempts to control the internet.  Using the annual meeting of the Internet Governance Forum in Nairobi as a backdrop, the articles note how some governments want to transition away from the current “multi-stakeholder” approach to a more government-controlled internet.  The multi-stakeholder approach describes how the internet is chaotically governed by a hotch-potch of organisations, causing decision-making to be slow and often unpredictable.  The multi-stakeholder's founding fathers believed that more openness would be both more secure and better for innovation.

Until the early 2000s, most governments were happy—at least in Western countries where most internet users lived.  Yet as the internet has become a global medium, attitudes have changed.  Some governments are uncomfortable with the multi-stakeholder approach because they feel that the internet is too important, politically as well as economically, to continue to operate beyond the power of governments.  China and Russia want the United Nations General Assembly to adopt an “International Code of Conduct for Information Security", and India, Brazil and South Africa have called for a “new global body” to control the internet.

Source: The Economist

The debate has strengthened as a result of the Internet Corporation for Assigned Names and Numbers (ICANN), a body set up to manage the internet’s address system.  Governments have long been unhappy with ICANN because it is not sufficiently transparent or accountable.  The tensions came to a head when the ICANN board moved last year to allow many more “generic top-level domains” as the controversial suffixes of web addresses such as .xxx (see article) or .jesus.  The point being, if even ICANN cannot command the respect of its stakeholders, the entire multi-stakeholder model may be in danger.

However, the articles note that for whatever chaos the multi-stakeholder approach causes, "the shambles are a lot better than the alternative—which nearly always in this case means governments bringing the internet under their control."  The internet’s openness fosters two of its great virtues: encouraged innovation and resiliency to censorship.  Governments have a role to play in the internet, but they should not be allowed the final say; creeping state control would suffocate the internet.

The article "In praise of chaos" can be found here.

The article "A plaything of powerful nations" can be found here.

Your Online Driver’s License: NYT

On September 17th, 2011, Natasha Singer wrote for the New York Times about the National Strategy for Trusted Identities in Cyberspace (NSTIC).  Comparing NSTIC to a digital driver's license, Singer explained how NSTIC would make it so people have a simpler, safer way to prove who they are online with more than a flimsy password.  To do so, consumers would choose among trusted third parties — such as banks, technology companies or cellphone service providers — that verify certain personal information about them and issue them secure credentials to use in online transactions.  The system would allow Internet users to use the same secure credential on many Web sites; people could have their identity authenticator automatically confirm that they are old enough to sign up for Pandora without having to share their birthdate with Pandora.

However, authentication proponents and privacy advocates disagree about whether Internet IDs like NSTIC would actually heighten consumer protection.  Privacy advocates argue that identity verification online could make consumers more vulnerable because authentication companies would become "honey pots for hackers."  Lillie Coney, the associate director of the Electronic Privacy Information Center, noted that “You can have one key that opens every lock for everything you might need online in your daily life, or, would you rather have a key ring that would allow you to open some things but not others?”

However, Jeremy Grant (senior executive adviser for identity management at the National Institute of Standards and Technology) noted that no system is invulnerable.  Privacy concerns aside, better online identity authentication would improve the current situation where people use the same passwords for their e-mail, banking, and social network accounts.  Mr. Grant went on to compare weak security to flimsly locks on bathroom doors: “If we can get everyone to use a strong deadbolt instead of a flimsy bathroom door lock, you significantly improve the kind of security we have.”

The source article can be found here.