General Accounting Office Says NIPC Must Step Up EffortsGeneral Accounting Office Says NIPC Must Step Up Efforts

Security professionals already knew that the National Infrastructure Protection Center has been largely ineffectual. Now the rest of the world knows it, too. In a wide-ranging critique released Tuesday, the General Accounting Office identified a number of shortcomings that the NIPC must overcome to be effective. The list of includes staff shortages, ineffective interagency reporting, and the FBI's reluctance to share sensitive information on potential cyber attacks.

Formed in 1998 to provide advance notice on possible security threats that could jeopardize the infrastructure of such critical industries as banking and finance, telecommunications, water, and energy, the NIPC has yet to offer the kind of buffer that was intended. For instance, the GAO report notes that the NIPC has issued 81 security alerts and other notices since its inception, but that all of the breaches already were under way by the time a notice was posted.

Bob Dacey, director of information security issues for the GAO, acknowledges that the NIPC's charter poses inherent challenges because of the difficulty in identifying potential cyber attacks--either viruses or coordinated attacks--before they occur. Dacey also says the NIPC should not take sole responsibility for making the system work. "They've got some significant challenges," he says, "and some of those are out of their control." Chief among those is establishing more formalized information-exchange practices between the NIPC and other federal agencies, including the FBI.

Gartner analyst John Pescatore says he supports the GAO's criticism of the NIPC. Pescatore says that until now, the NIPC has basically echoed alerts that security professionals had already discovered through other channels, such as Cert. "If we're going to devote public tax dollars to something like the NIPC, those dollars should be used on something private industry hasn't already done," he says. "It's had zero impact in increasing anybody's awareness. That's not a metric for success."