Re:The 'cyber-attack' threat to London's Olympic ceremony
by _b8r0 on Monday July 08, 2013 @01:25PM
(#6007900)
> What GCHQ should be doing is working with infrastructure providers to make sure all their security software is up to date,
For Critical National Infrastructure this is handled through an organisation called CPNI[1], that runs information exchanges. Where data is regulated by the government's own security framework this is handled by the Cabinet Office[2] and by a section of GCHQ called CESG[3].
> deploying things like SELinux (one good thing the NSA has done)
Are you suggesting that GCHQ should go around installing SELinux on peoples' computers, or that they should tell others to do it? There's actually a pretty comprehensive (if typically bureaucractic) information assurance framework in use throughout .gov.uk.
> doing free pen-testing
CESG (part of GCHQ) have a full service catalogue and they do provide certification for private sector suppliers through the CESG CHECK Scheme[4].
> advising companies on how to architect critical networks and so on.
Again, that's more Cabinet-officey type stuff, but CESG does provide guidance in the form of Good Practice Guide (GPG) documents, here's[5] an example of one.
GCHQ does actually do a lot of good stuff, but Olympic power switch threat management probably isn't the best example.
For Critical National Infrastructure this is handled through an organisation called CPNI[1], that runs information exchanges. Where data is regulated by the government's own security framework this is handled by the Cabinet Office[2] and by a section of GCHQ called CESG[3].
> deploying things like SELinux (one good thing the NSA has done)
Are you suggesting that GCHQ should go around installing SELinux on peoples' computers, or that they should tell others to do it? There's actually a pretty comprehensive (if typically bureaucractic) information assurance framework in use throughout .gov.uk.
> doing free pen-testing
CESG (part of GCHQ) have a full service catalogue and they do provide certification for private sector suppliers through the CESG CHECK Scheme[4].
> advising companies on how to architect critical networks and so on.
Again, that's more Cabinet-officey type stuff, but CESG does provide guidance in the form of Good Practice Guide (GPG) documents, here's[5] an example of one.
GCHQ does actually do a lot of good stuff, but Olympic power switch threat management probably isn't the best example.
[1] - http://www.cpni.gov.uk/
[2] - https://www.gov.uk/government/publications/security-policy-f...
[3] - http://www.cesg.gov.uk/Pages/homepage.aspx
[4] - http://www.cesg.gov.uk/servicecatalogue/CHECK/Pages/index.as...
[5] - https://www.gov.uk/government/uploads/system/uploads/attachm...