The rules are part of the “Vulnerabilities Equities Process,” which the Obama administration revamped in 2014 as a multiagency forum to debate whether and when to inform companies such as Microsoft and Juniper that the government has discovered or bought a software flaw that, if weaponized, could affect the security of their product. The Trump administration has mostly not altered the rules under which the government reaches a decision but is disclosing its process. Under the VEP, an “equities review board” of at least a dozen national security and civilian agencies will meet monthly — or more often, if a need arises — to discuss newly discovered vulnerabilities. Besides the NSA, the CIA and the FBI, the list includes the Treasury, Commerce and State departments, and the Office of Management and Budget. The priority is on disclosure, the policy states, to protect core Internet systems, the U.S. economy and critical infrastructure, unless there is “a demonstrable, overriding interest” in using the flaw for intelligence or law enforcement purposes. The government has long said that it discloses the vast majority — more than 90 percent — of the vulnerabilities it discovers or buys in products from defense contractors or other sellers. In recent years, that has amounted to more than 100 a year, according to people familiar with the process. But because the process was classified, the National Security Council, which runs the discussion, was never able to reveal any numbers. Now, Joyce said, the number of flaws disclosed and the number retained will be made public in an annual report. A classified version will be sent to Congress, he said.
Gary Edwards on 21 Jan 11The home business and small office sectors are leading the adoption of Cloud computing services, with business spending on Cloud services predicted to surpass $13 Billion by 2014. Cloud computing enables businesses to access computer servers and data storage over the Internet and internal networks, allowing them to lower data costs and move content more nimbly. One of the key concerns over adoption of Cloud services to date has been security issues. Recent research from the IT Governance Institute (ITGI) in the US suggested companies were holding back on Cloud investments over fears for the security of their data in the Cloud. Half of the 834 executives from 21 countries polled said they were delaying Cloud implementation because of security concerns, and over a third said they were waiting to get the full value from installed systems. Research by IDC confirmed this view, with organisations claiming identity management and access control over who has access to Cloud data was a worrying factor, along with governance issues over privacy and compliance of both Cloud data and apps. Nevertheless, the fast-growing trend has been seen to be boosting demand for infrastructure and fueling consolidation in the data-storage sector. According to the In-Stat report which forecasts trends in cloud computing and managed hosting spending in the US, the growth in Cloud Computing will be 'staggering', rising from a figure of less than 3 billion currently.
