A "cultural change" is needed in U.S. corporations to combat increasing computer security threats, a federal official said Tuesday at the University of Minnesota.
"The sophistication of cyberattacks has increased tremendously," said Ron Ross, a security expert from the National Institute of Standards and Technology (NIST) in Maryland. "And what we see more and more is that corporate people don't know they've got a problem until a breach happens."
That can't go on, Ross told the audience at the U's Technological Leadership Institute, where he unveiled new computer security guidelines. Private companies and government agencies need to create the job of high-level special security expert, he said, a person with the authority to make sure that enterprisewide computer systems are as secure as possible from the day they are built.
That position, officially called "systems security engineer," isn't a new job category, Ross said. But a person in that job today lacks the authority to make computer security a top priority.
"We need to raise their stature" so that they can be heard by IT decisionmakers and top management, he said.
Ross' U hosts agreed.
"Where these jobs exist in Minnesota corporations today, they are mostly at the bottom of the pyramid, and are seen as just techies," said Gopal Khanna, a senior fellow at the Technological Leadership Institute.
There's a high cost for ignoring these low-ranking security experts, said S. Massoud Amin, director of the Technological Leadership Institute. "Many corporate computer security jobs are done after a vulnerability is exploited. As a result, the corporations are often six months behind."
