Homeland Security To Offer Free E-Mails With Cyberwarnings

Just two days after the MyDoom worm began choking E-mail traffic worldwide, the U.S. Department of Homeland Security on Wednesday launched an E-mail security-alert system aimed at warning both average computer users and technical experts about pending cyberthreats.

Dubbed the National Cyber Alert System, it will be operated by the national Computer Emergency Response Team.

Amit Yoran, director of the National Cyber Security Division of the Department of Homeland Security, said at a news conference that the system will provide information security best practices and how-to guides. The E-mail alerts will offer information about potential threats to systems, such as MyDoom and last year's Blaster and Slammer worms as well as software vulnerabilities that could put systems at-risk.

The alert system will augment existing security information services offered by security vendors such as Symantec Corp. and Internet Security Systems Inc. National cybersecurity officials say the government is in a position to offer vendor-neutral security warnings and tips because it's not in the business of selling security products.

The cyberalert system won't include a color-coded alert similar to the terror alert warning system used by Homeland Security.

The CERT Coordination Center, a federally funded information security watch group based at Carnegie Mellon University, is partnering with Homeland Security on the new initiative. CERT will continue to publish its CERT Advisories, and they will be an important part of the new cyberwarning system.

"It's a good first step, especially building awareness among home users," Gartner research director John Pescatore says. But he adds that the most important work facing Homeland Security is helping federal agencies become more secure. The department shouldn't simply rely on getting its message out only to consumers who sign up for the mailing lists, Pescatore says. "They should be getting this information on the major Web portals, such as AOL, MSN, Yahoo, and eBay," he says. "You could reach 120 million people and build Internet security awareness just by doing that."

CERT says improvements in its capabilities will improve the security warning information dispatched to the public. Improvements include new laboratory and testing facilities, enhanced communication networks, and expanded technical expertise, CERT says.

CERT has been tracking Internet security issues for more than 15 years; it began shortly after the infamous Internet worm written by Robert Morris was released on Nov. 2, 1988. That worm infected roughly 6,000 systems on the Internet.

More information about the cyberalert system can be found at www.us-cert.gov.