Home / Blogs

The Role of a Cybersecurity Czar

For years now, there have been calls for a high-level cybersecurity official, preferably reporting directly to the president. This has never happened. Indeed, there is a lot of unhappiness in some circles that President Obama has not appointed anyone as “czar” (or czarina), despite the early fanfare about the 60-day cybersecurity review. There are many reasons why nothing has happened, I’m sure, up to and including high-level disagreement over the need for such a post. But another reason, I suspect, is that there are (at least) three different roles that need to be filled. The different roles have different needs and different responsibilities, but all are very difficult.

The first role is effectively as chief security officer for .gov. That is, the government—and I’m speaking of the civilian sector, not the military—has a vast IT complex. Securing any one part of the government is very hard; securing all of it may be impossible. The czar’s role, though, is to cadge, cajole, or coerce many different departments into doing something. Given how independent the departments are, it wouldn’t be easy. Presidential authority might help, but Truman predicted that Eisenhower would say “Do this! Do that! And nothing will happen”. A czar, by definition lower-level than the president, would have an even more frustrating time.

There have been attempts to set a single security policy for the government. The Federal Information Security Management Act (FISMA) tried it; unfortunately, it appears to have turned into yet another exercise in security by checklist. Beyond that, there’s a more subtle problem: a proper security posture is site- and application-specific. The requirements for securing, say, an informational web server are very different than what an EPA monitoring project might use when polling air quality sensors around the country. One size does not fit all; a centralized policy won’t work very well.

Some things, such as intrusion monitoring, might (or might not) be better off centralized. Detailed security policy is probably better off decentralized—if different departments will do it properly. The key to that is finding the right incentives, since we’re not dealing with profit-making organizations for which money is a suitable metric. That, I think, is the challenge for securing .gov. It is not clear that a high-level czar would help; one cannot enforce a policy if that policy doesn’t exist.

The second role I see for a cybersecurity czar is providing policy advice to the president. Cybersecurity (and cyber policy in general) are cross-cutting issues. Do you want a smart power grid? How will you secure the sensors, the actuators, and the computer systems that talk to them? Hunting cybercriminals? Is there a suitable agreement with the country they’re in? Improving education by providing computers to schools and libraries? How will these be secured? The president needs to hear advice on such issues, from someone with a very broad grasp of not just cybersecurity, but the fields in which there may be security concerns. There needs to be someone at a very high level advising the president on such issues, but should this advisor report directly to the president, or just be part of an office of science and technology policy?

The cybersecurity advisor has another big responsibility, though: devising a national strategy. What policies should the government pursue to help improve the overall security of computers in general? To give one example, many people have advocated a liability-based model: make vendors liable for for problems caused by their security flaws, and let the market work its magic. Is this a good idea? Someone needs to look into this in detail, and make a recommendation to the president. Others having suggested replacing the Internet with something newer and more secure. Will this help? What about broad, national initiatives, like electronic health records, where the security and privacy risks are pervasive? All of these have very deep implications; someone needs to advise the president about them. Again, though, at what level should this advice be given, directly to the president or at one remove?

The third major cybersecurity role is liason to the private sector. Most of the national computing capability is in private hands; what these organizations and people do has a great impact on the nation’s cybersecurity. Some changes can be accomplished by legislation or regulation, especially in critical infrastructure sectors; others, though, require persuasion. For example, suppose it was concluded that ubiquitous encryption would be a tremendous security advantage. The cybersecurity liason would try to jawbone vendors, web sites, etc., into implementing this. Does this need presidential access? It wouldn’t seem to, but as Theodore Roosevelt noted, the presidency is a bully pulpit; the further the cybersecurity liason is from the center of power, the less influence he or she would have.

These, then, are the three roles: government CSO, cybersecurity advisor, and cybersecurity liason. The first and last need the presidency’s power; the middle needs access. Is this one person, two, or three?

I’m certainly not privy to the debates going on inside the White House. I suspect, though, that some variant of the questions I’ve posed—the exact role and (especially for the CSO option) powers this person would have—are the reason for the delay. I also suspect that trying to combine all three roles in one position is counterproductive; the necessary skills are very different.

By Steven Bellovin, Professor of Computer Science at Columbia University

Bellovin is the co-author of Firewalls and Internet Security: Repelling the Wily Hacker, and holds several patents on cryptographic and network protocols. He has served on many National Research Council study committees, including those on information systems trustworthiness, the privacy implications of authentication technologies, and cybersecurity research needs.

Visit Page

Filed Under


Who was calling? Larry Seltzer  –  Nov 5, 2009 4:04 AM

For years now, there have been calls for a high-level cybersecurity official, preferably reporting directly to the president.

In fact, the main person calling for this in recent times was Obama himself in the campaign. He specifically promised to do so.:

As President, I’ll make cyber security the top priority that it should be in the 21st century. I’ll declare our cyber-infrastructure a strategic asset, and appoint a National Cyber Advisor who will report directly to me. We’ll coordinate efforts across the federal government, implement a truly national cyber-security policy, and tighten standards to secure information - from the networks that power the federal government, to the networks that you use in your personal lives.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byDNIB.com


Sponsored byVerisign

New TLDs

Sponsored byRadix

IPv4 Markets

Sponsored byIPv4.Global

Brand Protection

Sponsored byCSC

Domain Names

Sponsored byVerisign

Threat Intelligence

Sponsored byWhoisXML API