What is the best strategy for cybersecurity programs?

I have to say I think we should developing these types of protections in the world of
private networking first and then adapting to government use. Using the ASTM
International standard-creating process might be the way to go here. (For more info, go to http://www.astm.org) There's bound to be massive interest in a TRANSPARENT and UNIVERSALLY useful standard here. Now is not the time to do this in secret at a federal office.

Here's a snippet from the ASTM web page:
ASTM Committee E54 on Homeland Security Applications was formed in 2003. E54 meets twice each year, in January and June, with about 100 members attending three days of technical meetings. This Committee addresses issues related to standards and guidance materials for homeland security applications with specific focus on infrastructure protection, decontamination, security controls, threat and vulnerability assessment, and CBRNE sensors and detectors. It also is charged with the coordination of existing standardization (ASTM generated as well as external) related to homeland security needs. The Committee, with a membership of approximately 450, currently has its standards published in the Annual Book of ASTM Standards, Volume 15.08. E54 has 9 technical subcommittees that maintain jurisdiction over these standards. Information on this subcommittee structure and E54's portfolio of approved standards and Work Items under construction are available from the List of Subcommittees, Standards and Work Items below.

Industry experts question $6 billion Bush cybersecurity plan
By Jill R. Aitoro

A system that focuses on network protection will do little to fend off intruders, industry sources argue in response to reports that President Bush will allocate $6 billion in his 2009 budget to a cybersecurity project meant to shield communication networks from terrorists and hackers.

The Wall Street Journal reported on Monday that the administration plans to reduce access points from the Internet to government networks and better monitor intrusion attempts through the use of network sensors that detect suspicious patterns.

Once implemented in government, the program would be adapted to private networks. Former officials told The Wall Street Journal that the $6 billion would be the initial part of a potential total cost of $30 billion over seven years.

"Five years ago we needed this type of investment," said Howard Schmidt, president and CEO of R&H Security Consulting, former vice chairman of the president's Critical Infrastructure Protection Board and special adviser to the White House on cyberspace security. "Is it enough? Only time will tell, but it seems to be a good amount to deal with some of the issues we've identified for the past five years."

Full story: http://www.govexec.com/story_page.cfm?articleid=39150&dcn=e_gvet