Congress triples cyber security funding. (Up front: news, trends & analysis).

In November 2002, Congress passed a massive program that will triple spending on cyber security efforts by allocating nearly a billion dollars for research. The Senate approved the Cyber Security Research and Development Act (CSRDA), which hands colleges and universities about $900 million over the next five years to create security centers, recruit graduate students, and pay for research.

At a press conference after the vote, CSRDA's backers said the bill would help solve America's cyber security problems and convince more students to study related topics. Harris Miller, president of the Information Technology Association of America (ITAA), said companies that are members of the ITAA don't have enough people with the proper training to fill vacant tech jobs in the security field. The Bush administration is also putting together a set of guide-lines for businesses and individuals.

Most experts welcome the commitment and say it will enable research to develop new systems that are more resistant to attack and to better address the challenges of tomorrow. But critics have said the cyber security threat might be an occasion for shifting what are or should be private sector cost responsibilities to the government.

If President Bush signs CSRDA into law, the bill would, over a five-year period, give

* $275 million for post-doctoral and senior for work "related to the security of computer systems"

* $233 million for research grants in nine security-related areas, including cryptography, privacy, wireless security, and "enhancement of law enforcement ability to detect, investigate, and prosecute cyber-crimes, including those that involve piracy of intellectual property"

* $144 million to set up computer and network security research centers that will be designed to increase the "number and quality of computer and network security researchers and other professionals"

* $95 million in grants to colleges and universities to "establish and improve undergraduate and master's degree programs in computer and network security"

* $90 million to create traineeship programs for graduate students who pursue computer and network security research

* $32 million for research designed to improve the security of networks and pay for "multidisciplinary, long-term, high-risk research designed to improve the security of computer systems"

* $25 million for traineeship programs to encourage graduate students to "pursue academic careers in cyber security upon completion of doctoral degrees"

Clearly, there is a need for increased cyber security measures for both the government and corporate America. CERT, the computer-security institute at Carnegie Mellon University, said there were about 97,000 cyberattacks in 2002, up from fewer than 4,000 in 1998. That number is expected to increase again in 2003.

In 2002, the U.S. government flunked a computer-security review for the third consecutive year. Of 24 government agencies surveyed by the General Accounting Office, only three received a "C" or higher. Six agencies received lower grades than in 2000.

Similarly, the New York Times reported that, one year after 9/11, "few American businesses or organizations have responded with new measures to safeguard their computing systems from intruders." In a September 2002 CIO magazine survey of 279 information technology (IT) executives, 84 percent reported incidents of security breaches, viruses, and hoaxes that resulted in damage or loss in the past 12 months. On average, companies are allocating 7 to 8 percent of their total IT budget to security. When asked specifically about security budget allocation, IT professionals reported spending 36 percent on technology, 23 percent on staffing, 11 percent on consulting, 9 percent on policy, 9 percent on process, and 9 percent on education. The majority--63 percent of respondents--said they need to spend more on security, particularly on technology, user education, and dedicated security staff. When asked if their company needed to increase its security spending in 2003, 63 percent answered yes. However, according to high-technology analysis company Giga Information Group, money spent on security in 2002 was flat, and no turnaround is imminent.