Second, security measures to defeat denial of service attacks exist today and existed at the time of the attacks. CERT, SANS and the NIPC all put out alerts warning of denial of service attacks late last year. And the necessary security improvements subsequently made at the sites under attack were accomplished within hours. This is not to downplay the seriousness of those attacks, only to point out that security measures and warnings about denial of service attacks did exist at the time. Security protection against a range of threats always involves choices.
Every company doing business on the Internet faces such choices.
Third, the federal government deserves credit for identifying critical infrastructure protection as a national priority and has come forward with a structure and plans for how to achieve better computer security. The National Plan for Information Systems Protection devotes most of its attention to improving the security of government computer networks. Fourth, the corollary to this is that the real expertise on privately developed and operated networks resides in the private sector. As Vinton Cerf of MCI WorldCom pointed out to the Joint Economic Committee recently, these private sector companies also have the most to gain from improving Internet security. Microsoft agrees and believes that industry should take the lead.