[Senate Hearing 111-667]
[From the U.S. Government Publishing Office]
S. Hrg. 111-667
CYBERSECURITY: NEXT STEPS TO PROTECT
OUR CRITICAL INFRASTRUCTURE
=======================================================================
HEARING
before the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED ELEVENTH CONGRESS
SECOND SESSION
__________
FEBRUARY 23, 2010
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
----------
U.S. GOVERNMENT PRINTING OFFICE
57-888 PDF WASHINGTON : 2010
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED ELEVENTH CONGRESS
SECOND SESSION
JOHN D. ROCKEFELLER IV, West Virginia, Chairman
DANIEL K. INOUYE, Hawaii KAY BAILEY HUTCHISON, Texas,
JOHN F. KERRY, Massachusetts Ranking
BYRON L. DORGAN, North Dakota OLYMPIA J. SNOWE, Maine
BARBARA BOXER, California JOHN ENSIGN, Nevada
BILL NELSON, Florida JIM DeMINT, South Carolina
MARIA CANTWELL, Washington JOHN THUNE, South Dakota
FRANK R. LAUTENBERG, New Jersey ROGER F. WICKER, Mississippi
MARK PRYOR, Arkansas GEORGE S. LeMIEUX, Florida
CLAIRE McCASKILL, Missouri JOHNNY ISAKSON, Georgia
AMY KLOBUCHAR, Minnesota DAVID VITTER, Louisiana
TOM UDALL, New Mexico SAM BROWNBACK, Kansas
MARK WARNER, Virginia MIKE JOHANNS, Nebraska
MARK BEGICH, Alaska
Ellen L. Doneski, Staff Director
James Reid, Deputy Staff Director
Bruce H. Andrews, General Counsel
Ann Begeman, Acting Republican Staff Director
Brian M. Hendricks, Republican General Counsel
Nick Rossi, Republican Chief Counsel
C O N T E N T S
----------
Page
Hearing held on February 23, 2010................................ 1
Statement of Senator Rockefeller................................. 1
Statement of Senator Snowe....................................... 3
Prepared statement........................................... 5
Statement of Senator Ensign...................................... 36
Statement of Senator Pryor....................................... 38
Statement of Senator Begich...................................... 41
Statement of Senator Klobuchar................................... 43
Statement of Senator Thune....................................... 47
Witnesses
Vice Admiral Michael McConnell, USN (Retired), Executive Vice
President, National Security Business, Booz Allen Hamilton..... 7
Prepared statement........................................... 10
James A. Lewis, Director and Senior Fellow, Technology and Public
Policy Program, Center for Strategic and International Studies. 12
Prepared statement........................................... 14
Scott Borg, Director and Chief Economist, U.S. Cyber Consequences
Unit........................................................... 17
Prepared statement........................................... 19
Mary Ann Davidson, Chief Security Officer, Oracle Corporation.... 21
Prepared statement........................................... 23
James Arden ``Jamie'' Barnett, Jr., Rear Admiral, USN (Retired),
Chief, Public Safety and Homeland Security Bureau, FCC......... 27
Prepared statement........................................... 29
Appendix
Hon. Tom Udall, U.S. Senator from New Mexico, prepared statement. 55
Written questions submitted by Vice Admiral Michael McConnell to:
Hon. John D. Rockefeller IV.................................. 55
Hon. Tom Udall............................................... 55
Response to written questions submitted by Dr. James A. Lewis to:
Hon. John D. Rockefeller IV.................................. 56
Hon. Tom Udall............................................... 57
Hon. John Ensign............................................. 57
Response to written questions submitted by Hon. John D.
Rockefeller IV to Scott Borg................................... 58
Response to written questions submitted by Mary Ann Davidson to:
Hon. John D. Rockefeller IV.................................. 60
Hon. Tom Udall............................................... 62
Hon. John Ensign............................................. 72
Response to written questions submitted by Rear Admiral James
Barnett, Jr. to:
Hon. John D. Rockefeller IV.................................. 75
Hon. John Ensign............................................. 77
CYBERSECURITY: NEXT STEPS TO PROTECT OUR CRITICAL INFRASTRUCTURE
----------
TUESDAY, FEBRUARY 23, 2010
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 2:40 p.m. in room
SR-253, Russell Senate Office Building, Hon. John D.
Rockefeller IV, Chairman of the Committee, presiding.
OPENING STATEMENT OF HON. JOHN D. ROCKEFELLER IV,
U.S. SENATOR FROM WEST VIRGINIA
The Chairman. Welcome, all. And this hearing will come to
order. And members will be coming in.
Before I give my opening statement, I just want to make
sure that everybody knows who is testifying. And Vice Admiral
Michael McConnell, U.S. Navy, Retired, Executive Vice President
of National Security Business, Booz Allen Hamilton. He and I
have done a lot of work together, including on FISA, other
matters. Dr. James Lewis, Director and Senior Fellow,
Technology and Public Policy Program Center for Strategic and
International Studies. And Dr. Lewis is there, working on his
computer, I think. Mr. Scott Borg, Director and Chief
Economist, U.S. Cyber Consequences Unit. And Rear Admiral James
Arden Barnett, Jr., Chief, Public Safety and Homeland Security
Bureau, Federal Communications Commission. I'm really glad
about that. And Ms. Mary Ann Davidson, Chief Security Officer,
Oracle Corporation. So, you're going to have some attention
focused on you today.
This Nation--is it OK if I proceed? OK. This Nation and its
citizens depend enormously on communication technologies in so
incredibly many ways every single day. Vast network expansions
have transformed virtually every aspect of our lives:
education, healthcare, how businesses grow, don't grow,
function, and the development of an interconnected, more
democratic conversation. Our government, our economy, our very
lives rely on technology that connects millions of people
around the world in real time and all the time. And yet, these
powerful networks also carry great risks which people, for the
most part, don't understand--understandably don't understand--
but are going to have to come to understand.
In recent years, hackers have attacked numerous Federal
agencies, key media outlets, large companies across the private
sector, targeting intellectual property, stealing valuable
information vital to our national and economic security.
What was it? An article I read in the paper, somebody from
DOD says, ``We're getting attacked every day, all day, 7 days a
week.'' And that's what they do. And these attacks are coming
with increasing regularity and increasing sophistication. A
major cyber attack could shut down our Nation's most critical
infrastructure: our power grid, telecommunications, financial
services; you just think of it, and they can do it--the basic
foundations on which our communities and families have been
built, in terms of all of their lives and who are trying to
have a future.
So, this hearing is a next step in examining the important
action we should be taking right now, as a government and as a
national economy, to harden our defenses and safeguard critical
infrastructure against a major cyber attack. Having said that
they're happening all the time, that would seem to be out of
order, but, you know, it needs--both need to be said.
Now, I understand it's no secret that cybersecurity is one
of my top securities; it isn't a secret, at least, to Olympia
Snowe and myself. As the former Chair of the Intelligence
Committee, and now Commerce, I know that it's both national
security and our economic security at stake. But, obviously,
I'm not alone. Many experts, business leaders, public
officials, including two of our former directors of national
intelligence, have pointed, time and time again, to
cybersecurity as this country's chief security problem.
President Obama called cyberspace a strategic national
asset. However, this very important point, critical to the
challenge we're discussing here today, unlike the other
strategic national assets, cyberspace is 85-percent owned and
controlled by private companies and individuals. That means
that no one--neither the Government nor the private sector--can
keep cyberspace secure on their own. Both must work together.
All must work together. And that is why the wonderful Senator
Snowe, from Maine, and I have introduced comprehensive
legislation--the Cybersecurity Act 2009--to modernize the
relationship between the Government and the private sector on
cybersecurity.
And I have to say that on--there's--it's such a sensitive
subject, particularly with the private sector, that I--we were
on our fourth draft, because we kept calling in the
stakeholders. They kept saying, ``Well, this is wrong, this is
wrong, this is wrong.'' And so, we would adjust, and do another
one. I mean, we did it the way legislation should be developed.
Our legislation calls for developing a cybersecurity
strategy and identifying the key roles and responsibilities of
all the players, private and public, who will respond in a time
of crisis.
I'm sure you've all heard about last week's Cyber ShockWave
exercise. I watched. The process made it enormously clear; if
we are serious about responding effectively to real cyber
emergencies, we need a very strong top-level coordination. Too
much is at stake for us to pretend that today's outdated
cybersecurity policies are up to the task of protecting our
Nation and/or our economic infrastructure.
We have heard the reassurances and seen the best efforts of
the many in the private sector working to secure their
networks. But, it's clear that even the largest, most
sophisticated companies are not immune from attack. So, we have
to do better. And that means it will take a level of
coordination and sophistication to outmatch our adversaries and
minimize, as much as possible, the threats. So, it's that
simple. We can't wait; we've got to get going on this. We've
got to get people educated on it. And it's a massive, massive
undertaking.
I want to introduce, to speak first--one, because he has to
leave at 4 o'clock and, second, because he's kind of senior
around here--Admiral Mike McConnell, who, you know, was NSA,
DNI, private sector, and we worked together very closely on
FISA and other legislation.
So, I now call upon Admiral--I'm very aware that you have
to go----
Admiral McConnell. Yes, sir.
The Chairman.--and we will work that, and make it work.
But, Senator Snowe ranks here today.
No, but I want you to make an opening statement, if you
want to.
Well, John, that's a quandary. I mean, you know, Olympia
ought to make a little bit of an opening statement. You could
take a 3-minute opening statement.
STATEMENT OF HON. OLYMPIA J. SNOWE,
U.S. SENATOR FROM MAINE
Senator Snowe. OK. Thank you, Mr. Chairman, you're so
gracious and generous.
I also want to take this opportunity to commend you for
your extraordinary leadership on this paramount issue for the
security of our Nation. And I also want to extend my sincere
appreciation to our esteemed witnesses here today who represent
a combined depth and breadth of knowledge and experience to
provide invaluable insight into the multiple facets of this
threat posed by cyberintrusion and attack and how we should
mobilize as a nation to leverage both the public and the
private sector to confront this exceptional challenge.
As Senator Rockefeller indicated, we filed a comprehensive
cybersecurity bill, just a year ago, to accomplish that. We
have since had multiple drafts. We are trying to bring new,
high-level governmental attention to developing a fully
integrated, thoroughly coordinated public private partnership,
as we see this as the only means to address our Nation's 21st-
century vulnerability to cybercrime, global cyberespionage and
cyber attacks.
As crossover members of both the Intelligence Committee and
the Commerce Committee, Senator Rockefeller and I, are keenly
aware of the gravity of these circumstances and the astonishing
dimensions of this threat. Moreover, our legislation reflects
the recommendations of the Center for Strategic and
International Studies' Blue Ribbon Report that was issued to
the President. And the bill has undergone a number of
revisions, following literally hundreds of meetings with
industry and government thought leaders on this vital subject.
We sought to carve a course for our country to embrace a
national security policy that will protect and preserve
American cyberspace, which the President has rightly deemed a
strategic national asset, because it is simply undeniable that
the interconnection and integration of global systems, the very
backbone of our functioning modern society, creates myriad
opportunities for cyber attackers to disrupt communications,
electrical power, and other indisputably essential services.
And over the past several years, let there be no mistake,
cyberexploitation activity has grown more sophisticated, more
serious, and more targeted.
According to the Director of National Intelligence, Dennis
Blair, a burgeoning array of state and non-state adversaries
are increasingly targeting the Internet, telecommunications
networks, and computers. And we're being assaulted on an
unprecedented scale by well-resourced and persistent
adversaries seeking to gain a glimpse into America's mission-
critical vulnerabilities.
In an unclassified setting just 2 weeks ago, the Director
testified that the national security of the United States, our
economic prosperity, and the daily functioning of our
government are dependent on a dynamic public and private
information infrastructure that is now severely threatened. As
the Director also noted, the recent intrusions reported by
Google that appear to have originated in China should serve as
a wake-up call to those who have not taken this problem
seriously. That's why Senator Rockefeller and I have said that
our failure to implement effective policies and procedures to
prevent unauthorized intrusions have proven extremely
consequential. And if we fail to take swift action, we risk a
cybercalamity of epic proportions, with devastating
implications for our Nation.
We've already experienced breaches to our supply chains.
According to the SANS Institute, there have been several
incidents involving infected memory sticks sold in U.S. retail
stores. Furthermore, the FBI has alerted the Administration
that malevolent actors have actually begun selling counterfeit
networking equipment infected with viruses to consumers.
Indeed, government agencies, as well as the private sector, are
identifying an increasing number of security incidents.
According to Verizon, more electronic records were breached
last year than the previous 4 years combined, resulting in loss
of privacy, identity theft, and financial crimes. Today,
hijacked personal computers, known as ``botnets'' are used to
send spam or viruses. And all of this is done without the
owner's knowledge.
And just this week, according to a recently released report
from NetWitness, hackers gained access to data at close to
2,500 companies and government agencies, from credit card
transactions to intellectual property over the last 18 months,
in a coordinated global attack. In fact, it was described as
one of the largest and most sophisticated attacks, in the
Washington Post this month.
Then, according to a report drafted by the chief
information security officer of In-Q-Tel, the CIA's venture
capital arm, hackers currently charge about a penny for every
thousand e-mails of spam, and only $1 for a credit card that
includes every piece of information necessary to compromise
one's credit.
I commend the President for deeming cybersecurity a top
priority and recently naming Howard Schmidt, whom Senator
Rockefeller and I met with just a few weeks ago, as the
Administration's national cybersecurity coordinator. However,
we remain concerned that this position does not possess the
institutional heft that it requires. We would prefer and
recommend, in our legislation, a Cabinet-level, Senate-
confirmed national cyberadviser that reports directly to the
President and is directly accountable to the American people.
It is imperative that the public and private-sectors
marshal our collective forces in a collaborative and
complementary manner to confront this urgent threat and reduce
the risk posed by cyberintrusion or catastrophic cyber attack.
As part of this effort, we must identify incentives for the
private sector. Limiting liability for the companies that
improve their cybersecurity posture, improving threat
information-sharing, providing a safe harbor for exchanging
vulnerability data, as well as tax credits contingent on a
company complying with certain security practices, should all
be considered.
It is equally urgent that government take proactive steps,
always mindful of privacy concerns. The Government should work
with the private sector to recognize and promote cybersecurity
performance measures and best practices and develop a robust
workforce of cybersecurity professionals, promote innovation
and excellence in products and services, and institute a
campaign, as Senator Rockefeller has indicated, to educate the
public about cybersecurity risk, using the Government's
purchasing power, as well, to raise standards through
procurement.
Ultimately, we must recognize that time is not on our side,
and it's clear that our adversaries will continue to change
their tactics as technology evolves. Congress must take action.
I look forward to hearing from our distinguished witnesses
and working closely with the Chairman and all members of this
committee and others, and throughout the Congress, in order to
accomplish this goal this year.
Thank you.
[The prepared statement of Senator Snowe follows:]
Prepared Statement of Hon. Olympia J. Snowe, U.S. Senator from Maine
Thank you, Mr. Chairman, and I would like to take this opportunity
to commend you for your extraordinary and visionary leadership on this
paramount issue for the security of our Nation.
I also want to extend my sincere appreciation to our esteemed
witnesses for joining with us today. All of you bring to bear a
combined depth and breadth of knowledge and experience to provide
invaluable insight on the multiple facets of the threat posed by cyber
intrusion and attack, and how we should mobilize as a nation to
leverage both the private and public sector to confront this
exceptional challenge.
Indeed, Senator Rockefeller and I filed a comprehensive
cybersecurity bill almost a year ago to accomplish just that. We sought
to bring new high-level governmental attention to developing a fully
integrated, thoroughly coordinated public-private partnership as that
is the only way we can address our Nation's 21st century vulnerability
to cyber crime, global cyber espionage, and cyber attacks.
As crossover members of both the Intelligence and Commerce
committees, Senator Rockefeller and I are keenly aware of the gravity
as well as the astonishing dimensions of the threat. Moreover, our
legislation reflects the recommendations of the CSIS report to
President Obama, and the bill has undergone a number of revisions
following literally hundreds of meetings with industry and government
thought-leaders on this vital subject.
Senator Rockefeller and I sought to carve a course for our country
to embrace a national security policy that will protect and preserve
American cyberspace, which the President has rightly deemed a
``strategic national asset.'' Because it is simply undeniable that the
interconnection and integration of global systems--the very backbone of
our functioning modern society--creates myriad opportunities for cyber
attackers to disrupt communications, electrical power, and other
indisputably essential services. And over the past several years, let
there be no mistake--cyber exploitation activity has grown more
sophisticated . . . more targeted . . . and more serious.
According to Director of National Intelligence Dennis Blair, a
burgeoning array of state and non-state adversaries are increasingly
targeting the Internet . . . telecommunications networks . . . and
computers . . . and we are being assaulted on an unprecedented scale by
well-resourced and persistent adversaries seeking to gain a glimpse
into America's mission-critical vulnerabilities.
In an unclassified setting just 2 weeks ago, the Director testified
that ``the national security of the United States, our economic
prosperity, and the daily functioning of our government are dependent
on a dynamic public and private information infrastructure'' that is
now ``severely threatened.'' As the Director also noted, the recent
intrusions reported by Google that appear to have originated in China
should ``serve as a wake-up call to those who have not taken this
problem seriously.''
That is why Senator Rockefeller and I have said that our failure to
implement effective policies and procedures to prevent unauthorized
intrusion has proven extremely consequential, and if we fail to take
swift action, we risk a cyber-calamity of epic proportions with
devastating implications for our Nation.
We have already experienced breaches to our supply chain. According
to the SANS (Systems Admin, Audit, Network, and Security) Institute
there have been several incidents involving infected memory sticks sold
in U.S. retail stores. Furthermore, the FBI has reportedly alerted the
administration that malevolent actors have actually begun selling
counterfeit networking equipment infected with viruses to consumers.
Indeed, government agencies as well as the private sector are
identifying an increasing number of security incidents. According to
Verizon, more electronic records were breached last year than the
previous 4 years combined, resulting in loss of privacy, identity
theft, and financial crimes. Today, hijacked personal computers known
as botnets are used to send spam or viruses. And all of this is done
without the owner's knowledge.
Just this week, according to a recently released report from
Netwitness, hackers gained access to a data at close to 2,500 companies
and government agencies, from credit-card transactions to intellectual
property, over the last 18 months in a coordinated global attack. Then,
according to a report drafted by the Chief Information Security Officer
of In-Q-Tel, the CIA's venture capital arm, hackers currently charge
about a penny for every 1000 e-mails of spam and only about $1.00 for a
credit card that includes every piece of information necessary to
compromise one's credit!
As you all know, 85 percent of our vital infrastructure is owned
and operated by the private sector, and, according to a 2009 Verizon
report which examined data breaches at 45 major U.S. firms in 15
different industries, ``the average cost for a data breach reached an
eye-opening $6.75 million''--that's the cost to the average large
company every single day. Cyber attacks represent both a potential
national security and economic catastrophe.
I commend President Obama for deeming cybersecurity ``a top
priority'' and recently naming Howard Schmidt--whom Senator Rockefeller
and I met with a few weeks ago--as the administration's national
cybersecurity coordinator. However, we remain concerned that this
position still does not possess the institutional heft that it
requires, as the coordinator is not accountable to Congress and the
American people nor does he does report directly to the President--
significantly more can and must be done. It is imperative that public
and private sectors marshal our collective forces in a collaborative
and complementary manner to confront this urgent threat and reduce the
risk posed by cyber intrusion or a catastrophic cyber attack.
As part of this effort, we must identify incentives for the private
sector. Limiting liability for the companies that improve its
cybersecurity posture, improving threat information sharing, providing
a ``safe harbor'' for exchanging vulnerability data, as well as tax
credits contingent on a company complying with certain security
practices, should all be considered.
It is equally urgent that government takes proactive steps always
mindful though of privacy concerns. The government should work with the
private sector to recognize and promote cybersecurity performance
measures and best practices, develop a robust workforce of
cybersecurity professionals, promote innovation and excellence in
products and services, institute a campaign to educate the public about
cybersecurity risks, use the Government's purchasing power to raise
standards through procurement, and promote government and private
sector teamwork in emergency preparedness and response in the event of
a catastrophic cyber attack.
Ultimately, we must recognize that time is not on our side and it
is clear that our adversaries will continue to change their tactics as
technology evolves. Congress must take action--I look forward to
hearing from our distinguished witnesses and working closely with my
colleagues to implement a comprehensive cybersecurity strategy for our
Nation.
The Chairman. Thank you, Senator Snowe.
Admiral if you would present your testimony, please, and
then we'll go right on through.
I just want to point out that I--was it four years ago?
Five years ago?
Admiral McConnell. Three years ago, sir.
The Chairman. Three years ago----
Admiral McConnell. Yes, sir.
The Chairman.--that you took the entire Intelligence
Committee to an offsite place and spent a whole day on
cybersecurity.
Admiral McConnell. Right.
The Chairman. And you were so intense that day that I don't
think any of us were quite the same afterwards. And it was one
of those things that, you know, was a wake-up call that we
needed. You gave us amounts of information, and now we have
people on the Intelligence Committee who are following this
subject very closely.
We welcome you, sir.
STATEMENT OF VICE ADMIRAL MICHAEL McCONNELL,
USN (RETIRED), EXECUTIVE VICE PRESIDENT,
NATIONAL SECURITY BUSINESS, BOOZ ALLEN HAMILTON
Admiral McConnell. Thank you, Mr. Chairman, Senator Snowe,
members of the Committee. It's a pleasure to be here.
Let me first say I not only agree, I fully endorse and
verify everything that the two of you said in your opening
statements. Based on what I know, at a classified level, my
experience since being the Director of NSA in 1992, I've been
worrying about this issue and following it, and you're exactly
right. And thank you for your leadership as a forcing function.
Now, what I will attempt to do in some very brief comments
is put a sharper edge on it and then make some associations, on
a historical basis, about what we may need to do.
You asked me to talk to threat, actions to mitigate, and
public-private partnership. You mentioned that we're at
significant risk; let me make it sharper. If the Nation went to
war today in a cyberwar, we would lose. We would lose. We're
the most vulnerable. We're the most connected. We have the most
to lose. So, if we went to war today in a cyberwar, we would
lose.
As an intelligence officer, I'm often asked to make
predictions. I want to make three predictions for you:
The first is, we will not mitigate this risk. We'll talk
about it, we'll wave our arms, we'll have a bill, but we will
not mitigate this risk. And as a consequence of not mitigating
the risk, we're going to have a catastrophic event. In our
wonderful democracy, it usually takes a forcing function to
move us to action. And it is my belief, having followed this
from the early 1990s, it's going to take that catastrophic
event.
Now, my second prediction is, the Government's role is
going to dramatically change. It is going to be a very active
role in the future of telecommunications in this country and,
in fact, in global telecommunications.
My third prediction is, we're going to morph the Internet
from something that's referred to, generally, as ``dot-com'' to
something I would call ``dot-secure.'' It will be a new way of
communicating. Because when transactions move billions of
dollars, or when transactions route trains up and down the East
Coast or control electric power or touch our lives in the way
they do at such a significant level, the basic attributes of
security must be endorsed. And the first attribute of security
is not a scrambled text to protect a secret. The first
attribute is authentication; who's doing this transaction. If
it's a $10-billion transaction, don't you need to know for sure
who's conducting the transaction? The second attribute is data
integrity. You didn't move that decimal. The third is
nonrepudiation.
Now, the reason I pick it up that way is because, as the
Director of NSA, everybody knows the mission is to break code;
break the codes of potential adversaries, so we know their
secrets. The other mission of NSA is to make the code to
protect our secrets. And the attributes of security mostly are
in focus when you talk about nuclear weapons. So, if you're--if
you ever contemplated using nuclear weapons--heaven forbid, we
never do--authentication--order from the President--becomes the
single most important feature. Data integrity is the second
most important. Nonrepudiation is the third. So, thinking about
it that way changes one's perspective.
So, we're not going to do what we need to do. We're going
to have a catastrophic event. The Government's role is going to
change dramatically, and then we're going to go to a new
infrastructure.
Now, let me speak to the Government's role. I wanted to get
historical perspective, so I asked some of my associates to do
some research. And the astounding thing that we discovered is,
there is a technology cycle that runs about every 50 years.
Could be closer to 60, or maybe 40, but it's about every 50
years. Every time there's new technology, there's a rush to
invest, there's a frenzy, there's a period when there's a bust,
then there's strong intervention by the Government, and then it
settles out, going forward.
And the first example that I'll use is railroads. United
States has been the largest economy in the world since 1880.
Most people don't know that. We captured the Industrial
Revolution from the British. We laid rail coast-to-coast, and
our economy was off and running. What happened? The railroads
became so powerful they started to dictate to the Government.
So, what was the result? Antitrust legislation; break it up.
The Government's role changed very dramatically.
You can extend that argument to automobiles. Same argument.
When I was a child, 60,000 people a year died on the highway;
the population of the Nation was 150 million. Today, it's
30,000; our population is 300 million. What changed? The
Government's role significantly changed. Interstate highways,
for safety, guardrails, seatbelts, flashers, all the things
that industry was forced to do because it affected so many
people. So, in my view, the Internet--global communications,
moving money at the speed of light from Tokyo to New York, or
from New York to Singapore--billions of dollars--the
transportation systems of the world, the electric power grid of
the world--that is so significant that the Government's role is
going to change very dramatically. And I would predict we will
have a different Internet at some point in time.
Now, what are the things we have to do? International
agreements with partners and with competitors. Because it's in
the interest of China, as an example, to have a Net that's
secure, for which there's authentication, for which there's
data integrity, for which there's nonrepudiation features built
in. You can achieve that with mathematical certainty. It's a
simple function of applying the right kind of tools and
techniques and encryption. I would argue it's not in China's
self-interest to destabilize the U.S. money--money supply.
Now, what I really worry about today is, not a nation-
state. If we had a war with a nation-state, we would engage in
ground combat, maritime combat, air combat, space combat, and
cyberspace combat. That's not likely in our future. But, what
is likely in our future is a group that's not deterred, who
wishes to destroy the system, who has the technical
capability--because the cost of entry is pretty low--has the
technical capability to attack something. And I'll use the
money supply as an example.
I majored in Economics 101, way back as an undergraduate,
and I was astounded to learn there's no gold backing up all
those dollars. We left that standard in the 1930s. And then I
was astounded to learn that they're not even dollar bills
printed; there's--only about 6 percent of the value of the
country is actually in dollar bills. So, where's the value?
It's an accounting entry. And I believe the right kind of
talent could attack the global money supply.
As an example, our gross domestic product, on a yearly
basis, is 14 trillion--just over 14 trillion. Two banks in New
York move 7 trillion a day. So, if an extremist group with the
right kind of tools could scramble that data, they could
destroy confidence in global banking. New York is the banking
center of the world.
So, that's the risk. Will we be required to experience that
catastrophic event before we move to action?
I'll finish with just an example. Nuclear weapons are easy
to imagine, because there's the mushroom cloud and the
shockwave. When nuclear weapons happened, this Nation took
action to put the government in charge. There was a joint
committee of Congress to oversee it and fund it, and the law
said only the government could own things that were nuclear.
Now, that's mitigated over time. That committee was determined
to be unconstitutional, and we created the Department of
Energy, and it has gone on. We've got commercial nuclear energy
and so on. So, we learned over time to adjust to that.
If you take telecommunications and the Internet, it's
almost entirely in the private sector, and it's going in the
other direction. But, it has become so important and so
potentially significant, in my view, it rivals nuclear weapons,
in terms of potential damage to the country.
So, the government was hands-off to start. And if you look
at the evolution of the 50-year cycles, whether it was building
canals or textile machinery or railroads or automobiles, that
cycle repeated, where the government had a greater role when it
affected more people. And we're reaching that point now. So,
either we have a forcing function through a catastrophic event
or, hopefully, your bill will be law and we can have the
forcing function to deal with this in the way we must deal with
it. We must develop a deterrence policy, and we're probably
going to have to figure out how we engage in preemption, where
those that wish us harm cannot be deterred.
Mr. Chairman, that's my warm-up. I look forward to your
questions. Thank you very much.
[The prepared statement of Admiral McConnell follows:]
Prepared Statement of Vice Admiral Michael Mcconnell, USN (Retired),
Executive Vice President, National Security Business, Booz Allen
Hamilton
Introduction
Mr. Chairman, members of the Committee, thank you for the
opportunity to speak to the Committee on Commerce, Science, and
Transportation today.
First, I want to open with a simple statement:
If we were in a cyberwar today, the United States would lose.
This is not because we do not have talented people or cutting edge
technology; it is because we are simply the most dependent and the most
vulnerable. It is also because we have not made the national commitment
to understanding and securing cyberspace. While we are making progress:
the President's cyberspace policy review completed last May,
the appointment of the Cybersecurity Coordinator in
December, and
recent investments in the Comprehensive National
Cybersecurity Initiative (CNCI) are moves in the right
direction but
these moves are not enough.
The Federal Government will spend more each year on missile defense
than it does on Cybersecurity, despite the fact that we are attacked
thousands of times each day in cyberspace and we are vulnerable to
attacks of strategic significance, i.e., attacks that could destroy the
global financial system and compromise the future and prosperity of our
Nation. Securing cyberspace will require a more robust commitment in
terms of leadership, policies, legislation, and resources than has been
evident in the past.
Seizing Opportunity . . .
The cyber revolution has transformed our economy, enriched our
society, and enhanced our national security. The Information and
Communications Technology (ICT) sector contributes over $1 trillion to
our economy each year; ``smart'' electric grids promise to transform
our energy system; intelligent transportation systems are altering the
way we move and the way we manage commerce; electronic medical records
and telemedicine promise to reduce costs while improving quality. The
global financial sector relies on information technology to process and
clear transactions on the order trillions of dollars each day. To put
that in perspective, while the U.S. total GDP was just over $14T last
year, two banks in New York move over $7T per day in transactions.
Meanwhile, major investments in broadband--by both the government
and private sector--empowers small businesses and our citizens; digital
classrooms are changing the way our children are educated; and ``open
government'' initiatives make government data more accessible and
useable for business and individuals alike. Our military and security
services have benefited as well. The Department of Defense has
aggressively adopted network-centric operations, linking sensors,
commanders and operators in near-real time and providing the U.S. a
decisive advantage in the battlespace. The intelligence community and
homeland security have benefited from cyber technologies by improving
collaboration and information sharing across formerly impenetrable
organizational divides. In short, the microprocessor and Internet have
been as transformative as the steam engine and railroads in the 19th
century and as impactful as the internal combustion engine and
interstate highway system in the 20th century.
. . . Managing Risk
The reach and impact of cyberspace will accelerate over the next 10
years, as another billion users in China, India, Brazil, Russia,
Indonesia and Middle East gain access to the Internet. As a
consequence, cyberspace will be much more diverse, distributed, and
complex. As cyberspace becomes more critical to the day-to-day
functioning of business, society and government, the potential damage
from cyber attacks, system failures and data breaches will be more
severe.
In the early stages of cyberspace, the threat largely originated
from ``hackers'' who wanted to their test skills and demonstrate their
technical prowess. Criminal elements followed, resulting in attacks
against financial institutions, credit card accounts, ATMs for personal
gain. More sophisticated actors emerged as state-based intelligence and
security organizations developed robust exploitation and attack
capabilities as part of a larger national security strategy.
Recently, ``hactivists''--non-state actors mobilized in support of
a particular issue or motivated by patriotic reasons--have entered the
fray. Generally speaking, we know and understand these threats--their
capabilities and intentions.
However, of particular concern is the rise of non-state actors who
are motivated not by greed or a cause, but by those with a different
world view who wish to destroy the information infrastructure which
powers much of the modern world--the electric grid, the global
financial system, the electronic health care records, the
transportation networks.
Of increasing concern is that the sophistication of cyber attack
tools continues to increase at cyber speed, while the barriers to entry
continues to fall as attack tools proliferate in chat rooms, homepages,
and websites. The challenges we face are significant and will only
grow; our response must equally bold and decisive.
Recommendations for Cybersecurity
Despite the complex and seemingly unprecedented nature of the
challenge, there are some immediate actions we can take to secure
cyberspace and the future of our Nation.
Cyber Policy--The U.S. needs a long-term cyberspace strategy that
spells our specific goals and objectives and clarifies roles and
responsibilities across the Federal Government. This should be preceded
by a cyber equivalent to President's Eisenhower's ``Project Solarium''
in the early 1950s in developing the Nation's nuclear deterrence
policy. Today, we need a full and open discourse with a diverse group--
business, civil society, and government--on the challenges we face in
cyberspace. This dialogue should result in a strategic framework that
will guide our investments and shape our policies, both domestically
and internationally.
We need a national strategy for cyber that matches our national
strategy that guided us during the cold war, when the Soviet Union and
nuclear weapons posed an existential threat to the United States and
its allies. Cyber has become so important to the lives of our citizens
and the functioning of our economy that gone are the days when Silicon
Valley could say ``hands off' to a Government role. To offer historical
perspective on how the Government's role has increased in every case as
emerging technologies effect the Nation and greater numbers of our
citizens, I am attaching to this statement a review conducted by my
colleagues and I entitled ``The Road to Cyberpower.''
Cyber Operations--The Cybersecurity challenge to the Nation today
mirrors our response to counter terrorism after 9/11--a host of Federal
and state and local agencies, each with their own authorities,
missions, operations centers and information systems. The risk is that
we fail to learn the lessons around counterterrorism information
sharing and operations and create more silos by individual agencies,
potentially creating an atmosphere of bureaucratic rivalry and
duplicative investments. To that end, the U.S. should establish a
National Cybersecurity Center, modeled on the interagency National
Counter Terrorism Center (NCTC), that integrates elements of DoD's
proposed Cyber Command, DHS's National Cybersecurity and Communications
Integration Center (NCCIC), FBI's cyber operations, state and local
government, and the private sector. This center should operate at the
highest levels of classification for all members and serve as the hub
of information sharing and integration, situational awareness and
analysis, coordination and collaboration. Only sharing information
across all sectors will we be able to provide incident response across
all domains of cyberspace--.gov, .mil, and .com.
Such a center would utilize the legal authorities of each agency
while protecting privacy and civil liberties with appropriate oversight
by the Attorney General and the Congress. The center also could serve
as the information sharing and collaboration hub with our allies and
other Cybersecurity organizations, providing a single conduit for
outside entities.
Cyber Technology--The U.S. risks being left behind in Cybersecurity
technology. Currently, multiple organizations within the government and
private sector are focused on developing new technologies to protect
our networks, computer systems, data and applications. However, most of
the efforts are fragmented and sub-scale. The U.S. should approach this
challenge as we successfully addressed to the challenge to our
semiconductor industry in the 1980s through a public-private
partnership focused on Cybersecurity technologies.
The U.S. should establish a Cybersecurity Collaborative Consortia,
modeled after SEMATECH, a public-private partnership that supports
basic research and development and develops foundational technologies
and techniques of common concern--identity and access management,
secure networks, intrusion detection, dynamic defense, etc. Such an
organization should work closely with the National Institute of
Standards and Technology (NISI) and with the National Security Agency
(NSA) to define standards for Cybersecurity that could be used for
government, business, and individuals in both the public and private
sectors because there are no effective boundaries in cyberspace.
Cyber Human Capital--The U.S. needs a Cyber Education and Training
Initiative (akin to the National Defense Education Act of 1958 after
the launch of Sputnik) to build our national human capital base in
math, science and technology, electrical engineering, computer science,
and cybersecurity. Recent initiatives by Congress in programs like the
Federal Cybersecurity Scholarship for Service and the Information
Assurance Scholarship Program are a start, but need to be more
aggressively funded to build the expertise we need in cyberspace. As a
country, our vulnerabilities will only grow without a highly trained
workforce than can respond to the daunting cyber challenges and
opportunities of the 21st century.
Cyber Management--Current spending and oversight on Cyber is spread
among multiple accounts and dispersed over multiple committees in
Congress. It is difficult to understand the current level of investment
in cyber and evaluate the effectiveness of our investments given this
complexity and lack of transparency. OMB, working with Congress, should
identify Cybersecurity investments, develop performance criteria
aligned against a national cyber strategy, address the gaps and
eliminate duplicative or conflicting efforts, and improve
accountability for results. We can not spend our way out of this
challenge, prioritization, accountability, management and oversight are
key.
Summary
Cyber technologies offer unprecedented opportunities for the
nation; however, they also present significant risks to our
infrastructure, our financial systems, and our way of life. We
prevailed in the Cold War through strong leadership, clear policies,
strong alliances, and close integration of all elements of national
power--economic, military, and diplomatic--supported by a bi-partisan,
national consensus around containment and deterrence. We must do the
same with Cybersecurity.
The Chairman. Thank you, Admiral.
Dr. Lewis.
STATEMENT OF JAMES A. LEWIS, DIRECTOR AND SENIOR
FELLOW, TECHNOLOGY AND PUBLIC POLICY PROGRAM,
CENTER FOR STRATEGIC AND INTERNATIONAL STUDIES
Dr. Lewis. Thank you, Mr. Chairman, and I'd like to thank
the Committee for the opportunity to testify.
And I want to congratulate you on the Cybersecurity Act of
2010. This is a very important bill, and if it was passed, it
would make an immense improvement to our national security and
our economic well-being. The bill provides a broad rethinking
of our approach to cybersecurity and the role of government.
And a lot of what I'm going to say is going to sound a lot like
Admiral McConnell, which may be good, or not.
The people who pioneered cyberspace--the people who
originally designed it--they wanted governments to have a
limited role. They expected the Internet would be a self-
governing global commons. And they argued there were no borders
in cyberspace and that technology moved too fast for government
to intervene and that the old rules of business and national
security didn't apply. None of this was right.
People thought we would get a peaceful global commons.
Instead, we've got the Wild West. The Internet was not designed
to be secure. The rules and contracts put in place when it was
commercialized were not written with security in mind. The
result is a very Hobbesian environment; cyberspace is not safe.
So, the issue for me is, How do you bring law to the Wild
West? How to move from a do-it-yourself homebrew approach to
cybersecurity, and how to secure the digital global
infrastructure we now depend on. Legislation like the
Cybersecurity Act can play a crucial role in bringing needed
change.
You will hear--I think you've already heard--a litany of
criticism. You will be told the bill is not perfect. But, I
note that the Constitution says our goal is ``more perfect,''
not perfection. This bill would make cybersecurity more
perfect.
People will say that we cannot measure or certify
cybersecurity. This might explain why we're in such a mess.
But, I think we're now at the point where we're beginning to
collect data that shows what works; and if we can determine
what works, we can teach it and we can certify people to it.
Many will say that we should let the market fix
cybersecurity. I'm familiar with this one because I, myself,
wrote it in 1996, and I'm still waiting. The government needs
to give the market a kick.
There's a desire to say that the President should not have
authorities, during a crisis, to respond to the kind of cyber
attack that Admiral McConnell was talking about. I call this
the Hurricane Katrina approach to cybersecurity. There will be
complaints that cybersecurity will get in the way of
innovation. But, to build on the car metaphor, requiring safer
cars did not kill innovation in the automobile industry, or we
would still all be driving 1956 DeSotos.
Some claim the private sector can do a better job defending
networks than government. This is like saying we can rely on
the airlines to defend our airspace against enemy fighters.
Private companies will never be a match for foreign
intelligence service or foreign militaries.
But, moving to the policies we need for cybersecurity will
not be easy. In the past, when a new technology has come along
and reshaped business and warfare in society, it has taken the
United States decades to develop the rules it needed; the laws,
the judicial precedents, and the regulations that would
safeguard society.
The difference now is that we don't have decades to do
this. We're under attack every day, as you said. We're losing,
every day, vital secrets. We're at tremendous risk. If we had a
war, we would lose. So, we can't wait. You know, when it was
steam engines or automobiles or telephones, we could take 20 or
30 or 40 years to come up with the rules we needed. But, we
don't have that luxury now, right? Prompt action is necessary.
The prospects for growth and improvement in cyberspace
remain great, but to obtain these benefits, we need to close
the frontier, end the pioneer approach, say the Wild West is
over, and bring the rule of law to cyberspace. We need a new
framework for cybersecurity, and this bill helps provide it.
The work of this committee has really helped force the
debate in this issue, and so I really applaud you for it.
People have had to think hard about real serious issues. And I
hope, with that, that we see passage of the bill sometime this
year.
Thanks again for letting me testify, and I'll be happy to
take your questions.
[The prepared statement of Dr. Lewis follows:]
Prepared Statement of James A. Lewis, Director and Senior Fellow,
Technology and Public Policy Program, Center for Strategic and
International Studies
I would like to thank the Committee for this opportunity to testify
and I would like to congratulate it for its comprehensive
``Cybersecurity Act of 2009.''
This bill is important because it is a broad step to rethinking our
approach to the Internet, to cyberspace, and to the role of government.
The pioneers of cyberspace wanted governments to have a very
limited role. They expected a self-governing global commons to emerge,
and argued that there were no borders, that technology moved to fast,
that old rules of business and security did not apply. They expected a
global commons; instead they got the wild west. The Internet was not
designed to be secure; the rules and contracts put in place when it was
commercialized were not written with security in mind. The result is
Hobbesian, that is to say nasty and brutish, if not short. So the issue
for the Nation is how to bring law to the Wild West, how to move from a
do-it-yourself homebrew approach to cybersecurity, and how to secure a
global digital infrastructure upon which we now depend. Legislation
like the Cybersecurity Act 0f 2010 can play a crucial role.
Cybersecurity has become an important issue over the last decade as
the Internet changed to become a significant global infrastructure. The
U.S. in particular has woven computer networks into so many of its
economic activities that we are as reliant on the Internet as we are on
any other critical infrastructure. Networked activities can be cheaper
and more efficient, so companies large and small have migrated to the
Internet because it can provide competitive advantage. Our national
defense relies heavily upon networks. Networks reinforced existing
trends in military the realization that intangible factors--greater
knowledge, faster decisionmaking increased certainty--would increase
effectiveness of our military force.
That technologies designed in the early 1970s have worked so well
and have so cleanly scaled to support more than a billion users is an
amazing triumph, but anyone with malicious intent can easily exploit
these networks. The Internet was not designed to be a global
infrastructure upon which hundreds of millions of people would depend.
It was never designed to be secure. The early architects and thinkers
of cyberspace in the first flush of commercialization downplayed the
role of government. The vision was that cyberspace would be a global
commons led and shaped by private action, where a self-organizing
community could invent and create. This ideology of a self-organizing
global commons has shaped Internet policy and cybersecurity, but we
must now recognize that this pioneer approach is now inadequate.
There are two reasons for this inadequacy. First, private efforts
to secure networks will be always be overwhelmed by professional
military and criminal action. The private sector does not have the
capability to defeat an advanced opponent like the SRV or the PLA,
organizations that invest hundreds of millions of dollars and employ
thousands of people to defeat any defense. We do not expect airlines to
defend our airspace against enemy fighter planes and we should not
expect private companies to defend cyberspace against foreign
governments.
Second, absent government intervention, security may be
unachievable. Two ideas borrowed from economics help explain this--
public goods and market failure. Public goods are those that benefit
all of society but whose returns are difficult for any individual to
capture. Basic research is one public good that the market would not
adequately supply if government did not create incentives.
Cybersecurity is another such public good where market forces are
inadequate.
We talk about cyber attack and cyber war when we really should be
saying cyber espionage and cybercrime. Espionage and crime are not acts
of war. They are, however, daily occurrences on the Internet, with the
U.S. being the chief victim, and they have become a major source of
harm to national security. The greatest damage to the U.S. comes from
espionage, including economic espionage. We have lost more as a nation
to espionage than at any time since the 1940s. The damage is usually
not visible, but of course, the whole purpose of espionage is not to be
detected.
This is not cyberwar, Russia, China, and cybercriminals of all
types have no interest in disrupting Wall Street, the Internet, or the
American economy. There is too much to steal, so why would anyone close
off this gold mine. As with any good espionage exploit or mafia racket,
the perpetrators want stability, a low profile, and smooth operations
going so they can continue to reap the benefits.
There is a potential for cyber attack, but it is so far constrained
by political and technological barriers. Terrorists likely do not yet
have the advanced cyber capabilities needed to launch crippling
strikes. The alternative, that they have these capabilities but have
chosen for some reason not to use them, is ridiculous. There are
nations that could launch a crippling strike, but they are likely to do
son only as part of a larger armed conflict with the United States.
These nations do not love jihadis any more than we do, so they are
unlikely in the near future to transfer advanced cyber capabilities to
terrorists. Presumably, in the case of Russia and China their cyber
criminal proxies are also instructed not to take jihadi clients
(although there is one incident where it is alleged that Russian
hackers served as mercenaries for Hezbollah, against Israel). Should
any of these conditions change--the technological constraints that
limit terrorists and the political constraints that limit states and
advanced cyber criminals - the U.S. is in no position to defend itself
against cyber attack.
Short of armed conflict (over Taiwan or Georgia), China or Russia
are unlikely to use cyber strikes against the U.S. The political risk
is too high--it would be like sending a bomber or a missile against a
power plant, and the U.S. response would be vigorous. Our opponents,
however, have reportedly conducted reconnaissance missions against
critical infrastructure--the electrical grid, for example--to allow
them to strike if necessary in the event of conflict. Cyber attack is
cheaper and faster than a missile or plane, there is some chance that
the attacker can deny responsibility (because of the weak
authentication on the Internet). Right now, our opponents have the
advantage but it is within our capabilities to change this.
Getting this change requires a new approach. Many of the solutions
to the problem of cybersecurity our Nation has tried are well past
their sell-by date. Public-private partnerships, information sharing,
government-lead-by-example, self-regulation, and market-based solutions
are remedies we have try for more than a decade without success. These
policies overestimate incentives for private action and misalign
government and private sector responsibilities.
Like other new technologies in the past--airplanes, cars, steam
engines--the appeal and the benefits are so great that we have rushed
to adopt the Internet despite serious safety problems. These problems
are amplified by the global connectivity of the new infrastructure, as
the speed of Internet connections means that geographical distance
provides little in the way of protection. For those earlier
technologies, safety came about through innovation driven by government
mandates, and by agreements among nations. The same process of
development is necessary to secure cyberspace. The Cybersecurity Act of
2009 could play a vital role in this improvement.
This will not be an easy task. The United States does not like to
deal with market failure. This has been true since the earliest days of
the republic. Steam engines, although notoriously unsafe, had to wait
forty years until a series of savage accidents costing hundreds of live
led Congress to impose safety regulations. Automobile safety rules took
more than half a century and initially faced strong opposition from
manufacturers. The initial air safety regulations appeared only twenty-
three years after the first flight. There is the recurring hope that
``intellect and practical science,'' to quote a 19th Century
Congressional report explaining why regulation was unnecessary for
steamboats put it, will lead to improvement via some automatic and
self-correcting market process and without government intervention.
Just as cars were not built to be safe until government pressure
changed auto manufacturers' behavior, cyberspace will not be secure
until government forces improvement. Twelve years of reliance on
voluntary efforts and self-regulation have put us in an untenable
situation. Some may argue that a move away from the market or a greater
emphasis on security or a larger role for government will damage
innovation in cyberspace. This argument is in part a reflection of
competition among various bureaucracies, advanced to protect turf, but
is also reflects a misunderstanding of the nature of innovation. There
are grounds to be concerned about the ability of the U.S. to innovate
when compared to other nations, but the real obstacles are a weak
education system, poorly designed tax policies, damaging immigration
rules, and mis-investment that makes it hard to develop new
technologies and competitors. Removing these obstacles would be
politically difficult and face strong opposition. It is easier to
insist instead that keeping the Internet open and anonymous or bringing
broadband to undeserving areas will somehow generate growth. Greater
security is more likely to increase innovation, by reducing the loss of
intellectual property and by increasing demand for more valuable
Internet services.
Another reason put forward for not taking action is the supposedly
borderless nature of cyberspace. The pioneers of cyberspace wanted
their new creation to be a global commons, a shared space that no one
owns. The designers of the Internet built the network to reflect their
values, which were non-hierarchical and to a degree, anti-authoritarian
and anti-government. One of the original cyberspace theorists was also
a songwriter for the Grateful Dead, and it was he who issued the famous
Declaration of Independence of cyberspace, saying there was no room or
need for governments. Cyberspace would be a global commons where a
self-organizing community could invent and create.
This is an ill-conceived notion that continues to distort our
thinking. Cyberspace is an artificial construct produced by machines.
Those machines are all owned by individuals or organizations and all
exist in some physical location that is subject to the sovereign
control of some nation.
Cyberspace is like the public space in a shopping mall, a ``pseudo
commons'' or a condominium.
In some instances, of course, such as the Internet Engineering Task
Force or the Open Source Software Movement, this vision of an open,
nonhierarchical community has worked exceptionally well. But to use a
historical analogy, many of the pioneers of the Internet expected
Woodstock and the ``Summer of Love,'' instead they got Altamont and the
Hells Angels. The combination of unplanned global access, porous
technologies, and weak governance makes this newly critical
infrastructure exceptionally vulnerable. As our reliance as a nation
increases, so does our vulnerability to remote exploitation and perhaps
attack.
Cyberspace is not a global commons. It is a shared global
infrastructure. There is rarely a moment when a collection of bits
moving from one computer to another is not actually on a network that
someone owns and that is physically located in a sovereign state. The
exceptions might be undersea cables or satellite transmissions, but the
action still takes place on an owned facility were the owner is subject
to some country and its laws. At best, this could is a ``pseudo
commons.'' It looks like a commons but actually is not, as someone owns
the resources in question and that someone is subject to the laws of
some nation. Cyberspace is in fact a more like a condominium, where
there are many contiguous owners.
Governance of this condominium is both weak and fragmented. There
are no agreed rules, other than business contracts, and no
``condominium board,'' no process to develop rules. Action in
cyberspace takes place in a context defined by commercial law and
business contracts. When the United States commercialized the Internet,
it chose this legal construct accommodate business activity, but it is
inadequate for security, particularly as the Internet spread to
countries around the world and to nations with very different values
and laws.
The proposed legislation would go a long way to correct these
problems. To put the problem in a larger perspective, it is time to
move from the policies created in the pioneer phase of the Internet. It
is time to close the Wild West. This will require a broad rethinking of
American law and policy, and will require adapting to the technologies
we now depend on. It will need new kinds of international agreements,
new standards and rules for industry, and new approaches to the
professionalization of those who operate networks. This is no small
task but, judging from experience, it is inevitable. This process has
occurred before, often with help from the government. The Commerce
Department of the 1920s, for example, encouraged several major
industries, including the automotive and radio industries, to
standardize, to professionalize, and to create associations and rules
that serve the public interest.
A ``one size fits all'' strategy will not work. We will need to
manage international engagement, critical infrastructure regulation,
and economic stability all at the same time. Progress faces significant
obstacles. There are legitimate concerns over civil liberties. There
are strong business interests in avoiding regulation. And there are the
tattered remnants of a vision of cyberspace as some kind of utopian
frontier. Governance is a central issue for each of these. Governance
is the process for creating rules, resolving disputes, and ensuring
compliance. Our beliefs about the nature of cyberspace have downplayed
the role of formal governance and now we are paying the price. Changing
this, as we did for steamboats, cars and airplanes, is part of the
long-term process to adjust to new environment created by technological
change.
This bill contains many of the essential elements of the new
approach we need. A comprehensive national strategy that considers all
aspects of national security and puts forward along term vision for
cyberspace is an essential starting point for making this new
infrastructure secure. It will be essential, of course, to avoid merely
repeating the formulas of 1998 or 2003 in a new strategy. We've heard
repeatedly that there is a shortfall of individuals with the requisite
skills for cybersecurity. The scholarships, competitions and workforce
plans outlined in this bill would go a long way to repair this. The
legal review and the intelligence assessment are long overdue. The call
for the creations of a response and restoration developed with the
private sector that the President could implement in a crisis is
crucial for national defense.
As with any major piece of legislation, there will be considerable
criticism. Some of this criticism is ideological, some reflects self-
interest, and some is the result of a healthy skepticism as to our
ability to carry out some of the ambitious measures contained in the
bill. There was initially concern that emphasizing the authorities the
President already has to intervene in network operations during a
crisis would somehow give the ability to shut off the Internet. This
stemmed mainly from an inaccurate reading of the bill and perhaps from
the desire to preserve the notion of cyberspace as an untrammeled
commons where government has little or no role. Frankly, efforts to
deny the President adequate authority in a crisis are like expressing a
preference for Katrina-like disaster management. I hope we can do
better.
No one ever disagrees with the notion of more education, but the
more contentious aspect of the workforce development is the requirement
for certification and training. Being able to certify that someone has
the necessary skill and knowledge is a requisite part of
professionalization. We do this for doctors, lawyers, pilots, barbers,
plumbers and real estate agents. Some certification requirements are
Federal, many are developed by states. Many in the IT industry believe
that they are not ready for this step. Certification requires knowing
what is useful and necessary and being able teach it and test it. It is
on the former that there is disagreement--that we do not know what is
necessary for security.
This may have been true at one time but I believe it is changing.
In the last few years, as people have been able to collect more data on
security problems, to develop metrics, and to identify steps will
reduce risk, it is possible to think of a training program for
cybersecurity. This is part of a larger move from compliance drive
security, which has largely failed, to performance driven security. The
concept of a cybersecurity dashboard found in Section 203 reflects this
shift to a data driven approach to cybersecurity. The Act, if passed,
will accelerate the development and professionalization of those parts
of cyberspace that provide critical services to the Nation.
These are all politically difficult issues, but this situation is
not new. Every time a new technology has reshaped business, warfare and
society, there has been a lag in developing the rules--law, judicial
precedents, regulations--needed to safeguard society. Cyberspace is
different in its global scope and in the immediate nature of the damage
America suffers. Waiting for some natural process or perfect solution
not only puts our Nation at risk, it gives our opponents an advantage.
We would be well served if Congress passed this bill.
The Chairman. Thank you, sir.
Mr. Borg.
STATEMENT OF SCOTT BORG, DIRECTOR AND CHIEF ECONOMIST, U.S.
CYBER CONSEQUENCES UNIT
Mr. Borg. Thank you for inviting me.
My name is Scott Borg. Oh, I should turn this on. I'm the
Director of the U.S. Cyber Consequences Unit. This is an
independent, nonprofit, research institute that investigates
the economic and strategic consequences of cyber attacks. We
supply our results only to the U.S. Government and to the
public.
At the USCCU, I've had the privilege of leading an
extraordinary team of cybersecurity experts, economists, and
other investigators, many of whom have national reputations.
This team has included Warren Axelrod, John Bumgarner, Joel
Gordes, Ben Mazzotta, Michael Mylrea, Ardith Spence, Paul
Thompson, Charles Wheeler, and a number of others.
Since 2004, we have been visiting facilities in critical
infrastructure industries, and interviewing employees, to
determine what cyber attacks are actually possible and what
their consequences would be. We have been given access to the
business records of large critical infrastructure corporations
so that we could analyze their dependence on their suppliers
and their customers' dependence on them. We've developed
powerful conceptual frameworks and analytic tools for making
sense of this information.
There are three points I would like to make today. First,
cyber attacks are already damaging the American economy much
more than is generally recognized. Second, the biggest growth
opportunities for the American economy all depend on better
cybersecurity. Third, in order to get the improved
cybersecurity we urgently need, we must fix a number of broken
or missing markets.
The greatest damage to the American economy from cyber
attacks is due to massive thefts of business information. This
type of loss is delayed and hard to measure, but it is much
greater than the losses due to personal identity theft and the
associated credit card fraud. The reason the loss from
information theft is so great is that we really do operate in
an information economy. The amount of value a company can
create and capture is generally proportionate to the amount of
information that it can utilize that its global competitors
can't.
Education is economically important because it allows us to
create and apply more information. The greater portion of the
value, even in most manufactured goods, is not in the materials
from which things are made, but in the information they
contain. A modern automobile or airplane, from an economic
standpoint, is primarily an information product.
To understand what this means, think of how a company makes
money. It introduces a new product or a new feature, and
collects a premium from it until its competitors start offering
something comparable. Even after that, the company will
probably still be able to make a profit on that item because it
will know how to produce it for less. When a new production
facility opens, there will typically be a 5- to 15-percent drop
in costs each year for the first 3 to 6 years. This is because
the company is learning how to do everything more efficiently;
it's about information. The amount by which the company's costs
are lower than the costs of its competitors is normally all
profit.
Now think what happens if the company's information is
stolen. The period during which it can collect a premium will
be reduced to almost nothing, because the competitors will be
able to offer a comparable product almost right away. The
profits due to lower costs will be gone, because the
competitors will have all the detailed information that made
the greater efficiencies possible. The competitors' costs will
actually be lower than those of the victimized company, because
the competitors won't have the expense of creating the
information. Instead of collecting a healthy profit, the
victimized company might now be struggling to survive.
Most of the other factors allowing companies to prosper can
also be wiped out by information thefts. To get an idea of the
effect of information thefts on the larger economy, imagine
this sort of example multiplied thousands of times.
The biggest large-scale growth opportunities for the
American economy also depend on better cybersecurity. This is
because nearly all the more innovative ways of creating value
need information technology to be developed efficiently.
There are eight big growth opportunities that I've been
able to identify. I think you've been given a list of them.
These include things like the flexible re-allocation of
capacity, which lies behind the Smart Grid and cloud computing;
mobile information support, which boosts efficiency of tools
like electronic medical records; and smart products, which
allow products, such as smart phones, to increasingly contain
services. Examining this list reveals that each of these
opportunities requires networked computers, and is vulnerable
to cyber attacks. Awareness of this is the main thing that is
slowing down the implementation of many of these strategies.
And most of them could be brought to a screeching halt by a
greater awareness of the vulnerabilities they're introducing.
The solutions to these problems are not something that the
government can directly legislate into existence. The reason is
that both the information technology and the techniques
employed in cyber attacks are developing so rapidly. If the
government tries to mandate standards, they will be out of
date, and an actual impediment to better security, before they
can be applied. This is not like fire codes for building
constructions, where the big changes take decades. We don't
know what the minimum code of cybersecurity should look like 4
years from now.
If there's any area of the American economy that needs
creative entrepreneurial problem-solving, it is, therefore,
cybersecurity. Yet, our markets are currently not delivering
the improvements in cybersecurity at anything like the
necessary rate. In some cases, they are not delivering
improvements at all.
When markets are not functioning properly, there are
identifiable reasons. I think you've got a list of these
reasons; there happen to be six of them. Sometimes it's because
companies are not being charged for all of their costs or paid
for all the benefits they produce. Other times, the individual
agents are not adequately motivated to act in the long-term
best interests of their company. Still other times, there isn't
enough information available for good market choices.
Each of these market problems, each of these market
breakdowns, has possible remedies. It's these remedies to the
market failures that should be at the center of our discussion
of how to improve our cybersecurity.
Thank you.
[The prepared statement of Mr. Borg follows:]
Prepared Statement of Scott Borg, Director and Chief Economist,
U.S. Cyber Consequences Unit
Thank you for inviting me. My name is Scott Borg. I am the Director
of the U.S. Cyber Consequences Unit. This is an independent, non-profit
research institute that investigates the economic and strategic
consequences of cyber attacks. We supply our results only to the U.S.
Government and to the public. At the US-CCU, I have had the privilege
of leading an extraordinary team of cyber-security experts, economists,
and other investigators, many of whom are nationally famous in their
fields. This team has included Warren Axelrod, John Bumgarner, Joel
Gordes, Ben Mazzotta, Michael Mylrea, Ardith Spence, Paul Thompson,
Charles Wheeler, and a number of others. Since 2004, we have been
visiting facilities in critical infrastructure industries and
interviewing employees to determine what cyber attacks are actually
possible and what their effects would be. We have been given access to
the business records of large critical infrastructure corporations, so
that we could analyze their dependence on their suppliers and their
customers' dependence on them. We have developed powerful conceptual
frameworks and analytic tools for making sense of this information.
There are three points I would like to make today:
First, cyber attacks are already damaging the American economy
much more than is generally recognized.
Second, the biggest growth opportunities for the American
economy all depend on better cyber security.
Third, in order to get the improved cyber security we urgently
need, we must fix a number of broken or missing markets.
The greatest damage to the American economy from cyber attacks is
due to massive thefts of business information. This type of loss is
delayed and hard to measure, but it is much greater than the losses due
to personal identity theft and the associated credit card fraud. The
reason the loss from information theft is so great is that we really do
operate in an information economy. The amount of value a company can
create and capture is generally proportionate to the amount of
information it can utilize that its global competitors can't. Education
is economically important because it allows us to create and apply more
information. The greater portion of the value, even in most
manufactured goods, is not in the materials from which things are made,
but in the information they contain. A modern automobile or airplane,
from an economic standpoint, is primarily an information product.
To understand what this means, think of how a company makes money.
It introduces a new product or new feature and collects a premium for
it until its competitors start offering something comparable. Even
after that, the company will probably still be able to make a profit on
that item, because it will know how to produce it for less. When a new
production facility opens, there will typically be a five to fifteen
percent drop in costs each year for the first three to 6 years. This is
because the company is learning how to do everything more efficiently.
The amount by which the company's costs are lower than the costs of its
competitors is normally all profit.
Now think of what happens if the company's information is stolen.
The period during which it can collect a premium will be reduced to
almost nothing, because the competitors will be able to offer an
equivalent product right away. The profits due to lower costs will be
gone, because the competitors will have all the detailed information
that made the greater efficiencies possible. The competitors' costs
will actually be lower than those of the victimized company, because
the competitors won't have the expense of creating the information.
Instead of collecting a healthy profit, the victimized company might
now be struggling to survive.
Most of the other factors allowing companies to prosper can also be
wiped out by information thefts. To get an idea of the effect of
information thefts on the larger economy, imagine this sort of example
multiplied thousands of times.
The biggest large-scale growth opportunities for the American
economy also depend on better cyber security. This is because nearly
all of the more innovative ways of creating value need information
technology to be implemented efficiently.
There are eight big growth opportunities that I have been able to
identify. These include things like the Flexible Re-Allocation of
Capacity, which is what lies behind the smart grid and cloud computing,
Mobile Information Support, which boosts efficiency with tools like
electronic medical records, and Smart Products, which will allow
material products, such as smart phones, to increasingly ``contain
services.''
Examining this list reveals that each of these opportunities
requires networked computers and is vulnerable to cyber attacks. An
awareness of this is the main thing that has already been holding back
the adoption of practices like cloud computing. More important, nearly
all of these economic initiatives, including the smart grid and
electronic medical records, could be brought to a screeching halt by a
greater awareness of the vulnerabilities that they are introducing.
The solutions to these problems are not something that the
government can directly legislate into existence. The reason is that
both the information technology and the techniques employed in cyber
attacks are developing so rapidly. If the government tries to mandate
standards, they will be out of date--and an actual impediment to better
security--before they can be applied. This is not like fire codes in
building construction, where the big changes take decades. We don't
know what the minimum code for cyber security should look like 4 years
from now.
If there is any area of the American economy that needs creative,
entrepreneurial problem solving, it is therefore cyber security. Yet
our markets are not currently delivering improvements in cyber security
at anything like the necessary rate. In some cases, they are not
delivering improvements at all.
When markets are not functioning properly, there are identifiable
reasons. Sometimes companies are not being charged for all of their
costs or paid for all of the benefits they produce. Other times, the
individual agents are not adequately motivated to act in the long term
best interests of their company. Still other times, there isn't enough
information available for good market choices. There are six such
reasons altogether, and each suggests possible remedies. It is these
market remedies that should be at the center of our discussions on how
to save our economy from the destructive effects of cyber attacks.
Thank you.
The Chairman. Thank you, sir, very much.
And now Mary Ann Davidson, from Oracle, please.
STATEMENT OF MARY ANN DAVIDSON,
CHIEF SECURITY OFFICER, ORACLE CORPORATION
Ms. Davidson. Chairman Rockefeller and members of the
Committee, I'm Mary Ann Davidson, the Chief Security Officer
for Oracle.
I appreciate the opportunity to appear before you today,
and I want to commend the Committee for tackling the difficult
issue of cybersecurity and for including industry in the
drafting process of cybersecurity legislation, since
partnership between government and the private sector is
critical to secure our common infrastructure.
I have two specific recommendations to address the present
and future challenges of securing critical infrastructure.
First, we need to change the educational system so that we have
a cadre of people who know that critical cyberinfrastructure
will be attacked and to design and build accordingly and
defensively. Second, we need to stop upping the ante on
exposing critical infrastructure to, in some cases, large
systemic risk.
Some have proposed that we certify cybersecurity
professionals to improve the protection of critical
infrastructure. However, you can't secure something that was
not designed or built to be secure. Putting it differently, do
we certify interior decorators or the people who built the
house? It's architects and engineers and contractors who are
professionally licensed, not the people who move furniture
around and pick out color schemes, as important as that is.
Those who build software used in critical infrastructure do
not, in general, design and code defensively, because they're
not educated to do it. And yet, too many universities fiddle
while Rome burns, or at least fiddle while Rome is being
hacked. Several years ago, Oracle sent letters to the top
universities we recruit from, telling them that we spend
millions of dollars fixing avoidable, preventable coding errors
in software that creates security vulnerabilities. We have to
train all computer science graduates in how to write secure
code, because they were not taught this at universities.
Universities need to change their curricula to address this
clear and present deficiency. And the security of commercial
software has become a national security issue. Oracle received
precisely one response to this letter, and that was a request
for money. Is there a more tone-deaf response than that?
We must act now to change the educational system for all
computer science and computer-related degree programs,
including industrial control systems, so they include security
throughout the degree program. We should insist that
universities submit a plan to alter their curricula, and we
should link government research funding to phased change. If
parents can tell their toddlers that they don't get any dessert
until they eat their peas, the U.S. Government can certainly
tie monies to computer-related curricula change.
Something else we can do today is stop making cybersecurity
worse by using technology in ways we know very well we cannot
secure and that creates huge systemic risk. We need look no
further than the recent financial system meltdown in which
massive computer programs could quantify all kinds of risk
except the most important one: systemic risk.
One such area is Smart Grid, the idea that powerplants can
use near-realtime measurements on usage--devices in your home--
so we can price power better, be smarter about usage and build
fewer plants. Nobody is opposed to doing more with less,
unless, of course, the ``more'' includes a lot more risk.
And here's what we do know. We know we cannot secure
millions of IP-based clients; the millions of PCs that have
been co-opted into botnets are proof of that. We know that the
SCADA protocols used in control systems were not designed to be
attack resistant; they were originally used in
electromechanical systems, where you had to physically access
the control, turn the knob, and so on. Now we are increasingly
moving to IP-based control systems and connecting them to
corporate networks that, in turn, are connected to the
Internet.
We know that some Smart Grid devices are hackable. For
example, a prototype worm developed by a security research firm
was able, in a simulated attack--thank heavens--to spread from
meter to meter to take out power in more than 15,000 homes in
24 hours. We know that terrorists are increasingly interested
in targeting utility grids. We know that there are PDAs--
digital assistants--that talk SCADA, because it's just so
expensive to send a technician to the plant. Dare I say, move
the control rods in and out of the reactor? There's an app for
that. Will we one day scram a reactor when someone was merely
trying to answer the phone?
And last, we know that the people designing and building
these systems are not taught secure, defensive programming any
more than computer programmers are.
There are two things we can do now, and must do now. We
should insist on some standards, through existing standards
bodies, of Smart Grid components. NIST, for example, has led a
cybersecurity working group that recently released a second
draft of Smart Grid Cybersecurity Strategy and Requirements
document. Good on them.
Second, we need better transparency on how Smart Grid
components are built and of what they are built. There are some
mechanisms that can help establish this transparency, such as
the Common Criteria, which is ISO-standard, and the Department
of Homeland Security materials on improving software assurance
and acquisition.
Last, we do not think of the New Testament as a guide to
critical infrastructure protection, and yet, Jesus contrasted
the man who built his house on a rock with, quote, ``a foolish
man who built his house on sand.'' The rain came down, the
streams rose, and the winds blew and beat against that house,
and it fell with a great crash. The Gospel of Matthew.
This is an apt description of securing critical
infrastructure. If our infrastructure builders do not
understand the difference between building on rock and building
on sand, our house will collapse in the first good rainstorm.
Thank you, and I'll be happy to take your questions.
The Chairman. Thank you.
[The prepared statement of Ms. Davidson follows:]
Prepared Statement of Mary Ann Davidson, Chief Security Officer,
Oracle Corporation
Chairman Rockefeller, Ranking Member Hutchison, and members of the
Committee, I am Mary Ann Davidson, Chief Security Officer for Oracle. I
appreciate the opportunity to appear before you today, and I also want
to commend the committee for tackling the issue of cyber security--it's
a very tough and multi-faceted issue. I also want to thank the
committee for including industry in the drafting process of cyber
security legislation, partnership between government and the private
sector is critical for making our public infrastructure safe and
secure.
When many of us were young, we looked up to superheroes: Superman,
Batman, Aquaman and Wonder Woman: the people who could do almost
anything and were unstoppable (except--perhaps--by Kryptonite). When we
grow up, most of us realized that there are no superheroes: many
problems are very difficult to solve and require a lot of hard work by
a lot of smart people to fix. So it is with the security of critical
infrastructure: we cannot shine a signal in the sky and expect
SuperNerd to come and save us.
Many intelligent people have proposed a number of ways we can help
define the problem of critical infrastructure protection as it relates
to cybersecurity, ``bound'' the problem space and improve it. There are
two specific recommendations that may help stem the problems of the
present and change the dynamics of the future: both are necessary to
help secure not only today's but tomorrow's critical
cyberinfrastructure.
First, we need to change our collective mindset so that elements of
critical cyber infrastructure are designed, developed and delivered to
be secure. We do that in part by changing the educational system so
that we have a cadre of people who know that critical cyber
infrastructure will be attacked--and they build accordingly and
defensively. We do not generally think of the New Testament as a guide
to critical infrastructure protection, yet consider the parable of the
builders, in which Jesus contrasts the man who built his house on rock
with ``. . . a foolish man who built his house on sand. The rain came
down, the streams rose, and the winds blew and beat against that house,
and it fell with a great crash'' (Matthew 7:24-27). This parable is an
apt description of the problems in securing critical infrastructure: if
our infrastructure ``builders'' do not understand the difference
between building on rock and building on sand, our house will collapse
in the first good rainstorm.
The second recommendation is more straightforward: we need to stop
``upping the ante'' on exposing critical infrastructure to--in some
cases--unknowable risk--and we should walk away from the gambling
tables until we both understand the odds and the odds are better. What
we know now is that we continue to expose critical infrastructure to
the Internet in the interests of saving money, which massively
increases our attack surface, we do not, in many cases, know how
exposed we are, and we have determined enemies. ``Doubling down'' is
not a strategy--except a strategy for catastrophic loss.
Changing the Educational System
One of many cybersecurity risks the Department of Defense is
concerned with involves the supply chain of software--more
specifically, the risk that someone, somewhere will put something both
bad and undetectable in computer code that will allow enemies to attack
us more easily. However, that is but one type of supply chain risk we
should worry about and perhaps not even the most critical one. In fact,
``the software supply chain'' at a fundamental level includes the
people who design, code and build software. We should worry about the
supply chain of people as much or more than the supply chain of
software itself, because those who design, code and build software
don't know how to build it securely and the institutions--with some
notable exceptions--who educate them either don't know or do not care
to know how woefully inadequate their educational programs are. (Some
universities, of course, do care about security and have invested in
improving their computer science curricula accordingly. Kudos to them.)
If we were having a rash of bridge failures, and we discovered that
universities were failing to teach structural engineering to civil
engineers, we would not be discussing how to redesign tollbooths and
train tollbooth operators, or teach people how to drive safely on
bridges. Similarly, proposals to ``certify more cybersecurity
professionals'' is only a remedy for the cyber threats to critical
infrastructure if we understand the problem certifications attempt to
solve and ensure that we focus on the right set of professionals to
certify. This is especially true since ``cybersecurity professionals''
these days may well include Chad, the 12-year-old who installs anti-
virus on his technophobic grandparents' computer.
Several years ago Oracle sent letters to the top 10 or 12
universities we recruit from \1\--more specifically, to the chair of
the computer science (CS) (or equivalent) department and the dean of
the school in which the computer science department resided--telling
them that:
---------------------------------------------------------------------------
\1\ A heavily redacted form of this letter is available at http://
www.oracle.com/security/docs/mary-annletter.pdf and a larger discussion
of the supply chain ``personnel'' issue is available at http://
blogs.oracle.com/maryanndavidson/2008/04/the_supply_chain_problem.html.
a. We spent millions of dollars fixing avoidable, preventable
coding errors in software that lead to exploitable security
---------------------------------------------------------------------------
vulnerabilities;
b. We have to train CS graduates in how to write secure code
because they were not taught these skills in computer science
programs;
c. We need universities to change their curricula to address
this clear and present educational deficiency; and
d. The security of commercial software has become a national
security issue.
Oracle received precisely one response to these letters, and that
was a request for money to enable that university to create a ``secure
programming class.'' In the last 6 months, a representative that same
university--at a Department of Homeland Security Software Assurance
Forum no less--said publicly (and in apparent reference to the Oracle
letter) that his institutions' graduates were ``too good'' for vendors
like Oracle.
It's hard to imagine a more tone-deaf response to a ``customer''
request for a better ``product.''
Some have proposed that we certify ``cybersecurity professionals''
to improve the protection of our critical infrastructure. However,
certifying cybersecurity professionals--presuming we could define the
term precisely enough to avoid certifying absolutely everybody who
touches an information technology (IT)-based system--is too late in the
game. You can't secure something that was not designed to be secure or
that has holes big enough to drive the QEII through. Putting it
differently, in the physical world, do we certify interior decorators
or the people who build the house? It's architects, engineers and
contractors who are professionally licensed, not the people who move
furniture around and pick out color schemes. (No disrespect to security
administrators--or interior designers--is intended by this comparison;
the fact remains that cybersecurity professionals cannot necessarily
secure a system that was not designed to be secure.)
In the physical world, engineering degree programs are accredited
and engineering is a profession. Engineering graduates take the
engineer-in-training (EIT) exam--proof that they learned and absorbed
basic engineering principles in their degree program as part of their
career progression. Most who choose to actually practice the
engineering profession must become a licensed professional engineer
(PE). While it is true--as many academics are quick to point out--that
we understand the physics of, say, bridge design, and there are--as
yet--no ``physics'' of computer systems, that does not mean that we
should not expect people who are being educated in computer science to
know both what we know now, and what we do not know: specifically, how
to think about complexity and risk. At any rate, the fact that Oracle
and other large software vendors almost universally must teach the
basics of computer security to computer science graduates building IT-
based infrastructure should give all of us pause.
We know that embedding sound principles in curricula and
reinforcing those principles throughout a degree program works: this is
why physics is a ``core'' course for engineers and why civil engineers
cannot conveniently ignore physics in upper level classes. We also know
that an increasing number of professions involve computers and thus the
need for ``security''--embedded and reinforced throughout a number of
curricula and a number of classes within those curricula--is critical.
Control system design, for example, absolutely must include an
awareness of sound security principles or we will merely repeat the
mistakes we have already made. And yet, too many universities continue
to fiddle while Rome burns, or at least, fiddle while Rome is hacked.
A modest proposal in pursuit of curricula change would be to link
government research funding to phased educational reform in computer
and computer-related degree programs. That is, cutting off all money
until the curricula is fixed is counterproductive (as it penalizes
institutions that actually are making positive changes even if they are
not ``there'' yet). But we can certainly demand that universities
submit a plan to alter their curricula that includes specific delivery
dates for curricula change and insist that they make those changes as
delivered--or else. Currently, there is no forcing function to change
education. Many university professors are tenured and thus have no
incentive to ``cure.'' One of the few market forces we can exert is
money--such as grant money. If parents can tell their toddlers that
they don't get any dessert until they eat their peas, the U.S.
Government can certainly tie research funds to phased curricula change.
There are two additional reasons to--immediately and with some
urgency--forcefully impose curricula change on the universities that
deliver the pipeline of people building critical cyber-infrastructure.
The first is that we are already out of time: when the Soviet Union
launched Sputnik, it lit up the skies and lit up our eyes. The U.S.
rapidly moved to dramatically improve the science and technology focus
of our educational system so that we, too, could conquer space. As
regards cybersecurity, we have already had our Sputnik moment: in fact,
we in cybersecurity have such moments over and over, every single day.
The most damning comment one could make about the recent Google-China
headlines is that for those of us in industry, it was merely the
exclamation point on a long narrative, not an opening soliloquy.
The second reason is that everybody is looking for expertise to
secure what we have today--not to mention, what we are building in our
headlong rush to site critical infrastructure upon technical ``sand.''
For example, the Department of Homeland Security has stated that they
want to hire 1000 cybersecurity professionals.\2\ Where will they find
them? The military is standing up cyber commands \3\ and it seems
increasingly obvious that wars of the future will increasingly take
place in the cyber realm. Where are these future attackers and
defenders to come from?
---------------------------------------------------------------------------
\2\ http://www.cnn.com/2009/POLITICS/10/02/dhs.cybersecurity.jobs/
index.html.
\3\ http://www.informationweek.com/news/government/security/
showArticle.jhtml?articleID
=222600639.
---------------------------------------------------------------------------
In particular, the military views technology as a force multiplier
and their information systems increasingly form the background of their
ability to fight wars. What possible confidence can the military have
that the network elements on which they base their ability to prosecute
war can be trusted if the people who built them do not understand at a
very basic level that all software can and will be attacked? The people
designing and building software do not, in general, think, design and
code defensively because they are not educated to do it. We might as
well be turning out Marines who don't know that they have enemies, or
what a firefight is or what ``take the hill'' means. The results would
be and are predictable. Marines are lethal in no small part because
they know there are enemies, and they train to annihilate them.
Slow Our Exposure to Systemic Risk
There is an old saying that goes, ``quit while you are behind, and
when you are in a hole, don't dig.'' Nowhere is this truth more evident
than in our rush to increase the interconnectedness of critical
infrastructure and its exposure to the Internet--an exposure that
creates risks that we do not understand and thus cannot mitigate. We
embrace the interconnectedness because the benefits--and cost savings--
seem clear, but the risks are murky. No sensible person, of course,
should say that we cannot do anything that involves risk. Life is about
assuming risk.
That said, and as a cautionary tale of assuming risks we do not
understand, we need look no further than the recent financial system
meltdown in which massive computer programs could quantify all kinds of
risk except the most important one: systemic risk. The financial
superheroes ``in charge'' and the brilliant ``quants'' that were their
super-sidekicks got it wrong. Nobody really knew the degree to which
entity A was exposed to entity B and what would happen if the thread
between them was snipped. It turns out; systemic financial risk was the
Kryptonite that brought down Superman.
Alas, a lot of technophiles pushing new ``problems'' we need
sophisticated IT-based solutions for, or those eagerly embracing new
uses (and abuses) of technology, do not realize that everything--
including technology--has limits. The ``limits'' are not necessarily
those of bandwidth, or protocols we haven't invented yet. The most
important limitation is our inability to make rational, informed
decisions about risk because of complexities we simply cannot fathom.
In the many discussions on what the government can do to fix
cybersecurity, including ``spend more money on research,'' and
``certify cybersecurity professionals,'' it is worth noting that no
single proposal will ``save us,'' and certainly not any time soon.
There is, however, one thing we can do today: stop making cybersecurity
worse by rushing to use technology in ways we know very well we cannot
secure and that create huge systemic, unknown (and thus unmitigateable)
risk.
One such area is smart grid. The general idea, we are told, is to
allow power plants to: (a) get lots of near-real time measurements on
power consumption (e.g., from your house) to better price power
consumption accordingly and (b) do remote maintenance of grid elements
(e.g., deployed in your house). If we can do better demand pricing we
can build fewer plants and be ``smarter'' about power usage. Nobody is
necessarily opposed to ``do more with less'' premises, with one big
caveat: what if the ``more'' is ``more risk''--a lot more? More, in
fact, than we can fathom. What we know about smart grid should--if not
scare us--at least induce a very large gulp:
We already know we cannot secure millions of Internet
protocol (IP)-based clients: it's hard enough to secure
servers. The millions of PCs that have been co-opted into
botnets are proof enough of that.
We know that the SCADA (Supervisory Control and Data
Acquisition) protocols used in control systems were not
designed to be attack resistant: they were originally used in
electro-mechanical systems where you had to physically access
the control to use it (i.e., turn the knob).
We know people are increasingly moving to Internet protocol
(I P)-based control systems, and connecting them to corporate
networks that are, in turn, connected to the Internet. We thus
know that people can access controls for things they shouldn't
be able to from places they aren't supposed to be able to.\4\
---------------------------------------------------------------------------
\4\ http://www.c4-security.com/
The%20Dark%20Side%20of%20the%20Smart%20Grid%20-
%20Smart%20Meters%20%28in%29Security.pdf.
We know that many of the smart grid devices that have
already been deployed are hackable.\5\ For example, a prototype
worm developed by a security research firm was able--in a
simulated attack--to spread from meter to meter to take out
power in more than 15,000 homes in 24 hours.\6\
---------------------------------------------------------------------------
\5\ http://rdist.root.org/2010/02/15/reverse-engineering-a-smart-
meter/.
\6\ http://www.wired.com/threatlevel/2009/10/smartgrid.
We know that terrorists are increasingly interested in
targeting utility grids and in developing their hacking
expertise to be able to do so. \7\
---------------------------------------------------------------------------
\7\ http://www.scmagazineus.com/critical-condition-utility-
infrastructure/article/161689/.
We know that smart grid concepts are also starting to be
---------------------------------------------------------------------------
implemented in gas and water utilities.
We know that people have built personal digital assistants
(PDAs) that ``talk SCADA'' because ``it's so expensive to send
a technician to the plant.'' (It won't be long before we hear:
``Move the control rods in and out of the reactor? There's an
app for that!'' Some day we may have a power plant meltdown
when all someone was trying to do is answer the phone.)
And, last, we know that the people designing and building
these systems were never taught ``secure/defensive
programming'' any more than computer programmers were.
What we can infer from all the above is that the rush to ``save
money'' is being done by people who fundamentally do not understand
that they are vastly increasing the potential risk of a cyber attack
that can be launched from any home. Against the grid itself. In a way
that we do not know how to mitigate. In an increasingly hostile world.
If we think saving money on critical infrastructure is more important
than protecting it we might as well start sending the Marines into
combat with slingshots (so much cheaper than M 16s) and expecting them
to secure our Nation. Neither is acceptable, and both will involve
needless and senseless loss of life.
Before we keep trying to ``do more with less,'' let's take a deep
breath, step back and think seriously about worst cases and how we
avoid them in the first place. Hoping our enemies won't exploit a big
shiny new attack vector once we've deployed is not a strategy. Actually
minimizing the attack surface is.
There are a couple of things we can do to slow the lemming-like
rush over the smart grid cliff. One of them is to insist on some
standards (through existing standard setting bodies)--if not actual
certification--of smart grid components. N IST, for example, has led a
Cyber Security Working Group that recently released a second draft of
``Smart Grid Cyber Security Strategy and Requirements'' document.\8\
It's a start.
---------------------------------------------------------------------------
\8\ http://collaborate.nist.gov/twiki-sggrid/bin/view/SmartGrid/
NISTIR7628Feb2010.
---------------------------------------------------------------------------
Second, we need a better transparency around how ``smart grid''
components are built, and of what they are built--given a lot of the
underlying components may be commercial software that was not
necessarily designed for the threat environment in which it will be
deployed. It will also help those building critical infrastructure to
know how robust the ``building materials'' are. There are existing
mechanisms that can help establish that transparency, such as the
Common Criteria (International Standards Organization (ISO)-15408) and
the Department of Homeland Security (DHS) materials on improving
software assurance in acquisition.\9\
---------------------------------------------------------------------------
\9\ https://buildsecurityin.us-cert.gov/swa/downloads/
SwA_in_Acquisition_102208.pdf.
---------------------------------------------------------------------------
Without knowing how software was built, and what care was and was
not taken in development--we are building a house from components we
know nothing about and hoping the resultant structure is sound. It
isn't merely that a house built on sand cannot stand, it's that a house
built of ice won't survive in the tropics and a house built of some
types of wood won't survive in a termite-friendly environment. Without
knowing what components are being used in the house, how they were
designed and built--and with what assumptions--we have no idea whether
even a house built on rock is going to stick around for the long haul.
There are, after all, earthquake zones.
It may seem difficult to change the status quo, and yet we have to
believe in the capacity for positive change--even if that embraces a
clear and abrupt departure from the status quo. As the prophet Isaiah
said, ``Whether you turn to the right or to the left, your ears will
hear a voice behind you, saying, `This is the way; walk in it.' Then
you will defile your idols overlaid with silver and your images covered
with gold; you will throw them away . . . and say to them, `Away with
you!' '' So be it.
The Chairman. And, finally, Rear Admiral Barnett, Chief,
Public Safety and Homeland Security Bureau, Federal
Communications Commission.
STATEMENT OF JAMES ARDEN ``JAMIE'' BARNETT, JR., REAR ADMIRAL,
USN (RETIRED), CHIEF, PUBLIC SAFETY AND HOMELAND SECURITY
BUREAU, FCC
Admiral Barnett. Thank you, Mr. Chairman and distinguished
members of the Committee. Thank you for the opportunity to
testify on this important topic.
My remarks to you today are focused on the transformation
of communications by the Internet and broadband technologies,
the cyberthreat that transformation has engendered, and how the
role of the FCC to ensure communications is being invigorated
to meet the challenge of the cyberthreat.
Advanced broadband communication technologies have
dramatically changed to lives of Americans by enriching the way
that we communicate, learn, work, and live. Virtually all major
communication networks are now connected to the Internet; and,
for that reason, those communication networks are vulnerable to
cyber attacks.
Most cyber attacks target information systems attached to
communication networks--the edge or end-users--not the
communications infrastructure itself. Nonetheless,
communications infrastructures are not immune to cyber attacks,
and they have vulnerabilities. We should not have a false sense
of safety. A successful attack on communication networks could
have a severe or even catastrophic effect.
The FCC has an important role to play in securing broadband
communications infrastructures in conjunction with our Federal
partners. We are the congressionally mandated regulatory agency
with authority over communication providers and communication
networks, and we must face the new reality that cyberthreats
now imperil our communication networks.
When I came to--came aboard as the Chief of the Public
Safety and Homeland Security Bureau at the FCC, our Chairman,
Chairman Julius Genachowski, asked me to convene a working
group to examine the Commission's cybersecurity posture and
recommend courses of action. This group delivered a report to
the Chairman, and many of its recommendations will be addressed
in the National Broadband Plan that will be delivered to
Congress next month, in March. In the report, and in the
National Broadband Plan, we developed a roadmap to fulfill our
cybersecurity role and responsibilities. And I'd like to
address just a few points in that--from that roadmap.
First, the FCC can provide the Nation a much greater
situational awareness of the status and performance of the
Internet, including attacks, than it currently possesses. Many
of the owners and operators of the backbone of the Internet are
communications companies who are licensees of the FCC. One of
the reasons why the communications in America are so reliable
is that, under FCC rules, those licensees provide us with near-
realtime data on network outages and problems, so that we can
analyze that data and work on solutions. We also have a
successful voluntary program of reporting in times of disasters
and emergencies.
If these near-realtime outage and incident reporting
systems were extended to the Internet, the FCC could provide
the Nation with an enhanced situational awareness of attacks
and incidents and provide vital information for defense against
attacks and restoration of communications.
Second, there are things that FCC can do to prevent or
mitigate the effects of cyber attacks. For example, a previous
FCC Federal Advisory Committee, the Network Reliability and
Interoperability Council, or NRIC, developed a set of detailed
cybersecurity best practices that are intended to be
implemented by communication providers on a voluntary basis.
We're exploring the creation of a voluntary certification
program, possibly using these best practices as criteria to
provide network operators with additional incentives to improve
their cybersecurity posture. And we're also looking to other
voluntary incentives.
In December 2009, the FCC launched a new expert advisory
panel called the Communications Security Reliability and
Interoperability Council, or CSRIC, to examine and recommend
other cybersecurity solutions, such as how to stem the stream
of malware that arrives at our networks.
We're increasing our contacts with communication regulators
in other nations, since cyberspace and security are not local,
but are truly global. We're at the start of a long journey,
working with our Federal partners and with industry to secure
our Nation's vital infrastructure against new and rapidly
evolving threats. And, Chairman, we are determined to do so.
Thank you for your--the opportunity to testify.
[The prepared statement of Admiral Barnett follows:]
Prepared Statement of James Arden ``Jamie'' Barnett, Jr., Rear Admiral,
USN (Retired), Chief, Public Safety and Homeland Security Bureau, FCC
Senator Rockefeller, Ranking Member Hutchinson and distinguished
members of the Committee, thank you for the opportunity to testify on
the important topic of cyber security, and thank you for your
leadership in holding this hearing to address this urgent problem.
My remarks to you today are focused on the transformation of
communications by the Internet and broadband technologies, the cyber
threat that transformation has engendered, and how the traditional role
of the Federal Communications Commission to ensure communications is
being invigorated to meet the challenge of the cyber threat.
Advanced broadband communications technologies have dramatically
changed the lives of Americans and others around the globe by enriching
the way they communicate, learn, work and live. The Internet, which
relies on broadband communications infrastructure, is now a central
part of American interaction of all types. However, the manner in which
the Internet developed has left it exposed to cyber attacks.
Specifically, the Internet, which started as a small research network,
has evolved into a global network connecting over a billion people who
rely on it for social, economic, educational and political
applications, among others. The Internet's core design philosophy was
initially based on easy connectivity. The underlying Internet protocols
and architecture were not designed to be secure. As Internet usage has
increased and has become mainstreamed for everyday life, communications
providers have responded by adding features to improve the security of
their infrastructure and the services that ride on it.
As the public and private sectors continue to move toward more
online usage, bad actors, including criminals, have begun to lurk in
the shadows of cyberspace where they can launch costly attacks on end-
users. In 2008, the FBI Internet Crime Complaint Center logged $265
million in reported losses for Internet users, the highest loss ever
reported. No one is immune from attack, whether consumers, government
users or even our Nation's most sophisticated companies. Last year, it
was reported that ten to twenty terabytes of data were pilfered from
U.S. Government networks by a foreign entity, and in January Google
reported that it was subject to a sophisticated attack originating from
China. Reports show that at least ten other large companies, including
finance, media and chemical companies, have been the targets of similar
attacks. As attacks become more persistent, breaching computer systems
and establishing a foothold, these attackers are able to compromise
personal, confidential and classified information. We have seen the
effects of dedicated cyber attacks on Estonia and the Republic of
Georgia. Critical infrastructure sectors, such as energy, finance and
transportation, can all fall victim to these attacks.
All major communications networks are now connected to the
Internet, and for that reason, those communications networks are
vulnerable to cyber attacks. Most cyber attacks target information
systems attached to communications networks, the edge or end-users, not
the communications infrastructure itself. Cyber attackers currently
tend to view the communications infrastructure as the necessary
superhighway that will carry them to their victim. Accordingly, they
are reluctant to make it impassable.
Nonetheless, communications infrastructures are not immune to cyber
attacks, and they have known vulnerabilities. Accordingly, we should
not have a false sense of satisfaction with regard to the survivability
of our broadband infrastructure. A successful attack on communications
networks can affect all end-users that rely on broadband
infrastructure. For example, as 9-1-1 networks migrate from today's
technologies to Internet-based technologies concerns about the
vulnerability of these systems to cyber attacks have mounted. A
successful attack on such a network could severely obstruct the ability
of our first responders even knowing of emergencies.
We cannot allow the absence of a successful attack make us
complacent. The FCC has an important role to play in securing broadband
communications infrastructures. We are the Congressionally-mandated
regulatory agency with authority over communications providers and
communications networks. We must face the new reality that cyber threat
now imperils our communications networks and therefore our wellbeing
and even lives.
With the changing shape of the telecommunications infrastructure
and usage patterns, it is incumbent on the FCC to reassess our role in
cyber security. When I came aboard as Chief of the Public Safety and
Homeland Security Bureau, FCC Chairman Genachowski asked me to convene
a ninety-day working group to examine the Commission's cyber security
posture and recommend future courses of action. This group delivered
its report to the Chairman on November 30, 2009, and many of its
recommendations will be addressed in the National Broadband Plan that
will be submitted to Congress in March. Our Working Group report
demonstrates the critical role that the FCC has in cyber security, in
conjunction with its Federal partners. This report, in conjunction with
the National Broadband Plan, leads us to our plan to become further
engaged in cyber security. To this end, we have developed a roadmap in
which we plan to address cyber security utilizing our past experience,
technical expertise and our regulatory relationship with the FCC's
licensees to protect the communications infrastructure. I would like to
mention six major points from that roadmap.
First, we believe, based on past experience, that many cyber
security challenges can be met through public-private partnership
arrangements with industry. However, it would be ill-advised to assume
that intervention is not needed. In some cases, obligations may be
necessary. The Commission has a vital role to play in these situations,
and we will be working to craft a regulatory approach to cyber security
that strikes the right balance.
Second, we believe there are things the FCC can do to prevent or
mitigate the effects of cyber attacks. For example, recently, the
Network Reliability and Interoperability Council, an FCC Federal
advisory committee consisting of leading industry executives and
practioners, developed a set of detailed cyber security best practices
that are intended to be implemented by communications providers on a
voluntary basis.
We believe the opportunity exists for us to build on these best
practices to provide network operators additional ability to improve
their cyber security and to increase the adoption of these best
practices. A recent survey by PricewaterhouseCoopers found that
organizations following best practices experienced significantly lower
impact from cyber attacks, something that commercial industry should
find attractive. We believe that based on this survey that we should
explore methods, such as voluntary certification of compliance with
best practices that would create market-based incentives to increase
cyber security.
Third, we believe that a significant area for FCC involvement in
cyber security is to secure and analyze additional data received from
all broadband service providers concerning network and service
disruptions. However, our past experience in receiving data from
communications providers concerning disruptions in their networks has
been proven effective at providing us early warning of potential
problems and attacks on the Nation's existing communications
infrastructure. This information allows us, working with our Federal
partners and the communications industry, to expedite restoration of
service. Our work, which is based on a sector-wide view of
communications outages, also allows us to spot industry-wide or
carrier-specific reliability and security matters. We use this
information in conjunction with DHS and communications providers to
produce long-term improvements. For example, we recently observed a
statistically significant upward trend in the number of events
affecting wireline carriers. We worked with industry to establish a
team of experts who examined the data in closer detail and developed a
set of recommendations. In the intervening months we have measured a 28
percent decline in this category of outages. Obtaining similar
information from broadband and Internet service providers would enable
the FCC and its Federal partners to work with industry on sustained
improvements to Internet-based infrastructure. We are currently
examining the best path forward to obtain this information.
A fourth way in which we are exploring more active involvement in
cybersecurity is increase our ability to prepare reports which contains
situational awareness on broadband communications infrastructure during
disasters for use by our Federal partners, such as the Department of
Homeland Security (DHS). We currently gather such data for traditional
communications, and it has proven invaluable in emergency management
and communications restoration. Accordingly, we plan to coordinate with
DHS and communications providers in the near future to plan and
implement a cyber attack situational awareness system.
Fifth, another avenue we are pursuing is how to best address the
constant stream of malware arriving at the network, frequently from
end-users who are not aware that their systems are compromised. The
Commission has recently established an advisory committee, the
Communications Security, Reliability and Interoperability Council,
known as CSRIC. An important function of the Council is to examine this
problem and to recommend methods that communications providers can
implement to protect their networks from malicious traffic. We expect
to see reports from this Council in the near-term.
Sixth, and finally, cybersecurity is by nature international. The
networks are global, the threats are worldwide, and the human component
is universal. Through the State Department, the Commission participates
in various international activities and fora such as the United Nations
International Telecommunication Union (ITU) in which cyber security is
an issue. Cyber security is increasingly raised as an issue in
discussions with foreign regulators and at international meetings and
conferences, and the international aspects of cyber security is also a
more prevalent topic in the domestic arena. Going forward, there will
be increased need and opportunities for, greater FCC participation in
activities involving international aspects of cybersecurity--both in
the United States and abroad.
My intention has been to describe to you our vision of the FCC's
role in cyberspace and what we are doing to secure our critical
communications infrastructure in a broadband world. We are at the start
of a long journey, working with our Federal partners and industry, to
secure our Nation's vital infrastructure against a new and rapidly
evolving threat, and we are determined to do so.
Thank you for the opportunity to speak to you today.
The Chairman. Thank you very much, Admiral Barnett.
Let me ask the first question. The--this is directed to
Admiral McConnell and Mr. Borg and to Ms. Davidson.
You all talked, in various ways, about the need to have
people understand this at a very early age. You know, this--
they say, you know, kids are too fat these days, we ought to do
more exercise. Those things are--exercise is being cut out,
sports are being cut out, and sort of crowding the curriculum
is a really tough thing to do. On the other hand, if people
don't understand the threat of cybersecurity, it's all lose
from now on.
I made the point, Ms. Davidson, that 85 percent of the
critical infrastructure in this country are owned and
controlled by the private sector. And we found, as we were--at
least I found, as we were drafting this legislation, that
companies--I'm not saying Oracle; I'm not necessarily saying
big telecommunications companies--but, companies tended to
resist the idea of the government sort of getting in the way of
what they were already doing, which they felt to be adequate.
Now, my experience in general security with large companies,
and particularly like powerplants and chemical plants backed up
against rivers, and the rivers are patrolled by the Coast
Guard, except, of course, that there aren't enough boats or
people, so they're really not controlled by the Coast Guard, so
they're all vulnerable, but they say they're doing the job, and
thus, they--they're--you know, we had a lot of engagement with
industry. And so--and I look at your testimony here, Ms.
Davidson, and it's interesting, because I'm not sure what
you're saying. Your second recommendation, we need to stop
upping the ante, as you said, on exposing critical
infrastructure--in some cases, unknowable risk--and we should
walk away from the gambling tables until we both understand the
odds, and the odds are better. Doubling down is not a strategy,
except a strategy for catastrophic loss.
Now, what I'm--what I'd like the three of you to comment on
is, in that I think we all agree there has to be this
coordination between government and the private sector, are
you, in a sense, walking away, saying, ``We have to let time
pass so that people understand this problem better and kids--
it's part of their curriculum''? And--or are you not? And,
Admiral and Mr. Borg, if you could comment on this problem of
how--don't we have to take action really soon? But, then,
you've already said, whatever action--I think, Mr. Borg, you
did--whatever action we take is going to be outdated in 3 years
anyway. So, talk to me a little bit about this business of
cooperation, what we do. Is legislation any good? What do you
propose?
Admiral.
Admiral McConnell. Sir, let me use an example that touched
me personally. I'm old enough to remember Sputnik. And that
happened in 1957. And shortly after, the--an Act was passed. I
don't recall the exact name, something to the effect of the
National Defense Education Act. I went to college on that Act,
and it's likely I would not have gone to college except for
that Act. So, when I talk about an education bill--you heard in
my opening comments, I think the Nation reacts to two things:
crisis and money. Crisis will move us to act, money will move
us to act. So, if there is a bill that invests in the
youngsters of this Nation to make them smart about cyber and
cyber issues, and safe code, and secure code, and so on, I
think we will start to mitigate this problem.
I'll use an example. One of my colleagues is Gene--Dr. Gene
Spafford, at Purdue. Early mover, wonderful program, struggling
to keep it alive, because there's no interest or funding in it.
So, I think, since we react to crisis or money, that it's going
to take an investment, probably something on the order of the
National Security Education Act of 1958, for us to address this
problem. And if we do that, I think we'll make progress.
The Chairman. Will we make progress simply because people
grow up and go into business and go into government and,
therefore, work things out? Or----
Admiral McConnell. It's----
The Chairman.--it's a necessary starting point, no matter
what happens.
Admiral McConnell.--it is a necessary starting point. And,
for me, the example is, we put a man on the moon in 10 years.
So, Sputnik happened, the bill was passed, lots of engineers
and scientists and physicists, and so on, that were educated.
And when President Kennedy set it as a goal, then, 10 years, we
actually did it. So, for me, it's a necessary step to get us
started so we have the skill sets.
Now, one of the things I'm worry about is, we are
significantly outnumbered, in terms of population in China, in
India, and other places. So, we don't have a birthright to
intelligence. I mean, there are smart people all over the
world. It's an even distribution. And others are investing in
this in a major, major way. So, if we're going to compete and
be competitive and influence the world for a global standard in
cooperation in this arena, in my view, we have to produce the
electrical engineers, computer scientists, and other technical
talents that will allow us to do this.
The Chairman. OK. So, we--that is stipulated. I think there
would be no argument on that at all.
In this matter of cooperation between government and
business, and the point I raised, Ms. Davidson, about ``How do
I interpret what you said?''--I know that it was basically the
business community that came in and say, ``Look, we're fine. We
know what we're doing on this.'' I'm simplifying a little bit,
obviously. But, ``We don't need the government involved in
this.'' The Admiral and others are saying that the government
has to be involved in this, or else nothing really is going to
happen. And so, I don't--when you say ``walking away,'' I want
to know what you mean.
Ms. Davidson. What I meant by that was, there's an
expression, ``Quit while you're behind, and when you're in a
hole, don't dig.'' And the reason I use Smart Grid--and I was
very careful there; I didn't say, ``Oh, let's not do anything
that's insecure.'' You know, everything in life is about
assuming some risk. My concern is our failure to understand
systemic risk and going forward. And based on what we know
now--and all of those comments had footnotes to external
reports--what we see here is--this looks like we're assuming an
asymmetric risk we don't understand. I didn't say, ``Let's not
do more with less.''
The Chairman. But, you did say----
Ms. Davidson. ``Let's not make use of technology.''
The Chairman.--doubling down is not a strategy, except a
strategy for catastrophic loss.
Ms. Davidson. I did say that. And my comment was that we
continue to look at more ways we can use an IP-based backbone,
when we know, today, we cannot secure clients. And that's, on a
technical level, saying, ``OK, if I have to physically go in a
plant to turn a knob to do something bad, that's something I
can limit.'' If I'm now putting a device in everyone's home
that may or may not--that's the question mark--be appropriately
designed for a threat environment, you know, then I'm basically
saying, ``OK, now I've got a million ways to get into
something.'' Now----
The Chairman. Well, my----
Ms. Davidson. So, what I'm saying is----
The Chairman.--my time is----
Ms. Davidson.--is, let's understand--try to understand the
systemic risk. Let's look at how we actually impose enough
order that we understand what kind of risk we're assuming.
Right now, some of these devices have been hacked. We don't
know how they're built. We don't know whether--there is no
certification program for the devices. I have concerns about
that----
The Chairman. All right. Look----
Ms. Davidson.--based on just what I know.
The Chairman.--my time is out, OK? My time is out, and you
have to respect the rules of this committee.
I want to come back to you, because I don't think you've
answered the--my basic question. I think you've reaffirmed my
concern, ``Until people understand everything, or until
everything is prepared, don't act.'' Now, you do say you're
going to act in two ways, but I want to get back to that.
In the meantime, Senator Snowe.
Senator Snowe. Thank you, Mr. Chairman.
I guess it gets back to the question about, What will be
effective incentives for the private sector? I mean, if the
private sector owns and operates 85 percent of the
infrastructure, then obviously we have to concentrate on
providing the essential incentives for them to adapt.
What do you think would be effective private-market
incentives, and is that the appropriate focus? Should we compel
them? Should we create incentives, in terms of adopting best
practices versus mandating standards? What approach do you
believe we should take that would be the most effective in that
regard?
Admiral McConnell?
Admiral McConnell. What I attempted to do in my opening
remarks--to make the analogy that in those historical cycles,
we go through this each time. So, if we were having this
discussion about railroads and robber-barons, you know, way
back in the 1880s, those that were in the railroad business
would argue very strongly, ``We don't want the government
involved.'' So, what we did was have legislation to break it up
and regulate it, and so on.
So, the way I would think about it is, the current system
is not secure; and so, without prescribing exactly what the
answers are, it is a requirement to make it more secure. Now,
there is talent that exists to have that dialogue, and in a
constructive way. It will introduce tension in the system.
There will be those that argue that we shouldn't do this. There
will be those that say the Government's going to spy on its own
citizens, and so on. But, it is setting an objective to make it
secure, to achieve the basic elements of security--the basic
elements of making something secure, which I tried to
highlight, with authentication and so on. Those things are
essential when the transactions are of such significance they
affect a broad portion of the population.
So, I think, properly framed, we could create such a
framework that would cause us to move forward in that
direction. But, it would be required; it would be mandated.
Because industry is not going to embrace this unless they're
forced to do it.
Senator Snowe. Yes. Dr. Lewis? Dr. Borg?
Dr. Lewis. Let me--I was a regulator for 3 years, right?
And what I found is that most companies will try and do the
right thing, and some companies will always do the right thing,
and some companies will never do the right thing; and so, if
you don't compel them, you're not going to get the right thing.
And since this is a network, and they're all connected, if 10
percent don't do the right thing, then 100 percent could be
vulnerable.
So, incentives are great, but what I'd also say is, How do
you ensure compliance? And that leads me to a mandatory
approach.
Senator Snowe. Yes. Dr. Borg?
Mr. Borg. Yes, I urgently would like to talk about this,
but I hardly know where to start.
I think the government urgently needs to do something. I
think most of the things in your bill, broadly speaking, need
to be done. However, we have a lot of things here that aren't
working in the markets. Government intervention is needed to
help those things to work.
The sheet that I waved--that I held up--lists 21 things
that you could consider doing to help markets function better.
Some of those things you're already proposing to do; some of
them are already in your bill. But, there are many other ways
in which these markets are not working.
There's a tendency, left over from the Cold War, to think
that we have two choices where markets are concerned. One is to
be the commissar and dictate from the government what everybody
should do, and the other is to go, ``Whoopee, let's hope the
markets will do it on their own.''
In fact, markets are engineered into existence, and the way
they work is greatly shaped by government policy. Things that
the government decides about what kind of information should be
made available can hugely shape the way a market functions.
In this area, we have a number of markets where there's
insufficient information for any of the participants with the
best intention in the world to do the right thing; there is
just no way they can make the right choices, where
cybersecurity is concerned.
We have other situations where there are financial
impediments to them doing the right thing. I completely agree
with James Lewis, that we have a lot of people out there who
would do the right thing, but we shouldn't be penalizing them
for doing so.
We have other situations where people are ready to jump in
and supply the kind of security that is needed--supply products
that will provide the right security, but there are economic
impediments for them doing that.
So, there's a whole area here that needs to be--opened up
for discussion, a whole area of possible government action
that's really not being addressed.
Senator Snowe. Ms. Davidson, would you care to comment, or
Admiral Barnett?
Ms. Davidson. So, there are lots of ways to correct
markets--market imbalances. And, you know, we can talk, as a
public policy issue, about, Is this more effective or that more
effective, or is it regulatory or something else? One of the
things I have pushed for, because I think it could be
effective, is--and I believe I talked about this in the context
of Smart Grid, but I talked about it in a much larger context--
is a little more transparency around how people build their
software. Why is that important? Because at least the people
who are taking a piece of software that may not have been
designed for some particular purpose, but is general-purpose
software, need to understand what was done and not done. You
know, we know more about used cars than you do about a lot of
pieces of software that are used in really large systems. So,
at least forcing some transparency, which is what DHS was
trying to get at, would require someone to show, What did you
do, and not do, in development? My entire group--purpose in
living is to enforce compliance around our own organization
which is that transparency. You know, which groups do, and do
not do, particular things. And how we build software goes to a
security oversight board and it goes to our chief executive
officer. So, we know, at any point in time, here's where we
are, in terms of complying with our own development processes.
We state it is--what we believe are to be best practices.
Now, is that perfect? No. Does it mean that somebody, maybe
in the Defense Department, who's buying a piece of software and
going to deploy it in some system we have no knowledge of,
understands what they're getting and not getting?
Forcing transparency, by the way--it's a strange analogy--
it's the bathing-suit test. When someone puts on a bathing suit
around March, and they know they're going to go out in the
water in June, by and large, they're going to look at
themselves and say, ``I look terrible. I need to get a trainer,
cut out the carbs. I want to look good next to the three other
people at the beach.'' So, forcing more transparency actually
does elevate people's performance, in that you're probably
going to do no--more if you know that someone's looking over
your shoulder. It's not perfect; it won't cure everything, but
I think that, as part of that correcting that market imbalance,
is--people need to understand, ``You gave me a piece of
software. What does it do, and not do? How well does it do it?
And what did you engineer into this? And what were your
assumptions about how it was going to be used and who is going
to attack it?'' That's not perfect, but it's a good start.
Senator Snowe. Thank you.
Ms. Davidson. And the government could enforce that,
through procurement.
Admiral McConnell. Senator, could I offer one other----
Senator Snowe. Yes.
Admiral McConnell.--quick comment--example. In the late
1960s, early 1970s, the United States dominated the
semiconductor industry. At a point in time, we went from 80
percent to 20 percent. So, we had to do something about that,
because it was so vital to us. So, what we did was create a
public-private partnership. It goes by the name of Symantec.
And Symantec--I think, it--I don't get the--remember the exact
numbers, about 250 million on the government side, about 250
million on the private-sector side. We recaptured the
semiconductor industry. That's the kind of thing that we could
invest in here, with regard to cybersecurity. It would create
the transparency that the case has been made well for. If----
So, there are a series of things that could be done to put
us in a position to create the kind of infrastructure that we
need that's secure enough to do the Nation's business.
Senator Snowe. That's an interesting analogy.
Thank you.
The Chairman. Thank you, Senator Snowe.
Senator Ensign.
STATEMENT OF HON. JOHN ENSIGN,
U.S. SENATOR FROM NEVADA
Senator Ensign. Thank you, Mr. Chairman.
I agree with you, in how important and how critical these
issues are to our Nation's economy and our national security;
it's very important that we have this hearing today and that we
explore it going forward into the future. And I appreciate the
input of our witnesses today on an incredibly complex issue.
Admiral McConnell, I have a great deal of respect for you,
but when you're talking about security in other industries, the
Internet and technology today is changing so much more rapidly
than any of those other industries ever did. And also remember
that with railroads we came in much later. The airline
industry, as well. I mean, can you imagine if the government
would have come in too early, for instance, in the airline
industry, before it became a mature industry?
The question is somewhat about balance. We do want to make
sure that innovation occurs, as well. But, cybersecurity is
very, very important for all of us; for all of our personal
identities; for our financial security, where somebody could
steal the money out of your bank account; for protecting some
of these critical systems that we have, like Smart Grids; and
for all of the other things that you all have laid out today.
Getting to a question, I would ask each one of you to
succinctly talk about what you believe is the single biggest
cybersecurity vulnerability that we have today. If you could
tell this committee just one thing, what would you say the
government should focus on?
Admiral McConnell. I'll go first, if that's all right.
Senator Ensign. Yes. Just right down the line.
Admiral McConnell. The area would be the financial system,
because it--as the comments, I made earlier, about it being
vulnerable. And the issue is, the authorities for dealing with
it are divided by statute, and it's compartmentalized in
boundaries. So, as a nation, cyber respects no boundaries; and
so, it's going to take some action on the Hill for various
committees who oversee pieces to address it more holistically
for the integration of the problem.
So, if you think about it as communications, exploitation
of communications, attack of communications, or defense of
communication, different statutes, different departments,
different committees, and it's, How would you put that together
in a way that you can ensure the effect of successful
communications while doing the things that would allow you to
gain insight of a potential adversary and then mitigate the
risk at network speeds, which are milliseconds? So, that's the
challenge.
Senator Ensign. Dr. Lewis?
Dr. Lewis. We, in our report of December 2008, said that
the one thing you ought to focus on is securing cyberspace. And
there were three components to that: the financial grid, as
you've heard; the electrical grid; and the telecommunications
networks.
And so, I would say you need to think about, What is it
that gives us this wonderful capability to do things over the
Internet? And you need those three things. Focus on them.
Senator Ensign. OK.
Mr. Borg?
Mr. Borg. Three of us here were on the Cyber Commission and
heartily endorse that report that Jim wrote.
It's--the center of all this has got to be, however,
critical infrastructure industries. That's what we mostly need
to protect. That's what could do us the greatest damage. That's
where the government needs to be focusing its attention.
Right now, if an electrical company wants to improve its
cybersecurity, it can't get permission to pass on the minute
rate increase that that requires; it can't get permission from
the local regulatory organizations.
With the best desire in the world to improve security, the
impediments to these companies doing the right thing are really
great. So, one of the first things to do is to remove the
impediments and make sure that there is a positive incentive to
take care of these urgent issues.
Senator Ensign. OK.
Ms. Davidson?
Ms. Davidson. I would certainly echo what my colleagues
have said, but I also want to distinguish between something
that is important but not urgent. And that--it still gets back
to this educational system, particularly college systems. We
don't send Marines out to take the hill who don't understand
that there are enemies--they will attack them--what weapons to
use and how to secure the perimeter. And yet, we are training--
the people who build IT systems are building infrastructure.
They don't understand that they're building infrastructure,
with all that that implies, and they particularly do not
understand the difference between things--you know, good input,
bad input, and evil input. Until we change the mindset of
people to understand their systems will be attacked, and to
build and design accordingly, we're not going to change the
structure. We might address it today or next year, but the next
generation coming forward will not understand that we're
continuing to build infrastructure, and the responsibilities.
We have to invest, today, in changing the mindset, and that's
the educational system.
Senator Ensign. Admiral Barnett, before you answer--Ms.
Davidson, you mentioned the government hanging carrots out
there. We give them a lot of money from the Federal Government
to tie in certain things. Remember, however, the private sector
also has great influence. I know Oracle is trying to get the
universities included. But, collectively, the private sector
could have greater influence, because there's a lot of money
that comes from private donors to the universities, as well,
and I would encourage you all to get together, and especially
with some of the larger donors who understand the critical
importance of what you were just talking about, to encourage
the universities to change what they're doing. And so, maybe we
could hit it from both sides.
Ms. Davidson. Thank you.
Senator Ensign. Thank you.
Admiral Barnett?
Admiral Barnett. Senator Ensign, it may be somewhat a
parochial answer, but, obviously, coming from the FCC, we see
making the telecommunications networks and infrastructure
secure to be a primary focus. We--you know, of course, going
back to Senator Snowe's question, as well, the front line, of
course, are private companies--the commercial things. But,
there may be a role for regulation in such things as Admiral
McConnell mentioned earlier, such as authentication, identity
management, that could help secure--and you can't have
piecemeal answers to that. A regulatory framework may be able
to help bolster the private companies in protecting our
telecommunications infrastructure.
Senator Ensign. Thank you.
Thank you, Mr. Chairman.
The Chairman. Thank you very much, Senator Ensign.
Senator Pryor.
STATEMENT OF HON. MARK PRYOR,
U.S. SENATOR FROM ARKANSAS
Senator Pryor. Thank you, Mr. Chairman, and thank you for
holding this hearing.
Admiral Barnett, I'd like to start with you, if possible.
And when I think of the FCC----
The Chairman. Incidentally, Senator--I mean, Admiral
McConnell has to leave in about 5 minutes, so if--particularly
if anybody has questions for him.
Excuse me. Go ahead.
Senator Pryor. OK. Thank you.
When I think of the FCC, I think of, you know, your role of
regulating, say, telecommunications, for example, and making
sure there's competition and consumer protection, and all those
types of things. But, are you saying that there--FCC does have
a role in protecting our communications and our Internet?
Admiral Barnett. Senator, what I would say is that we have
a role in making sure that we have the best policies and best
practices to ensure. I mean, our traditional role in--under the
Communications Act is to ensure and promote that there is a
vast, reliable, nationwide, global wire and radio
communications system. To the degree that the Internet is now
connected to our communication networks, the FCC has a role in
doing that. And so, what we have to do as we go forward is make
sure that we are continually looking at those policies and
making sure that we are bolstering our networks. So, yes, sir,
we do have a role.
Senator Ensign. Ms. Davidson, let me ask, if I may. We've
heard a lot today about the public sector and the private
sector. I think, obviously, we all need to do a better job of
working together to come up with smart policies, in a lot of
different ways, to make all this happen like it should. But,
right now, can the private sector talk amongst themselves about
what's going on out there, and can you share information? Or
when you start doing that, do you start to get into an
antitrust problem or another environment that companies either
can't do legally or are just reluctant to do because of
competition?
Ms. Davidson. You know, I think some of that's out of my
area of expertise. I have been told that there are sometimes
some challenges. A lot of the--a lot of it has to do with--at
some point, it's knowing who you're dealing with. People talk a
lot about information sharing, and I'm all for that, but we
need to remember, information sharing is a tactic, not a
strategy. So, it gets down to information sharing about what,
for what purpose, with whom, and how is that going to be used?
So, I'm sorry I can't give you a better answer. I'll be very
happy to research it and get back to you to make sure I'm
giving you a more precise one.
Senator Ensign. Admiral Barnett.
Admiral Barnett. Senator, if you don't mind me jumping in
on that. But, that is one of the things that I think the FCC
can help. Right now, we've had a very--a great deal of success
in the traditional communications world by getting information
on outages and problems in the communications network. Because
companies are not--competitors are not going to be willing, nor
is it proper for them, to share that information with each
other. And yet, at the FCC, it's confidential. We can look at
it; we can analyze what's happening across the entire network--
analyze it and work on solutions. It's been very effective for
our legacy communications systems.
One idea is to explore, Could that be extended to the
Internet, and could we obtain the same success in getting
situational awareness of what's happening?
Senator Pryor. Good. Thank you.
Admiral McConnell, let me ask you--I know you need to leave
in just 5 minutes or so. You gave a very strong opening
statement, and your insights have been very interesting to the
Committee members. But, you know, you focus pretty much solely
on U.S. policy. Is there a need for an international policy
here that, you know, the U.S. either leads or the U.S. plugs
into? I don't know that we've talked a lot about international
policy.
Admiral McConnell. And, sir, my view is, it can't be solved
without an international approach. And I don't--I apologize for
being the history buff here today, but I go back to think about
the face-off between the United States and its allies and the
Soviet Union in the cold war. So, it was an international
dimension of NATO and the other allies that brought that to a
successful conclusion, from our point of view.
So, I think this is a global problem, and it will require
interaction and agreement at an international level, probably
starting with the nations that already have alliances, and so
on. But, at some point, it's going to have to--in my view--it
will have to migrate to nations that we currently see as, if
not adversaries, certainly competitors.
Senator Pryor. Dr. Lewis, let me ask you--and this may be
my last question, because I may be out of time--but, just for
the media and for laymen, like myself, can you describe--can
you give us two or three scenarios of what a cyber attack might
look like? I mean, we talk about this, but what does that mean
to the--you know, the average Joe out there in this country?
Tell us what a cyber attack might look like.
Dr. Lewis. Sure. And I think we need to divide it--it's a
great question--need to divide it into two parts. The first is,
then, as you've heard from Scott and from Admiral McConnell and
from everyone else on the panel, we're attacked every day, and
we're successfully attacked, and it's the economic damage that
we have to worry about.
So, what would a cyber attack look like? It would look like
being bled to death and not noticing it. And that's kind of
what's happening now. All right? So, the cyber attack is mainly
espionage, some crime. We've seen a good one. I don't know if
you saw it, but a couple months ago a bank, over a 3-day
weekend, had $9.8 million extracted from its ATMs. That was a
good cyber attack. Caught some of the guys who did it. The
mastermind probably lives in Russia, not under attack.
I don't worry too much about terrorists, and I'll tell you
why. Because terrorists are nuts. If they had the ability to
attack us, they would have used it, right? So, the notion that
they're waiting for Christmas or something--they know how to do
it. Eventually, they will get it, right? Eventually. And they
will not be constrained.
There are people who could attack us now: Russia, China,
some others. Our military--potential military opponents. Sorry.
And we know they've done reconnaissance on the electrical grid.
So, could they turn off the electrical grid in the event of a
conflict over Taiwan or Georgia? Sure. That's what it would
look like. Could they disrupt the financial system? They might,
if they thought that they were either in really desperate
straits or if they thought it wouldn't hurt their own bank
accounts, right? But, I think that's what you want to look for.
Right now, huge losses through espionage, growing losses
through crimes, and the potential of tremendous damage to
critical infrastructure if we get into a fight.
Senator Pryor. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Pryor.
Senator Begich.
STATEMENT OF HON. MARK BEGICH,
U.S. SENATOR FROM ALASKA
Senator Begich. Thank you very much, Mr. Chairman.
And I'll try to be quick with these, because I have to be
somewhere at 4 o'clock.
But, let me ask Admiral Barnett, if I can. I was listening
to your response to Senator Pryor in regards to, kind of, the
role the FCC is now playing or will play in the future. I sit
on the Armed Services Committee, and we've gotten briefings on
DOD issues around cybersecurity. Can you, from your
perspective--who do you think, within the general government--I
know Homeland Security, to some extent--but, who has the full
authority--for example, if you have recommendations of things
that should be done, who pulls the trigger?
Admiral Barnett. Well, I don't know that we have any
triggers to pull. We're a regulatory agency.
Senator Begich. Right. I understand that.
Admiral Barnett. But, we work very closely with the
National Communications Systems, with DHS, and that's where we
have most of our conversations, our information sharing. The
information that we do get is applied to the National
Communications System, on outages and network problems. We
would see that being extended to other types of problems that
we're talking about today.
So, primarily focused on DHS, although we work with a lot
of our Federal partners, including DOJ. We're a part of the
Joint Telecommunications Resource Board that advises OSTP.
Senator Begich. Do you think, just--in your experience at
this point, do you think they're well coordinated among the
agencies?
Admiral Barnett. Well, as far as I can tell, we have good
communications, we have good relationships and good information
flows. We have--I'm not positive, while I've been in office,
we've been tested on that. And for that reason, we participate
in exercises to make sure that there are good information
flows. Our most recent one was back in January, a tabletop
conducted with----
Senator Begich. Right.
Admiral Barnett.--OSTP and Joint Telecommunications
Resources Board.
Senator Begich. What's the--do you think the agencies that
you're working with have the resources they need to do the work
to make sure--or are there gaps that have been identified, or
you can identify?
Admiral Barnett. You know, Senator, I'm not positive I
could speak for those agencies. I can say that, after Chairman
Genachowski asked us to do our own review, part of the things
that we came up with is that we needed to increase our talent
pool with regard to cybersecurity, and consequently, we
launched a program to do that, to make sure that we have the
talent that we need.
It goes back to the question that the Chairman was talking
about earlier, is that we need to make sure that there's an
educational pool out there. One of the things that I've been,
even before coming to the FCC, concerned about is the
precipitous drop in computer science majors that this country
has been producing since 2000. I mean, I think it's like a drop
of almost 40 percent. It may have ticked up in the last year,
because I haven't looked at it, but it's very concerning.
Senator Begich. Do you have--and let me, if I can, kind of
move into that arena. And anyone can answer this after I make
this question--and that--or ask this question--and that is, Do
you think our ability to buy that talent--pay, compete against
companies like Oracle--do you think we have that capacity?
Admiral Barnett. Once again, I can only speak for the FCC.
One of the amazing things--it's just like when I was Active
Duty in the military--it's amazing to me that Americans are
willing to come forward, because of their belief in the country
and what we're doing. I'm positive that we'll be able to find
those folks, if we can educate them.
Senator Begich. Anyone else want to comment on that?
Admiral McConnell. There--I'm familiar with the current
talent pool, particularly in this area, particularly around
Fort Meade, over in Maryland, and there's just not enough
resources. So, my comments about educational bases--we're going
to have to do that. If I could offer another, sort of,
historical context, what was referred to a moment ago, the
NCS--the National Communications System--resulted from the
Cuban Missile Crisis. The President couldn't communicate with
the Cabinet officer. We had a single carrier--AT&T--so, a--an
arrangement was made. We had guaranteed communications for all
Cabinet officers, under any circumstances. That held until
Judge Greene's famous decision, which broke it up.
At that point--the question was--asked by Senator Pryor,
was exactly the key issue: Can the industry members come
together and have a discussion out of fear of the antitrust
legislation? And they couldn't do that. So, a secondary
organization was created, called NSTAC--National Security
Telecommunications Advisory Council. But, it's only focused on
telecommunications. That served the Nation well for 30 years.
It resided in Defense. It now is over in the Department of
Homeland Security. But, it's a public sector--U.S. Government--
and a private sector, and they collaborate, coordinate for
keeping communications working.
What--DHS, who under law has the authority for this
mission--defense--has proposed a construct patterned after NCS
NSTAC. It's called CPAC--Critical Infrastructure Protection
Advisory Council. Three chairs: Secretary of Defense, the DNI,
and the Secretary of Homeland Security. Three co-chairs. You
pick the largest segments of industry--critical
infrastructures--to come together. You have to have public
meetings, with government participation, with minutes that are
published to the public----
Senator Begich. Sure.
Admiral McConnell.--and you talk about the issues, like
technology or policy or operations, to address these issues.
Now, that has been proposed. My sense, that it hasn't gotten
the traction that it needs. Perhaps that would--may be
something that you could consider, in your bill, to put some
energy behind it.
Senator Begich. Yes, that's a good question.
My time is up, but, Dr. Lewis, I saw you--maybe you could
do a quick response.
Dr. Lewis. Sure. Just--I wanted to come back to the
educational point. And it's not a fluke that we have two
admirals sitting here, because the Navy's paid a lot of
attention to that--to cybersecurity and to cryptology. They're
coming up with a scholarship program. There's something called
U.S. Cyber Challenge, which CSIS has been a little involved in,
and it's an effort to get kids interested in cybersecurity, in
hacking contests. It's really good.
There's a chance to rebuild the university programs. And
Admiral McConnell mentioned the National Defense Education Act
of 1958. And what that did is, we said, ``Hey, the Russians are
ahead of us. We need a lot of engineers and mathematicians and
foreign language specialists.'' Five years later, we had them.
So, yes, you can fix this, with the right sort of investment.
Senator Begich. Thank you very much, Dr. Lewis.
I--my time is up, Mr. Chairman. Thank you for the
opportunity.
The Chairman. I've got to stick with that, Admiral.
Senator Klobuchar.
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you very much.
And do you have to leave, Admiral McConnell? Is that
correct?
Admiral McConnell. I do, and I want to offer a last
comment. But, I----
The Chairman. Please.
Admiral McConnell.--a little over time--just offer my last
comment.
The Chairman. Yup.
Admiral McConnell. Something that hasn't been mentioned; I
want to make it harder. We've talked about cybercrime and
cyberwar, and on and on. I'm thinking about a new idea, and I
will call it ``Insidia.'' Insidia means that an adversary
builds into our infrastructure. They do what they're doing now,
in terms of taking our intellectual capital, and now they harm
the infrastructure for competitive advantage, if and when they
choose to do so. That is possible today.
So, let's say that a--you pick it--country X is going to
introduce a new product, and they want achieve dominance in a
market. They could cause things to happen in our
infrastructure, that we don't even recognize, that would
disadvantage us in a competitive way.
So, it's early in my thinking, but I'll just leave the
thought with you. Insidia. Just something I made up, but it
could happen today. And the reason I know it could happen today
is, I know we could do it, if we chose to do so.
The Chairman. The great question, ``If we chose to do so.''
Voice. We've been investigating that for the last several
years, so I can give you background, if you'd like.
The Chairman. Great.
Senator Klobuchar. You know, just following up on some of
the issues raised about the lack of expertise and not enough
computer science majors. I'm a former prosecutor, and I always
remember how difficult it was when we even had simple computer
crimes and the police would show up, we didn't--and they'd
press a button, and then all the porn would vanish from the
screen, and we'd lose the computer evidence. And that's a
really tiny example, compared to what we're dealing with here.
What do you think about the ability--just as you're
concerned about computer science degrees--of law enforcement
right now? Because I've always said we need to be as
sophisticated as the crooks we're trying to pursue, whether
it's internationally or whether it's domestically. What do you
think needs to be done there? I'm a member of the Judiciary
Committee, as well.
Mr. Borg?
Mr. Borg. When we were looking at it, we discovered that
actually the law enforcement is getting increasingly
sophisticated about handling their evidence, but, they're not
very sophisticated about their own vulnerabilities. We looked
at the crime labs and discovered that we could, or somebody
could, hack into most of the crime labs that we've looked at,
alter evidence, if they chose, do all kinds of mischief. So,
we've got some huge issues there.
Senator Klobuchar. OK.
Mr. Borg. Think if somebody for hire could tamper with just
the chain of evidence for any prosecution that depended on
physical evidence. That's the situation we're in right now.
Senator Klobuchar. Right. Well, and part of what I think is
just the training, again, and being able to hire people who
have that kind of computer forensics experience.
Yesterday, the Federal Trade Commission issued a report
that revealed widespread data breaches by companies, schools,
and local governments whose employees are engaged in peer-to-
peer file sharing. The software was also implicated in a
security breach involving the President's helicopter, and other
cases. I'm actually working on some legislation along these
lines, that we're going to be introducing soon. But, could you
talk a little bit about how this could be a national security
threat, and what can be done about the human element in all
this, about employees even inadvertently sharing confidential
files?
You want to talk about peer-to-peer?
Dr. Lewis. Well, you know, we're coming to a--sort of a--
we're at the early days of, I think, new thinking about
cybersecurity, and that's where the work of this committee's
been really valuable.
I talk to a lot of companies. What they've--what I've
learned is that some of them have fabulous best practices,
right? Now, usually they've been companies that have already
been hit, right? So, I talk to a giant oil company, they had
a--they were hacked, and lost millions of dollars, and now they
do everything right. One of the things they do is, they
severely limit the ability of employees to use this kind of
software.
We can think of many examples. It's fun, if you think about
some of them, you can type in ``tax return'' and it will, for
systems that are not set up, show you people's tax returns.
But, we now are beginning to identify practices that work in
improving network security, and this is one of them.
So, the question is, How do we populate industry with those
best practices? How do we tell them what they are? How do we
get them all to do the right thing, when it comes to file
sharing?
Senator Klobuchar. Very good.
On February 16, the Bipartisan Policy Center sponsored the
Cyber ShockWave exercise, which brought together former high-
ranking national security officials to evaluate how they acted
when there was a realtime cybersecurity emergency. And one of
the problems the simulation exposed was the lack of clarity
regarding government authority to regulate private-sector-
controlled infrastructure systems, such as telecommunication
networks and the electrical power grid, during such an
emergency. Do you have any views on what steps should be taken
to clarify the ability of government to assume temporary
control of infrastructure during a cybercrisis?
Dr. Lewis. Well, I think, I'm--I don't want to talk too
much; I'll let somebody else jump in, too, but--there's a
provision in the bill that I think could be very helpful. And
one of the things that we need to think about is, In an
emergency, do we want the President to have the things he needs
to do to protect the American people? And I'm not sure the
scenario got it right. I'm not sure that the President wouldn't
scrounge around--they have some very smart lawyers over there--
and maybe under the International Economic Powers Act or--
pardon me--International Economic Emergency Powers Act, or some
other act, we could come up with a solution. But, I think the
ability to intervene in a crisis is essential, and giving the
President that authority clearly is going to be essential for
national defense in what's become a new kind of warfare.
So, in that sense, the provision in the bill, which I
understand has gone through many changes, really could be quite
helpful in making the Nation more secure.
Senator Klobuchar. Mr. Borg, in your testimony, you stated
that cyber attacks have already done damage to the American
economy, much more than is generally recognized, due to massive
thefts of business information. Could you talk about some of
the examples of what you most see with business information
thefts, and what was, or not, done by individual corporations,
what you think they could do better?
Mr. Borg. It's very tricky to talk about this, because
we've been warned by lawyers that if we even hint about an
actual example, we will be sued by everybody involved--the
company----
The Chairman. Could you say that again?
Mr. Borg. Is that--what?
The Chairman. Could you say that again?
Mr. Borg. We've been warned by lawyers that if we even hint
at a real example, so that somebody could begin to identify it,
we will be sued by everybody involved, because the business
leaders who let this happen will face shareholder lawsuits,
they will--their companies will feel obligated to sue the
beneficiaries, who will countersue, claiming libel, and so on.
So, the whole thing is, legally, a mess. As a consequence,
nobody wants to talk about this. This is huge.
Senator Klobuchar. Right.
Mr. Borg. This is just gigantic.
Senator Klobuchar. Well, but there's--sometimes there are
publicly known examples that maybe you could----
Mr. Borg. There aren't for this one.
Senator Klobuchar. OK.
Mr. Borg. We do have companies that had very, very
extensive intrusions that coincided with similar facilities
being built in Southeast Asia. The facilities in Southeast Asia
are ones that nobody is allowed to visit--we think, because
they would suspiciously like the facilities here that they are
replicating. They were, when they opened, able to function very
efficiently, offer very low prices, with no particular strain
on the corporation that was running them. So, we think whole
factories are being replicated in other parts of the world.
Senator Klobuchar. Wow.
Mr. Borg. The economic consequence is that whole industries
are potentially going to be stolen over time. It happens
gradually. It's being slowed down by certain obstacles right
now, the chief one of which is, there aren't enough people in
some of the countries and areas of the world that are receiving
this information to sort it all out; there isn't enough
expertise in American ways of doing business to utilize all the
information they've got. But, potentially, we're looking at the
viability of entire industries being undermined over time. And
the thing is just going abroad.
Senator Klobuchar. And so, if they had the appropriate
people, they would just be able to basically replicate a
company, is what you're saying?
Mr. Borg. Yes, that's right. Except without the expenses of
having to do the R&D, to go through the learning curve, to do
all the other things. You can open a facility, and, on the day
you open, have a level of efficiency that it took the American
market leaders 6 years to get to.
Senator Klobuchar. Anyone else?
Dr. Lewis. Let me give you a real quick example. I don't
care if anybody sues me, but--I heard an example I thought was
astounding. It was about a small furniture company, right? A
couple hundred employees, you know, not a big revenue--they
make wooden furniture. They got hacked, and somebody stole all
the designs for the wooden furniture. Now, you all know that
there are countries in the world that are good at making low-
cost furniture, right? And now they have the designs, the
intellectual property. They have the newest styles, and they
can get it on the market faster--as Scott said, on the market
faster, at a lower price. That American company has really been
hurt, right? And that's what we're looking at.
But, the notion, to me, that it's worth this--how pervasive
is this, if you're going to be hacking small furniture
companies that make wooden furniture? It's amazing. We don't
realize what's happening to our country.
Senator Klobuchar. OK.
Mr. Borg. Something else here that's very important, that's
not understood, is that all of the information for all the
pressures, temperatures, switches for an entire factory, and
all the schematic diagrams, can be stolen. We're not talking
about stealing the formula for Coca-Cola. We're talking about
sucking all of the information out of a company.
Senator Klobuchar. Well, thank you very much. It sounds
like we have a lot of work to do here.
The Chairman. Kind of, yes.
Senator Thune.
STATEMENT OF HON. JOHN THUNE,
U.S. SENATOR FROM SOUTH DAKOTA
Senator Thune. Thank you, Mr. Chairman. And I want to thank
you and the Ranking Member for holding today's hearing on a
very important and oftentimes overlooked subject,
cybersecurity, which, as we've heard, has great consequence for
our security and our economy. And I think we have to remember
that we're under constant attack. Our critical infrastructure
and the Internet backbone of our economy remain extremely
vulnerable to these cyber attacks. And there was a recent GAO
report that states that cyber attacks could cost our economy
$100 billion annually in the near future. And so, I think it's
important that this committee give the appropriate, sufficient
attention to this important subject.
I know some--the questions have been posed--Senator
Klobuchar and I are working on the peer-to-peer issue, and some
legislation with regard to that. But, I--what I'd like to do is
just ask a couple of questions to the panel and whoever would
like to respond to these.
The Wall Street Journal recently reported that hackers in
Europe and China hacked into computers in over 2,500 companies
and government agencies. And what's probably even more shocking
is that they infiltrated these systems for several months
before they were being detected. How do we improve the
identification of these attacks, to stop the activity before
they do additional damage?
Mr. Borg. One of the problems is that we focus so
exclusively on perimeter defense that once somebody has
penetrated the system, we don't have adequate devices to spot
what's going on. One of the things that we urgently need to
develop is industry-specific, sometimes even business-specific,
monitoring capabilities that will set off alarms when these
systems are being misused and when information is being
improperly moved about.
Dr. Lewis. You know, the Journal article was interesting. I
think it's the third or fourth time I've heard of something
like this--massive penetrations; hundreds, if not thousands of
companies. It's an ongoing program. It's a nice program,
because you're not going to get caught. And even if you do get
caught, there are no consequences.
So, one of the things we want to think about is, When we
see people committing a crime, what are the consequences? And
right now, if there's zero consequence, there's almost zero
risk.
I've talked to a few of the big financial companies and
said, ``Do you have trouble telling who is doing bad things to
you?'' And what they usually say is, ``No.'' They can follow
the money, they see where it goes, they know who's doing it to
them. But, right now, we don't have any way to go to these
other countries and say, ``Hey, some of your citizens are
committing crimes in our country. Would you do something about
it?'' And so, whether this is something for the World Trade
Organization, whether it's for the World Intellectual Property
Organization, whether it's for INTERPOL, we need to start going
after people who do these things. And right now, they've gotten
a free ride.
Senator Thune. I'm just trying to think about what our role
is, in terms of a worldwide problem. And if you don't have the
capability of enforcing or imposing some sort of penalty or
punishment on people who do this, you're right, there's no
consequence to it. I don't know what would keep them from
continuing to do it.
The question I have, dealing with the first response, which
said coming up with some industry-specific or even company-
specific mechanisms of dealing with that, Do you see some role
for the Congress in that process? I mean, it seems to me that
the companies that are impacted by this are, maybe, better
positioned to do that.
Mr. Borg. When I've talked about the need for this kind of
tool, this kind of software, to people in the security
industry, they have regularly said, ``Oh, yes, we're really
eager to jump into that market as soon as it's pioneered. We
don't want to be the first mover, we want to be ready to--once
the market is formed.'' So, there's a huge opportunity here for
the government to seed that market, to be a guaranteed
customer, to, in some cases, be an initial supplier, providing
some prototype tools. And then, I think, once that is set up,
the security industry will be ready to move into it. But, it's
another example of a market that's not working properly, that
could be fixed by government intervention.
Ms. Davidson. If I can echo that--and I'm sorry Admiral
McConnell is no longer here, because he was using the railroad
industry as an example. There is a role for the government in
promoting the use of standards. And why do we care about that
in this context? Part of what would make it easier for people
to not only have better situational awareness, but to be able
to connect these types of dots, is having standards around what
type of records or censor records you need to keep in a system,
and the way in which that is expressed. And the reason for
that--why do the railroads tie into that? Because, a long time
ago, the railroads didn't have a standard train gauge. And the
reason it's--I think, 4 feet, 8-and-a-half inches, is because
the government stepped in and said, ``We want to build a
transcontinental railroad--that's a public good--and we're
going to tell you what the train gauge is going to be, so we
can put the pieces together, and you can get on a plane on the
East Coast and go all the way across the West Coast.'' The
government could actually promote the use of standards around
audit records in such a way that would be not only how the--the
nerdy bits and bytes of how they're described, but also what
kind of record you have to keep. And by doing that, and
promoting it through procurement, you could effectively tell
your suppliers, ``We're going to change--we're going to tell
you what kind of train you're going to build and what the train
gauge is going to be.''
NIST is very good at getting industry to participate in
that, and that could actually help make--create the
infrastructure of security which can help secure critical
cyberinfrastructure.
Senator Thune. And there are multiple government agencies
that deal with, and have some role in preventing, cyber
attacks. You've got Defense, Homeland Security, Commerce, FCC,
FBI. And this was actually going to be a question more for
Admiral McConnell, but I'm interested in knowing, from your
observation, how the coordination--level of coordination is
between those various agencies, and is there anything that this
committee could do to ensure that they're working in a more
efficient and coordinated manner to prevent cyber attacks?
Admiral Barnett. Senator, from the FCC's perspective, we--
Chairman Genachowski is focused on making sure that we have
good communications with our Federal partners. And that's not
just for cybersecurity, but emergency management and other
responsibilities that we have. So, there's certainly a focus on
this. I mean, I think there's a desire to make sure that we do
the best. And for that, there's a lot of communication, I would
say, with regard to the exercises that you're seeing. I can't
say that there may need to be some more, and I can't speak to
all agencies, but there certainly is communication going on
about the threat.
Dr. Lewis. You know, we want to recognize that progress has
been made in the last year, or even a bit longer. So, there is
more cooperation than there used to be, and more coordination.
And hopefully the appointment of a new cybercoordinator at the
White House will help that.
But, you're all familiar with what happened on December
25th in Detroit. And that was a--in some ways, a problem with
coordination among Federal agencies. Again, on the
counterterrorism side, we're much better off than we were 9
years ago. But, you can still see problems, and I'd say, in
cyberspace, the coordination is not as good as it is in the
intelligence community and the counterterrorism community.
So, good progress, but still a long ways to go. And that's
where congressional attention, measures like this bill, can
help encourage the Federal Government to move in the right
direction.
The Chairman. Thank you, Senator Thune.
Senator Snowe.
Senator Snowe. Thank you, Mr. Chairman.
Dr. Lewis, I wanted to ask you about the cybercoordinator
position and the appointment of Howard Schmidt, as you
mentioned, being a coordinator, rather than a Senate-confirmed
position. And, for example, he is not able to testify before
this committee on this issue. So, how important is it to have a
Senate-confirmed position on this question?
Dr. Lewis. Well, I think, in the long run--and hopefully
the long run won't be more than a few years--we're going to
need something like USTR, right? Or maybe some of the other
agencies that exist. We're going to need a specific agency that
will be appropriately staffed and have the right authorities to
do this. And that position, just as the USTR positions are
confirmable, would make sense. So, I think, good first step
there, appointing a coordinator. We're on the right path, but
we've got a long ways to go.
Senator Snowe. Yes.
Dr. Lewis. And, you know, when you think about it, this is
a new infrastructure--you've heard that from everyone--that we
depend on. But, we haven't adjusted the government to that. And
moving toward that Senate-confirmable position would probably
be a good idea.
Senator Snowe. Does anybody else have an opinion on that
question?
Ms. Davidson. Well, I can't comment on the structure, but I
can certainly comment on the individual. I think Howard Schmidt
is probably the very best possible person who could have been
chosen for that position, who commands tremendous respect in
industry, and his sole agenda is to make things better. And
because of his--because of who he is, there will--people who
will line up to do things for him because it's Howard asking. I
think it was an outstanding appointment. You just could not
have had found anybody better. It will be a very difficult job,
but if anyone is up to it, it is--he is absolutely the right
person for that.
Senator Snowe. Well, I just think it's--given everything
that we've discussed here today and, obviously, the
significance of this issue and the fact that, as the President
described, it's a strategic national asset, I think it should
be elevated so we have that conversation, and that--more
importantly, that he reports directly to the President of the
United States. I mean, I think that that sends a very critical
message, frankly. And that relationship should be developed at
the outset, as we're beginning this process and, hopefully,
getting legislation in place. That's going to be absolutely
critical in that regard; otherwise, we're not going to have the
benefit, other than in private meetings, to have those kind of
discussions, when, in fact, they should be part of the public
arena.
I would just like to ask you, Are you familiar with the
NetWitness report, by any chance? And how would you
characterize the extent of that attack?
Dr. Lewis. Interesting company. The fellow who runs it is a
guy named Amit Yoran. Like Howard, he has tremendous respect,
long experience. And so, it's good that they came out with
this.
Interesting report, but, for me, it wasn't a big surprise.
I mean, this is sort of the normal business, here. How many
times have we seen this in the past: ``Somewhere in Eurasia,
there's a group of hackers, and they've penetrated hundreds or
thousands of American companies.'' You know, it's just--this
one wasn't particularly sophisticated.
One of the things to bear in mind is that we have more
sophisticated opponents than the fellows we stumbled across
here. The NetWitness report just helps reinforce the kind of
pressure we're facing.
Senator Snowe. Dr. Borg?
Mr. Borg. There were a couple of things about it that were
a little bit interesting. One is just the scale of it, and the
other is that it used two botnets in conjunction. Each time we
have one of these, they're a little more sophisticated, they
have another little new twist, something here or there. So,
it's a sign of an ongoing process of attackers just getting
better and better, more talented.
Senator Snowe. Getting increasingly sophisticated? Yes. And
how do we keep pace with that sophistication?
Mr. Borg. Well, one of the ways we're not keeping pace is
by having departments of cybersecurity where, in the graduate
programs, there are no Americans. A lot of our leading programs
literally have no American students at the Ph.D. level, or
sometimes even the master's level. We're training a lot of the
world in cybersecurity better than we are our own people.
Senator Snowe. What accounts for that? Is there any reason
for that, or does it just happen to be the way it is?
Mr. Borg. If you're Indian----
Senator Snowe. By----
Mr. Borg.--or Chinese----
Senator Snowe. Yes.
Mr. Borg.--or from some other part of the world, there is
greater motivation and a bigger gain from getting a degree in
cybersecurity than if you're American.
Ms. Davidson. Well, and to that point, a lot of the--you
know, how do we keep up with it? I actually have a team of
hackers who work for me. They're ethical hackers; their job is
to break our software before someone else does. They are also
the ones who author our coding standards: How do you write
secure code? And those are in a constant state of revision, not
only for new things that are publicly known, but new, nefarious
ways they find to break our software. And we train all our
developers on that. So, it is constant revision, because there
is always something else malicious coming down the pike.
Admiral Barnett. Senator, of course, I have a son who's in
computer security, so I'm not going to complain about the
American education system; I think we do have the ability to
train the people we need. But, there needs to be an emphasis
on--it has been a concern of mine--I mentioned the precipitous
drop in the number of computer science degrees that we are
producing. I might mention the number of women that we are
producing, and that has dropped even further. There's a good
deal of research of the reasons for that. We need to attack
those directly and reemphasize getting American kids ready to
go into computer science programs--so, we have to start earlier
than college--and then making sure that they're incentivized to
do that, and attack all the various reasons, some of which are
cultural--there are various reasons, too, that we can provide
to you.
Senator Snowe. Well, that's interesting. And that's
something that is part of our legislation that we're focusing
on, on the training and the certification of cybersecurity
personnel. But, that's clearly an emphasis that we have to
make.
So, then would it be very difficult for the Department of
Homeland Security to, you know, hire up to 1,000 cybersecurity
personnel over the next 3 years? Is that ambitious, or is that
doable?
Dr. Lewis. It's probably doable. They came in with only
about a third of their positions filled. They had 1,000 slots,
and I think they had about 300 filled. And in the intervening
year, I think they've moved that up to about 50 or 60 percent;
they've done a good job.
There's three problems. First, the shortfall of trained
personnel means DHS is competing with NSA and with DOD, with
FBI. And, let's face it, it might be more fun to work at NSA or
DOD than DHS, right? So, they've got a competition problem.
Second, a lot of the hiring processes that we have in the
Federal Government don't help. And so, somebody gets hired by
DHS, and then they're told--and this happens at other agencies,
too--``We've hired you, and in another 6 to 8 months we'll be
able to actually bring you on board.'' And, of course, people
can't wait 6 to 8 months for a job. So, a lot of people leave
early.
Finally, there's this--again, this shortfall problem, which
is that somebody comes to DHS, they get good training, they get
some good experience, they get a clearance, and they're
suddenly a lot more attractive to the private sector. So,
you've got an outflow problem, too. And all these things are
not impossible to beat; we've beat them in other agencies. But,
while there has been really good work done at DHS, I think they
could use some help on the recruitment side.
Senator Snowe. Thank you.
Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Snowe.
Let me kind of close up here by saying, you've been a
fabulous panel, all of you. And you, too, Admiral McConnell,
wherever you are. I mean, you really know your stuff. You speak
with the kind of cold clarity which this subject deserves.
Senator Snowe and I are very happy that we've introduced our
bill. And when listening to you, you know, you just ask, Is
it--was it done in time? Can it make a difference? And the
answer has to be yes.
And let me say the things that worry me. One is the whole
question of starting kids out. Right now, there's this
enormous--which was brought on point--emphasis on STEM--
Science, Technology, Engineering, and Mathematics. We
desperately need that. Is there a way that--and the kids are so
good--my son was--two nights ago he called up, and he's really,
really good on computers, and he was doing--he was at war with
a hacker, trying to fight back, and, you know, very, very
sophisticated stuff. He's 30, so that makes it a little easier.
But, the--trying to integrate this somehow--we don't have that
choice, do we?--into early education. We do not have that
choice. And if boards of education say they don't have that
money, we still do not have that choice.
The second thing is that the problem is so pervasive, so
overwhelming. We're talking about the public sector and the
private sector and all the--your 6- to 8-month vetting, you
know, the horrors of the Federal Government and its vetting
process, and people just say, ``You know, I can't wait.'' So,
you lose good people. The salaries involved. The budget
restrictions we're now going through for the next number of
years, because of our deficits. And yet, you know, put it in
comparison to the dangers of these massive cyber attacks, which
are not, you know, unlike another terrorist attack, something
of the future, you know, next week, next month, next year;
they're all day, every day, as I quoted at the beginning, from
a DOD person. I mean, it's just happening all the time, sucking
the blood. I think, forensically, it takes 4 minutes to drain
the blood out of a person, and, you know, that's not a
particularly attractive analysis, but it's a cogent one, that
this is a really serious, desperate problem and that bills at
any--you know, any kind of effort is going to be important, and
we have to, all of us, decide how to do this.
You know, we talk about the Federal Government and the
stovepipes that Olympia Snowe and I have dealt with on the
Intelligence Committee, and the intelligence community has
gotten a lot better since we had a DNI, but they are by no
means cured. People tend to hold on to their territory, and
they don't give it up easily. And I--that has to be true in the
corporate world, for some, you know, very clear and
understandable reasons.
So, how do we make it all work? How do we get people to
together? How do we create the sense of urgency, at a broader
lever, in which we do things we've just never done before as a
country? Which I think is what it amounts to. Yes, we've got to
give the President the right to intervene. And that's
controversial. That's all--that'll always be controversial.
But, Senator Snowe and I believe that needs to be done.
But, let me leave you with one happy thought, just for
practice. Last year and this year and the year before, on the
two sides, let's say, of American young people looking for
careers, one is in the intelligence--the world of
intelligence--the CIA, NSA, et cetera--the applications for
those agencies, in number and in quality, have never been
higher. So, they're swamping these agencies with applications
to work there. And incredible--and I've done this, and I'm sure
that Senator Snowe has, too--you go and meet some of these
young people working for CIA or whatever--they're fantastic.
And so, that's national security.
On the other end is the Peace Corps or Teach for America.
But, just take the Peace Corps for a moment. They have never
had so many applications, ever, and of such high quality.
So, to say, on the one hand, that we don't have enough
Americans doing this, that people from other countries--they
used to get their degrees and stay here, because it was more
profitable. Now, they're being called home, and they're
patriotic, and they're doing--I mean, I can't criticize them
for what they're doing. It's just that it makes our life more
difficult.
So, I think that, with the depth and desperation of the
problem, mixed with this sort of hopeful and positive attitude
to be engaged in serious matters, cerebral matters, of young
people in this country, we've got to find our way out of this.
And we won't do it quickly, but we sure have to do it.
So, thank you very, very much, all of you.
The hearing is adjourned.
[Whereupon, at 4:35 p.m., the hearing was adjourned.]
A P P E N D I X
Prepared Statement of Hon. Tom Udall, U.S. Senator from New Mexico
Thank you, Chairman Rockefeller, for again focusing this
committee's attention on cyber security.
Since this committee met last year to discuss this topic, we have
witnessed a number of alarming cyber attacks and data breaches.
In December, Google announced that they--and probably many other
American companies--had been infiltrated by cyber attacks that
originated in China. Apparently the hackers specifically targeted
Chinese activists who used Google services. However, many other users
and companies could be harmed by this type of cyber attack.
In January, we learned that the National Archives apparently lost a
hard drive that had over 100,000 Social Security numbers for workers
and visitors to the White House.
This month, a cyber war game exercise also illustrated some of the
Nation's vulnerabilities to a sophisticated cyber attack and the need
for a nimble and coordinated response to protect our infrastructure.
So, I welcome the opportunity to ask a few questions today about
how we can do more to protect consumers, companies, and the Nation.
______
Written Questions Submitted by Hon. John D. Rockefeller IV to
Vice Admiral Michael McConnell
Question 1. What are the key elements of public-private teamwork
that are not in place today that should be?
The witness did not respond.
Question 2. Would it make a difference if more senior executives in
the private sector were granted security clearances?
The witness did not respond.
Question 3. What about cybersecurity? Are you confident that the
everyday American citizen knows the threat that we are under, and knows
how to make his or her own home or business safe?
The witness did not respond.
Question 4. Should there be basic cyber awareness and education as
part of the normal curriculum in elementary and secondary school?
The witness did not respond.
Question 5. What can the government and private sector do together
to solve this labor shortage problem?
The witness did not respond.
Question 6. What can we do to inspire young students to aspire to
serve their country by being a cybersecurity professional?
The witness did not respond.
Question 7. What must the government do better? What must the
private sector do better? What responsibilities do both have to the
public at large?
The witness did not respond.
______
Written Questions Submitted by Hon. Tom Udall to
Vice Admiral McConnell
Question 1. Admiral McConnell, your statement sounds the alarm
about threats to our infrastructure. You note that the United States is
not doing enough to promote cybersecurity and that the country needs a
coordinated approach involving the public and private sectors. Our
national labs--which are the crown jewels of our Nation's research
system--are active in efforts to promote cyber security. In my home
state of New Mexico, Sandia National Laboratories is engaged in efforts
to secure the national electrical grid from cyber attack. Los Alamos
National Laboratories is a leader in quantum cryptography. What role
should our National Labs have in the efforts you describe to protect
our Nation from cyber attack?
The witness did not respond.
Question 2. Some experts say the arrival of ``Cloud computing''
could be as important and as disruptive as the advent of the World Wide
Web. Eric Schmidt, the CEO of Google, has written that, ``We're moving
into the era of `cloud' computing, with information and applications
hosted in the diffuse atmosphere of cyberspace rather than on specific
processors and silicon racks. The network will truly be the computer.''
How can we be sure to realize the benefits of cloud computing given
very real cyber security threats?
The witness did not respond.
Question 3. What is the role of government and private industry in
protecting sensitive data as it increasingly moves from desktop devices
to the ``cloud''?
The witness did not respond.
______
Response to Written Questions Submitted by Hon. John D. Rockefeller IV
to Dr. James A. Lewis
Question 1. What are the key elements of public-private teamwork
that are not in place today that should be?
Answer. The most effective partnership models are based on small
permanent groups of senior business leaders from the corporate
headquarters who regularly interact with senior government officials.
Only two or three groups (DOD's ESF, DHS's CIPAC and perhaps NSTAC) now
follow this model. The key elements are trust and authority--trust
comes from regular meetings among the same people and authority comes
from the ability to make binding decisions. Many existing groups are
not designed to provide trust or authority.
Question 2. Would it make a difference if more senior executives in
the private sector were granted security clearances?
Answer. Classified briefings on the nature and extent of the threat
are very effective in alerting corporate CEO's to the problem they
face. Classified briefings have been one of the most effective parts of
the DOD's Defense Intelligence Bases initiative.
Question 3. What about cybersecurity? Are you confident that the
everyday American citizen knows the threat that we are under, and knows
how to make his or her own home or business safe?
Answer. I do not believe we should make citizens responsible for
the national defense. There are some minimal activities (keeping anti-
virus software updated) that citizens now need to perform but we would
be better served by shifting security to service providers. Nobody has
to program their land-line phone or install anti-virus software on it.
The same model should apply to the Internet.
Question 4. Should there be basic cyber awareness and education as
part of the normal curriculum in elementary and secondary school?
Answer. Wouldn't hurt, although we shouldn't expect too much from
it.
Question 5. How can the Federal Government bolster market-based
private sector incentives to drive innovation in cybersecurity and
raise the bar on cybersecurity standards and best practices?
Answer. The same way it drove innovation in automobile safety: by
setting goals and requirements and then letting the companies figure
out how to implement them.
Question 6. Does the American public have the right to expect that
U.S. private sector critical infrastructure companies are looking out
for the safety and security of the American people? Should this
interest in public safety an integral aspect of the private market for
IT products and services?
Answer. In most other areas of public safety we expect critical
infrastructure companies to meet minimal standards. It is time to
extend this to cybersecurity. In many cases, regulatory authorities
also allow companies to impose a small surcharge to cover the
additional cost of safety measures. This too must become part of a
national effort to secure networks.
Question 7. What must the government do better? What must the
private sector do better? What responsibilities do both have to the
public at large? With this in mind, how can we fashion a public-private
partnership, based on trust, that allows for sharing of confidential
and/or classified threat and vulnerability information between the
government and critical private sector networks?
Answer. National security is the responsibility of the government.
We should not assign this function to citizens or companies if we wish
to succeed. Government needs to be better organized and have a clear
strategy for defense. The best analogy might be to city policing: yes,
we want people to lock their cars and doors to buildings, and exercise
a little common sense, but at the end of the day it is the
responsibility of the city authorities to bring crime rates down. Our
current approach to cyber security is like the crime fighting approach
in New York City in the 1970s. We need to change that.
Question 8. Would government and private cybersecurity efforts
benefit from ``vulnerability mapping'' of major U.S. networks, public
and private?
Answer. Only if the mapping was then tied to some action to either
improve defenses or increase resiliency.
Question 9. What are the specific risks to such an activity?
Answer. Since our major opponents have probably already done this,
any additional risk is likely to be small.
______
Response to Written Questions Submitted by Hon. Tom Udall to
Dr. James A. Lewis
Question 1. The recent Bipartisan Policy Center cyber war game
exercise examined a potential attack that first affected wireless cell
phones. As computing and networking technology become integral to all
manner of consumer goods, it seems that new cyber attack
vulnerabilities will only proliferate. In today's business landscape,
supply chains stretch across the globe and companies often acquire
other firms to gain access to new software and technologies for their
products. This makes it more difficult to know whether a product may
contain cybersecurity vulnerabilities from a single component or piece
of software code from an outside supplier or other firm. How is
security of the final assembled product affected in an environment in
which new links are so frequently added to the product's ``chain''?
Answer. Most companies have processes in place for quality control
that provides some level of protection. A skilled adversary could
bypass these, but it would be expensive to do so. The larger problem is
that as manufacturing and invention shift form the U.S. to Asia, our
vulnerability to supply chain corruption may grow.
Question 2. How are leading technology companies bringing the
security of acquired products in line with their own standards for
cybersecurity?
Answer. The most advanced companies buy from trusted suppliers,
engage in testing, and rely on their network defenses to identify
anomalies (such as effort to exfiltrate large amounts of data) after a
new device or program is installed.
Question 3. What is the role of Chief Security Officers or Chief
Technology Officers in assuring best security practices are implemented
in such cases?
Answer. It varies from company to company. The best practice is for
both CSO and CTO to work together to build secure networks.
______
Response to Written Questions Submitted by Hon. John Ensign to
Dr. James A. Lewis
Question 1. Are there any legal restrictions we should focus on
that make it more difficult for industry and government agencies to
share the information needed to protect our critical cyber
infrastructure? Are there any barriers that Congress needs to
eliminate, or any legal flexibility we can provide to foster the
necessary sharing while still protecting sensitive or proprietary
information?
Answer. The main problems are the need to have personnel with
security clearance to receive some information and the perception that
the government does not share fully. It may be possible to streamline
the clearance process for lower classification levels (Secret, for
example).
Question 2. What mechanisms are in place for private companies to
report cyber intrusions (either originating domestically or overseas)
to the Federal Government?
Answer. Different parts of the Federal Government receive reports
of cyber intrusions. DHS, FBI, Secret Service and, in some instance
DOD, all get reporting from companies, but the information is not
always available to other agencies.
Question 3. What is being done to encourage private companies,
particularly those with government contracts, to report cyber
intrusions (either originating domestically or overseas)?
Answer. DHS, FBI, Secret Service and DOD have outreach programs,
such as FBI's Infragard program
Question 4. Do government contractors have an ethical or statutory
obligation to report cyber intrusions (either originating domestically
or overseas)?
Answer. DOD has begun to require reporting from companies in the
Defense industrial base and in some instances companies have reported
breaches in their SEC filings, but there is no consistent requirement.
Question 5. Do government contractors with classified information
on their servers and individuals with security clearances on their
payrolls have a statutory or ethical obligation to report cyber
intrusions (either originating domestically or overseas)?
Answer. This requirement may be part of their contract of part of
DOD acquisitions regulations--the DFAR.
Question 6. When Request For Proposals (RFPs) are put out for
contracts that involve sensitive or classified information do all of
these RFPs require that bids include the number of successful and
unsuccessful cyber intrusions committed by domestic or foreign entities
(either originating domestically or overseas)?
Answer. I do not know of any specific requirement.
Question 7. In your opinion, if a private company believes that it
has been the victim of a cyber intrusion (both originating domestically
or overseas), which is the appropriate agency that it should report
this intrusion to?
Answer. The FBI.
Question 8. In your opinion, if a government contractor believes
that it has been the victim of a cyber intrusion (both origination
domestically or overseas), which is the appropriate agency that it
should report this intrusion to?
Answer. The FBI and the contracting agency.
Question 9. In your opinion, if a government contractor that is
working on a sensitive or classified project and believes that it has
been a victim of a cyber intrusion (both origination domestically or
overseas), which is the appropriate agency that it should report this
intrusion to?
Answer. The FBI and the contracting agency.
______
Response to Written Questions Submitted by Hon. John D. Rockefeller IV
to Scott Borg
Question 1. What are the key elements of public-private teamwork
that are not in place today that should be?
Answer. The public and private sectors should be discussing how to
engender the sort of market environment that will allow the creative
potential of American corporations to be turned loose on our collective
cyber-security problems. This hasn't happened yet.
Instead, our ability to tackle the challenges of cyber security is
being severely limited by established interests and obsolete ways of
thinking. Even the threat of government regulation and the promise of
big profits from government contracts or subsidies are not solutions,
but serious impediments to real cooperation. Both get corporations
thinking in terms of lobbyists and public relations, rather than
problem solving.
Question 2. Would it make a difference if more senior executives in
the private sector were granted security clearances?
Answer. Giving more senior executives security clearances would be
of little help. The population that needs to be reached is much larger
than the group to whom it would be practical to grant clearances. What
is needed, instead, is a set of better incentives for declassifying
information and an improved system for circulating it, while respecting
its sensitivity.
In general, the whole system of government security clearances is
ill-suited to protecting the sort of private-sector-based information
relevant to cyber defense. It has been a serious impediment to
communication, yet does not offer sufficient security.
It is important to understand that the most sensitive and dangerous
information regarding the possibilities of cyber attacks on critical
infrastructures is not possessed by the government. It is generated and
owned by private sector corporations. Much of this information is far
too sensitive to be entrusted to everyone with a given level of
security clearance. This information is seldom shared with the
government, in part, because there is a widespread belief that the
government can't be trusted with it.
Question 3. What about cybersecurity? Are you confident that the
everyday American citizen knows the threat that we are under, and knows
how to make his or her own home or business safe?
Answer. It is obvious to virtually all cyber-security experts that
most Americans have no idea of the threat we are under and little idea
of how to make their home and business computers safe.
Question 4. Should there be basic cyber awareness and education as
part of the normal curriculum in elementary and secondary school?
Answer. Yes, cyber-security education is essential, but it should
not be used as an excuse for failing to create more secure information
products and services. When systems are badly designed, there is a
great temptation to blame the users. But systems that make great
demands on users are simply badly designed systems. In addition to
education, it is urgently important to address the question of why
information systems are so badly designed from a security standpoint.
Question 5. How can the Federal Government bolster market-based
private sector incentives to drive innovation in cybersecurity and
raise the bar on cybersecurity standards and best practices?
Answer. I have offered a list of six basic reasons why markets are
not delivering the needed levels of cyber security: (1) Companies are
not being charged for the increased risks they cause or paid for the
risks they reduce; (2) Individual executives are not being motivated to
act in the long term interests of their companies where cyber security
is concerned; (3) People don't have adequate information to take
account of cyber security in their market choices; (4) Markets for many
urgently needed cyber-security products and services haven't been
created yet; (5) Switching costs are too great to allow companies to
shift readily to more secure choices; and (6) Entry barriers have kept
out alternative products and services that would be better from a
security standpoint.
For each of these six market problems, there are several market
remedies that should be considered. One of the possibilities, for
example, for remedying the lack of information needed for market
choices is a government-facilitated system for rating the cyber
security of software products. If people don't have any reliable
information on which software products are safer, they can't choose the
safer products. Putting rating labels on software, the way we put
already rating labels on everything from cars to cookies, would make it
possible for the markets to deliver safer software.
Talk of ``raising the bar'' and ``bolstering incentives'' misses
the point. The markets that determine cyber security are broken and
need to be fixed. Government mandates and subsidies won't do the job.
The government measures that are needed are actually less heavy-handed
and less expensive, but they need to affect the mechanisms that allow
markets to function.
Question 6. Does the American public have the right to expect that
U.S. private sector critical infrastructure companies are looking out
for the safety and security of the American people? Should this
interest in public safety an integral aspect of the private market for
IT products and services?
Answer. The American public should be able to assume that its
interests are being safeguarded, especially where monopolies like
electric power are concerned. But government intervention in these
areas needs to handled very carefully, because the technology is
changing so rapidly. If the government tries to dictate security
measures to the critical infrastructure industries, these measures will
probably be out of date and counter-productive before they are finished
being officially formulated.
Question 7. What must the government do better? What must the
private sector do better? What responsibilities do both have to the
public at large?
Answer. The government needs to get over the idea that its choices
are to throw out the market and dictate what should be done or,
alternatively, to do nothing and hope some market will somehow solve
things. Instead, the government needs to understand that properly
functioning markets need attention and engagement.
For its part, the private sector needs to recognize that properly
functioning markets provide better opportunities to make money for any
companies that are delivering real value. They should work with the
government to make these markets happen.
______
Response to Written Questions Submitted by Hon. John D. Rockefeller IV
to Mary Ann Davidson
Question 1. What are the key elements of public-private teamwork
that are not in place today that should be?
Answer. The information flow still seems to be one way. With the
exception of the UK government (through CPNI, a part of MI5), industry
almost never hears of threats the government--or some in the
government--know about. In some cases, there may be legal restrictions
that prevent this information sharing. It is (obviously) not the case
that everyone should know everything, but if there is a material threat
that affects national security--where that definition also includes
economic security--then I think that some of that information should be
shared more broadly.
Question 2. Would it make a difference if more senior executives in
the private sector were granted security clearances?
Answer. Generally, yes. I still think there is a general lack of
awareness among some executives about the extent to which critical
systems are vulnerable and the degree to which their data--including
intellectual property--is vulnerable. This affects not only national
security in the traditional sense but also our national economic
security.
Question 3. What about cybersecurity? Are you confident that the
everyday American citizen knows the threat that we are under, and knows
how to make his or her own home or business safe?
Answer. Absolutely not; that is, I have no confidence that the
average person knows how severe of the risks are and what they can do
to protect themselves. I am a security professional, yet I still learn
new things every day about how technology can be broken, corrupted or
used by bad guys against us.
Question 4. Should there be basic cyber awareness and education as
part of the normal curriculum in elementary and secondary school?
Answer. It may sound strange to say Yes, but I am old enough to
remember the cold war, and how elementary school children would do
``duck and cover'' drills in schools. We accepted that at the time,
because we lived under the threat of a nuclear war. We now live in a
world in which there are new threats and--especially given the degree
to which schools seem hell bent on using computers at an early age as
``educational tools''--they need to emphasize both ``responsible use''
and ``safe use'' of those tools.
Question 5. How can the Federal Government bolster market-based
private sector incentives to drive innovation in cybersecurity and
raise the bar on cybersecurity standards and best practices?
Answer. I do not think innovation is the problem--there are lots of
security startups and more all the time. (Of course, there are other
disincentives in the sense that Sarbanes-Oxley, for all that it was
well intended, has resulted in the curtailment of the market for
initial public offerings (IPOS) in the U.S. The ``compliance overhead''
for becoming a public company is so high and so expensive that a lot of
companies will not IPO anymore--their only exit strategy for investors
is to be acquired. This was a (clearly) unintended consequence of the
legislation but it has nonetheless curtailed innovation.)
I note that there are ways to bolster innovation by helping small
innovative security startups tap into the larger market that the
Federal Government represents, such as the IT Security Entrepreneur's
Forum which is sponsored, in part, by the Defense Department and the
Department of Homeland Security. (See http://www.security-
innovation.org/).
As far as raising the bar on standards and best practices, I have
been an advocate for a long time of using procurement power to do that.
And the procurement power need not only be the Federal Government but
could include other sectors. For example, the multi-state information
sharing and analysis center (MS-ISAC) has come up with common
procurement language on software development practice. Is it binding on
the states? No. Is it a common resource that they can use to
contractually ``signal'' their suppliers that they need to provide
better security? Yes.
A no-brainer as far as I am concerned is that any piece of software
sold to the government should: (a) provide a secure configuration guide
(attorneys frown on the term ``best practice''), (b) enable the product
to be installed in that configuration (make it easy and cheap for
customers to be ``secure out of the gate'') and (c) either provide a
tool to maintain the configuration or support a standard (such as those
provided via the Security Content Automation Protocol) that enables the
configuration to be monitored automatically and re-configured
automatically.
The Air Force realized that something like 80 percent of their
security vulnerabilities were a result of weak/poor configuration
practice. If vendors can do something once that helps secure all their
customers, at a lower lifecycle cost, they ought to do it. Procurement
can force them to do it.
Question 6. Does the American public have the right to expect that
U.S. private sector critical infrastructure companies are looking out
for the safety and security of the American people? Should this
interest in public safety an integral aspect of the private market for
IT products and services?
Answer. The two items are different. Why are they different?
Because in the case of critical infrastructure companies, most know
they are ``critical'' and in fact are already regulated (financial
services and utilities, to name two). So, there is already awareness
that there is a ``duty of care'' to the public (or they wouldn't be
regulated in the first place).
In the case of the private market for IT products and services,
realize that while some products are created for vertical markets that
may be regulated (e.g., a piece of software that is used in the
utilities industry), a lot of software is general purpose (e.g.,
accounting software). Trying to impose a ``worst case'' duty of care on
all purpose software would be like trying to ensure that, say, any
laptop would be required to comply with the battlefield ruggedness the
military demands. The Defense Science Board, in considering the foreign
influence over the supply chain of software, realized that, while
raising the overall assurance of commercial software was necessary,
raising it to the level required for all national security applications
was unfeasible because the commercial marketplace will not support such
high levels of assurance. I think it is a similar argument for general
purpose software used in ``critical sectors''--it's not clear whether
the market will support high assurance to the extent that's what those
sectors require.
Now what should happen is that critical sectors use their (perhaps
collective) purchasing demands to push their suppliers to higher levels
of assurance. In fact, we are already seeing many regulated sectors or
customers tied to those sectors (as suppliers) demanding more
transparency in development practice and higher accountability in
software development practice because their customers (e.g.,
pharmaceuticals, defense) are demanding it. And I am all in favor of
that push since I think customers' being more demanding purchasers
(within reason) absolutely is an effective agent of change.
Question 7. What can the government and private sector do together
to solve this labor shortage problem?
Answer. Unfortunately, there isn't a simple solution for this.
Nobody can major in ``cybersecurity'' and in fact, security needs to be
embedded in a lot of places if we want to change the dynamic. (E.g., we
don't use traffic cops to enforce secure driving--drivers all have to
take drivers' ed and be licensed to drive or we wouldn't have a prayer
of having reasonably safe highways).
As I have noted in my testimony, I think curricula change in
universities is a Must Do or we do not have a prayer of changing the
battlefield, so to speak. Perhaps the government can bring some
pressure on the accreditation bodies for computer and computer-related
degree programs? There is a group called ABET which accredits
engineering, computer science and technology programs (see http://
www.abet.org/) and within that there is a group called Computing
Sciences Accreditation Board, see http://www.csab.org/) which appears
to be the sub-group of ABET that accredits computer science,
information systems, software engineering and information technology
degree programs. I do not know who accredits industrial control systems
degree programs (if it is not within one of the above groups).
Question 8. What can we do to inspire young students to aspire to
serve their country by being a cybersecurity professional?
Answer. Making being a good guy more glamorous than being a bad
guy, as trivial as that sounds. Currently, the press tends to
``glamorize'' the hacking community. Vendors are almost universally
portrayed as evil slugs that deliberately build crummy software because
they do not care about their customers (!). Hackers (including those
who release exploit code before a vendor can fix a problem) are often
given a pass--regardless of the amount of damage they do. One well-
known hacker released ``proof of concept code'' that several months
later was the genesis of the Slammer word, which did BILLIONS in
damages. He got a pass from the press for that and there were no legal
repercussions, either, since releasing proof of concept code is not
illegal.
Finding a way to change the dynamic so kids use their technical
skills as defenders and securers can be done (I suspect the Marines'--
The Few, the Proud, the Marines--is one of the more successful
``service-oriented'' advertising campaigns there is).
We have a broader societal problem (in my opinion) in that we have
generations raised to be very aware of their rights and what is due
them, but few are aware of or seem to care about their
responsibilities. Serving your country is a responsibility of
citizenship and I think diversifying that message to emphasize other
kinds of service (than just using a rifle) could work (e.g., ``Uncle
Sam is looking for a few good geeks'').
I don't think appealing to the wallet is necessarily the first
thing to pitch but quite honestly; there is a lot of demand for
cybersecurity professionals--and not nearly the supply. This creates
scarcity that increases wages, all things being equal. So yes,
cybersecurity is also a good career move because the skills are
marketable.
Question 9. What must the government do better? What must the
private sector do better? What responsibilities do both have to the
public at large?
Answer. I think the government can do a number of things better.
For one thing, while the military is busy standing up cyber commands,
not all the services actually have career paths for plain old
information technology let alone cyber-expertise. I note that
traditionally, logistics, though not a war fighter discipline, is still
a valued career skill and in fact you can make flag rank (general or
admiral) in a logistics specialty. Why does it matter? Because Patton
understood what would happen if his 3rd Army ran out of oil. Today's
information centric armies run on bits and bytes, just as much as oil.
Without a clear, recognized and rewarded career path in both
``defensive'' information technology and offensive cyber war, the
military is sending a signal that information smarts is not valued and
is not important.
Obviously, the government also needs to lead by example by securing
their own networks.
As far as the private sector goes, I do advocate greater emphasis
and ``governance'' around security for private enterprises. Governance
is not about being perfect, it is about understanding the threats to
your business, prioritizing them in terms of ``what do we, as a
company, adhere to in terms of security practices to mitigate those
risks?'' and ensuring that you are doing those things broadly and
consistently. Where you are not doing them, you have a reasonably
aggressive remediation plan in place to, as they say, ``get with the
program.'' If you do not manage risks appropriately, you are not
running your business well.
______
Response to Written Questions Submitted by Hon. Tom Udall to
Mary Ann Davidson
Question 1. Ms. Davidson, in your statement, you note that many of
the commercial software components used to build a new ``smart grid''
probably are not designed for such for the level of cyber attack
threats that our Nation's electric grid may face. But ensuring that
commercial software, or even government computer systems, are safe from
cyber attack is a real challenge. The National Institute of Standards
and Technology (NIST) maintains a standard for data encryption, the
FIPS 140 standard. What other government or industry standards exist
for cyber security?
Answer. There are lots of standards--some of them are technical
standards that ensure interoperability of components (e.g., public key
encryption standards like PKCS (public key cryptography standards) 11,
or standards created by consortia such as the payment card industry
(PCI) data security standard (DSS) that addresses securing information
related to payment transactions. There are some emerging standards that
would specifically facilitate higher ``situational awareness'' for
networks, such as the security content automation protocol (SCAP), a
cornucopia of standards that enable things like determining what
product is running on a network (and what version), what it's secure
configuration is, and so on. These standards were developed by NIST or,
in some cases, Mitre under contract to NIST.
There are also international software assurance standards (such as
the Common Criteria--International Standards Organization (ISO)-15408)
to which the U.S. subscribes. The Common Criteria is focused on
describing the nature of threats, what technical measures a product
needs to address those threats, and how well it does meet them. I note
that in many cases an international standard is really better than a
market-specific one, because: (a) a lot of security needs are not
country specific and (b) if each country (and in some cases if each
industry) starts specifying a similar but slightly different way to do
X, companies will--ironically--potentially end up with worse security
as they spend money not on actual improvement but on meeting hundreds
of only slightly different regulatory requirements. For example, if
local, city, county, state and Federal bodies all required separate
termite inspections for houses, you'd have to pay for four inspections.
Your house would arguably not be four times as termite-free as if you
just did one pretty good inspection.
In some cases (by industry) there might be legitimate differences.
For example, the Defense Department has (legitimately) different
requirements for, say, smart phones that are going to be used in
sensitive environments than the average consumer does for his or her
smart phones.
Question 2. Should Congress encourage companies and government
agencies to develop and use more cyber security standards?
Answer. I think technical interoperability-type security standards
the market will take care of--government tends to be too slow to drive
those and entities tend to cooperate when there is a common problem
(or, where cooperation will actually increase the market size because
there can be more uptake of technology with a single standard than
would be the case if there are dueling standards).
But there are ``underserved'' markets or areas in which industry is
unlikely to develop common standards where government--specifically,
NIST--can have an important role. One such area has been SCAP--being
able to determine, quickly, what products are on a network, what their
configurations are, to what they might be susceptible, and to be able
to reconfigure them automatically--is helping to automate defenses.
Considering attacks are automated, automating defenses is important.
Another such area (as unglamorous as it sounds) is auditing and
auditability. There are a plethora of products in the sector called SIM
(security information management) or SIEM (security information and
event management) that claim to be able to analyze ``events'' on
networks (by data mining audit logs) and correlate them (e.g., to see
attack patterns). However, that assumes a) that events are recorded at
all--not all products have robust enough auditing to even record
interesting events--and that the events can be expressed in a common
format (so they can be more easily correlated). There is an emerging
standard (called CEE--Common Event Expression, see http://
cee.mitre.org/) in this sector but quite honestly, the government could
help create the capacity for better ``situational awareness on
networks'' by fostering a standard adoption through procurement
policies. Any software product the government buys could be expected to
a) have basic auditability as defined by a standard (possibly CEE,
assuming it is actually published by NIST and industry is allowed to
comment on it) and b) express their audit records in a common format.
Question 3. The recent Bipartisan Policy Center cyber war game
exercise examined a potential attack that first affected wireless cell
phones. As computing and networking technology become integral to all
manner of consumer goods, it seems that new cyber attack
vulnerabilities will only proliferate.
In today's business landscape, supply chains stretch across the
globe and companies often acquire other firms to gain access to new
software and technologies for their products. This makes it more
difficult to know whether a product may contain cybersecurity
vulnerabilities from a single component or piece of software code from
an outside supplier or other firm. How is security of the final
assembled product affected in an environment in which new links are so
frequently added to the product's ``chain''?
Answer. Keep in mind, there are many supply chain risks businesses
need to consider that directly affect their business. These are not
necessarily the same concerns that their customers have (but are
nonetheless important). For example, some software carries so-called
``viral licensing'' provisions in that, if the software is embedded
within another product, the product comes under the same licensing
terms (which in many cases, effectively makes it freeware). No vendor
wants to embed such third party code that ``taints'' their code base in
such a way that they can no longer sell the resulting product--their
revenue model is destroyed. Second, realize that it is impossible to
detect all vulnerabilities in software even using the best commercially
available tools and it is--in particular (emphasis added) it is
impossible to absolutely prevent someone from putting something bad in
code that would be undetectable.
What is reasonable and feasible is that a company should have
reasonable practices around their supply chain risk (because it is in
their business interests to do that, anyway). Note again that many of
these risks will go directly to their ability to operate and will not
necessarily be the same risks that a purchaser worries about. A company
should also have a reasonable governance structure in place to ensure
that they are doing the same things across their lines of business.
Having done that, they could disclose their practices to interested
purchasers--who were, for example, concerned over how a company takes
reasonable measures to prevent someone from corrupting their code base.
Reasonable means that, for example, changes to code have attribution,
and there are restrictions on access (e.g., not just anybody in the
company can make a change to code--and certainly not in a way that
cannot be attributed).
I have done a paper for the House Homeland Security Subcommittee on
Cybersecurity, Emerging Threats and Science and Technology on supply
chain risk that speaks to the above in more detail and I would be happy
to provide that, as well, if it is of interest and of use.
Question 4. How are leading technology companies bringing the
security of acquired products in line with their own standards for
cybersecurity?
Answer. I cannot (obviously) speak for other companies, but Oracle
has a structured process for integrating acquired companies into Oracle
business practices. My team has the remit for integration of acquired
entities into our secure development practices. As part of that, we
rapidly ascertain their current practices, use the review to create a
compliance plan going forward, and--as with all lines of business--
periodically report progress against compliance requirements to
executive management via a security oversight committee. The compliance
measurement covers the entirety of our secure development practices. In
cases where an entity struggles to make compliance we highlight them
for special attention and guidance (and the accountability that goes
with it). There are other groups that look after integration of our
networks, the security policies that go with our business practices,
and so forth.
Question 5. What is the role of Chief Security Officers or Chief
Technology Officers in assuring best security practices are implemented
in such cases?
Answer. There can be several roles. One of them is that to the
extent a CTO or CSO is an influencer or purchaser of technology, they
can enforce better procurement transparency on their suppliers. That
could include specific ``disclosure'' requirements on their suppliers
related to development practice if not compliance with standards (like
FIPS-140, or ISO 15408).
Second, to the extent a company develops their own software, they
should have internal standards for development practice that at least
reflect or include consensus good practice. That can reference
``standards''--I use the term loosely--such as BSIMM (Build Security In
Maturity Model), or the Build Security In guidance issued by the
Department of Homeland Security, or things like the SANS Top 25 coding
errors (i.e., to at least ensure that a developer has considered these
issues and attempted to avoid them), and so forth. There actually is a
lot of material out on what constitutes good, secure development
practice, and what common vulnerabilities are (and how to avoid them).
It's unconscionable that universities do not educate people who design
and build systems on these matters, but that does not mean people who
build systems in industry should accept that ``educational deficiency''
without making every effort to rectify it in their own practice.
Attachment
Supply Chain Risk
The purpose of this document is to outline risk management concerns
pertaining to the supply chain of software and hardware. This document
may serve as a blueprint for suppliers seeking to ensure they've
adequately addressed hardware- and software-related supply chain risk,
and for purchasers in the procurement of software. That is, suppliers
that want to protect their supply chain should be able to address these
questions for their own risk management purposes. Secondarily,
suppliers should be able to disclose their supply chain risk management
practices so that a purchaser can make better risk-based acquisition
decisions.
While supply chain transparency alone will not ameliorate risk, it
will level the playing field to the extent that supply chain assurance
``disclosure'' becomes the norm, and thus customers have the ability to
use supply chain risk mitigation as a--but not necessarily the only--
purchasing criterion. Furthermore, it is likely that disclosure will
lead to some upleveling of security practices to the extent vendors are
not already addressing supply chain risk and more customers evaluate
supply chain risk prior to purchasing. That is, to the extent more
purchasers demand transparency around supply chain risk mitigation,
suppliers not already addressing this risk will be compelled by market
forces to do so.
Scope
The scope of this paper is supply chain risk for commercial off-
the-shelf (COTS) software and hardware, not custom code or government
off-the-shelf (GOTS) software and hardware, which may be a combination
of COTS components and either government-developed or third party
custom code. GOTS could include custom applications (built by cleared
individuals) that run on COTS components, for example. This document
does not address supply chain risk related to industrial policy (i.e.,
a country may wish to ensure that they have one or more domestic
suppliers of a critical component--such as microprocessors la the
Trusted Foundry Program--to avoid supply chain disruption caused by war
or other geopolitical upheaval).
Constraints
There are a number of practical constraints that bound the ``supply
chain risk assessment'' problem as it pertains to COTS software and
hardware. These constraints are important because they set the
framework for what can reasonably and feasibly be asserted about the
supply chain of commercial software and hardware. Any such
``reasonability'' discussion must of necessity bound efforts to reduce
or mitigate supply chain risk for COTS. In particular, COTS is not
GOTS: it is no more reasonable to purchase commercial, general purpose
software and hardware and expect it to have the assurance (e.g.,
extensive third party validation, ``cleared'' personnel, robustness in
threat environments it was not designed for) of custom, single purpose
software and hardware as it is to purchase a Gulfstream V and expect it
to perform to the specifications of an F-22 Raptor.
Constraint 1: In the general case--and certainly for multi-purpose
infrastructure and applications software and hardware--there are no
COTS products without global development and manufacturing.
Discussion: The explosion in COTS software and hardware of the past
20 years has occurred precisely because companies are able to gain
access to global talent by developing products around the world. For
example, a development effort may include personnel on a single
``virtual team'' who work across the United States and in the United
Kingdom and India. COTS suppliers also need access to global resources
to support their global customers. For example, COTS suppliers often
offer 7x24 support in which responsibility for addressing a critical
customer service request migrates around the globe, from support center
to support center (often referred to as a ``follow the sun'' model).
Furthermore, the more effective and available (that is, 7x24 and
global) support is, the more likely problems will be reported and
resolved more quickly for the benefit of all customers. Even smaller
firms that produce niche COTS products (e.g., cryptographic or security
software and hardware) may use global talent to produce it.
Note that global development may include outsourcing of development
staff resource (use of contracted third parties to develop code modules
that are sold separately, or integrated into larger product suites), as
well in-house developers (employees) of a global enterprise that are
located in development centers around the globe. For example, some
enterprise software providers build some modules in-house while being
an open source distributor for other modules. In addition to including
development groups in multiple countries, global development may also
include H1B visa holders or green card holders working in the United
States.
Hardware suppliers are typically no longer ``soup to nuts''
manufacturers. That is, a hardware supplier may use a global supply
network in which components--sourced from multiple entities worldwide--
are assembled by another entity. Software is loaded onto the finished
hardware in yet another manufacturing step. Global manufacturing and
assembly helps hardware suppliers focus on production of the elements
for which they can best add value and keeps overall manufacturing and
distribution costs low. We take it for granted that we can buy
serviceable and powerful personal computers for under $1000, but it was
not that long ago that the computing power in the average PC was out of
reach for all but highly capitalized entities and special purpose
applications. Global manufacturing and distribution has helped make
this happen.
In summary, many organizations that would have deployed custom
software and hardware in the past have now ``bet the farm'' on the use
of COTS products because they are cheaper, more feature rich, and more
supportable than custom software and hardware. As a result, COTS
products are being embedded in many systems--or used in many deployment
scenarios--that they were not necessarily designed for. Supply chain
risk is by no means the only risk of deploying commercial products in
non-commercial threat environments.
Constraint 2: It is not possible to prevent someone from putting
something in code that is undetectable and potentially malicious, no
matter how much you tighten geographic parameters.
Discussion: One of the main expressions of concern over supply
chain risk is the ``malware boogeyman,'' most often associated with the
fear that a malicious employee with authorized access to code will put
a backdoor or malware in code that is eventually sold to a critical
infrastructure provider (e.g., financial services, utilities) or a
defense or intelligence agency. Such code, it is feared, could enable
an adversary to alter (i.e., change) data or exfiltrate data (e.g.,
remove copies of data surreptitiously) or make use of a planted ``kill
switch'' to prevent the software or hardware from functioning.
Typically, the fear is expressed as ``a foreigner'' could do this.
However, it is unclear precisely what ``foreigner'' is in this context:
There are many H1B visa holders (and green card holders) who
work for companies located in the United States. Are these
``foreigners?''
There are U.S. citizens who live in countries other than the
U.S. and work on code there. Are these ``foreigners?'' That is,
is the fear of code corruption based on geography or national
origin of the developer?
There are developers who are naturalized U.S. citizens (or
dual passport holders). Are these ``foreigners?''
It is unclear whether the concern is geographic locale, national
origin of a developer or overall development practice and the
consistency by which it is applied worldwide. For example, non-US staff
working outside the U.S. would appear by definition to be
``foreigners,'' yet they are often subject to U.S. management oversight
and their work on code may be peer and manager reviewed before it is
accepted. In the sense that a U.S. manager ``accepts'' responsibility
for a ``foreigner's'' code work, is this still a concern?
Similarly, there are presumably different levels of concern for
different foreign countries. How is a COTS vendor expected to know
which countries are of more concern than others? Should work by staff
working in or citizens of traditional U.S. allies be accepted as
similar to that of U.S. staff?
COTS software, particularly infrastructure software (operating
systems, databases, middleware) or packaged applications (customer
relationship management (CRM), enterprise resource planning (ERP))
typically has multiple millions of lines of code (e.g., the Oracle
database has about 70 million lines of code). Also typically,
commercial software is in near-constant state of development: there is
always a new version under development or old versions undergoing
maintenance. While there are automated tools on the market that can
scan source code for exploitable security defects (so-called static
analysis tools), such tools find only a portion of exploitable defects
and these are typically of the ``coding error'' variety. They do not
find most design defects and they would be unlikely to find
deliberately introduced backdoors or malware.\1\
---------------------------------------------------------------------------
\1\ For example, a trivial way to introduce a backdoor in a way
that would be undetectable by automated tools would be to create a
package or function (that is, a piece of code that does something
specific) that is ``called'' within a piece of software but that does--
nothing. Nothing that is, unless the package is called with a specific
argument--that is, a piece of data (e.g., an input string) that
triggers the package to do something very specific and malevolent.
While some automated tools scan for ``dead code''--code that is never
executed--this package would be executed in the sense it is called by
many other pieces of code--but doesn't do anything, or doesn't do
anything bad, except when called with a particular ``triggering''
input. Manual code review might catch this, but as noted earlier,
manual code review is unlikely for every change to a large code base
that changes constantly.
---------------------------------------------------------------------------
Given the size of COTS code bases, the fact they are in a near
constant state of flux, and the limits of automated tools, there is no
way to absolutely prevent the insertion of bad code that would have
unintended consequences and would not be detectable. (As a proof point,
a security expert in command and control systems once put ``bad code''
in a specific 100 lines of code and challenged code reviewers to find
it within the specific 100 lines of code. They couldn't. In other
words, even if you know where to look, malware can be and often is
undetectable.) \2\
---------------------------------------------------------------------------
\2\ The expert related the story while serving on the Defense
Science Board task force analyzing the mission impact of foreign
influence on DOD software, referenced later in this paper.
---------------------------------------------------------------------------
Constraint 3: Commercial assurance is not ``high assurance.''
Note that there are existing, internationally recognized assurance
measures such as the Common Criteria (ISO-15408) that validate that
software meets specific (stated) threats it was designed to meet. The
Common Criteria supports a sliding scale of assurance (i.e., levels 1
through 7) with different levels of software development rigor required
at each level: the higher the assurance level, the more development
rigor required to substantiate the higher assurance level. Most
commercial software can be evaluated up to Evaluation Assurance Level
(EAL) 4 (which, under the Common Criteria Recognition Arrangement
(CCRA), is also accepted by other countries that subscribe to the
Common Criteria).
Regarding the supply chain issue at hand, what is achievable and
commercially feasible is for a supplier to have reasonable controls on
access to source code during its development cycle and reasonable use
of commercial tools and processes that will find routine ``bad code''
(such as exploitable coding errors that lead to security
vulnerabilities). Such a ``raise the bar'' exercise may have a
deterrent affect to the extent that it removes the plausible
deniability of a malefactor inserting a common coding error that leads
to a security exploit. That is, in the absence of using these tools, a
malefactor could insert a back door implemented as a common coding
error. If the error is found, the malefactor has plausible deniability
that, after all, he made a coding error that many other developers
make, such as a buffer overflow. Using automated vulnerability finding
tools, in addition to improving code hygiene, makes it harder for
someone to deliberately insert a backdoor masquerading as a common
coding error because the tools find many such coding errors. Thus, a
malefactor may, at least, have to work harder. (A side benefit is the
overall lower cost of ownership of software to the extent code quality
improves and customers do not have to apply so many after-the-fact
security patches.)
That said, and to Constraint 1, the COTS marketplace will not
support significantly higher software assurance levels such as manual
code review of 70 million lines of code, or extensive third party
``validation'' of large bodies of code beyond existing mechanisms
(i.e., the Common Criteria) nor will it support a ``custom code''
development model where all developers are U.S. citizens, anymore than
the marketplace will support U.S.-only components and U.S.-only
assembly in hardware manufacturing. This was, in fact, a conclusion
reached by the Defense Science Board in their report on foreign
influence on the supply chain of software.\3\ And in fact, supply chain
risk is not about the citizenship of developers or their geographic
locale but about the lifecycle of software, how it can be corrupted,
and taking reasonable and commercially feasible precautions to prevent
code corruption.
---------------------------------------------------------------------------
\3\ Report of the Defense Science Board Task Force on the Mission
Impact of Foreign Influence on DOD Software (http://www.acq.osd.mil/
dsb/reports/2007-09-Mission_Impact_of_Foreign
_Influence_on_DoD_Software.pdf).
---------------------------------------------------------------------------
The lack of market support for ``higher assurance commercial
software'' is particularly ironic given the recent policy change \4\ by
the National Information Assurance Partnership (NIAP) that negates much
of the value of existing assurance mechanisms (i.e., Common Criteria
evaluations). While they are not perfect, Common Criteria evaluations
do establish the assurance of commercial software and--at commercial
assurance levels--includes an assessment of the security of the
software development environment. In other words, it is ironic that
there seems to be increased interest in software assurance (or, the
supply chain aspects of assurance) at the very time the U.S. government
is undercutting the market for evaluated products.
---------------------------------------------------------------------------
\4\ See http://www.niap-ccevs.org/ Prior to October 2009,
procurement policy as it related to software assurance was governed by
Department of Defense (DOD) 8500, which stated that national security
systems must have an international Common Criteria (ISO 15408)
evaluation or, for cryptographic modules, Federal Information
Processing Standard (FIPS) 140-2 cryptographic module validation.
(Note: DoD 8500 and NSTISSP #11 are due to be modified to reflect the
new NIAP policy.) As of October 2009, the NIAP policy has been changed
such that only products for which the U.S. government has an approved
``protection profile'' (a description of the threats a specific class
of product faces and the technical remedies for these threats) must be
evaluated. (The only other ``exception'' is in the case where an agency
indicates to NSA by letter that they need another class of product--
without a protection profile--evaluated.) While the intent of the
policy is to make evaluation more ``relevant'' to the stated needs of
the U.S. Government, as a practical matter it has undercut the market
for evaluated products. Vendors are already reassigning their
evaluation personnel in response to this ``market signaling.''
---------------------------------------------------------------------------
Constraint 4: Any supply chain assurance exercise--whether improved
assurance or improved disclosure--must be done under the auspices of a
single global standard, such as the Common Criteria.
This document is proposed as a potential ``disclosure
questionnaire'' for both suppliers and purchasers of software and
hardware. Any such disclosure requirement needs to ensure that the
value of information--to purchasers--is greater than the cost to
suppliers of providing such information. That is, the information needs
to result in significantly more ``informed'' purchasing behavior than
would otherwise be the case. To that end, disclosure should be
something that is standardized, not customized. Even a large vendor
would not be able to complete per-customer or per-industry
questionnaires on supply chain risk for each release of each product
they produce. The cost of completing such ``per-customer, per-
industry'' questionnaires would be considerable, and far more so for
small, niche vendors or innovative start-ups.
For example, a draft questionnaire by the Department of Homeland
Security as part of their software assurance efforts asked, for each
development project, for each phase of development (requirement,
design, code, and test) how many ``foreigners'' worked on each project?
A large product may have hundreds of projects, and collating how many
``foreigners'' worked on each of them provides little value (and says
nothing about the assurance of the software development process) while
being extremely expensive to collect. (The question was dropped from
the final document.)
More specifically, given that the major supply chain concerns seem
to be centered on assurance, we should use international assurance
standards (specifically the Common Criteria) to address them. Were
someone to institute a separate, expensive, non-international ``supply
chain assurance certification,'' not only would software assurance not
improve, it would likely get worse, because the same resources that
companies today spend on improving their product would be spent on
secondary or tertiary ``certifications'' that are expensive,
inconsistent and non-leverageable. A new ``regulatory regime''--
particularly one that largely overlaps with an existing scheme--would
be expensive and ``crowd out'' better uses of time, people, and money.
To the extent some supply chain issues are not already addressed in
Common Criteria evaluations, the Common Criteria could be modified to
address them, using an existing structure that already speaks to
assurance in the international realm.
Terms
Like the Indian fable of the six blind men and the elephant, each
of whom described a totally different animal based on what part of it
they were touching, the definition of ``supply chain risk'' often
varies depending on who is describing it. The assurance that
stakeholders may wish to have around supply chain risk may vary
depending on their perspectives. For example, vendor concerns may
include a heavy emphasis on intellectual property (IP) protection since
IP is typically one's ``corporate crown jewels'' and, should it be
compromised (e.g., stolen or tainted) the firm may be out of business
or crippled in some markets. For customers, the concern tends to focus
on the aforementioned ``malware boogeyman'' which is a subset of a
larger discipline known as software assurance.
Counterfeiting is a risk that is perceptually greater for hardware
than for software. The concern from a supplier's side goes to both
their brand and their intellectual property since a hardware component
has to both look like and perform like the genuine article but may not
be as good a quality as the genuine article. The customer concerns over
counterfeiting include getting what you pay for in terms of performance
characteristics (i.e., not failing at a critical juncture) and the
customer ability to service the product.
Software assurance (SwA) is defined by the Department of Homeland
Security as ``the level of confidence that software is free from
vulnerabilities, either intentionally designed into the software or
accidentally inserted at anytime during its lifecycle, and that the
software functions in the intended manner.''
Source code is raw computer code in uncompiled form. Typically,
vendors deliver compiled code (also known as binaries or executables)
to customers, so that all the customer can do is execute--``run''--the
code. While much software is configurable, the executable typically
limits the amount of customization or configuration a customer can do
to what is designed in (e.g., a customer of an ERP application can
typically configure approval hierarchies or the chart of accounts, but
cannot change the basic logic of the application). Therefore, most
threats to the supply chain are threats to source code to the extent
that it is source code that must actually be modified (maliciously).
There is another risk to the extent that some code allows execution
of other binaries that are ``linked in''--allowed to run with the
executable. That is, a software developer that downloads or purchases
binaries to run with their code without an understanding or vetting of
what that code does could be allowing ``bad code'' to execute with or
within their product. Much software (such as browsers or wiki software)
is explicitly designed to allow such third party ``plug-ins.'' Despite
the fact that the basic software usually ``warns'' users of the dangers
of allowing unvalidated plug-ins to run, most users just ``click
through'' such warnings because they want the features of the ``cool''
plug-in.
Supply Chain/Source Code Questions
The following questions outline concerns that a software or
hardware manufacturer should address in regards to protection of source
code throughout its lifecycle. It also includes questions related to
hardware-related intellectual property and assembly. By addressing
these concerns, a software or hardware manufacturer should be able to:
Identify the ways in which they are addressing risks (and
the ``owners'' for those areas).
Document what is being done--and not done--to protect their
source code throughout its lifecycle.
Identify remaining unmitigated risk and propose ways to
reduce that risk.
Create a governance structure around the protection of
source code--and other intellectual property, such as hardware
designs--to ensure that policies are followed consistently
across lines of business, and consistently over time.
Note: many below questions that are geared toward intellectual
property protection of source code may be equally applicable to the
intellectual property associated with hardware designs (i.e., limiting
access to source code or hardware designs to ensure employees--with or
without ``need to know''--do not commit IP theft).
Acquisition
Many companies grow by acquisition and incorporate code sets from
those acquisitions into other products. Ultimately, the processes and
policies that a company implements around supply chain risk need to be
reasonably consistent (that is, if there is an exception or a policy
``difference,'' there should be a reason for it and an explicit
approval of that difference).
A1. Do you do any pre-acquisition screening of source code prior to
an acquisition (e.g., to ascertain what it does, the ``content'' or
other characteristics of the code)? The general concern is, ``Do you
know what you are getting in an acquisition?'' \5\
---------------------------------------------------------------------------
\5\ One reason to do such pre-acquisition screening is to identify
so-called ``viral licenses'' wherein inclusion of the code in a larger
code base changes the licensing terms, potentially ``tainting'' the
larger code base and one's ability to generate revenue from it. There
are automated tools (e.g., from Black Duck) that can scan code bases
looking for such ``viral license'' code.
---------------------------------------------------------------------------
A2. Are you consistent across all acquisitions, or do you do
different ``source code due diligence'' depending on the acquisition?
A3. Are acquired code bases integrated into your other software
development practices? How quickly, and how often is this progress
measured?
Development
Software development encompasses much of the lifecycle of code.
This may include incorporation of third party code (e.g., open source,
licensed libraries), the core development of new code, the ability to
maintain it through its lifecycle, granting access to source code to
third parties (e.g., for a security assessment or for other reasons)
and escrowing the code.
Personnel
D1. What screening or background check do you do of employees who
get access to source code throughout its life cycle?
D2. Is the screening consistent (in terms of quality) across
employees, geographic areas and product divisions?
D3. Do you differentiate among some products or product areas that
are deemed more critical (and thus do more stringent checks)? Which
ones?
Third Party Code (not Open Source Code)
D4. What controls do you have around third party code incorporation
into the code base (to ensure, for example, that a random piece of code
without approval, appropriate licensing and oversight is not introduced
into source code)?
D5. In cases where you do incorporate third party code, are you
incorporating source code in all cases, or are there some object
libraries?
D6. What if any security checks do you do on third party code, and
is it consistent across product lines and across ``homegrown'' and
``third party'' libraries? (That is, any code shipped with a product
should in general comply with the same standards of quality, testing,
and so on.)
D7. Are the security checks done via manual code review, static
analysis or other analytic tool, or via another means?
D8. Are the same checks done on patches and updates? That is, if a
third party provider gives you a ``patch'' to a problem in their
libraries, are there any security checks done on the patch?
D9. How consistently are the above checks done across third party
libraries and across lines of business?
Open Source Code
D10. What processes and policies do you have around incorporation
of open source code into your product (to ensure, for example, that you
do not incorporate viral licenses, or ``back-doored code'' or an
otherwise ``tainted'' open source code into your code base)?
D11. Are the same checks done on patches and updates? That is, if a
third party provider gives you a ``patch'' to a problem in their
libraries, are there any security checks done on the patch?
D12. How consistently are the above checks done across open source
libraries and across lines of business?
Development Access Control
D13. Have you identified all employees who get access to source
code throughout its life cycle (e.g., developers, quality assurance
(QA), support personnel) as apropos? (That is, access to source code
should be reasonably restricted to those with a need to access it, not
open to all. While the ability to modify code (write) is one concern,
the ability to read code (that is read but not modify) may also be a
concern for purposes of intellectual property protection.)
D14. Do you deploy source control systems to govern access to and
modification of source code?
D15. What is the granularity of access? (That is, can a developer
get access to, say, an entire product's code base or a much smaller
subset?)
D16. How often is this access control reverified? For example, if
an employee is transferred, how quickly is source code access modified
or restricted accordingly?
D17. How consistent are your access controls? (That is, are these
controls implemented consistently across all product areas, or is there
a lot of disparity on granularity depending on product access?)
D18. Are the servers on which source code is stored regularly
maintained (e.g., do you apply critical patches--especially security
patches--in a timely manner?)
D19. Are there baseline secure configurations enforced on the
servers on which source code is stored and how often are these checked?
(The concern is whether someone can bypass source code controls by
breaking into the source code server through, say, a poor configuration
or an unpatched system.)
D20. Do you have any special carve outs on source code access
beyond ``by product/by developer''--for example, are there greater
restrictions on accessing security functionality like encryption
technologies (e.g., for Export Administration Regulations (EAR)
reasons) or other geographic restrictions?
D21. Do you review, validate (or ``pen test'') your source code
access controls to ensure that your controls are adequate? How often?
D22. Do you do any proactive checking (e.g., through a data loss
prevention tool) to look for source code leaving your corporate network
(e.g., through someone e-mailing it)?
D23. What if any auditing do you have on who accesses source code
in development and does anyone ever review those logs? How often?
D24. What if any native logs are there in the source control system
itself and how far back can you attribute changes to code?
D25. Are code changes attributable to individual developers?
Security Testing
T1. Do you use automated (or other) tools--such as static
analysis--to actively look for security vulnerabilities in code?
T2. How broadly is the tool deployed within a product? (E.g., is it
run against all libraries associated with a product, just a few, or
something in between?)
T3. How broad is the code coverage of such tools across all
products and lines of business?
T4. Are defects found via such tools logged and tracked?
T5. What policies do you have around fixing defects you find either
during development or afterwards? Do you keep metrics around how
quickly issues are fixed?
T6. What kind of access control or restrictions do you have on
access to information about unfixed security vulnerabilities? (The
concern is that a malefactor could find information about exploitable
defects by accessing a record or database of such information if access
is not suitably restricted to those with ``need to know.'')
Manufacturing and Distribution
M1. What processes do you have to ensure that your code is not
corrupted in between development and delivery to customers or external
parties (e.g., escrow agents)? For example, do you use checksums or
other mechanisms to ensure that the code ``as developed and released to
manufacturing'' is what is delivered to customers?
M2. Are these processes consistent across product divisions and
products?
M3. What are your processes regarding backing up (that is, secure
storage) of source code, to include length of time for which you store
it (e.g., escrowing), security controls around the secure storage
(e.g., encryption) and any auditing or ``spot checking'' of these
controls?
M4. Do you use a third party to escrow source code? If so, what
controls are there on source code as it is transmitted to the firm
(e.g., is it encrypted and/or sent by trusted courier, other?)
Third Party Access to Source Code
P1. What policies do you have around providing access to source
code to third parties and how are they enforced? (There are many
reasons an entity might provide such access: for example, a third party
might be doing a ``port'' of the code to an operating system that the
company does not have in-house resources to do.) What kind of access is
provided and how is it provided? (Does the third party have access to
corporate networks for purposes of accessing code, or other?)
P2. Is there any ``master list'' of where such access has been
approved and provided, to whom, for what products and so forth?
P3. What policies and processes do you have in place to ensure, for
example, that random third parties (to include customers and third
party research firms acting on their behalf) do not get access to
source code for purposes of security analysis? (While companies may
wish to contract with third parties for such purposes, allowing a third
party to access source code for security analysis purposes allows that
third party to amass a database of unfixed security vulnerabilities
which, if compromised or sold, could put all customers at risk.)
Hardware
The following section addresses hardware-specific supply chain
risks.
Manufacturing
HM1. To what degree is your manufacturing outsourced?
HM2. If all or part of your manufacturing is outsourced, what steps
have you taken to mitigate intellectual property theft (i.e., by not
having a turnkey ``outsourcer'' that provides all components to
specifications and that also does final assembly, or by selecting
locales based on ``country risk?'') \6\
---------------------------------------------------------------------------
\6\ The degree to which manufacturing can be outsourced in sections
is a function of the amount of expertise one wants to retain in-house
and also an assessment of risk of putting all one's eggs in one basket,
in particular, country-specific risk. Some locales have not only a
higher reputation for intellectual property theft but much less legal
protection of IP.
---------------------------------------------------------------------------
Testing
HT1. What kind of testing do conduct of a) components during
manufacturing and b) final component assembly?
HT2. Is testing done by the outsourcer or is there a ``check and
balance?'' wherein testing is done by an entity other than the
manufacturer?
HT3. How broad and deep is the testing (Each component? Each final
assembly?)
HT4. Does testing \7\ include verification that there are no
components or functions that should not be there?
---------------------------------------------------------------------------
\7\ Note: as with software, hardware testing can establish that
hardware performs to specifications but cannot necessarily establish
what it does not do.
---------------------------------------------------------------------------
Counterfeiting/Fraud
HC1. What procedures do you have in place to ensure that components
used in hardware manufacture are authentic (that is, not
counterfeited)? How broad (i.e., against the spectrum of components)
and deep (i.e., frequency) is your verification?
HC2. What procedures do you have in place to provide component
verification for customers (that is, to establish that hardware
ostensibly of your manufacture actually is authentic and not a
knockoff?)
HC3. Do you actively look for fraudulent ``suppliers'' of your
product?
Other
HO1. Are any hardware components used and resold \8\ wiped to
ensure that no data--or non-standard programs--are installed when they
are delivered to customers?
---------------------------------------------------------------------------
\8\ Some companies use their own hardware components for testing or
development purposes for a period of 90 days or less and then sell them
to customers (tax laws allow this). It's critical to ensure that there
is no data or non-standard programs on the hardware for the protection
of both the supplier and customers. This is a different issue than
wiping corporate data (or intellectual property) prior to disposition.
---------------------------------------------------------------------------
HO2. Is this verified to ensure that data is truly non-recoverable?
HO3. Are hardware components used operationally wiped before being
scrapped or resold to ensure that data is non-recoverable?
______
Response to Written Questions Submitted by Hon. John Ensign to
Mary Ann Davidson
Question 1. Ms. Davidson, Mr. Lewis of the Center for Strategic and
International Studies states in his testimony that public-private
partnerships, information-sharing, self-regulation, and market-based
solutions in the cybersecurity space are ``well past their sell-by
date'' and have not been successful. He argues that strong government
mandates are required to spur the cybersecurity innovation that our
country needs. As the only witness on the panel who has any hands-on
cybersecurity experience in the private sector, do you agree with Mr.
Lewis that we have exhausted the potential of market-based solutions to
improve cybersecurity? If not, what specific steps can we take to
improve cooperation and coordination between industry and the
government?
Answer. With all respect to my esteemed colleague, Mr. Lewis, I do
not agree with him on this issue. To take these points separately, I do
not think that market based solutions have been fully explored in areas
where they could help harvest low hanging security fruit. To give one
such example, the Air Force (under then-CIO John Gilligan) realized
that some 80 percent of their serious security vulnerabilities (as
identified by NSA) were the result of poor desktop configurations. They
worked with one of their major suppliers (Microsoft) and NSA to craft a
more secure desktop configuration and then--as a condition of
procurement--required Microsoft to ship products to them in the secure
default configuration. They estimated they saved millions of dollars
over the life of their contract and dramatically improved their
security posture. That configuration became the basis of the Federal
Desktop Core Configuration (FDCC), which the Office of Management and
Budget (OMB) required all suppliers to be able to comply with (that is,
suppliers who ran on a Microsoft desktop needed to assert that they
supported /could run on an FDCC-compliant Windows desktop).
While the way the program was implemented can and should be
improved, as a general construct, it was an important and needed
effort. The U.S. government could help themselves--and other market
sectors--by requiring any product sold to them to: (a) deliver a secure
configuration guide, (b) allow the product to be installed by default
in the secure configuration, and (c) provide either tools to maintain
the configuration OR make the security-specific configuration
parameters machine readable in a standard format (such as Security
Content Automation Protocol (SCAP)). It is a ``no brainer'' to require
suppliers to do something once that enables all customers to: (a) be
more secure out of the box, (b) maintain their security posture easily,
and (c) lower their lifecycle security costs. Yet, it has never been
broadly adopted as a procurement requirement. There is a lot of low
hanging fruit like that that has never been planted, let alone
harvested. (Note: Oracle, like many large vendors, has instituted
``secure by default'' as part of their development process. We do this
because we, like many vendors, run our own company on our own software
and thus it lowers our own IT security costs and improves our IT
security posture as a company, not to mention that of all other
customers. Providing good security at an attractive price point is also
a competitive advantage for us. In short, we have market incentives
(lower cost of operations) to deliver secure configurations.)
No vendor can or should argue that doing something once as a
vendor, that improves security for all customers, and lowers their
lifecycle costs, ``can't be done'' or ``shouldn't be done.'' It does
work, it can work, it must work. It makes too much economic sense not
to work (and does, indeed, correct a market inefficiency).
I am leery of ``information sharing'' being thrown out as a
security cure-all, because information sharing is a technique, or a
tactic; it is not a strategy. Specifically, it is not always easy to
ascertain what information is useful, with whom it should be shared,
what the desired result would be of such information sharing, and so
on. Absent some concrete ``for instances,'' it's ineffective for
everyone to share everything with everybody as a cure for cybersecurity
problems. Furthermore, information sharing (in the general sense)
typically imposes costs on those sharing the information that may
``crowd out'' other--more useful--security activity. Not to mention,
many businesses are global entities, so it is difficult to share
information with one entity (the U.S. government) and not others (e.g.,
other governments).
Back to the procurement idea, what would actually facilitate
information sharing, and enable better situational awareness as well as
more automated defenses is continuing to push the elements of SCAP
through the standards process (ideally, as an international standards
organization (ISO) standard) and then requiring suppliers to support
SCAP as a condition of Federal procurement. Why? Because currently,
nobody can answer the following questions real time: what is on my
network? who is on my network? what is my state of (security)
readiness? and what is happening that I should be concerned about? SCAP
does not speak to all of these, but absent being able to automate
discovery of what's on the network--what products, what versions--what
is the security configuration of those elements--what vulnerabilities
are present? and so on, there is no way that defenses can be automated.
And, being able to have a common language to express the above would
take the scarce resources we now employ in purchasing and deploying
multiple one-off tools--which cannot communicate with all networks
elements, which cannot express ``readiness'' in any way that is
actionable--and apply them to other areas of network defense. Better
intelligence at a lower cost: voila!
Automated and actionable information sharing for which the
information has a specific purpose and distinct benefit is more
effective than ``give us all your information.''
In short, the government can and does change the market through
their procurement policies. ``You don't ask; you don't get'' is not,
perhaps, enshrined in the Federal Acquisition Regulations, but it
should be. And, working with industry in a public private partnership
to talk about how rapidly those requirements can be implemented, what
kind of timelines, and so on, could help make procurement an effective
instrument of change.
Another example: the Defense Department claims they want to do
better risk based acquisitions. One way to accomplish this would be for
the U.S. Government to come up with a standard (i.e., ``single'' ) set
of reasonable questions around software development practices that
would help a customer know what was and was not done in the area of
security. They should be questions for which the answers: (a) have
value, (b) would materially affect the customers' decision to procure
and (c) have a specific purpose in mind that (d) should be readily
answerable by both large and small suppliers. A vendor could answer
these questions once (per product) and the results could be reused by a
number of procurement offices. Better information, at lower cost, and
more transparency. Transparency also reduces market inefficiencies
(i.e., where the seller has more information than the purchaser). This
is also a better approach than having multiple, agency-specific or
country specific ``assessments'' that actually crowd out security
improvements (just as having 12 termite inspections will not results in
a house with \1/12\th the number of termites, but it will
result in a more expensive house). I already have had customers asking
for such transparency and, where a product group is not doing as well
as I would like, I have used the ``transparency requirement'' to push
the problems to a senior level of management. (That is, if you don't
want to publicly say you don't do A, B, and C, because you think you
will look bad vis a vis your competitors, then the remedy is to start
doing A, B and C. This assumes A, B and C are worth doing and
materially improve security which, in the case of our company and
others who have such software assurance programs, they are.) If it is
true that everybody cannot do everything perfectly in security (and it
is true), it is also true that most of us can do some things better
that are also economically feasible to do better.
Question 2. Ms. Davidson, in your testimony you discuss the need to
change our educational system and to slow our country's exposure to
systemic cybersecurity risk. You raise a lot of good points, but do you
have any other specific recommendations on what this committee can do
to harden and protect our critical infrastructure?
Answer. What about starting to require self defending products as
part of procurement? The Marine Corps ethos is ``every Marine a
rifleman.'' That is, every Marine can fight, and they don't outsource
individual defense to the next Marine down the line. They do not assume
their perimeters will not be breached, nor that they will never take
casualties.
Given the threat environment (and the fact that our perimeters are
so porous), we should change our mindset away from ``build stronger
firewalls'' to realizing that: (a) perimeters will be breached and thus
(b) we need both ``redoubts''--ideally dynamic redoubts--and for each
product to be able to defend itself. That is, products already know
what good input look likes, how to handle bad input gracefully, It
ought also to anticipate ``evil input'' and be able to share real time
information (e.g., events of interest) via a common auditing protocol
and format (something NIST could develop and, apparently is developing
via a standard called CEE (Common Event Expression). A fire team pinned
down by enemies will not last long if it cannot tell the command post
they are under fire in language the command post can understand.
Systems under attack will not be able to survive if they cannot
digitally do the same thing.
Procurement could be used to start ``signaling'' the marketplace
that DOD expects products to natively defend themselves instead of
assuming ``nobody would ever do that,'' and ``the firewall will save us
all'' as is the case now.
Networks are--like it or not--battlefields now and we ought to take
the lessons we have learned from warfare and apply them to general
network defense (and by that I do not necessarily mean ``cyberwar'').
By way of example, the late Maj. John Boyd's theories on the importance
of maneuverability to air combat (popularized as the so-called observe-
orient-decide-act (OODA) loop) found later application to ground combat
(i.e., in the first Gulf War) and also in business strategy.
Question 3. Ms. Davidson, in his testimony, Admiral McConnell
recommends establishing a National Cybersecurity Center (modeled after
the National Counter Terrorism Center) that would integrate private
sector participation with interagency cooperation. What are your
thoughts about such a center? In your opinion, would the private sector
view this as a positive development or just one more layer of
government bureaucracy?
Answer. Before undertaking such an activity, I'd want to consider
what existing organizations do (and how well) and what the ``mission
statement'' is for such a new organization. We already have industry
specific information sharing and analysis centers (ISACs) which are
natural focal points for both industry sectors to share information
among themselves and to serve as a focal point for interactions with
government (e.g., I have been told--but have no way to verify--that the
Heartland Payment Systems data breach used techniques that were known
and discussed in the financial services industry ISAC (of which
Heartland was not a member at the time)).
Question 4. What mechanisms are in place for private companies to
report cyber intrusions (either originating domestically or overseas)
to the Federal Government?
Answer. As a general comment, I think we need to choose words
carefully in terms of what constitutes an intrusion. That is, there may
be ``general patterns of traffic'' that could be of interest, that do
not constitute an intrusion. Also, there are ``incidents'' that, upon
investigation, are found not to have merit. For example, if a company
has poor processes for terminating the accounts of employees who have
left, and a (former) employee accesses their network, should that be
reported to the government? I would think ``no,'' in the general case.
Now, if the company had evidence that their industrial designs for,
say, a new hardware encryption device being built for the Defense
Department were exfiltrated by that employee, the answer would likely
be ``yes.''
Question 5. What is being done to encourage private companies,
particularly those with government contracts, to report cyber
intrusions (either originating domestically or overseas)?
Answer. With all respect, this discussion, doubtless coming on the
heels of the Google-China incident, reminds me of the discussions of 8
or 9 years ago, when the Federal Government wanted information about
non-public security vulnerabilities in software products (the
discussion was typically, ``vendors, give us all your vulnerability
information''). Leaving aside the fact that a) there is often no
remediation for such issues until the vendor issues a patch, b) sharing
that information inevitably results in data leaks, which puts everyone
at risk. Famously, CPNI (part of MI-5) ``shared'' such information on a
``need to know'' basis only (with other UK intelligence or Ministry of
Defence entities) and yet it leaked to U.S. COMMERCIAL customers, which
led to the actual vulnerability being reported to the vendor who built
the software. The vendor, of course, was the only one actually able to
remediate the defect. In the meantime, the risk to the vendors'
customer base materially increased and the trust of the vendor
community toward this particular government materially decreased. (CPNI
have since implemented much better information sharing protocols.)
There is a difference between a cyber intrusion where the entity
has determined is limited and did no damage and one in which there was
material harm. The next question ought to be a consideration of the
benefit of sharing that information, the cost of obtaining it, and the
positive results that would accrue from it. Just asking people to throw
audit logs over the wall to a third party, for example, does not have a
clear benefit (and could, if the information were not handled properly,
render the intruded upon entity MORE vulnerable in the future).
Question 6. Do government contractors have an ethical or statutory
obligation to report cyber intrusions (either originating domestically
or overseas)?
Answer. In my opinion, it depends upon the nature of the intrusion.
Question 7. Do government contractors with classified information
on their servers and individuals with security clearances on their
payrolls have a statutory or ethical obligation to report cyber
intrusions (either originating domestically or overseas)?
Answer. See earlier comments. Note that I am not arguing against
reporting anything; my concern is that any organization on either the
originating or receiving end of information can drown in it if the
information is not targeted for a specific purpose. And, if a system is
vulnerable, and the vulnerability had not been remediated (which may
require an architectural change or operational change), if the
information about HOW the breach occurred is not protected, the company
will be more vulnerable.
Clearly, there are occasions in which an intrusion would have
larger ramifications than just the effect on the intruded upon entity.
For example, if a contractor is developing a new weapons program, and
the designs are exfiltrated to a hostile nation state, which renders
the value of the weaponry potentially much lower to the Defense
Department. You can't have a technical advantage if the technology is
used by everybody.
In short, I think ``incident reporting'' to be successful would
need some clear ground rules for both asker and askee to include what
types of incidents or intrusions are material and germane.
Question 8. When Request For Proposals (RFPs) are put out for
contracts that involve sensitive or classified information do all of
these RFPs require that bids include the number of successful and
unsuccessful cyber intrusions committed by domestic or foreign entities
(either originating domestically or overseas)?
Answer. I am unaware of any such requirements in RFPs.
At the risk of stating the obvious, you can't count unsuccessful
intrusions because there are a lot of attempts you cannot necessarily
capture. Also, you cannot count the successful intrusions you haven't
found yet, either. What would be unproductive is reporting something
like ``number of port scans'' as a proxy for ``unsuccessful
intrusions'' Firewalls get scanned all the time. Having to collect that
data and report it doesn't really accomplish anything besides taking a
scarce resource (a good security person) and putting them on a
reporting function.
By way of example, about 9 or 10 years ago, after Oracle started
running an ad campaign entitled ``Unbreakable''--the port scans on our
firewall (that is, an attempt to look for open ports, perhaps through
which to mount an attack) increased by an order of magnitude in just
one week. We can pretty confidently conclude that the increase in port
scans was from hackers who wanted to be the first to break
``Unbreakable.'' Now, there were no actual intrusions but, in the
absence of a precise definition, someone could require these port scans
to be reported as an ``incident.'' That would not be a productive use
of either a reporter's time or the time of an entity on the receiving
end, either.
Question 9. In your opinion, if a private company believes that it
has been the victim of a cyber intrusion (both originating domestically
or overseas), which is the appropriate agency that it should report
this intrusion to?
Answer. The FBI. And in fact the FBI does reach out to local
businesses in Silicon Valley (and for all I know in other locations) to
engage in dialogue. Dong this proactively is better than hoping a
company knows to call the FBI.
Question 10. In your opinion, if a government contractor believes
that it has been the victim of a cyber intrusion (both origination
domestically or overseas), which is the appropriate agency that it
should report this intrusion to?
Answer. The FBI.
Question 11. In your opinion, if a government contractor that is
working on a sensitive or classified project and believes that it has
been a victim of a cyber intrusion (both origination domestically or
overseas), which is the appropriate agency that it should report this
intrusion to?
Answer. I think the company ought to be doing an investigation on
their own first and in fact, most organizations of size DO have (or
should have) an incident response protocol which includes a series of
decisions as to whether law enforcement should be contacted (regarding
an incident) and under what conditions. For example, if a government
contractor experienced a website defacement (which is an ``incident''
under most definitions), does any Federal Government entity really want
that reported to them? (Note that a web page for the company as a whole
is likely a different area of the network than a classified program.)
This would actually be a good area for industry-government
dialogue--under what circumstances would the government want to know of
``incidents?''
______
Response to Written Questions Submitted by Hon. John D. Rockefeller IV
to Rear Admiral James Barnett Jr.
Question 1. What about cybersecurity? Are you confident that the
everyday American citizen knows the threat that we are under, and knows
how to make his or her own home or business safe?
Answer. I believe that the consumers, on the whole, are becoming
more aware of the threats that exist when they use the Internet, but
there continues to be room for improved education in this area. Polling
data, for example, indicates that citizen awareness is improving. A
March 2009 poll conducted by Harris Interactive indicates that online
security awareness among adults 18 and over had ``grown tremendously in
the past 2 years. The study found that 62 percent are more concerned
about their online security.''
Nevertheless earlier studies identified significant gaps between
perceptions and the realities of America's cyber security and are cause
for continuing concern. For example whereas 81 percent said they were
using a firewall, expert analysis indicated that in reality only 42
percent had a firewall installed on their computer.\1\
---------------------------------------------------------------------------
\1\ 2008 NCSA/Symantec Home User Study, October 2008, http://
staysafeonline.mediaroom
.com/index.php?s=67&item=46.
Question 2. Should there be basic cyber awareness and education as
part of the normal curriculum in elementary and secondary school?
Answer. Yes. Regardless of the environment in which it is taught,
our youngest generation needs instruction at the appropriate time by
responsible adults who are knowledgeable on these subjects. According
to a poll released February 25, ``more than 90 percent of technology
coordinators school administrators and teachers support teaching
cyberethics, cybersafety and cybersecurity in schools. However, only 35
percent of teachers and just over half of school administrators report
that their school districts require cyberethics, cybersafety, and
cybersecurity in their curriculum.'' \2\ There are also differing
opinions ``as to who is or should be responsible (parents vs. teachers)
for educating students about cyberethics, cybersafety, and
cybersecurity. For example, while 72 percent of teachers indicated that
parents bear the primary responsibility for teaching these topics, 51
percent of school administrators indicate that teachers are
responsible.'' \3\
---------------------------------------------------------------------------
\2\ Cybersecurity, Safety and Ethics Education Falls Short in U.S.
Schools, February 2010. http://staysafeonline.mediaroom.com/
index.php?s=43&item=57.
\3\ Ibid.
Question 3. What must the government do better? What must the
private sector do better? What responsibilities do both have to the
public at large?
Answer. Concerning educating the everyday American citizen on
cybersecurity issues, the government must speak with a single, clear
voice. Hence the FCC is committed to working with other Federal
agencies to deliver a coordinated message. The Commission has a unique
role on the Federal team protecting the critical communications
infrastructure against cyber attacks. Thus, the Commission must
coordinate its own focus on the cybersecurity of the communications
infrastructure with the end-system and standardization cybersecurity
responsibilities that have been delegated to DHS, FTC, NIST, and other
Federal agencies. Many broadband service providers are to be commended
for making ``anti-virus'' software and services available to their
subscribers, frequently free of charge. These providers should take
steps to ensure that their subscribers not only are aware of the
availability of such software and services, but, through appropriate
communications to them, also take steps to ensure that they understand
the perils of not taking advantage of these offerings or ones that
offer similar protections.
The government and the private sector must also work together to
ensure the cyber security of our Nation's critical infrastructures. For
example, they must work together to identify and encourage the
implementation of standards and best practices that will enhance the
security of our systems. In this regard, the Commission's National
Broadband Plan recommended that the Commission explore creation of a
voluntary cyber security certification program as a mechanism to
encourage the implementation of cyber security best practices by
communications service providers. The government and the private sector
must also develop a partnership that allows for sharing of threat and
vulnerability information.
Question 4. With this in mind, how can we fashion a public-private
partnership, based on trust, that allows for sharing of confidential
and/or classified threat and vulnerability information between the
government and critical private sector networks?
Answer. Our experience working with telecommunications carriers on
communications outage reporting and vulnerability analysis suggests
that this is possible. The recently released National Broadband Plan
recommended that the Commission and the Department of Homeland
Security's Office of Cybersecurity and Communications should
collaboratively develop an IP network Cyber Information Reporting
System (CIRS). As envisioned, CIRS would serve as a mechanism by which
the Commission could collect situational awareness information from
communications service providers and ISPs, during cyber events as
opposed to hurricanes and other types of emergencies. Under CIRS, the
Commission would act as a trusted facilitator to ensure that any
information sharing is reciprocated and structured in such a fashion
that ISP proprietary information remains confidential. CIRS filers may
be in a position to report about downstream attacks, i.e., attacks on
customers. Accordingly, relevant privacy issues and other details would
need to be addressed.
Question 5. Would government and private cybersecurity efforts
benefit from ``vulnerability mapping'' of major U.S. networks, public
and private?
Answer. Yes. Vulnerability mapping typically involves identifying
weaknesses in the targeted network infrastructure components and their
communications protocols. Many of these weaknesses are already well
understood and a greater benefit would come from ubiquitous deployment
of known fixes and best practices. Naturally, steps would have to be
taken to secure this sensitive information.
Question 6. What are the specific risks to such an activity?
Answer. The most obvious risk of vulnerability mapping is a breach
in information security whereby an adversary obtains sensitive
information about vulnerabilities in our critical communications
infrastructure. I believe this risk can be mitigated with proper
safeguards, and I further believe that the benefits of vulnerability
mapping outweigh the risks. There's little real security to be achieved
through obscurity. Any effort relying on security through obscurity--
the idea of not drawing attention to a security problem lessens the
potential for a security event--assumes that if flaws are not known,
that attackers are unlikely to find them. While this notion may be
theoretically attractive as a defense in-depth measure, in the real
world where we are dealing with multiple vulnerabilities spread across
a substantial infrastructure, which is currently the case, this is not
a reasonable assumption. Rather, achieving security by design--where
concerted efforts are brought to bear on solving a set of vulnerability
risks--would make us more secure.
______
Response to Written Questions Submitted by Hon. John Ensign to
Rear Admiral James Barnett Jr.
Question 1. Are there any legal restrictions we should focus on
that make it more difficult for industry and government agencies to
share the information needed to protect our critical cyber
infrastructure? Are there any bathers that Congress needs to eliminate,
or any legal flexibility we can provide to foster the necessary sharing
while still protecting sensitive or proprietary information?
Answer. I believe that the Administration's recent Cyberspace
Policy Review--Assuring a Trusted and Resilient Information and
Communications Infrastructure, to which the FCC contributed, captures
well the current state of information sharing between and among
industry and government agencies:
``Some members of the private sector continue to express concern
that certain Federal laws might impede full collaborative partnerships
and operational information sharing between the private sector and
government. For example, some in industry are concerned that the
information sharing and collective planning that occurs among members
of the same sector under existing partnership models might be viewed as
``collusive'' or contrary to laws forbidding restraints on trade. [For
example, the Sherman Antitrust Act, 15 U.S.C. 1-7 (2004)]. Industry
has also expressed reservations about disclosing to the Federal
Government sensitive or proprietary business information, such as
vulnerabilities and data or network breaches. This concern has
persisted notwithstanding the protections afforded by statutes such as
the Trade Secrets Act and the Critical Infrastructure Information Act,
which was enacted specifically to address industry concerns with
respect to the Freedom of Information Act (FOIA). Beyond these issues,
industry may still have concerns about reputational harm, liability, or
regulatory consequences of sharing information. Conversely, the Federal
Government sometimes limits the information it will share with the
private sector because of the legitimate need to protect sensitive
intelligence sources and methods or the privacy rights of individuals.
These concerns do not exist in isolation. Antitrust laws provide
important safeguards against unfair competition, and FOIA helps ensure
transparency in government that is essential to maintain public
confidence. The civil liberties and privacy community has expressed
concern that extending protections would only serve as a legal shield
against liability. In addition, the challenges of information sharing
can be further complicated by the global nature of the information and
communications marketplace. When members of industry operating in the
United States are foreign-owned, mandatory information sharing, or
exclusion of such companies from information sharing regimes, can
present trade implications.''
[Obama Administration, Cyberspace Policy Review--Assuring a Trusted
and Resilient Information and Communications Infrastructure, May 29,
2009, p.18]
Question 2. What mechanisms are in place for private companies to
report cyber intrusions (either originating domestically or overseas)
to the Federal Government?
Answer. The FCC currently has rules that require communications
providers to report disruptions to circuit-oriented infrastructure and
wireline and wireless switched-voice services. Thus, if a cyber
intrusion resulted in a circuit-oriented or switched-voice
communications service outage that meets certain thresholds, the
communications provider must report the outage and the root cause to
the FCC. These rules generally cover legacy communications systems and
do not cover Internet Protocol (IP)-based communications
infrastructure. To address this, the National Broadband Plan proposed
that the Commission initiate a proceeding to expand these outage
reporting rules to broadband Internet service providers and to
interconnected voice over 1P service providers.
In addition, the National Broadband Plan recommended that the
Commission and the Department of Homeland Security's Office of
Cybersecurity and Communications collaboratively develop an lP network
Cyber Information Reporting System (CIRS) somewhat as an analog of the
FCC's Disaster Information Reporting System (DIRS). Specifically, the
National Broadband Plan states that ``CIRS will be an invaluable tool
for monitoring cybersecurity and providing decisive responses to cyber
attacks.
ORS should be designed to disseminate information rapidly to
participating providers during major cyber events. CIRS should be
crafted as a real-time voluntary monitoring system for cyber events
affecting the communications infrastructure. The FCC should act as a
trusted facilitator to ensure any sharing is reciprocated and that the
system is structured so ISP proprietary information remains
confidential.'' National Broadband Plan, Recommendation 16.8 (available
at http://www.broad
band.gov/plan/16-public-safetyntr16-1).
Question 3. What is being done to encourage private companies,
particularly those with government contracts, to report cyber
intrusions (either originating domestically or overseas)?
Answer. The packet-oriented infrastructure and packet-switched
services such as Internet access are much more susceptible to outages
caused by cyber incidents. The FCC has engaged in collaborative efforts
with industry, including Internet Service Providers, to enhance
industry's own ability to prevent and respond to cyber events through
Federal advisory committees, which include private sector
representatives. There are currently no requirements for reporting
packet-switched service outages or their causes, which would include
cyber incident causes.
The FCC's National Broadband Plan has recommended that the
Commission's Part 4 outage reporting rules be expanded through a
rulemaking proceeding to include ISPs and interconnected VoIP service
providers. The Commission would seek comment about reported ``causes''
and thresholds for reportable events. As with the data received
pursuant to the Commission's circuit-oriented outage reporting rules,
ISP and VoIP outage data would be analyzed and used to support
cooperative efforts with industry to improve security and reliability.
Question 4. Do government contractors have an ethical or statutory
obligation to report cyber intrusions (either originating domestically
or overseas)?
Answer. We are not aware of any code of ethics or statutory
obligation that requires government contractors to report cyber
intrusions. Although the Federal Acquisition Regulation (FAR) requires
contracts over $5 million to include a clause requiring the contractor
to establish a written code of business ethics and conduct, there is no
FAR requirement that such codes address the subject of cyber
intrusions. FCC Directive 1479.3 (mentioned in the response to question
5), which is included in a small number of FCC IT contracts, requires
reporting of ``security incidents'' regarding FCC IT systems.
Question 5. Do government contractors with classified information
on their servers and individuals with security clearances on their
payrolls have a statutory or ethical obligation to report cyber
intrusions (either originating domestically or overseas)?
Answer. Under the National Security Act, government contractors and
their employees with security clearances have a statutory obligation to
protect the classified information that comes into their possession.
This requires the same reporting of cyber intrusions into systems that
involve sensitive information as fall to government employees.
Question 6. When Request For Proposals (RFPs) are put out for
contracts that involve sensitive or classified information do all of
these RFPs require that bids include the number of successful and
unsuccessful cyber intrusions committed by domestic or foreign entities
(either originating domestically or overseas)?
Answer. The FCC's information technology contracting procedures
require contractors to comply with the security matters addressed in
FCC Directive 1479, which ``establishes policy and assigns
responsibilities for assuring that there are adequate levels of
protection for all FCC information systems, the FCC Network,
applications and databases, and information created, stored, or
processed therein.''
A requirement that the vendor report the number of successful and
unsuccessful cyber intrusions is not a standard feature of FCC
contracts for information technology systems. However, under current
procedures this requirement could be included in the language for those
contracts for systems that involve sensitive information at the
discretion of the Contracting Officer. The nature of Internet-based
cyber attacks is such that careful attention would have to be given to
specifying definitions, thresholds and suspected origination of cyber
intrusions.
Question 7. In your opinion, if a private company believes that it
has been the victim of a cyber intrusion (both originating domestically
or overseas), which is the appropriate agency that it should report
this intrusion to?
Answer. If a cyber intrusion results in circuit-oriented or
switched-voice communications service outages that meet certain
thresholds, then the communications provider must report the outage and
the root cause (i.e., the cyber incident) to the FCC in accordance with
Part 4 of our regulations. As noted above, the FCC's National Broadband
Plan has recommended that outage reporting rules be expanded to include
ISPs and interconnected VoIP services through a rulemaking proceeding.
More generally, as the GAO has noted, where criminal activity is
involved ``the Departments of Justice (DOA Homeland Security (DHS), and
Defense (DOD), and the Federal Trade Commission (FTC) have prominent
roles in addressing cybercrime within the Federal Government. DOD's FBI
and DHS's U.S. Secret Service (Secret Service) are key Federal
organizations with responsibility for investigating cybercrime. State
and local law enforcement organizations also have key responsibilities
in addressing cybercrime.''
[Cybercrime--Public and Private Entities Face Challenges in
Addressing Cyber Threats, June 2007, GAO-07-705, p.1]
Question 8. In your opinion, if a government contractor believes
that it has been the victim of a cyber intrusion (both origination
domestically or overseas), which is the appropriate agency that it
should report this intrusion to?
Answer. In my opinion a government contractor should--unless the
applicable contract otherwise provides--first report a cyber intrusion
to the contracting agency; for example an FCC contractor should report
a cyber intrusion to the FCC. If criminal activity is suspected, then
the FCC will report the intrusion to the agency or agencies that
investigate cyber crime within the Federal Government, such as the
Departments of Justice and Homeland Security.
Question 9. In your opinion, if a government contractor that is
working on a sensitive or classified project and believes that it has
been a victim of a cyber intrusion (both origination domestically or
overseas), which is the appropriate agency that it should report this
intrusion to?
Answer. Unless the governing contract otherwise provides, a
government contractor should first report a cyber intrusion involving
sensitive or classified information to the contracting agency. If
criminal activity is suspected, then the agency should report the
intrusion to the agency or agencies that investigate cyber crime within
the Federal Government, such as the Departments of Justice and Homeland
Security.