[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]
H.R. 285: DEPARTMENT OF HOMELAND SECURITY CYBERSECURITY ENHANCEMENT ACT
OF 2005
=======================================================================
HEARING
before the
SUBCOMMITTEE ON ECONOMIC
SECURITY, INFRASTRUCTURE
PROTECTION, AND CYBERSECURITY
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED NINTH CONGRESS
FIRST SESSION
__________
APRIL 20, 2005
__________
Serial No. 109-11
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC] [TIFF OMITTED] TONGRESS.#13
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
__________
U.S. GOVERNMENT PRINTING OFFICE
22-904 WASHINGTON : 2005
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�0900012005
COMMITTEE ON HOMELAND SECURITY
Christopher Cox, California, Chairman
Don Young, Alaska Bennie G. Thompson, Mississippi
Lamar S. Smith, Texas Loretta Sanchez, California
Curt Weldon, Pennsylvania, Vice Edward J. Markey, Massachusetts
Chairman Norman D. Dicks, Washington
Christopher Shays, Connecticut Jane Harman, California
Peter T. King, New York Peter A. Defazio, Oregon
John Linder, Georgia Nita M. Lowey, New York
Mark E. Souder, Indiana Eleanor Holmes Norton, District of
Tom Davis, Virginia Columbia
Daniel E. Lungren, California Zoe Lofgren, California
Jim Gibbons, Nevada Sheila Jackson-Lee, Texas
Rob Simmons, Connecticut Bill Pascrell, Jr., New Jersey
Mike Rogers, Alabama Donna M. Christensen, U.S. Virgin
Stevan Pearce, New Mexico Islands
Katherine Harris, Florida Bob Etheridge, North Carolina
Bobby Jindal, Louisiana James R. Langevin, Rhode Island
Dave G. Reichert, Washington Kendrick B. Meek, Florida
Michael McCaul, Texas
Charlie Dent, Pennsylvania
______
Subcommittee on Economic Security, Infrastructure Protection, and
Cybersecurity
Daniel E. Lungren, California, Chairman
Don Young, Alaska Loretta Sanchez, California
Lamar S. Smith, Texas Edward J. Markey, Massachusetts
John Linder, Georgia Norman D. Dicks, Washington
Mark E. Souder, Indiana Peter A. DeFazio, Oregon
Tom Davis, Virginia Zoe Lofgren, California
Mike Rogers, Alabama Sheila Jackson-Lee, Texas
Stevan Pearce, New Mexico Bill Pascrell, Jr., New Jersey
Katherine Harris, Florida James R. Langevin, Rhode Island
Bobby Jindal, Louisiana Bennie G. Thompson, Mississippi
Christopher Cox, California (Ex (Ex Officio)
Officio)
(II)
C O N T E N T S
----------
Page
STATEMENTS
The Honorable Daniel E. Lungren, a Representative in Congress
From the State of California, and Chairman Subcommittee on
Economic Security, Infrastructure Protection and Cybersecurity. 1
The Honorable Loretta Sanchez, a Representative in Congress From
the State of California, and Ranking Member, Subcommittee on
Economic Security, Infrastructure Protection and Cybersecurity. 3
The Honorable Christopher Cox, a Representative in Congress From
the State of California, and Chairman, Committee on Homeland
Security....................................................... 4
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Security
Oral Statement................................................. 49
Prepared Statement............................................. 49
The Honorable Bobby Jindal, a Representative in Congress From the
State of Louisiana............................................. 53
The Honorable Zoe Lofgren, a Representative in Congress From the
State of California
Oral Statement................................................. 4
Prepared Statement............................................. 6
The Honorable Stevan Pearce, a Representative in Congress From
the State of New Mexico........................................ 51
WITNESSES
Ms. Catherine Allen, President and CEO, BITS, Financial Services
Roundtable
Oral Statement................................................. 21
Prepared Statement............................................. 23
Mr. Paul Kurtz, Executive Director, Cyber Security Industry
Alliance
Oral Statement................................................. 16
Prepared Statement............................................. 18
Mr. Harris Miller, President, Information Technology Association
of America
Oral Statement................................................. 11
Prepared Statement............................................. 12
Mr. Ken Silva, Chairman of the Board of Directors, Internet
Security Alliance
Oral Statement................................................. 37
Prepared Statement............................................. 39
Mr. Amit Yoran, President, Yoran Associates
Oral Statement................................................. 7
Prepared Statement............................................. 9
Appendix
Questions and Responses from Ms. Catherine A. Allen.............. 57
Questions and Responses from Mr. Paul B. Kurtz................... 61
Questions and Responses from Mr. Ken Silva....................... 63
H.R. 285: DEPARTMENT OF HOMELAND
SECURITY CYBERSECURITY ENHANCEMENT
ACT OF 2005
----------
Wednesday, April 20, 2005
House of Representatives,
Subcommittee on Economic Security, Infrastructure
Protection, and Cybersecurity,
Committee on Homeland Security,
Washington, D.C.
The subcommittee met, pursuant to call, at 11:05 a.m., in
Room 210, Cannon House Office Building, Hon. Dan Lungren
[chairman of the subcommittee] presiding.
Present: Representatives Lungren, Souder, Pearce, Jindal,
Cox (ex officio), Sanchez, Dicks, Lofgren, Langevin, Thompson
(ex officio), and Linder.
Mr. Lungren. The Committee on Homeland Security
Subcommittee on Economic Security, Infrastructure Protection,
and Cybersecurity will come to order. The subcommittee is
meeting today to hear testimony on H.R. 285, the Department of
Homeland Security Cybersecurity Enhancement Act.
In 1983, the film ``War Games'' depicted smart, tech-savvy
teenagers finding a back door into the Department of Defense
tactical computer. Mistaking real life for a war game, they
inadvertently bring the country to the brink of a nuclear war.
Although enjoyable as a film and fictional, the movie is a
stark reminder of the potential threats, vulnerabilities and
consequences of cyberattack.
Today's world is even more interconnected through
cyberspace, not just through the use of computers, but because
of our increasing reliance on cybersystems to control our
national infrastructures and economy.
Ensuring that essential services and industries survive an
attack has always been a part of our national security
strategy. What is new is how cyberspace networks have created
complex interdependencies that have never existed to this
extent before. The complexity and extent of these networks is
not fully understood. The technology and networks are
themselves constantly changing.
Identifying what is critical is becoming simultaneously
more difficult and more vital. Furthermore, the majority of
critical infrastructure is outside of Federal control, with 85
percent in private hands. The Department must work hand in hand
with the private sector not only because the majority of
structure is owned privately, but because the private sector is
at the forefront of innovative, productive and efficient
technologies to secure cyberspace and associated critical
infrastructure.
Many of us recognize the average cyberattack such as a worm
or virus is a nuisance, one that irritates us, slows down our
computers or prevents us from e-mailing. Yet deliberate
cyberattacks have the potential to do physical harm in the form
of attacks on cybersystems controlling critical
infrastructures, such as dams and power plants or medical
systems. Since I live just downriver of a dam, I am
particularly acutely aware of that. They can also be launched
coincident with physical attacks to interfere with our response
and to make a bad situation even worse.
It is typical to measure the potential cost of
probabilities of such attacks. There are no standard
methodologies for cost measurement, although the 2003 loss
estimates due to hostile digital acts range from $13 billion,
worms and viruses only, to $226 billion for all forms of overt
attacks.
Although accidental, the blackout of August 2003 may have
cost us about 6--to $10 billion for the U.S. economy alone,
which would amount to 1/10 of 1 percent of GDP. Clearly if the
attack had been deliberate, the potential loss could have been
much worse, and an attack on the financial services sector or
the stock market could have incalculable long-term economic
repercussions.
Recognizing this importance of cybersecurity to homeland
and economic security, the Congress, when it created the
Department of Homeland Security, directed this new department
to lead the effort to develop a comprehensive cybersecurity
strategy for the Nation. In response, the Department
established the National Cybersecurity Division within the
Information, Analysis and Infrastructure Protection Directorate
headed by a Director reporting to the Assistant Secretary of
Infrastructure Protection.
As chairman of the subcommittee, I appreciate the oversight
work that was done by the Select Committee on the Homeland
Security Subcommittee on Cybersecurity, Science, and Research
and Development during the last Congress, which culminated in
the subcommittee's excellent report entitled Cybersecurity for
the Homeland.
The report makes clear that under current organizational
structure, cybersecurity has not received the priority and
attention it deserves within the Department, and that the
National Cybersecurity Division needs explicit statutory duties
and authorities. These findings led to the drafting and
introduction of the bill that we are considering today, H.R.
285, the DHS Cybersecurity Enhancement Act of 2005, which was
introduced earlier this year by Congressman Mac Thornberry, the
former subcommittee chairman, and Congresswoman Zoe Lofgren,
the former Ranking Member and currently a member of our
subcommittee.
I am pleased we have an excellent panel of witnesses today
to help the subcommittee examine the need for this legislation.
In particular. We will hear from Mr. Amit Yoran, who was the
first Director of the National Cybersecurity Division with DHS,
and is a highly regarded cybersecurity expert. He left the
Department after 1 year and is in the unique position to help
us explore the challenges of cybersecurity within DHS.
Passage of H.R. 285 would not solve all of the problems
with cybersecurity within DHS, but it would elevate the mission
within the Department by creating a new position of Assistant
Secretary of Cybersecurity. This change would give the head of
the National Cybersecurity Division not only increased
prominence within the Department, but also give this official
greater clout across the Federal Government and the private
sector.
The bill also contains specific language that would outline
the responsibilities of the assistant secretary, guiding the
work that needs to be done to identify the threats and
vulnerabilities, mitigate those vulnerabilities, institute a
warning system, and be able to effectively and quickly respond
to an attack should one occur.
These statutory authorities will also serve to clarify
within DHS for the outside world the role and responsibilities
of the DHS Cybersecurity Office. Under the bill, the assistant
secretary also would assume authority over the National
Communications System, which will bring an end to DHS's current
treatment of telecommunications as separate from information
technology. This is essential because the real world
convergence of telephony and data is proceeding rapidly, and
DHS must integrate policy for securing these elements of the
cyberworld.
Today we have witnesses who represent the leading experts
in the cybersecurity industry with extensive experience working
either in or with DHS. We look forward to hearing from them and
why they think this legislation is important, presuming they do
believe it is important.
I would thank you all for appearing today.
I would recognize the Ranking Member Ms. Sanchez for any
opening remarks you would make.
Ms. Sanchez. Thank you, Mr. Chairman, and thank you all for
appearing before us today. We are looking forward to your
testimony. This morning we are going to hear testimony, and
this afternoon we are going to mark up H.R. 285, the Department
of Homeland Security Cybersecurity Enhancement Act of 2005.
I am so proud that this was written by my good friend from
California Ms. Zoe Lofgren and by Mr. Thornberry of Texas in
the last Congress when they had the roles of heading up the
subcommittee that handled cybersecurity, which of course now
has been put into this larger committee. I congratulate both of
them for the diligent work that they did and for bringing it
forward.
I am very grateful to the chairman of this committee and to
Mr. Cox and our Ranking Member Bennie Thompson for seeing the
necessity to bring this forward early in this session so that
we could get it done.
I know that it is a very bipartisan manner in which Ms.
Lofgren and Mr. Thornberry worked on this. I am happy to be a
cosponsor of this particular bill. I think it is incredibly
important that we look at the cybersecurity component of our
economic security of this country, in particular banking and
finance. I myself used to work in that arena on Wall Street. I
believe it is just incredibly important for us to make sure
that we do secure this.
I hope that this bill, H.R. 285, will raise the visibility
of the need to really explore cybersecurity, understand it, and
get that under control so that we don't have an attack on
either one of our infrastructure pieces, like a dam, for
example, or, more importantly, that we don't lose everybody's
money somewhere out in cyberspace or to the bad guys.
So I am looking forward to this. I think having an
assistant secretary is going to be important, and that person
will be able to raise the visibility of this. I am confident
that we are going to pass this piece of legislation.
So, thank you, Mr. Chairman, and I--.
Ms. Lofgren. Would the gentlelady yield?
Ms. Sanchez. Should I yield to her, or will you be
recognizing her?
Mr. Lungren. I was going to recognize her after I recognize
the chairman of the full committee.
Ms. Lofgren. Okay.
Mr. Lungren. The chairman of the full committee.
Mr. Cox. Thank you very much.
Since we are about to hear from Congresswoman Lofgren, and
since Mr. Thornberry is not here, let me acknowledge both of
them, and thank you for your leadership on this legislation.
The Homeland Security Committee has organized itself again, as
we did as a select committee in the preceding Congress, in
subcommittee around this mission of cybersecurity. It is the
fact that not only is the Department of Homeland Security, our
newest Cabinet department, already the third largest Cabinet
department, but, in addition, it is the locus within the
Federal Government for a new mission not just for our
government, but for our country, and that is cybersecurity.
It is the focal point within the Federal Government for all
of our efforts not just at the government level, but also
internationally and in the private sector, to prevent harm to
our national security and to our economy from cyberattacks.
We have, I think, some skeletal frameworks from which to
work: HSPD 7, the President's National Strategy to Secure
Cyberspace, the National Response Plan to the extent that it
treats cyberincidents. But what we need clearly inside the
Department of Homeland Security is leadership, and that entails
organizational responsibility and the opportunity to lead. So
this Committee in the 109th Congress, the Select Committee in
the 108th, have identified, with our partners outside the
government, this organizational step as a key one, the step
that we are proposing to take in this legislation.
I am very, very anxious to hear from our witnesses today to
make sure that we continue on the right track. But I believe
that an extraordinary amount of thought has been given to this
over the period of now a few years under the leadership of Mr.
Thornberry and Ms. Lofgren. So I want to thank you for that
leadership.
I want to thank the chairman and Ranking Member of this
subcommittee for renewing our efforts as a Homeland Security
Committee and to see this job through completion. I hope that
today's hearing moves us along on that path.
Mr. Lungren. Thank you, Mr. Chairman.
Before we hear from the panel, I would recognize the
gentlelady from California Ms. Lofgren, who is the author of
the bill and a member of this subcommittee.
Ms. Lofgren. Thank you very much, Mr. Chairman.
I do believe this bill is very important, and as has been
mentioned, it is very bipartisan in nature. It was largely
prepared through the direction of Congressman Mac Thornberry
and myself in our roles in the last Congress in the
Cybersecurity Subcommittee. Want to thank Mac Thornberry and
also his staff for their collaboration and hard work on this
bill. I am really very proud of the work that Mac and I did in
a truly bipartisan way on the issue of cybersecurity in the
last Congress.
During that 108th Congress, the subcommittee conducted many
hearings and briefings from Members of Congress and staff on
cybersecurity issues. The subcommittee also reached out to
diverse groups of individuals on seeking ways to improve
cybersecurity for the Nation. Since May of 2003, 15 hearings
and briefings were conducted, as well as additional and formal
meetings with Members and staff. We heard from private sector
experts who operate critical information infrastructure;
Federal, State and local officials; academic experts and the
like. A variety of witnesses also discussed the Department of
Homeland Security's role and responsibilities in securing
cyberspace.
To make a long story short, as the chairman of the full
committee has mentioned, we do have an adopted strategy, but
the strategy has not yet been implemented. It has become clear
to myself and Congressman Thornberry and many, many others that
we need a higher level of attention within the Department.
Obviously, there is much to do. This bill will not in and of
itself solve the issues, but it will put us on a footing, we
believe, to actually get the attention that we need.
The position would be an Assistant Secretary of
Cybersecurity within the Information, Assurance and
Infrastructure Protection Directorate, and the second--the path
the bill also accomplishes is to define cybersecurity at the
department level so that a consistent and authoritative
definition can be integrated throughout the Department.
I would ask that my full statement be submitted for the
record, but I would note that the Department of Homeland
Security is not alone in focusing on the issue of
cybersecurity. Clearly most of the infrastructure is within the
private sector, not within the government. NSF has recently
engaged in a very important funding of research in the
cybersecurity area with a number of academic institutions. One
of them, Professor Shankar Sastry at the University of
California, who has been very helpful to us on this effort, was
recently quoted and talking about the issue of cybersecurity,
that we don't want to have a digital equivalent of Pearl
Harbor.
So right now we are worried about viruses and worms, but
the exposure that we have is very large. We are very behind in
where we need to be to protect the infrastructure of the
Nation. So this is serious stuff. I believe that adopting this
bill promptly will get us further down the road to where we
need to be.
I appreciate the support of the chairman and Ranking
Member, both of the full committee and the subcommittee, in
promptly moving this forward.
I yield back the balance of my time, and I thank you.
Prepared Statement of the Congresswoman Zoe Lofgren
This bill addresses an issue that I believe is very
important making sure that our government, working together with the
private sector and academia, is doing all that it can to ensure that
cyber security is a top priority in our nation's homeland security
strategy.
This bill is bipartisan in nature and was largely prepared
through the direction of Representative Mac Thornberry and myself in
our roles as leaders of the Cyber security Subcommittee last year. I
thank Mac and his staff for their collaboration and hard work on this
bill, I am proud to have been able to work with him in a truly
bipartisan fashion to address this great need.
During the 108th Congress, the Subcommittee conducted
numerous hearings and briefings fro Members of Congress and staff on
cyber security issues. The Subcommittee also reached out to diverse
groups and individuals on ways to improve cyber security for the
nation. Since May 2003, fifteen hearings and briefings were conducted,
as well as several other informal sessions with Members and staff. The
committee heard from private sector experts who own and operate
critical information infrastructure. Federal, state and local
government officials and academic experts testified on the need to
fortify the nation's cyber security. A variety of witnesses also
discussed the Department of Homeland Security's role and
responsibilities in securing cyberspace.
The subcommittee initially focused its oversight on the
key management functions required for the success of any organization.
Through hearings and oversight letters, the Subcommittee questioned DHS
about its cyber security mission and functions. The subcommittee was
also interested in how DHS was developing working definitions related
to cyber security and what progress it was making to implement a viable
organizational structure, as well as formal personnel, resource and
programmatic efforts.
Unfortunately, the level and detail of planning documents
needed to manage the new cyber mission within DHS was not forthcoming.
Budget paperwork throughout the fiscal year was vague. It is still
unknown whether spending plans and detailed budget execution data
exists.
These are some of the reasons why I believe this bill is
necessary and can only help to improve our nation's level of cyber
security.
This bill accomplishes two essential tasks: it establishes
an Assistant Secretary of Cyber Security within the Information
Assurance and Infrastructure Protection Directorate to prioritize cyber
security and protect our computer networks.
The position, at this higher level, will be better able to
coordinate with other Assistant Secretaries within the Directorate, as
well as officials throughout the Department, other federal agencies,
and the private sector.
The second task this bill accomplishes is to define cyber
security at the Department level, so that a consistent and
authoritative definition can be integrated throughout the Department's
mission and policy functions.
I continue to hear from cyber security experts about the
threats and vulnerabilities facing our nation's networks and
systems.Unfortunately, these continue to grow faster than our nation
can address them.
These vulnerabilities will continue to hamper our homeland
security efforts if we do not make cyber security a major priority.As
long as our critical infrastructures are interconnected and
interdependent, the likelihood that a cyber attack will disrupt major
services or cripple our economy will remain and the threat will
increase.
If a cyber attack occurred simultaneously as a physical
attack, critical emergency response systems and communications
operations could be taken out, increasing the casualties and confusion
of an attack.
The Department needs to be advancing on cyber security -
it cannot afford to sit back and make minimal, if any, progress in this
area. It certainly needs to be doing more than re-creating programs
that existed before the Department's creation.Unfortunately, that is
all that is happening today.
I fear that the Department is unable to move forward on
cyber security because it lacks the leadership necessary to focus on
its unique and cross-cutting nature. The individual responsible for
leading the government's cyber security efforts must have more
authority within the Department of Homeland Security.
I recognize that the government cannot develop plans for
physical security in a vacuum--those dealing with both of those issues
must be able to communicate and collaborate. At the same time, though,
the government cannot be naive in its approach. The first responders
and security actors for cyber assets are not the same as in the
physical world. This bill recognizes this difference, while keeping in
place the mechanisms for collaboration with the Infrastructure
Protection Directorate.
Thank you Chairman Cox and Ranking Member Thompson for
bringing this bill before us today. I am certain that our discussion
that we are about to have on the merits and the importance of this
bill.
I know that some may argue that this bill is unnecessary
and that the Department already has authority to do this work now. If
that is true, then I ask why it has not been done already. In our role
of as the authorizers and the overseers of the Department of Homeland
Security, I believe it is critical for us to give the Department
guidance as to how it should manage the tremendous tasks that it has
been given. To sit by and do nothing would place our nation in greater
danger than it is today, and I for one am unwilling to do nothing.
I strongly urge you to vote in favor of this bill.
Mr. Lungren. I thank the gentlelady for her comments and
congratulate her on this piece of legislation.
Other members of the committee are reminded that opening
statements may be submitted for the record.
We are pleased to have the distinguished panel of witnesses
before us on this important topic.
The Chair now recognizes Mr. Amit Yoran, the president of
Yoran Associates and the former Director of the National
Cybersecurity Division of the Department of Homeland Security.
Before you testify, could you tell me if I am pronouncing
your name correctly?
Mr. Yoran. Yes, sir, that was perfect.
Mr. Lungren. Very good. Thank you.
All witnesses should know that your written testimony will
be submitted for the record. I would ask that you try to limit
your comments to 5 minutes so that we can make sure that we
hear all of you and then get involved in Q and A.
Mr. Yoran.
STATEMENT OF AMIT YORAN, PRESIDENT, YORAN ASSOCIATES
Mr. Yoran. Good afternoon, Chairman Lungren and
distinguished members of the subcommittee. I would like to
first thank Congressman Thornberry and Congresswoman Lofgren
and their staffs for their tireless efforts in the important
topic of cybersecurity and for the entire subcommittee's
bipartisan attention to this important topic.
My name is Amit Yoran, and I am pleased to have the
opportunity to appear before the subcommittee today to discuss
enhancements to our national efforts to secure cyberspace. I am
president of Yoran Associates, a technology strategy and risk
advisory business headquartered in northern Virginia.
In our practice we advise a number of global enterprises on
their technology strategy and mitigating associated business
risks and exposures. Prior to founding Yoran Associates, I
served as the Director of the National Cybersecurity Division
of the Department of Homeland Security responsible for building
a national cyberresponse system, a national threat and
vulnerability reduction program, a national cyberawareness and
training program, and establishing increased security and
coordination among and between government and international
counterparts. Much work has been done in the implementation of
the above responsibilities by both the public and private
sectors, and even more work remains ahead of us.
Protecting America from physical threats is a concept well
understood by senior leadership and risk managers, where sound
understanding of the challenges, consequences of failure and
specific work plans to be accomplished are ongoing as part of a
unified protection effort. Our ability to conceptualize and
defend against physical threats has matured over many years.
Changes to critical infrastructures do not occur on a highly
dynamic basis.
On the other hand, our use of and reliance on technology
transforms continually in today's modern competitive
environments. Significant challenges remain in raising
awareness and understanding of vulnerabilities to cyberfailure
or attacks to the leadership which structure and resource
defensive efforts. The challenge to change our thinking is
consistent in both the government and private sector.
Since the creation of the Department of Homeland Security
approximately 2 years ago, a massive restructuring has occurred
in the Federal Government. More important than the
restructuring and the organizational charts is the fantastic
work being accomplished by so many talented and dedicated
public servants serving in the most noble and challenging of
undertakings, protecting our homeland and the American people.
Responsibility for protecting these business-critical
systems lies largely in the private sector, where nearly all of
these critical infrastructure systems are owned and operated.
Organizational leadership must encourage the inclusion of
technology risks into their business risk management practices.
Responsible business risk practices require a thorough
evaluation and informed acceptance of technology and business
exposures, or investment in risk mitigation techniques.
Forward-thinking organizations are protecting themselves from
significant threats and exercising their response plans in
simulated cybercrisis scenarios. These types of activities can
be used effectively to create awareness among organizational
leadership. In essence, industry must not wait for government
action before securing systems and improving their
organizational policies and procedures.
Some critical functions and responsibilities in our
national cybersecurity efforts are inherently governmental,
such as providing a survivable communications capability in
various bad-case cyber and telecommunications outage scenarios,
raising the awareness of threat information and coordinating
national response efforts. I challenge the committee to assist
the Department in increasing the investments being made in
fundamental cybersecurity research and development.
Secretary Chertoff is in the midst of his departmental
analysis and restructuring effort, the second stage review. The
Directorate of Information Analysis and Infrastructure
Protection under which the National Cybersecurity Division
resides is charged with performing some of the most important
mission functions of DHS. It is imperative that we afford the
Secretary the opportunity to design and structure the
Department to the best of his ability and satisfaction and to
provide him and his team whatever support we can in
accomplishing their mission. Creating greater unity and clarity
around cyberefforts will result in further inclusion and better
integration of cybersecurity thinking, awareness and protective
measures across all of the various programs and efforts taking
place to protect America.
The creation of an assistant secretary position to address
cybersecurity issues is not inconsistent with a unified or
integrated risk management approach. On its own, it does not
address the government's challenges in cybersecurity. There are
several areas where greater clarity is needed and support must
be given to centralize cybersecurity functions across the
government. The Department of Homeland Security struggles with
its mission responsibility of security for government computer
systems, but FISMA authorities lay entirely within OMB.
Consideration of this topic by the committee can provide needed
attention and have significant impact on improving operations
on government cyberpreparedness.
Procurement practices by the Federal Government to enhance
cybersecurity features, functionality and requirements are not
effective and are rarely enforced with consistency, resulting
in the single greatest missed opportunity to positively
influence and drive better security capabilities into the
products that are used by both government and private sectors.
There are many dedicated Americans in both the public and
private sector working on these challenges to our economic and
homeland security. It is my hope that the Committee on Homeland
Security can provide them further mission guidance, support our
common cause and assistance wherever possible.
I look forward to answering any questions you may have.
Mr. Lungren. Thank you very much, Mr. Yoran.
[The statement of Mr. Yoran follows:]
Prepared Statement of Amit Yoran
Good afternoon, Chairman Lungren and distinguished Members of the
Subcommittee. My name is Amit Yoran and I am pleased to have an
opportunity to appear before the subcommittee today to discuss
enhancements to our national efforts to security cyberspace. I am the
President of Yoran Associates, a technology strategy and risk advisory
business headquartered in Northern Virginia. In our practice, we advise
a number of global enterprises on their technology strategy and
associated business risks and exposures. Prior to founding Yoran
Associates I served as the Director of the National Cyber Security
Division of the Department of Homeland Security (DHS), responsible for
building, (1) a national cyber response system; (2) a national threat
and vulnerability reduction program; (3) a national cyber awareness and
training program; and (4) establishing increased security and
coordination among and between government and international
counterparts. Much work has been done in the implementation of the
above responsibilities by both the public and private sector and even
more work remains ahead of us.
Protecting America from physical threats is a concept well
understood by senior leadership and risk managers, where sound
understanding of the challenges, consequences of failure, and specific
work plans to be accomplished are ongoing as part of a unified
protection effort. Our ability to conceptualize and defend against
physical threats has matured over many years. Changes to critical
infrastructures do not occur on a highly dynamic basis. On the other
hand, our use of and reliance on technology transforms continually in
modern competitive environments . Significant challenges remain in
raising awareness and understanding of vulnerability to cyber failures
or attacks to the leadership which structure and resource defensive
efforts. This challenge to change our thinking is consistent in
government and the private sector.
Since the creation of the Department of Homeland Security,
approximately two years ago, a massive restructuring has occurred in
the Federal Government. But more important than the restructuring and
the organizational charts is the fantastic work being accomplished by
so many talented and dedicated public servants serving in the most
noble and challenging undertakings; protecting our homeland and the
American people.
The task in securing America's cyber infrastructures is a daunting
and very real challenge. Efforts to secure the computer systems on
which our nation's critical infrastructures and our economic stability
rely are being addressed with a pre-9/11 lack of urgency. As we failed
to grasp the gravity of the World Trade Center bombings in 1993, today
we are not acting aggressively on the numerous warning signs of
critical infrastructure computer failures; the Northeast-Midwest
blackout of 2003, ATM outages and airline system failures or on the
numerous computer threats actively working against our economic
security. Simply put, many American business interest have a
significant if not complete reliance on general purpose computers and
inter-connected networks which can generally be categorized as
untrustworthy. The recipes for disaster are present.
Responsibility for protecting these business critical systems lies
largely in the private sector where nearly all of these critical
infrastructure systems are owned and operated. Organizational
leadership must encourage the inclusion of technology risks into their
business risk management practices. Responsible business risk practices
require a thorough evaluation and informed acceptance of technology and
business exposures or investment in risk mitigation techniques. Forward
thinking organizations are protecting themselves from significant
threats and exercising their response plans in simulated cyber crisis
scenarios. These types of activities can be used to effectively create
awareness among organizational leadership. In essence, industry must
not wait for government action to begin securing systems and improving
organizational policies and procedures.Sec.
Some critical functions and responsibilities in our national cyber
security efforts are inherently governmental, such as providing a
survivable communications capabilities in various bad-case cyber and
telecommunications outage scenarios, raising awareness of threat
information and coordinating national response efforts. I challenge the
Committee to assist the Department in increasing the investments being
in fundamental cyber security research and development.
Secretary Chertoff is in the midst of his departmental analysis and
restructuring effort--the second stage review. The Directorate of
Information Analysis and Infrastructure Protection under which the
National Cyber Security Division resides, is charged with performing
some of the most important mission functions of DHS. It is imperative
that we afford the Secretary the opportunity to design and structure
the Department to the best of his ability and satisfaction and to
provide him and his team whatever support we can in accomplishing their
mission. Creating greater unity and clarity around cyber efforts will
result in the further inclusion and better integration of cyber
security thinking, awareness and protective measures across all of the
various programs and efforts taking place to protect America.
The creation of an Assistant Secretary position to address
cybersecurity issues is not inconsistent with a unified or integrated
risk management approach. On its own it does not address the
Government's challenges in cyber security. There are several areas
where greater clarity is needed and support must be given to centralize
cyber security functions across government. The Department of Homeland
Security struggles with its mission responsibilities of security for
government computer systems, but FISMA authorities lay entirely within
OMB. Consideration of this topic by the Committee can provide needed
attention and have significant impact on improving operations and
government cyber preparedness. Procurement practices by the Federal
Government to enhance cyber security features, functionality and
requirements are not effective and are rarely enforced with
consistency, resulting in the single greatest missed opportunity to
positively influence and drive better security capabilities into the
product sets used by both government and private sectors.
There are many dedicated Americans in both the public and private
sector working on these challenges our economic and homeland security.
It is my hope that this Committee on Homeland Security can provide them
further mission guidance, support our common cause and assistance
wherever possible. I look forward to answering any questions you may
have.
Mr. Lungren. The Chair now recognizes Mr. Harris Miller,
president of the Information Technology Association of America,
to testify. I must say I knew Mr. Miller in another life when
he was neither as well dressed or as profitable-looking as he
is now. It is good to see you have reached success in your
older years.
STATEMENT OF HARRIS N. MILLER, PRESIDENT, INFORMATION
TECHNOLOGY ASSOCIATION OF AMERICA
Mr. Miller. Thank you, Mr. Chairman. It is a great honor
and pleasure to be here in front of Lungren 2, Congressman
Lungren's return. We got the great opportunity to work with you
on the Judiciary Committee. It was a great honor and pleasure
to serve you there. It is a great honor to appear before you,
Congresswoman Sanchez, Chairman Cox and Ranking Member
Thompson, and other members of the subcommittee today.
I want to join in commending Congressman Thornberry and
Congresswoman Lofgren for introducing this important
legislation, and I urge the subcommittee to pass it and move it
through the full committee of the House, and we hope to get
cooperation from the other side of the Hill, too.
Exhibit A about why this legislation is sitting immediately
to my right. Mr. Yoran is too much of a gentleman to perhaps
explain fully why he is back in the private sector after a
relatively short period of time in the government, and I am not
going to put any words in his mouth, but we at the private
sector were very excited when he agreed to come back into
government to serve in this position.
But we felt that because of where the position is located
in the Department, a head of a division as opposed to an
assistant secretary level, that a lot of the ideas and work and
enthusiasm that might have been brought to the position simply
couldn't be done because of where the position is located.
We also commend the current Acting Director Mr. Purdy. He
is also trying very hard. But at the end of the day, Mr.
Chairman, as you know very well, in this town where you stand
is where you sit; and where you sit is where you stand. When
you are down as a head of a division, you simply cannot bring
the firepower and the leadership to the issue that you can as
an assistant secretary, a confirmable position.
So we think that the idea that Congressman Thornberry and
Congresswoman Lofgren have incorporated into this legislation
is critical. We urge you and the subcommittee to move it
forward.
Certainly, a couple of simple points, number one, prior to
the formation of the Department of Homeland Security, the
cybersecurity issue was so important in this administration
that the position was a special advisor to the President of the
United States. That is where the locus of this government's
focus on cybersecurity was. After the Department was formed, it
was--ended up--as a head stuck in a division. That shows you
that without any real indication of any change of the
importance of the issue in terms of our country and protecting
our homeland, the position was significantly downgraded. As a
result, a lot of the work that President Bush and his
administration put into the National Strategy to Secure
Cyberspace, which was released a little over 2 years ago,
frankly hasn't been implemented because we have not had the
type of leadership we need. This is no slap on Secretary Ridge
and now Secretary Chertoff, but at the end of the day, if you
don't have someone high enough in the organization to show
leadership on the issue, it simply isn't going to happen.
Now we understand that--the argument on the other side,
that physical security and cybersecurity need to be closely
integrated. That is why they initially didn't want to have an
Assistant Secretary for Cybersecurity because it not was not
thought to be a separate issue. We understand that there is an
argument on that side, But we happen to think it is inaccurate
for reasons that Mr. Yoran indicated.
Just think about it. At the end of the day, people are much
more afraid of bombs and anthrax than they are of viruses and
worms. They have a lot of experience of dealing with these
physical threats. But the cyberworld is much different. It is
much more out there in cyberspace, so to speak, and people
don't quite understand it. So, again, putting it in the
physical arena, the resources, the attention, the expertise and
the government was all loaded toward people on the physical
side, which is incredibly important, Mr. Chairman. We are not
saying it is not, but it simply is different.
There is also a fundamental cultural issue. How many people
involved in law enforcement and physical threats have ever gone
to cyberschool, and how many cybergeeks have ever gone to
physical school? They simply live in different cultures, in
difference worlds. Now there are a few people that have skills
on both sides, but it is a different world. It is a different
set of issues.
Again, having someone in government who understands that
fundamentally at the right level of government, at the
assistant secretary level, we think is critically important to
furthering the agenda that is absolutely necessary. It is all
about resource allocation. It is all about allocating those
resources, and it is all about having the ear of the people at
the top.
At the end of the day, Mr. Chairman, as you said in your
opening statement, 85 percent of our critical infrastructure is
controlled by the private sector. One of the most important
roles the government can play in cybersecurity is as a bully
pulpit, getting out in front of people in the private sector to
explain to them why they have to put as much priority on
cybersecurity as they do on physical security, why they can't
always be trying to turn around and say, what is the ROI on
this? Again, I ask you, is it more likely to be successful if
that person sending that message is an Assistant Secretary for
Cybersecurity, or is it someone who frankly is pretty far down
in the bureaucracy?
Mr. Chairman, as you said your opening statement, creating
an assistant secretary is not going to solve all the problems,
but it will get the cybersecurity issue back to the level of
attention it had prior to the creation of the Department of
Homeland Security. It will enable us to move forward with so
many great ideas, which are included in President Bush's
National Strategy.
I think moving this legislation will be very important to
the protection of our Nation's homeland.
Mr. Lungren. Thank you, Mr. Miller.
[The statement of Mr. Miller follows:]
Prepared Statement of Harris N. Miller
Introduction
I am Harris N. Miller, President of the Information Technology
Association of America (ITAA), representing over 380 member companies
in the information technology (IT) industry--the enablers of the
information economy. Our members are located in every state in the
United States, and range from the smallest IT start-ups to industry
leaders in the software, services, systems integration,
telecommunications, Internet, and computer consulting fields. These
firms are listed on the ITAA website at www.itaa.org.
I appreciate this Subcommittee taking time from its very busy
schedule to hold this hearing today on the need to elevate the issue of
cyber security within the Department of Homeland Security (DHS) by
creating an Assistant Secretary for Cyber Security. The constant
attention by this Committee to the importance of cyber security in
protecting our nation against terrorism is greatly appreciated by my
members and all IT customers, whether they be individuals or companies.
After a lull in major network exploits, we have seen the issues of
information security and critical infrastructure protection spring back
into the news with the recent data breaches experienced by data
brokers, database companies, universities, payroll processors and other
types of organizations. As the development and adoption of electronic
commerce evolves, the issue of ``trust'' becomes increasingly
important. Businesses, government and citizens alike must trust the
security of their information and the identity of the person or company
on the other end. They must know the systems they are using are
reliable. Events that shake this trust--whether real or perceived--pose
a threat to the development of electronic commerce and the growth of
the U.S. economy.
ITAA has played a major role in addressing the numerous issues of
enhanced information security and cyber crime prevention. Our
information security program dates back to 1999, with active
participation from 250 IT companies. Since that time, along with many
other accomplishments, ITAA has been proud to serve as a co-founder of
the National Cyber Security Partnership, to chair the Partnership for
Critical Infrastructure Protection, to co-found the National Cyber
Security Alliance and the IT Information Sharing and Analysis Center
(IT-ISAC) and to act as Sector Coordinator for the IT industry under
Homeland Security Presidential Directive 7.
Why the U.S. Needs an Assistant Secretary for Cyber Security
Since the creation of the Department of Homeland Security, the
Congress has become increasingly aware of the enormously complex
challenges related to cyber security. The result is overwhelming
bipartisan support in the committees of jurisdiction for a robust
National Cyber Security Division (NCSD) to meet the broad challenges
posed in the 2003 President's National Strategy to Secure Cyberspace.
These challenges include creating and managing: a national cyber
response system; a national program to reduce cyber security threats
and vulnerabilities; a national cyber awareness and training program;
and programs of coordination among federal, state and local
governments, as well as with the private sector and with international
partners.
ITAA, too, has been for several years advocating the need for a
senior cyber security executive within the Federal government to help
coordinate national cyber security policy among all industry,
government and private sector stakeholders. We were the first
organization to call for the creation of a cyber security ``czar,'' and
were very pleased that first President Clinton, by holding a White
House meeting on cyber security in early 2000, and then President Bush,
by establishing a cyber security advisor in the White House at the
beginning of his term, each showed great leadership. But since the
creation of the Department of Homeland Security, and the effective
organizational demotion of the cyber security position, our concerns
about Executive Branch leadership have returned.
Given strong bipartisan calls within Congress for a more robust
NCSD capable of pulling together and coordinating among diverse
entities within both government and the private sector, we feel very
strongly that an Assistant Secretary position leading the NCSD is
needed to meet the growing public administration, resource and policy
challenges related to cyber security. This means coordinating closely
with, but outside of, the Infrastructure Protection Division. When DHS
was created, the decision was made to subsume cyber security
coordination and outreach functions under an Assistant Secretary for
Infrastructure Protection, on the premise that the integration of
physical security and cyber security is better managed by one person,
and that cyber security is only one component of physical security.
Our view, on the contrary, is that integration is best managed by
two individuals, each experts in their respective fields, with a
commitment to coordinating physical and cyber security where they are
interrelated, with neither vital function subordinated to the other. It
is clear that all of the nation's critical infrastructures, including
water, chemicals, transportation, energy, financial services, health
care, and others, rely significantly on computer networks to deliver
the services that maintain our safety and national economy. It,
therefore, is incumbent on the owners and operators of those critical
infrastructures to manage improvements in the security of their
information systems and to have a senior individual within the
government, with effective influence and budget authority, who can
coordinate collaborative efforts across critical infrastructure sectors
and with state and local governments.
The NCSD has indeed made some progress; we applaud the valiant
efforts of the former director and the current acting director and
their creative and dedicated staff. But the current integration of
cyber security and physical security is not working. As the IT Sector
Coordinator, co-founder of the National Cyber Security Partnership and
Chair of the Partnership for Critical Infrastructure Security--the
cross-sectoral council of Federally-designated sector coordinators--
ITAA has witnessed the growing demands the Congress has placed on the
NCSD to implement policies consistent with and beyond the President's
National Strategy to Secure Cyberspace. ITAA also has experienced
ongoing frustration with the confusion in the NCSD and its unrealized
potential.
Indeed, the President's National Strategy is not being implemented
as quickly and fully as it should, in large part, we believe, because
the current organizational structure at DHS allows cyber security
priorities to be marginalized against other physical security
activities considered to have higher priority. Good management is
always about allocating resources to the highest priorities set by both
the Department and Congress, but too often the cyber security function
has suffered from missteps, and an increasing inability to meet the
growing challenges that have been identified by Congress, government
entities and the private sector.
Among them:
DHS took several months to provide formal response to
major private sector recommendations emerging from the December
2003 National Cyber Security Summit (see
www.cyberpartnership.org), conducted in partnership with DHS
and Secretary Ridge and designed to act on the President's
National Strategy;
A major ``Partner Program'' conference scheduled last
year with industry and DHS was abruptly cancelled days before
the event without explanation;
The development of implementing regulations under the
Homeland Security Act to protect critical infrastructure
information (PCII) voluntarily submitted by private sector
entities fails to facilitate information flows--as the law
intended--from the private sector custodians of cyber security
early warning, analysis, and forensics--to DHS. The IT-ISAC,
for example, has submitted no critical cyber security
information to DHS under this program, because the prescribed
process does not reflect the realities of information
management and proprietary business information within the
private sector;
DHS attempts to reorganize the private-sector ``Sector
Coordinator'' and ISAC structures under Homeland Security
Presidential Directive 7 proceeded against the counsel of
several critical infrastructure representatives whose views may
have been better reflected in this DHS initiative had they been
heard at a more senior political level--such as an Assistant
Secretary--with guiding authority over staff;
NCSD's cyber security R&D budget authority remains low
and ineffectual. A division with an Assistant Secretary at the
helm would likely command more resources; and
It will not be until November of 2005 before we have a
full cyber threat and attack exercise as a component of the
DHS/industry critical infrastructure protection/emergency
response exercises in the TOPOFF series, despite the real and
identified threat of a coordinated physical/cyber attack on one
or more of our critical infrastructures
The resulting bipartisan proposal within the Intelligence Reform
bill to authorize the creation of an Assistant Secretary for Cyber
Security underscores Congressional demands for a confirmable position
of increased leadership within DHS that reflects the need for greater
accountability to Congress.
Congressional Leadership
Last year, an amendment in the 9/11 bill creating the Assistant
Secretary position was removed because of confusion during 11th hour
negotiations. What was clear, however, was a White House position of
``no objection'' to the bill. Administrations as a matter of principle
object to Congressional micromanagement of the President's
organizational prerogatives. The official White House position of
neutrality in this particular case, however, speaks volumes, in our
view, about the level of support within the White House for an
improvement in the functioning of the cyber security activities of DHS.
The House Subcommittee on Cyber Security, Science and Research &
Development underscored the need for an Assistant Secretary in its
December 2004 Report on Cyber Security for the Homeland. The
Subcommittee cited creation of this position as one of six ``core''
areas in its cyber security roadmap for the future.
We wholeheartedly applaud and support Congress in its efforts to
provide the legislative impetus for this important position, and
accordingly support H.R. 285.
While we believe the Assistant Secretary position is critical, it
is not the only critical step remaining in this journey. The cyber
security threat is constantly changing, and Congress has a role in
assuring that adequate investment is made in safeguarding critical
infrastructure and the U.S. economy from next generation threats.
Practical steps involve increasing appropriations for cyber
security research as authorized in the Cyber Security Research and
Development Act of 2002. More research is needed to improve information
systems, and identify and reduce their vulnerabilities. Congress should
also authorize and appropriate increases in the funding of NIST to
support its Computer Security Division--a critical resource in the
development of computer security standards and best practices for the
private sector and government agencies.
Congress should also act to encourage the private sector to adopt
more rigorous information security practices. For instance, lawmakers
should explore whether, and under what circumstances, commercially
viable information security insurance can be used as a market driver
toward improvements in information security management in the
enterprise. Other potentially productive strategies include considering
limits on liability from cyber security breaches for companies that
implement industry-agreed practices and creating economic incentives
for information security technology procurement and implementation
Finally, the Senate should ratify the Council of Europe Convention
on Cyber Crime, signed by the United States in November 2001.
Conclusions
No government executive will create single-handedly the policies or
regulations to herald a new age of information security or to make
cyber vulnerability a thing of the past. Logic tells us that we have
turned a corner in our reliance on the Internet, and that along with
the many blessings of the information economy and the knowledge society
come the risks posed by the cyber delinquent, cyber criminal and cyber
terrorist. A responsible government takes the steps necessary to
maximize the benefits and to manage the risks appropriately.
Creating an Assistant Secretary for Cyber Security advances the
cause of information security, introducing practical advantages and
sending an important symbolic message. Much needs to be done to improve
the performance and to elevate the position of cyber security as an
issue in the Administration, to coordinate information security across
disparate government agencies, and to build the necessary bridges
between the federal government and critical infrastructure industries.
For far too long, the federal government's symbolic role in information
security has gone begging--the ``bully pulpit'' stands empty.
Consumers, small businesses and other organizations peg their response
to various issues by the actions (or lack thereof) of policymakers. We
believe that cyber security is one such issue.
In calling for the increased leadership that we believe an
Assistant Secretary will bring to the goal of heightened cyber
security, industry also stands ready to do its part--and the good news
is that we have done much already. An ITAA-commissioned survey
conducted by the University of Southern California's Institute for
Critical Information Infrastructure Protection (ICIIP) at the Marshall
School of Business identified 175 examples of cyber security enhancing
products, services or activities from 65 responding organizations,
including cross-sectoral and vertical industry groups and trade
associations, multinational and owner-operated businesses, academic
institutions, and professional societies. Intrusion detection and early
warning networks, structures for information sharing, enhanced
commercial products across an array of information security
functionalities, guides, white papers, no-charge anti-virus protections
and automatic software update capabilities are just some examples of
the industry-led strides to raise the nation's cyber security profile.
The federal government faces a full agenda of cyber security
issues. The challenges of providing critical infrastructure protection
are formidable today and are likely to be even significant in the
future. An Assistant Secretary for Cyber Security can make an important
difference. We thank the Subcommittee for bringing this important issue
to the attention of the American people.
Thank you very much.
Mr. Lungren. The Chair will now recognize Mr. Paul Kurtz,
the executive director of the Cybersecurity Industry Alliance,
to testify.
STATEMENT OF PAUL KURTZ, EXECUTIVE DIRECTOR, CYBER SECURITY
INDUSTRY ALLIANCE
Mr. Kurtz. Thank you, Mr. Chairman. Thank you, Ranking
Member Sanchez.
I want to recognize, as Amit and Harris have done, the work
of Congressman Thornberry and Congresswoman Lofgren in putting
together this piece of legislation. As executive director of
CSIA, I am also pleased to speak on behalf of the Business
Software Alliance on the need for an Assistant Secretary for
Cybersecurity at DHS.
We want to urge early and urgent passage of H.R. 285. Since
the late 1990s, we have spoken of a partnership to secure the
critical infrastructure. For this partnership to work and to
truly be successful and not be simply rhetoric, we need a clear
leader in the Department of Homeland Security to act as the
focal point.
A director or a deputy-assistant-secretary-level position
does not have the sufficient stature, programmatic authority or
accountability to reach across government and industry sectors.
A leader in securing the critical infrastructure must have the
authority and resources to accomplish this important and
complex mission. This leader must be at least at the assistant
secretary level to have the impact needed.
Unlike other sectors, the information infrastructure is
dynamic. It will continue to evolve for the foreseeable future.
Changes within the information infrastructure are driving
change in all other sectors. Cyber and physical infrastructure
security will receive greater respect and attention with an
Assistant Secretary For Cybersecurity working alongside another
assistant secretary focused on the protection of the physical
structure while remaining integrated under an Under Secretary
for IAIP.
It is particularly important that the Assistant Secretary
for Cybersecurity have primary authority over the National
Communications System, which is, of course, included in this
bill. This is important given the convergence of data and voice
networks.
As you know, the National Communications System has control
over priority communications. These networks proved critical in
the immediate aftermath of 9/11. CSIA strongly believes that
the government needs a comprehensive approach to cybersecurity,
and by establishing assistant secretary, we can do much better
than we are today.
I think there are three documents that we could look at
that set out the government's overall policy or the
administration's policy in cybersecurity. The first is the
President's National Strategy, the second is Homeland Security
Presidential Directive Number 7, and the third is the National
Response Plan.
There are some common characteristics among those
documents. I think in the first instance, it is worthwhile
pointing out that these documents bound, if you will, the
responsibilities of DHS--they don't, and DHS too, if you will,
boil the ocean. They bound their responsibilities in the area
of creating an emergency communications network in case of an
attack, to prepare contingency plans in the case of an attack,
to carefully look at reconstitution issues in case of an
attack, to look at early warning issues; for example, if the
government has the means to understand through intelligence
assets that might be overseas or here, to pass that information
on to the private sector, and it might not be readily available
to the private sector. Those are private tasks that the
Department of Homeland Security has been given under the three
documents I mentioned.
The progress to date at the Department has not been what
you would hope. They have a myriad of programs set up,
wonderful intentions, but at the end of the day, they are not
succeeding in those very critical tasks that are so important
to our economic and national security.
If I were to prioritize those tasks, they would be just as
I have outlined. It would be simply working on to identify and
prioritize critical infrastructure related to information
systems, prepare for contingencies by ensuring that we have
survivable communications in place, work closely with the
private sector on any sort of reconstitution plans that need to
be put in place, provide warning of disruption, provide early
warning of an attack through intelligence means. These tasks
can really only be effectively done at the assistant secretary
level or higher. They cannot be done at a lower level.
I want to speak very quickly, before I close, on the
difference between cyber and physical infrastructure. By
advocating for an Assistant Secretary of Cybersecurity, we are
not dismissing the need to integrate cyber and physical
infrastructure protection, nor are we saying that the
protection of cyberinfrastructure is more important than the
protection of physical infrastructure. Although it is--
increasingly the IT infrastructure is a critical component in
the operation of our physical infrastructures.
Cyberinfrastructure is attacked and defended differently
than the physical infrastructure. Cyberinfrastructure is
largely defended by technical specialist, not through guns,
gates, guards and cameras. Vulnerabilities are discovered
through technical means and often require immediate remediation
involving a variety of parties across different sectors of the
economy.
A cyberattack may be launched remotely, requiring no
physical access to a target. Cyberattacks may not necessarily
be abrupt. For instance, a cyberattack may be low and slow,
changing or otherwise corrupting political data over an
extended period of time.
The infrastructure is dynamic, constantly changing. Amit
and Harris have addressed this. But I want to point out also,
in the event of an event of national significance affecting one
or more sectors across the economy, we are going to turn to our
information systems to help bail us out.
The National Communications System post-9/11 helped us in
that environment. By the way, the National Communications
System under DOD was run by a lieutenant general. Now we are at
an acting--acting director level. It is important that we have
an assistant secretary in place as soon as possible. During Q
and A I would be happy to speak to source issues.
Thank you.
Mr. Lungren. Thank you very much, Mr. Kurtz.
[The statement of Mr. Kurtz follows:]
Prepared Statement of Paul B. Kurtz
Thank you, Chairman Lungren and Ranking Member Sanchez for inviting
the Cyber Security Industry Alliance (CSIA) to testify before this
subcommittee in reference to HR 285. I would also like to acknowledge
Congressman Thornberry and Congresswoman Lofgren for their continued
efforts in support of an Assistant Secretary for Cyber Security
position in DHS. Their bi-partisan work is evident in their co-
sponsorship of this bill.
As Executive Director of CSIA, I am pleased to speak about the need
for an Assistant Secretary for Cyber Security in the Department of
Homeland Security. CSIA supports rapid passage of HR 285.
The members of the Business Software Alliance also support this
legislation and I am also speaking on their behalf.
Since the late 1990s, we have spoken of a ``partnership'' to secure
the critical infrastructure of the United States, particularly the
information infrastructure, since it is owned and operated by the
private sector. For this partnership to truly be successful and not
simply rhetoric, we need a clear leader in the Department of Homeland
Security to act as a focal point for this partnership. A Director-level
position does not have the sufficient stature or programmatic authority
for accountability, or to reach across sectors. A leader in securing
the critical infrastructure must have the authority and resources to
accomplish this important and complex mission.
This leader must be at least at the Assistant Secretary level to
have the impact that is needed.
Unlike other sectors, the information infrastructure is dynamic and
will continue to evolve for the foreseeable future. Changes within the
information infrastructure are driving change in all other sectors.
Cyber and physical infrastructure security will receive greater
respective attention with an Assistant Secretary for Cyber Security
working alongside the Assistant Secretary for Infrastructure
Protection, while remaining integrated under the leadership of the
Undersecretary for Infrastructure Protection and Information Analysis.
It is particularly important that the Assistant Secretary for Cyber
Security have primary authority over the National Communications
System, given the convergence of voice and data networks.
CSIA strongly believes that the Federal government needs a
comprehensive approach to cyber security protection. The establishment
of an Assistant Secretary for Cyber Security in the Department of
Homeland Security is a critical initial step in this approach.
I will cover three areas in my testimony:
A brief introduction to CSIA
An overview of the roles and responsibilities of the
Department of Homeland Security in the area of cyber security
The importance of clear leadership on the issue of
cyber security
Introduction to CSIA
CSIA is dedicated to enhancing cyber security through public policy
initiatives, public sector partnerships, corporate outreach, academic
programs, alignment behind emerging industry technology standards and
public education. CSIA is the only CEO-led public policy and advocacy
group exclusively focused on cyber security policy issues. We believe
that ensuring the security, integrity and availability of global
information systems is fundamental to economic and national security.
We are committed to working with the public sector to research, create
and implement effective agendas related to national and international
compliance, privacy, cybercrime, and economic and national security. We
work closely with other associations representing vendors as well as
critical infrastructure owners and operators, as well as consumers.
Members of the CSIA include BindView Corp; Check Point Software
Technologies Ltd.; Citadel Security Software Inc.; Citrix Systems,
Inc.; Computer Associates International, Inc.; Entrust, Inc.; Internet
Security Systems Inc.; iPass Inc.; Juniper Networks, Inc.; McAfee, Inc;
PGP Corporation; Qualys, Inc.; RSA Security Inc.; Secure Computing
Corporation; Symantec Corporation and TechGuard Security, LLC.
CSIA understands that the private sector bears a significant burden
for improving cyber security. CSIA embraces the concept of sharing that
responsibility between information technology suppliers and operators
to improve cyber security. Cyber security also requires non-partisan
government leadership. Work to strengthen cyber security began in the
Clinton administration. The Bush administration has continued and
boosted this work, through the creation of the National Strategy to
Secure Cyberspace. The National Strategy remains timely and salient.
Roles and Responsibilities
Last December, the Cyber Security Industry Alliance released an
agenda for the administration that outlined twelve steps to help build
a more secure critical infrastructure that called for an Assistant
Secretary level post in the Department of Homeland Security. To
understand why we feel this is critically important to the protection
of our cyber infrastructure, I thought it would be helpful to expand on
the Agenda and offer a framework to help define Federal versus private
sector responsibilities in the area of cyber security.
By outlining the responsibilities of the Department of Homeland
Security in the area of cyber security, we feel that the need for an
Assistant Secretary-level position can be better understood.
Three Federal documents provide a framework for Federal
responsibilities to secure cyberspace:
The President's National Strategy to Secure Cyberspace
(February 14, 2003)
Homeland Security Presidential Directive-7 (December
17, 2003)
The National Response Plan's Cyber Incident Annex
(January 6, 2005)
President's National Strategy to Secure Cyberspace
The President's National Strategy is an appropriate place to start.
While the Strategy's recommendations receive substantial attention, it
also provides clear policy guidance on the Federal government's role.
The President's cover letter for the Strategy states:
``The policy of the United States is to protect against the
debilitating disruption of the operation of information systems for
critical infrastructures and, thereby help to protect the people,
economy, and national security of the United States.'' He continues,
``We must act to reduce our vulnerabilities to these threats before
they can be exploited to damage the cyber systems supporting our
nation's critical infrastructure and ensure that such disruptions of
cyberspace are infrequent, of minimal duration, manageable and cause
the least damage possible.''
The strategy adds some additional guidance on its role, noting that
it is appropriate for the government to assist with forensics, attack
attribution, protection of networks and systems critical to national
security, indications and warnings, and protection against organized
attacks capable of inflicting debilitating damage to the economy.
Additionally, Federal activities should also support research and
development that will enable the private sector to better secure
privately-owned portions of the nation's critical infrastructure.
These statements lead to the conclusion that Federal activity is
bounded to protecting against debilitating attacks against critical
infrastructure, attack attribution for national security systems,
forensics and research and development.
The Strategy also sets specific responsibilities for Federal
agencies, including the Department of Homeland Security. The Strategy
states that the Department should:
Develop a comprehensive plan to secure critical
infrastructure.
Provide crisis management and technical assistance to
the private sector with respect to recovery plans for failures
of critical information systems
Coordinate with other Federal agencies to provide
specific warning information and advice about appropriate
protective measures and countermeasures to state, local and
nongovernmental organizations including the private sector,
academia and the public
Perform and fund research and development along with
other agencies that will lead to new scientific understanding
and technologies in support of homeland security.
It is important to note that the Strategy does not place
responsibility for every problem associated with cyber security with
DHS, but focuses its role on contingency planning and emergency
communications--two critical areas of defense against threats to our
national security.
HSPD-7
HSPD-7 establishes the U.S. government's policy for the
identification and protection of critical infrastructure from terrorist
attacks. It advances the President's strategy in a number of areas and
helps further refine the Federal government's role in securing
cyberspace.
HSPD-7 focuses in large part on the identification and protection
of assets that if attacked would cause catastrophic health effects or
mass casualties comparable to those from the use of a weapon of mass
destruction. It also addresses the protection of infrastructure that if
attacked would:
Undermine state and local government capacities to
maintain order and to deliver minimum essential public
services.
Damage the private sector's capability to ensure the
orderly functioning of the economy and delivery of essential
services
Have a negative effect of the economy through the
cascading disruption of other critical infrastructure and key
resources.
Undermine the public's morale and confidence in our
national economic and political institutions.
HSPD-7 designated the Department of Homeland Security as a focal
point for information infrastructure protection, including cyber
security, stating:
11The Secretary will continue to maintain an organization to serve
as a focal point for the security of cyberspace. The organization's
mission includes analysis, warning, information sharing, vulnerability
reduction, mitigation, and aiding national recovery efforts for
critical infrastructure information systems.''
The National Response Plan's Cyber Incident Annex
The National Response Plan (NRP) upholds the President's National
Strategy to Secure Cyberspace and HSPD-7. The NRP Cyber Incident Annex
states that the Federal government plays a significant role in managing
intergovernmental (Federal, state, local and tribal) and, where
appropriate, public-private coordination in response to cyber incidents
of national significance.
A Framework for Federal Action
The President's National Strategy to Secure Cyberspace,
Presidential Directive 7 and the National Response Plan yield a
possible two-tier framework for Federal responsibility.
Tier One--Functions Critical to U.S. Economic and National Security
1. Identify and prioritize critical information infrastructure
that if disrupted would have a debilitating impact on critical
infrastructure or systems essential to U.S. economic or
national security
2. Prepare for such contingencies by ensuring survivable
communications networks among key critical information
infrastructure operations in the government and private sector
3. Prepare contingency plans in the event of a disruption that
include crisis management and restoration of critical networks,
and regularly exercise, test and refine these plans.
4. Provide warning of attack or disruption to critical
infrastructure owners and operators from resources or
capabilities that are not available to the private sector
through such means as intelligence.
Tier Two--Supporting Functions that Improve Coordination,
Awareness, Education and Personnel Readiness
1. Facilitate coordination between individual sectors of the
economy by establishing appropriate government advisory
committees
2. Facilitate and support general awareness among all
information system users, including home users and small
businesses
3. Track trends and costs associated with information
infrastructure attacks and disruptions, through such means as
U.S. CERT.
4. Coordinate and support long-term research and development
for cyber security.
The Importance of Clear Leadership on the Issue of Cyber Security
When you look closely at the responsibilities of The Department of
Homeland Security in the area of cyber security, you see that while it
may be narrowly defined, its responsibilities are extremely significant
to our economic and national security. DHS is the government's focal
point for the prevention, response and recovery from cyber security
incidents that have a debilitating impact on our national and economic
security. While the private sector has a critical role to play in the
protection of critical information infrastructure, DHS serves as the
government's and nation's point of coordination for all our efforts.
Senior DHS leadership is needed to build an effective government-
private sector relationship, to understand the technical and global
complexities of cyber security, and to marshal the resources necessary
to provide an effective partnership with private sector organizations
and initiatives.
Cyber vs. Physical Infrastructure Protection
By advocating for an Assistant Secretary for Cyber Security, we are
not dismissing the need to integrate cyber and physical infrastructure
protection. Nor are we saying that the protection of the cyber
infrastructure is more important than the protection of the physical
infrastructure--although it is increasingly a critical component in the
operation of our physical infrastructures, and in fact, it cuts across
all of our physically infrastructures. The physical and cyber
infrastructures are related, but they are fundamentally different in a
variety of ways. For example:
Cyber infrastructure is attacked and defended
differently than the physical infrastructure. Cyber
infrastructure is largely defended by technical specialists,
not through guns, gates, guards, and cameras. Vulnerabilities
are discovered through technical means and often require
immediate remediation involving a variety of parties across
different sectors of the economy. A cyber attack may be
launched remotely, requiring no physical access to a target.
Cyber attacks may not necessarily be abrupt. For example, a
cyber attack may be ``low and slow,'' changing or otherwise
corrupting critical data over an extended period of time.
Cyber infrastructure is dynamic, where the physical
infrastructure is more static. For example, power plants, power
lines, chemical plants, railroads, bridges remain stationary
with more gradual changes in technology, where information
networks are rapidly changing. An IP-based transaction may
traverse the globe via satellite, wireless, or terrestrial
cable. The technologies that support these different means are
changing rapidly.
In an event of national significance affecting one or more of the
physical infrastructures, the cyber infrastructure takes on additional
responsibility for ensuring we have the ability to coordinate and
respond to attacks. Our IT infrastructure is operational; without it,
our national response capability is crippled.
We believe it is appropriate to have an Assistant Secretary for
Cyber Security working along side an assistant secretary responsible
for securing the physical infrastructure under the leadership of an
Under Secretary as proposed in H. 285.
Conclusion
Mr. Chairman, we are seeing increased threats and vulnerabilities
associated with our information infrastructure. We rely upon our
information infrastructure, yet there is no one clearly in charge of
coordinating its security and reliability. Presidential guidance and
the Homeland Security Act clearly identify the Department of Homeland
Security as the most appropriate focal point for coordinating the
protection of our information infrastructure. We strongly support HR
285 and its creation of a more senior position at DHS to lead efforts
to build a more secure information infrastructure for both the
government and private sector.
Mr. Lungren. The Chair now recognizes Catherine Allen,
president and CEO of BITS, a division of the Financial Services
Roundtable, to testify.
STATEMENT OF CATHERINE ALLEN, PRESIDENT AND CEO, BITS,
FINANCIAL SERVICES ROUNDTABLE
Ms. Allen. Thank you very much. Thank you, Chairman Lungren
and committee members, for the opportunity to testify before
the committee. We commend Congressman Thornberry and
Congresswoman Lofgren on the bill.
I am Catherine Allen, CEO of BITS, a nonprofit industry
consortium of the largest 100 financial institutions in the
U.S. We are a nonlobbying division of the Financial Services
Roundtable. Our mission is to serve the financial services
needs at the interface between commerce, technology and
financial services. We work with government organizations, DHS,
Treasury, Federal financial regulators, the Federal Reserve and
other technology associations.
Given the short amount of time, I want to focus on three
major points today: First, the state of cybersecurity; second,
reasons in favor of elevating the cybersecurity position at
DHS; and third, steps the government could take to strengthen
cybersecurity.
My written statement contains additional information on
BITS, cybersecurity, crisis management, critical
infrastructure, management of outsources and fraud reduction
efforts. It also contains suggestions that BITS has given to
DHS in the past, as well as others on how to strengthen
cybersecurity.
The importance of cybersecurity cannot be overstated. Our
Nation's economic and national security relies on the security,
reliability, recoverability, continuity and maintenance of
information systems. The security and reliability of the
information systems are increasingly linked to consumer and
investor confidence.
As I speak, criminals are writing code to compromise
systems. Viruses are epidemic. Hackers are closing the window
between the discovery of a flaw and the release of a new virus,
now an average of 5.8 days. Over 1,200 new security flaws were
discovered just in the last 6 months of 2004.
Beyond threats to our Nation's infrastructure, leaders in
the financial services industry are growing increasingly
concerned about the impact on consumer confidence. As one
example, fraudsters are finding new ways to trick consumers in
providing initial information that can facilitate ID theft
through phishing, pharming and other e-scams.
The financial services industry has been aggressive in its
efforts to strengthen cybersecurity and reduce fraud. We are
sharing information; analyzing threats; creating best
practices; urging the software and technology providers to do
more to secure their products and services, something we call a
higher duty of care; and combating fraud and identity theft.
Just last week BITS and the Roundtable announced the
permanent creation of an Identity Theft Assistance Center, a
free service to financial institution customers that helps
victims restore their financial identity. The ITAC has helped,
to date, nearly 700 consumers restore their financial
identities since it became operational last August. The ITAC
information is shared with law enforcement to help prosecute
the perpetrators, and the ITAC is the cornerstone of a broader
industry effort to detect and prevent fraud, help victims
address the causes of identity theft and prosecution of
fraudsters.
In a related effort, BITS created a phishing prevention and
investigation network, again helping our industry to shut down
on-line scams and aid in investigating perpetrators and
providing a united front with law enforcement.
Last year I submitted a letter in support of a proposal to
elevate the position of Cybersecurity Director at the
Department of Homeland Security to the assistant secretary
level. We support rapid passage of H.R. 285. Cybersecurity is
handled in DHS at a level far below where most financial
services corporations handle the issues today, and that is at
the board-room level. Elevating this critical position and
insuring that adequate funding is provided will help us to
focus greater attention on cybersecurity issues within the
government and provide a more senior-level dialogue with the
private sector. It will enable implementation of many key
elements that were identified in the administration's National
Strategy to Secure Cyberspace.
Much of the focus at DHS has been on physical security.
While that is important, we believe there are several areas
that need much more focus. It starts with cybersecurity, but
also a means addressing the interdependencies between our
sector and other critical infrastructures, including the
telecommunications and power industries. They, too, rely and
need a strengthened cybersecurity effort. Elevating the
cybersecurity position within DHS should be a first significant
step as part of a broader strategy to strengthening
cybersecurity.
For the record, it is important for the committee to
understand that the financial regulators are taking
cybersecurity issues seriously. Treasury is a sector leader.
DHS plays an important role in bringing the other sectors along
in addressing the cybersecurity issues.
We believe that there is much more that can be done to
strengthen cybersecurity. My written statement includes a more
detailed review of seven key elements that the Federal
Government should support to ensure information technology
security. I refer to them by the acronym PREPARE.
The first is promote, playing an important role of
promoting the importance of secure information technology and
in facilitating collaboration.
The second is responsibility, promoting shared
responsibility between the suppliers and the end users for
developing, deploying and maintaining secure information
software and networks.
The third is educate. All sectors should make it a priority
to communicate to all users of information technology the
importance of safe practices.
The fourth is procure, using its purchasing power to
leverage security requirements, such as software testing. Along
with employing best practices developed by public and private
sectors, the government can play an important role in
encouraging the changes that need to take place.
The fifth is analyze. Government should collect and provide
to the critical infrastructures and policymakers the kinds of
statistics we need on threats, risks and vulnerabilities.
The next to last is research. The government can play an
important role in funding R&D in the development of more secure
software development practices, testing and certification
programs.
Lastly, enforce. Law enforcement must do more to enforce,
investigate and prosecute cybercrimes here and abroad. E-crimes
are growing and undermine our economy. Law enforcement must
have the resources and mandate to go forward.
In conclusion, the financial services sector is a key part
of the Nation's critical infrastructure. Customer trust in the
security of financial transactions is vital to the security of
not only the infrastructure, but the strength of the Nation's
economy. Our sector is a target of cybercriminals as well as
terrorists. We have a vested interest in this being raised to a
higher level of dialogue in the community.
We have taken major strides to respond to the risks that we
have today. We need the government to support these efforts, to
support cybersecurity, with the same level of the energy,
resources and stature as protecting physical security through
DHS. Elevating the cybersecurity position to an assistant
secretary level is a step in the right direction, but there is
much more that is needed.
Thank you for the opportunity to testify.
Mr. Lungren. Thank you very much, Ms. Allen.
[The statement of Ms. Allen follows:]
Prepared Statement of Catherine A. Allen
Introduction
Thank you, Chairman Lungren and Ranking Member Sanchez, for the
opportunity to submit testimony before the House Committee on Homeland
Security's Subcommittee on Economic Security, Infrastructure Protection
and Cybersecurity about proposed legislation to elevate the Cyber
Security Director at the Department of Homeland Security (DHS) to the
Assistant Secretary level.
I am Catherine Allen, CEO of BITS, a nonprofit industry consortium
of 100 of the largest financial institutions in the U.S. BITS is the
non-lobbying division of The Financial Services Roundtable. BITS'
mission is to serve the financial services industry's needs at the
interface between commerce, technology and financial services. BITS
members hold about $9 trillion of the nation's total managed financial
assets of about $18 trillion. BITS works as a strategic brain trust to
provide intellectual capital and address emerging issues where
financial services, technology and commerce intersect. BITS' activities
are driven by the CEOs and their direct reports--CIOs, CTOs, Vice
Chairmen and Executive Vice President-level executives of the
businesses. BITS works with government organizations including the U.S.
Department of Homeland Security, U.S. Department of the Treasury,
federal financial regulators, Federal Reserve, technology associations,
and major third-party service providers to achieve its mission.
Attached to this statement is an overview of our work related to cyber
security, crisis management coordination, critical infrastructure
protection, and fraud reduction.
The importance of cyber security cannot be overstated. Our nation's
economic and national security relies on the security, reliability,
recoverability, continuity, and maintenance of information systems. IT
security has a direct and profound impact on the government and private
sectors, and the nation's critical infrastructure. Further, the
security and reliability of information systems is increasingly linked
to consumer and investor confidence.
As I speak, hackers are writing code to compromise systems. Viruses
are epidemic. Hackers are closing the window between the discovery of a
flaw and the release of a new virus. Fraudsters are finding new ways to
trick consumers into providing personal information that can facilitate
ID theft. Beyond threats to our nation's infrastructure, leaders in the
financial services industry are growing increasingly concerned with the
impact on consumer confidence.
The financial services industry has been aggressive in its efforts
to strengthen cyber security. We are sharing information, analyzing
threats, urging the software and technology industries to do more to
provide more secure products and services, and combating fraud and
identity theft. Just last week, BITS and The Roundtable announced the
results of a pilot of the Identity Theft Assistance Center (ITAC). The
ITAC has helped nearly 700 consumers restore their financial identities
since it became operational last August. The ITAC is a free service to
financial institution customers. It is a key part of industry efforts
to help victims and address the causes of identity theft.
Last year I submitted a letter in support of a proposal to elevate
the position of Cyber Security Director at the Department of Homeland
Security to the Assistant Secretary level (Attachment A).
BITS and The Financial Services Roundtable support this effort to
increase the administration's focus on cyber security concerns and
address our sector's concerns. While much of DHS' focus has been on
physical security, it has not focused enough attention on addressing
cyber security concerns. Elevating the cyber security position is a
small step as part of a broader strategy to strengthen cyber security.
Cyber security is handled at a level far below where most corporations
handle the issues today. Elevating this critical position and ensuring
that adequate funding is provided will help to focus greater attention
on cyber security issues within the government and throughout the
private sector and thus implement many areas identified in the
Administration's National Strategy to Secure Cyberspace.
Since the creation of DHS in March 2003, BITS has worked closely
with many DHS officials, including the director and acting director of
the Cyber Security Division. We have provided numerous suggestions for
DHS actions to strengthen cyber security and ways it can work in
partnership with leaders in the private sector. Earlier this year, the
National Cyber Security Division convened a ``retreat'' of
representatives from the major associations (e.g., BITS, Center for
Internet Security, Cyber Security Industry Alliance, Educause,
Information Technology Association of America, ISAlliance, Technet,
SANS Institute, U.S. Chamber of Commerce), individual companies (e.g.,
IBM, Microsoft, RSA), law enforcement (e.g., Federal Bureau of
Investigations, U.S. Secret Service) and government (e.g., Central
Intelligence Agency, Commerce Department, Defense Department, Homeland
Security Department, House of Representatives, Justice Department,
Treasury Department, National Security Agency). DHS played an important
leadership role in convening the meeting and other meetings of the US-
CERT program. Attachment B is a summary of answers to several questions
DHS officials asked in advance of the meeting.
More Can Be Done
As an organizational and symbolic step, elevating this critical
position will help to focus greater attention on cyber security issues
within the government and throughout the private sector.
However, this should be viewed as just one of many steps that must
be taken to strengthen cyber security.
Government plays an enormous role. Our nation's economic and
national security relies on the security, reliability, recoverability,
continuity, and maintenance of information systems. IT security has a
direct and profound impact on the government and private sectors, and
the nation's critical infrastructure. Further, the security and
reliability of information systems is increasingly linked to consumer
and investor confidence. In recent years, members of the user community
that rely on technology provided by the IT industry--private-sector
companies, universities and government agencies--are demanding greater
accountability for the security of IT products and services.
PREPARE
The federal government can play an important role in protecting the
nation's IT assets. The following are seven key elements that the U.S.
government should support to secure information technology.
Promote. Government can play an important role in promoting the
importance of secure information technology. Also, government should do
more to facilitate collaboration among critical infrastructure sectors
and government. Some sectors, such as financial services, are heavily
regulated and supervised to ensure that customer information is
protected and that financial institutions operate in a safe and sound
manner. Examples of actions the government can take include:
Government should lead by example by ensuring that the
issue of cyber security receives adequate attention in the
Department of Homeland Security. Today, cyber security is
handled at a level far below where most corporations handle
these issues. Congress could create a more senior-level policy
level position within DHS to address cyber security issues and
concerns and ensure that adequate funding is provided.
Strengthen information sharing coordination
mechanisms, such as the Information Sharing and Analysis
Centers (ISACs), by ensuring adequate funding is made available
to Federal agencies sponsoring such organizations. Information
sharing and trend analysis within a sector is essential to
protecting information security and responding to events.
Information sharing among sectors is equally important as cyber
threats sometimes reach some sectors before others.
Create an emergency communication and reconstitution
system in the event of a major cyber attack or disruption of
information networks. Such an attack or disruption could
potentially cripple many of the primary communication channels.
To allow maximum efficiency of information dissemination to key
individuals in such an event, a thorough and systematic plan
should be in place. The financial services industry has
developed such a plan for industry-specific events in the BITS/
FSR Crisis Communicator. Other organizations have developed
similar communication mechanisms. These emergency
communications programs should be examined as potential models
for a national cyber security emergency communication system.
Reform of the Common Criteria/National Information
Assurance Partnership (NIAP). The current software
certification process is costly, inefficient, used on a limited
basis by the Federal government, and virtually unknown to the
private sector. NIAP should be reformed so that it is more cost
effective for vendors to seek certification while ensuring
consistent Federal procurement practices and expanded
commercial adoption of NIAP-certified products. The BITS
Product Certification Program may well be able to serve as a
model.
Responsibility. Government should promote shared responsibility
between suppliers and end users for developing, deploying, and
maintaining secure information networks. Government can play an
important role in establishing incentives and making producers of
software and hardware accountable for the quality of their products.
Examples of actions the government can take include:
Provide tax or other incentives for achieving higher
levels of Common Criteria certification. Incremented incentives
would help to compensate companies for the time and cost of
certification. This should encourage certification and increase
the overall security of hardware and software.
Provide tax or other incentives for certification of
revised or updated versions of previously certified software.
Under Common Criteria, certification of updated versions is
costly and time consuming. Incentives are necessary to ensure
that all software is tested for security
Require software providers to immediately notify ISACs
of newly discovered cyber threats and to provide updated
information on such threats until an effective patch is
provided. It is vital that critical infrastructure companies
receive immediate notice of serious vulnerabilities.
Establish requirements that improve the patch-
management process to make it more secure and efficient and
less costly to organizations.
Educate. Communicate to all users of information technology the
importance of safe practices. Public confidence in e-commerce and e-
government is threatened by malicious code vulnerabilities, online
fraud, phishing, spam, spyware, etc. Ensuring that users (home users,
businesses of all sizes, and government) are aware of the risks and
take appropriate precautions is an important role for government and
the private sector. Examples of actions the government can take
include:
Fund joint FTC/DHS consumer cyber security awareness
campaign. The FTC should focus its efforts on building consumer
awareness, and DHS should coordinate more detailed technical
education regarding specific serious threats. In addition,
government employees should be trained in proper cyber safety
measures.
Train government employees on proper cyber security
measures.
Educate corporate executives and officers regarding
their duties under Sarbanes-Oxley, GLBA, and HIPAA as they
relate to cyber security.
Procure. Using its purchasing power and leveraging security
requirements and best practices developed by the public and private
sectors, government can play an important role in encouraging the IT
industry to deliver and implement more secure systems. Examples of
actions the government can take include:
Require high levels of cyber security in software
purchased by the government through procurement procedures.
Extend such requirements to software used by government
contractors, subcontractors, and suppliers.
Provide NIST with adequate resources to develop
minimum cyber security requirements for government procurement.
NIST should include software developers and other stakeholders
in the standard-creation process.
Analyze. Government should collect information and analyze the
costs and impact of information security risks, vulnerabilities and
threats and provide this analysis to policy makers. Examples of actions
the government can take include:
Assign to the Commerce Department or another
appropriate agency the responsibility of tracking and reporting
such costs and their impact on the economy. Measuring and
making these costs transparent will aid law makers and
regulators as they assign resources to cyber security programs.
Research. Government can play an important role in funding R&D in
the development of more secure software development practices, testing
and certification programs. In addition, training future generations of
programmers, technicians and business leaders that understand and
manage information security can be accomplished by establishing
university and educational/certification programs. Government can help
by facilitating collaboration with the users and suppliers of IT to
develop standards for safe practices. Examples of actions the
government can take include:
Enhance DHS, NSF, and DARPA cyber security R&D
funding.
Carefully manage long- and short-term R&D to avoid
duplication.
Establish a mechanism to share educational training
and curricula.
Enforce. Law enforcement must do more to enforce, investigate and
prosecute cyber crimes here and abroad. Examples of actions the
government can take include:
Ratify the Council of Europe's Convention on
Cybercrime.
Enhance criminal penalties for cyber crimes.
Make cyber crimes and identity theft enforcement a
priority among law enforcement agencies.
Encourage better coordination among law enforcement
agencies in order to detect trends.
The Financial Services Industry Is Leading the Way
in Responding to the Cyber Security Challenge
The financial services sector is a key part of the nation's
critical infrastructure. Customer trust in the security of financial
transactions is vital to the stability of financial services and the
strength of the nation's economy. At the same time, our sector is a
favorite target of cyber criminals as well as of terrorists, as was
made clear on 9/11.
Since 9/11, the financial services sector has taken major strides
to respond to the risks we face today. BITS has made coordinating
financial services industry crisis management efforts a top priority.
Senior executives at our member companies have dedicated countless
hours to preparing for the worst. We have convened numerous conferences
and meetings to bring together leaders and experts, developed emergency
communication tools, strengthened our sector's Information Sharing and
Analysis Center (FS/ISAC), conducted worst case scenario exercises,
engaged in partnerships with the telecommunications sector and key
software providers, compiled lessons learned from 9/11 and the August
2003 blackout, developed best practices and voluntary guidelines,
created a model for regional coalitions, developed liaisons and pilots
with the telecommunications industry for diversity and redundancy, and
combated new forms of online fraud. Additionally, BITS is now
developing best practices in collaboration with the electric power
industry.
Lessons Learned
BITS regularly gathers and disseminates ``lessons learned'' from
its membership. These lessons are a critical building block for BITS'
best practices. Below are some of those lessons for the Committee to
consider.
We must work with other parties in the private and public sectors
to address these issues sufficiently. We understand that the risks for
national security and economic soundness cannot be underestimated.
Neither can the importance of our working together to address them.
We need to look strategically and holistically at the nation's
critical infrastructures and what can be done to enhance resiliency and
reliability. We urge the Committee to consider all aspects of critical
infrastructure--the software and operating systems, the critical
infrastructure industries, and the practices of firms, industries and
the government--in addressing software security and vulnerability
management.
Preparation is critical. The events of 9/11 and subsequent
preparations by the private sector and government enhanced mutual trust
and the ability to communicate, shift to backup systems, and continue
operations. Prior to the August 2003 blackout, BITS conducted a
scenario exercise that included the West Coast power grid being out for
seven days and the impact that might have on the sector. That exercise
helped the industry think through things like communications, water
shortages, backup for ATM operations, and fuel for generators.
Critical infrastructure industries and the public need to have an
understanding of the scope and cause as early as possible when a major
event occurs. During the August 2003 blackout, the announcement that
the problem was not the result of a terrorist event alleviated public
concerns and made for orderly execution of business continuity
processes. If it had been a terrorist event, other communications and
directives such as ``shields up''--in which external communications to
institutions are blocked--might have occurred.
Diverse and resilient communication channels are essential. Diverse
elements--such as cell phones, wireless email devices, landline phones,
and the Internet--are required. Both diversity and redundancy are
needed within critical infrastructures to assure backup systems are
operable and continuity of services will be maintained.
The power grid must be considered among the most vital of critical
infrastructures and needs investment to make sure it works across the
nation. The cascading impact on the operation of financial services,
access to fuel, availability of water, and sources of power for
telephone services and Internet communications cannot be overstated.
Recognize the dependence of all critical infrastructures on
software operating systems and the Internet. A clear understanding of
the role of software operating systems and their ``higher duty of
care,'' particularly when serving the nation's critical
infrastructures, needs to be explored. Further, the Committee should
recognize that the financial sector is driven by its ``trusted''
reputation as well as regulatory requirements. Other industries do not
have the same level of regulatory oversight, liability, or business
incentives. However, we rely on other sectors because of our
interdependencies. Responsibility and liability need to be shared.
Financial Industry Efforts to Strengthen Cyber Security
In October 2003, BITS began its Software Security and Patch
Management initiative to respond to increasing security risks and
headline-sweeping viruses. Since then, BITS has worked to mitigate
security risks to financial services consumers and the financial
services infrastructure, ease the burden of patch management caused by
vendor practices, and help member companies comply with regulatory
requirements. BITS also began forging partnerships with the software
vendors most commonly used in our industry.
In February 2004, BITS and The Financial Services Roundtable held a
Software Security CEO Summit. The event launched BITS and Roundtable
efforts to promote CEO-to-CEO dialogue on software security issues.
More than 80 executives from financial services, other critical
infrastructure industries, software companies, and government discussed
software vulnerabilities and identified solutions. A ``toolkit'' with
software security business requirements, sample procurement language,
and talking points for discussing security issues with IT vendors was
distributed to 400 BITS and Roundtable member company executives. One
important deliverable from this Forum is the set of Software Security
Business Requirements, which are essential from the perspective of the
financial services sector. These requirements and the full ``toolkit''
are available in the public area of the BITS website, at
www.bitsinfo.org.
A theme of the event was the importance of collaborating with other
critical infrastructure industries and government. Since the Summit we
have worked with all the associations representing the financial
services industry, as well as The Business Roundtable, the Cyber
Security Industry Alliance and other relevant groups.
In April 2004, BITS and The Financial Services Roundtable announced
a joint policy statement calling on the software industry to improve
the security of products and services it provides to financial services
customers. The policy statement calls on software providers to accept
responsibility for their role in supporting financial institutions and
other critical infrastructure companies. BITS and The Roundtable
support incentives and other measures that encourage implementation of
more secure software development processes and sustain long-term R&D
efforts to support stronger security in software products. We also
support protection from antitrust laws for critical infrastructure
industry groups to discuss baseline security specifications for the
software and hardware that they purchase. Additionally, as part of the
policy, BITS and The Roundtable are encouraging regulatory agencies to
explore supervisory tools to ensure critical third-party service
providers and software vendors deliver safe and sound products and
services to the financial services industry.
We continue to work with software companies to create solutions
acceptable to all parties. In 2004 BITS successfully negotiated with
Microsoft to provide additional support to BITS member companies using
Windows NT. We have provided Microsoft and other software and hardware
companies with Software Security Business Requirements. (See Attachment
A.) BITS members agree that these requirements are critical to the
soundness of systems used in the financial services industry.
In July 2004, BITS published best practices for software patch
management in response to the increasing urgency of patch
implementation, given the speed with which viruses are targeting new
vulnerabilities. This document is available to the public at no cost
and applicable to industries outside of financial services.\1\
---------------------------------------------------------------------------
\1\ Patch management and implementation alone can cost one
financial institution millions of dollars annually. A BITS survey of
member institutions found that costs to the financial services industry
associated with software security, including patch management, are
approaching $1 billion annually. BITS' best practices help companies
mitigate these costs.
---------------------------------------------------------------------------
In July, BITS published The Kalculator: BITS Key Risk Measurement
Tool for Information Security Operational Risks. This tool helps
financial institutions evaluate critical information security risks to
their businesses. Financial institutions use the Kalculator to score
their own information security risks based on the likelihood of an
incident, the degree to which the organization has defended itself
against the threat, and the incident's possible impact. The tool brings
together an extensive body of information security risk categories
outlined in international security standards and emerging operational
risk regulatory requirements. Like the patch management best practices,
the Kalculator is available to the public at no cost and applicable to
industries outside of financial services.
BITS participated in the Corporate Information Security Working
Group (CISWG) sponsored by Congressman Adam Putnam, then-Chairman of
the House of Representatives' Subcommittee on Technology, Information
Policy, Intergovernmental Relations on the Census. CISWG is made up of
corporate, industry and academic leaders and is working to pursue a
private sector-driven approach to enhancing the protection of the
nation's corporate computer networks. BITS is active in the best
practices, incentives, and procurement subgroups. In addition, BITS has
participated in task forces established by DHS and several technology
associations.
Finally, the BITS Product Certification Program is another
important part of our work to address software security. The BITS
Product Certification Program is a testing capability that provides
security criteria against which software can be tested. A number of
software companies are considering testing. The criteria are also used
by financial institutions in their procurement processes. We are
working to hand this over to DHS and secure ongoing funding for it.
Identity Theft and Phishing: Prevention and Victim Assistance
Just as financial institutions are a key target for hackers and
other cyber criminals, our industry is increasingly the target of
fraudsters operating online. BITS and The Financial Services Roundtable
are responding to the escalation in identity theft with a series of
steps to facilitate prevention of the crime and assist victims when it
occurs. The goals of these efforts are to help maintain trust in the
financial services system, assist member companies' customers, and
mitigate fraud losses. BITS and The Roundtable are working with the
Administration, Congress, and law enforcement and regulatory agencies
to accomplish these goals.
A cornerstone to these efforts is the Identity Theft Assistance
Center (ITAC). Developed by BITS and The Roundtable, with the support
of 50 founding member institutions, the ITAC helps victims of identity
theft restore their financial identity. If a consumer or a member
company suspects a problem, the consumer and the company resolve any
issues, and if the problem involves identity theft, the customer is
offered the ITAC service. The ITAC walks the consumer through his or
her credit report to find any other suspicious activity. Then, the ITAC
notifies the affected creditors and places fraud alerts with the credit
bureaus. The ITAC also shares information with the Federal Trade
Commission and law enforcement agencies, to help arrest and convict the
perpetrators and prevent future identity theft crimes.
Because a consistent understanding of the problem is essential to
finding solutions, a 2003 BITS white paper on identity theft outlines
the full identity theft landscape, establishing key terms as well as
identifying factors that contribute to identity theft. The paper
provides background about the legislative and policy environment,
including existing and proposed laws, as well as industry best
practices.
Along with the white paper, BITS developed guidelines for financial
institutions to use to prevent identity theft and restore victims'
financial identities. The guidelines include processes for providing a
``single point of contact'' at companies to whom victims may report
cases of identity theft.
Additionally, the BITS Fraud Reduction Steering Committee and the
Federal Trade Commission have created a Uniform Affidavit to simplify
the recovery process for victims. The Uniform Affidavit streamlines the
reporting process by recording the victim's information about the
crime, so that victims only have to tell their story once.
BITS is also responding to ``phishing'' through its Fraud Reduction
Program. Phishing is the practice of luring consumers to provide bank
account and other personal information to fraudsters through bogus
email messages. In response to these and other online scams, BITS has
created a Phishing Prevention and Investigation Network. The Phishing
Network provides member institutions with information and resources to
expedite investigations and address phishing/spoofing incidents. The
Phishing Network includes a searchable database of information from
financial institutions on their phishing incident and response
experience, including contacts at law enforcement agencies, foreign
governmental agencies, and ISP Web administrators. The Phishing Network
also provides data on trends to help law enforcement build cases and
shut down identity theft operations.
Financial institutions are regulated to ``know your customers.''
However, financial institutions currently do not have access to various
government databases to validate information provided at new account
openings. For instance, financial institutions cannot validate that a
passport number belongs to the individual providing it and matches the
address given at a new account opening. This is also true of driver's
license and tax ID numbers. (A pilot is underway with Social Security
numbers; BITS is hopeful that financial institutions will finally be
able to validate Social Security numbers.) Financial institutions do
not want direct access to the information; they would like to have
access to a ``yes'' or ``no'' response through a trusted third party.
Complying with Regulatory Requirements
As you know, financial institutions are heavily regulated and
actively supervised by the Federal Reserve, Federal Deposit Insurance
Corporation, Office of the Comptroller of Currency, Office of Thrift
Supervision, National Credit Union Administration, and the Securities
and Exchange Commission. Regulators have stepped up their oversight on
business continuity, information security, third party service
providers, and critical infrastructure protection. Our industry is
working consistently and diligently to comply with new regulations and
ongoing examinations. In addition, BITS and other industry associations
have developed and disseminated voluntary guidelines and best practices
as part of a coordinated effort to strengthen all critical players in
the sector.
Regardless of how well financial institutions respond to
regulations, we simply cannot address these problems alone. Our
partners in other critical industry sectors--particularly the
telecommunications and software industries--must also do their fair
share to ensure the soundness of our nation's critical infrastructure.
Recommendations
The Congress can help the financial services sector meet the
challenges of a post 9/11 environment in a number of ways. We have
developed these key recommendations for the Committee to consider:
1. Recognize that the financial sector is driven by its
``trusted'' reputation as well as regulatory requirements.
Other industries do not have the same level of regulatory
oversight, liability, or business incentives. However, we rely
on other sectors because of our interdependencies.
Responsibility and liability need to be shared.
2. Maintain rapid and reliable communication. Critical
infrastructure industries and the public need to have an early
understanding of the scope and cause as early as possible when
a major event occurs. Diverse communication channels such as
cell phones, wireless email devices, landline phones, and the
Internet are necessary. Both diversity and redundancy are
needed within critical infrastructures to assure backup systems
are operable and continuity of services will be maintained.
3. Recognize the dependence of all critical infrastructures on
software operating systems and the Internet. Given this
dependence, the Congress should encourage providers of software
to the financial services industry to accept responsibility for
the role their products and services play in supporting the
nation's critical infrastructure. In so doing, Congress should
support measures that make producers of software more
accountable for the quality of their products and provide
incentives such as tax incentives, cyber-insurance, liability/
safe harbor/tort reform, and certification programs that
encourage implementation of more secure software. Congress also
could provide protection from U.S. antitrust laws for critical
infrastructure industry groups that agree on baseline security
specifications for the software and hardware that they
purchase.
4. Encourage regulatory agencies to review software vendors--
similar to what the regulators currently do in examining third-
party service providers--so that software vendors deliver safe
and sound products to the financial services industry.
5. Encourage collaboration and coordination among other
critical infrastructure sectors and government agencies to
enhance the diversity and resiliency of the telecommunications
infrastructure. For example, the government should ensure that
critical telecommunications circuits are adequately protected
and that redundancy and diversity in the telecommunications
networks are assured.
6. Invest in the power grid because of its critical and
cascading impact on other industries and other critical
infrastructures. The power grid must be considered among the
most vital of critical infrastructures and needs investment to
make sure it works across the nation.
7. Establish improved coordination procedures across all
critical infrastructures and with federal, state, and local
government when events occur. Coordination in planning and
response between the private sector and public emergency
management is inadequate and/or inconsistent. For example, a
virtual national command center for the private sector that
links to the Homeland Security Operations Center would help to
provide consistency.
8. Encourage law enforcement to prosecute cyber criminals and
identity thieves, and publicize U.S. government efforts to do
so. These efforts help to reassure the public and businesses
that the Internet is a safe place and electronic commerce is an
important part of the nation's economy.
On behalf of both BITS and The Financial Services Roundtable, thank
you for the opportunity to testify before you today. I will now answer
any questions.
Attachment A
Letter from BITS and The Financial Services Roundtable
The Financial Services Rountable
BITS
FINANCIAL SERVICES
ROUNTABLE
JULY 13, 2004
Representative Christopher Cox,
Chairman, Select Committee on Homeland Security
2402 Rayburn House Office Building
Washington, DC 20515
Representative Jim Turner
Ranking Member, Select Committee on Homeland Security
330 Cannon House Office Building
Washington, DC 20515
Representative Mac Thornberry
Chairman, Cybersecurity Subcommittee
2457 Rayburn House Office Building
Washington, DC 20515
Representative Zoe Lofgren
Ranking Member, Cybersecurity Subcommittee
102 Cannon House Office Building
Washington, D.C. 20515
RE: Cybersecurity Concerns
Dear Representatives Cox, Turner, Thornberry and Lofgren:
Thank you for the opportunity to discuss the concerns of financial
institutions with regard to strengthening software security.
The Financial Services Roundtable (FSR) and BITS want to offer our
support for the recommendation to elevate the position of cybersecurity
director to the level of Assistant Secretary. We support this effort as
a way to increase the administration's focus on cybersecurity concerns
and address issues such as those outlined in the attached BITS/FSR
Software Security Policy Statement. Furthermore, we believe that this
elevation to Assistant Secretary will provide support for those areas
identified by the National Strategy as requiring additional actions.
Finally, we would like to acknowledge the responsiveness of the
National Communications System (NCS) to meeting the needs of the
financial services industry. As such, we would like to ensure that
moving the NCS into the Cybersecurity Division will not undermine the
excellent work of the NCS.
Best regards,
Steve Bartlett
President, The Financial Services Roundtable.
Catherine A. Allen
Chief Executive Officer.
Enclosure: BITS/FSR Software Security Policy Statement
SOFTWARE SECURITY
Security is a fundamental building block for all financial
services. It is also a regulatory requirement. The financial services
industry relies upon software to operate complex systems and provide
services, as well as to protect customer information.
Financial services companies comply with a host of legal and
regulatory requirements to ensure the privacy and security of customer
information. Recently, the prevalence of security risks, threats and
viruses, combined with a lack of accountability for software
vulnerabilities, has saddled financial institutions with significant
risks and skyrocketing costs.
In early 2004, BITS surveyed its members to estimate the costs to
financial institutions of addressing software security and patch-
management problems. Based on the survey, BITS and Financial Services
Roundtable members pay an estimated $400 million annually to deal with
software security and patch management. Extrapolated to the entire
financial services industry, these costs are approaching $1 billion
annually.
The members of BITS and The Financial Services Roundtable believe:
Because the financial services industry plays a
central role in the nation's critical infrastructure and is
dependent on the products and services of software providers,
such providers of mission critical software to the financial
services industry need to accept responsibility for the role
their products and services play in supporting the nation's
critical infrastructure and should exhibit and be held to a
``higher duty of care'' to satisfy their own critical
infrastructure responsibilities.
Software vendors should ensure their products are
designed to include security as part of the development process
using security-trained and security-certified developers on
product development and lifecycle teams.
Software vendors should ensure through testing that
their products meet quality standards and that financial
services security requirements are met before products are
sold.
Software providers should develop patch-management
processes that minimize costs, complexity, downtime, and risk
to user organizations. Software vendors should identify
vulnerabilities as soon as possible and ensure that the patch
is thoroughly tested.
Software vendors should continue patch support for
older, but still viable, versions of software.
Collaboration and coordination among other critical
infrastructure sectors and government agencies are essential to
mitigate software security risks.
The members of BITS and The Financial Services Roundtable:
Support measures that make producers of software more
accountable for the quality of their products.
Support incentives (e.g., tax incentives, cyber-
insurance, liability/safe harbor/tort reform, certification
programs) and other measures that encourage implementation of
more secure software development processes and sustain long-
term R&D efforts to support stronger security in software
products.
Seek protection from U.S. antitrust laws for critical
infrastructure industry groups that agree on baseline security
specifications for software and hardware that they purchase.
Encourage regulatory agencies to explore supervisory
tools to ensure that critical third-party service providers and
software vendors deliver safe and sound products to the
financial services industry.
Support and incorporate, where possible, the BITS
Product Security Criteria into security policies, and encourage
technology vendors to test products to meet these criteria.
Apply a risk-management approach to software security
by assessing risks and applying appropriate tools and best
practices to ensure the most secure deployment and application
of software possible across the entire enterprise.
Participate in and support efforts to strengthen the
Financial Services Information Sharing and Analysis Center (FS/
ISAC) in order to share vulnerability information on the
products deployed by financial institutions.
Educate policy makers on the significance of the risks
posed to the financial services sector and other critical
infrastructure industries and the need to take action to
mitigate these risks.
BUSINESS REQUIREMENTS
FOR
SOFTWARE SECURITY AND PATCH MANAGEMENT
Members of BITS and The Financial Services Roundtable believe
software vendors should take responsibility for the quality of their
products. Especially when selling products to companies that are within
critical infrastructure industries, certain minimum requirements should
be met. Following are recommended critical infrastructure sector
Business Requirements.
Provide a higher ``duty of care'' when selling to critical
infrastructure industry companies.
To meet this higher duty of care, vendors should:
Make security a fundamental component of software
design.
Support older versions of software (e.g., NT),
particularly if existing programs are functional and not past
the end of their estimated life cycle.
Make upgrading easier, less cumbersome and less
costly, and offer more support.
-- Products should be less prone to failure and have an
automated back-out feature.
-- Components (including embedded components used in
other products) should be clearly defined in order for
the customer to assess the cascading effect of the
upgrade or installation.
-- Publish metrics on security of new and existing
products.
-- Expand coordination and establish better
communication with individual clients and industry
groups.
-- Vendors should give customers an aggressive ``patch
playbook'' which would provide clear guidance and
explicit instructions for risk mitigation throughout
the patch management process and especially in times of
crisis.
-- Vendors should offer critical infrastructure
customers access to one-on-one, private, early
vulnerability notice prior to notifying the general
public, possibly by establishing ``preferred'' customer
levels. (Some vendors offer financial institutions
advanced notification if they agree to serve as a
``beta'' site, however, this is not practical as an
industry-wide solution.)
Provide better security-trained and security-certified
developers on product teams.
Establish Regional Centers of Excellence to service
major financial institutions in their area. Centers would keep
IT profiles for each institution in order to:
-- Inform institutions of the likely effects of a new
vulnerability on their specific IT environment.
-- Continually advise institutions on how to best apply
patches.
-- Expedite patch installation by visiting the
financial institution site.
-- Make on site or remote consultation available when
patches affect other applications.
Comply with security requirements before releasing software products.
Vendors should:
Meet minimum security criteria, such as BITS software
security criteria and/or the Common Criteria.
Thoroughly test software products, taking into
consideration that:
-- Testing needs to address both quality assurance as
well as functionality against known and unknown
threats.
Conduct code reviews.
--Whether conducted internally or outsourced, code
reviews should involve tools or processes, such as code
profilers and threat models, to ensure code integrity.
Improve the patch-management process to make it more secure and
efficient and less costly to organizations.
Vendors should:
Issue patch alerts as early as possible.
Continue patch support for older software.
-- Vendors should be clear about the level of support
provided for each software version.
--Vendors are strongly encouraged to provide support
for up to two versions of older software, i.e., the N-2
level.
Provide automatic, user-controlled patch-management
systems, such as uniform, reliable, and, possibly, industry-
standard installers.
Ensure all patches come with an automated back-out
function and do not require reboots.
Support clients who purchase third-party installer
tools (until a standard is established).
Thoroughly test patches before release.
-- Testing should include patch-to-patch testing to
identify any cascade effects and in-depth compatibility
testing for effects on networks and applications.
Issue better patch and vulnerability technical
publications. Publications should include more thorough
analyses of the impact of vulnerabilities on unpatched systems
as well as data on the environments and applications for which
the patches were tested. Impact on other patches should also be
addressed.
Conduct independent security audits of the patch-
development and deployment processes.
Distribute a communication and mitigation plan,
including how vulnerability/patch information will be relayed
to the customer, for use in times of crisis.
Attachment B
BITS Response to DHS' Questions on Cyber Security January 4, 2005
The National Cyber Security Division of DHS hosted a retreat at Wye
River, Maryland on January 6-7, 2005 to assess private and public
sector progress in meeting the goals and objectives of the
Administration's National Strategy to Secure Cyberspace. DHS asked
participants in advance of the meeting to answer three questions. BITS
submitted the following answers to these questions.
Question 1: What are the top three initiatives your organization is
currently involved in to advance cybersecurity (such as the goals
articulated in the National Strategy to Secure Cyber Space)?
BITS is involved in numerous efforts to address cyber security and
protect the Nation's critical infrastructure. For 2005, BITS will focus
on the following top three initiatives to advance cybersecurity: (1)
urge major software vendors to address software security business
requirements; (2) combat on-line fraud and identity theft; and (3)
support efforts to develop meaningful software product certification
programs. In addition to the three initiatives outlined below, BITS
also will continue to educate policy makers on cyber security risks and
steps that can be taken to protect the Nation's critical
infrastructure. (See appendix B for a summary of BITS' accomplishments
in 2004.)
A. Urge major software vendors to address the BITS/FSR software
security business requirements. In April 2004, BITS and The Financial
Services Roundtable announced a joint policy statement calling on the
software industry to improve the security of products and services it
provides to financial services customers. The policy statement calls on
software providers to accept responsibility for their role in
supporting financial institutions and other critical infrastructure
companies. BITS and the Roundtable support incentives (e.g., tax
incentives, cyber-insurance, liability/safe harbor/tort reform,
certification programs) and other measures that encourage
implementation of more secure software development processes and
sustain long-term research and development efforts to support stronger
security in software products. (The BITS/FSR Software Security Business
Requirements are attached to the April 2004 BITS/FSR Software Security
Policy statement which is available at http://www.bitsinfo.org/
bitssoftsecuritypolicyapr04.pdf) In addition, BITS is working with
major software vendors to discuss business requirements. In June 2003,
BITS announced it had successfully negotiated with Microsoft to provide
additional support to BITS member companies for Windows NT. We have
provided Microsoft and other software and hardware companies with the
Software Security Business Requirements. BITS members agree that these
requirements are critical to the soundness of systems used in the
financial services industry. BITS also is working with or has plans in
early 2005 to work with Cisco, IBM and RedHat on software security
issues.
B. Combat on-line fraud and identity theft and explore appropriate
authentication strategies. BITS is involved in supporting the pilot of
the BITS/FSR Identity Theft Assistance Center (ITAC), developing the
BITS Phishing Prevention and Investigation Network, and focusing on
authentication practices and strategies.
The ITAC is a one-year pilot program intended to help victims of
identity theft by streamlining the recovery process and enabling law
enforcement to identify and prosecute perpetrators of this crime. ITAC
is an initiative of The Financial Services Roundtable and BITS, which
represent 100 of the largest integrated financial services companies.
Fifty BITS and Roundtable Members are participating and funding the
ITAC pilot program as a commitment to their customers and maintain
trust in the Nation's financial services system. The ITAC's services
are free-of-charge to customers and made available based on referrals
to the ITAC by one of the 50 members of the ITAC pilot program. BITS
has also published several business practices guidelines and white
papers on various aspects of identity theft and fraud reduction
strategies.
The BITS Phishing Prevention and Investigation Network has three
primary purposes. First, the Network helps financial institutions shut
down online scams. Second, it aids in investigations of scam
perpetrators by providing law enforcement with trend data. Law
enforcement agencies can use the data to build cases and stop scamming
operations. Finally, the BITS Network facilitates communication among
fraud specialists at financial institutions, law enforcement agencies
and service providers, resulting in a ``united front'' for combating
online scams. Financial institutions can also use the BITS Network to
share information about online scams. Through its searchable database,
fraud professionals at BITS member institutions learn from other
institutions' phishing incidents and responses. The database provides
quick access to contacts at law enforcement agencies, foreign
governmental agencies, and ISP administrators. Founded under the
auspices of the BITS eScams Subcommittee of the BITS Internet Fraud
Working Group, the Network is hosted by the Financial Services
Information Sharing and Analysis Center (FS/ISAC). Resources to develop
the Network were contributed by Microsoft Corporation and RDA
Corporation.
On March 8, 2005, BITS will host a Forum entitled ``A Strategic
Look at Authentication'' in Washington, DC. Authentication issues have
emerged in a number of BITS' working groups. This strategic Forum will
focus on the following issues: business issues that drive the need for
authentication; business challenges to implementation; public policy
implications; and emerging technologies in the authentication area.
C. Support efforts to develop meaningful software product
certification programs. The BITS Product Certification Program (BPCP)
is an important part of our work to address software security. The BPCP
provides product testing by unbiased and professional facilities
against baseline security criteria established by the financial
services industry. A product certification, the BITS Tested Mark, is
awarded to those products that meet the defined criteria. An option is
available for technology providers to meet the product certification
requirements via the internationally recognized Common Criteria
certification schema. BITS has initiated discussions with DHS to
support efforts to enhance product certification programs, including
the Common Criteria program run by the National Security Agency (NSA)
and National Institutes of Technology and Standards (NIST). DHS has
expressed support for broad-based, not sector specific, certification
programs. Moreover, DHS wants ``buy in'' from the broader user
community. Consequently, BITS has been in discussions with The Business
Roundtable, NIST, and the Cyber Security Industry Alliance (CSIA) to
develop a joint proposal.
Question 2 & 3: Aside from funding, what can the government (if
appropriate, specify which agency(ies)) do to help advance the
cybersecurity agenda/priority(ies)/initiative(s) of your organization?
What else should government and the private sector be doing to help
facilitate enhanced cybersecurity?
Our Nation's economic and national security relies on the security
of information technology (IT). This security depends on the
reliability, recoverability, continuity, and maintenance of information
systems. The issue of secure information technology has a direct and
profound impact on both the government and private sectors, and
includes the Nation's critical infrastructure. The security and
reliability of information systems are increasingly linked to consumer
and investor confidence. Financial institutions (and others that make
up the ``user'' community) are demanding greater accountability for the
security of IT products and services. The federal government can play
an important role in protecting the Nation's IT assets. The following
are steps the U.S. government can and should take to secure information
technology.
Strengthen the Information Sharing and Analysis
Centers (ISACs) by providing complete and adequate federal
funding. Information sharing and trend analysis within a sector
is essential to protecting information security and responding
to events. The ISACs are a good vehicle for such sharing, but
they require additional resources.
Encourage sharing of essential information among
industry ISACs. Threats to cyber security will reach some
sectors before others--oftentimes resulting in simultaneous or
cascading effects. Mandatory sharing among the ISACs will
provide valuable advance notice to sectors not immediately
threatened.
Utilize the ISACs to inform critical infrastructures
of cyber threats discovered through national intelligence and
law enforcement. As a primary target of cyber attacks, the
government expends substantial resources to protect, detect and
respond to attacks. The information gathered by the government
regarding present, imminent, or gathering threats should be
shared with sectors that are widely understood to be critical
to the security of the country. ISACs represent a centralized
way of quickly disseminating important security information.
Create an emergency communication system in the event
of a massive cyber attack. Such an attack could potentially
cripple many of the primary communication channels. To allow
maximum efficiency of information dissemination to key
individuals in such an event, a thorough and systematic plan
should be in place. The financial services industry relies on
the BITS/FSR Crisis Management Process and Manual of
Procedures, including the BITS/FSR Crisis Communicator.
Create and promote security standards for technology
products which address the Common Criteria certification
concerns noted by the National Cyber Security Partnership
(NCSP). These concerns include:
Cost and delay of the certification process
Need to make certification applicable to the
needs of both government and industry
Uniform tying of federal procurement policies
to the certification system
In the alternative to repairing the Common Criteria, a new system
should be developed that would address from the beginning the
limitations of the Common Criteria. DHS has expressed interest in such
a certification program if it is not sector specific. The BITS Product
Certification Program may well be able to serve as a model for such a
certification program.
Increase staffing, funding, and prominence of cyber
security in the DHS. Cyber security is a unique threat to
national security. As such, it should be elevated in importance
at DHS.
Create a more senior level policy level position
within DHS to address cyber security issues and concerns.
Provide tax or other incentives for achieving higher
levels of Common Criteria certification. Presently, Common
Criteria certification is the primary uniform means of
evaluating the security of software and hardware. Incremented
incentives, based upon the level of certification achieved,
would help to compensate companies for the time and cost of
certification. This should encourage more certification and
increase the overall security of hardware and software.
Provide tax or other incentives for certification of
revised or updated versions of previously certified software.
Under Common Criteria, certification of updated versions is
costly and time consuming. Incentives are necessary to ensure
that all software is tested for security and not a single build
or version of a product.
Require software providers to immediately notify ISACs
of newly discovered cyber threats and to provide updated
information on such threats until an effective patch is
provided. Regulatory controls may be necessary to prevent the
wider broadcast of such information, but it is vital that the
critical infrastructure receive immediate notice of serious
vulnerabilities. Regulatory action will also be necessary to
police software provider compliance with such an information
sharing requirement.
Establish requirements which improve the patch-
management process to make it more secure and efficient and
less costly to organizations that use software.
Fund joint FTC/DHS consumer cyber security awareness
campaign. The FTC should focus its efforts on building consumer
awareness, and DHS should coordinate more detailed technical
education regarding specific serious threats. In addition,
government employees should be trained in proper cyber safety
measures.
Train government employees on proper cyber security
measures.
Provide tax or other incentives for industry cyber
security awareness campaigns. Because security should not be
grounds for competitive advantage, cyber security awareness
campaigns undertaken on an industry-wide basis should be
encouraged.
Educate corporate executives and officers regarding
their duties under Sarbanes-Oxley, GLBA, and HIPAA as relates
to cyber security.
Require high levels of cyber security in software
purchased by the government through procurement procedures.
Extend such requirements to software used by government
contractors, subcontractors, and suppliers.
Provide NIST with adequate resources to develop
minimum cyber security requirements for government procurement.
NIST should include software developers and other stakeholders
in the standard creation process.
Assign to the Commerce Department or another
appropriate agency the responsibility of tracking and reporting
such costs and the impact on the economy. Measuring and making
transparent these costs will aid law makers and regulators as
they assign resources to cyber security programs.
Fund research and development of more secure software
development practices, testing and certification programs.
Facilitate collaboration with the users and suppliers
of information technology to develop standards for safe
practices.
Enhance DHS, NSF, and DARPA cyber security R&D
funding.
Carefully manage long and short term R&D to avoid
duplication.
Establish a mechanism to share educational training
and curriculum.
Encourage law enforcement to enforce, investigate and
prosecute cyber crimes here and abroad.
Ratify the Council of Europe's Convention on
Cybercrime.
Enhance criminal penalties for cyber crimes.
Make cyber crimes and identity theft enforcement a
priority among law enforcement agencies.
Encourage better coordination among law enforcement
agencies in order to detect trends, share information and
identify and prosecute offenders.
Mr. Lungren. I think the chief clerk wants to make sure
that we hear Mr. Silva. This is high-tech right here.
The Chair now recognizes Mr. Ken Silva, chairman of the
board of directors of the Internet Security Alliance, to
testify. Thank you for appearing.
STATEMENT OF KEN SILVA, CHAIRMAN OF THE BOARD OF DIRECTORS,
INTERNET SECURITY ALLIANCE
Mr. Silva. Good morning, Mr. Chairman.
I am Ken Silva. I am the chief security officer and vice
president for infrastructure security of VeriSign,
Incorporated. I am also chairman of the board for the Internet
Security Alliance, on whose behalf I am here today. With the
Chairman's permission, I ask that my entire statement be
inserted into the record.
Before I detail what is in H.R. 285 that the IS Alliance
finds promising, let me tell you a little bit about ISA and one
of its members companies, VeriSign. ISA was established in
April of 2001 as a trade association comprising over 200 member
companies spanning four continents. ISA member companies
represent a wide diversity of economic sectors representing the
vendors and users of the technology network, and the ISA
focuses exclusively on information security issues. Among IS
Alliance's core beliefs are, first, because we are the stewards
of the Internet's physical assets, it is the private sector's
responsibility to aggressively secure them.
Second, more needs to be done by both government and
industry to provide adequate information security. This means
security not only securing the physical and logical elements of
the network--but also securing the highly valuable electronic
cargo running over the network.
Third, a great deal can be accomplished simply with
enhanced technology and greater awareness and training of
individuals--from the top corporate executives down to the
solitary PC user.
Fourth, while technology, education and information sharing
are critical to cybersecurity, they must be supported by
research, aggressive global intelligence gathering, information
sharing, and vigorous law enforcement efforts against those who
attack the network.
Lastly, new and creative structures and incentives need to
evolve to ensure adequate and ongoing information security.
VeriSign, as one of the member companies of the Internet
Security Alliance, is in a unique position to preserve and
protect the Internet's infrastructure, at least part of it, in
our role as steward for the dot.com and dot.net top-level
domains of the Internet and also 2 of the 13 root servers.
I am pleased to have the opportunity to speak in support of
H.R. 285, the Department of Homeland Security Cybersecurity
Enhancement Act of 2005. I would like to make three overarching
points about this legislation.
First, both the public and private sectors need to become
more proactive with respect to cybersecurity. The FBI declares
cybercrime to be our Nation's fastest-growing crime. According
to the CERT, there has been an increase of nearly 4,000 percent
in computer crimes since 1997. We also know from reliable
intelligence that has been reported that terrorist groups are
not only using cybercrime to fund their activities, but
studying how to use the information and attacks to undermine
our critical infrastructures.
Second, the administrative changes in management tasking
set out in H.R. 285 must be supported by an adequate level of
funding to permit the Department to carry out critical mandates
of this bill. In particular, increased funding for
cybersecurity research is one critical area not specifically
mentioned in this legislation. The Internet's basic protocols
are nearly 30 years old, and at the time of their creation,
they didn't contemplate the security or scale issues we face
today.
Third, sufficient real authority and trust must be invested
in the person who heads up the cybersecurity organization.
Without this stature and trust, the elevation of the
organization to an office and the bestowing of an assistant
secretary title will have little benefit.
Mr. Chairman, there is no shame in pointing out what we all
know to be true. Our economic and national security depends on
this job being done right. Cybersecurity means the protection
of physical and logical assets of a complex distributed
network. Cybersecurity means protection of the economic and
national security activity carried on that infrastructure.
These infrastructure assets support activity that in the
commercial area alone account for about $3 trillion daily.
According to the Federal--excuse me, this is according to the
Federal Reserve Board. That is $130 billion an hour that
depends on there being a safe, reliable and available Internet.
An infrastructure of such great importance to America's
economic and national security demands leadership that is
trusted, visible and effective.
In summary, Mr. Chairman, the challenge of America and the
rest of the Internet-dependent world, security organizations
like DHS, is threefold. First, DHS and other government
cyberagencies need to understand the architecture of the
network today and to recognize its ever-growing diversity and
complexity.
Second, cybersecurity agencies need to collaborate with the
industries that operate most of these network assets and
exchange and understand the information exchanged with
industry, including employing the best engineering talent
available.
Lastly, the cybersecurity agencies here and around the
world must be organized and cooperate to respond to threats and
attacks against our cyberinfrastructure rapidly and
effectively.
Mr. Chairman, this H.R. 285 moves the Department of
Homeland Security in the direction of addressing these three
challenges. It is especially helpful simply because it applies
more attention to cybersecurity.
IS Alliance members want to work with the committee and the
Department to ensure that good intentions expressed in this
document become a reality that strengthens America's ability to
prevent attacks against our networks and to make them strong
enough to withstand any attacks that do come our way.
Thank you, Mr. Chairman.
Mr. Lungren. Thank you very much, Mr. Silva.
[The statement of Mr. Silva follows:]
Prepared Statement of Ken Silva
Good morning Mr. Chairman. I am Ken Silva. I am the Chief Security
Officer and Vice President for Infrastructure Security of VeriSign,
Incorporated. I have the privilege of being the Chairman of the Board
of the Internet Security Alliance (ISAlliance), on whose behalf I am
here today
Before I detail what it is in H.R. 285 that the IS Alliance finds
promising, let me tell you a bit more about both the IS Alliance and
VeriSign.
Established in April 2001 as collaboration between Carnegie Mellon
University and the Electronic Industries Alliance, the IS Alliance is a
trade association comprising over 200 member companies spanning four
continents. IS Alliance member companies represent a wide diversity of
economic sectors including banking, insurance, entertainment,
manufacturing, IT, telecommunications, security, and consumer products.
The IS Alliance programs focus exclusively on information security
issues. We provide our member companies with a full suite of services
including: information sharing, best practice, standard, and
certification development, updated risk management tools, model
contracts to integrate information technology with legal compliance
requirements, and market incentives to motivate an ever-expanding
perimeter of security.
Among the IS Alliance's core beliefs are:
First, because the Internet is primarily owned and operated by
private organizations, it is the private sector's responsibility to
aggressively secure the Internet.
Second, not enough is currently being done by either government or
industry to provide adequate information security. This means security
not only of the physical and logical elements of the network--but also
security of the highly valuable electronic cargo running over the
network. Third, a great deal can be accomplished simply with enhanced
technology and greater awareness and training of individuals--from the
top corporate executives down to the solitary PC users.
Fourth, while technology, education, and information sharing are
critical, they are insufficient to maintain appropriate cybersecurity
and respond to an ever-changing technological environment. Research,
aggressive global intelligence gathering, information sharing, and
vigorous law enforcement efforts against those who attack our networks
are also essential.
Fifth, new and creative structures and incentives may need to
evolve to assure adequate and ongoing information security. While
government is a critical partner, industry must shoulder a substantial
responsibility and demonstrate leadership in this field if we are to
eventually succeed.
As Chairman of ISAlliance's Board, one of my roles is to carry
these messages not only to government, but also to potential new
members of the ISAlliance. When VeriSign helped found the ISAlliance
four years ago, there were fewer than a dozen members. But the
ISAlliance's key points resonate with ANY organization that uses the
information superhighway to conduct its affairs--whether commercial
business, academic institution, NGOs, or government. Thus, it is not
surprising that, since its inception, the ISAlliance has grown by
nearly twenty-fold.
Certainly, my own company, VeriSign takes these principles
seriously. VeriSign is a microcosm of the diverse ``e'' activities on
the Internet, of the convergence of the traditional ``copper'' networks
with computer driven digital networks, soon to become the ``NGNs'' or
Next Generation Networks. Commerce, education, government, and
recreation all are enabled by the infrastructures and services we and
our colleague companies support. VeriSign, the company I am privileged
to serve as Chief Security Officer, was founded 10 years ago in
Mountain View, California. VeriSign operates the Internet
infrastructure systems that manage .com and .net, handling over 14-
billion Web and email look-ups every day. We run one of the largest
telecom signaling networks in the world, enabling services such as
cellular roaming, text messaging, caller ID, and multimedia messaging.
We provide managed security services, security consulting, strong
authentication solutions, and commerce, email, and anti-phishing
security services to over 3,000 enterprises and 400,000 Web sites
worldwide. And, in North America alone, we handle over 30 percent of
all e-commerce transactions, securely processing $100 million in daily
sales.
Of these activities, the one that places us in a very unique
position to observe, and to protect the Internet's infrastructure is
our role as steward of the .COM and .NET top level domains of the
Internet, and of two of the Internet's 13 global root servers. These
are the Internet's electronic ``directory'' The services VeriSign
provides over many hundreds of millions of dollars worth of servers,
storage and other infrastructure hardware enables the half trillion
daily Internet address lookups generated by all of your web browsing
and emails to actually reach their intended destinations. Consequently
as the manager of several 24x7 watch centers where our engineering
staff observe as these 500 billion daily requests circle the globe, we
see when elements of the infrastructure are attacked, impaired, taken
off the air for maintenance, or otherwise have their status or
performance altered. Because we observe and record this, VeriSign is
capable of, and often involved in the identification of the nature,
severity, duration, type, and sometimes even source of attacks against
the Internet. Our experience in doing this for over a decade, I believe
makes VeriSign uniquely interested in how the government architects its
companion cybersecurity services.
I am pleased to have the opportunity to speak in support of H.R.
285, the Department of Homeland Security Cybersecurity Enhancement Act
of 2005; I would like to make three overarching points about the
legislation:
First, both the public and private sectors need to become more pro-
active with respect to cybersecurity.
A smattering of statistics can briefly outline the growing nature
of the growing cyber security problem. According to Carnegie-Mellon
University's CERT, there has been an increase of nearly 4000 percent in
computer crime since 1997. The FBI declares Cybercrime to be our
nation's fastest growing crimes. One FTC estimate puts the number of
Americans who have experienced identity theft at nearly 20 million in
the past 2 years, suggesting the link between Cybercrime and identity
theft is not merely coincidental. CRS reported last year that the
economic loss to companies suffering cyber attacks can be as much as 5
percent of stock price. Furthermore, the OECD reports that as many as 1
in 10 e-mails are viruses and that every virus launched this year has a
zombie network backdoor or Trojan (RAT). Globally they estimate 30
percent of all users, which would mean more than 200 million PCs
worldwide, are controlled by RATs.
Perhaps most ominously, we know from reliable intelligence that
terrorist groups are not only using Cybercrime to fund their
activities, but are studying how to use information attacks to
undermine our critical infrastructures.
Second, the administrative changes and management taskings set out
in H.R. 285 must be supported by an adequate level of funding to permit
the Department to carry out the critical mandates of this bill.
In particular, cybersecurity research is one area of critical
financial need NOT specifically mentioned in the legislation. The basic
protocols the Internet is based on are nearly 30 years old; they did
not contemplate the security or scale issues we face today and will
continue to face in the future. Increasing Federal funding for
cybersecurity research and development was recently cited by the
President's Information Technology Advisory Committee, (the ``PITAC'').
After studying the U.S. technology infrastructure for nearly a year,
PITAC noted in its report entitled ``Cyber Security: A Crisis of
Prioritization'' that ``most support is given to short-term, defense-
oriented research, but that little is given to research that would
address larger security vulnerabilities.'' The IS Alliance fully
agrees. Substantial funding needs to be provided for basic research in
cybersecurity. Industry, itself, can not sustain the level of research
investment that is required. The US government must increase its
investment.
Third, sufficient REAL authority and trust need to be invested in
the person who heads up the Cybersecurity organization within the
Department. Without this stature and trust, the elevation of the
organization to an ``Office'' and the bestowing of an Assistant
Secretary title will have little benefit. Mr. Chairman, there should be
no shame in pointing out what we all know to be true: our economic and
national security depends on this job being done right.
``Cybersecurity'' means the protection of the physical and logical
assets of a complex distributed network comprised of long-haul fiber,
large data switching centers, massive electronic storage farms, and
other physical assets worth hundreds of billions of dollar; the
software programs, engineering protocols, and human capital and
expertise which underlie it all are equally valuable. And cybersecurity
means protection of the activity--economic and national security--
carried on that infrastructure. All of these infrastructure assets
combine to support activity that, in the commercial area alone, account
for about $3 trillion dollars daily, according to the Federal Reserve
Board. That's $130 billion per hour that depends on a safe, reliable,
and available Internet. An infrastructure of such great importance to
America's economic and national security demands leadership that is
trusted, visible, and effective.
Several provisions of H.R. 285 are of special note:
First, the final section does us all the important service of
attempting to define--and to BROADLY ``define--cybersecurity'', to
encompass all of the diverse legacy, present and emerging networked
electronic communications tools and systems.
Second, the bill's repeated emphasis on collaboration between the
Department and the private sector--in each present and proposed NCSO
operational area, as well as across government--reflects a wise
understanding of the dynamic nature of the cyber infrastructure, and
the diverse interests in and out of government which must cooperate to
assure the networks' security and stability. I will address some
specifics, as well as IS Alliance's incentives programs, later in my
testimony.
Third, in a related area, language in Section 2 (d) directs the
consolidation into the NCSO of the existing National Communications
System (NCS) and its related NCC industry watch center, which for two
decades has provided industry-based alert, warning, and analysis
regarding attacks against the traditional telephone networks. These
existing important watch functions support critical national security
and emergency preparedness communications; their consolidation will
bring Departmental practice more inline with emerging technological
realities. If done with appropriate care and recognition of the
valuable, unique role the NCC has played in supporting NS/EP
communications for two decades, consolidation could also make the
function stronger and better able to protect these converging assets.
Fourth, the IS Alliance strongly supports voluntary cybersecurity
best practices highlighted in section 5(A). We believe that market-
driven cyber security is the appropriate model to compel positive
cybersecurity improvements within the nation's cyber critical
infrastructure. Towards this end, the insurance industry, among others,
have made great strides and continue to advance the state-of-the-art
among market-driven cybersecurity best practices.
COMMENTS on SPECIFIC PROVISIONS
Developing new tools to address cyber threats depends on real
public-private cooperation. H.R. 285 provides the Department with
significant improvements that the ISAlliance believes may help achieve
better organization, more cooperation, and greater effectiveness in its
collaborations with the industrial, private-sector custodians of the
cyber infrastructure, in its cooperation with other agencies of
government at the Federal, sub-Federal and international levels, and in
its development of new tools to combat cyber threats.
With its focus on government-industry cooperation and cross-
governmental cooperation, this bill correctly identifies the two
centers of gravity for successfully meeting the cybersecurity
challenge. Current programs must continue, which address:
analysis of threat information;
detection and warning of attacks against the cyber
infrastructure;
restoration of service after attacks;
reducing vulnerabilities in exiting network
infrastructure, including assessments and risk mitigation
programs;
awareness, education, and training programs on
cybersecurity across both the public and private sectors;
coordination of cybersecurity (as directed by HSPD-7
and the Homeland Security Act) across Federal agencies, and
between Federal and sub--federal jurisdictions; and
international cybersecurity cooperation.
All of these are essential functions. Even in our custodial role
for many of the infrastructures that support the $10 trillion
U.S.''eConomy'', few would assert that private industry can, or even
SHOULD, manage these functions. They are PUBLIC functions, properly
performed by government, but in cooperative collaboration--persistent
and polite collaboration between government and industry. I want to
note here, Mr. Chairman, that we realize the challenges for DHS/NCSD
are far, far easier said than done. Everyone working at the Department,
including those in the infrastructure protection and cybersecurity
divisions, deserves our sincerest gratitude. I want to personally thank
my colleague on the panel today Mr. Yoran, as well as his predecessors,
Mr. Clark & Mr. Simmons, as well as his successor Acting Director
Purdy. And Mr. Liscouski who oversaw the entire infrastructure
division; they all worked, or are working, as hard as they can at an
imposing task.
That said however, it is a task that must be completed, no matter
how difficult And IS Alliance is not unmindful of cost. But a national
cybersecurity awareness and training program as provided by subsection
(1)(C), a government cybersecurity program to coordinate and consult
with Federal, State, and local governments to enhance their
cybersecurity programs as provided by subsection (1)(D), and a national
security and international cybersecurity cooperation program as
provided by subsection (1)(E) are all important and welcome
improvements to the nation's overall cybersecurity posture. Absent
adequate funding however, the long-term effectiveness of these critical
cybersecurity programs will be uncertain.
Unfortunately, and despite great effort to date, the track-record
of the Department and NCSD in achieving even an effective dialogue on
how to conduct these essential activities has been spotty and even
disappointing.
The provisions of Section 2 of H.R. 285 that direct these specific
functions may--hopefully, WILL--jumpstart the collaborations that will
rapidly make these programs a reality. America cannot fail in doing
these things; a cyber Pearl Harbor is not just a catch phrase, but very
much a potential reality. The Department's own ``Red Cell'' exercises,
including a notable one published last September, clearly forecasts
``blended'' terror attacks against the physical and logical assets of
our information networks and institutions that depend on them. Such
unavoidably attractive targets have the potential to disrupt economic,
social, and government activities at all levels. Improved cyber-
resiliency--established in part through effective public-private
cooperation such as spelled out in Section 2 of H.R. 285--is one
important step in reducing that threat.
Similarly, cross-agency collaborations within Department
components--and with other security and anti-terrorism components of
government--is not merely common sense, they are essential. In
VeriSign's business, we have had opportunities from time to time to try
to ``go it alone'' and reap the innovator's premium from the
marketplace, or to cooperate with competitors on standards and
accessible platforms that grow markets and increase business
opportunities for all participants. I can tell you that cooperation and
the ``rising tide raises all boats'' approach is preferable to being
the single-handed sailor. In cybersecurity, the expertise of many
different agencies--Treasury on financial crimes, or Justice on
international frauds--being brought to bear just seems compelling.
Several other provisions of the bill have been long-standing areas
of interest to the IS Alliance:
The information sharing provision of HR 285 refers back to Section
214 of the Homeland Security Act; the Department's ``Protected Critical
Infrastructure Information'' program attempting to implement this
Congressional mandate is long overdue for reexamination. The ``PCII''
program, though perhaps well meaning has, rather than encouraging
information sharing between industry and the Department, chilled the
flow of information. The implementing regulations represent a complex
bureaucratic structure that seems more intent on keeping Federal
employees from accidentally mishandling information, and thus facing
prosecution, rather than encouraging a timely flow of attack and threat
information from network custodians to the Department. VeriSign and
some of our ISAlliance partners who are members of the IT-ISAC helped
draft the original Section 214 of the Homeland Security Act. We are
anxious to see it work in a manner consistent with its original
Congressional intent and enable information flow that will help respond
to attacks, mitigate the damage and, above all, prevent a recurrence.
And, as mentioned earlier, the proposal to merge the watch
functions of the NCS into NCSO, and create a single, industry-supported
watch effort that covers traditional and IP-based assets is clearly a
beneficial way to manage the monitoring of network exploits. However,
cyber-security is not the sole mission of the National Communications
System. Executive Order (EO) 12472 assigns the NCS with support for
critical communications of the President and government including, the
National Security Council, the Director of the Office of Science and
Technology Policy and the Director of the Office of Management and
Budget. The NCS was established by EO 12472 as a Federal interagency
group assigned national security and emergency preparedness (NS/EP)
telecommunications responsibilities throughout the full spectrum of
emergencies--disaster and warfare as well as cyber attacks. These
responsibilities include planning for, developing, and implementing
enhancements to the national telecommunications infrastructure to
achieve improvements in survivability, interoperability, and
operational effectiveness under all conditions and seeking greater
effectiveness in managing and using national telecommunication
resources to support the Government during any emergency. While this
mission does cover the spectrum of cyber-security issues, there is more
to the legacy role of the NCS that must not be forgotten or overlooked
and from which the NCSO can learn as these functions move forward
together.
A key issue is missing from HR. 285, however. Funding for
cybersecurity research and development is essential. The Director of
the U.K.'s equivalent agency, the NISCC, observed recently that the
U.K. alone last year spent 3 times as much on cyber R&D in 2004 as the
$68 million spent by the Department and the National Academy's ``cyber
trust'' programs to fund private sector cyber R&D. The United States
should not be taking a second place position in the funding of
cybersecurity research. While we are benefited by the many investments
being made by intelligence and defense agencies that do not appear on
such comparative scorecards, R&D to support improved security for the
majority privately-held network assets must continue and must grow. In
a tech industry where 2-3 percent is not an unusual R&D budget, the FY
2004 $68 million number is an amount you would expect one $2 billion
cyber company to spend on R&D, not the entire government of the country
that invented the technology.
We are increasingly seeing the solutions for improved security
originating from research outside the United States, with outside
investment and ownership in the solutions. Unless the U.S. commits to
self-defense, funding the research locally at our universities that
will produce solutions to secure our nation's economic infrastructure,
we run the risk of having our security developed and managed by others
than Americans--and that could be a fragile policy both economically
and from the perspective of homeland security. We must figure out a way
to invest more to match the clever advances being made by the
terrorists who WILL attack these networks.
Finally, let me cite three examples of marketplace incentives that
IS Alliance believe promote improved cybersecurity investment by
industry: The ISAlliance, together with AIG, have agreed on a program
wherein if member companies comply with our published best practices
they will be eligible to receive up to 15 percent off their cyber
insurance premiums. Visa, another ISAlliance member company, has
developed its KISP program which again uses market entry, in this case
the ability of commercial vendors to use the Visa card, as a motivator
to adopt cybersecurity best practices. And the IS Alliance has recently
launched its Wholesale Membership Program which allows small companies
access to IS Alliance services at virtually no cost, provided their
trade associations also comply with IS Alliance criteria.
There is also a role for the government to play in promoting
industry cyber security; government should be a critical partner if
incentive programs will have their maximum impact. Examples of critical
incentive programs include the need to motivate and enhance the
insurance industry participation in offering insurance for cyber-
security risks, where AIG has been a leader, and the creation of
private sector certification programs such as those provided by Visa in
its Digital Dozen program. These and several other government incentive
programs were highlighted last year in the report of the Corporate
Information Security Working Group on Incentives which we commend to
the Committee for its consideration.
In summary. Mr. Chairman, the challenge of America's--and the rest
of the Internet-dependant world's security organizations--like the
Department's is threefold:
First, DHS and other government cyber agencies need to understand
the architecture of the network today and to recognize its ever-growing
diversity and complexity;
Second, cybersecurity agencies need to collaborate with the
industries that operate most of these network assets and exchange and
understand the information exchanged with industry (including employing
the best engineering talent available); and
Third, the cybersecurity agencies here and around the world need to
cooperate to respond to threats and attacks against our cyber
infrastructure rapidly and effectively.
Mr. Chairman, H.R. 285 moves the Department of Homeland Security in
the direction of addressing these three challenges. It is especially
helpful simply because it applies more attention to cyber security.
ISAlliance members want to work with the Committee and the Department
to assure that the good intentions expressed in this document become a
reality that strengthens America's ability to prevent attacks against
our networks and to make them strong enough to withstand any attacks
that do come our way.
I appreciate the opportunity to bring our views before you today,
and I am happy take any questions you may have.
Mr. Lungren. I thank all of you for your testimony. I would
just like to ask a question of all of you, and that is it is
premised on the fact that this hearing, while it is a hearing
on a particular bill, is actually part of oversight in a sense.
If we didn't think we needed a bill like this, we wouldn't be
doing it for a position there.
So I would ask this, and I would just go down right to
left, starting with Mr. Silva, and asking each of you, do you
believe there is a sense of urgency to pass this bill so that
it prods DHS to do what everyone seems to suggest we want DHS
to be doing? Mr. Silva?
Mr. Silva. Well, Mr. Chairman, I think that the sooner we
start, if you will, getting on the ball with the cybersecurity
issues, I think the better. Decisions around this have sort of
floundered for long enough. The longer we wait, the longer this
is going to linger as an issue and potentially lose interest. I
think the sooner you could get this passed, I think it will
express to the Department how urgent you feel this issue is.
With our support, I think we will also reinforce that as well.
Mr. Lungren. Ms. Allen.
Ms. Allen. Yes. I do think there is a sense of urgency,
first of all because of the escalation of attacks that are
occurring; secondly, because we need leadership from the
government; and, thirdly, I think, as said before, we have the
potential of having a digital Pearl Harbor, and we want to
avoid that.
Mr. Lungren. Mr. Kurtz. Everybody trying to share a
computer monitor.
Mr. Kurtz. Yes. Simply stated, I think it is urgent that we
seek passage of this. It has been 2 years since the National
Strategy was issued. We have a crisis of organization and
prioritization at DHS with regard to cybersecurity, and it
would be nice if we could do this and not have to learn the
hard way.
Having an assistant secretary will help develop those
programs and plans and the communications issues in order for
us, when we have an eventual attack, work out of it more
cleanly than we are in a position now.
Mr. Lungren. Thank you.
Mr. Miller.
Mr. Miller. Yes.
Mr. Lungren. Thank you.
Mr. Yoran.
Mr. Yoran. I am a cybersecurity strategist and operator.
Just to point out the obvious, I am not particularly well
versed in legislative process or motive. All of the fundamental
concepts represented in this bill are well informed and
constructive, and should be dealt with with the sense of
urgency that they deserve.
Mr. Lungren. Well, let me ask you this. From your
testimony, it doesn't sound to me like you think that it is
right now receiving, that is the issue of cybersecurity, the
kind of urgency, the kind of priority that is necessary. Would
that be a correct characterization of your feeling?
Mr. Yoran. I would say that the threat against our Nation
and our Nation's vulnerability to cyberattacks is increasing at
a rate that is faster than the problem is being dealt with.
Mr. Lungren. Let me ask you this then, Mr. Yoran. If I were
to ask you what the top three priorities would be, if we were
to establish an Assistant Secretary of Cybersecurity, what
would you say they would be; the most important priorities that
we need right now to address from the standpoint of DHS, and,
if this law passes, within the personification of this person
as Assistant Secretary For Cybersecurity?
Mr. Yoran. Mr. Chairman, I believe that the single top
priority for an assistant secretary, should one be created,
would be to refine the Department's mission statement around
the area of cybersecurity to go beyond the National Strategy
and get to more specificity around what activities are under
way within the Department, and also to point government
counterparts as well as private sector counterparts to other
components of the Federal Government which are playing an
active role in our Nation's defense from cybersecurity threats.
So that single top priority would be to refine the mission
statement.
The second would be to integrate cybersecurity activities
and priorities into and across all of the various programs of
the Department of Homeland Security and across the Federal
Government. So to the extent that cybersecurity and physical
security risks have not been fully integrated and fully brought
to the table to address vulnerabilities which may exist, I
think that would be a top--a second priority for an assistant
secretary.
The third would be in the area of resource allocation, once
the mission definition has been refined; once more active
participation has been integrated into various protection
programs of the Department and across the Federal Government,
to look at the resource allocation challenges and determine if
the resources are sufficient for dealing with the refined
mission and requirements.
Mr. Lungren. Thank you. My 5 minutes are up.
So Ms. Sanchez is recognized for 5 minutes of questions.
Ms. Sanchez. Thank you, Mr. Chairman, and thank you all for
testifying once again.
I actually think that the whole arena of cybersecurity is
so large and so vast and with so many things being so
interconnected that it is just an incredibly overwhelming job.
I represent Newport Beach, Santa Ana, Irvine area in Orange
County, which, you know, is one of the top places for white-
collar crime, most of it involving either telephone or
computer. So it is just so overwhelming when my law enforcement
officials tell me about all the scams that go on and the way
that people get taken.
My question is about the identity theft that is going on
in, like, for example, the ChoicePoint situation that we
recently had. What do you think that a new Assistant Secretary
of Cybersecurity should do or can begin to do to address some
of these just large databases that exist that can be either
broken into or that you can pay $9.95 and find out everything
you ever wanted to know about Loretta Sanchez, including her
Social Security number, bank account and name of her kitty cat,
et cetera? What are we going to do about that? Do you have any
suggestions? I think that is just one of the scariest things
that I see out there on the horizon for us. Any of you have any
ideas on that?
Mr. Miller. I think, Congresswoman, you have addressed a
critical point. I think this is an example, again, where the
assistant secretary position would make a difference, because
what you are in need of is partnership between government and
industry; having an assistant secretary there to work with the
Treasury Department, with organizations like Ms. Allen's
organization and others in the financial services industry and
others to come up with an aggressive process that protects
these data better, protects the citizens and the consumers
whose data are at risk without harming electronic commerce,
without making electronic transactions impossible to actually
conduct.
Having someone at the assistant secretary level could
convene a meeting along with his level, along with his or her
colleagues and the other relevant agencies, as well as the
Federal Trade Commission and Department of Treasury. But again,
it is very hard to do that. It is very hard to have someone who
is the head of the division to have internal clout to bring all
the parties together and/or, frankly, to bring all the members
of the industry together. So by passing this legislation that
has been crafted by Congresswoman Lofgren and Mr. Thornberry,
then you get the kind of clout you need to make these
partnerships happen.
Ms. Sanchez. Thank you.
Anybody else on that?
Mr. Kurtz. I will expand briefly on what Harris has
described. I think a lot of this comes down to leadership and
having that focal point within the Department that other
agencies can look at across the Federal Government, as well as
individuals in the private sector. And that is absent now. That
is why we have this drift.
Now, is the Department of Homeland Security ultimately
responsible for removing all spyware or stopping all phishing
and stopping all data warehouse issues? I would argue, frankly,
no, at the end of the day. They have a leadership role, but
that is largely the responsibility of the private sector. But,
nonetheless, we need that focal point and leader within a
department that people can turn to to pull together that
overall strategy.
I would contend that the key priorities for the Department
remain identifying that critical infrastructure that is so
important to our economic and national security and working on
communications, contingency plans, recovery plans. That is
consistent with the mission of the Department; and that, to me,
is what is absent today at the Department of Homeland Security.
Ms. Allen. I would just say I think there is a role for the
DHS to play. Certainly on the identity theft issue, just as you
said, it is a very complex issue. That is a crime that comes
out of software vulnerabilities. It is a crime that comes out
of processes that may be lax. It is something that is just not
a financial services issue. And certainly our regulators are
very active and very strongly supporting those kinds of
processes and technology changes that will help address some of
the issues.
The problem is the data is out there. You can go on the
Internet in a very short period of time and find out everything
that you need to know about you. So the Internet has
exacerbated the problem by making it easier to pull this
information together. So it is a combination of educating,
preparing people and consumers and businesses to understand
what these threats are and how to prevent them from either a
process or a technology point of view. It is a point of going
after the software vulnerabilities and encouraging the
providers of IT to close those gaps. It is an issue of best
practices and policies that can be instituted in all kinds of
institutions. And, most important, it is support of law
enforcement, the people that are talking to you, letting them
have both the knowledge and the resources to go after these
fraudsters.
Ms. Sanchez. Thank you.
Thank you, Mr. Chairman, for the time. I appreciate it.
Mr. Lungren. Thank you.
And now the Chair recognizes the Chairman of the full
committee, Mr. Cox.
Mr. Cox. I thank the Chairman.
I want to thank, once again, each of our witnesses for your
outstanding presentations.
I want to ask about the National Computer Security Division
and ask you whether or not you agree or disagree with the
position of the previous assistant secretary of homeland
security for information analysis and infrastructure
protection, who told us that keeping the National Computer
Security Division under the assistant secretary for
infrastructure protection was the correct thing to do. In the
assistant secretary's view, its placement there allowed better
integration of efforts to protect critical infrastructure from
both physical and cyberthreats.
Do you agree or disagree with this position and why? And
can you also add to that whether you see any ways to address
perceived problems with integration? And, finally, could that
integration occur at a higher level?
Yes, Mr. Kurtz.
Mr. Kurtz. I would respectfully disagree with the previous
assistant secretary. I think the elegance of the bill that has
been put together is that you don't lose the integration in
what has been proposed. Under the bill, you have created a new
assistant secretary that focuses on cybersecurity who works
alongside an assistant secretary who presumably is working on
physical security, and you have your information analysis
assistant secretary working there as well. So you have three
assistant secretaries working under an under secretary, and the
under secretary can work to integrate programs and policies as
appropriate.
So I think, you know, in my written remarks, in my oral
remarks, I also think there is a fundamental misunderstanding
of how we defend information networks versus physical assets
which we require a different set of skill set. It is far more
complex, I would argue, than securing a physical
infrastructure. So I would--.
Mr. Cox. And are you of the view that NCS would come under
the new assistant secretary?
Mr. Kurtz. Most definitely, especially with the integration
voice and data networks. I think it would be a mistake to leave
the NCS out to the side.
I would note that when we talk about priority
communications, which are the responsibility of the NCS, if you
were to set that to the side in a VOIP environment, it would be
very difficult and cumbersome to coordinate downstream. You
need to--we need to recognize the confluence of telecom and IP
networks and have the leadership in place to take care of it.
Ms. Allen. I would respectfully disagree, also. The reason
is it is a different skill set in cybersecurity; and it is much
more complex, as Paul mentioned, to understand the
cybersecurity issues. And in a way the model of how the public-
private sector works together is one of cooperation and
collaboration. I don't see why that can't occur within the
Department of Homeland Security; and I think it would be
important for Congress to reward success in collaboration and
problem solving and working together, as opposed to having silo
approaches.
Lastly, let me address--the NCS I think is a fabulous
organization. BITS has worked very closely with them on the
telecom redundancy and diversity issues. They have been a key
player in addressing some of the problems that we had after 9/
11 with the business continuity issues, with the telecom
industry, and I think they belong under the cybersecurity
arena.
Mr. Cox. Mr. Miller.
Mr. Miller. Mr. Cox, the other point I would add, I totally
agree with my colleagues, with all due respect to the former
assistant secretary's view. But in addition why this is so
important is the reason that Ms. Allen brought up so eloquently
in her testimony is the cross-sectorial work. Not having an
assistant secretary to bring the other government agencies
together and get them to focus more on cyber in addition to
physical is a problem.
Until yesterday, when my tenure ended, I spent the last 16
months chairing the Partnership For Critical Infrastructure
Security, which is an organization of private sector
representatives of each of the critical sectors. Until I
brought Mr. Yoran to speak before them about a year and a half
ago at one of our meetings, many of those other sectors had
never even thought about the cyber issue, Ms. Allen's
organization's being a great exception, because financial
services does and telecommunications does, but many of the
other sectors hadn't even thought about these issues. And the
government agencies with which they liaise, Mr. Chairman, a lot
of them don't have expertise internally. Having an assistant
secretary at the Department of Homeland Security can help the
other agencies do a better job in terms of working with these
other critical sectors.
Mr. Cox. I just want to note, Mr. Chairman, that the
legislation that is before us would in fact give the assistant
secretary primary authority within the Department over the
National Communications System.
My time has expired.
Mr. Lungren. I thank you.
The Chair now recognizes the ranking member of the full
committee, Mr. Thompson.
Mr. Thompson. Thank you, Mr. Chairman; I have an opening
statement that I want to include in the record, rather, now at
this time.
[The statement of Mr. Thompson follows:]
Prepared Statement of the Honorable Bennie Thompson, Ranking Member,
Committee on Homeland Security
Thank you Mr. Chairman, Ranking Member Sanchez. I am glad we are
here today to consider this important legislation.
H.R. 285 is an important step in fixing a very big problem at the
Department of Homeland Security. It is clear from the Department's
actions over the past two years that it does not consider cybersecurity
to be an important issue.
For example, the last Director of the National Cybersecurity
Division, Mr. Amit Yoran who is with us today, left last Fall ? and the
Department has still made no attempt to identify a replacement.
In addition, the Department has moved slowly, if at all, to
implement the goals set out in the National Strategy to Secure
Cyberspace.
This inaction is inexcusable. Cybersecurity is about more than just
the world of computers and hackers. In the 21st century, the prosperity
of each and every American is dependent in one way or another on
information technology, and those systems must be protected against
breaches like the ones experienced by LexisNexis or ChoicePoint.
Vital assets such as the electric power grid, gas pipelines,
nuclear power plants, and our air traffic control systems rely on the
cyber infrastructure for operation. This is also true of vital
government and military systems. With the ever-changing threats facing
our cyber infrastructure, time is of the essence.
It is hard for me to understand how the Administration can be so
reluctant on this issue, given the overwhelming support by the private
sector, our colleagues across the aisle, and the Democrats in Congress.
Today, as we hear from the private sector, I hope to hear
suggestions as to how the Department of Homeland Security can improve
its strategy, management skills, and resource allocation to get the job
done.
We also need to know whether, from your perspective, you think that
the government is living up to its obligation in this public-private
partnership. Is there someone in the government devoting 24-hours a
day, 7 days a week to cybersecurity? If a cyberattack were to happen
today, would we be ready for it?
When it comes to ensuring cybersecurity, I believe that government
and industry must work together closely, and that this effort requires
attention at the highest level in both the public and private sectors.
We can develop a culture of security within our computer networks
and ensure our national security. But first, we must have effective
leadership on cybersecurity issues at the Department and we must have
that leadership now.
That is why I urge my colleagues, during the markup of H.R. 285
later today, to vote for this critical legislation. Thank you.
Mr. Thompson. Let me first compliment and congratulate Mr.
Silva for his promotion. We all could benefit from such lofty
movement. Congratulations.
And I want to compliment Ms. Lofgren and Mr. Thornberry for
this bill. It is a wonderful bill. We have tried for a while to
make it happen. There is no question about the fact that we
need to elevate the position. In Washington, unless you are at
a certain level, people don't pay you much attention. I think
clearly the issue of cybersecurity has not been given the level
of attention that it should have, and hopefully we will correct
it.
With respect to merging cyber and physical infrastructure,
is that something that individually you all see as something
that is very positive for what is going on, or how do you see
those two issues?
Mr. Silva. I think we can't overlook the need to have at
least close collaboration between the physical and the cyber
side. I think, as my colleagues have already pointed out, there
are clearly different disciplines there, but to spin cyber
separate from physical I think would probably--I think what we
don't want to do is we don't want to create too much of a
disconnect between those two, because there is a relationship
between the physical and the cyber, and I think it shouldn't be
ignored. As we said in our testimony, or as I said in my
testimony, it is very important that the leaders of both of
those organizations, physical and cyber, be empowered
individuals and be able to work closely together and coordinate
their efforts in such a way that we don't sacrifice one for the
other.
Mr. Thompson. Ms. Allen.
Ms. Allen. I think that there is an interdependency.
Certainly, the systems that run much of our critical
infrastructure are run off the same operating system that the
financial services runs, that the first responders run. So we
have to understand the interdependency that our industries, the
physical industries have on the IT industry, the software
operating systems, on the telecommunications and the power
industries. Because if they are down or if there is a cascading
effect of them being down, our physical structures as well as
our cyberstructures are going to be--we will not be able to
communicate. So I do think there need to be separate assistant
secretary level positions, but I do think there needs to be the
collaboration and cooperation in addressing the issues.
Mr. Kurtz. I would essentially agree with what Cathy has
just pointed out. I think there is--if you pictured a physical
infrastructure in one circle and the cyberinfrastructure in
another, there is certainly some overlap between the two. But
the disciplines through which you use to protract those
infrastructures, to defend those infrastructures are very
different. So, on the whole, yeah, there needs to be that
integration under an under secretary type individual, but there
is different disciplines involved in protection and defense.
Mr. Yoran. Sir, I would point out that, just as battle
plans may include elements of air power, armor, sea power,
intelligence, similarly we need integrated risk management
practices. But all of those disciplines are highly specialized
in and of themselves and need to remain specialized in order to
be effective.
I would also--if I could just take a second or two to
answer the previous question with a slightly different
perspective, and that is it may have been possible that at the
initial phases of the National Cyber Security Division it was a
more effective strategy to make it part of infrastructure
protection. Simply put, there was no organization. It was a
from-ground-zero startup. We had to go in and recruit the
individuals, and having a larger organization to participate in
may have facilitated some growth and enabled us to build and
accomplish what we were able to accomplish.
As Secretary Chertoff moves into his second stage review, I
would say we also need to look at how in the current
environment, not with legacy perspectives, we can integrate our
cybercapabilities into a holistic risk management practice.
This means having cybersecurity at the table along with
physical security and participating in the grant programs, the
emergency planning and readiness programs, the Office of
Domestic Preparedness, and State and local programs across the
Department and, just as importantly, alongside other
departments and agencies. Many of the issues and challenges
mentioned earlier by my counterparts include many policy
coordination roles in which the FDC, the Department of State,
the Department of Justice, and Commerce have a primary
regulatory or significant stake.
Mr. Lungren. Thank you very much.
The gentleman Mr. Pearce is recognized.
Mr. Pearce. Thank you, Mr. Chairman.
Ms. Allen, you had stated that investor confidence and
reliability of information systems are linked to the security
and reliability. What countries are excelling in that
particular relationship today, in security and reliability?
Ms. Allen. Well, the U.S. has the leadership. Even though
we have headlines about breaches or problems that we have with
cybersecurity, the U.S. has the most sophisticated people in
terms of information security and IT. So if you look at best
practices or you look at the development of software, anti-
intrusion software or other types of software that help to
prevent or identify breaches, it is mostly U.S. based.
Mr. Pearce. Also, it would be useful to know, if I were to
look at the nearest competition, how many laps behind us are
they? Are they catching up, or is the rest of the world moving?
Because as we look at the flows of financial capital, this is
going to be the determining factor.
Ms. Allen. That is right. In the U.S., we fortunately have
a good reputation in terms of the--and because of all the
regulation that we have of the financial community and the
economic system; and I think we will continue to enjoy that.
The U.S. is light years ahead of regulators in other countries
around regulating us against or for information security,
information technology, all of the issues that help us to
provide safety and soundness. So we are far ahead of any other
country in that area.
There are other countries, however, that have the
leadership role, so to speak, in the bad guys, the hackers and
the countries where the ISPs, the Internet service providers,
are not regulated or there is not oversight.
So I think we have a challenge in the U.S. to not only
maintain leadership to maintain our economic livelihood, but we
also have a challenge to help bring the other regulators and
the other countries up to speed on these issues, and to help--
to cooperate with them to go after the fraudsters and the
hackers and the criminals.
Mr. Pearce. Sure. Actually, the flows of financial capital
have actually disciplined them very well. I am not so concerned
that we bring them up, because simply the evaporation of
capital from them as they fail to do their own internal
strengthening is going to accomplish that. And we saw that even
in the recent trip to South America and to some of the
countries that have turned sharply to the left. Their political
climate shifted to the left, but their business advisers, their
economic advisers stayed solidly in the business sector. And
that is with realization that we can talk what we want to in
politics, but we had better keep our financial house moving
forward.
You talked somewhat in your written testimony about market
incentives, and I have got one more question for Mr. Silva. So
if you could give me a very brief description of the market
incentives that you see available for these functions.
Ms. Allen. I think both R&D dollars that could help to
encourage the development of technologies. Because, in the end,
we are going to have to address this partially as a
technological issue, the ability to have software that will
counteract what is happening.
I think a second is tax incentives to build the critical
infrastructures. Again, I come back to the telecommunications
industry as one where we are all reliant on their diversity and
resiliency, and we need--they are in dire need of help to
develop that capability.
Mr. Pearce. Thank you.
Mr. Silva, you talk about the essential information sharing
and the fact that it has been hindered by the complex
bureaucratic structure that mostly is worried about protecting
people from lawsuits. How can we basically see that the new
structure is free from those constraints?
Mr. Silva. I think that particularly--some of this had been
addressed a couple of years ago with some of the protections
for FOIA protection and some other areas. But the problem is
that when organizations want to share information with the
government, the government either has to make it available to
all of them or, if it chooses to provide that information only
to a select few, then there are going to be issues that arise
from that.
I mean, there are so many different organizations; and what
tends to happen is when the information--whenever we create a
new sharing relationship with an organization that seems to be
at the exclusion of the other organizations--and this is very
confusing to the various organizations. In fact, if you want to
have your bases covered, you have to sort of join every
organization to make sure that you are covered, and it is quite
confusing. If the Department can establish a unified policy of
sharing across the board with all of the organizations that are
relevant, then I think that would go a long ways to solving
that problem.
Mr. Pearce. Thank you. Thank you, Mr. Chairman.
Mr. Lungren. The gentlelady from California, Ms. Lofgren.
Ms. Lofgren. Thank you, Mr. Chairman. And I will be brief
because I think the witnesses have covered the issues very well
and thoroughly.
I would just note, as I said in my opening statement, that
the staff on the subcommittee in the last Congress worked very
hard and together. I mentioned Mr. Thornberry's excellent
staff; and I see that Jessica Herrera who was his Democratic
staffer, has also came. She also did a fabulous job, and I
would like to publicly add my thanks to her along with Mr.
Thornberry's staff.
As some of the witnesses have mentioned, there is much to
do, I mean, from identifying and prioritizing the critical
infrastructure in the cyberspace, to increased funding, to
implementing the strategy. I mean, we are behind where we
should be as a nation. And this bill alone doesn't solve that
problem. What it does is set the stage to solve that problem, I
believe.
We in the Congress cannot do the hire for this position.
That would be inappropriate. But I think that we will give the
Department an essential tool to recruit an excellent person,
because the assistant secretary will have the clout and the
prestige and the authority to actually get the job done. I
think that has been a frustration for those in the Department
who have worked hard and who are smart people and who are
skillful, but they haven't really had the ability to use their
talents to move the country forward in a way that is so
important.
Mr. Thornberry and I, at the end of the last Congress in
December, issued a report of the activities and findings of the
cybersecurity subcommittee, and I think some of the issues
raised here today are really covered in that report in the to
do list. I am hopeful that this subcommittee, although we have
a very wide range of responsibilities, that we will have the
time to schedule some hearings and some oversight on the
elements that Mr. Thornberry and I identified in the last
Congress.
The General Accounting Office is coming back with reports
to us on some of the issues. One I think has just been received
in draft form, and we will be receiving another. They are very
helpful. We know that we need to pay some attention to whether
or not we need to act to provide incentives for market
solutions. I mean, there are differences of opinion that are
valid, but we need--we have not seen the market move forward in
the way that we had expected. I think we need to explore why
that has happened and whether there is anything we can or
should do about that.
The one thing we do know is that we don't want a heavy
legislative regulatory approach to this, because our lawmaking
will never catch up with the code writers. I mean, we really
need to use market incentives in the leadership of the Federal
Government in ways that are successful.
There isn't enough time to really go through how much needs
to be done. In addition to the reach efforts that have been
mentioned here, I am very grateful to NSF for stepping up to
the bat, but clearly there are things that the Department needs
to do. So I am pleased to be here today. I look forward to the
markup later today, and I would yield back the balance of my
time with thanks, Mr. Chairman.
Mr. Lungren. Thank you very much.
Mr. Jindal.
Mr. Jindal. I have two quick questions. The first was
regarding--Ms. Allen talked about the international
marketplace, international response to the issue of
cyberterrorism. I am wondering, is there a need for more
coordinated international response given the fact that maybe
attacks may be launched abroad because of the lack of
protection overseas? Is there more that could be done? Or what
can be done?
And the second question--I will go ahead and ask both my
questions, also building on this question, about the legal
liability. My question was, how is the insurance industry
responding to this? Have they created products for the private
sector to insure against these kinds of risks? If they haven't,
what can we do to help integration of those products?
Ms. Allen. I am going to answer both quickly, and I am
going to defer to Paul on one of the issues of what we can do
on an international basis.
The answer is, yes, there is much more that we need to do
on an international basis, not only cooperation with the laws
but also with law enforcement. Most of the phishing attacks
that occur in the U.S. are launched from overseas. Most of the
phishing attacks that come from the U.S. are launched on
overseas institutions, and we have got to cooperate and try to
shut down these fraudsters. So it is a higher level of
cooperation; and I know Paul will tell you exactly, or at least
one way to do that.
Secondly, on your question on market incentives. Yes, the
insurance industry is developing products that will help to
ensure best practices or appropriate behaviors of institutions,
not just financial institutions, but all institutions,
practices in cybersecurity. I think most of you know, on the
legal liability side, the financial institutions are by law
required to make all customers whole if there is any problem in
an electronic delivery or an electronic transaction. Not all
other countries have that same restriction. So it is also one
of the things that makes us a target for potential fraud. There
is much to do here, but we are looking at market incentives
from the insurance industry to help move companies along.
Mr. Jindal. Thank you.
Mr. Silva. So, while I have the mike on my end, actually,
some of the insurance companies have started market incentives
already. In fact, AIG, which is one of our member companies,
actually offers discounts to companies that adhere to a set of
best practices. Now, while this is certainly not an end all to
everything, I think it is an example of a market incentive
which has a very positive effect and I think offers a
reasonable reward to companies that are willing to take the
steps. So I think that it is just starting. It is just
starting.
Mr. Miller. On the international, just coincidentally this
week there is actually a meeting going on in Delhi between
officials of the U.S. government, the Indian government, the
U.S. IT industry, the U.S. financial services industry, and the
industry of India, because India has become such a destination
for so much offshore work.
But I would certainly agree, we are really in the infancy
in the international cooperation. In addition to my chairing
the U.S. IT association, I chair an international organization
which is 65 countries. I spend a lot of time traveling around
the world. And this issue simply hasn't raised itself at a
higher level in other countries.
In the IT industry, and most customers, as Ms. Allen said
in an earlier response to Mr. Pearce's question, certainly in
the financial services industry, the U.S. is far ahead.
And, again, while the DHS has domestic responsibility, I
would contend that having an assistant secretary--to come back
to the purpose of the hearing--would help to elevate the issue.
The State Department is doing some good work in holding
bilateral meetings with other countries around the world. The
Department of Justice, the Cyber Crime Division, has been doing
some work with the G8 and other countries. But I think having
someone at DHS at a higher position would help the
internationalization of the need to collaborate on these
issues.
Mr. Kurtz. I will just expand on what has been said.
I worked a lot on international issues when I was at the
White House and did some of the initial trips at India and
other places to foster international cooperation. At the time,
we had a good pedestal to stand on. We had a national
cybersecurity czar. We had a special adviser to the President.
We don't have that now. It is hard for us to make the point to
other countries that they need to organize and react when we
ourselves are not in the position we used to be. This is where
I go to Harris's point. Having an assistant secretary would
help us in this space.
Second point, the Council of Europe Convention on Cyber
Crime, negotiated under President Clinton, signed under
President Bush, it is in with the Senate. We would urge
ratification of the Council of Europe Convention on Cyber
Crime. I believe Business Software Alliance, ITAA, BITS, and a
few other organizations have come together to say, to urge for
ratification of this convention. What will that do? It will put
in place that global framework for us to go afterSec. excuse
me, for law enforcement to go after and prosecute
cybercriminals abroad. We don't have that framework now.
Finally, on the insurance question. There is insurance out
there. I think the problem has been there is no actuarial data
available, or very little, which means there needs to be some
sort of best practice or standard put in place. And I think
until we have that best practice or standard in place that can
be more widely adopted, we aren't going to see the insurance
industry be all it can be, if you will, in that space.
Mr. Jindal. Thank you.
Mr. Lungren. The gentleman's time has expired.
We thank all the panelists, all the witnesses for their
valuable testimony and the members for their questions. Members
of the committee may have some additional questions for the
witnesses, and they may submit them in writing to you. We would
ask you to respond to them, if you can.
The hearing record will be held open for 10 days.
The subcommittee stands adjourned. We are going to be
meeting at 2:00 for markup on this. Thank you very much.
[Whereupon, at 12:36 p.m., the subcommittee was adjourned.]
A P P E N D I X
Material Submitted For the Record
Questions Submitted by the Honorable James R. Langevin for Catherine A.
Allen
Question 1: One thing I have heard consistently over the past two
years is that government regulation is the wrong way to bolster cyber
security. The argument is that the government cannot move nearly as
rapidly as market forces where it comes to information systems and
security. Best practices are frequently used to demonstrate how the
private sector is working to encourage a culture of security, except
that it seems they are not updated as often as may be needed. This begs
the question of whether these should be standardized by a group like
NIST or not. I would like the panel's honest assessment of what the
government's role in cybersecurity.
Answer 1: Financial institutions are heavily regulated and actively
supervised at the federal level by the Federal Reserve, Federal Deposit
Insurance Corporation, Office of the Comptroller of Currency, Office of
Thrift Supervision, National Credit Union Administration, and the
Securities and Exchange Commission and at the state level by numerous
state banking and insurance commissioners. In recent years, these
regulators have stepped up their oversight on business continuity,
information security, third party service providers, and critical
infrastructure protection. The financial services industry is working
consistently and diligently to comply with new regulations and ongoing
examinations. In addition, BITS and other industry associations have
developed and disseminated voluntary guidelines and best practices as
part of a coordinated effort to strengthen all critical players in the
financial sector.
The financial services industry has been aggressive in its efforts
to strengthen cyber security. We are sharing information, analyzing
threats, urging the software and technology companies to do more to
provide more secure products and services, and to combat fraud and
identity theft.
Regardless of how well financial institutions respond to
regulations, we simply cannot address these problems alone. Our
partners in other critical industry sectors--particularly the
telecommunications and software industries which are not regulated from
a safety and soundness or data protection perspective--must do their
fair share to ensure the soundness of our nation's critical
infrastructure.
Our nation's economic and national security relies on the security,
reliability, recoverability, continuity, and maintenance of information
systems. IT security has a direct and profound impact on the government
and private sectors, and the nation's critical infrastructure. Further,
the security and reliability of information systems is increasingly
linked to consumer and investor confidence. In recent years, members of
the user community that rely on technology provided by the IT
industry--private-sector companies, universities and government
agencies--are demanding greater accountability for the security of IT
products and services.
The federal government can play an important role in protecting the
nation's IT assets. The following are seven key elements that the U.S.
government should support to secure information technology. I refer to
these as PREPARE, which is an acronym based on the first letter of each
element.
Promote. Government can play an important role in promoting the
importance of secure information technology. Also, government should do
more to facilitate collaboration among critical infrastructure sectors
and government. Some sectors, such as financial services, are heavily
regulated and supervised to ensure that customer information is
protected and that financial institutions operate in a safe and sound
manner. Examples of actions the government can take include:
Government should lead by example by ensuring that the
issue of cyber security receives adequate attention in the
Department of Homeland Security. Today, cyber security is
handled at a level far below where most corporations handle
these issues. Congress could create a more senior-level policy
level position within DHS to address cyber security issues and
concerns and ensure that adequate funding is provided.
Strengthen information sharing coordination
mechanisms, such as the Information Sharing and Analysis
Centers (ISACs), by ensuring adequate funding is made available
to Federal agencies sponsoring such organizations. Information
sharing and trend analysis within a sector is essential to
protecting information security and responding to events.
Information sharing among sectors is equally important as cyber
threats sometimes reach some sectors before others.
Create an emergency communication and reconstitution
system in the event of a major cyber attack or disruption of
information networks. Such an attack or disruption could
potentially cripple many of the primary communication channels.
To allow maximum efficiency of information dissemination to key
individuals in such an event, a thorough and systematic plan
should be in place. The financial services industry has
developed such a plan for industry-specific events in the BITS/
FSR Crisis Communicator. Other organizations have developed
similar communication mechanisms. These emergency
communications programs should be examined as potential models
for a national cyber security emergency communication system.
Reform of the Common Criteria/National Information
Assurance Partnership (NIAP). The current software
certification process is costly, inefficient, used on a limited
basis by the Federal government, and virtually unknown to the
private sector. NIAP should be reformed so that it is more cost
effective for vendors to seek certification while ensuring
consistent Federal procurement practices and expanded
commercial adoption of NIAP-certified products. The BITS
Product Certification Program may well be able to serve as a
model.
Responsibility. Government should promote shared responsibility
between suppliers and end users for developing, deploying, and
maintaining secure information networks. Government can play an
important role in establishing incentives and making producers of
software and hardware accountable for the quality of their products.
Examples of actions the government can take include:
Provide tax or other incentives for achieving higher
levels of Common Criteria certification. Incremented incentives
would help to compensate companies for the time and cost of
certification. This should encourage certification and increase
the overall security of hardware and software.
Provide tax or other incentives for certification of
revised or updated versions of previously certified software.
Under Common Criteria, certification of updated versions is
costly and time consuming. Incentives are necessary to ensure
that all software is tested for security
Require software providers to immediately notify ISACs
of newly discovered cyber threats and to provide updated
information on such threats until an effective patch is
provided. It is vital that critical infrastructure companies
receive immediate notice of serious vulnerabilities.
Establish requirements that improve the patch-
management process to make it more secure and efficient and
less costly to organizations.
Educate. Communicate to all users of information technology the
importance of safe practices. Public confidence in e-commerce and e-
government is threatened by malicious code vulnerabilities, online
fraud, phishing, spam, spyware, etc. Ensuring that users (home users,
businesses of all sizes, and government) are aware of the risks and
take appropriate precautions is an important role for government and
the private sector. Examples of actions the government can take
include:
Fund joint FTC/DHS consumer cyber security awareness
campaign. The FTC should focus its efforts on building consumer
awareness, and DHS should coordinate more detailed technical
education regarding specific serious threats. In addition,
government employees should be trained in proper cyber safety
measures.
Train government employees on proper cyber security
measures.
Educate corporate executives and officers regarding
their duties under Sarbanes-Oxley, GLBA, and HIPAA as they
relate to cyber security.
Procure. Using its purchasing power and leveraging security
requirements and best practices developed by the public and private
sectors, government can play an important role in encouraging the IT
industry to deliver and implement more secure systems. Examples of
actions the government can take include:
Require high levels of cyber security in software
purchased by the government through procurement procedures.
Extend such requirements to software used by government
contractors, subcontractors, and suppliers.
Provide NIST with adequate resources to develop
minimum cyber security requirements for government procurement.
NIST should include software developers and other stakeholders
in the standard-creation process.
Analyze. Government should collect information and analyze the
costs and impact of information security risks, vulnerabilities and
threats and provide this analysis to policy makers. Examples of actions
the government can take include:
Assign to the Commerce Department or another
appropriate agency the responsibility of tracking and reporting
such costs and their impact on the economy. Measuring and
making these costs transparent will aid law makers and
regulators as they assign resources to cyber security programs.
Research. Government can play an important role in funding R&D in
the development of more secure software development practices, testing
and certification programs. In addition, training future generations of
programmers, technicians and business leaders that understand and
manage information security can be accomplished by establishing
university and educational/certification programs. Government can help
by facilitating collaboration with the users and suppliers of IT to
develop standards for safe practices. Examples of actions the
government can take include:
Enhance DHS, NSF, and DARPA cyber security R&D
funding.
Carefully manage long- and short-term R&D to avoid
duplication.
Establish a mechanism to share educational training
and curricula.
Enforce. Law enforcement must do more to enforce, investigate and
prosecute cyber crimes here and abroad. Examples of actions the
government can take include:
Ratify the Council of Europe's Convention on
Cybercrime.
Enhance criminal penalties for cyber crimes.
Make cyber crimes and identity theft enforcement a
priority among law enforcement agencies.
Encourage better coordination among law enforcement
agencies in order to detect trends.
Question: 2: If you do not want regulation, what do you want? Can
DHS actually have an impact if it is only a coordinator and not an
enforcer? Do you feel it is possible to draft regulations that would
require minimum security standards, or would that encourage
complacency?
Answer 2: Financial institutions are heavily regulated so no
additional regulation of financial institutions is warranted. Financial
institutions view the question as how best to urge the software
industry, telecommunications industry and power industry to take
greater responsibility for their products and services. It is important
for members of Congress and the Administration to recognize the
dependence of all critical infrastructures on software operating
systems and the Internet. Given this dependence, the Congress should
encourage providers of software to the financial services industry to
accept responsibility for the role their products and services play in
supporting the nation's critical infrastructure. In so doing, Congress
should support measures that make producers of software more
accountable for the quality of their products and provide incentives
such as tax incentives, cyber-insurance, liability/safe harbor/tort
reform, and certification programs that encourage implementation of
more secure software. Congress also could provide protection from U.S.
antitrust laws for critical infrastructure industry groups that agree
on baseline security specifications for the software and hardware that
they purchase.
In addition, DHS can encourage collaboration and coordination among
other critical infrastructure sectors and government agencies to
enhance the diversity and resiliency of the telecommunications
infrastructure. For example, the government should ensure that critical
telecommunications circuits are adequately protected and that
redundancy and diversity in the telecommunications networks are
assured. Further, the Congress should encourage law enforcement to
prosecute cyber criminals and identity thieves, and publicize U.S.
government efforts to do so. These efforts help to reassure the public
and businesses that the Internet is a safe place and electronic
commerce is an important part of the nation's economy.
Since its creation in 2003, DHS has focused primarily on physical
security. It has not focused enough attention on addressing cyber
security concerns. Elevating the cyber security position is a small
step as part of a broader strategy to strengthen cyber security. Cyber
security issues are handled in the government at a level far below
where most corporations in the private sector handle these issues
today. Elevating this critical position and ensuring that adequate
funding is provided will help to focus greater attention on cyber
security issues within the government and throughout the private sector
and thus implement many areas identified in the Administration's
National Strategy to Secure Cyberspace.
Since its creation, DHS has devoted substantial resources in
bringing interested parties together to discuss cyber security risks.
For example, DHS has hosted or supported fora to discuss steps that
government and the private sector can and should do to mitigate cyber
security risks. However, DHS has not devoted enough resources to
address other key components of securing cyberspace. This include
efforts to raise awareness of cyber security risks and steps consumers
can take to protect themselves, facilitating collaboration among
critical infrastructure sectors and government, strengthening a
information sharing coordination mechanisms, such as the Information
Sharing and Analysis Centers (ISACs), reforming the Common Criteria/
National Information Assurance Partnership (NIAP), and urging the IT
industry to take on greater responsibility for the security/quality of
its products and services.
Question 3: Ms. Allen, I would like to get your opinion on the
recent joint rules made by the FDIC, Comptroller of the Currency and
other agencies regarding data theft at financial institutions. Do you
believe they overstepped their bounds by doing this? If so, how do you
feel this growing problem should be dealt with?
Answer 3: The federal financial regulators issued a final rule on
customer notice breach requirements in March 2005 following a notice
and comment period. About 80 organizations submitted comment letters,
including BITS and The Financial Services Roundtable. Fortunately, the
regulators responded to some of the concerns voiced in these comment
letters. Consequently, the regulators provided greater flexibility for
financial institutions when deciding when and how best to notify
customers in response to a security breach.
Notifying customers is a complicated and complex process and can,
if poorly done, undermine confidence in the financial services
industry. Care must be exercised in alerting consumers to steps they
can take to protect themselves from ID theft and other forms of fraud
while averting needless alarm.
Members of BITS and The Financial Services Roundtable believe
financial institutions have a strong track record in protecting
customer information and in communicating with customers when security
concerns arise. Protecting customer information is of paramount concern
and our member institutions have taken a proactive approach in this
regard. Examples of these efforts include the creation of the Identity
Theft Assistance Center (ITAC) as well as BITS guidelines and best
practices for reducing fraud, managing third party providers, engaging
law enforcement agencies, and communicating with customers.
We believe that financial institutions should have the flexibility
to develop their own risk-based approaches toward dealing with
unauthorized access to customer information, whether at their own
operations or with a third party service provider, within the current
guidelines set forth in section 501b of GLBA. For example, financial
institutions should be given flexibility in determining a course of
action when they ``flag'' and secure accounts that have been
threatened.
Efforts by various states and regulatory agencies raise significant
implementation problems for financial institutions. In a transient
society, notification should occur uniformly regardless of which state
the consumer may live in. Moreover, inconsistent application of
inconsistent state law inevitably creates a compliance nightmare for
institutions with a multi-state presence.
Members of BITS and The Roundtable believe it is important for
legislators and regulators to adopt uniform national standards to avoid
serious implementation problems and inconsistent applications. Our
members also encourage legislators and regulators to mandate
notification only when there is some indication that the breach
actually has the potential to cause harm or injury. If harm is
demonstrably contained, for example, and no risk really exists, there
should not be any reason to notify and scare people. Moreover, we
believe it is wise policy that legislators and regulators require
companies that discover breaches in security to immediately notify law
enforcement authorities, as well as consumer reporting agencies, so
that law enforcement authority can get a jump on any existing
criminality and Credit Reporting Agencies may be better prepared for
the potential volume of consumer inquiries about the impact of any
breach on consumer credit history. Further, BITS and the Roundtable
support measures to impose caps on damages. Any allowable damages
should have firm caps and there should be no damages absent a showing
of intent or actual harm. Absent negligence, an affirmative defense
should be available if the company can demonstrate that is it a victim
of fraud. Other measures include providing ``safe harbors'' from
lawsuits for companies if they have instituted reasonable internal
notification procedures.
Questions Submitted by the Honorable Daniel Lungren for Paul B. Kurt
Question: 1. What is the Government's role in cybersecurity? If you
don't want regulation, what do you want? Can DHS actually have an
impact if it is only a coordinator and not an enforcer? Do you feel is
it possible to draft regulations that would require minimum security
standards, or would that encourage complacency?
Government's Role in Cybersecurity
The Federal Government is positioned to assist with forensics,
attack attribution, protection of networks and systems critical to
national security, indications and warnings, and protection against
organized attacks capable of inflicting debilitating damage to the
economy. Additionally, Federal activities should also support research
and development that will enable the private sector to better secure
privately-owned portions of the nation's critical infrastructure.
Three Federal documents provide a framework for Federal
responsibilities to secure cyberspace:
The President's National Strategy to Secure Cyberspace
(February 14,2003)
Homeland Security Presidential Directive-7 (HSPD-7)
(December 17, 2003)
The National Response Plan's Cyber Incident Annex
(January 6, 2005)
The President's National Strategy to Secure Cyberspace provides
clear policy guidance on the Federal government's role: ``The policy of
the United States is to protect against the debilitating disruption of
the operation of information systems for critical infrastructures and,
thereby, to help protect the people, economy, and national security of
the United States. . . We must act to reduce our vulnerabilities to
these threats before they can be exploited to damage the cyber systems
supporting our nation's critical infrastructure and ensure that such
disruptions of cyberspace are infrequent, of minimal duration,
manageable and cause the least damage possible.''
HSPD-7 establishes the U.S. government's policy for the
identification and protection of critical infrastructure from terrorist
attacks. It focuses in large part on the identification and protection
of assets that would cause catastrophic health effects or mass
casualties if attacked, comparable to those from the use of a weapon of
mass destruction.
Finally, The National Response Plan's Cyber Incident Annex upholds
the President's National Strategy to Secure Cyberspace and HSPD-7. The
NRP Cyber Incident Annex states that the Federal government plays a
significant role in managing intergovernmental coordination (Federal,
state, local and tribal) and, where appropriate, public-private
coordination in response to cyber incidents of national significance.
Ultimately, Federal activity is bounded by these three documents to
protecting against debilitating attacks against critical
infrastructure, attack attribution for national security systems,
forensics, and research and development.
The DHS Impact
The Department of Homeland Security (DHS), as designated by HSPD-7
and the National Strategy, is the government's focal point for
prevention, response and recovery from cyber security incidents that
have a debilitating impact on our national and economic security. The
Strategy sets specific responsibilities for the DHS, including:
Developing a comprehensive plan to secure critical
infrastructure
Coordinating with other Federal agencies to provide
specific warning information and advice about appropriate protective
measures and countermeasures to state, local and nongovernmental
organizations including the private sector, academia and the public.
DHS's responsibilities in the area of cyber security, although
narrowly defined, are extremely significant to our economic and
national security. DHS serves as the point of coordination for all
government and national efforts. Senior DHS leadership, at the
Assistant Secretary level or higher, is needed to build an effective
government-private sector relationship, to understand the technical and
global complexities of cyber security, and to marshal the resources
necessary to provide an effective partnership with private sector
organizations and initiatives.
Regulation
Regulation is difficult, due to rapid technology changes, and
regulation can also stymie innovation. A report from the Business
Roundtable (BRT) states, ``traditional regulations directing how
companies should configure their information systems and networks could
discourage more effective and successful efforts by driving cyber
security practices to a lowest common denominator, which evolving
technology would quickly marginalize.'' A regulatory approach could
result in more homogeneous security architectures that are less secure
than those currently deployed. Given the complexity and dynamism of
cyberspace, the marketplace will provide in most cases the necessary
impetus for improving IT security. In those instances where existing
market forces fail to provide such impetus, incentive programs that
rectify market shortfalls and encourage proactive security solutions
should be considered and adopted as appropriate.
Minimum Standards
CSIA believes we should encourage the adoption of existing
standards, rather than creating new ones. Several sets of standards and
best practices exist today. Some are required under current regulation,
such as Gramm-Leach-Bliley or the FDA Part 21, while others are
voluntary, such as International Standards Organization (ISO) 17799, or
Control Objectives for Information Technology and Related Systems
(COBIT).
Question 2: What can be done to improve cybersecurity within the
Government? Why is the Government's coordination so bad? Should DHS be
responsible for the Federal government's cybersecurity, or should OMB
retain this duty?
The Government has to address cybersecurity in a holistic manner,
rather than attempting to solve each problem piece by piece. By
securing entire networks from the ground up, coordination within the
Government will improve.
To even begin to accomplish this, OMB needs to look to the
authority it was granted in the Federal Information Security Management
Act of 2002 (FISMA). FISMA positions OMB to strengthen the federal
information security program, evaluation, and reporting requirements
for federal agencies. However, this has not been achieved to its
highest level, nor are there adequate--resources and personnel
available to accomplish this. The security of Federal systems could be
improved by ensuring OMB has more resources to ensure oversight of
FISMA implementation.
The government needs to use the power of procurement to encourage
vendors to provide products that meet a higher government standard.
Subsequently, the government can coordinate to implement standard
practices, procedures, and policies across all the federal agencies.
The security of Federal systems could also be improved by ensuring
FISMA is more thoroughly applied to contractors supporting the Federal
government. The GAO's recent report, ``Improving Oversight of Access to
Federal Systems and Data by Contractors Can Reduce Risk'' discusses
this issue in detail.
Finally, GAO identifies in ``Continued Efforts Needed to Sustain
Progress in Implementing Statutory Requirements'' the use of the annual
``report card'' on governmental information security as an effective
tool to identify and address security weaknesses.
Question 3: Is the private sector doing enough to educate consumers
and users about the importance of cyber security? There have been
several studies recently that show most computer users do not take
security very seriously. What can we do about this?
Based on the number of security breaches and increasing cases of
identity theft, it is fair to say that consumers are not as educated on
the importance of cybersecurity as they should be, leaving a large
percentage of computers unprotected. The private sector has increased
its efforts in recent years to educate consumers about cybersecurity
issues. Primarily, the private sector has established partnerships with
the major networking and operating system providers, which have eased
the burden on the consumer, while working to secure cyberspace.
Awareness campaigns, such as October's National Cyber Security
Awareness Month, have also helped in the effort. CSIA and the National
CyberSecurity Alliance(NCSA), along with a number of other awareness
organizations, work with the FTC, FBI, the Small Business
Administration, the Department of Homeland Security, the Department of
Commerce, and other government agencies at the federal, state, and
local level to promote cyber security awareness.
In instances where existing market forces fail to provide adequate
impetus, incentive programs that rectify market shortfalls and
encourage proactive security solutions should be considered and adopted
as appropriate. A recent Congressional Research Service Report
discusses incentives that may be adopted to help foster cyber security.
Finally, Federal government's leadership, particularly through an
Assistant Secretary position at DHS, fostering collaboration, reducing
legal barriers, and leading by example, will continue to assist the
private sector in educating consumers.
Questions Submitted by the Honorable James R. Langevin for Ken Silva
Questions: One thing I have heard consistently over the past two years
is that government regulation is the wrong way to bolster cyber
security. The argument is that government cannot move nearly as rapidly
as market forces when it comes to information systems and security.
Best practices are frequently used to demonstrate how the private
sector is working to encourage a culture of security, except it seems
they are not updated as often as may be needed. This begs the questions
of weather these should be standardized by a group like NIST or not. I
would like the panel's honest assessment of what the government's role
in cyber security is.
* If you don't want regulation what do you want? Can DHS actually
have an impact if it is only the coordinator and not the enforcer? Do
you feel it is possible to draft regulations that would require
minimum-security standards or would that encourage complacency?
Answer: You are correct that there seems to be a fairly broad
consensus not just in the private sector, but in the National Strategy
to Secure Cyber Space published by the Bush Administration, that
federal regulation is not the appropriate approach to improving cyber
security.
However, it is not just because the regulatory process is slow.
There are many other reasons as well.
I'm not sure the federal government is on very firm ground in
asserting that if they, through NIST of any other mechanism, wrote
standards that there would be dramatic improvement. After all, for the
fifth consecutive year the average score of the 24 federal agencies,
which are charged with meeting such federal standards for cyber
security, was a D+.As bad as things are generally in the private
sector, recent research shows there is a substantial minority of firms,
probably about 20% who are doing an excellent job at cyber security by
following best practices. I'm not aware that the federal government's
record is nearly that good.
And, while it is fine to say that federal standards intent would
only be to create a floor many feel that floor would, in reality,
become a ceiling. The last thing we want in the cyber security field is
something like we have in the campaign finance field where everyone
claims they meet the federal standards and no one really believes the
regulations are accomplishing their intended goals.
In the last Congress one of your colleagues, Congressman Adam
Putnam, circulated a draft bill that would have attempted to layout a
regulatory system. It was resoundingly opposed by virtually all
segments of the industry.
In response Congressman Putnam appointed the Corporate Information
Security Working Group (CISWG) to address the question you ask today.
At the conclusion of that effort last year Chairman Putnam wrote of the
CISWG group that: "The corresponding recommendations have provided
valuable information and have already produced a variety of initiatives
that have made a measurable difference."
The Internet Security Alliance was very active in that group and is
responsible for some of theses initiatives. The co-chairs of the
Committee on Incentives, Liability and Safe Harbors was co-chaired by
my first Vice Chairman on the ISAlliance Board, Ty Sagalow of AIG, and
our ISAlliance Chief Operating Officer, Larry Clinton.
15 different trade associations participated in the Incentives/
Liability Sub Group and produced two fairly detailed reports go a long
way toward answering your question. I am supplying the reports for the
record.
Briefly the group first answered your question of why regulatory
measures were inappropriate to address this issue. They provided a
series of reasons including the following:
1. The traditional regulatory structure (i.e. FCC/SEC style
regulation) is likely to be both ineffective and potentially
counterproductive to the interests of implementing a
comprehensive cyber security program.
2. A cyber security program based on positive incentives is
more likely to generate safer and more attractive products.
This will increase consumer and business confidence in advanced
technology and result in a better environment for the American
economy in general and American businesses and consumers in
particular.
3. Traditional regulatory structures are likely to be
ineffective because:
The international nature of the cyber security
issue demands a cross-boarder solution which national
legislation cannot achieve.
The ever-evolving nature of the Internet and
the cyber security threat demands a solution that can
be quickly adapted to changing circumstances which is
inconsistent with the nature of the traditional
regulatory structure.
The current US political consensus is that
regulation of the Internet is unwise and hence the time
it may take to enact a regulatory structure may not be
appropriate given the urgency of the worldwide cyber
security problem.
4. Traditional regulatory approach to cyber security is
potentially counterproductive because:
The traditional regulatory structure is an
open process of public comment and reply comments. Such
a process could lead to providing a roadmap of
vulnerabilities to nefarious parties intent on causing
damage.
Private industry is better able to innovate
and maintain the array of tools necessary to adequately
police Internet security. Relying on inadequate
resources could lead to the unsophisticated decisions
yielding less, rather than more security
The political process by which traditional
regulatory standards are reached encourages compromise
rather than maximum effectiveness. Hence the political
process could result in an inefficient program that
could yield a false sense of security.
Government regulation of technology may blunt
innovation resulting in less consumer choice, economy
and security.
5. Hence a program of positive incentives such as insurance
incentives, liability incentives and tax incentives is likely
to be an effective, comprehensive and ongoing program of
managing the security risks consistent with the ever evolving
and international nature of the technology and the threats to
it.
Based on this assessment the CISWG concluded, as did the National
Strategy to Secure Cyber Space, that the best approach would be for
governments and industry to work together. Specifically, the Working
Group outlined six different incentive programs that should be
considered three of which would be led by industry and three of which
would be led by government.
In summary they are:
Industry Led:
1. Development of Common Measurement Tools/Seal of
Approval and Vendor Certification Programs
2. Better Use of Cyber insurance tied to best practice
adoption
3. Development of market entry incentives
Government Led
1. Safe harbor/tort reform tied to best practice
implementation
2. Tax incentives
3. Credit programs such as FEMA credits or use of
government procurement to drive better security in
products sold
In the final phase of the CIWG process the group began to develop a
new paradigm which could be used to drive best practice adoption on an
international level by tying the various incentives into broadly
adopted best practices which would use market forces to continually
generate updates and modernizations.
The Sub-Group found that within the marketplace there already
exists a robust assortment of published regulations, standards, best
practices, and similar guidance. Research shows that compliance with
these existing practices can result in demonstrable improvements in
cyber security. Indeed, the largest study in the field to date found
that the approximately 20% of companies deemed the "best practices
group" suffered less monetary damage and downtime than less careful
corporations, and one-third of this group suffered no such
inconvenience despite being targeted by attackers regularly.
Further, the Group found that while there are apparently effective
best information security practices operative in the world, there is
still a consensus that no one size fits all. What qualifies for a
specific entity, as a best practice will be affected by size of the
entity, the culture or cultures it operates within, its sector specific
regulatory status, and a range of other variables?
Government's role in the public-private partnership is to fashion
an incentive program for the good actors that will create a business
advantage for them over less careful players. In so doing, we hope to
harness the power of the market to motivate cyber security.
The group specifically did not endorse the creation of a federally
specified standard of information security to be applied to the vast
private sector. Rather they were concerned that such an approach would
be too static and could put U.S. business at a competitive
disadvantage. Such an approach also might not be appropriate across
various sectors, might be weaker than needed due to the political
nature of the regulatory process, and hence, could be counter
productive. It would also be very hard to enact legislatively.
Instead, they proposed that companies have available federal
incentives if they implement information security pursuant to and meet
the:
Information security procedures adopted by a Federal
sector-specific regulatory agency.
Standards established and maintained by the following
recognized standards organizations:
International Organization for Standardization
American National Standards Institute
Electronic Industries Alliance
National Institute of Standards and Technology
Standards established and maintained by an accredited
security certification organization or a self-regulatory
organization such as NASD, BITS, or the emerging CISP
structure.
Finally, the Sub-Group analyzed the various types of incentives
available and proposes a series of classes for organizing these
incentives with the greater ability of an entity to demonstrate
performance of agreed upon security practices yielding greater benefit.
These incentives and their classification will require further analysis
as part of the enactment process security controls pursuant to the
identified standards should not be considered as conducting an unfair
or deceptive practice. Similar state-based claims would also be
preempted.
These benefits include:
Limits on FTC Jurisdiction--a company that
demonstrates it implemented information security controls
pursuant to the identified standards should not be considered
as conducting an unfair or deceptive practice. Similar state-
based claims would also be preempted.
Limits on State Actions--Once a company has
demonstrated it has met the security requirements, then
plaintiffs should face additional burdens, such as increases in
the burdens of proof, caps on punitive damages, prohibitions on
third-party liability, prelitigation notice requirements, or a
cap on damages.
In summary Mr. Langevin, the Internet is a new type of technology
that will require different methods of management and assurance than
those that have been applied to previous technologies. Federal
standards, for the reasons cited, above are not the answer.
This is not to say that the government, and governnient agencies
such as NIST have no role. Quite the contrary, they have a very
important role working with the private sector as part of a new model
to insure long term information security.
The Internet Security Alliance would be pleased to work with the
Committee in further developing this new model.