good afternoon before we began this before we began this is my first subcommittee hearing this chairwoman for the subcommittee and i would like to share that i am extremely honored to be serving in this  look forward to working with the subcommittee members and staff i would like to welcome you all and thank you for joining us today to discuss cyber security a high priority issue for the department of defense and for the security of this nation as a whole and i think on an individual basis a high priority for many people who value their privacy today our witnesses will be providing us with private sector perspectives on the department of defense is information technology and  security activities cyber security is an issue that i've been following very closely for many years including in my role as vice chair of the homeland security committee and cyber threats have only recently received i think the attention that we should have been giving them the entire time and particularly within the defense community d o d s continually working to gain a better understanding of cybersecurity and how to best protect this nation cyberspace there's been many mainstream discussions in the press regarding cyber security lately in particular because of the google incident however there's been a number of high profile events against the d o d s others including cyber attacks against the stony and georgia government forces reports of intrusions into contractor networks to exfiltrate data on the f thirty five joint strike fighter intrusions into the networks that control our electricity grid and intrusions on pentagon e mails as well those are only a few of the instance that we know of many people are unaware that our systems especially our defense networks are attacked on a daily basis in the department of defense there are more than fifteen thousand different computer network switcher operated across four thousand military installations around the world we must protect those systems and ensure that information on them is only available to authorized personnel and we must not only be prepared to respond quickly and effectively to cyber attacks but we need to invest what is necessary and particular resources to protect our systems that's why it's important that the government engage the private sector as a partner in cybersecurity and not simply as the technology provider that you have been for such a long time there's a vast array of intellectual capital and expertise in the private sector i should know because i'm from california and a lot of the cyber people live there  e not consulted on key strategic questions even though some of those decisions have as much impact on industry as on government because sometimes government becomes the standard and then take from that we should recognize that the private sector is very much a part of the d o d family and we should treat it that way do you know do works with countless defense industries and these industries must also be held responsible for handing classified and sensitive  classified information appropriately while d o d may find it difficult to engage with industry that is not the case for congress and we feel that gaining insight from the private sector is essential we hope that the witnesses today will share their views on a broad range of topics to further and former awareness of these issues as we work with the d o d to craft an appropriate strategy for defending and operating our cyberspace i feel the views of our private sector witnesses are a valuable complement to those views that we have within the d o d for example understanding the implications of how the recent q t r address the issue of cyber space would be i think valuable to us and we would love to hear the thoughts on the proposed directions for the new established cyber command that the d o d a major focus of the subcommittees on the science and technology programs of the day so getting an outside view on the proposed research agenda would also be valuable and with a proposed increase of more than seventy million dollars in new funding for computer science and security research in the budget this year i would like to better understand from a private sector perspective if we're investing in the right thing if not what should we be investing in and how much would that cost us because i believe we must better protect our information networks before we experience more situations where states in non state actors are able to infiltrate our systems and not only steal data on our weapons system but also put lives in danger by disrupting military operations on our front line so let me quickly introduce our three witnesses today we have mr bond who's the president of tech america mr david bow and representing some twelve hundred member companies across the country let me begin by thanking the chair and the members of the committee for raising these important issues and holding hearings our members and our members concerns about these vital topics and the need to apply technology to every aspect of national security from the basement of the pentagon to the war fighters in the battle field share a commitment to protecting these critical networks and infrastructure and disruption today i want to focus on with technology changes faster than the requirements faster than the budget process faster than acquisition milestone process for all these reasons the normal acquisition process does not work for  technology to solve that problem we recommend first to build a new qadri of acquisition professionals people dedicated solely to purchase of large systems much as is done in the private sector the department also needs greater flexibility in budgeting we cannot afford to wait too much time in a world where cycles are short there also is a need to restore and enhance commercial products and their use there is an inadequate supply of stem carrying a degree workforce out there and that is a long term challenge other long term challenges basic research we're certainly supportive of critical nature is the chair mentioned about collaboration between d o d and the private sector in our view dialogue with the private sector has been incomplete so far in this area certainly engage with the defense industrial base with system inte grators that are part of america but the vast majority the commercial software development world is not a part of that conversation and needs to be they have not been formally involved related to any of these kinds of discussions about  the collaboration on information assurance and discussion of supply chains excuse me again here government needs to work with industry to understand the global deployment the benefits of it and the risks of it and then once  risk share the risk so that the very best minds in the private sector can help we would encourage some specific steps refocusing and reforming the existing certification process identifying commercial sector best practices and tools to expand their use within the government realm we also would recommend creating a governance structure for assurance we underscore the need to service and perhaps have the government salary supplemented by the private sector the legal framework so that leading cyber companies could donate talent tours of duty much like reservists and really help the national security finally we think it's important to underscore that the leadership and the word fighter ultimately traces back to our leadership in the private sector innovation and believe that therefore the department should take an interest in the private sector leadership of american companies let me make one other point quickly in summing up which is that we we know there are many efforts in information assurance and global supply chain assurance so we encourage administration to look at a single authority to consolidate and coordinate those and finally met i'm sure we would ask that subcommittee consider a strategic review of title ten in this information there aren't some adequate authorities that just have not kept up with the pace of technology that could be up for the good of our national security thank you rwoman sanchez and members of the committee thank you for your leadership on cyber security issues without cyber security we cannot maintain military superiority or economic security and a vital key to cyber security is a robust public private partnership quite bluntly government and industry will either succeed together or fail separately i am david bowden heimer a partner in the law firm of kroll and maureen where i had the homeland security practice specializing government contracts and work on committees focusing on cyber security issues today here in my personal capacity to talk about cyber security a topic that keeps me busy during the day and awake at night i will not dwell on the threat today nearly everybody agrees that the cyber security threat is imminent relentless and catastrophic and it's getting worse the cyber barbarians are stealing our secrets and our technology they are plundering our databases and private information and they are hacking into our critical infrastructure systems the real question is not the threat but what we do about it and i have six points six suggestions winston churchill would say that's five too many but let me see how many i cover six areas where the department of defen and the private sector must work in tandem number one we must supercharge the public private partnership with the same urgency that we mobilize the industrial base and would work to we need a public private partnership to attack today a cyber security threat so it does not become tomorrow's digital pearl harbor with the defense industrial base initiative has made a fine start with its program for bilateral partnerships now we need to move from limited partnership to full partnership instead of a bilateral model with a few companies we need a bigger can't with more private sector players and broader participation additionally full partnership should involve a two way exchange of information before the decisions and strategy are casting concrete number two we need more effective information sharing if we cannot connect the dots our cyber defenses are just another maginot line begging for a cyber ambush from the rear too often the public sector gets information that is too little too late and too classified for effective information sharing the private sector needs timely data exchanges with context and analysis two way sharing not a one way pipeline and less classification with greater access number three we need clear firm and consistent cyber standards working in consistent cyber standards works about as well as serving two masters it just doesn't work very well multiple inconsistent standards drive industry crazy and it's not just a military versus civilian standard issue sometimes even the army navy and air force don't agree getting clear firm and synchronize standards would give us better cyber defense at a lower cost number four we must encourage development of breakthrough technologies the department of defense specifically darpa brought us the internet we need that same big brain research to deliver breakthrough technologies for cybersecurity that can leapfrog our cyber enemies but at a cost we can afford an innovation can be energized in other ways as well such as technology clearing houses darpa prizes and private fellowships for cyber security the more brains the better number five we need to stimulate cyber defense to libel of the safe harbors getting penalize is a sure fire way to shut down information sharing and technology innovation for effect cybersecurity the private sector must share information not only with the department of defense but also its industry partners to encourage that sharing we need safe harbors so the industry partners can meet minimum security standards and are not penalized with an actress suits and other sanctions for cooperation say farmers can also excel or innovation such as we have with the safety act we need to expand that so it also applies to companies in the cyber industry as well number six we need to assure due process and dispute resolution and every partnership partners sometimes disagree when they government contracts business pulling the plug on a government contractor connected to the systems is effectively a cyber guests at a private party should not be unplugged when someone else is responsible for security breach  resolution process perhaps a cyber board of appeals of independent experts would allow government to do its job while assuring due process for private sector in the event of such disputes as an old navy  am the proud to appear before this historic committee we thank you for your leadership on this issue and welcome your comments thank you thank you gentleman and now mr schneider for five minutes thank you for inviting me here to testify i want to focus on cybersecurity research and education military and civilian computing systems need to tolerate failures and to withstand attacks but they don't they're not trustworthy our dependence on the systems is increasing both for peace time and wartime operations often with system users ignorant of what they depend on and the risks of that dependent moreover we operate in a reactive mode and we improve defenses only after they've been penetrated we prepared to fight the last battle rather than the next one this means attackers always win round one we need to move beyond this reactive stance to a proactive one in short we must build systems whose trustworthiness derives from first principles the proactive approach requires having a science base for cyber security since we don't have one we need to develop one but doing that will require making significant investments in research and the investments will have to be made on a continuing basis for without continuity if you will be inclined to make the intellectual commitment necessary to enter the field unfortunately cybersecurity will never be a solved problem we're not going to find a magic bullet solution attackers grow ever more sophisticated the systems themselves as do the deployment settings bringing new opportunities for attack and disruption so what research needs to be done there have been one studies by federal agencies since one nine hundred ninety seven each concerned with that question each offering some kind of cybersecurity research agenda and there's remarkable agreement among them all so it's time to move beyond the list making and embark on execution i will offer two observations about the conduct of cybersecurity research the first when the work is classified it cannot engage many of the country's top researchers it necessarily receives less scrutiny by a diverse community of experts and it will be slow to impact the eroding getting that restored should be a priority and it would undoubtedly bring better value for research dollars earlier made the observation that systems are not as trustworthy as they need to be the number of adequately trained cybersecurity professionals is obviously a factor here universities need to hire more faculty and to teach cybersecurity courses and to expand their programs significant increases some have advocated a cybersecurity credential for system developers as a forcing function the medical profession is a useful point of departure to is concerned with matters of life and death here obtaining a credential requires far more than passing an exam it requires years of postgraduate study in which the curriculum has been set by the most respected and practitioners in the field  barriers to working with our defense department or other departments of our federal government with respect to information sharing and what would you say from academic perspective from our universities and research many of you can answer all of here so the risk of the risk of doing this is it might make visible to our adversaries what's working and what's not working and that's primarily the concern about revealing classified data to broader community on the other hand it seems pretty clear that we overclassify content with respect to cybersecurity and there's a grave risk that academics and others who don't have access to this information will solve the wrong problem let me add to that if  government private sector and public sector there are there are a number of rules regulations and laws authorities in place built in earlier times for good reasons of the time but which today represent large and small obstacles to just that collaboration if i can with the analogy used earlier to the medical research efforts the differences you can't really talk to the disease or even the in this kind of gray world between perpetrators and and the rest the world so there are a collaboration and conversations we can learn more about what the adversaries are doing during that through academic partners so that we get to that forward looking agenda the doctor  about in his testimony i would agree that there are indeed legal barriers to information sharing between and the private sector there was a recent report to the u s track com which identified about twenty three different laws bearing upon the public private partnership in information sharing about ten of those have a direct effect upon the information sharing issues there are we we need a dual pr approach one as mr bond said we do need to look at some of those laws to determine whether there needs to be additional authority to share the information with the private sector in addition there are models for sharing the information such as in the u s track com report by using a nonprofit organization to receive the information and effectively serve as a clearinghouse i also agree with dr schneider that over classification has been an issue i think that we do need some institutionalized methods such as technology clearing houses with restrictions on access but still access so that industry and the department of defense can in fact work together committee you know there are a lot of members present and it's not that we're all over attending the health care summit or watching the health care summit we're certainly busy and we tend to focus on things that we think we might you know add some value to and that might explain why so few of us are here i'm a former law professor you know reasonably well educated i use computers all the time and it's very difficult for me to follow a lot of  your suggestions actually are fairly straightforward so i can follow the suggestions i just don't have a sense of enough of a sense of the problem of the structure we currently have that's attempting to address this problem and whether that structure that we currently have those individuals who are currently doing this who have expertise i don't come close to having nor will i ever have the right experts to have are they appropriately structure and do they have the appropriate authorities so i have to assume that you all are here because you do have some familiarity with how we the government currently structured trying to analyze understand this issue and then make recommendations concerning how we should make recommendations to congress for how we should proceed i fully accept secretary live statement and your description of the urgency of this there's no doubt in my mind that this is critically important i just have no clue what direction to go and so with your familiarity with our structure can you tell me whether or not you're kind of comfortable with who's there how they're organized what they're doing to try and tackle these issues that you're addressing today let me take a stab at your question which i think is a good one i know the attendance as well our hands around but it's not because of you if i could reclaim my time here definitely not because of the three of you but i've been on this committee now for a while and we've had like this in the past and they're typically not very well attended and it's not because we aren't alarmed it's not because we don't worry about this problem because we don't really understand it very well and so we're hoping that we're appropriately organized that we have the right people in the government organized appropriately to try and listen to folks like you and come up with the right suggestions for us whether it's changed the law increase funding here or there and that's that's my question do you feel like we do have those folks in place and that they're going to and who are they  different efforts on the same topic that was what is behind our recommendation that the administration maybe look at a coordinator to bring the information we also have the challenge of legal prohibitions on co kind of discussions are going on certainly another one i would mention that is specific challenges i think to capitol hill is the speed of innovation is so much faster than the speed of legislation that issues around budget flexibility the color of money and when that money dies how much flexibility you can have to respond quickly in a fast changing technology environment those would be challenges here with that branch of government has the power of the purs i would like to add to what mr bond said one of the things that we do see is a divided structure within d o d in the civilian agencies one of the things that congress has done well is to bring the bug from the senate and the house side staffs together into cyber jams and it would be great to see a model like that with india in the civilian side as well we need to brain together the standards that we see on the d o d side with those on the civilian side in the i c community in a way that we have a single set of standards we need the government to the executive agency speaking with a single voice just to sort of give you an idea of how far behind you a single set of standards what's that mean you just want to stop it all that's how basic my there's a standard of except there's an acceptable level  of i mean you don't really need to tell me i'm never going to have that kind of expertise i just want to know that the right people are placed on the right so the good news is you have some very good people the bad news is they are not working in a context in which they can get the job done and i'm a professional computer scientist i'm going to become an amateur government and point something out the defense department is dependent on lots of stuff that's highly vulnerable the power grid the communications infrastructure in the public sector as well as stuff that they operate themselves there are some obvious things to make this better you could imagine a stage plan where you start addressing short term things you worry about ten year out problems and you worry about investing in research long if you go into the pentagon and look around you will find nobody who's doing this but what's worse is you will not find anybody who believes this is his or her job there is nobody who feels its job number one to create a program and to execute on it appointment of howard schmidt in the white house you could argue for the nation at large there's been some movement in their action but the defense department cannot depend on the efforts for the nation at large your needs are slightly different your needs are more critical needs to be somebody there the people exist but nobody has that job why don't we just go back and forth there's only two of us  my impression jibes with what i think i heard from a few of you and that is that the technology that we use for most of our systems lags and a little bit i think in part it's because of the process that we go through in order is there an accepted mechanism for us to evaluate the effectiveness it would be very helpful if there were some way  accepted way where you know not it can be a lot argument about this to evaluate the talent productivity of the folks that we have that are developing our software we've got a lot of software engineers out there that we're relying upon people who could be working for google or microsoft or what have you but they happen to be working for us on software for us on software for communication etc in addition to cybersecurity stuff how do we evaluate whether or not their town is talented as they need to be in practice as they need to be there so it with your you know they will try to take that and get back to it something and dr schneider if you would the committee staff here is great and they've been they've been really working on this issue for some time and so if you if you could if you get back with committee staff on that and then dr schneider and your case your thoughts concerning the absence of a mission within the pentagon people specifically task to to these kinds of issues if you could maybe that it's in your testimony if it's not if you could share that with us in writing that would be very helpful if you could detail that and i'm sorry i interrupted the other thoughts about how we evaluate our you know do we have the right talent pool is it appropriately productive he has no interest in becoming involved in cybersecurity because there are so many other opportunities not think part of it is a marketing job and part of it is a credentialing job to make cybersecurity professional stand out that would make a difference i'm curious about your interest in evaluating the quality of people since ultimately we really want to evaluate the quality of the artifacts they produce and if for example we could evaluate the quality of what they built how secure it was then we'd have an easy way to determine how good the people who built it are certainly when you're going to buy a car you read consumer reports or something and they discuss the car they don't discuss the engineers the bad news is we don't really have a way to measure security we don't have a way to measure security or return on investment defenses and this isn't and this is a hard fundamental problem it's not something we're going to crack the near term it's something everybody appreciates is a big difficulty there's a famous quote that says if you can't measure something you really don't understand it and the field is well aware of this and this is a fundamental disconnect and the reason it's a difficult problem is because you don't know what to measure it against you'd like to measure it against some hypothetical attacker but as soon as you deploy a defense the attacker gets wise and now you don't know what to measure it against because the attacker may go in any number of directions so this is the sort of problem that has alluded the field for some time this is one of the reasons i've been advocating for the kind of science based because i think that's the only hope for getting these measurements but i think in the limit we really want to be able to evaluate artifacts and not evaluate people would if i could just quickly there are a number of private sector based efforts to measure their reliability and kind of fundamental code within the software programs to increase your understanding of the assurance and reliability of that  d and i wanted to acknowledge and agree with dr schneider's point to that one way of measuring that is to look at the overall product and working and the different levels of certification and other things approaches to information sure it's of tended to look at that way let's break it down by level of sensitivity and therefore greater certification or greater assurance as you climb up that stack so each would have a different metric assigned to  and could help the agency deal with but i think to best assist that would be kind of an expert panel that can help on these because these are very large complex systems old and new that the that the department needs to keep that warfighter the very front on the edge let me address that from an acquisition standpoint many of these systems are in the process of being replaced the various p r p particular mensah within a department of defense replacing the stove pipe systems in the legacy systems i think one of the most important things we can do is make sure that the contracts for replacing those old systems include the requirements for information assurance and information security and them and in addition i think that we need to take a hard look to determine whether the existing d o d standards for example the defense information assurance certification and accreditation program gap is the right standard is a sufficient minimum standard for applying to updating these legacy systems new systems are more secure than old systems but if you read the newspapers the front page is about attacks against new systems i don't believe that moving to today's new systems is going to appreciably change how vulnerable d o d is to cyber attacks i think the only way to change things is to build systems differently and that requires a different force field whether it's economic policy legit that changes the equation about how people are prepared to make investments when they build a system whether they're prepared to spend more time testing the system whether they're prepared to sacrifice complexity systems certain that software engineers as they develop products have security in mind as they do so they have to do not just sort of all around and your packages your product is not going to be as attractive  in handling you're not going to it won't be as attractive to the market if the market is something that wants security if you don't you can't somehow establish this do we within the private sector when large software packages are being developed does the company go so far as to actually have red teams that are trying to figure out ways to attack the product to destroy the product what are the it's not just relying on the software engineer who's designing to come up with security that's adequate but actually trying to attack it do we have that i guess dr schneider if we don't have anybody within d o d that's really specifically charged with the responsibility of worrying about the security issues we probably don't have red teams that are actually out there trying to penetrate our systems no actually has some of the finest red teams in the world what we don't have and somebody who's worried about the roadmap and making investments  and executing on a plan to move the field and move forward so that is less vulnerable to all of the attacks that exist today you know if we've got the best red team in the world we're obviously concerned about cyber security and and yet we're not appropriately structured because we're not we don't have the right mindset or the right division of responsibilities or our attention is drawn to this adequately as we develop systems is that what you're saying and yet here we are it's national security we know cyber security is an issue it's hard for me to believe that we wouldn't have cyber security in mind as we develop our software products yes sir it's very disturbing so you've made the statement that in fact we have this lack how how do you you know because frankly if the chair lady here was convinced there was such a lacking this committee would be moving forward with whatever needs to be done in order to make sure that that gets fixed so  if we went to the folks in d o d who are principally responsible for this at maybe the undersecretary level and we said geez you know dr schneider says we're not structured appropriately we don't have the right mindset products that we're producing are inadequate because this failing they say yeah that's true i couldn't put words in their mouth but i believe there are people who see it this way yes if i can i probably see a little bit been a greater emphasis and understanding of the need to build security in software even though companies certainly test because their reputation their brand is going to be at risk and can be somebody can choose another product with the click of a mouse but that said there is much greater awareness just in the last few years nationally and throughout the software community the entire community to put more attention and effort into building security in from the very beginning so that it's not just patches and things you build on the edge of your network or under the software that you build it in from the very beginning and so that should continue to increase  the risk and importance is only growing but i do observe the last few years of both the private sector and the public sector generally have been moving in that direction and i think that we've seen that in particular working on the homeland side with respect to the civilian side of the federal government we certainly have seen a bigger impact and momentum to try to get that obviously also coming out of the white house and their cybersecurity out in public with comment and discussions this is one area that the department of defense has shown leadership prepared of acquisition regulations specifically addressing the estimating but having lived through it i would guess that fifty percent of the time that position was vacant and that the other fifty percent of the time i'm talking about the first five years where i believe we had six is ours and that the median stay of that those r s might have been six or seven months and that the biggest problem we found was how do we  pay for what they're worth to come over and do that and in fact we have one of them who was supplemented i believe through a university maybe mit or one of the others it was north eastern university and there was a total outcry when the newspapers came out with the fact that they were funded by the university and only taking one hundred sixty k or whatever that  were paying this are but had a total compensation package of four hundred because four hundred thousand because they were being subsidized by some some university who by the way ship of that university or the flagship of that university was a private company and therefore wasn't it amazing that this is our guy was considered was considering that the best stuff was coming from by the way the company that was funding the universit is a new thing for me to think about but it's it's very difficult to figure out how we do that and that's one of things we have to think through if we do if we do take a look at that  be particular talents that you want to bring in a shorter term on a project so i think it probably would vary but also it's very much something notionally that some leaders in the space have talked about and has not had the benefit of  thought research yet to be a full bodied proposal to you but i think it does underscore how much the industry wants to help and how frustrated they are you know it would be great if you're representing twelve hundred companies you obviously have resources i think it be wonderful if you could pull some folks together and explore this with some detail and get it to get it to do you know get it to whoever and i think the chair listed some of the concerns that we would have no doubt there are others out there as well but the potential seems fairly obvious to me dr schneider i hear you when you when you say we should be looking at the quality of the product did mention productivity as well as talent and in this arena just like many others obviously the talent of the workforce has a lot to say or a major effect on the quality of the product that you wind up getting let alone productivity and  and so i hear mr bond saying and i think all of you would agree that you know to the extent that we can organize ourselves in a way that brings to the table the best talent that the country has to offer to try to tackle this problem that affects both national security and at a public level at a private level then we ought to be and that if there's a way to do that and i don't have to i'll never be an expert in this area and i don't have to be an expert in this area in order to understand it we need to find it and if the right people are in place giving us advice concerning how to go about finding it then we'll do it i will commit to that we will get back to you next week in san francisco as the world's largest cybersecurity trade show will have a number of the c e o s who are affiliate with our association meeting at that and i will convey your message to them will be back something to ask some additional questions in writing put them to you we hope that you would answer them fairly quickly for our committee and with no other questions out there we will close the committee