testing one two three four five six testing one two three four five six seven eight one two three four testing twenty three t hearing will now come to order i'd like to welcome everybody this afternoon to this hearing on cyber security and as we increasingly put all sorts of information including personal information online our nation's entire infrastructure from traffic systems and air traffic control to manufacturing to power distribution depends on internet network systems i can think of few topics as important for this  subcommittee to address that cybersecurity and i want to welcome all the witnesses here this afternoon for this very very important hearing as anyone who has seen the movies recently clued in movies like ocean's eleven have become increasingly sophisticated in the method of heist and it should be no surprise that cyber criminals and life are becoming also more sophisticated in their crimes congress realized the dangers of network systems as far back as the one nine hundred eighty s and in one thousand nine hundred eighty seven this committee wrote the computer security act which charged with developing the technical standards to protect non classified information on federal computer systems congress has remained concerned about cyber threats and since one thousand nine hundred seven congress has passed thirteen laws related to  cybersecurity today o m b reports that federal agencies spend approximately six billion dollars per year on cyber security to protect a seventy two billion dollars infrastructure in addition the federal government funds three hundred fifty six million in cybersecurity research each year i don't believe that simply spending more money creating more programs is the means to improve cybersecurity we also need to use our existing resources more efficiently and with specific achievable goals in mind this is also the main conclusion of the administration's recent cybersecurity review the focus of today's hearing is not to review what nist has done but to address what should be its focus going forward since nist is the only federal agency tasked with protecting non classified federal computer systems the testimony we hear today will have a vital and long lasting effect on our nation's economic and national security we have a distinguished panel of witnesses who have a long history of working with nest and detailed knowledge of activities i want to assure them that this subcommittee is prepared to act on their recommendations and now i would like to represent to recognize the ranking member representative smith chairman thank you for calling this hearing today on cybersecurity the fourth in a series of hearings held by the committee this year thank you to the witnesses as well while our early earlier hearings reviewed cybersecurity a relatively broad lands today we're here to examine the specific role plays or should play in supporting computer and network security our starting point for this review is the white house's sixty day cyberspace policy policy review which was released in may and which provided a broad outline of the actions the administration intends to emphasize moving forward a number of these actions appear well suited to us capabilities and expertise with respect to security practices and standards as a proven and trusted entity within the federal government the private sector and even around the world is also well known for its excellence in advancing research in the fundamental science of computer security for these reasons it's important for the committee to consider more closely the specific additional or expanded activities which make sense for us to undertake and what if any associated legislative authority or direction is necessary to enable this in doing so i think it is also important we work to prioritize these activities and and identify those which provide the greatest security returns recognizing the universe of computer security activities we would like to do is significantly larger than any realistic budget expectations additionally and as i emphasized in our prior hearings i think we should also be careful to delineate which activities nist shouldn't undertake particularly with respect to anything which could take on a regulatory nature is directly or indirectly i think chairman and the panel today thank you for dedicating your time and donating your time to this productive discussion thank you mr chairman thank you very much mr smith and if there are any members who wish to submit their opening statements the statements will be added to the record at this point and now it is my pleasure to welcome o lani is the director of the information technology laboratory at the national institute of standards and technology dr susan landau is a distinguished engineer at sun microsystems and a former member and former member of the commission on cybersecurity for the forty fourth president say i thought that was a mistake at first but that is the title of the group and then this information security and privacy advisory board let's see we have a different order here so dr phyllis schneck is the vice president of threat intelligence at mcafee she served as a commissioner also on the commission on cybersecurity for the forty fourth president and is on the national board of directors for the fat f b i s in for guard mr william wyatt technology professor frederick schneider is the samuel b eckert professor of computer science at cornell university and is a current nist information security and privacy advisory board member and finally our  last witness is mr mark hannan who is the general counsel and senior vice president public policy at software information industry association prior to working at s a a mr b hand it was the chief counsel technology of the u s department of commerce where you helped oversee nist cybersecurity activities witnesses will each have five minutes for your spoken testimony and your written testimony will be included in its entirety in the in the record for the hearing when you complete your testimony we will begin with questions and each member will have five minutes to ask questions of the panel ms for lani please proceed thank you chairman alou ranking member smith and any other members of the subcommittee i m c to for lani the director of the information technology laboratory at the department of commerce is national institute of standards and technology thank you for the opportunity to appear before you today cyber security is a vital central mission of our laboratory the impacts of this cyber security activities extend beyond providing the means to protect federal system they provide the cyber security foundations for the public trust that is essential to our realizing the national and global productivity and innovation potential of electronic business and its attendant economic benefits consistent with our mission in the recommendations of the administration cyberspace policy review this is actively engaged with many others in coordination and part is asian of cybersecurity research standards development standards conformance demonstration and cyber security education and outreach activities the review observed that it is our total national information infrastructure which is under attack the president has developed a coordinated national response approach that places leadership for cybersecurity related policies amongst the team within the white house this team provides an effective means for coordination and collaboration across the federal government and with the private sector the intelligence community the other elements of the national security community and nist are actively coordinating their standards and processes for cyber security this effort is producing a single set of requirements for the first time this does include a security controls and it's catalog for both national security and non national security system the updated security control catalog incorporate best practices in information security from the defense intelligence and civil agencies and historic achievement the review recommended building a cybersecurity based identity management vision and strategy and response nist is working with always d p o m b and the n s c through a new sub interagency policy committee focusing on line identity management working with o m b and other agencies this is helping to develop a security and privacy profile that will provide guidance to enterprise architects on integrating information security and privacy requirements into the federal enterprise architecture nist post the information security automation program which is an effort to enable the automation and standardization of technical security operations including automated vulnerability management and policy compliance evaluations the newest national vulnerability database is one such tool that makes  information on vulnerabilities impact measurement detection techniques and remediation assistance it provides reference data data that enable the information security of automation programs security automation capabilities this database also is key to the payment card industry in their efforts to mitigate vulnerabilities in credit card systems the review recommended a national public awareness and education campaign to promote cybersecurity nist working with the s b a and the i has put instructional video on you tube and published a guide to help small businesses and organizations in addition the review recommended strengthening federal leadership and accountability for cyber security and response nist was asked by m b to contribute to the security metrics taskforce to develop new metrics for information security performance for federal agencies the review recognizes the role of international standards in protecting our information infrastructure we are actively working with others and fostering international standards and protocols that are conducive to a free and safe information processing and interchange environment nist also actively contributes to the knighthood program and its five years strategic plan consistent with the reviews recommendation nist works with other members of the cyber security and information assurance interagency working group in establishing research and development priorities to address actions to compromise or threaten a compromise computer or a network based system is undertaken an internal assessment of its operational structured allocation of resources to ensure that our programs fully reflect the complex interdisciplinary nature of today's threats based on the feedback we continue to receive i have decided to put the proposed reorganization of i t i l on hold we have received expressions of both support and concern from various stakeholders we are seriously considering this input and plan to re evaluate how to ensure that our structure is as flexible and efficient as possible in meeting the many challenges and opportunities ahead regardless of whatever recommendations emerge from this internal assessment the technical program of work currently performed by the computer security division would not change  welcomes and appreciates all input and looks forward to continue conversations on this matter thank you for the opportunity to testify i would be happy to answer any questions you may have thank you very much mr lani dr landau please please proceed thank you very much thank you very much mr chairman and members of the committee on the distinguished engineer at sun where i concentrate on security and public policy issues i've done this for ten and a half years i served on this path for six years the information security and privacy advisory board that advises nist and got a chance to see firsthand what a terrific job the people at the computer security division do but i had seen that earlier in my work in cryptography they have a very difficult job in a very complicated situation they're designing security standard and guidance for federal agencies those are their customers but the work that they do actually gets used by businesses the private sector as well as being used internationally that's when they do things right and they do things right most of the time i'm very impressed but the reason it's a complicated job is because they are doing in order for them to do their work advising them providing standards for the federal government for federal civilian agencies they need to do not just basic research but mostly applied research and security guidance and they're doing that within an an agency nist that focuses on scientific research so doing we applied work is often a complicated dance for nist for the computer security division and i think they do it extremely well they do it extremely well because they listen to their customers and they work well with industry they're seen as an honest broker the sixty day review was very clear on the need to work internationally in order to work internationally it is a very important to extremely useful to have a scientific agency at your side providing guidance we show up in this country with nist to do that sun was part of a group of industry that had concerns over chinese government trying to impose mandatory security requirements on thirteen different products we showed up at the table with nist not n s a not v h s having nist at the table was extremely important because the chinese government saw that as an agency that was not interested in snooping not interested in finding out about things from china that it shouldn't but as a scientific agency and it really helped the decisions that happened and where we as it is industry are quite happy with the results and we really relied upon this to do that that was part of what the sixty day review said the importance of of international agreements and that calls for an elevated role for the computer security division there are other things that the computer security division should be be doing delighted to hear by the way that the reorganization is off the table because i thought that that was problematic but there are other things that the computer security division should be doing we need to address privacy standards in recent months there's been technical work that describes how easy it is to take data that a looks as if it's anonymized and re identify it with other data outside that particular data set taking information from netflix that has been anonymized and comparing it with data outside the netflix database and being able to figure out who the people are we need scientific standards technical standards to talk about how data should be handled to protect privacy in the past mists has worked almost entirely on computer security standards and not on privacy standards and i think that this role is very important especially as we move forward with healthcare we need nist we need the computer security division to be active in the international arena we also need greater independence for the computer security division it's impossible to separate policy from security sometimes i'm not asking here for to be setting government policy on security what i'm asking is for nist to be providing advice when a computer security division when it's computer security issue comes very close to a policy issue whether it's about identity verification identity management or any one of another of technical issues nist has that expertise and should be be using it more in the government it's also important to keep the branding of the computer security division which is well known both within the government now as a result of his ma and outside the government because of all the excellent work that c s d does for all these reasons i think it's time to elevate the computer security division to the level of a laboratory i think that would help a great deal in international work i think it would be appropriate in terms of the policy effort that i think the computer security group should be doing i think it's important for privacy standards thank you very much and i'd be happy to answer questions thank you very much dr land out dr smith please proceed good afternoon chairman will ranking members the members of the subcommittee my name is still a snack i'm the vice president of threat intelligence at mcafee we're headquartered in santa clara california a core of our cyber labs our cyber research is  beaverton oregon i testified today on behalf of the b s a the business software alliance thank you for the opportunity to testify on cybersecurity and the role of the i p l i commend the subcommittee for focusing on these i mcafee in the b s a believes that innovation and standards are among the most important tools we have to improve our cyber security therefore our primary recommendation regarding the role of the i p l in implementing the recommendations of the sixty day review is to contribute to an integrated u s government strategy to influence the development of international standards on cyber security please allow me to explain the importantly between innovation cyber security and international standards first we believe innovation is key to cybersecurity those persons intent on doing harm whether cyber criminals spies hostile nations even terrorist groups they find new ways to attack the adopt those needs those new technologies all the time and we must stay ahead of them and to do that innovation is the key second we believe the global industry voluntary standards are critical about innovation this is because first they facilitate interoperability between systems built by different vendors second they facilitate competition between those vendors leading to greater choice lower cost finally they spur the development and the use of innovative and secure technologies because a regularly updated cyber security depends on innovation which in turn depends on global industry lead standards this is why we urge the u s to support and uphold these standards by developing a comprehensive international cybersecurity saturday standard strategy currently the u s government's involvement in standards development is ad hoc incomplete and uncoordinated the sixty day review recognized this lack of coordination and called for a comprehensive strategy that defines what cybersecurity standards we need where they're being developed and what agencies will represent the u s for each nist has expertise and standards and cybersecurity and it's internationally respected so it should play an important role in the creation and implementation of such a strategy conversely there are also missteps the government should avoid most importantly we should not impose countries specific government created technology standards for cyber security this was a dangerous precedent that other nations would follow to then create their own divergent standards president obama said quote my administration will not dictate security standards for private companies on the contrary we will collaborate with industry to find technology solutions that ensure our security and promote prosperity and quote context of tighter federal budget still need sufficient resources we also need to ensure that nist funds intended for congress for cybersecurity are not spent on other projects so i can see s c works with a wide range of industry and academic partners the process underway needs to be open and transparent so that it can be informed by the views of the stakeholders and third whatever we do we should avoid diminishing the visibility priority and resources accorded to cybersecurity withi finally i'd like to close my testimony with a few other recommendations about further activities of c s t as congress considers how to elevate cybersecurity as a government priority including how to reform says the federal information security management act should produce the following first government wide standards and guidelines for real time monitoring audit and analysis of data about the security of federal networks and second government wide standards and guidelines developed jointly with industry for sharing threat and vulnerability information among federal agencies and with the private sector nist must also continue to invest in cybersecurity research and development b s a has called for the creation of a national cybersecurity been heavily used in both government commercial security practice and i currently serve as the c e o and president cygnus are also involved in information assurance issues we have been working with both companies very closely with commercial and government sectors in the areas of information assurance and cybersecurity for better than a decade for the purposes of my testimony and for reasons better described in my written testimony we prefer the term a cyber assurance and the reason and we tend to think this way is we deal both with non malicious and malicious activity and have found imperatively that non malicious activity unauthorized changes and uncontrolled changes can cause up and ninety percent of the failures and in complex information technology systems we really believe that the view needs to be broader than just cybersecurity relative review my person likes to experience tells me that this is already ahead of the curve in most of the key areas discussed in the report what i would observe in general about t report is it lacks this substantial out of the boss thinking there are bigger and more important things we can be doing then sure blacklists based cybersecurity which is the goal of keeping the bad guys the systems we must more broadly assure that the systems are intact as designed but this contributions relative to all of these issues irish security have in fact been formidable going to talk about three of those one and perhaps most importantly is the eight hundred series body of work which is literally a volumes of work in this work has contributed significantly the state of our state of the art for both federal and commercial id software and systems management second i'd like to focus on some of the extension of that work in a practical sense and that is a multilateral and both private and public partnership and teaming that's been in place to affect the security content automation protocol or s cap methodology  series documents as well as brain and the best of some of the intelligence community and the o t you are my opinion the s p f method and the increased emphasis on continuous monitoring as opposed to pure credit and and and auditing methods represent far and away the most important advance to better light systems management that i've seen i think i can be even briefer on the root reorganization of per my personal belief they're having worked inside and outside of nest is the management team is very capable of making decisions like this i would expect that the goal of these changes are to align the expertise with the changing mission requirements and budgetary requirements and would also believe that this movement tree broader view of cyber assurance as opposed to pure computer security is a motivation the best leads us a long way down that path so it's more than just keeping the bad guys out it's making sure that the systems are good and deployed as as as we intended them so there's a software supply chain issue there there's a change management detection issue a lot of that is being compassed in the work ethic gap in general early and history of first of these methods white listing methods and compliment to the blacklisting method make sure the bad code is kept out make sure that big code is good and the combination of chairman computer security division serves today as a trusted source of expert information about secure computing the recent proposal to reorganize the division in my opinion threatened its effectiveness and thus could have undermined a key national resource for civilian cybersecurity therefore my remarks here will focus on c s t organization but i'll be prepared to answer other questions later what had been proposed involved two elements the first element had the head of c s t reporting higher up in management chain this would have been good higher levels of mismanagement increasingly will want to understand and champion computer security activities so they can secure needed resources and can provide guidance throughout the federal government the other element of the reorganization involves redefining which projects are part of c s t c s p would no longer be the home for all cybersecurity activities within the information technology where i have not heard a compelling rationale for this and i'm not sure one exists first i fear that having computer security activities attract talent because c s t employees are seen to have an impact on computer security both domestically and internationally second i'm concerned about loss of budget accountability for computer security activities put all the activities in a single division and it will be easy to ascertain that funds appropriated to nist for cyber security are used as intended cyber security activities over multiple divisions and the funds will be intermixed with funding for other activities finally and perhaps most important i see no intellectual basis for deciding what computer security activities to place outside of and what other activities to play inside of  however i do see difficulties when people who are working on closely connected initiatives are not under the same management it removes imperatives for cooperation for rational budgeting and makes comparisons of people in projects difficult so the proposed reorganization seemed to offer a few benefits but a slightly different reorganization actually could have been a very wise move looking ahead c s t will have to assume a larger role because trustworthy computing is so central to the future of our nation's critical infrastructures private sector systems and the administration's new initiatives in health care and smart grid growth will be necessary to meet these needs although the recent reorganization proposal makes no allowance for such growth there is a plan that elevates to become a laboratory so that it's parallel to the information technology lab currently housing with this alternative proposal the director of the new lab would report higher up the new management chain the c s t brand would be protected and perhaps even strengthened budget control and accountability are facilitated by having all and only computer security activities under one director and there would be no need to separate various efforts that intellectually are closely related in some i find that entertaining a reorganization of today's d s t is sensible but the recently proposed reorganization lacks a rationale and seems to create problems without offsetting benefits and alternative reorganization has already been indicated by the panel that review was quite comprehensive in its outlook even by its own statement it touched virtually everyone and everything we do in our society and i think i certainly share with my colleagues the anticipation that the cyber coordinator will be announced soon but i think you can boil down the thrust of that review into three things first that we've got to take action to enhance the security of our federal government systems that we need to second that we need to continue  enhance the public private partnership to make sure our infrastructure secure and sir that we need to partner effectively with international community since this is a global problem not just a u s problem and in our view the challenges these three challenges mean that nist and thereby the secretary of department of commerce have an absolutely essential and critical mission and contribution to me just seeing where the sixty day review goes to be more precise and welcome  update on what's going on with the i till and i've known her for many years look forward to working with her on where this could possibly go once they step back from this program the reality is that this change in is the review comes at a very critical time about the direction i think we're going to take with a cybersecurity review and one of the key questions is whether its implementation is going to be informed predominantly by the military intelligence framework of cybersecurity or whether it is going to be able to adapt across a wide variety of sectors and parts of our economy our view based on the experience so far is that you've got to have that blend of perspectives for it to work and if it is going to be effective it means that nist must be enhanced  in its role and thereby the department of the secretary must play a leadership role in where the sixty day review is going to be carrying out so therefore we think rather than looking at what are the merits or not merits of the i t i l run as a show and this is a great time to look at really where the future of nist and its service to the activities need to go in mr chairman in our testimony we make a number of recommendations and ask him key questions which i assume have been submitted for the record let me try to summarize those here first we urge the committee as it has done for decades to make sure that nist does not become a private a regulator a private sector actions have been very consistent in making sure that nist remains a first class laboratory not a fifth class regulator and this does best and carries out its mission when it collaborate to the private sector not try to impose government defined standards or technologies on the private sector my testimony goes through some examples where they've come very close to that line without a great deal of success and in my view some negative consequences the second thing we would urge is consistent with some of the other panelists is that we would urge serious consideration to making the computer security division a standalone laboratory we've heard three key challenges facing the computer security division one is funding one is staffing and recruiting and retaining good staff and the third is enhancing and reinvigorating the the global brand we think that currently the c s t being spun of six divisions inside t l and i feel being one of ten laboratories inside of news is not really the right framework in which that can occur and so again we know that there are issues involved in doing any reorganization but we think that there needs to be serious consideration given to this creating a cyber information nist needs to make sure that its primary customers agencies of the federal government are the focus of its efforts and the committee is well aware of its responsibilities regard the fourth recommendation we would make is that nist needs to continue to work with the private sector and the political leadership of the com or send us your among others as we work to roll back some of the ridiculously stringent regimes that we're seeing from other governments which are trying to impose indigenous or unique standards in this area i was not able to appear in the june hearing chairman because i was in china personally working to try to roll those back and while we certainly depended on the leadership of ambassador locke and secretary investor kirk and secretary locke in getting that done this was an absolutely essential partner because of its  perceived global reputation as an independent assessor independent evaluator credible place for we could talk about legitimate ways of approaching these issues globally that is going to become more important as we see countries like india and russia also beginning to take on those efforts so that mr chairman i just want to say that we think the nist in the department of commerce have been absolutely essential role we're very pleased to see that secretary locke in particular has brought some terrific people who are really beginning to focus on these issues we commend those steps we can in this hearing and we look forward to working with you and and the executive branch to carry out these goals thank you thank you very much mr ball hand and now it is in order to for the panel to ask questions and the chair recognizes himself for five minutes in i hope to be able to address both the international cooperation issues and also the reorganization issues in five minutes but it may stretch out a lot that mr bohannan you cited the chinese instance and like you to expand on that a little bit and i also like to ask the rest of the panel about the appropriate role that you try to summarize them the best i can starting several years ago china began to develop a series of standards for evaluating i t products in a wide range of areas not surprisingly they include areas in which the u s i t industry is dominant or has very superior products to the rest of the world those standards are based in large part on indigenous standards that were developed by indigenous standards organizations without really input from anyone outside of china to be honest with you they would require evaluation of products through laboratories that are at best loosely associated with the chinese government these kinds of values it's a very sensitive nist has handled these issues very carefully in its long time history of working in this  area those chinese standards would have prevented market access for many i t products working with commerce and u s t r been able to roll them back they are still quite broad in scope our every we're looking forward to continue to work with the u s government but the implications were that china would develop very indigenous very unique standards for security products that are widely used and that would be detrimental not only to the security of china in terms of its practices but also our technology base our innovation i think that we're familiar with the scope of the problem but if if there are any further comment you want to make about nist role and why that was important in this role they were very important because the chinese as a truly world class laboratory from which nist can provide an independent view about things its role in developing advancing christian standard is well known but that's only the tip of the iceberg started with china but other governments nest as a place where it can go for unbiased professional independent assessment of what are good security practices and how they can be implemented in a meaningful way and so we were very pleased when nist team were willing to have light night video conferences with their counterparts explain to them why the united states government doesn't do things like ask for source code or why other governments don't ask for source code that was a very important message it was a different message than could come from the trade route with the secretary of commerce it came from the best in world class experts in this area to explain why that is not good security practice based on global norms and those are making a big difference thank you very much m any of the other witnesses like to comment on what has been occurring well or not well and what can be improved going for an international standard setting microphone place thank you i just like to say and this is an old example but it contrasts with the previous failed example or an example that was not successful advanced and trips in standard was done extremely openly extremely transparently were not only the submissions open but in fact the  comments on the proposed specifications were given out and that is the proposed specs were put out and and this asked for comments and then the proposed specs were changed in accordance with comments received internationally the result was a very open competition and when the standard was chosen it was a standard designed by two belgians the excepted was immediate internationally which created a much better situation for industry it created a much better situation for security and it created a situation in which the u s government has been using the advanced and it has approved the use of the advanced equipment standard for top secret implementations the the n s a has approved it and i think it's a tremendous success it has to do with the transparency of the process the scientific starts thank you a couple of things on the international standards and that relates to this discussion about brand the primary brand and this is nist and it is a significant brand  and as an it doesn't have regular tory authority they're very good in these kinds of technology and standards discussions cross border there is a movement to a broad movement that we're watching carefully to this notion of trusted platform how do i know that this device is trusted that involves both hardware and software systems so there is deep concern that our definition of trust is not consistent we can we can describe technical trust but social trust is a little more interpretive so there's work being done against some particular important elements fundamental elements in the computer platform things called trusted platform module or china  example would like to build their own based on their definition of trust and i think we do have to look carol at some of these formative issues and this can play an extremely important role in creating an adopted international standard at the core basis of the evolution of this trusted platform movement thank you very much mr stein's and my time is expired but perhaps we can come back in the next round mr smith five minutes thank dr schneider you stated in your testimony the need to revise his mom could you elaborate you know what do you see as the as the problems and what you believe should be done about them especially as it relates to  thank you so i suppose i'm an outsider i am not working for a federal agency and therefore i don't have to follow guidelines periodic lead to establish the security of my computing systems but i have heard people who do this in my capacity on the pad and it strikes me as a very expensive madness and an annual ritual where i team managers have to compile an enormous amount of paper certifying a number of things that is only loosely correlated with the security of their systems when the federal government didn't require our agency computer systems to be very secure and there was much distance to cover and this sort of initial inventorying that says more reviews are about were very good way to get started we're now way down that path and we understand much better about vulnerabilities and about how to how to address them and the current system requirements are not about that they should be continuous they should involve monitoring they should be focused much more on technical issues and much less on inventory style documentation they should be much less a legal listed exercise between some sort of auditor and agency management and i think that lots and lots of resources are being spent trying to accommodate a set of guidelines without getting much security game ok thank you mr lonnie you noted in your testimony about be talking about outcome focused rather than compliance focused metrics in cyber security what type of products do you expect to emerge from that effort and what is the timeline that the effort has just begun so i'm not a you mentioned in your testimony the emerging security needs in the area of cloud computing could you explain exactly what that is and how it is used on federal computer networks and what uniques security needs to accompany  when you have a system that is in your office or in your i t center you own it you manage it when the data is instead held somewhere else on google documents in g mail are the examples that people tend to be familiar  with then you're no longer managing the security of your system or your managers are no longer managing the security of your system i'm not i don't know exactly how the federal government is using cloud computing i know that  has been preparing documents about security and risks and security definitions for cloud computing and i would defer to two to see to for that but you raise a whole set of security risks and a whole set of policy risks and legal risks when you move to cloud computing and those have to be addressed whether it's in business whether it's in government whether it's in education as you shift where the data is being held what's the backup policy who has access to it what are the legal policies if the data is being held in the united states that's one thing is the data being held in canada is the data being held in the u k what's the backup policy so that's a new set of security risks that are being introduced thank you very much thank you very much mr smith thank you mr chairman and thank you to each of our witnesses i'm in the fourth congressional district of maryland we're really proud to be the home of the newest labs i know i've had a chance to visit and meet with all of our partners friends and missed and incredibly impressed by the work that that's done there and i appreciate your testimony lonnie i have a question because i'm not i don't quite understand the the argument around concerns raised about reorganization if there is if there isn't a deep impact on the actual work that takes place and this responsibilities and so i wonder if you have any comments about some of the testimony that you've heard here today regarding  new capacity to take on these responsibilities and also maintain what i think is a really high standard for cooperation and work with private industry and trusted work with with private industry in so many other areas and why would a reorganization actually impact that trust that's been well established thank you for the opportunity to speak the energy that was applied to thinking rethinking how we could better use the resources that are ours to manage to address all the incoming opportunities to succeed was the the driver behind the proposed initial thinking of how we might consider restructuring to be better prepared to address the future and the the perception that somehow we would be diminishing what we are already the great things that are already being accomplished was misplaced and so we what we were trying to do was make sure that we could address what the new requirements would be with the resources that we have and bring the broader perspective that are available go across the laboratory to that focus thank you and i have a couple of other questions that are actually related more to this concern about the absorption of cybersecurity responsibilities and standard setting in the homeland security national security arena apart from miss roll and i wonder if any of the witnesses have some thoughts about as to the value of maintaining a somewhat independent standard setting for cybersecurity that isn't completely folded into a national security framework i'm thinking about in areas like health care and you know some things that concerns thank you and thank you for the opportunity to address that as a mcafee employee and to this end of a background of high performance computing and actually a founder of the georgia tech information security center i look at the development of cyber security standards as a collaborative effort and necessarily a collaborative effort with academia with private sector and with nist scientific guidance as has been mentioned by the other panelists and we look at that because we're up against an enemy an international enemy we're all connected and this threat we all face the same threat and this enemy is collaborative and this enemy works best so with if we were to have a and only government or a very regulatory standards body for cybersecurity you not only stifle the market and the innovation as we've mentioned but you set back the implementation of standards of stronger cybersecurity for two to three years and by the time we're able to meet those standards in the networks that keep the lights on we're three years behind what the market has developed to do better than the enemy and we lose that war so i feel strongly that cybersecurity standards that it needs to be a very collaborative act exercise with the private sector with academia with many experts from government with different agencies and certainly with the nist scientific guidance bringing crucial guidance into that process and does that mean in your view i mean does that mean that the coordination for that has to take place out of the white house or is there some sort of other interagency coordination at the federal level with private industry and academia that should be set up that isn't the whims of wanted ministrations focus or not so in the in the focus of how we set standards for cyber security not overall cyber security strategy but simply standard view i i would put here today and on behalf of the b s a is it's collaborative it's private sector and academic but with strong respect for an inclusion of that crucial role that news plays in the china example is a great point of bringing the science back into the equation because the science is what will help us win that war against the threat thank you very much i believe we have just commands the series of nine votes and i think it would be inhumane to ask the panel to wait that long to the vote so it is questions and look forward to your response dr landau you distinguish between security issues identity issues and privacy issues how does that affect the framework of of security standards that that we should be developing well up till now nist is focused on the security standards and any time that i was on the its path and we discussed addressing privacy standards nist had stayed very far away i'm delighted to hear that it's beginning to move in that direction and i do the committee to give mr even more authority to do so because i think there is a crying need as we see the accumulation of data in private hands and the need for for a good set of standards identity management is a very complicated issue and we've seen some fledgling efforts i think that has a very good understanding of the the difficulties of doing identity management and i'm sorry that nist was not pulled more into the discussions earlier this summer on a level it produced the levels of assurance document that that's part of the eight hundred series but it wasn't as involved as i think it ought to have been in the policy implications of making decisions about identity management systems for different levels of assurance and it's a place where i had said earlier i thought that nist should be providing more policy guidance and should be somewhat more independent so if i'm simplifying this incorrectly please correct me that there has been a fair amount of activity on the privacy side and that more activity is needed in the security side and more activity is needed on the privacy and identity side i'm not more and more activity is needed on the privacy side and i would say on the policy side on the policy side where it's closely allied to technical issues and one particular example of that is the identity management very good and i wanted to ask the panel as whoever wants to respond that you know we've been talking about standards better education programs so that people up and down the food chain but especially end users became more aware of what they could do with that help the overall privacy assurance security issues outside of standard setting so i'd like to say here that well i think a lot of the computer security division the one place that i think it has not handled things well is in outreach and in particular inability to find the information if you know the information is there and you look for it you can find it but if you're not determined it's somewhat hard to do and i would like to see better outreach better development of its web site more usable access to information what kinds of mechanisms could we use to push that out as opposed to having it as a pool that people reached into i know the nist had a program in which you did vice small business but it was a very a small program if i'm there there's the answer it's a very small program it doesn't reach very many people i think this should be doing that work and not the f b i with the ag extension or manufacturing estancia and sort of mechanism our model apply in this case i don't know what the ag extension model is well enough sorry mr starr is a come back to you yes we've been planning and working historically with our manufacturing extension partnership and with our new you tube video we're hoping to leverage that capability to get into the small manufacturers we also  corsets addressing all small businesses we were kind of hoping that maybe some of your newsletters might refer back to our you tube video and make it more available to your constituents as well as starts traditionally and  information security to your observation representative edwards we've we've pulled the collective knowledge and talents across multiple parts of industry and government and i think this is a clear case  where we need to do that again and are doing that so we have to differentiate differentiate between standards which nist is very good at and methods and best practice which are putting standards into action and there are some very good technical solutions that are coming multilaterally as i mentioned from government that move us from certification and accreditation we spent one point three one billion dollars on certification and accreditation last year many of those dollars should be spent with these new tools and techniques on continuous monitoring of information technology systems using all of the intelligence of all of our federal agencies and and commercial entities thank you work and doing it approaches ness though it's consistent with trying to figure out how do to walk that fine line because with a few exceptions some of which i talk about i testimony on the whole where nist has developmental information processing standards it has done so in an open transparent and collaborative way so that when phipps are in fact referenced for government use they are the product on the whole of working with the stakeholders the technology providers the users to making sure there is a standard that as much as possible conforms to general commercial practice and notably the government has its own needs those are take into account but that is a fine line and one that to the leadership of this committee on both sides of the aisle that did not happen i think we would be in a very different situation today if the computer security division and i think its work on the special eight hundred series i think it's work on a house i think good work where it needs to go would have been fundamentally different because it would have come out of an agency that had very specific law enforcement and regulatory mission stakes and the credibility of that work would have been dramatically differentiated so you're actually right it is a fine line but as we've pointed out the buenos does its business in a collaborative way means that on the whole all doesn't always get it perfect but on the whole the results are consistent with commercial goods commercial practice take into account stakeholders and to any of the suggestions that we want to respond to but in particular i would very much like you to respond to any it's not as simple as should c s t become a laboratory on its own but  support and concerns we're going to go back to the drawing board essentially and revisit what might make the best next proposal the idea of separating cybersecurity information technology is difficult for me to understand because of the intertwined nature of the two but the decision of course would be dr gallagher's not mine so it's there we have lots to consider many from the panel members which i greatly appreciate and others and we have a lot of rethinking and and of course the original goal which i want to go back to and make sure that we're have the full input from my staff which is where with we all started with just trying to get the staff input  back to revisiting the entire set up and we'll hopefully come out with something that labels us to move forward in the future meet new opportunities and challenges in a much more robust capable way thank you very much ms for lani and for the entire panel we will submit some additional written questions but you all have put a lot of work into the prepared written materials into preparing for the oral testimony and and some of you have traveled a decent distance to get here so at the risk of shortening up my thank yous in person at the table i want to give each of you who has something that you want to contribute to this discussion but you haven't had an opportunity to put that either in your oral testimony or you haven't asked that question please at this time for as much time as we have  if you want to add that last point this is your chance so i would just like to make a brief comment which i do have in my written testimony about the importance of usability work in security and i know that the computer security division has begun to work on this and i think it's an important new direction i'd like to see the committee strongly support that work because of course it increases security thank you thank you anyone else thank you one opportunity to talk a lot about cyber security and the threat and the scariness of it and the work that we need to do if you have awareness is raised before and that's a very positive point and i think there's a huge opportunity for nys to work with the national cybersecurity alliance part of this is in my written testimony but when you visualize that this group is what they do they take the message and they bring it to the street to the federal from the federal but to the state local tribal community level and to homeowners associations  cyber because it is going to control our entire way of life forward thank you very much anyone else thank you chairman but i'd like to put just a punctuation mark on my c n a comments earlier if we took just thirty percent of the c n a dollars that were spent and two thousand and eight that would be more than we spent on cybersecurity research and the entire year so i encourage the committees to focus legislatively on these processes as well and help government agent agencies and industry do base implementation of important new methods around continuous monitoring thank you very much mr starnes and since mr smith and i are at risk of missing some of these votes professor schneider mr ball hand in your indulgence and perhaps providing us comments and answering other inquiries  as we go i want to thank you all very very much for your testimony and no guarantees in life but i think there is a high probability that we will try to pitch in with relevant legislation to try to improve the situation and we look forward to your comment on that effort also so thank you very much that record will remain open for two weeks for additional statements from members and for answers to follow up questions  witnesses are excused and the hearing is now adjourned thank you