will now come to order good afternoon i'd like to welcome everyone to today's hearing on the cyber security activities of the national institute of standards and technology and the department of homeland security this is the third hearing the science and technology committee has held on this very very important issue the prior hearings discussed the research and development needs for improved cyber security and federal agencies responses to recommendations made in the cyber space policy review all of us in both public and private sectors rely on my team networks to manage great many things ranging from online bank accounts to the power grid with this increased reliance on networks we have become more sensitive to the security of these networks to support cyber security efforts the prior administration implemented an estimated forty billion dollar comprehensive national cybersecurity initiative in january of two thousand and eight this year alone d h s and nist have requested over five hundred million dollars for their cyber security efforts with an additional three hundred forty million dollars requested for research through the networking and information technology research and development program even by government standards almost eight hundred fifty million dollars is a fair amount of money despite the substantial funding levels and many hours spent by federal employees on this issue assessment remains the same overall our cyber security remains core the administration's cybersecurity policy review emphasized the recommendations made in prior reports first bolster cyber security operations protecting the federal network systems second improve interagency and private sector coordination third modernize and coordinate the research agenda and fourth and hance public education on cyber security this committee wants to understand the impediments that have prevented similar recommendations from being successfully implemented in the past i believe one key recommendation made in the cybersecurity cyber space policy review is the need for objectives and metrics to accurately measure cyber security performance the development of these metrics would provide a base from which we could improve program assessment budgeting research and development prioritization and strategic planning this recommendation mirror th subcommittee's belief that agency should be accountable for real world outcomes rather than outputs measured in terms of money spent projects supported and interagency meetings which is how the agencies categorized their success at a subcommittee hearing last week as is generally the case we have many recommendations but the devil is in the details i hope that in addition to making suggestions on this hearings issues our witnesses can tell us what is required to implement their recommendations i want to thank our witnesses for appearing before a stay and now i'd like to recognize my friend and colleague mr smith from nebraska for his opening statement and thank you mr chairman for calling the hearing today on  cybersecurity the third in a series of hearings held by the committee this month by the committee's jurisdiction on cybersecurity issues is generally limited to agencies t h s and nist because of their broad roles and responsibilities the activities of both agencies directly impact not only the entire federal government but also many private sector computer security stakeholders accordingly we have the benefit of being able to examine cybersecurity through a very broad lens and the opportunity to influence the debate on the government's actions in the most important pressing policy area to this and i would like to briefly outline what i see as the key high level outstanding questions which should directly what should drive the direction of cybersecurity policy for this committee and congress as we do go forward first as we explored last week with respect to protection of government networks are we confident the reported thirty billion dollar effort comprising the administration's comprehensive national cybersecurity initiative the n c i is appropriately focused and will d h s einstein program provide effective and lasting security if not one of the best alternatives to this investment and focus area and perhaps more importantly how do we do a better job of measuring cybersecurity so we can more systematically evaluate technology and policy options and perhaps even fit in here in between votes but the largest outstanding questions however revolve around the nature of the relationship between the government and the private sector and efforts to secure non government systems stakeholders on all sides placed a great deal of emphasis on strengthening public private partnerships to secure critical infrastructure beyond the well established goals of improving information sharing and policy dialogue precise features of the desired partnerships as well as the scope of what constitutes a critical critical infrastructure have remained largely undefined does this entails a new regulatory regime a d h s s or nest liability protections or incentives for private sector actors or some combination thereof are there other innovative partnership models which could be explored these are all weighty questions which will not be answered at this hearing or in the immediate future but i believe they are required to careful attention of congress going forward as we consider legislative options to improve network security i think the chairman for assembling an excellent panel today thank you for being here and i look forward to productive discussion thank you mr smith and as you all probably notice from the bells votes have been called this will be a substantial series of votes i want to apologize to the witnesses and all the participants here for the inconvenience but i just want to note that these votes are called without consideration any of the individual members and rarely of any individual vigil committee what i intend to do is to proceed to introduce the witnesses and we may be able to get through the testimony of one or two witnesses before mr smith and i and the other members who come here will have to leave to vote and then we will recess this hearing until after the last information security issues at the government accountability office mr mark bregman is the executive vice president and chief technology officer of symantec corp mr scart charney is the corporate vice president of microsoft's trustworthy computer group and mr jim harper is the director of information policy studies at the cato institute you each will have five minutes for your spoken testimony your written testimony will be included in the record in its entirety and when you complete all of your testimony we will start with questions and at that point each member will have five minutes to ask questions  proceed chairman route ranking member smith thank you for the opportunity to testify today's hearing on the cyber security activities performed by the department of homeland security and the national institute of standards and technology federal laws and policy have assigned important roles and responsibilities to d h s s and mess with securing computer systems and networks d h s s charge of coordinating the protection of cyber critical infrastructures much of which is owned by the private sector and secur its own computer systems while nist is responsible for developing standards and guidelines for implementing security controls over computer systems and information today i will describe cyber security efforts at  nest including partnership activities with the private sector and the use of cybersecurity performance really met metrics in the federal government over the past three years g a o has consistently reported that  has yet to fully satisfy its key responsibilities including those for coordinating and protection of cyber critical infrastructures and serving as a primary federal focal point for cyber security efforts while the department has achieved some successes shortcomings like in key areas including bolstering sivers analysis and warning capabilities improving the security of infrastructure control systems strengthening its ability to help  recovery from internet disruptions reducing organizational inefficiencies completing actions identified during cyber exercises and securing internal information systems we have made about ninety recommendations to assist d h us in addressing these shortcomings the department has implemented some of our recommendations but still has not fully satisfied most of them and thus needs to take further action to address these areas pursuant to its responsibilities under the federal information security management act fiz my nist has developed a suite of mandatory standards and guidelines that are intended to assist agencies in developing and implementing information security programs and in  managing risk to agency operations and assets in addition nist has worked with both public and private sector entities to enhance its cybersecurity products the resulting guidance and tools provided by nist serve as important resources that federal agencies can apply to their information security programs mr chairman as the old adage a goes what gets measured gets done and so it is with the security measures that agencies use to report on their progress implementing the requirements of his money according to the performance metrics established by the office of management and budget agency's generally reported increasing compliance in implementing key cybersecurity control activities however g a o and agency i g s continue to report significant weaknesses in controls this dichotomy exists in part because the only to be defined metrics generally measure whether or not a control activity has been implemented not how well it has been implemented as a result reported much tracks may not provide a complete picture of the agency's cyber security posture providing information on the effectiveness of controls and processes could further enhance its usefulness of the data for management and oversight of agency information security programs in summary mr chairman d h us has not fully satisfied its cybersecurity responsibilities and needs to take further action to address shortcomings in several areas including its efforts to coordinate with the private sector to assure protection of our nation's cyber critical infrastructure developed a significant number of standards and guidelines for information security and continues to assist organizations in implementing security controls and wildness roles is so developed guidance it remains the responsibility of federal agencies to effectively implement and sustain security over their systems developing and using metrics that measure how well agencies implement important controls can contribute to increased focus on the effect of federal information security mr chairman this concludes my opening statement and i'll be happy to answer questions at the appropriate time thank you very much mr walsh is and i think at this point i'm going to recess the hearing for  both prudential reasons we have plenty of time to get to the floor but also i think that this is an important set of topics and i'd hate for any of the members of congress or the staff  to be watching the clock ticking down rather than paying attention to these very very important topics so at this point we will adjourn until after the last vote i'm sorry we will recess until after this hearing will come back to order i thank everyone for their forbearance mr bregman please proceed chairman will ranking member smith members of the committee good afternoon and thank you for the opportunity to testify  cyber security efforts at nist and h s as a global information security leader semantic protects more people from online threats than anyone in the world by assuring the security availability and integrity of their information  gordon california fourth largest software company with operations in forty countries we've ploy over eighteen thousand people including several which are located in the chairman's district in beaverton and i want to thank you for your support the symantec releases an annual internet security threat report which is a comprehensive analysis of information security threat activity that analyzes network based threats on consumers and business we compile the data the our global intelligence network which consists of over forty thousand sensors monitoring computer activity in one hundred eighty countries so in short if there's a class of threat on the internet aware of it this year's report found that while vulnerabilities continue increase dramatically the scope and size of sophistication of cyber attacks is also growing dramatically they're becoming much more targeted and more dangerous to our nation's critical infrastructure and our economic security the most common type of attack during this period is targeting our government's critical infrastructure was denial of service attacks common accounting for about half of the top ten threats in two thousand and eight dollars service attacks are a threat to government critical infrastructure since the purpose of such attacks is to disrupt the availability of high profile way sites and other network services and render them inaccessible to users and employees these kind of attacks are often associated with political protests and were used to disrupt the estonian government web sites in two thousand and seven as well as the georgian government web sites that were rendered inaccessible during the georgia russia conflict in two thousand and eight but denial of service attacks are just one type of cyber threat that affects government and critical infrastructure as the sixty day cyber of you right points out cyber security risks posed some of the most serious economic and national security challenges of the twenty first century and we applaud the president's commitment to take action on cybersecurity we hope that the coordinator will be elevated within the white house to have the appropriate decision making and budget authority necessary to set strategic direction for the nation to empower our government agencies and private sector to do their mission in a coordinated and balanced way and take a more prominent role in international cyber policy  security isn't a civilian or military problem or even a government problem it's a universal problem all networks military government civilian and commercial are based on the same computers same networking hardware technology same internet protocols many the same software packages were all the target of the same attack tools and tactics in addition since most of the nation's critical i t infrastructure is in commercial hands hackers consistently go after both military and civilian targets we all have the same security challenges so solutions must be shared i want to underscore today that cyber security is a shared government and private sector responsibility we need transparent and accountable government processes as well as cutting age government cybersecurity programs to improve security for everybody so that in mind let me turn to what the h s and mistes respective roles and responsibilities are or could be in cybersecurity we've seen a marked improvement in the department of homeland security in their engagement with the private sector under the national infrastructure protection protection plan construct the h s is the lead department for engaging the i t sector and sematic another private stakeholders through the sector coordinating councils have provided an input to the h s on a number of the comprehensive national cyber initiative projects we've been engaged with the h s and several other cyber policy initiatives including resiliency incentives metrics risk assessment information sharing and cyber exercises there are few areas in which we believe more can continue to be done by the department in private sector jointly including establishing a frontline cyber defense seeking ways to defend against threats to the supply chain and taking cybersecurity the next level through workforce education in cyberspace we have a very rich base from the commercial sector this is quite different from other historic government models for addressing frontline national defense where there is much of the solution comes from government or the defense industrial base the us government could benefit greatly if the private cyber sector cyber security sector were brought in more consistently to assist in the development of cyber security solutions one example was mentioned earlier where more input from the private sector could be helpful to  s would be in project einstein to date the private sector has not been formally asked to participate in d h s is global supply chain initiative despite the fact that much of the supply chain the government cares about is in the hands of private sector if more information is not shared by the government on the threats or risks that government sees then how can the private sector do more to protect against these threats and risks so mantic is a co founder of safe code a nonprofit organization created for companies to share software assurance and supply chain best practices we strongly urge the department homeland security department defense nist and other agencies to work closely with safe code and its member companies to work collaboratively in addressing supply chain and software assurance  to also taken a lead role in education awareness for sample it's a sponsor an active participant in the national cybersecurity alliance and stay safe online dot gov purpose of and c s a is the education consumers k twelve higher education small business on how to protect themselves and their data in cyber infrastructure the h s is also working with n c s a and other stakeholders develop a plan for the development of retention of train cybersecurity professional workforce within the government we serve certainly support these d j s has a role to play in the area of cybersecurity r and d we believe that much of the work completed by the s and t director is very important and that r and d determined to not be commercially viable should be funded by the government respectfully ask the u s government gave the private sector more on the r and d collectively to collaborate on common problems given this committee's jurisdiction i'd like to comment on this mission in cybersecurity it's very important through the promotion of national standards in particular the work miss does with federal agencies industry and academia to research develop and deploy information security standards and technologies is critical as these standards become more important this role and responsibility will continue to grow and with that we believe  this funding level is not adequate and should be increased this is played a leading role in the development of physical guidelines and federal information processing standards and as congress looks to reform fresno will look to nist to for appropriate guidance and standards magic is worked closely with nist on crime common criteria for several years and we fully support common criteria because it offers many advantages including international certification framework for products as the lead technical standards organization for the federal government and this has a critical role to play in revising the production profiles and improving problem criteria and we ask that ms become an active member of nih apple again and would like to see them play an even more active role in other international consensus standards bodies and organization is contributed to raising the quality of federal information security by promoting operational norms and by helping agencies to find models security processes experience shows that federal standards aligned with established commercial practices generally succeed whereas unique government only standards such as the government open systems interconnection profile have achieved poor results whether rigid or flexible standards must be appropriate for the activities being regulated they must be mindful of the market drivers credible federal mandates must strike a balance between ideal and practical standards including setting reasonable expectations for compliance in the huge base of installed federal system and this guideline strike a balance between general rules of thumb for all agencies and local knowledge and expertise of on the ground federal officials however fixed inflexible process standards can't easily accommodate these situations so in summary the constantly changing cyber threat landscape and its reliance on human activity coupled with a rapidly changing technology makes it essential that security doctrine remains flexible i strongly recommend that nist also engage with the private sector to include development of an independent supply chain verification verification process that will allow us to validate software integrity focusing more on how technology is developed and less on where it is developed locally the near term action plan within the president's cyber view requires establishment of cybersecurity performance metrics and this is another area that's ripe with opportunity we believe this should be a key driver of this activity working with the private sector and other agencies in addition to cybersecurity metrics and the should consider collaborating more the private sector in other areas such as cloud computing architecture and standards ascap and other data taxonomy standards health i t and smart grid architecture with security standards built in from the beginning we also want to stress the importance of nist working with private sector to ensure the agreed upon standards protocols and requirements are rolled out with reasonable time lines and milestones to meet realistic commercial product development roadmaps in conclusion we believe both the department of homeland security and this have done much to carry the cyber torch forward in many areas however there is much work still to be done and much more collaboration th needs to take place with the private sector we think committed to working with the administration in congress to improve cybersecurity and i like to thank you chairman will for allowing me the opportunity to testify before the members of this committee thank you very much mr bregman mr chine please proceed thank you chairman will thank the members smith members of the subcommittee thank you for the opportunity to appear today at this important hearing on cyber security my name is scott charney i'm the corporate vice president for trustworthy computing at microsoft cyberspace today we are locked in an escalating and sometimes hidden conflict cyber threats have grown in sophistication expanding from opportunistic viruses and worms that were once disruptive and sometimes damaging to include very targeted stealthy and persistent attacks in the information age any individual can engage in activities formally limited to nation states and any nation with guard lists of traditional measures of power and sophistication to gain economic  military advantage through cyber programs the lack of identity for hardware software and people on the internet also makes it difficult to determine the source of an attack understanding the sources and motivations of attacks is essential to ensuring the appropriateness of response absent strong attribution abilities which balance security and privacy international and national strategies to deter cyber attacks will not succeed attribution can and must be a top priority to improve cyberspace security moving forward the challenge for the government today is that it must balance tool and often interrelated roles to manage cyber threats affectively the government is responsible for protecting public safety and national security and it is also responsible managing a large i t infrastructure i support the near term action plan and the recently released white house sixty day review and specifically action to prepare an updated national strategy to secure the information and communications infrastructure just as we need an updated national strategy to ensure the nation's cyber security the government must also implement an effective model for managing its own cyber security such a model would include a centrally managed horizontal security function to provide a foundation of government wide policy standards and oversight and because each federal agency has its own mission customers partners and threats there must also be vertical security functions resident in each agency to ensure that agency specific missions are accomplished and agency specific risk managed appropriately let's turn to the more specific roles for d h s and nest the hybrid model i just outlined could be applied more effectively to the federal enterprise in this implementation d h s s and this would provide the horizontal centrally manage cybersecurity functions and individual agencies would have vertical functions to manage their unique gress simply stated that the parliament of homeland security should set security control policy articulating minimum six  cybersecurity baselines goals and outcomes should also develop processes to exchange and watched the implementation of best practices so that agencies can more quickly more quickly achieve higher levels of security when issue create government wide standards to help agencies meet the security control policy set by d h s to realize the value created by analyzing data horizontally the h s and this must have the right data they must analyze that data and the data must drive action this will require enhanced cyber secure the monitoring audit and analytics to gain valuable insights on the real time how of the federal enterprise and then able agile actions to mitigate and respond to incidents agency should continue to have the responsibility and accountability for creating documented information security programs assessing their rest implementing effective management controls and responding to agency and since this is the vertical function in the hybrid model in conclusion as long as threats evolve so must our efforts to protect against that technology alone will not create the trust necessary just secure cyberspace technological innovation must be aligned with social political economic and id forces to enable change microsoft helps drive and shape these forces with partners in the ecosystem to create a safer more trusted internet the united states must similarly drive forward with a clear vision and holistic information age strategies to combat threats to national and economic security and to public safety thank you again chairman moved for providing me the opportunity to testify before the distinguished members of the subcommittee on technology and innovation and i'm happy to answer any questions you may have thank you very much mr charney mr harper please proceed thank you thank you very much chairman will thank you ranking member smith for having me here to testify on cybersecurity activities a d h s n s today i welcome your oversight and your focus on results rather than outputs such as dollars spent this is very important work but not very easy as i tried to illustrate in my written submission talking about cybersecurity is like talking about securing all the things we prize cyber security is many different problems and would be a mistake to believe that a discrete number of activities or discrete set of government policies could solve all of them i'm concerned that in the cyber security area there is a common practice of threat exaggeration and that that could buffalo the congress to adopt policies that are not balanced and ultimately waste resources frustrate innovation and threaten privacy and civil liberties yesterday i came across an article in the boston review called cyber scare on this very topic and if it would please you i'd be happy to submit it for the record i was pleased by the way also to see that my my  colleagues didn't engage in exaggeration here and spoke about cyber security seriously without hyping threats i'd like to feature one of the cyber security policy that i think has been lost in some of the cyber terrorism cyber warfare cook and that is the policy of keeping critical infrastructure off the public internet this policy is a proven success but some policymakers i believe have ignored it thinking that all resources should be on the public internet or managed over the public internet so i encourage you and your colleagues to keep in mind the policy of keeping the true critical infrastructure off the net that takes care of the lion's share of many security problems as i said cyber security society wide is many many different problems and i think your goal in congress should not be to solve cybersecurity but to determine the systems the social and legal systems that will best discover and propagate good security technology in practices you might think of a of a hierarchy of legal mechanisms that congress could consider for advancing that goal starting with contracts considering also tort liability and arriving last at prescriptive regulation because the government is a large consumer of technology it is a it is well positioned to positively affect the cybersecurity ecology and the standards are integral to that process as a representative and work at the cato institute i'd like to see the federal government a smaller purchaser of things but while it is a large market actor it's buying decisions can help the market for secure for secure technology products advanced one way obviously is by setting high security standards in its purchasing a second is to consider pushing technology providers to accept the risk of loss when their products are not sufficiently secure there is a market failure in technology when in secure technology harms networks or harms other users i wouldn't lead to regulating in these cases though especially because none of us know efficiently and effectively how to solve these problems nobody knows what a regulation would say for getting buyers and sellers of technology to internalize risks i think liability should be the preferred preferred mechanism liability is an open ended process of discovery as courts discover the legal doctrines that will help them prevent cyber harms buyers and sellers of technology will have to discover the technologies and practices that prevent cyber harms concerns for me arise when the government steps out of its role as a market participant and becomes a market dominator regulator a partner or investor with private sector entities the standards are difficult things as you and my co panelists know well when done right they are extraordinarily valuable and that can't be overstated but when done wrong they can distort markets or threaten privacy and civil liberties i briefly note in my written testimony the potential concern with a standard like fifty to one and one of the witnesses in your earlier hearings mention that tips to a wanted identity standard for federal employees and contractors was becoming a national rather than a government standard i work extensively on national id issues and i'm concerned with the idea of a single standard for identification throughout the country i'm suspicious of various public private partnerships in the cybersecurity area and  elsewhere they can be valuable in threat information sharing is valuable but they can also suppress competition they can foster security monoculture and immunize parties from liability and as i mentioned before threaten privacy and civil liberties i will conclude my remarks there and thank you again for having this hearing you're looking at important issues in a careful way and i appreciate that thank you again thank you very much mr harper and at this point we'll open for our first round of questions well i guess i'll start one of the things about the metrics that have been developed at least by all of the for the business reporting purposes is that the metrics themselves probably served a useful purpose when they were first developed and this was several years ago the ones that they have developed are primarily implementation related metrics and determine whether or not a control has been activated and implemented when they were first a valve several years ago many of the federal agencies were not performing some very basic security controls and so over the intervening years as agencies increasingly perform these control activities it's natural to start taking a look at these metrics and see do we need to make them evolve as well is there a need to continue to report whether or not agencies are implementing specific controls when they're all up in the ninety plus percent tile of performing these controls over their systems so now it's important to look well how well are these agencies implementing these controls and looking at different types of measures we have in a agent that's ongoing right now looking at how leading organizations develop and use  metrics to gauge and monitor their information security activities and we'll be issuing a report later on this summer about that particular topic but one thing that we have noted previously is that it's probably time to start looking to see how well agencies and are actually implementing controls and the effectiveness of their control activities rather than just mere implementation of a specific control activity and several of you refer to having a unified standard for set of standards for the federal government that is we currently have a division between defense applications and civilian governmental applications and i just want to confirm that that's a consensus view of the panel that the division between d o d and n s a on the one hand and v h s and nest on the other is is maybe one rooted in jurisdiction but not rooted in utility or the sense of the field  yeah i would agree with that i mean as a co chair of the c s i s commission on cyber security one of the things we noted that there were historical reasons in the past why there was a clear delineation between the national security world and the civilian world but to some extent and cyber networks a lot of these things tend to motor together and when you're trying to devise the best security practices you want to take all of your great capabilities and knowledge and bring that together and have holistic programs in cybersecurity so bringing them together is helpful and i'd like to walk that over a little bit further getting to the civilian non governmental sector my understanding is that there are different cyber security standards for different fields whether you're dealing with health care a banking and these have developed over time would there be the utility in developing consensus standards for cyber security  possible to better develop cybersecurity standards for that field at this point in time you know i actually think it is possible one of the things that we have done at microsoft is we looked at the different regulations that impose certain security requirements on information systems so you have things like ram leach gladly for financial data you have p c i which is the credit card standards for securing credit card data for health care data it turns out most of these regulations actually promote the same concepts in terms of the framework which is reasonable security controls based on traditional risk management principles so it does we look at all those laws and then we map the controls that are necessary to an international standard  standard two seven zero zero one by the international standards organization is a standard for controls around the systems and we've actually gotten iso certification for a lot one of our largest properties that works so i think the short answer is there is a lot of similarity in these regimes having a unified standard that people can map to is a good and healthy thing and the other nice thing of course is the rights of all those standards can always be modified to address field be a logical place to begin working on a consensus private sector standards in any one of the past i think so but i think it has to be done in collaboration with private sector yes i think it is a logical federal developed standards should be available to the private sector and then perhaps produced in collaboration with the private sector that there is a touch of concern though that the federal government as a large market actor would drive standards into the into the marketplace that imported into the marketplace they have to stand go through a different series of tests for private adoption i think what we're working on here is the divide between the public sector and the private sector and nist traditionally has played international standards organisations with members of industry so if you're looking at standards that would apply more broadly than the government there are four that already exist to do that the government and industry participates in that the mechanism is there to get through that process thank you very much mr smith recognized for five minutes thank you mr chairman mr harper suggested in his testimony that the critical infrastructure vulnerabilities should be addressed by physically sorry i think it's impractical in many cases because it's one thing in the realm of d o d or the intelligence community to operate in a separate environment but in many cases other parts of government have to interact with citizenry they have to interact with private sector in the course of their normal operations and the the challenge in cybersecurity is as soon as i connect my perhaps well defended well defined network to someone else i open myself up to vulnerabilities that may be present in the other components that i don't control and so there's a real risk in isolating government function in the attempt to achieve this security through isolation and becoming much less effective so i think the real challenge is finding ways to develop security and secure the cyber infrastructure even in a world in which it isn't an isolated totally controlled environment for the  government i would echo those points and if you think about some of the involving models like the smart grid for example where people's homes can communicate intelligent power consumption information to the power grid so that they can do powered appropriate times of feedback back into bread i don't know how you do that by creating a power infrastructure that's isolated from all the systems that need to connect to it i think the trend of these private critical infrastructure is basically becoming a internet enabled is because of the huge business imperative in fish and sea cost drivers and other things that really critical to the success of these new technologies and it's our experience too in the reviews that we've done at the tennessee valley authority where we looked at the control systems and the security of the control systems at the peers at the trend is to go to more ip based type of systems to run these control systems now while that is it really helps and serves additional benefits to the company and able to do to enable such control protocols but it also raises the risk because the risk associated with running those ip based systems can now expand to control system so agencies need to make sure that they assess those risks and take the appropriate steps to secure against mitigate those risks but is certainly the benefits and the trend seems to be going more towards going to  an ip ip based type of network and structure which are i would anticipate these criticisms of what i said and they're not they're not wrong they're not unfair i would i would in the way i thought about it was that criticality should be a very very tightly circumscribed adjective and dealt with dealt with it a little bit in my in my written testimony that i wouldn't call myself an expert criticality should be when there is an immediate and proximate danger to life and health from the loss of an asset and that's under basically definition that the type of work done there's a lot of history behind it that that didn't go into my testimony which is why there are look there's a lot of stuff out there that's referred to as critical infrastructure that i would not but i  again something that would immediately injure life and health and proximately so the example of an electrical grid going down it would it could kill people so in a hospital for example to lose electric power for an hour people run on a heart lung device that  think it's not proximate because what you do for a likely risk like that is you put electrical infrastructure at the hospital that would take care of things when the broader infrastructure went down so again that these are these are fair comments and i would i think the critical infrastructure should be very tightly defined to us to a small universe of assets ok thank you and another one we heard that the liability is preferable to regulation as a tool for we have repeatedly said that you have to think about different ways to motivate the markets to do the right thing and there are many ways to do that everything from and send to regulation and liability the biggest challenge in the software industry i believe is that software is extremely complex and is not entirely clear what the reasonable practice would be in developing security today and how you could apply them uniformly in the spectrum of people who make software so it's not just about large companies i mean one of the great things about the internet is it creates this incredible innovative environment where people in their garage can develop software and distributed around the globe and this is led to a lot of great innovative technologies and i don't know how they survive under that's laden with a lot of upfront costs having said that i think there are better ways to get there one of the things that we have been active proponents of reforming common criteria which is the method by which the government of value waits products for security and that then affects purchasing acquisitions in the government and i think if the government wants to drive better security practices one of the ways to do that is to use common cry to a flaw of acquisition regulations to achieve that result i think that drives a much more effective and efficient process it also allows still innovative and low barrier to entry and by and i would echo chinese remarks that add to other things i think not only a software very complex but any software that is delivered by a supplier becomes part of an even more complex integrated solution and in most cases where we've seen a vulnerability of system level it's traceable to configuration that is outside of the core of any given product but it's the interaction in the customer's environment or in the user's environment which opens up the vulnerabilities that's something it's very hard to legislate liability around without putting tremendous constraints on what people are willing to supply and related to that i think it was also at going  o chinese remarks liability as a way to control this will stifle a lot of the innovation which is what we need in order to get ahead of the threat and so i would be fearful that if liability were to be the tool primarily used to and improve security would actually see the opposite effect retrenchment on the part of suppliers and fear to try innovative new solutions maybe i hear you saying he would not advocate liability in addition to regulation that's correct yes mr will use and will he can you elaborate on your findings on the impact of such things in a couple areas one regarding like the common criteria in the use of that we did a review several years ago looking at the national information assurance program or not and which it's a program which now and n s a at that time establishing certified laboratories to examine the security controls that were designed into these products one of the problems that we identified in challenges is was just the length of time that it took these laboratories to go through and evaluate the security of these products and many cases some of the vendors indicated that by the time it went through the process the technology and applications were already obsolete there are new newer versions out there so to implement that we're going to need to have some sort of measure and mechanism that will allow speedy and a quicker response time to evaluate such products another issue is just with the the risk involved  actually there is also another mechanism that government can use in addition to providing incentives is also through its procurement policy you know the government procures sixty seventy billion dollars worth of products a year it's using that ability and it's the requirements that it needs or security requirements into the products that it requires can help maybe move markets into an area where they implement security or design security into their products more readily thank you thank comment on whether there is integral problems to the way that we have tried to structure our cyber security program at the federal  level tread lightly here but i think one of the issues that may be resolved and i guess going as we go forward with the new official that will be the cyber security official in the white house is one of the concerns as to what is going to be their authorities and what control they have over budge that's and strategy and what will be their levers of power to affect change and i don't know how that excess protect and that will be just one of the challenges and trying to make sure that those a difficult field with a lot of responsibility and perhaps not enough line authority and budget to accomplish the mission or the multiple missions and will depend upon what their role and responsibilities are  bregman do you have anything to add to this i would agree with that i think appropriate decision making and budget authority is going to be necessary because of key part of the role is helping coordinate the strategic direction across the various parts of government and also coordinating better on an international front one of the challenges is this is not a problem that occurs just within our own borders it's borderless and so better coordination globally is going to be an important part of this as well thank you several of you referred to the importance of public private partnerships and coordinating with the private sector what in our structure today is not creating the kinds of public partner public private partnerships that we need and what kind of incentives should we try to build and you know since the early ninety's we've been talking about this public private partnership and it was really reflection of the fact that the private sector designs deploys and maintains about ninety percent of the critical infrastructure and so governments in an interesting situation here unlike things like nuclear weapons where they had both responsibility and control here they have responsibility for public safety and national security but they don't for all the assets to be protected or maintain and so the idea of a partnership is the right idea i think it got off on the wrong foot in large part early efforts at partnership were focused on information sharing there was a lot of discussion that industry and government should share information about threats and vulnerabilities the problem is information sharing is not an objective it's a tool you share information so you can do something sharing information just for the sake of sharing information does it make any operational change that makes security better so the first problem is the wrong focus focus on sharing instead of action the second thing is that the government has been concerned for understandable reasons about not playing and picking favorites in the marketplace so it often took the view that it has to share with everyone or no one and of course when you share with everyone when you share a lot of information about vulnerabilities threats and risk too broadly you actually make the problem worse and if you share with no one then there's nothing and so i think in addition to focusing on what information to share that is how is this information actionable the next question is who is it actionable by and we have to share it with the organizations people companies whatever who can do something with the information specifically and not worry so much about sharing with everyone or no one because that's not a productive model so i missed trying to is one of your criticisms of the current advisory committees and coordinating committees that they are mechanisms for sharing information and that that becomes an end goal rather than a tool for accomplishing mission objectives that is correct although there has been an effort in recent times to refocus on more operational security issues and share actionable information but there was a long history of having the wrong focus thank you i might have a couple more questions but at this time i'm going to yield to my colleague mr smith five minutes if mr trani or others would still like to maybe elaborate on what exactly the partnership would look like i mean i think you started down the down that track but obviously it can be difficult to define i know that sometimes partnerships are overstated here here on the hill but if you could elaborate sure i'd be delighted to in addition to the miss focus i don't think the partnership ever had the right philosophical underpinnings here's the way i see the problem markets actually do deliver some level of security customers demand it and markets deliver it governments need a level of security for public safety and national security that often exceeds what the market will provide markets are not designed to do national security you cannot make a market case for the cold war in those situations the government steps in and does things it seems to me that the proper basis of a partnership is to figure out how much security you want to get from the market through its natural proclivit and a little more because companies do have a sense of corporate responsibility if you care about public safety and national security so they do a little more than the markets would require then you have to figure out what the government thinks it really needs and the key is filling the gap between what the market will provide and what the government sees as necessary and then there are a lot of ways to fill that gap acquisition regulations are an example to drive the market in a particular direction regulations standardization there are many ways to fill the gap tax incentives so the real key and i think the basis of the partnership is to focus on meeting the requirements that that span between where markets are and what government at figures out the right way to incentivize the right behaviors so the products take you where you want to go anyone else just briefly comment on it some more i think the question of public private partnerships i agree in large part with what mr carney said that that partnerships formed up to share information as if that was the goal the problem is is goal setting and then then asking what achieve that goal and i think it has been the idea little to have a public private partnership in an area i have a relative amount of experience homeland security issues the data sharing connect the dots and nobody knows exactly what that means it's a it's a more difficult problem i would prefer to see the government play the role of partner that you see in security of houses and buildings in a given city the primary responsibility is on the holder of private infrastructure to secure the house with locks on the windows and doors and when something really goes wrong and there's criminal behavior afoot the police are called or if the police have information about what's afoot they can contact the community that's a public private partnership that i think is a success but putting together programs to try to describe that don't really work what works is when the government stays in it's law enforcement and national security role for the most part and the private sector for the most part takes the role of securing its own infrastructure that doesn't mean they can't work together but i don't think the focus has to be on them working together to improve security works with them separate focus was on threats and intrusions and perhaps that's not enough of a focus now would you concur pat i think we see a very very rapidly evolving threat landscape and einstein was developed with you know somewhat looking at the then current threat landscape and so given the long lead time and point lead time it's not taking advantage of the best practice best technologies that are currently available  in the private sector and i think that's an area where again private sector working together with government could do a much better job of looking forward anticipating things and being closer to the leading edge of protection as opposed to looking backward at what the previous threats were and then going through a rather cumbersome development process to deploy something which is inadequate when it's doing ok thank you several of you have referred to the importance of setting the components that we need to put together to develop a strategy or a means of accomplishing a clear set of  goals it seems to me there are two separate issues and it comes back to a comment in my testimony about the government as a policy and the government as a large ip enterprise so part of the goal of developing a comprehensive strategy is recognizing that the way cyberspace works today there are some very interesting challenges about how you security and also respond to answer that give you some like classic example that have been widespread reports in the media about attacks on u s defense department systems there's a lot of interesting questions about what constitutes cyber warfare when and you shoot back what's it mean to do collateral damage on the internet these are hard policy questions and it's even an interesting question of whether or not you want to respond in a cyber event in a cyber way or impose a trade sanctions you know because cyberspace of course ties all our econom together just like the ties all our systems together and so the government has to think very holistically about diplomatic efforts intelligence efforts military efforts economic efforts and law enforcement efforts and integrate them into a strategy and set norms because right now around the world we now have norms and certain behaviors like proliferation of weapons of mass destruction proliferation of nuclear materials we don't even have norms on what constitutes appropriate cyber conduct around the world and as a result of that countries internationally haven't developed the processes procedures and strategies to deal with these issues because the internet is sovereign agnostic even though sovereignty is very much well and a l and so in the policy space this is one of the reasons why the commission recommended the advisor has to be at the white house and could not sit in any one agency because thinking about this problem comprehensively means that the government has to think about all the tools  its arsenal and how to implement those one government on the i t infrastructure protection side that's when you get into very specific controls where you want security controls and in place and i would  echo the comments made earlier about the need to actually test the efficacy of those controls make sure they're doing what you think they're doing and making sure they're always current and as i said there are international standards now as well as regulations that require controls be put in place so to some extent the more i think about some of these issues we're reaching the point at least in the network enterprise where the full the fee is right and we're getting to the point of we need to execute well and we need to focus on execution and that requires being rigorous about putting your policies in place testing your controls having audits done whether they're in total self certification to external to make sure you're achieving your desired levels of security well i think we've surfaced a lot of concerns about the lack of a dearth of rules of the road for the internet but to try and your reference to  accords about w m d and so on brings to mind that we've been able to work at least try to work on rules for warfare for the whole four thousand years at least and the early versions of the internet are at  most thirty years old and cyberspace probably is more like in the teens than anything else so in essence we are here all together at the inception and some of the decisions we we make will  and commentary that this process should in plute private industry to a large extent can you give us your best analysis of the research that is currently being done at either nist or d h s i think what we think about research in the cybersecurity space there are several different objectives there obviously is the primary objective of the research itself and the outcome of that research and with a goal one would think of ultimately impacting technologies  products which can be delivered and implemented and so that's an area where linking the research activities with the industrial base is important because to exploit them there's an ad to be some commercialization that takes place the other dimension of research is that research spending research and setting the research agenda is a very good way to stimulate alongside investment both by private sector and kept intellectual capital investment within the academic world and i think one of the things we need to improve our cyber security posture is a larger qadri of expertise at all levels people who can be the next generation leading researchers but also practitioners in government and in private sector and carefully aligning the research agenda with the interests of the h s nest and the private sector and using that to create interest within the academic community will draw more i think from more students more people into that area in that field and create a much larger community of expertise will shows in or anyone else anything to add to the research agenda we need to have a strategy right we haven't looked at the but about four years ago we did a review over cybersecurity research and development and looking at the night her and the group that was responsible for coming up with the plan for conducting cybersecurity within the federal government and we found that while there was some overall goals and objectives they were identified there really wasn't a clear concise plan on how to conduct and how to perform and fun which particular projects and so making research of all stripes or value research that benefits industry really is subsidy and i love to i want research done i think everybody does but research that's funded by industry goes then into the price of products and is paid for by the users of the security technologies rather than taxpayers many of which don't use the internet and live perfectly good lives without it we should try yes it does actually don't disagree and earlier i said the philosophy of the partnership should be that the government doesn't do what the markets are already delivering but do something else that's true in research too so industry does a lot of research and we do research that we can monetize and commercialize and there's other very hard research that we can't do because there's no economic model that permits it remember the internet was a government research effort which has revolutionized the world that came out of so i think it's really important that the government as part of its strategy do two things one invest in the research that that actually is vance's the overall strategy that we've talked about to create a more secure environment but also do the things that industry won't do and to be clear mr bregman point about commercialization is not the same as financing industry research the internet which was invented by the government was then commercialised by the private sector because the government made it available that's not exactly funding industry which search it saying invest in things that will find a place in the commercial market so it gets widespread adoption so that everyone benefits from the research but do research that won't underfund research rather than over purchase research compared to other immediately pressing needs there is the tendency to address those pressing needs rather than something which is long term something else which we underfund public education the market would probably not fund education properly and along those lines i think several of you mentioned the role that education consumer education user education can play in improving cyber security at relatively low cost can you identify some things that that we could be doing either as a society or as a government to use that education to more effectively to enhance cybersecurity while mr chairman you mentioned the fact that the cyber world that we're living in today is only maybe dozens of years old and it's it's changing at a pace which is much much more rapid in the generational shift and i think there's a very important role in education in educating our citizens on how to behave and what are the norms and what are the risks and what are the processes to use to protect oneself in the cyber world and i think that it requires government to take the role particularly of coordinating that delivery of that education because if it's delivered in a very fragmented way it's just confusing to the  populace so the programs that are in place today and c s a and others i think are good starting points for governments collaborating with private sector to bring that education to the mass market cybersecurity and then decide to work for the federal government so there are various different programs available now where there's like an education assistance program that can help bring those individuals with information care to degrees into the federal workplace record one thing i would just like to add related to the research and development question that came up earlier is that the results of the research and development activity should be made available particularly those funded by the federal government there's a requirement under the e government act that these federally funded research particular cybersecurity be maintained the results of that and repositories we found several years ago that the results of many of the efforts were not being considered and implement implemented into these positive or is there by making them unavailable for other researchers who might have benefit from the knowledge gained from those research efforts thank you i'd like to start by thanking the committee for taking on this task i think as you mentioned it's a very complex problem and one that is changing very rapidly and it's very important that this committee and other parts of  government focus on it i think there has been increased focus and we see improvement in the work we do with the d h s s and witnessed with other parts of government we need to continue that and accelerate that momentum if we're going to be able to really protect our nation in the face of this increasing cyber threat thank you thank you thank you i do want to comment one further point about education in particular we have spent a lot of time educating consumers about some of the basic steps they can take to protect themselves on the network and i think this is important to do and we will continue to do it the challenge it seems to me is in part that  technology is is very opaque to end users my mother is seventy nine and found an e mail blast so hard and when i talk to about security issues she really does not want to become a security i t professional she remembers the day of the telephone where it just worked in if something went wrong the telephone company took care of it and i think to some extent we have to think about models that provide consumers a higher level of protection with less work and i don't think we're going to get there unless we start thinking about some very hard problems some of which i outlined in my testimony about things like attribution how does my mother know where mail really came from who really wrote the software that is being asked to be installed on her system and what do we how do we think about the role of internet service providers who are the choke point to the internet and might be able to look at machines and clean infected machines there are a lot of difficult challenging things we have to do there interesting models if you think about who is the world health organization and the way we deal with pandemics you know they're called viruses and worms for reason in the computer world because they propagate in many at the same ways and we have to start thinking about other models that have worked and how we bring new protections to the internet because the ability to create malicious malware and propagate it worldwide at machine speed virtually at the speed of light is going to continue unabated human beings are not going to be able to react fast enough to respond to machine based attacks and so one of the areas for intense research and development and one of the things we have to think about is how we're go protect people in this environment where things move that quickly and things change so rapidly thank you very much mr charlie mr harper just briefly before i close i thought i'd come back to the question of liability which  would be hard to do it also could frustrate innovation and i think that's also true those things are true of regulation as well and so maybe if there's consensus on the on the panel it might be that that the government contracting is the best way using using well developed new standards is the best way to advance the market for technology products and that liability in regulation should be distant second and third places i think that the federal government has a role as a market actor  in promoting standards though it's not a given that a government promotes government created standards should be adopted in the private marketplace it's best role for the most part is as an outside referee and policeman rather than as a as a  responses was a friend pointed me to a website where people's self important tweets are collected and so i think i'll be ratcheting back on my use of twitter thanks for having us this afternoon thank you all very much there were many many  insights which were very interesting some sometimes surprising and always very thoughtful i think that's one of the benefits of being able to hear from people who are able to think deeply and consider topics and thank you all very very much for appearing before the committee this afternoon the record will remain open for two weeks for additional statements from the members and for answers to any follow up questions that the committee may ask the witnesses the witnesses are now excused and the hearing is adjourned thank you very much