welcome to the research and science education subcommittee hearing on cybersecurity research and development information technology is an integral part of our daily lives computers cell phones internet have greatly increased our productivity in connectivity unfortunately this connectivity in the dependence on our critical infrastructures and information technologies has increased our roll abilities to cyber attacks for example last year the pentagon than three hundred sixty million attempts to break into its networks in just two weeks ago a cyber attack or access to design plans for a three hundred billion dollars joint strike fighter project but it's not just the pentagon that needs to worry about cyber security cyber crime is a problem for businesses large and small and for every single american that c c estimates the identity theft cost consumers about fifty billion dollars annually and even more alarmingly it's the fastest growing type of fraud in united states these aren't just individual crimes or individual criminals increasingly globalization in the internet i mean it's physically organized crime groups can mine information sell yet both nationally and internationally in two thousand and seven nearly fifty million credit card records were taken when cyber criminals broke into computer systems used by the retailer t j maxx some analysts put the total cost of the breach at over four billion dollars in a stolen card data was used to defraud retailers nation wide as a result of this wal mart lost almost eight million dollars of fraudulent gift cards ultimately eleven people were indicted including three u s citizens two individuals from china one from bell ruth one from the ukraine in one from a stony a this is what cyber attacks are about is a worldwide challenge to law enforcement and it can affect any american improving the security of cyrus spaces of the utmost importance it will take a collective effort of the federal government the private sector our scientists and engineers in every american to be able to accomplish this in order to realize the full benefits of information technology we need advances in cybersecurity r and d cyber threats are constantly evolving in cyber security aready must evolve in concert through a combination of near cer is a long term project that builds a more secure foundation people are perhaps the most important part of our i t infrastructure in according to experts they're also the weakest link in many system better cyber security education for both the general public and for current and future ip professionals is vital however there's still a lot we don't know about how humans interact with technology therefore more research in the social and behavioral sciences as a potential significantly improve the security of our i c systems today we'll hear from witnesses or actively engage in efforts to improve the security of our digital infrastructure i look forward to witnesses providing valuable insight into the challenges we face in tackling this complex issue in the role of cybersecurity our indian education in any comprehensive solution the science and technology has a key role to play in improving cyber security in to that extent we are holding a series of hearings to examine various aspects of this issue as we focus on our indian education next week our subcommittee will hold a joint hearing and nist there's no doubt that our use of the internet and other communication networks is continuing to grow and evolve and that threats from individual hackers criminal syndicates and even other governments are growing and evolving to i'm glad the president is taking an active role and there's no doubt in my mind that administration leadership will help better define in prioritize cyber threats coordinate the federal response and develop a fact of partnerships with the private sector as chairman of the subcommittee i look forward to working with my colleagues and the administer to ensure the development of a strong cybersecurity strategy i want to thank all of our witnesses for taking the time to appear before the sub to this morning and i look forward to your testimony now that you're well recognized doctor for an opening statement thank you mr chairman almost a decade ago i was serving as a wrapper tour for the nato parliamentary assembly committee on science and was charge of the responsibility for writing position paper on cybersecurity that was real eye opener to me i had never investigated and obviously had to do a great deal of work to prepare the paper we were of course dealing with more than just the commercial cybersecurity current concerns which are largely the concern today we were dealing not only with people trying to find out what was on the federal cybernet but also how people could do damage to our entire cyber superstructure in the united states to various nefarious schemes that was a real eye opener to me and today continues my education on this program sober security is of great concern to both the federal government and private industry and that's quite a change from a decade ago  it was considered entirely the concern of the federal government but this isn't as a specially timely hearing since a little over a month ago the house passed a measure reauthorizing the networking and information technology research and development act of two thousand and nine better known as night or day as you know the night or day program is responsible for the coordination of all the unclassified federal research and development efforts in federal security however sever security efforts are only a small part of the overall night or day mission and i'm glad that we've focused special attention on this subject as we can become more dependent on virtual information and services security becomes more and more challenging to maintain fostering trust between the public and private sector will allow for the type of research partnerships necessary to keep our information secure and exchanging information between stakeholders is critical i'm also particularly interested in learning how we are supporting the education and training of students in this rapidly changing field and whether the current mechanisms are adequate to ensure our national cybersecurity interests i look forward to learning from our witnesses today about their experiences and cybersecurity research development and education and how we can strengthen our federal efforts in this area and certainly thank you for attendance and i'm hoping to learn much more than i learned a decade ago when i first got involved in this field thank you very much for being here i look forward to your testimony  always learn a great deal from you great to always great to have you here you always have better stories to tell so it's this remember their  stories if there are members of some additional opening statements your statements will be added to the record at this point and at this time i'd like to introduce our witnesses first dr seymour goodman is a professor of international affairs and computing and co director of the georgia tech information security center at the georgia institute technology ms liezel franz is a vice president information security and global public you will be accurate professor of computer science in the department of computer science at cornell university and finally mr timothy brown is vice president and chief architect for security management at ca incorporated is there witnesses should know you'll each have five minutes for your spoken testimony your written testimony will be included in the record for the hearing when you've all completed your spoken testimony each will we will begin with questions and each member will have five minutes to question the panel and right now it's about ten fifteen we're expecting votes at about eleven fifteen so we appreciate if panels could could stick to that that five minute time frame and we'll have a good amount of time than that for questions so we will start here with with dr goodman dr goodman thank you mr chairman ranking member reelers distinguished members and staff of the subcommittee in addition to my academic positions of georgia tech i also serve or have recently served as chair of the national research council committee that authored towards a safer and more secure cyberspace and those vice chair of the institute for information infrastructure protection a research consortium of twenty seven universities national labs and federally funded non profits and as the principal investigator of georgia tax and a self funded scholarship for a service program a large fraction of the american people it's businesses and government institutions have become increasingly dependent on that work information technologies we are at risk because these infrastructures are riddled with vulnerabilities that can and cannot be fully trusted and there are a malicious people greatly enabled by network connectivity seeking to exploit those vulnerabilities like auto safety or public health cybersecurity should be viewed as a broad societal issue requiring continued improved responses to dynamically changing circumstances these responses will require better larger and more agile education and research programs and the effective and broad deployment of the output of those programs in timely waives technical progress will be of extreme critical importance but not in itself sufficient policy economic and behavioral issues must also be addressed in particular market forces have failed to provide the nation with a level of cybersecurity adequate for its needs an authoritative interdisciplinary study of how this may be changed would be of enormous benefit to the nation i would like to raise two other specific subjects of both nearer and nearer term and long term urgency and importance the first is what i fear is a coming tsunami of insecurity due to the spread of cellular telephones and other mobile devices the second concerns educating a professional workforce the ubiquitous spread of cell phones and other small increasingly powerful computers with wireless connections is likely to result in unprecedented opportunities for criminals stalkers industrial spies foreign intelligence agencies and other unfriendly actors cell phone users number over three point five billion already a majority of the world's population and vastly outnumber traditional internet users this is leading to increased possibilities for information security not least because of the huge increase in the number of connected potential malicious actors and potential victim attacks employed against other computers will be deployed against the mobile devices especially as they become primary means of access to the internet there are many additional vulnerabilities because of battery limitations the use of airwaves instead of wires the ease with which devices and the information on them may be lost or stolen particular forms of denial of service attacks and new target applications such as digital wallets the vulnerability of mobile devices potentially affects almost every american citizen an organization its international dimensions are without precedent research development and deployment efforts to improve security wellness says it's a to solution to a large number of interdependent technical and business problems and require researchers from multiple disciplines and will depend on strong forms of involvement with the private sector and international institutions to ensure effective and widespread implementation a safer and more secure cyberspace will also demand many more professionals in the workforce on the front lines the fending organizations and infrastructures this will require new faculty and curricula at a wide range of educational institution i conclude by drawing your attention to one of the few efforts to grow this workforce on a national scale the f scholarship for service program it provides scholarships support to u s citizens who must start their careers in the federal government the results of this modestly funded program on the order of about ten million dollars per year has been impressive since two thousand and three nine hundred seventy mostly master's level professionals from thirty four universities across the country have been placed in agencies many of them would not have chosen to study cybersecurity or work for the federal government without it the government has done well in establishing this program it should be continued and carefully augmented to have a more extensive impact thank you for inviting me to chairman the pinsky ranking member ehlers and distinguished members and staff of the subcommittee thank you for the opportunity to testify and to provide the technology industries perspective on cyber security research and development and on the cyber workforce i respectfully submit my written statement for the record as innovators of technological solutions as well as critical infrastructure owners and operators the private sector is a key stakeholder and partner in improving our cyber security posture while there are many things we collectively need to do on a real time operational basis we also need to be working on longer term strategic initiatives that will ensure our cyber security posture and leadership for the future r and d and education f skilled workforce are precisely those areas that are strategic in nature and require immediate and sustained attention i will address both in my testimony today currently we expect about two tenths of the federal government's two thousand and nine budget to go toward cybersecurity r and d that amounts to about three hundred million dollars which in today's highly networked and highly interdependent environment is deemed by most to be inadequate we welcome the comprehensive national cybersecurity initiatives r and d efforts under the cyber leap year project to identify the most promising game changing ideas to reduce vulnerabilities and we look forward to the results of that process we also welcome the r and d focus in president obama's cyberspace policy  companies conduct r and d all the time to develop products and services needed in the marketplace on the more strategic side many companies also for to participate in partnership efforts to assess and mitigate risk to the i t sector including r and d work under the national infrastructure protection plan partnership framework however there is no institutionalized mechanism for providing input into the federal r and d portfolio development but through increased collaboration we are in hansing the mutual understanding on r and d efforts between industry and government increased coordination is crucial to identify gaps and fill them and avoid unnecessary duplications between the projects that industry might undertake and those that the government might undertake that's why we recommend a more formal mechanism be put in place for industry's input and importantly for public private collaboration where necessary and feasible and specially in projects that are national in nature and will reset the paradigm another interesting concept is a national clearinghouse to serve as an intermediary between government and industry and other stakeholders on dialogue and collaboration for r and d and related projects i'd like to take my remaining time to focus on the cybersecurity work force the adoption of technology has far outpaced our education and training capabilities for developing a pool of skilled i t security professionals so we are short everywhere interestingly on the way home from work yesterday i was behind a city bus in d c and there was a  advertisement for a job fair for i t professionals for decide and j t f g n o the d o d joint task force global network operations believe me that's something i never thought i would see on the back of a bus but it's one example of active government recruiting efforts in this area existing federal cyber sleuth cyber related education and service corps programs like the one that dr goodman mentioned are laudable ones but they not without their own challenges recruitment and retention are both difficult we need to continue efforts to improve our university and the six existing job programs and develop a relevant current government career path to help meet and retain the demand in addition we cannot rely only on a university education to help shore up our personal resources for the future we need to adjust our nationally education curriculum for the k through twelve years to reflect the new environment as well kids today are much more set computer savvy than we ever dreamt of being so we need to imagine magnify that capability for our future and some we have much to do but we welcome recent efforts and are optimistic about the opportunity to work together to leverage the momentum and make progress thank you for the opportunity to appear before you today and express industries prepared perspective on this important issue and i'll try to answer any questions you may have thank decisions a division of applied visions which is a small business in new york we specialize in improving the situational awareness of cyber defenders we help them understand what's going on as a network find suspicious activity and figure out what to do about it i'd like you to know the name of my division secured decisions as a psychologist i wanted to name to reflect the importance of human decisions of security professionals i've since learned we need to improve the decisions of a lot of people not just security professionals we must teach programmers to make security design decisions that build security into software from the beginning and not just tacked on at the end home users need to be educated about the risks of their internet decisions before they click on the interesting ad students need to learn the affix of you using computers for entertainment and online socializing we need to change the culture to make good security second nature to all of us and not something that we try to avoid but this change in culture is not going to be achieved by a bunch of smart engineers designing new intrusion detection systems this cultural shift requires the expertise of those who understand how to change minds that is the social sciences so my first take away to this committee is that cybersecurity education is not just for security walks we need to broaden the base of those we teach and involve the social sciences in the education of this larger audience my second takeaway is that we have to get better at training the people whose job is computer security new graduates with information security degrees have little opportunity to learn by doing as prior generations had to do young soldiers in particular have little time to become proficient before rotating out to their next assignment how do we improve this first we need to formalize the mentorship of the new generation before the old guard retires they need to share their knowledge with the newbies but mentorship is not something that comes naturally to everyone and that's where the social sciences can help second we need better ways for security practitioners to share information with their own peers new collaboration techniques developed with social scientists can make a difference third we need to train professionals on realistic yet safe training networks where they can practice their skills without bringing down e bay this is also needed for researchers to test out their new technologies and speaking of research few results of federally funded cyber r n d ever make it into the real world operation as a taxpayer i find this disturbing little research funding is directed at technology transition once the papers published many researchers and government program managers feel their job is done the rest of the work making the technology affordable and usable is abandoned in the hope that someone else will pay for it furthermore i could the missions are judged by their publication history but few scientific journals consider technology transition worthy of their attention and finally computers are caught as scientists are often just not into the softer side of security that is how people use the technology yet studying how people use cybersecurity technology is exactly what is needed to improve technology transition we need to study the usability of systems and to test them in operational environments where real people get to try them out so my third takeaway to the committee is that the government should fund projects through the technology transition phase and should use transition to evaluate both researchers and the government program managers my last message is about how little input the private sector has in the federal research portfolio with the exception of a few i sec the private sector has no voice furthermore the private sector cannot easily tap into the results of the federally funded research i believe the government should require researchers to publish their results in the trade magazines and the online forums where security professionals communicate not just in the scientific journals  closing please keep in mind what information security experts often say cybersecurity is about people processes and technology as educators and researchers we must look at all three of these things not just technology i'm one of the few psychologists actively engaged in cybersecurity r and d i am surround by computer scientists and engineers but i hope with this committee support that in the future my position as a psychologist in cybersecurity will just be a bit less lonely thank you thank you dr mico dr snyder thank you for inviting me here to testify today in the few minutes i have i want to summarize the key points in my written testimony i start with the observation that computing systems we deployed today are not as trustworthy as they could be and we don't know how to make them as trustworthy as they need to be as us increases our dependence on these systems they become ever more attractive to attackers our defenses don't keep up so we operate in a reactive mode and we improve defenses only after they have been penetrated with us prepared to fight the last battle rather than the next one we need to move beyond this reactive stance to a proactive one ensure that we must build systems whose trustworthiness derives from first principles this proactive approach requires having a science base for cybersecurity we don't have one and we need to develop one doing that will require making significant investments in research and the investments will have to be made on a continuing basis so i have a security will never be a solved problem we're not going to find a magic bullet solution we've expect we've accepted this reality for medical research and for defense the same reality applies to cybersecurity the analogy with public health and medical research highlights to disconnect between cybersecurity research today and what is really needed the first was the lack of science base i just discussed the second disconnect concerns the policy part of the picture technology solutions that ignore policy questions risk irrelevance as do policy initiatives that ignore the limits and capabilities of technology this means that we should also be supporting research in policy and research that aims to bridge the gap between technology and policy let me make two further observations about cybersecurity research first when the work is classified it cannot engage many of the country's top researchers it necessarily receives less scrutiny by a diverse community of experts and it will be slow to impact the civilian infrastructure on which we increasingly depend second cybersecurity research once was funded by a diverse ecology of agencies this was valuable because different agencies have different needs goals cultures styles and criteria for reviewing proposals but that diversity has been eroding getting that diversity restored should be a priority and it would undoubtedly bring better value per research dollars spent i earlier made the observation that today's system are not as trustworthy as they could be there are many reasons for this and university education certainly has an important role to play in the solution here with significant increases in research funding more faculty will be working on system trustworthiness so more faculty will be available to teach these subjects and that is crucial but understand that like any new discipline this field is in flux there is not yet a widespread agreement on the core so we would be ill advised to be legislating what gets taught we would also be ill advised to be legislating that everyone be taught only a fraction of the students that a computer science department teaches end up in systems building jobs well so many who are building our nation's critical infrastructures were not computer science majors what i think we need is a new graduate professional degree program lawyers doctors teachers and most other professionals in our society are a good model we need a post bachelor's degree for systems trustworthiness for french professionals on the university side this would mean developing courses texts and other teaching materials and outside the university it would mean creating a force field so people are compelled to invest the time and money to pursue this new degree in closing let me say how encouraged by all the recent interest and activity at the federal level regarding cybersecurity but let me caution long term activities that will require long term investments are the only way to get a long term solution to this problem we need to be making long term investments in research and we need to be making long term investments in education thank you i look forward to your questions thank you dr snyder and i recognize this around good morning chairman lipinski ranking member ehlers in the members of the subcommittee my name is timothy brown i am the vice president and chief architect for security management for ca and corporate and i will test today testified today on behalf of ca and i will draw in several instances upon the positions of the business offer of alliance of which he is an active member i appreciate the opportunity to testify today on cybersecurity in r and d i commend you for your focus on these issues which are of great importance to say in the cyber security of the nation threats to our security are real and ever changing the day of the hobby as hacker are long past today most threats are posed posed by organizations for profit groups which run very much like businesses except their business plan is to steal data identities credit card numbers and other valuable information and convert them into profit my job at ca is to help stop these bad actors we develop tools that individuals and businesses can use to protect themselves but the chat the threats are ever changing for example we have an immense and recent growth in social networking sites like twitter and facebook this is a good development but the cyber criminals look at these developments as simply new business models so what can we do to about all this we believe the solution requires a multi pronged and smart approach consisting of four elements industry and government need to work together said comprehensive goals meet the full range of threats and develop rapid and effective responses as a country we need to invest more in basic research the science must advance for us to develop the tools we need to address the threat and we need to make sure that those advances in the laboratory of quickly turned into the products people  companies need to protect themselves and maintain their security we need more and better educated security specialists we need we have made some advances in this year but our universities must be encouraged to devote more resources sources to supplying the security professionals of tomorrow finally we must ensure the public is fully aware of the threats they face today too many internet users fail to take the needed steps to ensure their data and valuable information is safe and secure one of these elements stands out we believe the indispensable element of addressing the security threats is ensuring our country continues to invest in basic research into the ever changing information sharing environment in my written testimony i set this point out in great detail i would now like to highlight a few of the technology changes that will create new opportunities for cyber criminals first increased bandwidth and conic tippity to laptops and smartphones is very important to our economic recovery in key to our long term growth but this trend also poses new challenges to security by pushing our existing security technology to its limits second demand for data storage and computing power ever increasing over the coming years we expect these demands to increase sharply more data needs more cyber criminals have more opportunity to do harm third as i have mentioned already the emergence of social networking as happened very fast and is transforming the way the internet is used both at home and through increased collaboration information sharing but the security systems used by social networks need to get much better very quickly for today's business collaboration today businesses collaborate and share data they no longer operate independently in this is good for example hospitals collaborate with other hospitals universities health care providers but more collaboration is create more vulnerabilities finally the source of risk is also changing too often today the threats come from within your organization rather than from malicious outsiders trying to infiltrate systems today we have not given enough attention to these insider threats to address these problems we reckon the the following ways federal support for advance research can help developing test tools and products that can identify vulnerabilities logical inconsistency in an inappropriate back doors ways to ensure ensure security measures can keep pace with data being used by hundreds sometimes thousands of people simultaneously new identity management technology and business models are acceptable to consumers and industry models enabling people to collaborate and interact securely research into insider threat  protection but this is not enough college and universities have made great progress in security courses and now mandatory many programs however the security knowledge tends to focus more and so cure coding practices and less on in limitation  design of secure systems we need simply more security professionals well trained in areas such as identity and access management director tech ssion in response and cryptographic systems finally we believe we need to significantly increase our national effort to raise public awareness about cyber security this would decrease the likelihood that consumers will become victimized as well as decrease the likelihood that the computers will be hijacked to serve as a launching pad for larger attack packs we simply need to develop a national cybersecurity public awareness and education strategy i would be happy to answer any questions you may have for me thank you certain that we're creating state of the art education for our cyber security professionals that schneider you and i claim new york as our base of operations and we have a wealth of community colleges  is there potential to draw in the infrastructure of our community colleges and develop some earlier investment in cyber security professionals and i would throw out  the into the question i would make the statement of the unusual glut that seems to be emerging in terms of professionals from outside our borders that are addressing this field this arena and we're not growing and cultivating domestically the talent we require yes thank you for the question and i completely agree with the premise that we need to employ a broad spectrum educational approach to the problem we're not going to solve this problem only with ph d s or only with bachelor's graduates there are jobs that are suitable for somebody educated at the level of a community college and there's life which means people educated to the level of k through high school and actually those of us who have graduated long ago and need to exist for some years to come need to have a much more sophisticated view of what's going on so i believe there's going to be a broad spectrum of jobs available some of which we would do best to train people to community college level for and i believe the community college will become more and more sophisticated as we get a better understanding of some of the cybersecurity challenges are there others on the panel and by the way let me thank the panelists your information is very helpful is there anyone else that would like to respond to that dr to make a i think you raise a very interesting point about the role of community colleges and i fully agree with you that there are not enough u s citizens who are being trained in this area i think community colleges can participate in the training of security professionals because as we've learned this is not all about academic education there is a lot of learning by doing and i think that we should incentivize the private sector to bring the community college students into internships i sit on the board of directors of the metro chapter of the site which is the largest second largest chapter of security professionals in the world right in new york city we have people who want to bring in in terms from places like community colleges to work with and so i think this is part of structuring and mentorship program thank you dr goodman let me return to the scholarship for service program for a moment and talk about one of the offshoots of  that effort having these students by the way has enabled quite a number of of departments computer science departments around last departments around the country to build their own capacity and several of them have used that greater capacity to seek roles in trying to develop curriculum and educate students regionally in other institutions particularly community colleges and law enforcement schools in their  areas mentioned in particular mississippi state university and the university of tulsa and there is a very strong feeling among most people who are very seriously concerned about developing workforce and an educated user community that this effort must be extended far more broadly than just the universities in this country and i would also endorse the idea of programs that specifically are geared to do that thank you ms friends thank you i don't like to add the notion that as we discuss a broad spectrum of the kinds of education and skills that can contribute to resolving the problem that we don't then funnel every l of our students into very rigid specific requirements for cybersecurity professions that multi disciplinary nature the multifaceted types of education that  can that can contribute to resolving the problem is something we need to retain the magine is that those of those that might be working in the cybersecurity field now did not get a college degree and yet they are doing are big contributors if they were shut out of minutes thank you mr chairman it's it's a little hard to know where to start that it's been a very rich testimony and very very helpful so for you testify there needs to be a better interaction between the government and the private sector with regard to cybersecurity and by the way these questions are going to be for everyone because i picked up ideas from all of you and mr hanson believe testified more formal mechanism needs to be put in place for private sector input goal ever ation and so one of the question i'm asking is what is your involvement been with snyder do you or any of the mission agencies to initiate s interactions or discussions have you been rebuffed or already have you been accepted and if you've been accepted how are the conversations gone dr goodman you're also not your testimony that market forces a failed to provide the nation with a level of snipers cyber security adequate for its needs and this seems to imply that government regulation or other significant intervention is required to achieve adequate cyber security but seems to me the government hasn't done that good a child itself and governing its own needs and so the question is are can the government really provide the leadership you need or is it just the money you need or how how can we reach the point that you and i both seem to want to get to one another some of you mentioned oh it's hard to recruit people for security jobs and it wasn't clear to me whether it's because these jobs are not particularly appealing perhaps computer experts would rather be programming than playing cops and robbers i don't know or maybe you have to field a compass and robbers people and provide them with appropriate cyber security training but i'm just wondering if server security jobs are just not appealing enough to the people that you're trying to to get so it's a potpourri of questions but i think you're all sort of focusing in that same area so dr goodnight if you'd kicked it off and we'll just go down the line i think a fundamental problem out there that is largely behind the statement that i made is that for a variety of reasons cyber security has frankly not been taken as seriously as it should be in putting all of these systems out there there has that there are simply so vulnerable security has not been a major design consideration it has not been a major driver for the businesses who are out there in cyberspace doing whatever they do in cyberspace there has been no pressure on them and when things go wrong they usually are not the people who suffer the consequences i'm a believer that as is the case with lots of other security and safety issues and other infrastructural domains that some requirement if you'd like needs to be made on those who are in a best position to mitigate risk do so and that may in fact require regulation choire certain kinds of laws that for example heighten liability it may benefit from coming up with the kind of technology that is so easy to use and so cheap to use and so easily integrate a bill with what we have out there now that you just cannot not use it nevertheless we have a situation where much of cyber defense is pushed on the end users you and me and all the other citizens and organizations that are out there this is partly built into the architecture of the internet and other things and we are increasingly incapable of defending ourselves against increasingly capable  and attackers so an effort must be made to get those people who are in the best position to mitigate risk to do so and i think what should be done and it's been done in other areas  industry and government need to get together and they need to get together under some perhaps formal forum or other kind of institutional mechanism with the mandate that they come up with greater security in cyberspace simple as that there are again other than most recently this seems to have produced some results in the electric power industry where there has been great concern about how vulnerable increasingly i t controlled electric power generation and distribution may be to to outside attacks or to other forms of failure and for the federal energy regulatory commission got together with the industry associations and basically came up with mandated vanderjagt for this for the systems that they use to generate and on the partnership effort most of the interaction that we have had with night or day has been through our increasing dialogue with the interagency working group on cyber security and information assurance  we have had more and more discussions in the work of the information technology sector coordinating council righty f c c under the net framework that i mentioned and that has been increasingly positive as well however i'd like to say that we'd like to see that discussion and dialogue start at the very beginning of a process rather than at the end you know where where the document may be presented for review and input but at that point it's almost too late to do so so the dialogue hasn't started in the beginning so that you might you might see overlaps in time it's too late you might miss gaps in things that needed to be done and weren't and you might look you might see areas where innovation might be stifled by the by the proposals that the government may make so i would say that in order to avoid all of those malign minds we would want that partnership to start earlier but our dialogue has been increasingly positive and and rich and we're finding out a lot more about what industry is doing what government is doing and where we can  mentioned would enable that interaction at the earliest stage and get the expertise of both government and industry and other stakeholders in the room at the table perhaps with a blank document as some have mentioned rather than a fully fledged  united states this thing that's keeping this from happening is not the money we know that they're well paid industry the average salary for a security manager is one hundred eight thousand in the federal government it's ninety eight thousand and in this state and local is seventy nine thousand so it's not the money i think i have to do with three things one is the availability of jobs the second is the perceived status and third is the us lack of us citizens  that there are not that many jobs available in industry and i think it's because they don't see the return on investment the only reason that people are really investing is in security is because of the compliance legislation but from the economic perspective they don't see the are alike in the military there is no real perceived status for being a techie in the military if you are in the cyber defense force you are not on the path to advancement so you have to move out of that in order to advance in the military and then put respect to u s citizens more and more of the advanced degrees in information security and computer science are not granted not as many of them are granted to u citizens as in prior years and so a lot of bachelor's degrees are given to u s citizens only i think eight percent of the degrees are to foreign nationals but by the time you get to p h d about a thirty eight thirty nine percent given to foreign nationals we need to change that around as well thank you if you want somebody to get to do something there's this basic tight dichotomy of the carrot versus the stick the only way the industry that plays in cyberspace not the cyber security industry but companies that benefit by doing business over it are going to build more secure systems is if they are somehow incentivized to do that return on investment is the carrot legislation is the stick i'm not an expert on suggesting which way to go but i will point out that if there were an incentive structure then two problems would be solved one there would be employment of experts and cybersecurity experts might be technical and they might be policy oriented and second companies would be very anxious to facilitate tech transitions from researchers into companies you've only to look back at the dot com era to notice that lots of good ideas were being discovered in research and were very quickly being monetized in the in dustry community so there was an incentive structure it was a carrot in this case and it moved it's the lack of incentive structure that in my opinion is what's holding things up thank you finally mr brown is one of the things we look at you know research gaps and try to resolve some of those between industry and government you know we we look at these gaps to identify these gaps and industry today is focused primarily on satisfying their customers needs today we prioritize those needs we staffed for those needs to make sure that we are creating products that can meet those needs today one of the major challenges industry is this how can we for pair for things that are going to happen five six seven years from now how can we set up that infrastructure that's really going to prepare us for that and you know there's a challenge there that says those investments are very very high risk you know how many of those investments going to really be fruitful and as we looked at the list of the research research areas when we see those we see that they're identified as areas but really plans are not put into place to say how we're going to address those areas some of those areas are better left to research of government some of those areas are better left to research for public and private partnerships some of those researchers are better for university research it's important that we lay out plans to address each one of those areas and stay to those plans ok thank you very much very useful or three questions but now you know that you have used up your question time for the next two hearings also so that's fine but now that was very interesting and very very good questions and good answers very interesting responses there i will now recognize myself for five minutes i have some of the things that i was going to ask about some  one of those questions actors just asked seems like one of the issues that we face with cybersecurity is that everyone thinks that it's not their their problem f individuals to companies whether they're they have you know companies are producing software or operating systems or companies that just are have have data that is not  that the administration is paying attention to it because it's shining a light on this what's going on that's not just a political statement i just i'm very happy to see that but i think there's really needed in our country because a lot of people  cybersecurity they don't realize how much impact you can have on them but just take take an example yesterday microsoft issued updates the past thirty one vulnerabilities in windows and office programs including eighteen bugs that they marked critical you know just focusing on microsoft there yes i do use a apple computer macintosh operating system always have  not just pick on microsoft but where how do we better incentivize that like you say that you have all kinds of different individuals types of companies how do we better incentiv e making trying to get these whether it's on the software programs or we have data better protected and any other ideas talk such a little bit on this we don't have anything to add on that right now dr snyder i think some sunlight would help i think we don't do a good job of informing the pa elation about the risk or about the consequences you have a good notion of what the chances of being burglarized if you were walk in any part of this city you are probably the city you've come from you don't have any notion of how often successful penetrations are occurring at banks or military installations or any of the attractive targets there are good reasons why these institutions don't make this information public yet if you look at the success of the california breach legislation that's now spreading throughout the nation whereby when private information is disclosed the institution that leaked it is obligated to inform the potential victims that's had a very interesting effect and raise the consciousness both of the owners of this data and of people at large so i see all this talk about raising published public  consciousness and public campaigns i think if business were more obligated to be candid about what was happening we'd all understand and build a better model of the risks and once people are more concerned about it i think are the adversaries we're up against are changing as well so when we look at software vulnerabilities you know just four or five years ago no one had a plan in place to train their software professionals now i can't think of any large software vendor that doesn't put their you know their coders through at least secure code training so the level of awareness has raised to a very good extent now we have to deal with a lot of things from the past so software that was written five years ago is still still in place software slowly moves out of both industry and consumers and the industry has done better at at a note saying vulnerabilities and you know they should be  they should be applauded for announcing vulnerabilities and working with working in ways to patch those vulnerabilities as quickly as possible so overall i think the industry is getting better now can we do more absolutely should we have more trained people coming into our organizations yes should we have better more trained professionals absolutely but things are taking time but they are getting better so we have to remember where we were three years ago versus today  friends i would like to build on a couple of things and my other distinguished panelists have mentioned first i think there is still a great need for awareness or sunlight as d said on what the issue is and particularly particularly there's only a small community that know what the threats are to them or what the activity is in cyberspace and so we have often asked for a mechanism that allows more information sharing between the government and industry on on just what the problem is and what are the truck problems are trying to solve that turning these madonnas trusted environment as possible so that goes back to the part of the partnership mechanism but that information sharing and exchanges is as important i'd like to touch upon the incentive piece from a positive side of the equation  more of a carrot and stick i suppose dr snyder mentioned the data breach notification laws and certainly that's something tech america has been actively engaged in particularly looking at the requirement for noti notification when there is a breach and providing for a safe harbor for industry and companies or that other organizations government or academic institutions if they've taken protective steps to protect that data before in my could even be preached to render that data unreadable unusable and so there is a there is a presumption of a lack of harm in that kind of instance and so on the one hand it incentivizes companies and other organizations to take protective  mitigate of steps beforehand and then provide for makes the data unreadable unusable if it is if it is accessed so that's a positive incentive to look at sort of the carrot and stick approach i also might suggest that we consider ways that the tax structure could could benefit efforts in r and d or other investments in cyber security efforts wanted to cause trouble what i would do would be to take some drives and throw them out in some parking lot with a trojan horse on their cars almost i was going to pick it up taken in the office plug it into the into their machine just even see where who this might belong to you know just things as simple as that how do we change people's habits and just automatic reaction  we need a marketing campaign and americans are very good at marketing and there's a lot of research on how to market effectively to americans people want to be good u s citizens and they really need some kind of marketing campaign for individuals and for companies that you too can make a difference engage in good computer hygiene so that before they wouldn't touch a dirty object on the ground because of good because of health considerations they shouldn't touch potentially dirty thumb drive on the ground because of computer hygiene considerations and i think it's well within our capability to engage in a public awareness campaign using everything we know about good marketing i think the second thing and this is this is a much harder is that we really need to understand what the impact is of any single failure so if somebody picks up that some drive and sticks it into the computer and they get some kind of infection what are the cascading effects of that we really don't know and this really is a right area for research we don't know enough about the interdependencies within an enterprise and across enterprise to be able to say you pick up a thumb drive you put it into your computer well guess what somebody in a bank account two states away from you is going to have some money hidden out of their camp we just don't know that and we need to study that that's good when the problem of educating the public are making the public really fear what might happen to them there is very very difficult in this domain we have a situation i mean in other domains usually there is some  immediate fear sickle threat that gets public interest and arouses them to protect themselves and to get help from others to protect them  this kind of threat for most users not only in this country but especially around the world they it is so remote it is so abstract they are connected to these systems they see all the good stuff that's going on out there that's why they spending so many hours i terminals on their cell phones and what have you and any kind of threat is out in oblivion someplace  and physically it may well be out on the other side of the world they don't see the immediacy they don't see and it's very difficult to educate them to this given so many other things they have to think about and we have again  a situation where even when the public has seen immediacy for example as in the world of automobile safety those industries that are in the best position to do something about it have had to have a great deal of government push to do something to protect the public and i don't think the public each individual out there can do things to help them as they do with their homes with locks on their doors and what have  you that's not going to be enough and the public doesn't fully appreciate i'm not sure what kind of educational program will bring it home what kinds of risks they have there thank you i've gone away over time here so you can conclude at that and recognize them it's not a bar thank you mr chairman thank you for calling this hearing for i think the first question i think in most of your testimony you indicate that a lot of the infrastructure for cyber space in the private sector and a lot of ideas kicked around of how to enhance the cyber security and one of those is to establish a regulatory regime to impose on these private companies and i think the second one is to somehow give those companies some kind of liability protection for maybe mandates that the government would impose on those companies to to do certain activities so those are two ideas one of them sounds like more big government you know what are your thoughts on the current things that are being talked about in third is the better ideas that is certainly right now we see a lot of proposals for the kinds of things that we the regulatory or the regulatory nature or with regard to practice  the problem is while the bulk of the information technology or cybersecurity or critical infrastructure is own and operated by the private sector the issue is it moves so  quickly we see transitions and evolutions in the technology on of at a very rapid pace and legislation is not always the best way to address that at least not in very specific ways it usually is a blunt hammer for a very specific problem so if there is a way to identify the problem and again i would suggest doing that in a collaborative sense and then finding the best way to approach it either through a standard or a best practice  in many of the collaborative bodies that we have either standards bodies nationally and internationally again it's also a global issue we can't and we don't want to put into place a regime that is restrictive will be irrelevant in a very short period of time and then is either conflicting or provides call it causes extra burden on companies or other organizations that have national and multinational operations so it requires a really good robust dialogue on them the best way for for legislation to address the issue as well as other mechanisms misprints also brought up the point of standards and standards are extremely important when we look at when we look at it hearing to as toppers develop it hearing to standards will help us have more consistent more secure infrastructure across the board so that that's also extremely important component of this you know the infrastructure players in the private sector are you know they're driven to do the best that they can you see who is out there and who hasn't survived and you know the bottom line is that they don't do their job they don't do things securely they don't do things in a high bandwidth method then you know they will survive as a company so there are a lot of incentives for them to the private sector to do the right thing here i agree with you and i think that's one of the things that kind of concerns me about you know the government stepping in sometimes when the government does that it leaves a false impression oh the government's watching out for me now and so i don't have to be careful i can pick up that thumb drive or you know and so i think we i think we ought to because most most companies very competitive prevented or not there's there's there's there's problems to do that want to move to another area and that is with the huge amount of growth in use of p d a f and cell phones they there is nothing in this world i mean world expanding faster than cellular to less than a and mobile devices more generally and restate some of what i said earlier i think before you came the devices are becoming increasingly powerful  computers many are not yet around the world but the trend is very much there and as such they have all of the vulnerabilities particularly as they become the principal devices for most of the world to connect to the internet that you have with such things as laptops and desktop computers so everything that is seen as a vulnerability that can be exploited with desktops and laptops will be coming with so the early devices i can guarantee that plus and i rattle off a number of other features that are associated with mobile devices that are uniquely vulnerable to them such that they use airwaves they have very limited battery power and there's a disinclination on the part of everybody the providers the cell phone  statement that there is a tsunami of insecurity far greater than what we're seeing now coming with those devices and it will be worldwide and to make another point what's we've got to worldwide and the comment that you  raise mr representative the there are limitations you use the term rigorous right regulatory regime and i advocated more regulation at least thinking about regulation there are limitations t and everything else that everybody has raised here with regard to educating the american public and what have you and that is we are dealing with the infrastructure to an extent like no other on this planet that is connected to the rest of the world and you can regulate us businesses you can regulate us users universities have been dropping our universities are not the best protected places on earth i hate to say but what sort of leverage does that regulation or law enforcement have on the other two hundred countries or semi sovereign entities where the internet and how they are to laugh and they all come to ground and some real thought has to be given to that and i'm afraid close to thought has been given to that except from a law enforcement standpoint around the world and i'll also say that as a crime and punishment approach you know people who are doing things out there almost say from being caught and prosecuted real attention needs to be given to prevention and recovery and the world as a whole much more even worse than the united states is giving very very little thought of that just to germany we're going to have panel i had a few questions i wanted to jump through so i'll try to move this along first i wanted to ask what is in the panel's opinion most effective route for small innovative companies that have new cutting edge technologies to get visibility and consideration within the federal government cybersecurity area yes well i'm from a small business in new york and we do cybersecurity research so i could say from experience that the small business innovation research program is one of the best vehicles for small businesses to become involved in cybersecurity it's an excellent program and and it requires that the small businesses not just work in cybersecurity in r and d but also transition the technology so i think that that is very important one of the things that hurts small businesses and innovations is the common criteria certification that is required on security products in order to get a secure a new security product used in the federal government one has to go through a very expensive common criteria certification entry level price is about a quarter of a million dollars and very few small businesses can afford that so as a result you have some of the most innovative ideas that are really never get into the federal government because of this requirement thank you anybody else on that fronts i'd like to touch upon two aspects one is i think building upon the awareness aspect there are several mike and isms for making small business and other users more aware of the steps they can take to protect themselves so looking at it from that perspective what what does a small business need to do need to do these are the what large companies or individuals need to do and one great resource for that is the national cybersecurity alliance which is involved in a lot of awareness efforts and a partnership with the department of homeland security those kinds of efforts certainly could be bolstered to have more of a marketing campaign like  fact the doctor to me go alluded to earlier and i think would be positive with regard to how they can take advantage of cybersecurity efforts in the government i just think it's a great awareness need outreach meant efforts can be undertaken to take those in a more into consideration make it easier for them to participate thank you the in the defense bill section two fifty four in title trust trust to defense systems it calls for an assessment of various methods of verifying the trust of semiconductors procured by the department of defense from commercial sources for use on mission critical components potentially vulnerable defense systems how can the federal government better prepare and provide for these critical needs in a more comprehensive manner and a more timely schedule to meet those critical semiconductor requirements today yes so i think you're alluding to what's known as the supply chain problem yes wherein we are now purchasing semiconductors boards and software from abroad either through u s companies or not  and using them in defense systems and we're using them also in private sector systems which are used in defense and which are controlling critical infrastructures that are not used in defense this is a big problem and it does not have a short term solution it is a very difficult problem involving probably five to ten years worth of research before we will have some basic engineering approaches to solve it and we should appreciate the severity of the threat and hope that the sophistication of our attackers is not at the level that could be aware of the of the vulnerabilities they have a something goes wrong so they have taken steps in a number of ways to address their supply chain cycles and and  efforts in order to six sure that up along the way of course there are always situations in which that doesn't happen and those measures are undertaken and not only the company but others well it could possibly see the ramifications of that but before we do anything that disrupts the economic model that many companies and government are benefiting from we need to have a discussion about how best to to construct  positive way so again that partnership is really important to figure out exactly what's happening what is industry doing perhaps what it is and what the parts that need to be addressed before we disrupt the system that and thereby restrict the kinds of innovations that government can get in a timely manner certainly the level the spectrum of sensitivity or classification or criticality of a mission needs to be taken into consideration as well where do they need the most critical the most secure solutions and and where might they be able to leverage a global marketplace better so that discussion and consultation is necessary for that let me just wrap can the government and our educational system ensure that we meet the demands for these not only meet the demand but also when the cybersecurity race and stay ahead of the curve here  i recall that article and there are a few things about it one is that they mentioned that there are very few people who have the security clearances that are needed to engage in some of that work we need to have more s citizens who get advanced degrees and in computer science engineering and the into disciplinary areas that are related to computer security the second thing is that a lot of those people came out of the military one of the reasons they came out of the military is because of something i alluded to before that if you are a techie in the military you don't get it you get don't get an advancement we really need to have in the military way of rewarding those people who are cyber defenders cyber warriors and then you'll grow them in the military and then when they retire they'll be there to help and in those areas that were mentioned the new york times article said brown yeah i think one of the other things so education is definitely important educating people you know a lot of our our workforce is coming out of universities with education and secure coding capabilities but not really secure systems understanding how to design  secure fashion is actually a lot more difficult than understanding how to code securely a lot of the threats that we see are really more systems threats you know you've left you know using  software throughout your system but you know it's got a weak password rules or those types of things are in place so making sure that we have people that understand those of the coming up through the ranks of our universities that understand understand how to to design secure systems you know we do have you know we we have been producing more of those professionals in the last few years but it's still just a growing field so we need to do more it's also important that we institute strong internship programs strong programs that link them with industry link them with government because the university environment only gives so much focus to to the real world essentially so a lot of our work with universities today we fund university research but when we see the researchers come in a lot of those researchers were teaching them about the real world and trying to give them enough knowledge you i was just going to go back to our conversation dr goodman was talking about in the cell phone in area and we talked about the devices necessarily may not be equipped to  process some of the threats but i guess the question is what what is the industry doing i guess out there to make sure that you know that that that their systems have integrity because obviously a lot of people it's big business and other panel members if you have some knowledge on that thing be helpful for this as well  fred also respond but from where i sit i don't see and it is big business i mean it is big business worldwide not just the providers of the service but the makers of the devices and so on and so forth  so far i don't see much i would also like to say something hopefully encouraging in that we are at the beginning of what i perceive to be a very rapidly rising curve in this domain  we have a certain amount of history with mistakes and not getting ahead of the game with regard to the internet and all sorts of other security areas right now most of the users of cell phone most of that three point five probably four billion people in the world now are using fairly weak devices that limit the kind of risks they are taking that is going to be changing rapidly  we we all of us industry government governments around the world actually for once you get ahead of the curve on this and do something to mitigate these risks before it becomes the kind  israel i thought yes yes thank you so when we look at you know i agree in some cases the we are at in infancy and the cell phone p d a world right we have opportunity to do a lot better in this world than the laptop desktop world the threats are going to be different here though as we open up new interfaces and new capabilities to these phones so you know apple first put out their i phone and they said a browser will be your only interface that was easy to secure but guess what consumers demanded that i have an app for everything as the apple commercial says and each one of those applications now has increasing functionality each one of those applications has potential vulnerabilities you know we have they've done a better job at securing things but there are more vulnerabilities more opportunities to either socially engineer threats which is actually probably more of a threat th software engineering of a threat so we are at a at the point where we can do more and not solve not have the same problems that we had it sort of in the desktop laptop world let me point out a few technical differences between the cell phone world and the desktop world and the way they're evolving that might give you some reason to sleep at night first there is no dominant producer of the operating system for cell phones and there are a fair number of producers that means there's not a monoculture so it's difficult for a single attack to attack all the the processors second early in the ever lucian of cellphones the phone companies established a model that they owned the software and that they would periodic lee change your software without telling you when they decided to make a change in feature or fix a bug so the model that we have for desktop software where microsoft announces a bunch of patches for some vulnerabilities notice they didn't announce that they were successfully attacked they were preempting that but the model where  it's the users responsibility to configure the system and it's the users responsibility to keep it up to date has been abandoned and it's least for the basic operating system of the cellphone this is under control of the manufacturer at there's a possibility now that everyone's going to be able to download their own applications and they will be responsible for that piece of the picture that will be a problem but if the cellphone manufacturers retain the view that they manage your security then we might be better off thank you and we keep pushing back and looking at the t v screen here to see about when we're going to vote i don't want to get into we don't have much time so i just want to very briefly get in to throw one more question as looking through my notes that i that i had made so i recognize myself for five minutes but hopefully we can keep that to shorter than that dr to mico talked about needing to incentivize technology transfer and dr schneider also talked about you know bridge the gap between the research and policy how do we do this and this is always an issue that faces so many different areas in technology transfer and something i'm very interested in because i think it's very critical getting that research especially from our universities and getting them together with this industry how do we do that in this instance so we really need to make the government program managers who are monitoring this federally funded research accountable for the technology transition and make the researchers incentiv do it first of all the programs that are funded should include a technology transition phase and not stop while you've built a prototype you've demonstrated in a laboratory and now we're done and we write the paper  really have to go through usability testing and operational environment and the money has to be there to do it the second thing and something i raised in my oral testimony is that i think that the researchers need to go out to the security professionals who are also mentally going to be using the results of their work so much of research is is really so many researchers brief themselves or that their community they publish papers within their community and they never really go out and talk to the security practitioners and we need to have the results of the research brought out so those security practitioners write an article for information security see if you can turn your research into something that makes those researchers and i do get government grants i run a fairly big operation today if you want to get a grant you're much better off being able to assert in the grant application what you're successful technology transitions w then to list publications is least in many of the funding agencies there is a culture that people who succeed in having a real impact are the ones they want to follow and publications don't matter for some so much the other question has to do with teaching policy and technology i think academia may be a bit ahead of the curve here but when i read places asserting we need to teach all our students the list of common security holes and secure coding practices and the next step is to teach them how to do secure designs i think we need to teach them ethics i think we need to teach them law because if they don't understand these things they're not going to know when they can trade off between a technological solution and a policy solution if they don't have a good sense of ethics and sociology then they won't understand how when they change the internet so it's more secure or the fact that it became less usable makes it a less attractive place for all of its users and and it gets ruined in another way and so i think it's the responsibility of universities and any educator to have a much broader view than this kind of technology and we shouldn't get railroaded into believing that we should produce technologists to solve this problem because they'll come up with solutions but they're not going to be good solutions in the big picture thank you mr brown we have to one quick comment when when you talk about moving from research into products and applications we have to understand that some of that takes takes a long time even if i come up with the greatest idea today within my company within my position i'm a year and a half out before that idea gets into a product because we're mid cycle and products we're going to take that time so patience and diligence diligence and follow through is critical to get anything to anything done so we have great ideas we have great research they take time to get implemented in products and they take time for p old implement them in the commercial sector or in the government sector so we need to have a process in place that is going to track those that research that we're doing through its life cycle and not give up on it after a year or two years thank you it be very brief after good very  brief i guess there's another side to this the implication or a lot of what has just been said is that somehow the innovators the people who do the research need to push what they have done into the real world and  perhaps by offering things get policy changed or what have you there's the other side of things and that is the people who are going to be the primary consumers of better security whether they're trying to manifest this through through policy or through what they think will really help their products their commercial activities be more secure they've got a sense serious signals that there is a demand for certain kinds of research to solve certain kinds of problems and that demand i think will filter into the research community when with the funding they will get results is a two way street to get things from ideas into useful practice thank you i want to thank all of our witnesses for testimony today it i've certainly have learned a tremendous amount in as we move forward right now we have as i said two more hearings on cyber security as we move forward with our legislation in this area you're certainly going to take a lot of what you have said and any more follow up that you may have for us we would appreciate the record is going to remain open for two weeks for additional statements from members and for answers to any follow up questions the committee may ask of the witnesses so again thank you witnesses for their testimony thank the members for their participation and the witnesses are refusing the hearing is now your and