U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

26–066 PDF 2017

FEDERAL CYBERSECURITY DETECTION, RESPONSE, 

AND MITIGATION 

HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

APRIL 20, 2016 

Serial No. 114–157 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://www.house.gov/reform 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

JASON CHAFFETZ, Utah, Chairman 

JOHN L. MICA, Florida 

MICHAEL R. TURNER, Ohio 

JOHN J. DUNCAN, JR., Tennessee 

JIM JORDAN, Ohio 

TIM WALBERG, Michigan 

JUSTIN AMASH, Michigan 

PAUL A. GOSAR, Arizona 

SCOTT DESJARLAIS, Tennessee 

TREY GOWDY, South Carolina 

BLAKE FARENTHOLD, Texas 

CYNTHIA M. LUMMIS, Wyoming 

THOMAS MASSIE, Kentucky 

MARK MEADOWS, North Carolina 

RON DESANTIS, Florida 

MICK, MULVANEY, South Carolina 

KEN BUCK, Colorado 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

JODY B. HICE, Georgia 

STEVE RUSSELL, Oklahoma 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GLENN GROTHMAN, Wisconsin 

WILL HURD, Texas 

GARY J. PALMER, Alabama 

ELIJAH E. CUMMINGS, Maryland, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STEPHEN F. LYNCH, Massachusetts 

JIM COOPER, Tennessee 

GERALD E. CONNOLLY, Virginia 

MATT CARTWRIGHT, Pennsylvania 

TAMMY DUCKWORTH, Illinois 

ROBIN L. KELLY, Illinois 

BRENDA L. LAWRENCE, Michigan 

TED LIEU, California 

BONNIE WATSON COLEMAN, New Jersey 

STACEY E. PLASKETT, Virgin Islands 

MARK DESAULNIER, California 

BRENDAN F. BOYLE, Pennsylvania 

PETER WELCH, Vermont 

MICHELLE LUJAN GRISHAM, New Mexico 

JENNIFER HEMINGWAY, Staff Director 

MIKE FLYNN, Counsel 

SEAN BREBBIA, Senior Counsel 

WILLIAM MARX, Clerk 

DAVID RAPALLO, Minority Staff Director 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

WILL HURD, Texas, Chairman 

BLAKE FARENTHOLD, Texas, Vice Chair 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

PAUL A. GOSAR, Arizona 

ROBIN L. KELLY, Illinois, Ranking Minority 

Member 

GERALD E. CONNOLLY, Virginia 

TAMMY DUCKWORTH, Illinois 

TED LIEU, California 


KING-6430 with DISTILLER
(III) 

C O N T E N T S 

Page 

Hearing held on April 20, 2016 .............................................................................. 1 

WITNESSES 

Mr. Sanjeev Bhagowalia, Deputy Assistant Scretary for Information Systems 

and Chief Information Officer, Department of Treasury 

Oral Statement ................................................................................................. 5 

Written Statement ............................................................................................ 8 

Mr. Steven C. Taylor, Chief Information Officer, Department of State 

Oral Statement ................................................................................................. 16 

Written Statement ............................................................................................ 18 

Mr. Andy Ozment, Assistant Secretary for Cybersecurity and Communications, Department of Homeland Security 

Oral Statement ................................................................................................. 21 

Written Statement ............................................................................................ 23 

Mr. Richard Barger, Chief Intelligence Officer, ThreatConnect, Inc. 

Oral Statement ................................................................................................. 32 

Written Statement ............................................................................................ 34 

APPENDIX 

Report titled, ‘‘Liberty and Security in a Changing World,’’ submitted by 

Mr. Lieu ................................................................................................................ 64 

LA Times article titled, ‘‘4.5 Million Smartphones Were Lost or Stolen in 

U.S. in 2013,’’ submitted by Mr. Lieu ................................................................ 65 

Letter for the Record submitted by Gibson, Dunn & Crutcher LLP ................... 66 

Questions for the Record for Mr. Steven Taylor, submitted by Mr. Hurd .......... 69 

Questions for the Record for Mr. Steven Taylor, submitted by Mr. Farenthold 83 

Questions for the Record for Mr. Andy Ozment, submitted by Mr. Farenthold . 87 

Questions for the Record for Mr. Andy Ozment, , submitted by Ms. Kelly ........ 91 

Questions for the Record for Mr. Steven Taylor, submitted by Mr. Connolly .... 101 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

FEDERAL CYBERSECURITY DETECTION, 

RESPONSE, AND MITIGATION 

Wednesday, April 20, 2016 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON INFORMATION TECHNOLOGY, COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, Washington, D.C. 

The subcommittee met, pursuant to call, at 9:34 a.m., in Room 

2154, Rayburn House Office Building, Hon. Will Hurd [chairman of 

the subcommittee] presiding. 

Present: Representatives Hurd, Chaffetz, Farenthold, Walker, 

Blum, Kelly, Connolly, and Lieu. 

Mr. HURD. The Subcommittee on Information Technology will 

come to order. And without objection, the chair is authorized to declare a recess at any time. 

Good morning, everyone. 

Every day, Federal agencies face a barrage of attacks on their information systems from a number of different actors. Attacks on 

both the public and private sectors consistently reveal one common 

truth: No one is immune. 

In December of last year, Juniper Networks announced that malicious code had been placed in its ScreenOS software leaving a 

gaping vulnerability in one of its legacy products. This particular 

vulnerability may have allowed outside actors to monitor network 

traffic, potentially decrypt information, and even take control of 

firewalls. 

Within a matter of days, the company provided its clients, which 

include various U.S. intelligence entities and at least 12 Federal 

agencies, with an emergency security patch. 

DHS and other law enforcement agencies acted swiftly to notify 

Federal agencies of the breach in Juniper’s security advisory. Both 

of their actions may have averted a potentially devastating breach 

of sensitive data. This is just one sophisticated example of the attacks that U.S. companies and their Federal clients face on a daily 

basis. 

In January of this year, the committee sent letters to the heads 

of 24 Federal agencies requesting an inventory of systems running 

the aforementioned software. Additionally, the committee asked for 

an update of their progress in installing the corresponding security 

patch. 

Of the 12 agencies affected, 3, including the Department of 

Treasury, took longer than 50 days to fully install patches and 

mitigate the threat posed by this vulnerability. This is absolutely 

unacceptable. 


KING-6430 with DISTILLER
2 

The inability of Federal agencies to maintain a comprehensive 

view and inventory of their information systems and to respond to 

Congress in a timely manner cannot be the status quo. 

Last December, Congress passed landmark information-sharing 

legislation, the Cybersecurity Act of 2015, which creates a voluntary cybersecurity information-sharing process to encourage public and private sector entities to collaborate and share information. 

Moreover, the bill established the Department of Homeland Security as the sole portal for companies to share information with the 

Federal Government. 

With their newly codified role, I look forward to working with Dr. 

Ozment and DHS on how to strengthen their own posture and ensure that they possess the necessary technical tools to detect and 

mitigate threats and disseminate threat information within the 

Federal Government. Only by fostering this framework where government and private entities are able to freely share knowledge of 

security vulnerabilities, threat indicators, and signatures can we be 

sure that our network defenses are getting the best intelligence 

available. 

In addition, we must continue to learn from the private sector. 

Industry leaders like ThreatConnect and FireEye are consistently 

pushing the envelope in what is possible in cybersecurity. The government should not seek to compete with them, but rather they 

should harness these engines of innovation, learn from them, and 

safely cooperate with them under the guidance of good sense and 

personal liberty. 

I hope that this hearing will serve as a starting line for a larger 

conversation on attribution. Various international groups and 

state-sponsored actors are constantly attempting to steal military 

secrets and expose the personally identifiable information of American citizens and we cannot stand idly by while this happens. I believe that attribution is a form of deterrence. 

This hearing presents an opportunity to learn how Federal agencies can improve their overall cybersecurity postures, share more 

timely and relevant information, and work with the private sector 

in a way that benefits all involved, while respecting the institutions 

of commerce and privacy. 

I welcome our witnesses and look forward to hearing your testimony today. 

I would like to yield to the chairman from the great State of 

Utah, Mr. Chaffetz. 

Mr. CHAFFETZ. I thank the gentleman. And Mr. Hurd, I thank 

you for your leadership on this issue. You are such a valuable part 

of our team in making this happen. 

But to those that are in the Federal Government, we’ve got to 

up our game. I was elected the same time as President Obama was. 

Starting in 2009, if you look at the expenditure on the IT budget, 

the Federal Government has spent more than $525 billion on IT 

and it doesn’t work. It doesn’t work. 

And so I see that the President has a proposal, he needs another 

$3 billion. As if $525 billion wasn’t enough, he needs $528 billion 

in order to actually solve these problems. I have a hard time believing that we’re just 3 more billion away from actually solving this. 


KING-6430 with DISTILLER
3 

I understand the predicament that we’re in because as best I can see on a macro level, we are spending about 70 percent of our $80- 

plus billion a year now on legacy systems. And it is difficult, to say 

the least, on making that transition from those legacy systems to 

newer, more progressive, more secure networks and using the basic 

software. 

I got to review a document from the Department of Justice. Was 

on WordPerfect. WordPerfect was a great company back in 1990. 

They were a Utah company, and had a good product, but they still 

are using WordPerfect at the Department of Justice. And I’m sorry, 

with all due respect to Corel, it maybe is not the most up to speed 

and very difficult to share with others. 

And it just begs the question of why in the world we continue 

to have to teach people how to use COBOL. We have some that I 

have heard are using punch cards still. I mean, it’s unbelievable 

how far behind we are. And yet, I don’t think it’s for a lack of funding. 

It is just unexcusable for, in my mind—it is just inexcusable, I 

should say—inexcusable that we need a patch and it takes 50 days 

to do it. Fifty, really? Come on. Patching a vulnerability should be 

priority one and should be done within the day. There is no excuse 

for waiting nearly 2 months to patch what is known as a vulnerability. 

At the Department of Education, it’s something Mr. Ozment, I 

hope, would look at personally, because the inspector general was 

able to go into the Department of Education and look into their 

system, surf around for 3 days, and come out undetected, despite 

their deploying EINSTEIN, which begs the question of, with all 

due respect to the inspector general, I’m guessing they are good, 

but they are probably not as good as the Russians, the Chinese, the 

others that do this type of thing for a living. 

And so I do agree with Mr. Hurd that one of the things we have 

to talk about is how to fight back. And attribution, just flat-out acknowledgment and pointing the finger at who is doing what, might 

be a form of deterrent. But I do think it’s one of the big questions— 

we won’t answer it today—but I do think it’s a big question for 

those of us in Congress, how do you fire back? You know, if somebody fired a weapon on us we could fire back at them. But if 

they’re attacking us online, how do we fight back? And I don’t 

know the answer to that. 

But we need all of your help here today. We have got a lot on 

the line, a lot of personal information, a lot of vulnerabilities for 

the country itself. And so we thank you for your expertise and your 

commitment. We want to be part of the solution, not part of the 

problem, not just fire arrows. We are supposed to be oversight, but 

then government reform. And we can, I think, help you solve these 

problems, because this is the first time in the Congress we have 

actually had a subcommittee focused on just information technology. 

And so we are going to highlight the problems, but our next step 

is, how do we solve those? And, collectively, we need to come together in a bipartisan way and help you accomplish that and 

achieve that. So that’s the spirit in which we do this. 

I thank the gentleman. Thank you for the time. I yield back. 


KING-6430 with DISTILLER
4 

Mr. HURD. Thank you, Chairman. 

And now this subcommittee in 17, 18 short months has done, I 

think, a lot of good work in government reform and identifying the 

problem. And part of that is because of the bipartisan nature in 

which we do that. And we are able to do that because of the leadership of the ranking member on the Subcommittee on Information 

Technology, Ms. Kelly from Illinois, and I would like to recognize 

her for her opening statement. 

Ms. KELLY. Thank you, Mr. Chairman, for holding this hearing 

on how Federal agencies detect, respond, and mitigate the growing 

number of cyber threats they encounter each year. 

And thank you to our witnesses for being here. 

The Federal Government and the private sector are facing a volume of cyber attacks that just a few years ago would have been unimaginable. According to a new report by security firm Symantec, 

54 zero-day vulnerabilities were discovered in 2015, more than 

twice as many as in 2014. Compared to the previous year, in 2015, 

the instances of ransomware increased by 35 percent. 

We need to ensure that the Federal Government has the resources necessary to respond to these vulnerabilities and threats. 

Agencies are spending up to three-quarters of their information 

technology budgets maintaining legacy systems that were never designed to deal with today’s cybersecurity risks. Adding to the problem is the increasing difficulties agencies are having in filling more 

than 10,000 vacant cyber positions across the Federal Government. 

As Tony Scott, the chief information officer for the Federal Government, has said, and I quote, ‘‘We have a broad surface area of 

old, outdated technology that is hard to secure, expensive to operate, and on top of all of that, the skill sets needed to maintain 

those systems are disappearing rather rapidly.’’ 

But we are making progress in fixing that. I, along with my colleagues on this subcommittee and Ranking Member Cummings, 

were original cosponsors of Congressman Steny Hoyer’s Information Technology Modernization Act. The act would authorize the 

creation of an Information Technology Modernization Fund to help 

Federal agencies upgrade their aging information technology systems. Over the first 10 years the fund would help facilitate upgrades to $12 billion worth of civilian IT programs and make sure 

the Federal Government has the most effective, secure IT infrastructure possible. 

Legislation like the ITMA sends a clear message that Congress 

understands the challenges facing our Nation’s Federal IT systems. 

But there is more to be done. I look forward to hearing from our 

witnesses today when their threat response processes in place, and 

I look forward to working with you, Mr. Chairman, to do what’s 

needed to ensure that we keep the Federal Government secure 

from the growing number of cyber threats. 

I yield back. 

Mr. HURD. I would like to thank the ranking member for her 

comments. 

We will hold the record open for 5 legislative days for any members who would like to submit a written statement. 

Mr. HURD. Now I’d like to recognize our panel of witnesses. I’m 

pleased to welcome Mr. Sanjeev Bhagowalia. He’s the deputy asVerDate Nov 24 2008 13:10 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 H:\26066.TXT APRIL

KING-6430 with DISTILLER
5 

sistant secretary for information systems and chief information officer at the Department of Treasury. Mr. Steven Taylor, chief information officer at the Department of State. Dr. Andy Ozment, assistant secretary for cybersecurity and communication at the Department of Homeland Security. And Mr. Richard Barger, chief intelligence officer at ThreatConnect Incorporated. 

I would like to welcome you all. 

And pursuant to committee rules, all witnesses will be sworn in 

before they testify. So please rise and raise your right hands. 

Do you solemnly swear or affirm that the testimony you are 

about to give will be the truth, the whole truth, and nothing but 

the truth? 

Thank you. Please be seated. 

And let the record reflect the witnesses answered in the affirmative. 

In order to allow time for discussion, please limit your testimony 

to 5 minutes, and your entire written statement will be made part 

of the record. 

Mr. Bhagowalia, we will start with you, and you are recognized 

for 5 minutes. 

WITNESS STATEMENTS 

STATEMENT OF SANJEEV BHAGOWALIA 

Mr. BHAGOWALIA. Thank you, Chairman. 

Chairman Hurd, Ranking Member Kelly, and members of the 

subcommittee, thank you for the opportunity to testify on Treasury’s approach to the detection and mitigation of cybersecurity 

vulnerabilities. 

Treasury relies on technology to meet our mission of serving the 

American taxpayers and acting as a steward of the national economy. Cybersecurity is one of the top priorities of Treasury, not only 

for the CIO, but also for the Department and bureau senior leadership. We are continuously and incrementally improving in management oversight over the IT environment, including cybersecurity. 

We are leveraging synergy opportunities across the enterprise 

through authorities in law, like FITARA and FISMA, to more effectively use our people, policy, processes, technology, and governance 

in cyberspace. 

Detecting and mitigating vulnerabilities in our environment before they are exploited by our adversaries is an essential component in Treasury’s ‘‘defense-in-depth’’ strategy. 

I have divided my testimony into two parts. The first part will 

explain how we tackle vulnerability mitigation of the Department, 

and the second part will outline how we participate in the governmentwide Federal cybersecurity community. 

Part one, vulnerability detection, reporting, response, and mitigation within Treasury. As you know, Treasury is a large, geographically and technically diverse enterprise with bureaus having widely 

varying missions requiring widely varying IT environments. While 

Treasury bureaus are empowered to make IT decisions necessary 

to execute their individual missions and carry out operational security functions within their environments, the Treasury CIO is acVerDate Nov 24 2008 13:10 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 H:\26066.TXT APRIL

KING-6430 with DISTILLER
6 

countable to ensure that those decisions properly consider security 

implications and evaluate risk and vulnerabilities. 

Treasury has aligned our departmental cybersecurity strategy 

with the five-part NIST national Cybersecurity Framework and the 

Cybersecurity National Action Plan, CNAP, to ensure common objectives across the enterprise. 

Vulnerability detection. IT companies, government agencies, security researchers, and others identify thousands of security weaknesses each year. Critical vulnerabilities are a far smaller number, 

in hundreds. Vulnerability detection requires a multidimensional 

approach involving asset management, automated tools, monitoring 

of communication channels, and human analysis. The foundation of 

good comprehensive vulnerability detection is strong asset management. 

To this end, Treasury has policies in place requiring bureaus to 

perform regular asset and vulnerability inventory scans using automated tools. Treasury maintains a central Department-wide security operations center that operates around the clock. It’s called the 

SOC. The SOC monitors classified and unclassified government 

channels, as well as open source and industry channels, for news 

of critical vulnerabilities. 

In response, reporting, mitigation of known vulnerabilities, we 

follow the maxim that cybersecurity is about risk management. Bureau IT organizations undertake risk analysis for each vulnerability and schedule testing and patch deployment as appropriate. 

A risk analysis may result in several mitigation approaches, such 

as patching, instituting compensating security controls, and migrating to a new software or hardware solution. Treasury and its 

bureaus start by remediating vulnerabilities on assets with the 

greatest risk exposure first and then moving systematically to remediate the remaining assets. 

The recent Juniper vulnerability offers an example of this process in action. Table 1 in my written testimony illustrates how 57 

affected devices across Treasury were remediated from a time and 

risk perspective. Treasury coordinated an enterprisewide response 

to the Juniper vulnerability within a couple of hours of receiving 

the information from open source vendor channels and DHS. Treasury fixed 25 percent of the patches within a day, 84 percent within 

a week, and 86 percent within 2 weeks, and 93 percent 7 weeks. 

But if you look at it from a risk lens, we fixed 40 out of the 57 devices, representing 100 percent of high-risk devices, within 6 days. 

Of the remaining 17 low-risk devices, 13, or 76 percent, were completed by February 4, and the remaining 4 devices were completed 

over the next 10 days. 

A detailed analysis determined that the configuration posed low 

risk of the exploitation of the vulnerability because the devices 

were not directly connected to the Internet, were not directly affected by the vulnerability, and each had multiple layers of compensating controls in place. 

So a challenge faced by large agencies in complying with governmentwide mandates to address particular vulnerabilities is the 

need to balance operational and security risk. In many cases the 

device must be patched as part of a complex operational system 

with several legacy components that may not be compatible with 


KING-6430 with DISTILLER
7 

the security fix. So we respectfully request and suggest that factor 

should be considered in reporting. Could we have done it a little 

bit faster? Yes. 

Part two, Treasury’s role in governmentwide vulnerability detection, response, and mitigation. I would like to thank DHS for the 

leadership role in coordinating Federal cybersecurity. Treasury 

fully participated in the EINSTEIN program and looks forward to 

EINSTEIN 3A. The CDM program led by DHS will help us move 

as the entire U.S. Government from federated compliance to integrated continuous monitoring and mitigation. 

Treasury is an enthusiastic participant in the CDM program. We 

expect CDM will improve situational awareness regarding 

vulnerabilities and will move us to better automation of tracking 

in real time. 

In conclusion, while Treasury has established a solid procedural 

and operational foundation to identify and mitigate vulnerabilities, 

our adversaries are constantly changing their methods. I see two 

opportunities where congressional support could aid our efforts. 

First, hiring and retaining cybersecurity staff remains a challenge. We ask for continued support to streamline hiring and offering appropriate incentives to attract and retain that talent. 

Second, we ask for some consideration in the fiscal year 2017 

budget request for a cybersecurity enhancement account which will 

enable us to keep pace with the rapidly evolving adversaries 

through targeted and accountable spending. 

Thank you for your attention to this important matter. I appreciate this opportunity to testify today, and I will be glad to answer 

any questions you may have. Thank you. 

[Prepared statement of Mr. Bhagowalia follows:] 


KING-6430 with DISTILLER
8 


KING-6430 with DISTILLERInsert offset folio 1 here 26066.001

Written Testimony of 

Sanjeev "Sonny" Bhagowalia 

Deputy Assistant Secretary for Information Systems and Chief Information Officer 

United States Department of the Treasury 

Before the Subcommittee on 

Information Technology of the 

Committee on Oversight and Government Reform 

United States House of Representatives 

Introduction 

Chairman Hurd, Ranking Member Kelly, and members of the subcommittee, thank you for the 

opportunity to testifY today on the Department of the Treasury's procedures and approach to the 

detection, response, and mitigation of cybersecurity vulnerabilities. 

Cybersecurity is one of the top priorities at the Treasury, not only for the Office of the Chief 

Information Officer (OCIO), but also for our senior leadership at both the department and bureau 

levels. Like others in the public and private sectors, Treasury relies on technology to meet our 

mission of serving the American taxpayers and acting as a steward of the national economy. 

Trillions of dollars and millions of records are stored and processed using Treasury IT systems. 

We devote a great deal of time, effort, and resources towards securing those systems in order to 

successfully execute our mission and maintain the trust of the American public. 

Our adversaries in the cyber realm make this an increasingly difficult task, but one at which we 

must continue to succeed. Those targeting our people and our systems continue to grow in their 

sophistication, resources, and determination. According to a GAO official, cybersecurity 

incidents reported to the U.S. Computer Emergency Readiness Team (US-CERT) by all federal 

agencies increased more than 1,000 percent between 2006 and 2014. 1 Treasury's incidents have 

grown by a far smaller percentage over that same time period. However, Treasury is observing 

what the rest of U.S. industry and U.S. government has observed: cyber activity by our 

adversaries is growing in sophistication, volume, brazenness, frequency and potential impact. 

For example, each year we monitor hundreds of millions access attempts and millions of 

potentially malicious cyber events. In response to this ever-changing threat, we must continue to 

be vigilant against the next incident, not just the last one. We have improved our cybersecurity 

posture through a holistic approach of people, process (including policy and governance) and 

technology. We have also increased our spending on cybersecurity in the past few years to 

reflect the seriousness of the threat. Our Cyber Enhancement Account in the FY 2017 

President's Budget reflects our ongoing commitment to transparency and judicious use of 

resources as we augment Treasury's cyber defenses. We are continuously and incrementally 

improving in management and oversight of our IT environment including cybersecurity. We are 

leveraging synergy opportunities across the enterprise through legal authorities (e.g., FIT ARA, 

FISMA, and the Clinger-Cohen Act) to more effectively use our people, processes, technology in 

the cyberspace. 

1 Cyber Threats and Data Breaches lllustrate Needfor Stronger Controls across Federal Agencies, 7 (2015) 

(testimony of GregorY C. Wilshusen, Director, Information Security Issues). 
9 


KING-6430 with DISTILLERInsert offset folio 2 here 26066.002

Detecting and mitigating vulnerabilities in our environment before they are exploited by our 

adversaries is an essential component of Treasury's "defense-in-depth" strategy. Having the 

tools and processes to identifY and close these potential holes, and the communication lines to 

spread the message across government and to our private sector partners, are the keys to effective 

threat mitigation. 

I have divided my testimony into two parts, to answer the two questions posed by the 

subcommittee. The first part of my testimony will explain how we tackle this challenge at the 

Department ofthe Treasury. The second part of my testimony will outline how we participate in 

the government-wide federal cybersecurity community and support the lead agency for 

cybersecurity, the Department of Homeland Security (DHS). 

I. Vulnerability Detection, Reporting, Response and Mitigation within Treasury 

The Treasury Environment 

As you know, the Department of the Treasury and its bureaus have widely varying missions 

requiring widely varying IT environments. Our department is a large, geographically and 

technically diverse enterprise. From the industrial focus of the U.S. Mint and Bureau of 

Engraving and Printing, to the massive data storage and analytics focus of the Internal Revenue 

Service, to the advanced economic modeling performed in the Departmental Offices, each 

Treasury bureau requires a different mix of technologies to accomplish the overall Treasury 

mission. 

While Treasury bureaus are empowered to make the IT decisions necessary to execute their 

individual missions and carry out many of the operational security functions within their 

environments, the Treasury CIO is accountable to ensure that those decisions properly consider 

security implications and evaluate risk and vulnerabilities on an ongoing basis. To this end, 

Treasury has aligned our departmental cybersecurity strategy with the National Institute of 

Standards and Technology (NIST) Cybersecurity Framework and the OMB Cybersecurity 

National Action Plan (CNAP) to ensure a common understanding of our objectives across the 

enterprise. Treasury is fully supportive of the five-part NIST framework (identifY, detect, 

protect, respond and recover) and is proceeding with a department-wide effort to implement all 

applicable portions of the CNAP. Vulnerability management is part of the NIST framework. 

We follow the maxims that "cybersecurity is about risk management" and "if everything is a 

priority, nothing is a priority." Therefore, we must often make strategic decisions regarding 

where we should focus our efforts. To the extent possible, and especially in instances where 

time is of the essence, Treasury employs a risk-based approach to vulnerability remediation. 

Given the realities of a limited resource environment, Treasury and its bureaus start by 

remediating vulnerabilities on assets with the greatest risk exposure first, and move 

systematically to remediate the remaining assets. In addition to security risk, factors such as the 

operational risk posed to the business are evaluated during the remediation process. This 

prioritization enables bureaus to focus on fixing the most important vulnerabilities first while 

facilitating our ability to perform the mission of Treasury. 

2 
10 


KING-6430 with DISTILLERInsert offset folio 3 here 26066.003

Vulnerability Detection 

IT companies, government agencies, security researchers, and others identity thousands of 

security weaknesses each year in the devices and software that we all use on a daily basis. There 

are over 76,000 identified vulnerabilities in the National Vulnerability Database. In 2015 alone, 

over 6,000 new vulnerabilities were added to the database.2 Critical vulnerabilities are a far 

smaller number and may represent weaknesses with respect to external or internal threats. 

Vulnerability detection requires a multidimensional approach involving asset management, 

automated tools, monitoring of communication channels, and human analysis. Using each of the 

multidimensional approaches, Treasury identifies vulnerabilities in our environment that 

adversaries might exploit. 

The foundation of good comprehensive vulnerability detection begins with understanding how 

the hardware and software is used throughout an organization through strong asset management. 

Employing this approach allows us to evaluate the impact of each new vulnerability 

announcement against the equipment in our environment. To this end, Treasury has policies in 

place requiring our bureaus to perform regular asset and vulnerability inventory scans using 

automated tools. 

In addition to understanding the makeup of our IT environment and performing automated scans 

against known vulnerabilities, it is critical that we become aware of new vulnerabilities as 

quickly as possible after they are discovered. Treasury maintains a central security operations 

center (Treasury SOC) responsible for coordinated department-wide activity that operates around 

the clock working closely with bureau SOCs and security operations personnel to ensure 

protection of the department's IT assets. As one of its key functions, the Treasury SOC monitors 

classified and unclassified government channels, as well as open source and industry channels, 

for news of critical vulnerabilities and actively participates with other U.S. Government SOCs. 

Once critical vulnerabilities are identified, the Treasury SOC rapidly transmits the information to 

Treasury bureaus through alerting and notification channels. Bureau IT operations personnel 

assess the risk posed by the identified vulnerability to their respective networks and plan 

mitigation as appropriate, coordinating with the Department OCIO, who maintains overall 

oversight responsibility under FISMA and FIT ARA. 

Additionally, the Treasury SOC and bureau security teams assess our collective ability to detect 

and block malicious activity targeting a given vulnerability. Whenever possible, new signatures 

or indicators are added to Treasury's defensive measures to mitigate risk or respond to any 

negative impact that may have occurred while the vulnerability was exposed. 

Treasury also takes steps at both the enterprise and bureau levels to identity vulnerabilities that 

our automated scanning may not discover. Some of these countermeasures include penetration 

testing to uncover configuration or software and hardware vulnerabilities that hackers could 

exploit, as well as analyzing the attempts against us to identity patterns that may indicate a 

"zero-day," or undiscovered, vulnerability. 

2 https://nvd.nist.gov/ 

3 
11 


KING-6430 with DISTILLERInsert offset folio 4 here 26066.004

Response, Reporting, and Mitigation of Known Vulnerabilities 

To keep up with the thousands of vulnerabilities and associated patches that are released and 

may apply to their respective environments, the initial response by bureau IT organizations is to 

undertake a risk analysis for each new vulnerability. Informed by the risk analysis, bureau IT 

organizations schedule testing and patch deployment as appropriate. This risk analysis aligns 

with best practices and typically is highly technical and detailed. Factors that bureau IT 

organizations may consider include the version and current patch levels of vulnerable software 

running on our hardware, as well as whether the software is configured to block the use of 

exploitable services and whether other defenses are in place or can be instituted to reduce the 

likelihood of an exploitable vulnerability. These security concerns are then balanced with 

operational assessments and testing to mitigate potential business impact that could result from 

deploying any patches. 

A risk analysis may result in several mitigation approaches, such as patching, instituting 

compensating security controls, or migrating to a new software or hardware solution. These 

mitigation techniques are then evaluated through follow-on efforts. Compensating security 

controls may be assessed by a security professional, or automated tools used to scan and assess 

whether or not patches have been successfully applied throughout the department. This risk 

analysis and mitigation process covers the vast majority of patching and remediation efforts, and 

each Treasury bureau manages the timing and nature of the mitigation based on their established 

risk thresholds. 

Bureaus are required to report a set of metrics on vulnerability assessment and remediation to 

OCIO on a monthly basis, including statistics on percent of assets scanned for known 

vulnerabilities, and statistics on patch implementation. Additionally, for certain highly important 

or highly critical vulnerabilities as determined by a risk analysis at the Treasury OCIO, 

remediation progress is tracked closely by OCIO. 

The recent Juniper vulnerability offers an example of this process in action. Within a couple of 

hours after the vulnerability was announced by the equipment manufacturer, the Treasury SOC 

alerted bureau-level SOC counterparts to the vulnerability and to the mitigation instructions 

provided by the vendor. Additional updates and details from DHS were also transmitted to 

bureaus as they were received. Thanks to the quick action of the Treasury SOC and the bureaus' 

SOCs, remediation was already under way by the time government-wide alerts to patch 

vulnerable appliances were issued. Throughout the process, the Treasury SOC and OC!O 

gathered regular updates on remediation efforts via data call, which were communicated to DHS 

and Treasury leadership until the vulnerability was fully patched. For any highly critical 

vulnerabilities, the Treasury SOC and OCIO continue to monitor the remediation status until all 

the vulnerable assets are patched. 

Some notable milestones in this mitigation effort across Treasury include: 

• Treasury coordinated an enterprise-wide response to the Juniper vulnerability and patch 

within a couple of hours of receiving the information from open source vendor channels 

and DHS; 

4 
12 


KING-6430 with DISTILLERInsert offset folio 5 here 26066.005

• Treasury fixed 25% of the patches in a day; 84% within a week; 86% within two weeks; 

and 93% in seven weeks; 

• After a detailed analysis determined that two bureaus configurations posed low risk for 

exploitation of the vulnerability (because infected devices were not connected to the 

Internet and thus were not directly affected by the vulnerability and each had multiple 

compensating controls in-place) Treasury completed the remaining 7% of patching in just 

over eight weeks; 

• DHS NCCIC submitted a notice to all agencies in the U.S. Government indicating closeout of the action on February 17, 2016; 

• Treasury submitted the official status of the program to Congress on March 4, 2016. 

Table I accompanying this testimony illustrates the timeline followed by Treasury in mitigating 

the vulnerability. 

All organizations, both in the public and private sectors, face the same challenge in defending 

against the asymmetric nature of cyber incidents. To guarantee successful defense of our 

systems, we must be perfect I 00 percent of the time; to penetrate our defenses, while our 

adversaries only need to succeed once. Federal government organizations face additional 

challenges working within the restrictions of a two-year budget cycle, compliance with a long 

list of regulations to defend against adversaries who may change tactics at Internet speed with a 

singular focus. It is noteworthy that many breaches outside Treasury have exacerbated our cyber 

efforts, as they have for many agencies across Government. 

II. Treasury's Role iu Government-Wide Vulnerability Detection, Response and Mitigation 

Participation in Government-wide Vulnerability Mitigation 

First, l would like to start by thanking DHS for their leadership role in federal government 

cybersecurity. As a member of the federal cybersecurity community, Treasury does its part to 

support the efforts of DHS and others to identifY and remediate critical vulnerabilities. Treasury 

is an active participant in information sharing efforts, including the Automated Indicator Sharing 

program, the Cyber Response Group (CRG), and the Cybersecurity Coordination, Assessment, 

and Response (C-CAR) program. While programs such as C-CAR are instrumental in providing 

notifications regarding critical vulnerabilities across government, the speed at which our 

adversaries can identifY and exploit vulnerabilities in our infrastructure makes rapid alerts all the 

more essential. Treasury also has a vast network across government and industry to share 

cybersecurity practices and lessons learned. Treasury has also engaged with DHS for penetration 

testing, Remote Vulnerability Assessments (RVA) for high value assets; exchanges information 

with the law enforcement and intelligence communities for threat awareness; fully participates in 

the DHS EINSTEIN program and looks forward to participating in the EINSTEIN 3A program; 

and uses world-class cyber organizations to independently assess our cyber posture. 

Another challenge faced by large agencies in complying with government-wide mandates to 

address particular vulnerabilities is the need to balance operational and security risk. In many 

cases the devices that must be patched are part of complex systems with several legacy 

components that may not be compatible with a given security fix. If other security measures can 

5 
13 


KING-6430 with DISTILLERInsert offset folio 6 here 26066.006

mitigate risk while a patch is tested for interoperability with a particular system, that factor 

should be considered in reporting. As much as feasible, government-wide reporting on 

remediation compliance should factor in risk mitigation as well as raw patching numbers. 

I would also like to share a success story of government working together to collectively 

improve our cybersecurity. In May 2015, DHS issued Binding Operational Directive 15-01, to 

mitigate the most critical vulnerabilities currently identified on Internet-accessible systems for all 

Federal Civilian Executive Branch Departments and Agencies. They detected 363 initial active 

critical vulnerabilities (external) across the Federal Civilian Executive Branch and Departments 

and Agencies reduced this initial set to two; a 99% reduction. Treasury fully participated in that 

initiative, reducing to and maintaining our number at zero. 

Continuous Diagnostics and Mitigation (CDM) at Treasury 

The Continuous Diagnostics and Mitigation (COM) program led by DHS will help move 

Treasury and other departments and agencies from federated compliance to integrated 

continuous monitoring by implementing new technologies in three phases. Phase I, which is 

currently being implemented at Treasury, will focus on managing our assets and identifYing and 

prioritizing their vulnerabilities. Treasury is an enthusiastic participant in the COM Program. 

Later phases will focus on managing our users and managing security events. 

Treasury expects that COM will lead to improved situational awareness regarding vulnerabilities 

in our environment. When a new vulnerability is discovered, Treasury will have a single data 

repository containing near real-time information about our entire asset inventory to analyze in 

order to more quickly assess our risk exposure. COM will also enable better automation of 

vulnerability mitigation tracking in near real-time, reducing or eliminating in some cases the 

need for manual reporting of patch deployment through data calls. This will allow our staff to 

focus on assessing risk and remediating vulnerabilities rather than just reporting on them. 

Conclusion 

While Treasury has established a solid procedural and operational foundation to identifY and 

mitigate vulnerabilities, our adversaries are constantly changing their methods, and we must 

remain vigilant to stop them. Continued collaboration with DHS, OMB, and the Congress on 

improved and streamlined notification as well as standardized toolsets through COM will enable 

Treasury to more quickly learn of new vulnerabilities, as well as identifY and remediate the 

affected aspects of our infrastructure. 

Treasury understands that better use of our existing resources and strategic deployment of 

resources are just as important as new funding. Successful implementation of the Federal 

Information Technology Acquisition Reform Act (FITARA) provides opportunities for 

improvement in cybersecurity. FITARA can help to reduce the variance in IT asset profiles 

deployed across the agency, leading to faster mitigation of known vulnerabilities on common 

platforms. FIT ARA also enables us to better understand cybersecurity spending across the 

organization and identifY opportunities for efficiency, allowing us to be better stewards of the 

public funds we already have rather than requesting additional support. Treasury secured full 

6 
14 


KING-6430 with DISTILLERInsert offset folio 7 here 26066.007

approval of our FITARA plan in December 2015 and will be reporting significant strides in our 

April report, thanks to on-going comprehensive reviews of major programs (including cyber). 

Protecting against cyber intrusions remains a rapidly evolving challenge. In addition to the 

challenges and plans I already discussed, I see opportunities where Congressional support could 

aid our efforts: 

I. First, hiring and retaining cyber security staff remains a challenge. We ask for continued 

support to streamline hiring and otTer appropriate incentives to attract and retain that 

talent. 

2. Finally, we ask for your consideration of our FY 2017 budget request for a Cybersecurity 

Enhancement Account, which will enable us to keep pace with the rapidly evolving 

adversaries through targeted and accountable spending. 

Thank you for your attention to the important subject of vulnerability identification and 

remediation. I appreciate this opportunity to testifY today and I will be glad to answer any 

questions you may have. 

7 
15 


KING-6430 with DISTILLERInsert offset folio 8 here 26066.008

Table 1: Juniper Vulnerability Remediation Timeline 

8 
16 

Mr. HURD. Thank you, sir. 

Mr. Taylor, you are recognized for 5 minutes. 

STATEMENT OF STEVEN C. TAYLOR 

Mr. TAYLOR. Chairman Hurd, Ranking Member Kelly, distinguished members, thank you for inviting me to testify about the 

Department of State’s cybersecurity program. 

The Department of State, as the lead U.S. foreign affairs agency, 

has over 70,000 employees in our 275 overseas and 30-plus domestic locations. Like all government agencies and businesses, particularly organizations the size of the Department, we face a dilemma. 

The Department relies on the Internet and email to conduct our 

day-to-day operations, communicating with U.S. and foreign citizens and organizations about a wide variety of issues. We use these 

tools to support passport and visa applications, to communicate 

about foreign policy initiatives, and to conduct the day-to-day business of the Department. 

We also know that email and the Internet are avenues through 

which our networks and databases can be attacked. As a breach of 

our own unclassified email system in 2014 demonstrated, our adversaries see information handled by the Department and many 

other U.S. Government agencies as a desirable target. Annually, 

we experience millions of attempts to breach our networks and gain 

possession of our information. 

Protecting our information as we face increasingly sophisticated, 

frequent, and well-organized cyber attacks is a top priority for the 

Department of State. The Bureaus of Information Resource Management and the Diplomatic Security share the role of defending 

our networks through our joint security operations center and 

through collaborative long-range planning. 

Alongside our partner Federal agencies, we’ve developed increasingly robust defenses as the sophistication and intensity of these 

threats increases. The foundation of our cybersecurity framework is 

the Federal Information Security Modernization Act, or FISMA, 

along with OMB guidance and the National Institute for Standards 

and Technology guidelines. But we go far beyond these guidelines 

to protect our network and data while protecting privacy and civil 

liberties. 

The Department of Homeland Security serves as a first line of 

defense by filtering our traffic through the EINSTEIN system 

which detects and blocks cyber attacks on Federal agencies and 

through its trusted Internet connections and continuous diagnostics 

and mitigation initiatives. In addition, we monitor our networks 

with an extensive defensive toolset. 

We also make great efforts to educate our network users so that 

they, themselves, are defending our systems. Annually, the Department of State employees must complete security and privacy 

awareness training. In addition, network users must answer a security challenge question prior to logging on to the systems each 

and every day. 

We amplify the effectiveness of our defenses through partnerships with US–CERT, the Department of Homeland Security, the 

Federal Bureau of Investigation, the National Security Agency, 

U.S. Digital Services, and other agencies in the private sector. Our 


KING-6430 with DISTILLER
17 

partners in the intelligence community, DHS, and other agencies 

in the private sector perform penetration testing to ensure our defenses are capable of withstanding persistent attacks. They also 

provide us with a steady stream of information about probable 

sources, methods of attack, and recommended countermeasures. 

We recognize that intrusion is possible even with the best defenses. Today we train and prepare for a wide range of cyber 

threats. Some can be contained by removing a hard drive, while 

others may require that we take a system offline. We are constantly working with our partners to defend against the known and 

evolving threats. 

Looking to the future, we are creating a safe zone between our 

data and the Internet through segmentation of our networks, by reengineering our business practices, and leveraging cloud services. 

The most powerful and promising tools for our defense are effective 

risk management, our public and private partnerships, clearly defined agency roles, effective information sharing, employee education, and of course next generation technology. 

We appreciate the support on cybersecurity issues, and we look 

forward to working with Congress and our partners to defend our 

critical information and systems. Thank you. 

[Prepared statement of Mr. Taylor follows:] 


KING-6430 with DISTILLER
18 


KING-6430 with DISTILLERInsert offset folio 9 here 26066.009

DEPARTMENT OF STATE 

Testimony of Steven C. Taylor 

Chief Information Officer 

Bureau of Information Resource Management 

before the 

House Committee on Oversight and Government Reform 

Subcommittee on Information Technology 

United States House of Representatives 

April20, 2016 

Chairman Hurd, Ranking Member Kelly, and distinguished members-- thank you 

for inviting me to testifY about the Department of State's cyber security program. 

THE THREAT 

The Department of State, as the lead U.S. foreign affairs agency, has over 70,000 

employees at our 275 overseas locations and at over 30 domestic locations. 

Like all government agencies and businesses, particularly organizations the size of 

the Department, we face a dilemma. The Department uses the Internet and email 

to conduct our day-to-day operations, communicating with U.S. and foreign 

citizens and organizations about a wide variety of issues. We use these tools to 

support passport and visa applications, to communicate about key foreign policy 

initiatives, and to conduct the day-in, day-out business processes of the 

Department. We also know that email and the Internet are avenues through which 

our networks and databases can be attacked. As the breach of our own unclassified 

e-mail system in 2014 demonstrated, our adversaries see information handled by 

the Department- and many other U.S. government departments and agencies- as 

a desirable target. We experience millions of attempts to breach our networks and 

gain possession of our information annually. Protecting our information as we face 

increasingly sophisticated, frequent, and well-organized cyberattacks is one of the 

Department's top priorities. 
19 


KING-6430 with DISTILLERInsert offset folio 10 here 26066.010

THE DEFENSE 

At the Department of State, the Bureaus of Information Resource Management and 

Diplomatic Security share the role of defending our networks through our joint 

security operations center and collaborative long-range planning. Working with 

the Department's Bureau of Diplomatic Security and alongside our partner federal 

agencies, we have developed increasingly robust defenses as the sophistication and 

intensity of these threats increase. The foundation of our cyber security framework 

is the Federal Information Security Modernization Act, along with OMB guidance 

and National Institute for Standards and Technology standards and guidelines, but 

we go far beyond those guidelines to protect our network and data while protecting 

the privacy and civil liberties of system users. The Department of Homeland 

Security (DHS) serves as a line of defense by filtering all our traffic through the 

Einstein system, which detects and blocks cyberattacks on federal civilian 

agencies, and through the Trusted Internet Connections initiative. In addition, we 

internally monitor with our own defensive toolset and capabilities. We also make 

great efforts to educate network users so they themselves defend our systems. 

Department of State network users must complete cyber security and privacy 

awareness training. In addition, network users are expected to answer a security 

challenge question prior to logging on to their system each day. 

PARTNERSHIPS 

We amplifY the effectiveness of our defenses through partnerships with US-CERT, 

DHS, the Federal Bureau ofinvestigation, the National Security Agency (NSA), 

U.S. Digital Services, other agencies, and the private sector. DHS enhances our 

efforts through its Continuous Diagnostics and Mitigation program. Our partners 

in Diplomatic Security, intelligence community, DHS, other agencies, and the 

private sector perform penetration testing to ensure our defenses are capable of 

withstanding persistent attacks. Our partners provide us with a steady stream of 

information about probable sources and methods of attack, and recommend 

counter-measures. 

2 
20 


KING-6430 with DISTILLERInsert offset folio 11 here 26066.011

MITIGATION 

We recognize that intrusion is possible even with the best defenses. Today, we 

train and prepare for a wide range of cyber threats . Some can be contained by 

removing a hard drive, while others may require that we take systems off-line. We 

are constantly defending against known threats, and we work with our partners to 

protect against developing threats. 

THE FUTURE 

Looking to the future, the most powerful and promising tools for our defense are 

effective and efficient risk management, our public and private partnerships, 

clearly defined agency roles, effective information sharing, continuous education 

and reminders to our employees, and next generation technology. We appreciate 

the support of Congress on cybersecurity issues, and we look forward to working 

with Congress and our partners to defend our critical information and systems. 

I would be happy to take any questions you may have. 

3 
21 

Mr. HURD. Thank you, Mr. Taylor. 

Dr. Ozment, you are recognized for 5 minutes. 

STATEMENT OF ANDY OZMENT 

Mr. OZMENT. Chairman Hurd, Ranking Member Kelly, and members of the committee, thank you for the opportunity to appear before you today. 

Recent compromises clearly demonstrate the challenge facing the 

Federal Government in protecting our systems and networks 

against sophisticated, agile, and persistent threats. Addressing 

these threats is an important shared responsibility. 

Today I will focus on how we protect Federal civilian departments and agencies. It is important to note that each agency is responsible for managing its own cybersecurity risk under the Federal Information Security Modernization Act, or FISMA 2014. My 

organization assists agencies in performing that risk management 

through four lines of effort. 

First, we provide cybersecurity protections where it is effective 

and cost efficient. This baseline is principally provided by two programs. The EINSTEIN program detects and blocks cyber attacks 

outside of agency perimeters, and the Continuous Diagnostics and 

Mitigation, or CDM program, provides tools for agencies to identify 

and prioritize vulnerabilities within their networks. 

Second, we measure and motivate agencies to implement best 

practices through risk assessments and targeted guidance. 

Third, we serve as a hub for cybersecurity information sharing 

between the government and the private sector through automated 

means whenever possible. 

And fourth, we provide incident response assistance to agencies. 

The committee is well aware that cybersecurity vulnerabilities 

are all too common. My organization serves a key role in helping 

agencies resolve significant vulnerabilities. 

Upon learning of a new vulnerability, our first priority is to rapidly promulgate actionable information to our partners. When the 

vulnerability is particularly critical, we hold an emergency interagency coordination call. These calls allow DHS to quickly convey 

key information to chief information security officers across the 

Federal civilian government. 

Additionally, we share information through secure portals managed by our National Cybersecurity and Communications Integration Center, or NCCIC. 

After disseminating information about a significant vulnerability, 

DHS at times collects information about governmentwide remediation progress. This information is used for two purposes: to understand the prevalence of a particular vulnerability across government and to drive individual agencies to more quickly implement 

required mitigations. 

Currently, this data-collection process is largely manual, but the 

CDM program will fundamentally change this paradigm. Through 

the CDM program, DHS will provide civilian agencies with tools to 

monitor their internal networks. CDM will allow us to shift from 

current manual methods of collecting vulnerability data to automated data collection. 


KING-6430 with DISTILLER
22 

We have provided CDM Phase 1 tools to 97 percent of the Federal civilian government. Agencies are now deploying these Phase 

1 tools on their networks. But this is not a simple or easy process. 

Deploying new technologies across 23 agencies and over 2 million 

users is a significant undertaking. We will see incremental 

progress over the next year and expect the first agency data to be 

available in early fiscal year 2017. 

It is also important to note what CDM will not do. The first 

phase of CDM will detect vulnerabilities in workstations, servers, 

network infrastructure, and operating systems in devices like routers. But other devices, like printers, will be identified by these 

tools, but will not be assessed for vulnerabilities. 

Perhaps most importantly, CDM relies on individual agencies to 

rapidly deploy these sensors across their networks and to use CDM 

data to, in fact, address the identified vulnerabilities. 

Even after learning of a vulnerability, agencies have varied capabilities to fix the problems. We can also provide agencies with technical assistance and consultation upon request. These services help 

agencies mitigate complex vulnerabilities and design more secure 

systems and assets. 

We appreciate the help of Congress in passing several key statutes for Federal cybersecurity over the past 2 years, including modernizing FISMA and enacting the Cybersecurity Act of 2015. 

This year, the fiscal year 2017 President’s budgets funds several 

activities that will significantly enhance our ability to manage vulnerability detection and mitigation across the Federal civilian executive branch. 

First, the fiscal year 2017 budget funds a further acceleration of 

the CDM program and a new CDM phase focused on securing highvalue data on agency networks. 

Second, the budget provides resources for additional personnel to 

help agencies remediate complex vulnerabilities or to design more 

secure systems. 

Finally, the budget funds more proactive assessment teams using 

the same techniques as malicious hackers, known as red teams. 

With the help of Congress, we will continue driving towards additional automation and deploy the resources required to support 

expedited remediation. This must be a shared effort. DHS, our 

partner agencies, and Congress must join together to ensure that 

vulnerabilities are rapidly mitigated before sensitive information or 

government services are placed at risk. 

Thank you. 

[Prepared statement of Mr. Ozment follows:] 


KING-6430 with DISTILLER
23 


KING-6430 with DISTILLERInsert offset folio 12 here 26066.012

Written Testimony 

of 

Dr. Andy Ozment 

Assistant Secretary for Cybersccurity and Communications 

U.S. Department of Homeland Security 

Before the 

U.S. House of Representatives 

Committee on Oversight and Government Reform 

Subcommittee on Information Technology 

Regarding 

Federal Cybersecurity Detection, Response, and Mitigation 
24 


KING-6430 with DISTILLERInsert offset folio 13 here 26066.013

Introduction 

Chairman Hurd, Ranking Member Kelly, and Members of the Committee, thank you for 

the opportunity to appear before you today. Recent compromises of federal agencies clearly 

demonstrate the challenge facing the government in protecting critical information systems for 

essential operations and safeguarding our citizens' and employees' personal information against 

sophisticated, agile, and persistent threats. Addressing these threats is a shared responsibility. I 

will discuss the roles of the Department of Homeland Security (DHS) in protecting civilian 

federal departments and agencies from cybersecurity risks. I will then outline my Department's 

role in communicating significant cybersecurity vulnerabilities to federal civilian Executive 

Branch agencies, tracking remediation across government, and helping agencies mitigate 

vulnerabilities as required. 

The Role of the Department of Homeland Security in Federal Cybersecurity 

Within DHS, the National Protection and Programs Directorate (NPPD) has three sets of 

cybersecurity customers: federal civilian agencies, private sector companies, and State, local, 

tribal, and territorial (SLTT) governments. Department of Defense (DOD) and intelligence 

community (I C) networks are outside ofNPPD's remit. The Office of Cybersecurity and 

Communications at NPPD is not a law enforcement agency or a member of the intelligence 

community. Its sole focus is on helping our customers improve their cybersecurity. This 

testimony focuses on NPPD's role in securing federal civilian Executive Branch departments and 

agencies. 

Under current law, each agency is responsible for managing its own cybersecurity risk. 

NPPD assists agencies through four lines of interrelated effort. First, NPPD provides 

cybersecurity protections in certain cases where interagency services are effective and cost2 
25 


KING-6430 with DISTILLERInsert offset folio 14 here 26066.014

efficient. This baseline is principally provided by the EINSTEIN program, which detects and 

blocks cyber-attacks outside of agency perimeters, and the Continuous Diagnostics and 

Mitigation (COM) program, which provides tools for agencies to identifY and prioritize 

vulnerabilities and other risk conditions within their networks. Second, NPPD measures and 

motivates agencies to implement best practices through risk assessments and targeted guidance. 

Third, NPPD serves as a hub for cybersecurity information sharing between government and the 

private sector, through automated means wherever possible. And fourth, NPPD provides incident 

response assistance to agencies victimized by a cyber-attack. 

NPPD's Role in Vulnerability Detection, Response, and Mitigation 

Information Sharing 

NPPD serves a key role for the federal civilian executive branch in expediting the 

resolution of significant cybersecurity vulnerabilities. This role begins when we first learn of a 

new significant vulnerability. Upon doing so, either through a public announcement, our 

standing relationships with the cybersecurity vendor and research community, or our own 

activities, our first priority is to rapidly promulgate actionable information to our partners. For 

federal civilian agencies, our principal tools for this immediate dissemination are the 

Cybersecurity Coordination, Assessment, and Response (C-CAR) calls and alerts via standing 

portals. C-CAR calls allow DHS to quickly convey information to Chief Information Security 

Officers (CISOs) across the federal civilian government. While C-CAR calls are our frontline 

mechanism for rapidly transmitting critical cybersecurity information across the federal 

cybersecurity community, we leverage secure portals managed by our National Cybersecurity 

and Communications Integration Center (NCCIC) to disseminate more detailed information 

about a specific vulnerability. 

3 
26 


KING-6430 with DISTILLERInsert offset folio 15 here 26066.015

In conveying information about a particular vulnerability to federal agencies, we include 

detailed mitigation instructions and available contextual information necessary to help our 

partners understand the significance of the vulnerability and the implications of forestalling 

expeditious remediation. Generally, dissemination of information about a vulnerability via a CCAR call and the NCCIC portal is sufficient to raise awareness across the federal government 

and encourage agencies to rapidly implement necessary mitigations. The Federal Information 

Security Modernization Act of 2014 provided DHS with another tool to drive agency behavior: 

binding operational directives. These directives allow the Secretary of Homeland Security to 

require that agencies take certain actions in response to a known cybersecurity risk. For example, 

Secretary Johnson issued a binding operational directive in May 2015, requiring that all agencies 

mitigate critical vulnerabilities identified in their Internet-facing devices within 30 days of the 

vulnerability being identified to them by DHS. We conduct recurring scans to identifY 

vulnerabilities in these devices, and we provide each agency with a weekly report listing their 

vulnerabilities and providing mitigation recommendations. These scans are a critical tool in 

motivating agencies to address vulnerabilities in their Internet-facing decisions, and the binding 

operational directive proved effective in focusing agency attention. But binding operational 

directives are generally most effective where we can independently measure agency compliance 

and thereby ensure accountability. As discussed further below, the deployment ofCDM sensors 

across civilian federal agencies will provide significant data to support future binding operational 

directives. 

Data Collection 

After disseminating information about a significant vulnerability, DHS often collects 

information about government-wide remediation progress. This information is used for two 

4 
27 


KING-6430 with DISTILLERInsert offset folio 16 here 26066.016

purposes: to understand the prevalence of a particular vulnerability across government and to 

drive individual agencies to more quickly implement required mitigations. Currently, this data 

collection process is largely manual. DHS, typically in coordination with the Office of 

Management and Budget, disseminates a data call via a C-CAR call. Agencies then submit data 

to a central repository. This approach has several disadvantages: it relies upon agency selfattestation of their vulnerabilities and remediation progress, it imposes a time-consuming data 

entry requirement on each agency, and it depends on agencies to update their data regularly and 

accurately. The CDM program is fundamentally changing this paradigm. Through the CDM 

program, DHS provides federal civilian agencies with continuous automated diagnostics tools to 

detect vulnerabilities in near-real-time. CDM is divided into three phases: 

• CDM Phase 1 identifies vulnerabilities on computers and software on agency 

networks. It can be summarized as telling operators "what is in your network." 

• CDM Phase 2 will detect potentially malicious user behavior and ensure that 

users' authorized access does not exceed their assigned role in the organization. It 

can be summarized as telling operators "who is in your network." 

• CDM Phase 3 will assess activity happening inside of agencies' networks to 

identij'y anomalies that may indicate a cybersecurity compromise. It can be 

summarized as telling operators "what is happening on your network." 

We have provided CDM Phase 1 tools to 97% of the federal civilian government. 

Agencies are now deploying CDM Phase I tools on their networks. We will provide CDM Phase 

2 to federal civilian agencies by the end of this fiscal year. Once widely deployed, CDM Phase 1 

will lead to significant advances in vulnerability detection and mitigation for the federal civilian 

5 
28 


KING-6430 with DISTILLERInsert offset folio 17 here 26066.017

government. First, CDM sensors allow agencies to automatically and recurrently identity 

vulnerabilities in hardware and software on their networks. In turn, agencies will have a more 

accurate and timely understanding of vulnerability prevalence than they are able to achieve 

today. Second, CDM will allow us to shift from current manual methods for collecting 

vulnerability data to automated data feeds from each agency. Instead of asking each agency to 

manually submit a list with the instances of a particular vulnerability, we will be able to derive 

such a list nearly instantaneously from data provided by each agency to the federal dashboard 

hosted in the NCCIC. Third, CDM will provide us with the ability to assign each vulnerability a 

particular "risk score" that will represent its relative criticality. By increasing the risk scores for 

significant vulnerabilities, CDM will allow us to drive prioritized remediation activity across the 

federal civilian executive branch far faster than we can today. 

Assist Agencies with Remediation 

Agency capabilities to rapidly remediate identified vulnerabilities are often varied. We 

provide agencies with technical assistance and consultative services upon request to mitigate 

complex vulnerabilities and help agencies design more secure systems and assets. As discussed 

further below, the President's Fiscal Year (FY) 2017 Budget significantly expands our capacity 

to provide this valuable service to federal agencies. 

Case Study 

On December 17, 2015, a vendor released an out-of-band security advisory for an 

operating system running on certain routers and other network devices. This advisory was 

released after the vendor discovered unauthorized code that could allow an attacker to take 

control of certain devices and to decrypt secure connections. The same day, we held a C-CAR 

6 
29 


KING-6430 with DISTILLERInsert offset folio 18 here 26066.018

call with federal CISOs, including necessary mitigations. One day later, we sent a request to 

nearly 50 agencies requesting information on the impacted operating system and progress in 

mitigating the vulnerability. We then used our EINSTEIN system to check Whether any 

adversaries had attempted to compromise federal civilian agencies using the identified 

vulnerability. We have not identified any such attempts. Most agencies rapidly mitigated all 

instances of the vulnerability on their network. We worked with a small number of agencies that 

identified technical challenges during remediation to help them address the vulnerability or 

implement compensating controls. This example illustrates that the current process is wellexercised but relies on manual processes. We are also still not satisfied with how long it takes to 

ensure that a vulnerability is fully patched across the government. CDM will allow a necessary 

transition to automation and timely data analysis, and thereby inform better oversight for the 

government writ large and better cybcrsecurity at each agency. 

How Congress Can Help 

The FY 2017 President's Budget funds several activities that will significantly enhance 

our ability to manage vulnerability detection and mitigation across the federal civilian executive 

branch. First, the Budget funds a further acceleration ofCDM and a new CDM phase focused on 

securing high-value data on agency networks. Second, the Budget provides resources for 

additional personnel to help agencies remediate complex vulnerabilities or to design more secure 

systems. Finally, the Budget funds more proactive assessment teams that use the same 

techniques as malicious hackers, known as "red-teaming." These assessment teams detect 

vulnerabilities that the agencies themselves may have missed and determine how easily an 

adversary could compromise the agency's network. 

7 
30 


KING-6430 with DISTILLERInsert offset folio 19 here 26066.019

As noted, NPPD also has a significant role in helping the private sector secure itself. 

Many companies take a holistic approach to assessing and mitigating risks from cyber attacks, 

physical sabotage, and natural disasters, all of which can all result in disruptions to their essential 

services. As our nation continues to face increasing and evolving cyber threats and other risks, 

the Department must likewise use an integrated approach in preparing for these threats. In a 

major step toward this unified approach, the Department proposed to transition NPPD to an 

operational component, the Cyber and Infrastructure Protection Agency. This transition would 

elevate cyber operations and provide more comprehensive, coordinated risk management support 

to our stakeholders that reflect the growing convergence of cyber and physical threats. As one of 

the current priorities of the Secretary, the Department submitted a plan to NPPD's authorizing 

and appropriating committees, calling for congressional support and action. The transition, if 

implemented, would improve the services provided to NPPD's stakeholders. Not only would the 

transition provide a more comprehensive approach to national level stakeholder engagement and 

relationship management, but stakeholders in the field would also have access to a unified 

catalog of services and tools that spans across all ofNPPD. For example, the plan proposes to 

establish regional offices to better integrate field staff like Protective Security Advisors and 

Cyber Security Advisors, and support coordinated engagement with industry partners on cyber 

and physical vulnerability assessments, information sharing, incident response and other efforts. 

We need to position ourselves to successfully address the realities oftoday's cyber 

environment and its impacts on critical infrastructure. The proposed structural changes at the 

headquarters and regional levels will enable NPPD to be more efficient and effectively deliver 

the important tools and resources to our critical infrastructure stakeholders that need them the 

most. NPPD is committed to ensuring that our partners understand how disruptions and attacks 

8 
31 


KING-6430 with DISTILLERInsert offset folio 20 here 26066.020

on infrastructure can impact homeland security, community resilience, and our economy, and 

have the tools to drive informed action to mitigate those risks. 

Conclusion 

Vulnerabilities will continue to be identified and our adversaries will continue to use 

these vulnerabilities in attempting to compromise federal agencies. The key to effective 

vulnerability management is communication, automation, and resources for remediation. We 

have developed the government-wide processes for effective communication of significant 

vulnerabilities. With the help of Congress, we will continue driving toward additional 

automation and deploy the resources required to support expedited remediation. But this must be 

a shared effort. DHS, our partner agencies, and Congress must join together to ensure that 

vulnerabilities are rapidly mitigated before sensitive information or essential government 

services are placed at risk. 

9 
32 

Mr. HURD. Thank you, Dr. Ozment. 

Mr. Barger, you are recognized for 5 minutes. 

STATEMENT OF RICHARD BARGER 

Mr. BARGER. Chairman Hurd, Ranking Member Kelly, members 

of the subcommittee, thank you for the opportunity to appear here 

today. 

My name is Rich Barger. I’m the chief intelligence officer and cofounder of ThreatConnect, a Virginia-based security company. I 

lead our research team. It’s responsible for tracking existing and 

emerging threats, to ensure that our software platform is uniting 

security teams, their processes, and their technologies to bring together a cohesive unity of effort so that organizations can more efficiently conduct intelligence-driven security operations. 

ThreatConnect was founded in 2011 and our platform launched 

in 2013. Since then, we have seen 40 percent of the Fortune 100 

use our platform and amassed over 9,000 global users. 

Today my testimony will focus on fragmentation as the root 

cause behind our continuing struggle to detect, respond to, and 

mitigate modern threats. The four key areas I will discuss are people, processes, technologies and community. 

Our customers within both public and private sectors often express the same problem, but they do so in different ways. Fragmentation across their security operations is both their biggest 

frustration as well as their biggest risk. Whether they are a global 

financial services firm, a U.S. energy company, or a Federal agency, the fissures that exist across people, processes, and technologies 

create the very footholds into our networks that give malicious actors access to our finances, sensitive personal data, and corporate 

intellectual property. 

Now, it’s important to understand that information security is 

heavy work. There is no easy button. There is no silver-bullet solution. Today’s network defenders face a gargantuan task of protecting networks that were not originally designed with security in 

mind. 

In terms of security teams and practitioners, as we increase our 

numbers of individuals and teams required to work together, organizational agility, transparency, and situational awareness will 

often suffer, making us our own worst enemy. Too often as an organization’s domain expertise and institutional memory is scattered 

across these diverse teams, share drives and emails, it is often rendered functionally inaccessible. 

Fragmentation also exists across the executive staff, from Csuites to boards. There is a communication deficit which negatively 

impacts leadership’s ability to interpret and prioritize core challenges and subsequently leads to ineffective decisionmaking. 

This brings us to process. There is no one-size-fits-all approach. 

Enterprises, much like snowflakes, are made of the same elements 

but uniquely configured. Different business objectives drive different business processes and multidisciplinary security operations 

reflect a company’s overarching sector, vertical, legal, and regulatory requirements. 

In a lot of cases the answer to, ‘‘Why do you do it this way?’’ is 

simply, ‘‘We’ve always done it this way.’’ It’s much easier to advoVerDate Nov 24 2008 13:10 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00036 Fmt 6633 Sfmt 6633 H:\26066.TXT APRIL

KING-6430 with DISTILLER
33 

cate for a new tool or more head count. Optimizing process seems 

mundane and intelligible by comparison. But this is the dirty little 

secret. Developing coordinated intelligence-driven processes is the 

linchpin to identify, protect, and respond to threats in an efficient, 

measurable way. 

In terms of technology, security teams worldwide feel that they 

spend too much time wrangling their various security solutions. Instead, they should be delivering that much-needed breathing room 

for these overburdened teams. Instead, these solutions often consume additional resources, and many are not designed to be interoperable. Better orchestration of security systems creates a combined-arms approach that allows the sum of the parts to yield mutually supporting effects against threats. 

The first three areas, people, processes and technologies, are internal to the enterprise. The last source of fragmentation is at the 

community level, outside the enterprise. Sharing today centers 

around atomic indicators of compromise. 

Now, this is a good start, but we need to do more of it and we 

need to also include sharing of the recipes that created the indicators in the first place. So let’s continue to evolve today’s baseline 

sharing practices to our broader goal of cross-sector coordination 

and collaboration. 

In conclusion, the disconnect between expectation and reality 

that fragmentation presents is a catalyst which is elevating the priority of enterprise security within the corporate structure. This rise 

must continue, and organizations must be properly incentivized to 

look at enterprise security as a critical business function. 

The security professionals of tomorrow must be educated and enabled to meet the current demand of security talent, and the market must drive the need for interoperable security technologies. The 

gap between compromise and detection is not closing, and that is 

why we are committed to reducing that thorny reality of fragmentation across both public and private sector security operations. 

I thank you for your time, and I look forward to any of your 

questions. 

[Prepared statement of Mr. Barger follows:] 


KING-6430 with DISTILLER
34 


KING-6430 with DISTILLERInsert offset folio 21 here 26066.021

THREATCOI\"'ECT 

Prepared Testimony and 

Statement for the Record of 

Richard Barger 

Chief Intelligence Officer, ThreatConnect, Inc. 

Hearing on: 

"Federal CyberSecurity Detection, Response and Mitigation" 

Before the 

House Committee on Oversight and Government Reform 

Subcommittee on Information Technology 

Chairman Hurd, Ranking Member Kelly, and members of the Subcommittee, thank you for the opportunity 

to appear before the Committee today. 

My name is Richard Barger, and I am the Chief Intelligence Officer and co-founder of ThreatConnect, a 

Virginia-based cybersecurity company. I lead a research team dedicated to understanding existing and 

emerging cyber threats to ensure our software platform equips organizations to conduct intelligence-driven 

security operations. Prior to ThreatConnect, I served as a U.S. Army Military Intelligence Analyst and 

supported customers within the Department of Defense and Intelligence Community as a civilian. 

ThreatConnect, Inc. was founded in 2011, and our platform launched in 2013. Since then, we have seen 

40% of the Fortune 100 use our software, as well as more than 9,000 global users. We have amassed 

details for more than 55,000 security incidents and 3,500 threats which consist of more than 3.5 million 

indicators. From our inception, we have committed to and offered a free cloud-based edition of our 

ThreatConnect software platform so everyone has the opportunity to collaborate and simplify the 

challenges of cybersecurity. 

3865 Wilson Blvd. I Su!l~ 5SO 1 .tv!ington. VA 22203 

P 1.&00.965.2708 F + 1 703.2:?9 4489 

www. ThreatConnect.com 
35 


KING-6430 with DISTILLERInsert offset folio 22 here 26066.022

THREATCOI\"'ECT. 

Today my testimony will focus on the concept of fragmentation as the root cause behind our continuing 

struggle to detect and respond to cyber threats in both the public and private sector. The four key areas I 

will discuss are people, processes, technologies, and community. 

Fragmentation 

ThreatConnect customers within both the public and private sectors often express the same problem in 

different ways: fragmentation across their security operations is both their biggest frustration and their 

biggest risk. Whether they are a global financial services firm, a North American oil and natural gas 

company, or a federal agency, the fissures that exist across people, processes, and technologies create 

footholds into our networks that allow malicious actors access to our finances, sensitive personal data, and 

corporate intellectual property. 

Security is difficult work. There is no "easy button" or "silver bullef' solution. Today's defenders face the 

gargantuan task of protecting networks that were not designed with security in mind. Our defensive posture 

tends to be a reaction to the last threat or breach, which briefly focuses attention and resources on "doing 

more". As a result, we add another device or build another team. But this additive response exacerbates 

fragmentation. 

The 2015 Verizon Data Breach Investigation Report' (DBIR) highlights that 60 to 90% of the time 

adversaries are breaching enterprises in days or less, but are only being detected in days or less 10 to 

20% of the time. There is a huge gap of time between initial breach and response. Our own research 

validates the DBIR's findings, from sophisticated state actors who targeted the Office of Personnel 

Management" as well as entities with strategic diplomatic and strategic interests in the South China Sea. 3 

Our efforts over the past decade - new authorities, laws, advancements in technology, increased security 

investments -are not making much of a difference against this detection deficit. This is where I believe we 

are coming up short: our innate inability to evolve our respective security resources into an organism that 

can intelligently orchestrate its own defense. Focusing on a constantly evolving threat landscape distracts 

us from the realization that we are our own worst enemy. 

Fragmented Security Teams 

As we increase the number of individuals and teams required to work together, organizational agility, 

transparency and situational awareness often suffer, making us our own worst enemy. More people may be 

necessary, but it is no longer possible to play "man-to-man" defense in information security. Effective zone 

defense requires investments that allow people to efficiently prioritize, triage, memorialize, and share their 

findings. Too often an organization's expertise and institutional memory is scattered across diverse teams, 

shared drives, and emails, often rendering it functionally inaccessible. Reducing the fragmentation of 

security teams is just one of the hurdles that we at ThreatConnect are helping the industry clear by giving 

1

http://www. verizonenterprise.com/DBIR/2015/ 2

https:/lwww.threatconnect.com/opm-breach-analysis-update 

3

https:/lwww.threatconnect.com/camerashy/ 
36 


KING-6430 with DISTILLERInsert offset folio 23 here 26066.023

THREATCOI\"'ECT 

the experts a secure place to work together, so that everyone benefits from their collective knowledge and 

talents. 

Fragmentation also exists across executive staff, C-suites and Boards. There is a communication deficit, 

which negatively impacts leadership's ability to interpret and prioritize core organizational challenges and 

subsequently leads to ineffective decision making. Effective communication, increased transparency, and 

shared situational awareness across a variety of stakeholders is a key center of gravity that we recognize 

and where we are investing to help organizations achieve greater efficiencies in the face of increased risk. 

Fragmented Processes 

In terms of security processes, there is no one-size-fits-all approach. Enterprises are like snowflakes: made 

of the same elements, but uniquely configured. Different business objectives drive different business 

processes, and multidisciplinary security operations reflect a company's overarching sector, vertical, legal 

and regulatory requirements. Combined with the growth of security teams described earlier, this is a recipe 

for fragmentation. Examples abound such as a vulnerability management team failing to coordinate a list of 

unpatched assets with the Security Operations Center (SOC) or the SOC escalating a series of suspicious 

events to those assets without including required information for the incident response team. 

Intelligence-driven security needs to become the focus as practitioners grapple with a tangle of these siloed 

processes built around different teams and technologies. It is much easier to define, measure, and 

advocate for the resources required for a new tool or new headcount; optimizing processes seems 

mundane and intangible by comparison. But this is the dirty little secret: developing coordinated 

intelligence-driven processes is the linchpin to identify, protect and respond to threats in an efficient, 

measurable way. This is one of the most powerful value propositions for our customers, but also one of the 

most difficult to explain. At ThreatConnect, we are helping global organizations master their own 

processes and in-house data and complement it with external threat data to proactively identify threats 

before damage occurs. As these organizations build confidence and gain comfort, they begin to adjust 

some of those other siloed processes - incorporating thern into this newfound knowledge base and fine 

tuning so they can put their energy where it matters most. 

Fragmented Solutions 

We have engaged with security teams worldwide, and they often highlight that they spend an inordinate 

amount of time struggling with their various security solutions, such as perimeter or endpoint controls. 

Today's practitioners expect these solutions to deliver "breathing room" to the organization and create 

measurable efficiencies, not consume additional organizational resources. Unfortunately many of these 

solutions are created in a vacuum and simply are not designed to be interoperable. This is where the 

industry feels the pain of fragmentation the most. Practitioners feel they are in the business of wrangling 

these solutions, rather than actually securing their organizations. This is why we place so much emphasis 

on the need to bring the power struggle between man and machine back into balance. 

By replacing fragmentation across security teams, security processes and security solutions with 

orchestration, we begin to align the disparate parts of security operations. This concept of orchestration is 
37 


KING-6430 with DISTILLERInsert offset folio 24 here 26066.024

THREATCOI\"'ECT 

not a new notion for those in the public sector familiar with Command & Control, Communications, 

Computers, Intelligence, Surveillance and Reconnaissance (C41SR). But this is a significant doctrinal shift 

for private sector enterprises very much rooted in traditional fragmented security practices. Today we see a 

growing hunger in industry for solutions to these fragmented practices. Even if an organization is only 

starting to recognize foundational C41SR principles such as centralization and coordination are key, they 

still instinctively understand how reducing fragmentation will have an impact. From our work with 

organizations around the globe, we understand that to be effective agents of change we need to enable 

security operations to be integrated, orchestrated, and supported by intelligence and interoperable 

defensive solutions. This is the combined arms approach that allows the sum of the parts to yield mutually 

supporting effects against threats. 

Fragmented Community 

At Threa!Connect we see information sharing as a key tenet to overcoming the challenges of fragmentation 

between today's siloed security organizations. At the core, information sharing is less a technical issue and 

more of a cultural issue. As practitioners, we have either participated in or maintained a multitude of private 

researcher-sharing communities, all of which have their own unique focus areas, memberships, and 

respective value proposition. Within the 2015 Verizon DBIR, ThreatConnect contributed metrics associated 

with various types and levels of sharing that occurs within our platform, reinforcing that individual sharing 

communities are often unique. They vary in topical focus areas, member experience and size; some 

individual participants share more frequently than others; and some share content that is arguably of more 

value than others. 

Ironically, we encounter many organizations that lack effective information sharing practices within their 

own organization, where privacy and trust should be more abundant It is then not surprising that some will 

try to put the cart before the horse and navigate the complexities of institutionalized external sharing. 

Organization to organization information sharing continues to remain an "advanced move· for many as an 

official corporate practice. Today, sharing is fragmented and often occurs under the radar of executive or 

legal staff, primarily happening informally at the individual practitioner level. Sharing in this manner has its 

advantages: it is often quicker, more frequent, and the information shared is often of higher quality than 

what is found in bulk via the more formal information industry sharing programs. However, that approach is 

not scaleable. 

The passing of S. 754, the Cybersecurity Information Sharing Act of 2015, has renewed focus on 

information sharing. S.754 is a step forward for our industry, but remains very much focused on enabling 

technical, atomic indicator-based sharing with the Department of Homeland Security (DHS). ThreatConnect 

remains committed to supporting initiatives such as DHS's Automated Indicator Sharing (AIS), but we also 

look forward to working with DHS and others to evolve today's baseline sharing practices toward a broader 

goal of cross-sector coordination and collaboration. 

In our view, atomic indicator sharing is a useful first step in fostering a sharing culture, but those indicators 

are highly perishable. Unless sharing happens in near real-time, the value of those indicators deprecate 

quickly. Indicators of compromise are the tactical bits of our business, but we have to evolve collaboration 

to include sharing the "recipes" or the process by which the indicators were created in the first place. This 
38 


KING-6430 with DISTILLERInsert offset folio 25 here 26066.025

THREATCOI\"'ECT 

requires a foundation of trust across the stakeholders, which is largely established through day-to-day 

operations and social interactions. There is no better way to establish trust than rolling up one's sleeves, 

planning, and working through a problem together. It is here that we foster lasting trust and democratize 

domain knowledge and expertise for the long term -the type of information sharing that lasts decades. 

Final Conclusion 

It is said that "necessity is the mother of invention." ThreatConnect was created with a desire to fill such a 

necessity that I and my co-founders witnessed first-hand supporting the Department of Defense and 

various intelligence agencies. The "detection deficit" I mentioned earlier highlights that despite a decade of 

best efforts, we are not improving. The gap between compromise and detection is clearly not closing, which 

is why we are working to reduce the thorny reality of organizational fragmentation across public and private 

sector security operations. Without closing that gap, we continue to be our own worst enemy, and we 

cannot expect to be effective in detection, response and mitigation 

Across a spectrum of threat actors driven by ideological, criminal, or espionage motives, the internet knows 

no borders. Yet everyday the global market expects security and privacy to be easy, ever present, and to 

simply work. Irrespective of sector, security continues to be an achilles heel for many organizations due to 

the types of fragmentation issues we've highlighted here. The disconnect between expectation and reality 

is elevating enterprise security to become a more prominent and central fixture within the corporate 

structure. This rise in priority must continue and organizations must be incentivised to look at enterprise 

security as a critical business function. Information sharing initiatives must transcend cross-sector 

coordination and collaboration. The security professionals of tomorrow must be educated and enabled to 

scale to the current demand for talent. 4 The market must drive the need for interoperable security 

technologies. 

By solving the challenges that we find at the seams, we can begin to reduce the effects of fragmentation 

between our organization's people, processes, technologies. 

Thank you again for the opportunity to testify before you today. I look forward to your questions. 

'https:l/www.threatconnect.com/sending-aspiring-jedi-knights-to-the-dagobah-system/ 
39 

Mr. HURD. Thank you, sir. 

And I would like to recognize first, for the first set of questions, 

my colleague from the great State of Texas, Mr. Farenthold. He is 

recognized for 5 minutes. 

Mr. FARENTHOLD. Thank you very much. 

I’m going to start with you, Mr. Ozment. 

The FBI for years has been pushing for encryption backdoors so 

they can easily access device content. However, security experts, including Ash Carter and NSA Director Admiral Rogers, as well as 

former leaders from the intelligence community, have all said that 

encryption is essential to national security, cybersecurity, and economic security. 

What is your take on the call for back doors? Do you think that 

makes us safer or less safe, and why? 

Mr. OZMENT. Thank you, sir. 

The administration has highlighted a number of times that this 

is a very complicated issue with legitimate and important perspectives on both sides of the issue. We do have law enforcement concerns and the need to access data from malicious adversaries, 

whether they be terrorists or criminals, to deter and catch those individuals responsible for malicious actions. At the same time, from 

a cybersecurity perspective, we want more broad and secure 

encryption and other technologies to be widely disseminated. 

I would reflect the administration’s position here that we do need 

a national conversation on this issue, and I think it’s important 

that Congress has taken this issue up and has focused on it. 

Mr. FARENTHOLD. All right. 

Mr. Barger, do you have a take on that? 

Mr. BARGER. So the encryption issue is a very, very complicated 

subject. I would encourage the government to consider how they 

should be able to conduct investigations in striking a balance between privacy and also the need—— 

Mr. FARENTHOLD. We see in the case of the San Bernardino terrorist’s iPhone that the FBI hired a hacker to break into, and they, 

the FBI, won’t tell us how they did it. Haven’t they discovered a 

cyber vulnerability in iPhones that needs to be disclosed so it can 

be patched? 

Mr. BARGER. Well, I don’t necessarily know the situation, the 

sources and methods which they applied to that, but it seems that 

they have found a creative workaround to the environmental conditions in which they were forced to operate and have been able to 

carry their investigation forward. Whether or not that was used for 

a specific vulnerability, I wouldn’t know. 

Mr. FARENTHOLD. All right, let’s shift a little bit here to the 

Cybersecurity Information Sharing Act. And since DHS is kind of 

the hub, as you say, for that, what kind of success are we having 

on that? Are you tracking how many attacks have been shared that 

way and whether companies are actually applying the information 

that’s being shared there? Do we have some numbers on any successes or failures there? 

Mr. Ozment, that’s clearly in your alley. 

Mr. OZMENT. Thank you, Representative. 

So we have, as you know, that Congress passed this act in December of 2015, and gave DHS some fairly aggressive deadlines. 


KING-6430 with DISTILLER
40 

I’m proud to report that we did meet those deadlines and the Secretary of Homeland Security formally certified that the system was 

live on March 17 of this year. 

We will grow the system incrementally. We are not going to 

reach all of the American economy in just a few months. I’m very 

happy with our rate of growth to date. We have 14 non-Federal entities currently connected to our server and 82 who are in the process of connecting the server who have signed our terms of use. 

So there’s clearly an interest in doing this. It does require the 

other participant to build some IT infrastructure on their side. So 

it’s like we’ve built a phone system and we have a phone. They also 

have to acquire a phone before they can call us. 

Mr. FARENTHOLD. So you’ve been up and going a month now. Is 

that correct? Roughly a month? 

Mr. OZMENT. That’s right. 

Mr. FARENTHOLD. So have there been any threats shared? I 

mean, do you have a number? 

Mr. OZMENT. We have shared over 2,000 indicators to the private 

sector and we have received additional indicators that the private 

sector did not allow us to share onward to other companies but 

that we did share internally within the Federal Government. 

It is important to note that an indicator does not equal an incident. And so a company or government agency can learn about an 

indicator from a failed attack just as they can learn from a successful attack. So these do not all represent incidents. They represent 

‘‘be on the lookout for this bad guy’’ activity. 

Mr. FARENTHOLD. And one of the big concerns with the act was 

the sharing of personally identifiable information. How much personally identifiable information are we seeing coming and going 

with this? 

Mr. OZMENT. We have multiple layers of protection to protect privacy. First, companies are required to vet what they share themselves. We have some automated mechanisms to prevent inappropriate or incorrect information from being shared. And then there 

are a few types of information that would require human review. 

The way that we block in an automated way inappropriate information from being shared is that we just don’t accept it, so it’s not 

even possible to send it to us. So I can’t tell you how many of those 

blocks have occurred. I can tell you that our human review has not 

identified any inappropriate information, to my knowledge. 

Mr. FARENTHOLD. I will dive into this a little bit deeper if we get 

a second round of questioning. I see my time has expired. 

Mr. HURD. Ms. Kelly, you are recognized for 5 minutes. 

Ms. KELLY. Thank you, Mr. Chair. 

According to its Web site, the United States Computer Emergency Readiness Team, US–CERT’s role is to, and I quote, ‘‘leads 

efforts to improve the Nation’s cybersecurity posture, coordinate 

cyber information sharing, and proactively manage cyber risk to 

the Nation.’’ 

Dr. Ozment, can you explain what that means? 

Mr. OZMENT. Absolutely. So the US–CERT is a part of the 

NCCIC, our National Cybersecurity and Communications Integration Center. They have three broad roles shared by my larger organization. First is to promulgate best practices, help companies and 


KING-6430 with DISTILLER
41 

Federal agencies understand what do they need to do to protect 

themselves? 

Second, is to share information about what the adversaries are 

doing so that those companies and agencies can adapt their defenses to the changing behavior of our adversaries. 

And third is to respond to incidents. US–CERT will respond to 

incidents, whether in the private sector or Federal Government or 

State, local, and tribal and territorial governments. We do that either by going on site, which we try to minimize because of the expense and overhead of doing it, or we can help remotely, sometimes 

just by analyzing the malicious software that was used in an intrusion, other times by giving more customized help to the situation. 

We prioritize the victims that come to us for help based upon our 

national risk. But we really encourage companies to reach out to 

the Federal Government, whether law enforcement or through us 

doesn’t matter, we will connect it on the back end, and let us know 

about incidents so that we can come and help. 

Ms. KELLY. So if an government agency’s computer is hacked and 

you say that part of your effort is to respond, does that include forensic analysis? What all does that include when you respond? 

Mr. OZMENT. That’s right. It includes—well, let me take a step 

back. Our role is different from law enforcement, and by analogy, 

every cyber incident is like an arson in the physical world. You 

want to have both the police and the firefighters responding to the 

incident. 

Our role is similar to that of the firefighter. We want to help a 

victim figure out where is the bad guy on their network, how do 

they get him off the network, work together to push that bad guy 

off the network, and then improve their defenses so that they are 

not just compromised again immediately thereafter. 

Then we take—well, all throughout that process, we take what 

we learn in this one incident and we broadcast it to other sectors, 

other companies, other agencies so that everybody can learn from 

the incident and make sure that they are themselves not victimized 

by the same approach that the adversary used in this case. 

Ms. KELLY. Okay. Now let’s turn to government contractors. As 

you know, the biggest cyber intrusions of 2015 involved government contractors. Anthem is the largest provider of health insurance to government employees and it was hacked. KeyPoint is a 

provider of background investigation services and it was hacked, 

leading to the breach of OPM’s network. What role did US–CERT 

play in the company’s responses to those major cyber attacks? 

Mr. OZMENT. I want to be careful not to speak to individual companies because we keep the confidentiality of our customers, if you 

will. But we have responded to attacks at both private sector companies, contractors, and Federal Government agencies. Depending 

on the situation, our role has been to analyze the malicious software, figure out, how did they break in and what did they once 

they got there? It has been to provide remediation advice: Here are 

the types of security measures you can put in place to ensure that 

this doesn’t happen again. And to help them kick the bad guy off 

their networks. 

In an incident you often find a malicious actor, or you see traces 

of them on, say, one computer, and that’s how you figure out that 


KING-6430 with DISTILLER
42 

you’ve been compromised. But if you just kick them off that one 

computer, you can’t be confident that you fully removed them from 

your network. So the first thing you have to do is look throughout 

your network, watch the bad guy, stay silent and watch the bad 

guy, see who they are talking to and where else they are on your 

network. You have to do that for a period of time so that you can 

be confident that when you kick them off you’ve gotten them entirely off your network, and we help victims with that as well. 

Ms. KELLY. Okay, thank you. 

Mr. Barger, when talking about the type of information forensics 

can provide, could it include information on the identity of future 

victims as well as how those victims might be attacked? 

Mr. BARGER. Absolutely. Being able to gather information about 

an attacker, how they move, basically their genetic makeup, their 

capabilities, their intent, these fingerprints, essentially, can be telltale traces of how they do what they do. And to Dr. Ozment’s point, 

you can leverage that intel gain and loss for everything that they 

show you. You can harness that information to then democratize 

that across your customer base and better understand who it is, 

what they’re after, why they’re after it, and over time that develops 

a great picture when you can get feedback from various other individuals or organizations that are affected by it to develop a much 

clearer information intelligence picture. 

Ms. KELLY. Okay, thank you. Looks like I have run out of time. 

Mr. HURD. The distinguished gentleman from North Carolina, 

Mr. Walker, is recognized for 5 minutes. 

Mr. WALKER. Thank you, Mr. Chairman. 

Thank you, panel, for being here today. 

Jumping right into questions for Dr. Ozment here, what participation rates have you seen from the private sector? Can you speak 

to that just for a moment? 

Mr. OZMENT. Yes. We have, as you would expect, varying participation based on both the sector and also the program that we’re 

talking about. We have a very wide uptake of the bulletins and 

advisories that we send out advising companies about security 

risks and mitigations. We have something like 100,000 individuals 

signed up to receive those. And these tend to be the security individuals operating within a company. 

Mr. WALKER. Right. What engagement have you seen from the 

Federal sector? 

Mr. OZMENT. Federal sector, we also have pretty universal participation in our programs. And it is worth highlighting that as of 

about a year ago Federal departments and agencies are required to 

report incidents to US–CERT, part of my organization. 

Mr. WALKER. Sure. 

Mr. Bhagowalia, is that correct? 

Mr. BHAGOWALIA. Yes, sir. 

Mr. WALKER. All right. How effective has the Department of 

Homeland Security been in notifying your agency or notifying other 

government agencies? 

Mr. BHAGOWALIA. I think they have been very effective and 

things are improving. As you know, the threats have been coming 

at us in increasing frequency over time. Obviously, as the threats 

keep on coming at us, we work together with them, but we also 


KING-6430 with DISTILLER
43 

work with other intelligence community agencies. Together, it’s a 

community basically working together to make sure we are improving. 

Mr. WALKER. Thank you. 

Mr. Barger, kind of the same question. How effective has DHS 

been in notifying the private entities? 

Mr. BARGER. I can’t think of, like, one security company that 

probably doesn’t leverage the information that DHS puts out, 

whether it be on specific vulnerabilities or active threats. In many 

cases, that information serves as a seed in which we leverage and 

then continue to leverage private sector sources and methods to 

gain a better understanding of what we—— 

Mr. WALKER. The world of cybersecurity is fairly new for all of 

us in the last decade or so. And to use your analogy, Dr. Ozment, 

you were talking about an arson situation where you guys are the 

firefighters. But also, you guys are kind of the end all, kind of the 

central authority when it comes to all of this. 

Can you speak a little bit, because I’m concerned that if you’re 

going to be the central authority in this, I do believe, to go back 

to your analogy, that it’s not just the firefighter’s part, the investigation part, but what role do you have in the policing of it as 

well? Because I don’t want there to be any gaps here, because I do 

feel like you have a role to maybe funnel information to both segments. Would you mind taking a minute to speak to that? 

Mr. OZMENT. Absolutely. This is a team sport, both in the private 

sector and in government, and so we do partner very closely with 

Federal law enforcement agencies, particularly the FBI, the Secret 

Service, and Homeland Security investigators. Those agencies do 

prosecute cybercrimes and are very aggressive in reaching out to 

victims to help them figure out who did this and ideally prosecute 

the perpetrator. 

And we often—we find out about incidents and with the permission of the victim we share that with law enforcement. They do the 

same. And so we may not find out directly from a victim. We may 

find out because the victim talked to law enforcement who then 

told us. 

Mr. WALKER. The larger point is, we want to make sure that we 

are getting this right since this is relatively new, and your role 

with the law as the law says, CISA says, you guys are the central 

authority in this. So it’s very important that the communication is 

exactly where and what it needs to be and to whom this information needs to go to. 

You know, we don’t want this to be the IRS or the EPA where 

there’s decades of dysfunction. We have a chance at the ground 

level to make sure that the proper channels of communication to 

all the various departments or players in this is very important. I 

guess that’s why I’m emphasizing this. 

I have got one more thing before I yield back. This could be to 

Mr. Taylor. Mr. Bhagowalia may want to respond as well. 

Modern cybersecurity best practices require a much different approach to information security than the Federal Government has 

done before, as we talked about this as being brand new. Placing 

a premium on information sharing, continuous network monitoring, 


KING-6430 with DISTILLER
44 

and ensuring continuity of operation plans, these, I guess, plans 

are in place when a breach or degradation does occur. 

So here’s the question, okay? How are your departments modernizing to keep pace with these best practices and shifts in approach? 

Mr. Barger, would you address that? 

Mr. BARGER. In terms of the—— 

Mr. WALKER. Best practices shift in approach when it comes to 

this information. 

Mr. BARGER. The best practices in terms of vulnerability management where sharing? 

Mr. WALKER. Sharing information, yes, networking. 

Mr. BARGER. So communities have different looks and feels, different participants, different requirements, and so being able to understand who your audience is, what their needs and their requirements are, helps foment more user growth, user engagement and 

participation in that community. So not a one-size-fits-all approach 

in that regard. 

Mr. WALKER. Well, my time has expired, so I will yield back to 

the chairman. Thank you. 

Mr. HURD. I would like to recognize the gentleman from California, Mr. Lieu, for his 5 minutes of questions. 

Mr. LIEU. Thank you, Mr. Chair. 

Mr. Ozment, are you familiar with this document commissioned 

by the administration called ‘‘Liberty and Security in a Changing 

World’’ in 2013? It’s a report and recommendations of the President’s Review Group on Intelligence and Communications Technologies? 

Mr. OZMENT. I am familiar with it, sir, yes. 

Mr. LIEU. And I’m going to read to you recommendation 29, 

which says, ‘‘We recommend that, regarding encryption, the U.S. 

Government should fully support and not undermine efforts to create encryption standards; not in any way subvert, undermine, 

weaken, or make vulnerable generally available commercial software; and increase the use of encryption and urge U.S. companies 

to do so in order to better protect data in transit, at rest, in the 

cloud, and in other storage.’’ 

Do you agree with that recommendation? 

Mr. OZMENT. Sir, the issue of encryption is a really challenging 

one. And as administration officials have highlighted a number of 

times, we have to weigh the balances of our law enforcement and 

counterterrorism needs with our desire and need to improve 

cybersecurity across the private sector and government. So we are 

calling for a national conversation on this topic so that we can plot 

a way forward together essentially. 

Mr. LIEU. So do you agree or disagree with recommendation 29? 

Mr. OZMENT. I think it is more complicated than one can simply 

agree or disagree to. I think we do—it is a decision—— 

Mr. LIEU. Let’s be pretty specific. Do you believe that the U.S. 

Government should not in any way subvert, undermine, weaken, or 

make vulnerable generally available commercial software? Do you 

disagree with that? 

MrOZMENT So, sir, I think in the—there’s a lens here that any 

attempt—there are some people who perceive that any attempt to 

have court-ordered access to devices would be viewed as weakening 


KING-6430 with DISTILLER
45 

software. If that’s what you’re referring to, that’s really where I do 

think we need to have a national conversation to figure out what 

are our goals as a Nation. 

Mr. LIEU. I’m going to, with the permission of the chair, enter 

this document into the record. I just note that this document was 

really written from the angle of U.S. national security, and I think 

the proper frame for this debate is there is apparently some disagreement within the administration between law enforcement and 

U.S. national security. And my own view is we should not sacrifice 

U.S. national security, nor our economy, so that some law enforcement investigations can be made easier. 

Now, let me ask you another question. Are you familiar with Signalling System No. 7 in a cell phone network, also known as SS7, 

and the flaws associated with it? 

Mr. OZMENT. Yes. 

Mr. LIEU. And as you may know, hackers of foreign governments 

that can exploit SS7 can listen to phone conversations of cell 

phones as well as acquire text messages in real time. Do you agree 

with that? 

Mr. OZMENT. There are vulnerabilities that allow those accesses. 

Yes, sir. 

Mr. LIEU. Do you have a recommendation how to fix that? 

Mr. OZMENT. These vulnerabilities were really first publicly highlighted in 2014. I think it’s important to note that they are design 

vulnerabilities. So essentially, as the system is designed, you cannot fix it, per se. What you can do is carriers can monitor their networks for suspicious activity and then block that suspicious activity. 

When these vulnerabilities were disclosed, we reached out immediately to the carriers. We are not a regulator. We do work with 

the carriers through a voluntary partnership. The carriers have assured us that they are taking this seriously and are looking for malicious activity. 

But, frankly, I do share your very deep concern about this and 

I was concerned by the fact that the hackers you collaborated with 

on ‘‘60 Minutes’’ were so readily able to exploit that network. And 

so we are using this opportunity, frankly, to reach back out to the 

carriers and really push them to highlight progress. 

Mr. LIEU. Thank you. Would you agree that if a person using a 

cellphone had end-to-end encryption for the text messages or endto-end encryption for their voice data, that that would mitigate this 

problem? 

Mr. OZMENT. It would mitigate some aspects of this problem. If 

that were implemented, the other aspects, such as the ability to 

track location, would not be impacted. 

Mr. LIEU. Got it. Thank you. 

I forget, Mr. Chairman, if I requested to enter this into the 

record? Did I ask that? Maybe I did. 

Mr. HURD. Without objection. 

Mr. LIEU. Okay. Thank you. And with that, I yield back. 

Mr. HURD. Dr. Ozment, how long have you been at DHS? 

Mr. OZMENT. I have been at DHS for approximately 2 years now. 

Mr. HURD. Well, I would like to thank you for your service. I 

know the job that you have is difficult, and I think you have had 


KING-6430 with DISTILLER
46 

an exemplary time at DHS, and I’m looking forward to continuing 

to working with you in the next few months. 

My question, I would like to drill down on the Juniper breach. 

The ScreenOS, there were several versions that were hacked, 6.30 

version 17 through version 20. Were any of the versions that were 

vulnerable to the breach, were they supported by Juniper? Were security patches supported by Juniper, are you aware? 

Mr. OZMENT. I’m not entirely sure. I believe that at least a number of those were out of service and no longer supported, certainly 

not all of them. 

Mr. HURD. So when something is out of service, that means the 

vendor does not provide patch updates, or this is saying, ‘‘Hey, you 

are operating on your own. We are not responsible for keeping this 

up to speed.’’ Is that correct? 

Mr. OZMENT. That’s correct. 

Mr. HURD. Mr. Bhagowalia, my question for you. Fifty-seven devices had the Juniper vulnerability. Is that correct? 

Mr. BHAGOWALIA. Yes, sir, they were affected by the release 

versions in question in the ScreenOS, yes. 

Mr. HURD. And do you agree that the vulnerable versions of the 

ScreenOS software that is provided by Juniper is not supported by 

a vendor, the security updates were not supported by the vendor? 

Mr. BHAGOWALIA. We didn’t know about whether it is supported 

by the vendor, but we, obviously, the moment we got the information—— 

Mr. HURD. No, no, look, I’m not questioning about the—we can 

talk about the four devices that you thought were low vulnerability. My question is, why were you using versions of Juniper 

software ScreenOS that was no longer supported by the vendor? 

And if I’m not mistaken, please correct me if I’m wrong, the vendor 

stopped supporting that software in 2014, 2013, 2014. Why was the 

Department of Treasury still using software that wasn’t being supported by the vendor? 

Mr. BHAGOWALIA. I would have to get back to you on the exact 

details as to how many of those devices were late on that version 

that was not supported with 2014. We, obviously, work continuously with not only DHS, but with the vendor itself—— 

Mr. HURD. Well, but DHS doesn’t have anything to do with supporting—— 

Mr. BHAGOWALIA. Yes, sir. 

Mr. HURD. —patching for a software. 

Mr. BHAGOWALIA. No, it doesn’t, but we are sharing—— 

Mr. HURD. And the vendor has made it very clear that they are 

not going to continue to support that software. So what are you 

working with the vendor on? 

Mr. BHAGOWALIA. The vendor usually works with us to kind of 

figure out if there are any challenges with particular versions of 

software and so on and so forth. We have not looked at it or been 

advised of any particular devices there that were behind. But nevertheless the point is, we should, obviously, be—— 

Mr. HURD. You are the CIO for Treasury, correct? 

Mr. BHAGOWALIA. Yes, sir, I am. 

Mr. HURD. How much software are you using in the Department 

of Treasury that is not supported by a vendor? 


KING-6430 with DISTILLER
47 

Mr. BHAGOWALIA. We keep tabs on a lot of the legacy versions, 

that is—— 

Mr. HURD. Do you have a number? How many systems are you 

running—— 

Mr. BHAGOWALIA. We have 329 systems, sir, overall in Treasury. 

Mr. HURD. Okay. And how many of the 329 systems that you are 

running are systems provided by a vendor that is no longer supporting that version of the software that you’re using? 

Mr. BHAGOWALIA. It’s a small percentage. I’ll have to get back 

the exact number. 

Mr. HURD. Please get back with a specific number. 

Mr. BHAGOWALIA. Yes, sir, I will. Yes, sir. 

Mr. HURD. Threat mitigation—threat assessment—or damage assessment is probably the most accurate number—of the 54 systems 

that were using the Juniper’s software ScreenOS, what did the 

hackers, attackers, have you done a damage assessment on what 

was possibly stolen? 

Mr. BHAGOWALIA. Yes, we’ve obviously looked at the devices, and 

which there were two versions. Obviously, one had the administrative access and one had the VPN. We looked at both of those devices and seen whether there was anything going on in those devices themselves. We looked at the risk analysis of that. We also, 

obviously, made sure that those devices did not have any lateral 

movement and other things like that. 

We’re doing more in this area. We’re putting some other countermeasures just to double-check, for example, using third parties to 

see if there’s anything else going on in there. 

Mr. HURD. So you identified 17 of the 56 systems as high threat? 

Is that correct? Fourteen? 

Mr. BHAGOWALIA. No, sir, 40 of the devices, out of an overabundance of caution, we put at high risk. Only 4 out of the 57 were 

really connected facing the Internet. The rest were internal facing. 

Mr. HURD. Of those four that were facing the Internet, what kind 

of systems—what kind of information was traversing those systems? 

Mr. BHAGOWALIA. So one was—it was like, for example, it was 

on an isolated Internet connection at one of the locations, like 

Mint. Another location—— 

Mr. HURD. Right. So the Mint, like where we make money? 

Mr. BHAGOWALIA. Yes, sir, but it was not connected to the corporate LAN. It was sitting outside in a public-facing sort of Internet. 

Mr. HURD. But it’s still connected to the Internet, right? So are 

you implying that that’s not a significant vulnerability? 

Mr. BHAGOWALIA. No, sir, we don’t. We take cybersecurity very 

seriously. 

Mr. HURD. So in your damage assessment, who did you think potentially took this information? 

Mr. BHAGOWALIA. Well, there was no information that we are 

aware of that has been taken, and we have looked at it very carefully. We, obviously are obviously concerned if there’s anything 

that’s an external attempt. But there were multiple layers of security in terms of what we were watching. And out of the version 

that we had, nothing was taken. 


KING-6430 with DISTILLER
48 

Mr. HURD. So you don’t think anything was taken. But based on 

this vulnerability, you don’t have to exfil data, right? If you’re able 

to read—if you’re able to decrypt encrypted information, then if 

you’re capturing that encrypted network, the encrypted traffic traversing the network, you don’t have to exfil it. So how would you 

know if something was taken or not? 

Mr. BHAGOWALIA. So, for example, the four devices that are in 

question, they do not participate in the VPN connection at all. So 

there’s no risk to that. So even if that was taken out, there was 

no issue there. 

They are connected between three levels of firewalls, in addition 

to what’s already at Juniper. They are configured in such a way 

without giving the configuration away. Since admins have special 

access to that, we were pretty confident, and we did a detailed risk 

analysis, and that’s why we took a little bit of time to kind of, to 

your question, to really look into detail and make sure there’s nothing going on. 

We absolutely appreciate a concern. We’ve also read your article, 

and we also know that this vulnerability was quite serious. We 

looked at it, and there was nothing that we can see. But we’re also 

going further and making sure that we’re bringing in other experts. 

And so far one of the vendors—one of the vendors who was going 

to be briefing today, Mandiant, we think is very, very good, is one 

of the other folks, and amongst others, that we’re looking at bringing in. 

Mr. HURD. Well, my time has expired, but there will definitely 

be several more rounds of question. 

I would like now to recognize the gentleman from Virginia, Mr. 

Connolly, for 5 minutes. 

Mr. CONNOLLY. Thank you, Mr. Chairman, on what is, I think, 

one of the most important topics we can be addressing here in Congress with respect to our future. 

Mr. Taylor, can you explain what the Consular Consolidated 

Database is, briefly? 

Mr. TAYLOR. Thank you for the question, sir. Briefly—— 

Mr. CONNOLLY. Well, because I’ve only got 5 minutes. 

Mr. TAYLOR. I appreciate that, sir. 

The Consular Consolidated Database is a number of databases, 

actually. I think the total is around 18. It handles various activities, such as visa issuance, passport issuance, and that sort of 

thing. It manages our consular workload. 

Mr. CONNOLLY. So hundreds of millions of records? 

Mr. TAYLOR. Hundreds of millions of records, sir. 

Mr. CONNOLLY. Hundreds of millions of records. Would you 

agree, Mr. Taylor, that makes it a juicy cyber target? 

Mr. TAYLOR. We’ve identified it certainly as a target and as a 

critical system for the Department. 

Mr. CONNOLLY. And on March 31 of this year there was a report 

that an internal review revealed lots of vulnerabilities in the CCD? 

Is that correct? There was an ABC News report that said you did. 

Mr. TAYLOR. Right. The ABC News report was referring to, sir, 

the process that we go through for all our significant systems, 

which is penetration testing and a host of other types of tests that 

we run against our system on a regular basis. So through that 


KING-6430 with DISTILLER
49 

process, yes, in fact, we identified vulnerabilities. That’s the point 

and purpose of the penetration testing. And we’re well on our way 

to reconciling those and remediating it. 

Mr. CONNOLLY. In response to the ABC story, the Department officially sort of took issue with those reports on the severity of the 

vulnerability and referred to it, the vulnerability of the CCD, as in 

the lowest threat category. 

Can you put that in perspective? I mean, how many categories 

are there at the State Department in terms of threat, cyber threat? 

Mr. TAYLOR. If I could, sir, I’d rather try to answer the question 

through the way we look at risk mitigation, and that’s to look at 

the probability as well as the potential damage associated with the 

threat. 

The probability was very low, but, obviously, clearly, given the 

type of private information that’s available on that system and the 

quantity, even with a low risk, we take that very, very seriously. 

In fact, I mean, we meet on this on a weekly basis with the under 

secretary and with the deputy secretary and with the senior leadership in Consular Affairs to track the progress against our remediation efforts. 

Mr. CONNOLLY. Okay. Well, the reason I think it’s important is 

because one of the concerns I’ve got with respect to cyber throughout the Federal Government is you look for—if I were a hacker or 

up to no good, I’d look to low-hanging, vulnerable fruit. And we, 

this committee, this subcommittee, has found lots of that in what 

might look ostensibly like an attractive target, Department of Education. Huge database, lots of information in it, and potentially ripe 

for the picking. Which is why we think implementation of FITARA 

is so important and because we’ve got to sharpen up our ability and 

make wise investments and so forth. 

Let me ask you while I’ve got you, Mr. Taylor, I’ve just gotten 

back from China, and on this particular trip there were probably 

20 Members of Congress, Senators and House Members, Republicans and Democrats. 

I mean, everybody was told when we got there, you do understand that any device you bring will be compromised, period. Is it 

routine for the Department of State to provide counsel to Members 

of Congress when they’re traveling to places that have a known 

reputation with respect to cyber? 

Mr. TAYLOR. Thank you, sir, for the question. 

I understand the question, but to be honest, it’s a little outside 

of my wheelhouse. I’m not sure if those briefings take place. I 

would expect that Congress would receive those briefings either 

through our Diplomatic Security or another entity in State. It really isn’t within the purview of the CIO responsibilities to do that. 

Mr. CONNOLLY. I mean, you work for the State Department. 

Mr. TAYLOR. I do, sir. 

Mr. CONNOLLY. Yeah. Well, maybe you can take it back with 

somebody whose purview it is. 

Mr. TAYLOR. Yes. 

Mr. CONNOLLY. But it just worries me that a whole branch of 

government is unwittingly putting itself at risk. And remember I’ve 

got messages here from the State Department, from the White 


KING-6430 with DISTILLER
50 

House, from lots of other Federal agencies, all of which, if I bring 

this to Beijing, is going to be compromised. 

Mr. TAYLOR. Yes, sir. 

Mr. CONNOLLY. And it just seems to me a prudent measure for 

the executive branch to—if it isn’t—to be more proactive in not 

only discouraging, but strongly providing guidance, quite explicit 

guidance, to Members of Congress, rather than having it be on our 

own. I mean, what could go wrong with 535 individuals and their 

spouses traveling hither and yon with devices that are official that 

could be compromised? 

Mr. TAYLOR. Yes, sir. 

Mr. CONNOLLY. It might be outside your purview, Mr. Taylor, but 

we both work for the U.S. Government and are concerned about 

U.S. security, and we’re talking about cyber, and this is a big issue 

I think in your wheelhouse. So I would appreciate your cooperation 

in going back to whoever’s purview it is in the Department and 

maybe beefing up our protective preemptive measures. 

Mr. TAYLOR. Yes, sir. I understand the question, and I will certainly take that back. 

Mr. CONNOLLY. Thank you. 

Thank you, Mr. Chairman. 

Mr. HURD. Thank you. 

Now I’d like to recognize Mr. Blum for 5 minutes. 

Mr. BLUM. Thank you, Chairman Hurd. 

And I’d like to thank the panelists for appearing here today to 

talk about this most important issue. 

Mr. Barger, in your testimony you state that information is less 

a technical issue and more of a cultural issue. To me, this gets at 

the very importance of building trusting relationships. I’m from the 

private sector and trust is so important. Without trust, it’s hard to 

run an effective business, trust between employer and employee, 

trust between the company and its vendors, trust between the company and its customers. Trust to me is ultra-important. And it gets 

to the importance of your statement of building trusting relationships between parties to ensure effective information-sharing practices. 

In your opinion, is there a trust deficiency between the private 

sector and the public sector when it comes to the sharing of threat 

intelligence? 

Mr. BARGER. In terms of efficiencies, I believe sharing in general 

within public sector as well as within the private sector is still 

somewhat new, and everyone’s feeling around the edges to figure 

out how to best approach it. I think the Information Sharing Act 

of 2015 kind of helped break the ice and give folks a renewed interest and focus in that area. 

In terms of private sector sharing, we find organizations are still 

challenged internally with communicating effectively, let alone 

some of the more advanced moves of sharing across parties or Bank 

A sharing with Bank B. But there’s interest to get there. 

I think DHS and some of their initiatives are good starting 

points where there’s a centralized area where folks can go. The private sector has a thirst for information, and so as much information you can send our way is always appreciated. 


KING-6430 with DISTILLER
51 

Mr. BLUM. There is a willingness in the private sector, I agree, 

and I hear that time and time again. Is there something the government, the public sector, can be doing to help facilitate this? Because there is that willingness, I agree with you. 

Mr. BARGER. I think timeliness of reporting can help. I think 

there’s optics and perceptions as to how much value information is 

coming out of the government in terms of the flash to bang. There’s 

many cases where the private sector will be a little—a few steps 

ahead of the government in terms of sharing some information, and 

then several weeks or months later you’ll get an FBI flash bulletin 

or a DHS report which echoes some of the same details you already 

know. 

However, there’s also instances where, like I pointed out earlier, 

where the information that may come out of DHS or FBI will serve 

as a feed or will shore up a loose end that the private sector may 

have not have necessarily figured out or understand fully, but that 

then fills in some of the blanks. 

Mr. BLUM. I hear from the private sector also sometimes the government is viewed as a black hole. And they deploy a fair number 

of assets, time, people’s talent, to obtain information, share it with 

the government, and never hear back, never hear back. And that 

to them is a problem, and I’d say it probably is a problem. You 

know, was the problem resolved? Was it helpful or not? They just 

want to hear back. 

Any ideas there on what we can do to have a two-way communication street here versus, ‘‘Give me, give me, give me, and, hey, 

don’t ask what happened with it’’? 

Mr. BARGER. Correct. I am part of that group of folks who shared 

information into the black hole, if you will, and have wondered, 

was this effective, do you need more? But what happens is over 

time, when you don’t hear back, you just say, really, what’s the 

point of me continuing this if I don’t really see the value? 

Mr. BLUM. Exactly. Exactly. 

Mr. BARGER. So having a thumbs-up or a thumbs-down or quick 

‘‘got it’’ is always helpful and I think lends to what you’re talking 

about is improving that sharing relationship and that trust. 

Mr. BLUM. Very good. 

I’ll yield back the balance of my time, Mr. Chairman. 

Mr. HURD. I’d like to recognize Mr. Lieu for another round of 

questions. 

Mr. LIEU. Thank you, Mr. Chair. 

Question for Mr. Barger, sir. Are you familiar with the SS7 flaw? 

Mr. BARGER. I am not. 

Mr. LIEU. Okay. That’s fine. I will now go to Mr. Ozment. 

In February of this year, The New York Times published an article quoting Defense Secretary Ash Carter, and he is quoted in there 

regarding back doors as saying the following: ‘‘Just to cut to the 

chase, I’m not a believer in back doors or a single technical approach. I don’t think it’s realistic.’’ Do you agree with his statement? 

Mr. OZMENT. I think part of the challenge here is an argument 

about what constitutes a back door or not. You know, I think what 

I have heard from law enforcement agencies is that they hope for 


KING-6430 with DISTILLER
52 

a solution that allows them court-ordered access without introducing vulnerabilities. I think if you are to enter—— 

Mr. LIEU. Let me just stop you there. 

Do you believe it’s technologically possible to put in a back door 

only for the good guys? 

Mr. OZMENT. I think there are solutions that add—that make 

that possible. 

Mr. LIEU. Just give me one. 

Mr. OZMENT. However, to get to our point, I think any time you 

add a solution, you add complexity. And every time you add complexity, you increase the risk of compromise. 

Mr. LIEU. Thank you. 

Do you know how many smartphones were lost or stolen in the 

U.S., let’s say, in 2013? 

Mr. OZMENT. I do not. 

Mr. LIEU. Okay. According to an article in the LA Times, about 

4.5 million smartphones were lost or stolen. 

If hackers could hack into a smartphone, they could access all 

sorts of data on Americans. Wouldn’t you agree that it would be 

important that if government finds a flaw in smartphone 

encryption that they let the manufacturer know about it so we can 

protect American consumers if their cell phones are lost or stolen? 

Mr. OZMENT. There is a process for deciding whether or not to 

disclose vulnerabilities that the government finds. My organization’s role in this process is to advocate for the broad sharing of 

vulnerabilities, because that does increase the cybersecurity of our 

Nation. 

There are other perspectives that have to be viewed in that process, law enforcement intelligence perspectives, but the administration has gone on record to highlight that the process, the strong default, is to share information to increase the security of devices and 

systems. 

Mr. LIEU. So through this process the way the FBI was able to 

hack the recent iPhone in the San Bernardino case, that may be 

released to Apple at some point. Am I understanding that correctly? 

Mr. OZMENT. If the FBI did, in fact, use a vulnerability it would 

go through this process and could potentially result in a release. 

But I don’t know of the specifics of this, whether or not the FBI 

used a vulnerability in this case, so I would have to defer to the 

FBI on that. 

Mr. LIEU. Thank you. 

Before I forget, Mr. Chair, could I enter into the record this article, ‘‘4.5 million smartphones were lost or stolen in the U.S. in 

2013,’’ from the Los Angeles Times? 

Mr. HURD. Without objection. 

Mr. LIEU. Thank you. 

Mr. Barger, let me ask you a similar question. Do you agree with 

Defense Secretary Ash Carter’s statement that we should not have 

back doors in encryption? 

Mr. BARGER. I think that, again, introduces a very complex conversation. I think that we need strong encryption. As a member of 

industry, I would be very concerned and challenged, I guess, with 

any sort of approach by the government to weaken anything or 


KING-6430 with DISTILLER
53 

weaken security or encryption of any sort of product or solution 

that we delivered. So I would say no. 

Mr. LIEU. Thank you. 

And with that, I yield back. 

Mr. HURD. Mr. Farenthold from Texas is recognized for 5 minutes. 

Mr. FARENTHOLD. Thank you very much. 

I would like to follow up on a line of questioning the chairman 

had about legacy systems. We talked about some of the legacy and 

unsupported systems in the IRS. We’ve had hearings where various 

government agencies are still running pre-Windows 98 or Windows 

98, again, not supported by Microsoft, the security patches are not 

coming up. 

Dr. Ozment, do you have any idea the scope of this problem? 

Mr. OZMENT. I think this is a major problem for the Federal Government. It’s something that is concerning to me. 

I’ll tell you that we do scan agencies externally, so the systems 

they have connected to the Internet, and we look for critical 

vulnerabilities. We do consider an unsupported device to be a critical vulnerability. 

And some of our most challenging discoveries in that process are 

unsupported devices, particularly at smaller departments and 

agencies who may lack the resources or the expertise to upgrade 

these very legacy systems. I think this is a major risk for the government. And I do believe that any approach that we can take to 

upgrading and replacing legacy systems is a good approach. 

Mr. FARENTHOLD. And the National Institute of Standards publication 800–40 lays out guidance for agencies on enterprise patch 

management and states that it would be, quote, ‘‘ideal’’ to deploy 

patches immediately so as to minimize the timeframe systems that 

are vulnerable. You know, obviously, immediately isn’t possible. 

We’ve got a couple—we’ve got the State Department and Treasury 

Department here. How good are you guys at getting this out? I 

mean, what is immediately for you? A security patch comes out, 

how long does it take you to get it out, Mr. Taylor? 

Mr. TAYLOR. So our security patches, we look at it two ways, critical threat patches and typical required patches. So for our critical 

patches—we begin immediately, I want to be clear about that—we 

have a 3-day timeline to deploy a patch worldwide, to all locations 

worldwide. We meet that with approximately 98 percent success 

rate. 

Mr. FARENTHOLD. And how are you all doing at Treasury? 

Mr. BHAGOWALIA. We obviously take the most critical patches 

first, sir, and we move on it. And as you saw in my testimony, we 

fix those in 5 days, 6 days. For the rest of the enterprise, we work 

with the bureaus to make sure those critical patches go first. As 

far as the medium and low patches, they take a little bit more 

time. And we also are, obviously, looking at operational risk, making sure those systems are a continuing mission. And then we 

schedule that, and then the report, the bureau CIO’s report, back 

to us. 

So the answer is it’s ongoing. As to exact numbers, I can get back 

to you and give you the exact numbers. 

Mr. FARENTHOLD. All right. 


KING-6430 with DISTILLER
54 

And, Dr. Ozment, in May of 2015, it’s my understanding that the 

Secretary issued a binding operational directive requiring all agencies to mitigate critical vulnerabilities on their Internet-facing devices within 30 days. That seems like an awful long time to me, 

but before I go criticizing how long it is, how much success do we 

have getting them done in 30 days? 

Mr. OZMENT. I would agree with you that it is a somewhat generous amount of time. I would highlight that, to the points that my 

colleagues have made, the criticality of the patch and the type of 

system will dictate timing. There are systems that are more complicated than your normal desktop operating system that do take 

additional time. And since we were doing a one-size-fits-all policy, 

we had to be somewhat generous. 

Even with that somewhat generous timeframe, when we started, 

when we released this directive, there were over 360 Internet-facing systems with critical vulnerabilities in them. I view that as the 

backlog, what we started with, because of course new 

vulnerabilities are discovered all the time. 

We reduced that backlog, not as rapidly as I would like for the 

government to have reduced it, but we are now down—we have, obviously, eliminated that backlog. Even right now we have 39 

vulnerabilities across the government that are critical but have 

been unpatched for more than 30 days. There is good news in that, 

which is when we started we were over 360, and, clearly, not 

enough attention was being paid on it. 

Mr. FARENTHOLD. I mean, are these some obscure operating system or ultracomplicated software or are we just not running Windows update? 

Mr. OZMENT. The majority of these are now legacy systems at 

small agencies that are struggling to manage their IT and to find 

the budget to replace these legacy systems. These have been the 

toughest nuts for us to crack. 

Mr. FARENTHOLD. All right. I am loathe to ask what you think 

Congress could do to help with that, because I suspect the answer 

will be: Give us more money. But is there something besides give 

us more money that we can do in Congress? And then I’ll yield 

back after your answer. 

Mr. OZMENT. You know, I would like to highlight that Congress 

has been incredibly helpful to date. The recent legislation passed 

in both 2014 and 2015 has been very important. This type of attention is very important. 

I do think that one of the challenges that agencies consistently 

have is when you replace a legacy system, you often have to operate that system for a period of time even as you’re paying to build 

the new system. So you do functionally need to pay for two things 

at once for a period of time. 

The IT modernization bill sponsored in part by Representative 

Kelly, the ranking member, would really assist with that, because 

it would essentially give you that fund to temporarily support the 

building of a second system even as you operate the original, older 

system. 

Mr. FARENTHOLD. Thank you. 

I yield back. 


KING-6430 with DISTILLER
55 

Mr. HURD. The ranking member from Illinois is recognized for 5 

more minutes. 

Ms. KELLY. Thank you. 

Mr. Bhagowalia—— 

Mr. BHAGOWALIA. Yes. Yes, ma’am. 

Ms. KELLY. —Mr. Taylor, this question is for both of you. As the 

people with ultimate responsibility for the security of your agencies’ computer networks, I imagine that you would welcome any information that would help you with cyber defense. If a company 

that plays a critical role in your agencies’ mission was hacked, 

would knowing how that hack happened help you to do your job? 

Mr. BHAGOWALIA. Yes. We work with a lot of vendors, and we, 

obviously, work very closely with them. I believe the cyber climate, 

the way things are in the prevailing world, we work together as a 

team and we look out for each other. We are all in the boat together. And that’s the way we want to manage this. 

We share information also across not only the government, not 

only with DHS, but with the law enforcement and the intelligence 

community. I myself Came from the law enforcement intelligence 

community. And I can tell you that—and I have come from industry—we are in a different world now, and the adversary is growing 

in sophistication, volume, brazenness, and impact and frequency. 

So if that’s the case, the only way we can do this together is to 

work together and make this thing happen. So absolutely, ma’am. 

Ms. KELLY. Mr. Taylor. 

Mr. TAYLOR. Thank you for the question. 

Partnership is the basis of our cyber defense. We learned that in 

2014 when we had our challenges with our unclassified email. We 

reached out to DHS. We reached out to NSA. We get wonderful 

support from the FBI. We support and established a joint operations center for cyber. So we have folks from interagency there sitting with us 24/7, 7 days a week, 365 days a year. 

We receive threat and mitigation information from just a host of 

partners. It would not be possible for the Department of State or 

any other agency to successfully defend our systems without support, without continuing information, both threat information and 

mitigation information, private sector and public. We recognize 

that. As I said, that’s a keystone for us. 

Ms. KELLY. What means do you have—and this is for both of 

you—to learn about the details about a hack of one of your contractors? How do you learn about that? 

Mr. BHAGOWALIA. We work very, very closely, first of all, with 

our vendors in terms of our governance, that they have to tell us 

what’s going on, and I think in that regard, we watch that. We 

monitor classified and unclassified channels, including vendor community, from our security operations center that looks for that. We 

work with the US–CERT, NCCIC, and DHS, who gives information 

to us. We work on the Federal CIO Council where we are all sharing information as a sort of a network of CIOs and also CISOs. 

We also work within our folks and our staff who have sort of an 

organic network. And I don’t want to underplay the importance of 

that organic network that’s looking and looking out. So I think 

we’re doing a pretty good job there. 

Ms. KELLY. And, Mr. Taylor, you would agree with—— 


KING-6430 with DISTILLER
56 

Mr. TAYLOR. Absolutely. We actively maintain our relationship 

with our vendors. I travel regularly, we meet with them regularly. 

Ms. KELLY. Okay. Thank you. 

Ms. Ozment, just two quick yes or noes. Are government contractors required to share detailed forensic analysis about attempted or 

successful cyber attacks, yes or no? 

Mr. OZMENT. Not in general. There may be some specific contracts where that’s required. 

Ms. KELLY. Okay. Are government contractors required to notify 

the FBI if they are the victims of a successful cyber attack? Yes 

or no? 

Mr. OZMENT. Again, not in general. There may be specific contracts. 

Ms. KELLY. Are there examples where US–CERT has offered its 

services to government contractors who were hacked and the company declined the offer? 

Mr. OZMENT. Not to my knowledge. I don’t believe so. 

Ms. KELLY. Okay. All right then. 

Thank you. And I yield back. 

Mr. HURD. Mr. Bhagowalia, some very basic questions, and I 

apologize for not knowing the answer to this. 

At Treasury, what floor does the Secretary of Treasury sit? 

Mr. BHAGOWALIA. Main Treasury, third floor, sir. 

Mr. HURD. And where do you sit? 

Mr. BHAGOWALIA. I sit in one of the buildings next to the Main 

Treasury. 

Mr. HURD. Do you have budgetary and operational control? I’m 

assuming there’s a CIO specifically for IRS, right? 

Mr. BHAGOWALIA. There’s a separate CIO for IRS, sir. 

Mr. HURD. Does that person report to you? 

Mr. BHAGOWALIA. No, he does not. Reports to the Commissioner. 

But he has a dotted line under FITARA that I have given him 

some CIO commitments that he has to report with me and work 

with me. 

Mr. HURD. But isn’t part of FITARA to empower you to have control over the entire organization? 

Mr. BHAGOWALIA. Yes, sir. The Department has the authority, 

and I’m working very closely with the bureau’s CIOs to make the 

mission happen. 

Mr. HURD. CDFI, what is that? 

Mr. BHAGOWALIA. It’s one of the consolidated funds that is a 

smaller program that sits within the departmental offices. 

Mr. HURD. So earlier this year or late last year, we sent a letter, 

this committee sent a letter to every agency asking for an update 

or asking for a review of legacy hardware and legacy software. And 

thank you, you get back to us. And I know I asked a question earlier about old systems. I have eight pages worth of information. 

Some of the software, when we asked when was the last date of 

support, the answer was ‘‘unknown’’ because the vendor is no 

longer in business. 

Some of the other software stopped being supported in 2007. And 

then we asked the question: If no longer supported by vendor, how 

is it supported? The reply was: Unsupported, IRS assumes expired 

product risk. 


KING-6430 with DISTILLER
57 

Now, I’m not going to go through each one of these. But my question is, do you, as the CIO of Treasury, have the authority to go 

through, identify which one of these are high risk, and figuring out 

why and moving away from unsupported software? 

Mr. BHAGOWALIA. Yes, the bureau CIO and I do, I have the authority, and we look at using what they call critical POAM item, 

and they have to report to me as to whether they are testing and 

is there enough security, that there’s any vulnerability, if there’s 

anything critical. And they have signed to that and I can—I, obviously, check and verify that. If they have not done that, I have the 

authority to turn it off and so do they. And, obviously, this particular system I’ll have to take a look at—— 

Mr. HURD. No, look, we’re going to get into a much larger conversation at some other point about this. But some of these systems that stopped being supported in 2013 deal with software to 

manage cell phone communications, right? So this is—to me, that 

would be a high priority vulnerability or a system that should be 

of high priority to ensure that—and, again, the Federal Government shouldn’t be in the business of providing support to products. 

We should be upgrading and buying the latest version. So I’m more 

interested in making sure you have the authorities in order to solve 

these problems. 

Dr. Ozment, how much, you know, with the new cybersecurity 

rules that DHS has, how much influence do you all have in telling 

another department or agency, ‘‘Hey, guys, you all need to sort this 

out’’? 

Mr. OZMENT. The new authorities that Congress has provided us 

and, frankly, the congressional attention on this issue have really 

dramatically helped us more deeply engage with departments and 

agencies. We focus on working collaboratively with those departments and agency, essentially because when they trust us, we can 

accomplish more together. And we also look at OMB holding agencies accountable. And together, we really work to improve—— 

Mr. HURD. Dr. Ozment, do you have a list of all the unsupported 

software that’s being used across the 24 CFO agencies? 

Mr. OZMENT. I do not, but I’ll be honest with you, I want that— 

I will have that when CDM phase one is deployed. 

Mr. HURD. Copy. 

Mr. OZMENT. And I want an automated list of that. I don’t want 

a manual data—— 

Mr. HURD. Good. Copy. 

Mr. Barger, should enterprises be concerned with using software 

that is no longer supported by a vendor? 

Mr. BARGER. They should. Unfortunately, organizations over 

time will set up systems that just become systems of record, that 

they just cannot pull these systems out, that they age within the 

organization, both within public and private sector. It’s not just one 

sector or the other. So it’s a very hard to necessarily pull them out. 

If you consider some medical devices are FDA regulated, so if you 

were to patch them, in some cases you change that regulation. 

And so there’s these very nuanced details in accepting risk in 

and around these nuanced systems of record that could be supporting command and control or medical systems. And so there can 


KING-6430 with DISTILLER
58 

be creative workarounds that are put in place, be it policies or solutions, that can help manage that risk a little better. 

Mr. HURD. No, thank you for that. 

And my next question kind of shifting gears slightly. Can you 

do—can an enterprise do proper damage assessment without understanding who the threat actor was? 

Mr. BARGER. So as a former analyst, I am always appreciative 

of as much information as possible so that I can use that and form 

the basis to make better decisions. So I think maybe to your point 

around attribution, that sort of information, always helps to understand what the adversary’s motivations are, because that can 

frame how I respond and subsequent decisions down the line, be 

it technical or nontechnical type response. 

Mr. HURD. So would this be a fair statement, that understanding 

who the attacker is, we would better—we can do better damage assessment? 

Mr. BARGER. Absolutely. It’s an integral part. I mean, one of the 

first questions everybody asks when you’re the bearer of bad news 

and there’s a breach is: Who did it? Or why? The boss always 

wants to know that. And so understanding that can, again, help 

frame how you respond and the decisionmaking cycle afterwards. 

Mr. HURD. When it comes to the Juniper ScreenOS breach, do 

you have opinions on who was responsible? 

Mr. BARGER. These are personal opinions and not necessarily 

rooted in fact, but just reading, casually reading—— 

Mr. HURD. The record reflects that. 

Mr. BARGER. Roger. Okay. So if you look at the type of 

vulnerabilities potentially introduced for the term in which they’re 

reporting that, I could think of a handful of nation-state entities 

that would leverage key weakening and an administrative back 

door for core infrastructure. And that core infrastructure is kind of 

one of those more strategic areas of the domain, if you will, the 

contested domain, that if you lay up in there, you can do quite a 

bit in terms of—— 

Mr. HURD. So let’s talk about the nature of the Juniper 

ScreenOS breach. Source code was manipulated, correct? 

Mr. BARGER. From what I understand, correct. 

Mr. HURD. And code was inserted in the source code used for 

ScreenOS. Is that your understanding? 

Mr. BARGER. From what I understand, correct. 

Mr. HURD. How difficult is it to do that? 

Mr. BARGER. I would imagine if it were, for me, putting on a bad 

guy hat, that I would have to have a significant understanding of 

how that system works as well as a very robust quality assurance 

capability to make—— 

Mr. HURD. But when you’re designing software protecting—ensuring that your source code cannot be seen, is a pretty—that’s a 

pretty key—that’s a key software development. 

Mr. BARGER. Correct. That’s what I was driving at, is that there 

had to have been a robust team that would be able to make sure 

that that implant or that key weakening was not detected for the 

term that’s being reported. 

Mr. HURD. Could Juniper have protected its source code better? 


KING-6430 with DISTILLER
59 

Mr. BARGER. I don’t know enough about their development process and their internal security to be able to say that, but—— 

Mr. HURD. So based on your experience and your—this is your 

personal observation—it was a state actor—it was an entity supported by a nation-state? 

Mr. BARGER. I would certainly think that a criminal or ideological group probably wouldn’t have necessarily the resources or the 

motivation to leverage that type of attack. 

Mr. HURD. Why are—and maybe, Dr. Ozment, this is a better 

question directed to you—who is responsible in the Federal Government for attribution? 

Mr. OZMENT. We look to the intelligence community, so the Director of National Intelligence for attribution. 

Mr. HURD. So DNI is the one responsible for making attribution. 

Even in a case when it’s a breach of a private sector entity? 

Mr. OZMENT. That’s right. 

Mr. HURD. But that private sector entity could make it aware, 

right? Because if a private sector company is hacked, they usually—they will bring in—they’ll probably reach out to some Federal 

Government agencies, whether it’s DHS—it should be DHS now, 

after the Cybersecurity Act of 2015. They’re going to bring you in. 

They’re probably going to hire another company that does incident 

response and threat mitigation. But are there barriers from having 

the company that’s hacked from articulating who they believe was 

responsible for the breach? 

Mr. OZMENT. No. Any company could point to anybody if they 

had a view on the perpetrator. 

Mr. HURD. Why—and this is my opinion now—I feel like in this 

case of the Juniper ScreenOS hack people have been reticent to do 

attribution, even general attribution. Do you have an opinion on 

that, Dr. Ozment? 

And, Mr. Barger, I’m going to ask you the same question. 

Mr. OZMENT. You know, I don’t, other than to say that the government has historically been—has used attribution in a fairly relatively few cases. And so I don’t view it as unusual that the government has not attributed this particular incident. That’s it. 

Mr. HURD. Copy. 

I will now recognize my friend from California, the distinguished 

gentleman, Mr. Lieu, for another round of questions. 

Mr. LIEU. Thank you, Mr. Chair. 

My understanding is that Juniper was invited to testify, but they 

refused to come. I just want to note for the record that I—well, let 

me first ask questions. 

Mr. Ozment, is Juniper a government contractor? 

Mr. OZMENT. I don’t know for sure. I would assume that they 

are. I do want to highlight that they’re a victim here and that from 

our perspective we ask all IT vendors to give us advanced notice 

when they are making a major patch so that we can amplify their 

patch announcement and make sure that it reaches the public and 

private sector, that everybody who knows needs to know about it. 

In this case they did notify us in advance that they were developing a major patch. I think they did a very responsible job of this, 

and I salute them for working hard to make sure that all of their 


KING-6430 with DISTILLER
60 

customers were aware of this vulnerability and helping us amplify 

their message as well. 

Mr. LIEU. I note for the record that Juniper had their systems 

breached. I find it disrespectful that they did not come here to testify and it insinuates that they have something to hide. 

So let me ask some questions for Mr. Bhagowalia. I’m trying to 

understand your agency’s response to the breaches of Juniper. 

My understanding is that within 1 week, 48 out of 57 affected 

systems on Treasury’s network were patched. Is that correct? 

Mr. BHAGOWALIA. Yes, sir. 

Mr. LIEU. But for the other nine, it took, from my understanding, 

another 2 months. What’s the reason that it took that amount of 

time? 

Mr. BHAGOWALIA. We made a risk-based decision, and we found 

that out of those devices—first of all, anything—only 4 of those 57 

were Internet facing. Everything inside had many layers of firewalls. We found that of those devices, a certain amount had—did 

not even have the VPN vulnerability as such. So we looked at that 

and made a risk-based decision as one of the bureaus to delay the 

patch. And the others were mitigated in terms of compensating 

controls that they had in place. So it was done a little bit later. 

Obviously, in retrospect, one could look at balancing mission and 

risk, and we could have gone a little faster, but it was basically a 

low risk for the devices that were done after the first week. 

Mr. LIEU. So when I patch something on my computer it’s, I don’t 

know, a few minutes. Are these very complicated patches? Are 

these something that takes a long time? I’m trying to understand 

why it just wouldn’t have been done rather quickly. 

Mr. BHAGOWALIA. Yes, sir. Let me just say, as an engineer, we 

obviously, obviously, look at first what is the risk analysis as to 

what the thing is. We understood the details of this once we were 

told what the thing was and exactly what the vendor was saying 

and what DHS told us. We went and looked at what the risk analysis is, is it in our network? 

We looked at where they were facing. A lot of these configurations, without giving them away, we have multiple layers of firewalls and protection and proxying and all kinds of various means 

that allows sort of a maze of things that we do to basically confuse 

anyone from getting in. 

And third, you know, five of those device didn’t have the VPN 

vulnerability. So even if there was nothing to decrypt, we actually 

covered that. 

So it just, if you look at it in isolation, obviously, one can only 

always look at something being a little faster, but we always balance operational risk. Because think of it has a neighborhood, 

gated community, and then you get in, and then you’ve got multiple layers of firewalls and a backbone network that had one or 

two of these devices between many layers just to get into that. And 

beyond that, there were various firewall subdivisions and these 

were deeply imbedded inside those firewall divisions. So to get to 

those would require a lot of compromise before someone gets in. 

So we looked at that, and based on that, it was made—a riskbase decision was made. And in addition to that, I would just add 

that we are actively using other kinds of red teaming, should I say, 


KING-6430 with DISTILLER
61 

penetration testing, and we are also looking at some hunt operations to make sure there’s nothing in there. We are aware of some 

of these nation-states, and I think in this case we have not seen 

anything. 

Mr. LIEU. Thank you. 

Ms. Ozment, you’re familiar with the ransomware attacks on 

hospitals, some of which were in southern California? 

Mr. OZMENT. I am, sir. 

Mr. LIEU. And do you have a sense of how many hospitals have 

been hit with ransomware attacks in the last year or last few 

months? 

Mr. OZMENT. I don’t have those numbers in hand, but we have 

certainly seen an increase in ransomware, not just the health sector, but across the Nation. 

Mr. LIEU. If this is something we could follow up with your office 

to see if you could let us know about how many attacks we’re experiencing? 

Mr. OZMENT. Absolutely, sir. Will do. 

Mr. LIEU. Great. Thank you. 

And then let me just conclude with a comment. 

In this case, Juniper made firewalls to try to prevent important 

information from going to foreign governments. Juniper is not the 

victim in this case, as the witness from DHS had said. The U.S. 

Government and the American people are, and we need to view 

this in a whole different lens, that when products are made to try 

to protect the U.S. Government and they fail, the companies that 

made those products are not the victims. They failed. And I think 

we just need to put this in proper perspective. The victims here are 

the U.S. Government, the American people. 

Thank you. 

I yield back. 

Mr. HURD. Thank you. 

Dr. Ozment, is DHS MPPD built and organized to deal with the 

problems of the future? 

Mr. OZMENT. It is not, sir. And we have proposed a reorganization that we would very much appreciate support of the Congress 

in performing that reorganization. 

Mr. HURD. And, again, I’d just like to point out, I think, when 

it comes to the Juniper breach, I think DHS played an important 

and key role in organizing the government’s response to this. 

I still have a problem with attribution. And, Dr. Ozment, can attribution play a deterrence role? 

Mr. OZMENT. I think it absolutely can. You know, depending on 

the circumstances, actual attribution could be used to play a deterrence role. In other circumstances the threat of attribution may 

play a deterrence role. I do think it depends on the particular actor 

and the dynamics of the relationship, but it can absolutely be a tool 

for deterrence. 

Mr. HURD. Copy. 

Mr. Bhagowalia, would you like to know who was responsible for 

or have some idea of attribution for this Juniper breach? 

Mr. BHAGOWALIA. Absolutely, sir. You know, we have, obviously, 

been reading all the news and watching various channels, but we’d 

love to know. 


KING-6430 with DISTILLER
62 

Mr. HURD. Now, Mr. Taylor, I know the Department of State 

wasn’t affected, because you didn’t have any of the ScreenOS software running on there. 

But does anybody on the panel like to make any comments on 

attribution? 

Mr. Barger. 

Mr. BARGER. To your point about attribution serving as a deterrent, we conducted research into a specific series of attacks that 

had been targeting entities within the South China Sea for quite 

some many years and put out an attribution product with the assistance of some of our partners. And, basically, after this attribution product was released, we basically saw no more activity from 

it. Not to say that they are done forever, but I do believe that it 

can slow down, mitigate active threats as well as enter into the adversary’s decisionmaking cycle as to how important this sort of 

thing is on the world stage and how to recognize those. 

Mr. HURD. I appreciate that. 

And, Mr. Taylor, we have—I have extended my time on too many 

occasions, but I’d like to let you know that there was a report that 

the Department recently—Department of State recently detected a 

vulnerability within its own systems, and we’re going to provide 

you all with some questions that we would like to have answered 

on the record. And one of those questions is I hope that information 

has been shared with DHS in order to communicate that across the 

rest of the Federal infrastructure. 

Mr. HURD. Barring no further business, I’d like to thank our witnesses for taking the time to appear before us today. And if there’s 

no further business, without objection, the subcommittee stands adjourned. 

[Whereupon, at 11:25 a.m., the subcommittee was adjourned.] 


KING-6430 with DISTILLER
(63) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
64 


KING-6430 with DISTILLERInsert offset folio 26 here 26066.026

For the full report titled, "Liberty and Security in a Changing World," please visit the following 

website: https:/ /obamawhitehouse.archives.gov/sites/default/files/docs/20 13-12-

12_rg_final_report.pdf 
65 


KING-6430 with DISTILLERInsert offset folio 27 here 26066.027

4.5 million smartphones were lost or 

stolen in U.S. in 2013 

by Salvador Rodriguez 

Los Angeles Times 

Aprlll7, 2014 

A report released Thursday said 4.5 million smartphones were lost or stolen in the U.S. in 2013, up from 2.8 million 

in2012. 

Thefts were largely responsible for the increase in devices that were permanently separated from their owners, 

according to Consumer Reports' annual State of the Net Survey. The organization, which tests products, said stolen 

devices nearly doubled from 1.6 million in 2012 to 3.1 million in 2013. 

The number oflost devices increased from 1.2 million in 2012 to 1.4 million in 2013. More than 3,100 adults in the 

U.S. participated in the Consumer Reports survey that was used to calculate the figures. 

"Our survey revealed that the number of lost and stolen smart pbones is on the rise, and too many smart-phone 

users are needlessly imperiling their personal data by not taking basic security measures," said Glenn Derene, 

Consumer Reports' electronics editor. 

Consumer Reports recommends that at the minimum consumers secure their smartphones by setting up a four-digit 

lock code. 

The survey comes shortly after top phone manufacturers and wireless carriers announced their commitment to begin 

including basic anti-theft tools on all smartphones made after July 2015 for sale in the U.S. These tools will enable 

users to remotely lock their devices as well as remotely erase any data on the phones. 

Backing the commitment were Apple, Samsung, Google, Microsoft and several other companies. 

http://www.latimes.com/business/technology/la-fi-tn-45-million-smartphones-lost-stolen-2013-

20140417-storv.html 
66 


KING-6430 with DISTILLERInsert offset folio 28 here 26066.028

GIBSON DUNN 

April28, 2016 

VIA ELECTRONIC MAIL 

The Honorable William Hurd 

Chairman 

United States House Subcommittee on 

Information Technology of the 

Committee on Oversight and 

Govennnent Reform 

2157 Rayburn House Office Building 

Washington, D.C. 20515 

The Honorable Robin Kelly 

Ranking Member 

Gibson, Dunn & Crutcher llP 

1050 Connecticut Avenue, N.W, 

WaShington, D.C. 20036-5306 

Tel 202.955.8500 

www.gibsondunn.com 

MichaeiD.Bopp 

011901: +1202.956.1!256 Fax: +1202.530.9648 

Mllopp@g-.ccm 

United States House Subcommittee on 

information Technology of the 

Committee on Oversight and 

Govennnent Reform 

2471 Rayburn House Office Building 

Washington, D.C. 20515 

Re: Statement Made Concerning Key Point Government Solutions, Inc. During the April 

20. 2016 Hearing Titled, "Federal Cybersecurity Detection. Response. and 

Mitigation" 

Dear .Chairman Hurd and Ranking Member Kelly: 

Gibson, Dunn & Crutcher LLP ("Gibson Dunn") represents KeyPoint Government 

Solutions, Inc. ("Key Point''). During the April20, 2016 Subcommittee on Information 

Technology of the House Committee on Oversight and Govennnent Reform hearing titled, 

"Federal Cybersecurity Detection, Response, and Mitigation" (the "April20 Hearing''), a 

ststement was made about KeyPoint and its role in the data breach of the U.S. Office of 

Personnel Management's ("OPM") network, which KeyPoint would like to address. 

During the April20 Hearing, Ranking Member Kelly stated', "Key point ... was 

hacked, leading to the breach ofOPM's network ... "' By this letter, we seek to ensure that 

this statement is not taken as an evidence-based conclusion that KeyPoint was responsible 

fur a breach of OPM's network. 

1 Piease note that because the official hearing transcript is currently unavailable, the statement below is 

excerpted from a transcript provided by Congressional Quarterly. 

' Federal Cybersecurity Detection, Response, and Mitigation: Hearing Before the Subcomm. on Informollon 

Technology of the H. Comm. on Oversight & Gov 'I Rl![orm, ll4th Cong. 21 (20 16)(statement of Rep. 

Robin Kelly), CQ Congressional Transcripts, Congressional Hearings, April20, 2016. 

Beijing· Brussels· Century City· ~lias • Denver· Dubai • Hong Kong • London· Los Angeles • Munich 

New York • Orange Ccunty • Palo Alto · Paris San Francisco · sao Paulo • Singapore ·Washington, Q,C, 
67 


KING-6430 with DISTILLERInsert offset folio 29 here 26066.029

GIBSON DUNN 

The Hon. William Hurd 

The Hon. Robin Kelly 

April28, 2016 

Page2 

In a June 24, 2015 hearing before the House Committee on Oversight and 

Government Reform titled "OPM Data Breach: Part II," KeyPoint CEO Eric Hess testified' 

that "we see no evidence suggesting Keypoint was in any way responsible for the OPM 

breach.'"' He continued, explaining that while "[t]he press have also reported that hackers 

stole OPM credentials assigned to a Keypoint employee and that -- and leveraging to access 

OPM's systems,'" in fact, 

As (OPM] Director Archuleta noted, [in a] Senate hearing yesterday, there is no 

evidence suggesting that KeyPoint is responsible for or directly involved with the 

incursion. To be clear, the employee was working on an OPM system, not a 

Key Point system. • 

At the June 23, 2015 hearing before the Financial Services and General Government 

Subcommittee of the Senate Committee on Appropriations referenced by Mr. Hess in his 

testimony, then-Director of OPM Katherine Archuleta testified, 

I want to be very clear that while the adversary leveraged a compromised Key Point 

user credential to gain access to OPM's network, we don't have any evidence that 

would suggest that KeyPoint as a company was responsible or directly involved in 

the intrusion. We have not identified a pattern or material deficiency that resulted in 

the compromise of the credentials.7 

In sum, both Mr. Hess and then-OPM Director Archuleta testified that there was no 

evidence that KeyPoint was responsible for the OPM incursion. Stated another way, the fact 

that a KeyPoint employee's credential was stolen does not answer questions about how the 

credential was stolen and who was responsible. 

3 Again, because the official hearing transcript is currently unavailable, the following statements are 

excerpted from a trauscript provided by Congressional Quarterly. 

• OPM Data Breach: Part II: Hearing Bifore the H. Comm. on Oversight & Gov 't Reform, !14th Cong. 20 

(2015) (statement of Eric Hess, CEO, KeyPoint Government Solutions), CQ Congressional Transcripts, 

Congressional Hearings, June 24, 2015. 

' Idat21. 

6 Id 

7 Financial Services and General Government Appropriatiom for Fiscal Year 2016: Hearing Before the 

Subcomm. on Fin. Servs. & Gen. Gov'toftheS. Comm. on Appropriations, !14th Cong. 38 

(20 15Xstatement of Katherine L. Archuleta, Director, Office ofPersounel Management). 
68 


KING-6430 with DISTILLERInsert offset folio 30 here 26066.030

GIBSON DUNN 

The Hon. William Hurd 

The Hon. Robin Kelly 

April28,2016 

Page 3 

We appreciate your attention to this matter and respectfully ask that this letter be 

made part of the April 20 Hearing record. Please feel free to have your staff contact me with 

any questions concerning this matter. 

Sincere~, • ~ 

-1/~ 

Michael D. Bopp 
69 


KING-6430 with DISTILLERInsert offset folio 31 here 26066.031

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#1) 

House Subcommittee on Information Technology 

April20, 2016 

Reports indicate that the Department recently detected a significant vulnerability 

within its Consular Consolidated Databases (CCD). Can the Department confirm 

that this breach occurred and that reports are accurate? 

Answer: 

There is no evidence or indication that these vulnerabilities were ever 

exploited, and any reports of a breach or other intrusion of the CCD are not 

accurate. As part of our regular Federal Information Security Management Act 

(FISMA) and NIST 800-53R4 program (Security and Privacy Controls for Federal 

Information Systems and Organizations), the Department of State continuously 

monitors, tests, and implements upgrades to our systems in order to improve our 

defenses against constant, ever-evolving cybersecurity threats. We do this 

regularly and proactively to identify and remediate vulnerabilities before they can 

be exploited. The particular review in question was an extension of an ongoing 

internal review to improve our systems and to comply with our FISMA and NIST 

800-53R4 responsibilities, and not a response to an incident. 

During our regular proactive penetration testing late last year, the 

Department of State found vulnerabilities, i.e., technical weaknesses, in the 
70 


KING-6430 with DISTILLERInsert offset folio 32 here 26066.032

Consular Consolidated Database (CCD). Again, there is no evidence or 

indication that these vulnerabilities were ever exploited, and any reports of a 

breach or other intrusion of the ceo are not accurate. 
71 


KING-6430 with DISTILLERInsert offset folio 33 here 26066.033

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#2) 

House Subcommittee on Information Technology 

April20, 2016 

If these reports are accurate, what is the status of the mitigation of those 

vulnerabilities? Have they been fully mitigated, and if not what is the 

Department's target date for full mitigation? 

Answer: 

Any report of a breach is inaccurate. Since last fall, we have been working 

with interagency partners to detect and close any identified vulnerabilities, and we 

continue to do so. Vulnerabilities discovered in late 2015 have been addressed 

fully, or have been partially addressed with other mitigations, while we continue to 

develop and test complete fix actions. Because of their age, size, and complexity, 

aspects of some consular systems must be re-written in order to fully remediate the 

root vulnerability. We have been adding, and continue to expand, defense-in-depth 

mitigations to our systems while we improve and re-test underlying, custom 

software components prior to production deployment. 

We continually monitor, test, and upgrade our systems to address identified 

vulnerabilities, and to prevent unauthorized access. 
72 


KING-6430 with DISTILLERInsert offset folio 34 here 26066.034

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#3) 

House Subcommittee on Information Technology 

April20, 2016 

How much time passed between the Department's detection ofthe CCD 

vulnerabilities and notifying DHS? 

Answer: 

The Department of State works with the Department ofHomeland Security 

(DHS) as part of the federal incident response framework. As such, there are 

specific criteria for categorizing and reporting the nature and scope of an event or 

incident (e.g. detected intrusion, discovery of mal ware, denial of service). The 

vulnerabilities discovered in consular systems were application-level 

vulnerabilities in system software implementation, similar to vulnerabilities found 

in many applications. There was no evidence of exploit, and no trigger to escalate 

an incident response. 

We engaged DHS and the United States Emergency Readiness Team (USCERT) in December 2015, to gain assistance in performing additional testing and 

forensic analysis of our systems, including reviews to determine whether an 

incident might have occurred. The Department of State identified and investigated 
73 


KING-6430 with DISTILLERInsert offset folio 35 here 26066.035

the vulnerabilities principally between August and November 2015. US-CERT 

concluded that there was no evidence of a breach or other compromise. 
74 


KING-6430 with DISTILLERInsert offset folio 36 here 26066.036

Question: 

Questions for the Record Submitted to 

The Chieflnformation Officer Steven C. Taylor by 

Representative Will Hurd (#4) 

House Subcommittee on Information Technology 

April 20, 2016 

When the detection of a vulnerability has been designated as "classified", but the 

vulnerability is part of a Legacy IT system that is used in more than one 

government agency, is it State's protocol to immediately notifY DHS of the 

vulnerability's existence, so that agencies can begin mitigation? 

Answer: 

The Department works closely with DHS in accordance US-CERT Federal 

Incident Notification Guidelines to report a confirmed compromise of the 

confidentiality, integrity, or availability of federal systems. Moreover, the 

Department's Cyber Incident Response Team (CIRT) maintains a detailed set of 

internal operating procedures that fully satisfY the US-CERT requirements for the 

timely assessment, reporting, and sharing of information about cyber security 

incidents (i.e., intrusions, malware, denial of service, etc.) and reviewing, 

monitoring, and mitigating (where required) for Indicators of Compromise 

reported by DHS. 

These vulnerabilities were identified during internal testing and review, and 

not an actual incident. The system in question also was not used by other agencies 

but rather accessed. Therefore, issues surrounding the CCD vulnerabilities fell 
75 


KING-6430 with DISTILLERInsert offset folio 37 here 26066.037

outside the scope of the standard incident response framework as these matters 

were self-identified by the system owner, Consular Affairs, by way of internal 

testing and review. The Department subsequently leveraged DHS' expertise in 

performing additional testing. The Department will adjust reporting processes on 

an as needed basis as federal reporting requirements change. 
76 


KING-6430 with DISTILLERInsert offset folio 38 here 26066.038

Approved: CA: David T. Donahue, Acting (ok) 

Drafted: CA/CST/SIJ: Sandeep Maripuri, ext. 5-7938 

Cleared: CA: LPetrush 

CA/R: JBrennan 

CA/CST: KReynolds 

CA/CST/SII: SMaripuri 

CA/P: TMazin 

SIP: AMansour 

D-MR: CMorrow 

D: BF!ens 

P: DWong 

M:HA!to 

MIPRJ: CMaier 

IRM: PGouldmann 

H: JDeMaria 

DS: AStarr 

USDS: RMajma 

CA Tracking Number: Tl418-16 

(ok) 

(ok) 

(ok) 

(ok) 

(ok) 

(info) 

(ok) 

(ok) 

(ok) 

(ok) 

(ok) 

(ok) 

(ok) 

(ok) 

(ok) 
77 


KING-6430 with DISTILLERInsert offset folio 39 here 26066.039

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#5) 

House Subcommittee on Information Technology 

April20, 2016 

What challenges do your organizations and agencies see related to the cyber 

workforce in the federal government and what ways can Congress help address 

them? 

Answer: 

We need to acknowledge that cyber threats will always exist, and there is a 

need for a holistic, all-of-government approach, including workforce planning. No 

one agency should ever attempt to go it alone when faced with a cybersecurity 

event, and there is great strength in our numbers. The ability to share information 

with private and public sector partners extends beyond research and development, 

and should include training. We, like all other federal agencies, face significant 

challenges in remaining competitive when hiring IT officials, including 

cybersecurity personnel. A holistic, strategic approach that includes federal 

training programs, including rotational assignments, would enhance the federal 

workforce. 
78 


KING-6430 with DISTILLERInsert offset folio 40 here 26066.040

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#6) 

House Subcommittee on Information Technology 

April20, 2016 

Skill testing is a critical step in validating the skills critical to securing govermnent 

IT. What challenges do you face around this issue with regards to your 

employees? 

Answer: 

In both the private and public sector, IT professionals require continuous 

learning because technology evolves as a rapid rate, which can be challenging. 

The Department has formalized training for our IT workforce at our Foreign 

Service Institute School of Applied Information Technology, and offers an IT 

Skills Incentive Program (SIP). SIP provides a financial incentive, on a renewable 

basis, for IT employees to attain current IT certifications and other credentials after 

joining the Department of State. IT SIP requires employees to update their 

credentials every three years, with a focus on expanding their skill set. 

The Department hires and incentives IT professionals, and all cyber-related 

IT positions in the Department use the National Initiative for Cybersecurity 

Education (NICE) framework. Per the requirements of the Federal Cybersecurity 

Workforce Assessment Act of2015, the Department participates in the Office of 
79 


KING-6430 with DISTILLERInsert offset folio 41 here 26066.041

Personnel Management's (OPM) Federal Cybersecurity Workforce Assessment 

Act Advisory Group to better capture the cybersecurity skills of its IT employees; 

determine where the gaps are; and identify future critical training programs. 
80 


KING-6430 with DISTILLERInsert offset folio 42 here 26066.042

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#7) 

House Subcommittee on Information Technology 

April 20, 2016 

What requirements currently do your agencies have in place for training and 

certifying employees with IT and cybersecurity job responsibilities and roles? 

Answer: 

The Department makes great efforts to educate network users so they 

themselves defend our systems. Department of State network users must complete 

cybersecurity and privacy awareness training on an annual basis. In addition, 

network users are expected to answer a security challenge question prior to logging 

on to their system each day. Both the Federal Information Security Modernization 

Act (FISMA) of2014 and Federal guidance mandate role-based training for IT 

professionals with significant information technology security responsibilities. 

The Department offers cybersecurity courses through its Diplomatic Security 

Training Center, providing training that addresses the specific information security 

roles, such as Information Systems Security Officers, System Administrators, 

application developers, and senior-level managers and executives. These courses 

are instructor-led and include hands-on exercises, and there is also a Cybersecurity 

Online Learning program. This program supplements mandatory security role-
81 


KING-6430 with DISTILLERInsert offset folio 43 here 26066.043

based training with live, instructor-led virtual workshops throughout the year on 

the latest cybersecurity topics, tools, and best practices. 
82 


KING-6430 with DISTILLERInsert offset folio 44 here 26066.044

Question: 

Questions for the Record Submitted to 

The Chief Information Officer Steven C. Taylor by 

Representative Will Hurd (#8) 

House Subcommittee on Information Technology 

April20, 2016 

The government has a significant volume of sensitive PII. Do your agencies 

currently deploy digital rights management capabilities? 

Answer: 

The Department of State does not currently use digital rights management; 

however, the Department has recognized the value of the technology and is 

actively working to address the need. To this end, the Department has established 

a high-level plan, business requirements, and design to implement Microsoft 

Rights Management Services (RMS), a digital rights management solution that will 

allow the Department to control e-mail and documents based on configured 

policies. These capabilities are included within our Microsoft Enterprise User 

Level Agreements. The digital rights management solution provided by RMS is 

expected to be available after the introduction of Office 365 and Azure federal 

cloud services for the Department. 
83 


KING-6430 with DISTILLERInsert offset folio 45 here 26066.045

Questions for the Record Submitted to 

Chief Information Officer Steven C. Taylor by 

Representative Blake Farenthold (#1) 

House Committee on Oversight and Government Reform 

April20, 2016 

Technology has been deployed across government known as Digital Rights 

Management that has the ability to protect and encrypt sensitive data at the 

document and content level. This technology has been successfully 

deployed in a number of federal agencies as well as in the Intelligence 

Community. 

Question: 

Does your agency have any information security programs in place to 

protect and monitor in real time sensitive documents and information (MS 

Word, PowerPoint, Excel, PDFs, CAD files, etc.) after it leaves a content 

management system? 

Answer: 

Department personnel have the ability to encrypt both files and emails 

using the public key infrastructure (PKI) certificates contained on their 

HSPD-12 Personal Identity Verification (PIV) card. The ability to encrypt 

using the PIV card is used when sharing information with other Department 

users or other Federal entities. Once the file is encrypted, it can be attached 

to an email or copied to mobile media for transit and decrypted using the 

PKI certificate of the receiving party. 

For external partners, the Department has the ability to encrypt a file 

using a FIPS 140-2 compliant product, ProtectPack. Just like with internal 

users and Federal partners, once the file is encrypted, it can be emailed to an 
84 


KING-6430 with DISTILLERInsert offset folio 46 here 26066.046

external partner for decryption on their end using a password that is 

provided out of band. 
85 


KING-6430 with DISTILLERInsert offset folio 47 here 26066.047

Questions for the Record Submitted to 

Chief Information Officer Steven C. Taylor by 

Representative Blake Farenthold (#2) 

House Committee on Oversight and Government Reform 

April 20, 2016 

Question: 

What plans does your agency enterprise have to identify and ensure the 

protection and encryption of high value data sets-- sensitive digital content, 

documents and information housed in various agency databases? 

Answer: 

The Department categorizes all of its information systems based upon 

Federal Information Processing Standard Publication 199 and in the case of 

national security systems, Committee on National Security Systems 

Instruction 1253. This categorization identifies for the Department the 

protection required with regard to the level of impact that would occur if the 

system was successfully exploited. These efforts provide the Department 

with a baseline of need for the protection provided through application of 

data-at-rest encryption. 

The Department is in the process of implementing data-at-rest 

encryption for sensitive information contained within systems categorized as 

high and moderate. This process began in July 2015 and included renegotiation of enterprise licensing for the two large-scale database product 

vendors to add to the licenses already on hand for file systems. 
86 


KING-6430 with DISTILLERInsert offset folio 48 here 26066.048

Implementation time lines were set based on the categorization of systems, 

with high impact systems to be completed first. The encryption products 

employed are all validated as compliant with Federal Information Processing 

Standard Publication 140-2 as recommended by the Government 

Accountability Office. 
87 


KING-6430 with DISTILLERInsert offset folio 49 here 26066.049

Question#: I 

Topic: CDN FY 17 Budget Request 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation. 

Primary: The Honorable Blake Farenthold 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

Question: NPPD's Continuous Diagnostics & Mitigation (CDM) FY17 budget request 

includes a $266m budget increase request to accelerate the adoption of data protection 

capabilities to help federal civilian agencies protect sensitive and high value asset data 

within agency networks. What is CDM's strategic plan and timeline for deploying CDM 

phase 4 data level protection capabilities such as digital rights management and 

encryption? 

Response: The CDM program office is performing preliminary planning activities to 

support the addition of Phase 4 in FY17, Ql. Phase 4 consists of: 

1. Digital rights management; 

2. Micro-segmentation; 

3. Data masking; and 

4. Mobile device management. 

Based on initial planning, CDM Phase 4 will prioritize the deployment of the capabilities 

listed above to high value assets (HV A) across 23 eligible Chief Financial Officers Act 

agencies. HV As are systems or databases that contain sensitive or large volumes of 

Personally Identifiable Information (PII), support critical government services, or contain 

data critical to economic or national security. Congressional support for the FYI7 budget 

request will allow DHS to focus on securing these critical assets against persistent 

adversaries. 

Capability Estimated Estimated Award Available To 

Solicitation 

Digital rights management Q3, FY17 Ql, FY18 All civilian agencies 

participating in 

CDM, via a shared 

service 

Micro-segmentation Beginning Beginning Q4, 12 HVAs per 

Q2, FY17 FY17 _quarter 

Data masking Beginning Beginning Q4, 12 HVAs per 

Q2, FY17 FYI7 quarter 

Mobile device Beginning Beginning Q4, 12 HVAsper 

management Q2, FY17 FY17 J!Uarter 
88 


KING-6430 with DISTILLERInsert offset folio 50 here 26066.050

Question#: I 

Topic: CDN FY 17 Budget Request 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation. 

Primary: The Honorable Blake Farenthold 

Committee: OVERSIGHT & GOY RFORM (HOUSE) 

As further planning activities are conducted over the next several months with the 

Department of Homeland Security (DHS), General Services Administration and 

participating agency stakeholders, changes to this strategic plan may occur to support the 

most cost and time effective approach to continue to secure agency mission critical 

information, applications, and networks. 
89 


KING-6430 with DISTILLERInsert offset folio 51 here 26066.051

Question#: I 

Topic: CDN FYI7 Budget Request 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation. 

Primary: Tbe Honorable Blake Farenthold 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

Question: NPPD' s Continuous Diagnostics & Mitigation (CDM) FY17 budget request 

includes a $266m budget increase request to accelerate the adoption of data protection 

capabilities to help federal civilian agencies protect sensitive and high value asset data 

within agency networks. What is CDM's strategic plan and timeline for deploying CDM 

phase 4 data level protection capabilities such as digital rights management and 

encryption? 

Response: The CDM program office is performing preliminary planning activities to 

support the addition of Phase 4 in FY17, Ql. Phase 4 consists of: 

1. Digital rights management; 

2. Micro-segmentation; 

3. Data masking; and 

4. Mobile device management. 

Based on initial planning, CDM Phase 4 will prioritize the deployment of the capabilities 

listed above to high value assets (HV A) across 23 eligible Chief Financial Officers Act 

agencies. HV As are systems or databases that contain sensitive or large volumes of 

Personally Identifiable Information (PII), support critical government services, or contain 

data critical to economic or national security. Congressional support for the FY17 budget 

request will allow DHS to focus on securing these critical assets against persistent 

adversaries. 

Capability Estimated Estimated Award Available To 

Solicitation 

Digital rights management Q3, FY17 Q1,FY18 All civilian agencies 

participating in 

CDM, via a shared 

service 

Micro-segmentation Beginning Beginning Q4, 12 HVAs per 

Q2,FY17 FY17 quarter 

Data masking Beginning Beginning Q4, 12 HVAsper 

Q2, FY17 FY17 quarter 

Mobile device Beginning Beginning Q4, 12 HVAsper 

management Q2, FY17 FY17 quarter 
90 


KING-6430 with DISTILLERInsert offset folio 52 here 26066.052

Question#: I 

Topic: CDN FYI7 Budget Request 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation. 

Primary: The Honorable Blake Farenthold 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

As further planning activities are conducted over the next several months with the 

Department of Homeland Security (DHS), General Services Administration and 

participating agency stakeholders, changes to this strategic plan may occur to support the 

most cost and time effective approach to continue to secure agency mission critical 

information, applications, and networks. 
91 


KING-6430 with DISTILLERInsert offset folio 53 here 26066.053

Question#: 1 

Topic: Inspections of Contractors 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

Question: What steps has the Department of Homeland Security (DHS or Department) 

taken to ensure that those contractors who perform work on its behalf, and who as part of 

that work store sensitive or classified government information on their computer systems, 

have adopted adequate measures to secure this information? 

Do these steps include conducting at-will inspections of those contractors? 

If so, what statute or law authorizes the Department to conduct at-will inspections? 

Can you explain the role and benefit that at-will inspections provide in ensuring that 

Departmental contractors have adopted adequate cyber-security measures? 

Response: DHS has taken several steps to ensure that contractors who perform work on 

its behalf, and who, as part of that work, store sensitive or classified government 

information on their computer systems, have adopted adequate measures to secure this 

information. DHS developed special contract language to protect sensitive information, 

such as personally identifiable information, from unauthorized access and disclosure. 

This contract language, issued March 9, 2015, includes specific requirements that 

information systems must meet before they can be used to process, store, or transmit 

sensitive information as well as at-will inspections. We are currently in the rulemaking 

process to incorporate this contractual language into the Homeland Security Acquisition 

Regulation. The specific requirements related to this inquiry are as follows: 

• Authority to Operate: A contractor cannot process, store or transmit sensitive 

information within an information system until an ATO has been accepted and signed 

by the Component or DHS Chieflnformation Officer (CIO), or designee. To obtain 

an ATO, a contractor must complete the Security Authorization (SA) process. The 

SA process consists of two steps as follows: 

o Security Authorization Documentation: The contractor shall develop its 

SA documentation using the Government provided Requirements Traceability 

Matrix (RTM). The RTM identifies the security controls an information 

system must meet before it can be used to process, store, or transmit sensitive 

information. The SA documentation consists of a Security Plan, Contingency 

Plan, Contingency Plan Test Results, Configuration Management Plan, 

Security Assessment Plan, Security Assessment Report, and Authority to 
92 


KING-6430 with DISTILLERInsert offset folio 54 here 26066.054

Question#: I 

Topic: Inspections of Contractors 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOY RFORM (HOUSE) 

Operate Letter, Additional documents that may be required include a Plan(s) 

of Action and Milestones and Interconnection Security Agreement(s). 

o Independent Assessment: Contractors must have an independent third party 

validate the security and privacy controls in place for the information 

system(s). The independent third party reviews and analyzes the SA 

documentation and reports on technical, operational, and management level 

deficiencies. The contractor is required to address all deficiencies before 

submitting the SA package to the Government for review and acceptance. 

• Renewal of ATO: Unless otherwise specified in the ATO letter, contractors are 

required to renew the A TO every three years. As part of the A TO renewal process, 

the contractor is required to update its SA documentation for review and verification 

of security controls. Review and verification of security controls may include onsite 

visits that involve physical or logical inspection of the contractor environment to 

ensure controls are in place. 

• Security Review: The Government may elect to conduct random periodic reviews to 

ensure that the security requirements contained in the contract are being implemented 

and enforced, which may include at-will inspections of the contractor's facilities and 

information systems. This assists the government in verifying that necessary security 

measures are being adequately followed to properly safeguard the Department's 

information from compromise. 

The Government, at its sole discretion, may obtain the assistance from other Federal 

agencies and/or third-party firms to aid in security review activities. The Contractor 

is required to allow access to DHS, the Office of the Inspector General, other 

Government organizations, and contractors working in support of the Government, 

access to the Contractor's facilities, installations, operations, documentation, 

databases, networks, systems, and personnel used in the performance of the contract. 

Access is required to be provided, to the extent necessary as determined by the 

Government (including providing all requested images), for the Government to carry 

out a program of inspection, investigation, and audit to safeguard against threats and 

hazards to the integrity, availability and confidentiality of Government data or the 

function of computer systems used in performance of this contract and to preserve 

evidence of computer crime. 

• Continuous Monitoring: Contractors operating information systems on behalf of 

the Government or operating information systems containing the Government's 
93 


KING-6430 with DISTILLERInsert offset folio 55 here 26066.055

Question#: l 

Topic: Inspections of Contractors 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOY RFORM (HOUSE} 

sensitive information must comply with Federal reporting and information system 

continuous monitoring requirements. The Government may elect to perform 

information system continuous monitoring and IT security scanning of information 

systems from Government tools and infrastructure. 

• Incident Response: The contractor is required to provide full access and cooperation 

for all activities determined by the Government to be required to ensure an effective 

incident response, including providing all requested images, log files, and event 

information to facilitate rapid resolution of sensitive information incidents. Incident 

response activities determined to be required by the Government may include, but are 

not limited to, inspections, investigations, forensic reviews, data analyses and 

processing, and revocation of the Authority to Operate. The contractor shall also 

preserve and protect images of known affected information systems and all relevant 

monitoring/packet capture data for at least 90 days from submission ofthe incident 

report to allow DHS to request the media or decline interest. The Government may 

also, at its sole discretion, obtain assistance from other Federal agencies and/or thirdparty firms to aid in incident response activities. 

The Federal Information Security Modernization Act (FISMA) of2014 (44 U.S.C. § 

3554) requires agency heads to provide information security protections commensurate 

with the risk and magnitude of the harm resulting from unauthorized access, use, 

disclosure, disruption, modification, or destruction of information collected or maintained 

by or on behalf of the agency as well as information systems used or operated by an 

agency or by a contractor of an agency or other organization on behalf of an agency. 

Integral to the process of applying such protections and ensuring security compliance 

with them is the ability to access and inspect the systems. Thus, the ability to do so is 

built into the contract clauses. 
94 


KING-6430 with DISTILLERInsert offset folio 56 here 26066.056

Question#: 2 

Topic: Forensic and Incident Reports 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

Question: At the time of the data breaches of OPM and Anthem, was there a requirement 

that a government contractor provide DHS with copies of all forensic and incident reports 

and analyses in the event that the contractor sustains a data breach on its network or 

systems? 

If not, what steps is DHS taking now to ensure that contractors provide those materials in 

future cyber incidents? 

Response: DHS is unable to answer questions related to the OPM and Anthem data 

breaches as the Department did not issue the contracts under which these data breaches 

occurred. DHS has developed special contract language to protect sensitive information, 

such as personally identifiable information, provided under DHS contracts from 

unauthorized access and disclosure. Using her authority to issue class deviations from 

the Homeland Security Acquisition Regulation, the DHS Chief Procurement Officer 

issued this special contract language on March 9, 2015, and several Components have 

already successfully incorporated the requirements in contracts. The contract language 

includes specific incident response requirements for which a contractor must comply in 

the event of a data breach. Specifically, the contract language requires contractors to 

provide full access and cooperation for all activities determined by the Government to be 

required to ensure an effective incident response, including providing all requested 

images, log files, and event information to facilitate rapid resolution of incidents. 

Incident response activities determined to be required by the Government may include 

inspections, investigations, forensic reviews, data analyses and processing, and 

revocation of the contractor's Authority to Operate. Contractors are also required to 

preserve and protect images of known affected information systems and all relevant 

monitoring/packet capture data for at least 90 days from submission of the incident report 

to allow DHS to request the media or decline interest. We are currently in the 

rulemaking process to incorporate this contractual language into the Homeland Security 

Acquisition Regulation. 
95 


KING-6430 with DISTILLERInsert offset folio 57 here 26066.057

Question#: 3 

Topic: US-CERT 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOY RFORM (HOUSE) 

Question: Can you explain the role and benefit of forensic and incident reports and 

analyses in the mission ofDHS's United States Computer Emergency Readiness Team 

(US-CERT)? 

Response: US-CERT, which is a part of the National Cybersecurity and Communications 

Integration Center, acts as the federal information security incident center for the United 

States federal government under FISMA. Pursuant to FISMA, federal civilian executive 

branch agencies are required to notify and consult with US-CERT regarding information 

security incidents involving the information and information systems (including those 

managed by a federal agency, contractor, or other source) that support the operations and 

assets of the agency. This includes incidents involving control systems, which include 

supervisory control and data acquisition systems, distributed control systems, 

programmable logic controllers and other types of industrial measurement and control 

systems. Reporting by all other entities is generally voluntary. 

Such reports and consultation support US-CERT in executing its mission objectives and 

enable the following benefits: 

• Greater quality of information - Alignment with incident reporting and handling 

guidance from National Institute of Standards and Technology 800-61 Revision 2 

to introduce functional, informational and recoverability impact classifications, 

allowing US-CERT to better recognize significant incidents. 

• Improved information sharing and situational awareness - Establishing a one-hour 

notification time frame for all incidents to improve US-CERT's ability to 

understand cybersecurity events affecting the government. 

• Faster incident response times- Moving cause analysis to the closing phase of the 

incident handling process to expedite initial notification. 

Forensic analysis and reporting seeks to define the scope and depth of cyber incidents by 

bringing to light previously unknown artifacts, actions and indicators from victim data 

sets. The goal of which is to distill and articulate a complete forensic narrative for 

decision makers to leverage in response to events within their organizations/communities. 

Additionally, forensic and incident reports provide-threat awareness and detailed tactics, 

techniques, and procedures (TTPs) that adversaries are using to compromise networks. 

Learning about potentially new TTPs gives us additional places within a network or host 

to search for potential malicious activity or evidence of compromise. Although US-CERT 
96 


KING-6430 with DISTILLERInsert offset folio 58 here 26066.058

Question#: 3 

Topic: US-CERT 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOY RFORM (HOUSE) 

would routinely conduct its own examination, it is always beneficial to receive analysis 

completed by third parties. 
97 


KING-6430 with DISTILLERInsert offset folio 59 here 26066.059

Question#: 4 

Topic: Inspection Regulations 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOY RFORM (HOUSE) 

Question: Do the current federal acquisition regulations allow agencies across the federal 

government to conduct at-will inspections of those contractors that store sensitive or 

classified government information on their networks or systems? 

If so, which regulations grant this specific authority? 

If not, do you believe legislative reform is needed to address this issue? 

If you do believe legislative reform is necessary, what would be your recommendation to 

Congress? 

Response: The Federal Acquisition Regulation (FAR) currently provides a number of 

mechanisms for agencies to conduct inspections of contractor facilities. Examples 

include FAR 52.539-1 Privacy or Security Safeguards, FAR 52.246-4 Inspection of 

Services-- Fixed-Price, FAR 52.246-5 Inspection of Services-- Cost-Reimbursement, 

FAR 52.246-6 Inspection-- Time-and-Material and Labor-Hour, etc. Classified 

government information would be subject to the National Industrial Security Program 

Operating Manual. 

DHS has addressed its ability to access contractor facilities through the development of 

special contract language that protects sensitive information, such as personally 

identifiable information, provided under DHS contracts from unauthorized access and 

disclosure. Using her authority to issue class deviations from the Homeland Security 

Acquisition Regulation, the DHS Chief Procurement Officer issued this special contract 

language on March 9, 2015, and several Components have already successfully 

incorporated the requirements in contracts. This contract language includes specific 

requirements that afford the government access to contractor facilities. DHS is currently 

in the rulemaking process to incorporate this contract language into the Homeland 

Security Acquisition Regulation. The current special contract language addresses this 

requirement through two (2) provisions as follows: 

(1) Security Review: Under this provision, the Government may elect to conduct random 

periodic reviews to ensure that the security requirements contained in this contract are 

being implemented and enforced. The Contractor shall afford access to DHS, the Office 

of the Inspector General, other Government organizations, and contractors working in 

support of the Government access to the Contractor's facilities, installations, operations, 

documentation, databases, networks, systems, and personnel used in the performance of 
98 


KING-6430 with DISTILLERInsert offset folio 60 here 26066.060

Question#: 4 

Topic: Inspection Regulations 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

this contract Access shall be provided, to the extent necessary as determined by the 

Government (including providing all requested images), for the Government to carry out 

a program of inspection, investigation, and audit to safeguard against threats and hazards 

to the integrity, availability and confidentiality of Government data or the function of 

computer systems used in performance of this contract and to preserve evidence of 

computer crime; and 

(2) Incident Response: Under this provision, contractors are required to provide full 

access and cooperation for all activities determined by the Government to be required to 

ensure an effective incident response, including providing all requested images, log files, 

and event information to facilitate rapid resolution of incidents. Incident response 

activities determined to be required by the Government may include inspections, 

investigations, forensic reviews, data analyses and processing, and revocation of the 

contractor's Authority to Operate. Contractors are also required to preserve and protect 

images of known affected information systems and all relevant monitoring/packet capture 

data for at least 90 days from submission of the incident report to allow DHS to request 

the media or decline interest 
99 


KING-6430 with DISTILLERInsert offset folio 61 here 26066.061

Question#: 5 

Topic: Forensic/Incident Reports to US-CERT 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Robin Kelly 

Committee: OVERSIGHT & GOY RFORM (HOUSE) 

Question: Do the current federal acquisition regulations or laws require that when a 

government contractor sustains a data breach on their computer systems that the 

contractor provide copies of any forensic or incident reports concerning the breach 

directly to United States Computer Emergency Readiness Team (US-CERT)? If so, 

which specific regulations or laws govern this obligation? 

If the answer to the above question is no: 

Would it be advantageous for completion ofUS-CERT's cyber-mission to directly 

receive copies of any incident or forensic reports? 

What advantages would it provide to US-CERT's cyber-mission if government 

contractors were obligated to directly provide the agency with any incident or forensic 

reports concerning a data breach? 

Do you believe government contractors should be required to directly provide US-CERT 

with copies of all forensic or incident reports and analyses pertaining to any data breach 

that was sustained on their networks or systems? 

If so, what would be your recommendation to Congress? 

Do the current federal acquisition regulations or laws require that when a government 

contractor sustains a data breach on their computer systems that the contractor provide 

copies of any forensic or incident reports concerning the breach directly to US-CERT? If 

so, which specific regulations or laws govern this obligation? 

Response: FISMA requires federal, civilian, executive branch agencies to report security 

incidents to the federal information security incident center. US-CERT acts as that center. 

FISMA, and thus FISMA incident reporting, extends to information collected or 

maintained by or on behalf of an agency and information systems used or operated by an 

agency or by a contractor of an agency or other organization on behalf of an agency. 

Agencies extend the reporting obligations imposed on them by FISMA to their 

contractors by contract, in a structure in which the contractors report to the relevant 

agency and then the agency reports to US-CERT. 
100 


KING-6430 with DISTILLERInsert offset folio 62 here 26066.062

Question#: 6 

Topic: CDM Phase 4 Data Level Protection 

Hearing: Federal Cybersecurity Detection, Response, and Mitigation 

Primary: The Honorable Gerry Connolly 

Committee: OVERSIGHT & GOV RFORM (HOUSE) 

Question: The National Protection and Programs Directorate's Fiscal Year (FY) 2017 

Continuous Diagnostics & Mitigation (CDM) budget request includes a $266 million 

increase to accelerate the adoption of data protection capabilities and to help federal 

civilian agencies protect sensitive and high value data within agency networks. What is 

CDM's strategic plan and timeline for deploying CDM phase 4 data level protection 

capabilities such as digital rights management and encryption? 

Response: The requested funding for Phase 4 builds on the success of Phases 1, 2 and 3, 

of the CDM program, and expands to include tools and services to protect data within 

agency networks. Through the Cyber Sprint inter-agency teams, Office of Management 

and Budget has identified several tools and services that, if made available, would allow 

agencies to build in that additional layer of defense at the data level. 

The potential Phase 4 capabilities are categorized as: digital rights management; microsegmentation; data masking; encryption and decryption; and mobile device management. 

The current plan is to release procurement actions in FYI7 Q3, award the contract by 

FY18 Q2, and begin implementation by FY18 Q3. 

The total requested increase will support all phases of the CDM program to include the 

implementation of Phases 3 and 4, providing necessary software and services to allow 

DHS and federal agencies to continuously manage their boundaries, security events, 

building security into system lifecycles and enhancing data protection in a variety of ways. 

Additional funds are required to plan across all the phases for increased planning, 

monitoring, and oversight. 
101 


KING-6430 with DISTILLERInsert offset folio 63 here 26066.063

Question: 

Questions for the Record Submitted to 

Chief Information Officer Steven C. Taylor by 

Representative Gerry Connolly 

Subcommittee on Information Technology, 

Committee on Oversight and Government Reform 

April 20, 2016 

Digital Rights Management (DRM) is one of a number of documentprotection and encryption technologies that have been deployed across 

multiple federal government agencies, including the Intelligence 

Community. 

a. Understanding that the government has a significant volume of 

sensitive and personally identifiable information, do you have 

plans to fund and deploy digital rights management capabilities 

across your agency to protect against unauthorized data 

exfiltration? 

b. Does your agency have any information-security programs in place 

to protect and monitor in real time sensitive documents and 

information? 

c. What plans does your agency have to identify and ensure the 

protection and encryption ofhigh-value datasets (e.g. sensitive 

digital content, documents and information housed in various 

agency databases, etc.)? 

Answer: 

The U.S. Department of State established a high level plan, business 

requirements, and a design to implement a digital rights management 
102 


KING-6430 with DISTILLERInsert offset folio 64 here 26066.064

solution that will allow the Department to control e-mail and documents 

based on configured policies. The digital rights management solution 

provided is expected to be available after the introduction of Office 365 and 

related Azure federal cloud services for the Department. 

We understand your question to be whether or not the Department of 

State has programs currently in place and available to our users to protect 

and secure information being sent electronically within the Department, the 

federal government and to non-governmental third-parties. Yes, within the 

Department's managed information systems, multi-layered data protection 

security countermeasures are active. These safeguards provide real time 

and/or near real time protection to data in transit, in use, and at rest. A few 

examples of the technologies in use are: Event log collection, retention, 

correlation, and analyses; principle of least privilege (e.g., manage, track, 

and correct); FIPS 140-2 encryption; malware protection (end-point and 

network); boundary protection (threat protection); network content filtering; 

network activity monitoring; and filtering; intrusion prevention system 

(IPS); e-mail and browser protection. The Department is also currently 

working to implement phase I ofDHS's three-phased Einstein 3 

Accelerated (E3A) and Continuous Diagnostics and Monitoring (CDM) 

program. 
103 

Æ 


KING-6430 with DISTILLERInsert offset folio 65 here 26066.065

The Department categorizes all of its information systems based upon 

the National Institute of Standards and Technology guidelines, Federal 

Information Processing Standard Publication 199, and in the case of national 

security systems, Committee on National Security Systems Instruction 1253. 

This categorization identifies for the Department the protection required 

with regard to the level of impact that would occur ifthe system was 

successfully exploited. These efforts provide the Department with a baseline 

of need for the protection provided through application of data-at-rest 

encryption. 

The Department is in the process of implementing data-at-rest 

encryption for sensitive information contained within systems categorized as 

high and moderate. This process began in July 2015 and included renegotiation of enterprise licensing for the two large-scale database product 

vendors to add to the licenses already on hand for file systems. 

Implementation timelines were prioritized based on the categorization of 

systems, with emphasis on completing high impact systems first. The 

encryption products employed are all validated as compliant with federal 

guidelines and practices, specifically Federal Information Processing 

Standard Publication 140-2.