```

[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]

                    CYBERSECURITY--GETTING IT RIGHT

=======================================================================

                                HEARING

                                 of the

                     SUBCOMMITTEE ON CYBERSECURITY,
                 SCIENCE, AND RESEARCH, AND DEVELOPMENT

                               before the

                 SELECT COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED EIGHTH CONGRESS

                             FIRST SESSION

                               __________

                             JULY 22, 2003

                               __________

                           Serial No. 108-18

                               __________

    Printed for the use of the Select Committee on Homeland Security

 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 house

                               __________

                   U.S. GOVERNMENT PRINTING OFFICE
98-150 PDF                WASHINGTON : 2005
______________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512-1800  
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

                 SELECT COMMITTEE ON HOMELAND SECURITY

                 CHRISTOPHER COX, California, Chairman

JENNIFER DUNN, Washington            JIM TURNER, Texas, Ranking Member
C.W. BILL YOUNG, Florida             BENNIE G. THOMPSON, Mississippi
DON YOUNG, Alaska                    LORETTA SANCHEZ, California
F. JAMES SENSENBRENNER, JR.,         EDWARD J. MARKEY, Massachusetts
Wisconsin                            NORMAN D. DICKS, Washington
W.J. (BILLY) TAUZIN, Louisiana       BARNEY FRANK, Massachusetts
DAVID DREIER, California             JANE HARMAN, California
DUNCAN HUNTER, California            BENJAMIN L. CARDIN, Maryland
HAROLD ROGERS, Kentucky              LOUISE McINTOSH SLAUGHTER,
SHERWOOD BOEHLERT, New York            New York
LAMAR S. SMITH, Texas                PETER A. DeFAZIO, Oregon
CURT WELDON, Pennsylvania            NITA M. LOWEY, New York
CHRISTOPHER SHAYS, Connecticut       ROBERT E. ANDREWS, New Jersey
PORTER J. GOSS, Florida              ELEANOR HOLMES NORTON,
DAVE CAMP, Michigan                    District of Columbia
LINCOLN DIAZ-BALART, Florida         ZOE LOFGREN, California
BOB GOODLATTE, Virginia              KAREN McCARTHY, Missouri
ERNEST J. ISTOOK, JR., Oklahoma      SHEILA JACKSON-LEE, Texas
PETER T. KING, New York              BILL PASCRELL, JR., New Jersey
JOHN LINDER, Georgia                 DONNA M. CHRISTENSEN,
JOHN B. SHADEGG, Arizona               U.S. Virgin Islands
MARK E. SOUDER, Indiana              BOB ETHERIDGE, North Carolina
MAC THORNBERRY, Texas                CHARLES GONZALEZ, Texas
JIM GIBBONS, Nevada                  KEN LUCAS, Kentucky
KAY GRANGER, Texas                   JAMES R. LANGEVIN, Rhode Island
PETE SESSIONS, Texas                 KENDRICK B. MEEK, Florida
JOHN E. SWEENEY, New York

                      JOHN GANNON, Chief of Staff

         UTTAM DHILLON, Chief Counsel and Deputy Staff Director

               DAVID H. SCHANZER, Democrat Staff Director

                    MICHAEL S. TWINCHEK, Chief Clerk

                                 ______

   SUBCOMMITTEE ON CYBERSECURITY, SCIENCE, AND RESEARCH & DEVELOPMENT

                    MAC THORNBERRY, Texas, Chairman

PETE SESSIONS, Texas, Vice Chairman  ZOE LOFGREN, California
SHERWOOD BOEHLERT, New York          LORETTA SANCHEZ, California
LAMAR SMITH, Texas                   ROBERT E. ANDREWS, New Jersey
CURT WELDON, Pennsylvania            SHEILA JACKSON-LEE, Texas
DAVE CAMP, Michigan                  DONNA M. CHRISTENSEN,
ROBERT W. GOODLATTE, Virginia          U.S. Virgin Islands
PETER KING, New York                 BOB ETHERIDGE, North Carolina
JOHN LINDER, Georgia                 CHARLES GONZALEZ, Texas
MARK SOUDER, Indiana                 KEN LUCAS, Kentucky
JIM GIBBONS, Nevada                  JAMES R. LANGEVIN, Rhode Island
KAY GRANGER, Texas                   KENDRICK B. MEEK, Florida
CHRISTOPHER COX, CALIFORNIA, ex      JIM TURNER, Texas, ex officio
officio

                                  (ii)

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

The Honorable Mac Thornberry, Chairman, Subcommittee on 
  Cybersecurity, Science, and Research and Development, and a 
  Representative in Congress From the State of Texas.............     1
The Honorable Christopher Cox, Chairman, Select Committee on 
  Homeland Security, and a Representative in Congress From the 
  State of California
  Oral Statement.................................................     3
  Prepared Statement.............................................     4
The Honorable Dave Camp, a Representative in Congress From the 
  State of Michigan
The Honorable Donna M. Christensen, a Delegate in Congress From 
  the U.S. Virgin Island.........................................    45
The Honorable Bob Etheridge, a Representative in Congress From 
  the State of North Carolina....................................    43
The Honorable James R. Langevin, a Representative in Congress 
  From the State of Rhode Island.................................    37
The Honorable Sheila Jackson-Lee, a Representative in Congress 
  From the State of Texas
  Oral Statement.................................................    48
  Prepared Statement.............................................     5
The Honorable Zoe Lofgren, a Representative in Congress From the 
  State of California............................................     1
The Honorable Ken Lucas, a Representative in Congress From the 
  State of Kentucky..............................................    47
The Honorable Pete Sessions, a Representative in Congress From 
  the State of Texas.............................................    34

                               WITNESSES

Steven Bellovin, Ph.D., Technical Leader and Fellow, AT&T 
  Laboratory
  Oral Statement.................................................    17
  Prepared Statement.............................................    19
Shankar Sasry, Ph.D., Chairman, Department of Electric 
  Engineering and Computer Systems, University of California, 
  Berkeley
  Oral Statement.................................................     6
  Prepared Statement.............................................     8
Mr. Daniel G. Wolf, Information Assurance Director, National 
  Security
  Agency
  Oral Statement.................................................    21
  Prepared Statement.............................................    24

 
                    CYBERSECURITY--GETTING IT RIGHT

                              ----------                              

                         Tuesday, July 22, 2003

                     U.S. House of Representatives,
            Subcommittee on Cybersecurity, Science,
                      and Research and Development,
                     Select Committee on Homeland Security,
                                                   Washington, D.C.
    The subcommittee met, pursuant to call, at 10:05 a.m., in 
Room 2118, Rayburn House Office Building, Hon. Mac Thornberry 
[chairman of the committee] presiding.
    Present: Representatives Thornberry, Sessions, Camp, Cox 
[ex officio], Lofgren, Jackson-Lee, Christensen, Etheridge, 
Lucas, and Langevin.
    Mr. Thornberry. The hearing will come to order. This 
oversight hearing of the Subcommittee on Cybersecurity, 
Science, and Research and Development will hear today on the 
topic of ``Cybersecurity--Getting It Right.'' This is the next 
in a series of hearings that this subcommittee has had on 
cybersecurity. We have had virtually unanimous recommendations 
from previous witnesses that, among other things, research and 
development is a key role for the Federal Government. And we 
are here today to hear from some outstanding witnesses to help 
guide us in that research and development for the future.
    Before proceeding further, let me turn to the distinguished 
Ranking Member of this subcommittee, the gentlelady from 
California, for any opening comments she would like to make.
    Ms. Lofgren. Thank you, Chairman Thornberry, for scheduling 
this hearing today and for your wonderful leadership of this 
subcommittee.
    When the subcommittee was formed back in February, Chairman 
Thornberry and I met to discuss our common agenda and 
priorities. And at that meeting we both agreed that the 
subcommittee should spend considerable time studying incredibly 
complex sets of issues surrounding cybersecurity, and we 
decided to embark on a mission to educate and inform the 
members of the subcommittee. We felt the need to establish a 
knowledge base before we attempted to tackle any possible 
policy directives or legislative initiatives.
    Soon after our initial meeting, we began this educational 
process. At our first meeting, we heard from Dr. Charles 
McCreary on the work being done within the Science and 
Technology Directorate at the Department of Homeland Security. 
Soon after that, we began a series of hearings on the 
cybersecurity issue. First, we looked into threats, 
vulnerabilities, and possible responses to cyber attacks. Last 
week, we heard from industry leaders on their experiences.
    In addition to these hearings, we have held several 
briefings on cyber issues, including a classified briefing on 
cyber threats. Chairman Thornberry and I have also had 
individual meetings with academics, business leaders, and 
public policy experts. All of these meetings and hearings have 
been quite informative, and helped the members of this 
committee to get a handle on the scope of the issues we face. I 
believe that this subcommittee is beginning to have a solid 
understanding of the cyber question, and I am sure we are going 
to build on this foundation today.
    Today, we will explore the research agenda that will help 
us to better secure cyberspace. Our panelists represent 
academia, the national security community, and industry, and 
all are well-versed on cyber issues. Scientific research and 
innovative technology may hold some of the most promising 
solutions to our IT vulnerabilities, and I believe that we can 
stay one step ahead of hackers and cyber terrorists if 
government works in a coordinated way with the private sector.
    I look forward to learning more about the advanced 
technology programs that currently exist and the ones that need 
to receive higher priority and funding. I want to hear about 
the current efforts to share information between the private 
sector, the government, and academia. Government, and this 
subcommittee in particular, should play a role in helping these 
diverse entities work together to reduce all our 
vulnerabilities and better secure cyberspace.
    I am looking forward to hearing from all of our witnesses 
today, but I especially want to welcome and thank Dr. Shankar 
Sastry, Chairman of the Electrical Engineering and Computer 
Sciences Department at UC-Berkley. I have had the pleasure of 
discussing these issues with Dr. Sastry before, and I 
appreciate you coming all the way to be with us here today.
    Finally, as I mentioned in my opening statement at last 
week's hearing, I have great concerns about the Bush 
administration's cybersecurity program. In the last 6 months, 
the most senior Bush administration cyber officials have left 
the government. These individuals include Richard Clark, the 
Special Advisor to the President for Cybersecurity; Howard 
Schmidt, the Vice Chair of the President's Critical 
Infrastructure Board and Clark's replacement; Ron Dick, the 
Chairman of the NIPC; and John Tritak, Director of CIAO. The 
last two organizations are part of the National Cybersecurity 
Division at DHS which was created on June 6th of this year. To 
date, no director has been named for this division. The NCSD is 
located within the DHS Information Analysis and Infrastructure 
protection directorate, reporting to the Assistant Secretary 
for Infrastructure Protection. Some cybersecurity-related R&D 
activities, however, will take place within the DHS Science and 
Technology Directorate.
    I believe that this situation where it is buried within the 
bureaucracy is questionable, and that once a person is finally 
chosen to lead the division, he or she may not receive the 
high-level access to Secretary Ridge and the White House that 
is warranted.
    The House is going to adjourn at the end of this week for 
the summer district work period, and when we return in the 
fall, I look forward to hearing directly from the Department of 
Homeland Security on their cybersecurity agenda.
    I thank Chairman Thornberry for scheduling this hearing, 
and I thank him for his leadership and for working so well and 
honestly with me. And I thank you, too, our witnesses, for 
their testimony, and finally to the committee staff for their 
outstanding work.
    Mr. Thornberry. Let me thank the gentlelady, and express 
agreement with the concerns that she has raised. We will be 
hearing from the Department of Homeland Security when we 
return, and this committee as well as the full committee, I 
know, will be certainly engaged with them.
    The Chair is going to yield his time for an opening 
statement to the distinguished chairman of the full committee, 
the gentleman from California, Mr. Cox.
    Mr. Cox. I thank the Chairman and the Ranking Member. And I 
will be brief, because we have an excellent panel of witnesses 
today and I, like you, am anxious to hear from them. I want to 
thank you both for organizing today's hearing and for your 
continued diligence in examining the cyber threat, and for this 
subcommittee's focus on the Department of Homeland Security's 
mission to counter this new and worrisome threat. I would also 
like formally to thank our witnesses for making the time to be 
with us today.
    Just as our focus on science, including notably the 
Manhattan Project, contributed to our victories in World War II 
and in the Cold War, a similar comprehensive commitment to 
scientific inquiry, to basic research, and to the development 
of innovative technologies is necessary if we are going to win 
the current war on terrorism. For that reason alone, the cyber 
challenge in particular requires a mobilization of the American 
scientific community.
    As recently reported by the National Research Council, the 
United States information system vulnerabilities from the 
standpoint of both operations and technology are growing faster 
than the country's ability, if not willingness, to respond. 
This is a critical fault that we have got to address, because 
technology is at the center of our economy, our civilian and 
defense critical infrastructure, our communications systems, 
and indeed every aspect of our way of life.
    Superior technology will, therefore, be at the heart of our 
efforts to prevent and to deal with cyber attacks. We must 
leverage our superior research community resources to address 
risks and harden our critical physical and electronic 
infrastructure.
    Under Chairman Thornberry's leadership, this subcommittee 
has held three hearings and a productive half-day workshop on 
this issue. During these hearings, representatives from 
industry, government, and academia have confirmed our 
understanding the gravity of the cybersecurity threat and of 
the importance of the Department of Homeland Security's role in 
addressing it.
    The workshop held yesterday morning, which was co-sponsored 
by the Congressional Research Service staff, not only 
accentuated the threat, but stressed the importance of the 
public-private partnership in developing solutions. Today's 
hearing will increase our appreciation for the research being 
done to address the cyber threat. Each of our witnesses today 
represents a different facet of the cyber research community.
    The Department of Homeland Security, to be effective in its 
analytic and policy mission, must have a clear understanding of 
the best research being done and where it is going. In 
exercising oversight, this committee will want to measure the 
Department's progress over time in coordinating governmentwide 
cyber programs, in advancing research and development efforts 
to reduce cyber vulnerabilities, in improving our capabilities 
to respond to attacks, and in accelerating our efforts to 
promote computer security awareness training across the 
country.
    I look forward to hearing from our witnesses about research 
priorities, both in the Federal Government and in the private 
sector and in academia, and about ways that the Department of 
Homeland Security can support and capitalize on your efforts.
    Mr. Chairman, thank you again for your personal commitment, 
and also our Ranking Member for your personal commitment and 
for your exemplary performance and the performance of this 
subcommittee on this issue. I yield back.
    [The information follows:]

PREPARED OPENING STATEMENT OF THE HONORABLE CHRISTOPHER COX, CHAIRMAN, 
                 SELECT COMMITTEE ON HOMELAND SECURITY

    I would like to thank Chairman Thornberry and Ranking Member 
Lofgren for organizing today's hearing, for their continued diligence 
in examining the cyber threat, and for their focus on the Department of 
Homeland Security's mission to counter this new and worrisome threat. I 
would also like to thank the witnesses for making the time to share 
their valuable insights with us today.
    As many of you know, the Manhattan Project, launched in 1942, 
marked the establishment of a sustained and successful U.S. nuclear 
science program that grew stronger and stronger in subsequent years. 
This focus on science contributed to our victory in World War II and in 
the Cold War. The current War on Terrorism requires a similar 
comprehensive commitment to scientific inquiry, to basic research, and 
to the development of innovative technologies.
    Today, the cyber challenge in particular requires a similar 
mobilization of the American scientific community. Technology is at the 
center of our economy, our critical infrastructure, our communication 
systems, and our way of life. Superior technology will be at the heart 
of our efforts to prevent a cyber attack. We must leverage our superior 
research community resources to address risks, and harden our critical 
physical and electronic infrastructure.
    Under Chairman Thornberry's leadership, this Subcommittee has held 
three subcommittee hearings and a productive half-day workshop on this 
issue. During these hearings, representatives of the industry, 
government and academia have confirmed our understanding of the gravity 
of the cybersecurity threat and of the importance of the Department of 
Homeland Security's role in assessing it. The workshop held yesterday 
morning, which was cosponsored by the Congressional Research staff, not 
only accentuated the threat, but stressed the importance of the public-
private partnership in developing the solution.
    Today's hearing will increase our appreciation for the research 
being done to address the cyber threat. Each of our witnesses today 
represents a different facet of the cyber research community. The 
Department of Homeland Security, to be effective in its analytic and 
policy mission, must have a clear understanding of the best research 
being done and where it is going. In exercising oversight, the Select 
Committee will want to measure the Department's progress over time in 
coordinating government-wide cyber programs, in advancing research and 
development efforts to reduce cyber vulnerabilities, in improving our 
capabilities to respond to attacks, and in accelerating our efforts to 
promote computer security awareness training across the country.
    I look forward to hearing from our witnesses about research 
priorities, and about ways that the Department of Homeland Security can 
support your efforts. Mr. Chairman, thank you again for your personal 
commitment and for the exemplary performance of your subcommittee on 
this issue.

     THE PREPARED STATEMENT OF THE HONORABLE SHEILA JACKSON-LEE, A 
           REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS

    Mr. Chairman and Mr. Ranking Member, I thank you for convening this 
hearing today so that we can take another step toward securing our 
homeland. Today's hearing, ``Cybersecurity: Getting It Right,'' gives 
the Members of this Subcommittee another opportunity to explore the 
difficult and ever-changing technology sector, and to hear more 
invaluable testimony on protecting our information infrastructure.
    A common question in our cybersecurity efforts is the issue of 
information sharing. The technology industry is highly competitive and 
also highly lucrative. Technology companies that develop innovative 
ideas can earn millions, if not billions, of dollars. Therefore, there 
is a substantial interest on the part of the corporation to keep the 
innovation for themselves and reap all of the financial benefits. In 
the general market for software and hardware development, research and 
development secrecy is an expected part of our capitalist economy. In 
the national cybersecurity arena, however, failure to share information 
may result in our information infrastructure being more vulnerable to 
cyber attacks. It is imperative to national security that the 
technology sector shares the information that will protect our 
information infrastructure. It is equally imperative that the Members 
of Congress pass legislation that promotes information sharing while 
protecting the intellectual property of our technology companies.
    In order for innovations to be shared the innovations must be 
developed. The research and development aspect of national 
cybersecurity must be fostered to protect our homeland. As the 
capabilities of the Internet and the remainder of our information 
infrastructure expands, so too do the capabilities of cyber-terrorists. 
The complexity of recent computer viruses and the speed with which they 
spread across our information infrastructure illustrates the formidable 
task our country faces combating cyber-terrorists. Developing the 
technologies to counter cyber attacks will be an on-going endeavor. 
Each advancement in computer technology will bring advancements in the 
capabilities of cyber-terrorists. New technological defense methods 
will be required through research and development in order to 
adequately protect our information infrastructure.
    Research and development will also be needed to detect and 
apprehend those responsible for cyber-terrorist attacks. The nature of 
the information infrastructure allows criminal actors to operate 
anonymously. Often the perpetrators of cyber-crimes are not located and 
are left free to attack our information infrastructure again in the 
future. If America's cyberspace is to be protected we must be able to 
locate the perpetrators of cyber-attacks and also develop intelligence 
methods to detect attacks before they occur. Our national research and 
development efforts will also be critical to stopping cyber-crimes 
before they occur.
    Mr. Chairman and Mr. Speaker, the task before this Subcommittee is 
great. Achieving full cybersecurity for our Nation's critical 
information infrastructure is important for the full operation of our 
education system, federal, state, and local governments, our financial 
system, our travel system and every other segment of our society. The 
Internet has become an integral portion of the daily operation of all 
of these segments. One successful cyber-attack could have devastating 
consequences. I look forward to hearing the testimony of our witnesses 
today, and I thank them for their attendance. I hope that their wisdom 
will bring us closer to securing our information infrastructure.

    Mr. Thornberry. The Chair thanks the gentleman, and would 
also join in thanking the Congressional Research Service, Eric 
Ficsher and his staff, and the folks who participated in 
yesterday's workshop. It really was an outstanding group.
    Now, again let me thank each of our witnesses for taking 
time to be with us today. We will first hear from Dr. Shankar 
Sastry, Chairman of the Department of Electrical Engineering 
and Computer Science from the University of California at 
Berkley. Thank you for being with us today, sir. And you are 
recognized for 5 minutes.

 STATEMENT OF S. SHANKAR SASRY, PH.D., CHAIRMAN, DEPARTMENT OF 
   ELECTRIC ENGINEERING AND COMPUTER SYSTEMS, UNIVERSITY OF 
                      CALIFORNIA, BERKELEY

    Mr. Sastry. Thank you very much, honorable Chairman 
Thornberry, honorable Ranking Member Lofgren, and distinguished 
members of the Subcommittee on Cybersecurity, Science, and 
Research. Thank you very much for the opportunity to testify 
today.
    I would like to testify about areas for investment in 
cybersecurity, science, research and development, some priority 
areas for funding, and the role of university, industry, the 
venture community, and government partnerships in bringing 
secure and trusted systems to the marketplace.
    By way of background, I should say that I served as 
Director of the Information Technology Office at DARPA from 
September 1999 to February 2001. My areas of research are in 
embedded and autonomous software, complex infrastructure 
systems, and secure network embedded systems.
    Let me start with my perceptions of the current funding of 
cybersecurity research. The most sustained funding for 
cybersecurity research to date has been through the Department 
of Defense. In DOD, the largest pool for funding for research 
has been through DARPA, though there have been some important 
research initiatives also through the National Security Agency.
    The programs have been in three generations. The first 
generation is to prevent intrusions, and there have been a 
number of successes that have come out of this, including 
several sets of cryptographic tools, access control, and 
multiple levels of security.
    In the second generation, if intrusions happen, how does 
one detect them and how does one limit damage? Examples of 
successful products that came out of this: firewalls, boundary 
controllers, intrusion detection systems, virtual private 
networks, and a public key infrastructure.
    In the third generation, which we are now in the midst of, 
the goal is to operate through attacks. And these goals are 
intrusion tolerance and graceful degradation. In my opinion, 
this is the space that we need to be in to be able to have 
critical infrastructure systems that can weather attacks.
    From its high watermark of close to $100 million of 
research funding per year for information assurance and 
survivability research, IA&S, in 2000 the funding for 
unclassified IA&S research has decreased significantly in the 
following years. While it is understandable that there are 
important other priorities in DOD for more focused efforts on 
command and control networks and other sensitive DOD networks, 
I feel that, given the scope and magnitude of research that 
remains to be done, it is critical that the burden of 
supporting cybersecurity research be picked up by other 
agencies.
    Of course, I also feel that, given the newest generations 
of manned and unmanned and autonomous systems in the DOD such 
as the UCAV and in Future Combat Systems and so on, it would 
also be in the interest of DOD not to scale back its 
unclassified programs a great deal.
    The National Science Foundation. I feel the NSF has been 
proactive in taking steps to boost funding for cybersecurity 
research by setting up new programs in trusted computing, and 
in secure network embedded systems, which is under planning, 
networking research, and more recently test beds for 
cybersecurity.
    Department of Homeland Security. It is our understanding 
that the Science and Technology Directorate is planning an 
initiative in cybersecurity and is organizing program 
management structures for cybersecurity research centers. The 
Congress and the administration should be lauded for having 
taken the visionary step of having formed the Homeland Security 
Advanced Research Projects Agency, HSARPA, along the DARPA 
model. In addition, I feel that the idea of having HSARPA work 
with procurement and operational branches of the DHS to 
evangelize the adoption of new cyber secure software and 
systems is a very attractive one. If such a model was 
successful, it would be useful in reforming possible changes in 
procurement and operational concept transformation in DOD as 
well. The community has felt a great deal of enthusiasm about 
this potential outcome. The outcome we feel would be best 
achieved if the research centralized in the S&T Directorate at 
HSARPA interacted directly with the procurement and operational 
needs of the IAIP, Border and Transportation Security, and the 
Emergency Preparedness Directorates.
    However, a necessary condition for an outcome is an 
adequate outlay of funds for research and development coupled 
with acquisitions. In my opinion, the level of investment needs 
to be somewhere in the range of 100 to $200 million per year, 
and we base this number on a road map for research and 
cybersecurity which we have developed and is present in the 
full testimony. In the interest of time, I will just talk a 
little bit about a few highlights of the funding gaps in 
research priorities for cybersecurity.
    The technology needs may be classed into the following 
categories: unsolved difficult research problems and 
information assurance and survivability--and a number of these 
are taken from the so-called Infotech Research Council hard 
problems list, and they are listed in my testimony.
    The second one is about technologies for strong security 
with strong privacy. The technology needs for strong privacy 
are completely compatible with the technology needs for strong 
security. So some examples are selective revelation, where the 
goal is to minimize revelation of personal data while 
facilitating analysis through the approach of partial 
incremental revelation of data. Others include strong audit. 
And also, rule processing technologies for checking compliance 
with privacy rules.
    In addition, I feel that the emerging infrastructure of the 
future will be based on wired and wireless network devices 
ubiquitously embedded in the environment to provide so-called 
sensor webs of information for monitoring and controlling 
infrastructure. We need to take steps today to start securing 
them.
    And, finally, the last set of problems comes in under the 
title of validated modeling, simulation and visualization of 
critical infrastructures and their interdependencies.
    Mr. Chairman, am I out of time? Or--.
    Mr. Thornberry. The gentleman's 5 minutes has expired. The 
Chair is somewhat lenient with time, however. The gentleman may 
proceed and conclude his remarks.
    Mr. Sastry. Thank you very much, Mr. Chairman. Perhaps in 
the interest of time, let me sort of say--to go to the last 
part of my testimony and talk a little bit about a model for 
public-private partnerships for rapid technology transfer in 
cybersecurity.
    I think there is clearly a need for cybersecurity research 
and development, but even more immediate and pressing is the 
need for transitioning this. The most common complaints that 
one hears from vendors and service providers are as follows: No 
one pays for security. Will the Federal Government play the 
role of market maker in the early adoption of security 
products? Is there sufficient demand to stimulate new companies 
around new ideas in cybersecurity? Who will provide road maps 
to help the investment by established companies and the venture 
community in cybersecurity products?
    So a fundamental organizational problem that exists today 
is the lack of mechanisms for filling in the gap between the 
end of successful Federal projects. And I feel that a lot of 
the Federal investment to date has indeed been a success, but 
there is a problem in transitioning from the end of a 
successful Federal project to the venture community and 
industry in the form of products.
    Research prototypes need to be hardened, tested on large-
scale test beds, informed and customized by the customer base 
before we get these into the marketplace. And I feel that the 
role of public-private partnerships and perhaps the nonprofit 
sector is in filling this gap between the end of a successful 
research program and industry and venture update.
    And let me just conclude by saying that there are exemplars 
of successful such partnerships which have been formed by the 
legislation of this Congress, and so those are in the 
semiconductor industry. In the semiconductor industry, both the 
SIA, the Semiconductor Industry Association, and the SRC, the 
Semiconductor Research Consortium, have facilitated both the 
funding of rapidly transitioned research to the semiconductor 
industry and led the continual development of road maps for the 
electronics industry. DOD funding, both from OSD and DARPA from 
the earliest days of this research, has been instrumental in 
maintaining a strategic national component both for 
competitiveness as well as for maintaining U.S. superiority in 
a vital sector.
    My own sense is that nonprofits are the same ilk as the SIA 
and SRC. With the same kind of partnership, DHS and DOD could 
play an important role in developing a mechanism for rapid 
transition of focused research and road mapping for industry in 
the investment community.
    Thank you very much, Mr. Chairman, for your indulgence. 
Thank you very much for the opportunity to testify. We are 
really delighted as a community to see your attention to all of 
these important issues. Thank you very much.
    [The statement of Dr. Sastry follows:]

                PREPARED STATEMENT OF DR. SHANKAR SASTRY

    Honorable Chairman Thornberry, Honorable Ranking Member Lofgren, 
and members of the subcommittee on Cybersecurity, Science, and 
Research, thank you for the opportunity to testify today, regarding 
areas for investment in cybersecurity research and development, 
priority areas for funding, and the role of university-industry-
venture-government partnerships in bringing secure and trusted systems 
to the market place. By way of background, I should say that I am 
currently the Chairman of Electrical Engineering and Computer Sciences 
at the University of California, Berkeley where I have been a professor 
for over 20 years. I have also served on the faculties of the 
Massachusetts Institute of Technology (1980-1982), where I began my 
academic career as an Assistant Professor, and Harvard University where 
I was a Gordon Mc Kay chaired professor in 1993-1994. From November 
1999 to March 2001, I served as the Director of the Information 
Technology Office (ITO) of the Defense Advanced Research Projects 
Agency (DARPA) in the DoD. The responsibilities of this office included 
planning and managing the investment in all areas of information 
technology, including the information assurance and survivability 
portfolio of programs. My areas of research are embedded and autonomous 
systems and software, complex infrastructure systems, secure networked 
embedded systems, and high confidence systems and software. I have 
recently led the organization of a collaborative multi-university 
cybersecurity research consortium named, and a testbed for network 
defense called the national cyber Defense Technology Experimental 
Research network (DETER).

To answer the questions asked by you, I will divide my testimony into 
the following areas:
        1. Current Funding of Cybersecurity Research,
        2. Research Gaps and Funding Priorities for Cybersecurity 
        Research,
        3. A collaborative university research program in Ubiquitous 
        Secure Technologies led by Berkeley partnered with Stanford, 
        Cornell, Vanderbilt, Carnegie Mellon, and San Jose State 
        Universities, and Smith College,
        4. Testbeds for Cybersecurity,.
        5. A model for public-private partnerships for rapid technology 
        transfer in Cybersecurity

              1 Current Funding of Cybersecurity Research

There has been Federal funding of Cybersecurity research thus far 
primarily by the Department of Defense and the National Science 
Foundation, though there has also been some research funded by NIST, 
Department of Energy and NASA as well. The community has followed with 
interest the testimony given by the DARPA Director, the NSF Director 
and Undersecretary for Science and Technology at DHS to the House 
Science Committee. The community feels grateful to the House Science 
Committee, its staff and its Chairman, the Honorable Mr. Bohlert, as 
well as this Subcommittee on Cybersecurity, Science and Research and 
Development, its Chairman, the honorable Mr. Thornberry and ranking 
member the Honorable Ms. Lofgren for their close attention to the needs 
of cybersecurity research. I will limit my own remarks to the 
perceptions of the community and also my own experience with helping to 
manage the cybersecurity portfolio at DARPA.
Department of Defense. The most sustained funding for cybersecurity 
research to date has been through DoD. In DoD, the largest pool of 
funding for research has been through DARPA, though there have been 
important research initiatives that have been managed by the National 
Security Agency. Some very important University Research Initiatives in 
Critical Infrastructure Protection (CIP-URI) were funded through DDR&E 
as five-year programs primarily in 2001. Modest 6.1 core programs in 
cybersecurity research at AFOSR, ARO and ONR also exist. The 
Information Assurance and Survivability (IA&S) programs at DARPA are 
the largest and most successful Federal investment to date. This suite 
of programs has gone through three generations listed below with some 
exemplars of successful outcomes:
        1. 1st Generation (Prevent Intrusions): Trusted Computing Base, 
        Access Control, Cryptographic Tools, Multiple Levels of 
        Security
        2. 2nd Generation (Detect Intrusions, Limit Damage): Firewalls, 
        Boundary Controllers, Intrusion Detection Systems, Virtual 
        Private Networks, Public Key Infrastructure
        3. 3rd Generation (Operate Through Attacks) Goals are Intrusion 
        Tolerance, Graceful Degradation, Big Board View of Attacks, 
        Security Tradeoffs and Metrics, and hardening of the core 
        infrastructure.

The first generation was aimed at preventing intrusions as much as 
possible, the second generation with detecting intrusions when they 
occur and limiting the amount of damage that they cause. The third 
generation of programs, which is most critical to critical 
infrastructure protection, consists of developing the ability to 
operate through attacks without failing catastrophically. A very large 
number of existing security solutions were developed by companies 
either as spin-offs of DARPA research or as an integral part of DARPA 
research programs in Generations 1 and 2. We are currently in the 3rd 
generation of programs and a research and development base has been 
energized to address what remain as difficult technical problems in 
IA&S. From its high watermark of close to $ 100M of funding for IA&S in 
2000, the funding for unclassified IA&S research at DARPA has decreased 
significantly in following years. The DARPA investment has also had the 
extremely desirable effect of involving the Service Laboratories (such 
as AFRL and Navy SPAWAR), and the services operational commands in 
bringing their requirements to the community. While it is 
understandable that there are other important priorities in the DoD for 
more focused efforts in IA&S for command and control and other 
sensitive DoD networks, given the scope and magnitude of research that 
remains to be done in cybersecurity, it is critical that the burden of 
supporting cybersecurity research be picked up by other agencies. In 
addition, given the important strategic nature of IA&S research for new 
and emerging DoD systems, including the newest generations of unmanned 
and autonomous systems (such as the UCAV and in Future Combat Systems), 
it would not be in the interests of DoD to scale back its unclassified 
programs a great deal.

National Science Foundation NSF has been proactive in taking steps to 
boost funding for cybersecurity research by setting up new programs in 
Trusted Computing and in Secure Network Embedded Systems (under 
planning), networking research, and testbeds for cybersecurity. These 
investments, primarily in the Directorate of Computer and Information 
Science and Engineering (CISE) have been timely and strategic. 
Nonetheless it is the perception of the community that the level of 
funding for cybersecurity and Critical Infrastructure Protection could 
be greater. A point about the synergy between funding between DARPA and 
NSF is in order here. From the early days of networking when NSF picked 
up the ARPA net and helped fund it while it grew into the modern 
Internet, and early DARPA funding on high performance computing was 
sustained by NSF funding, there has been a rich legacy of cooperation 
in funding information technology research between the two agencies on 
Fairfax Avenue in Arlington, Virginia. It would be extremely desirable 
to have this synergistic relation continue in the area of 
cybersecurity.

Department of Homeland Security. It is our understanding that the 
Science and Technology Directorate of DHS is planning its initiative in 
cybersecurity and is organizing program management structures for 
cybersecurity research centers. The Congress and the administration 
should be lauded for having taken the visionary step of having formed 
the Homeland Security Research Projects Agency along the DARPA model. 
In addition, the idea of having HSARPA work along with procurement and 
operational branches of the DHS to evangelize the adoption of new 
cybersecure software and systems is a very attractive one. Such a 
model, if successful, would be very useful in informing possible 
changes in procurement and operational concept transformation at the 
DoD as well. The community has felt a great deal of enthusiasm about 
this potential outcome. The outcome would be best achieved if research 
centralized in the Science and Technology Directorate, at HSARPA, 
interacted directly with the procurement and the operational needs of 
each of the Information Analysis and Infrastructure Protection (IAIP), 
Border and Transportation Security, and the Emergency Preparedness 
Directorates. There are some synergies to be gained for example by 
engaging with the research needs of the National Communication Systems, 
with road-mapping activities for cybersecurity, or by using secure 
sensor webs for border patrol and monitoring programs

However, a necessary condition for such an outcome is an adequate 
outlay of funds for basic research and development coupled with 
acquisitions. In my opinion the level of investment needs to be 
somewhere in the range of $100-200 M per year. I base this number on a 
roadmap for research in cybersecurity, which we have developed (details 
are included in the next section of this testimony). I feel that the 
DARPA model is an especially appropriate model for funding research and 
development in cybersecurity. Once again HSARPA may wish to involve 
groups in the other directorates the way DARPA involves service 
laboratories and commands as ``agents'' for contracting the work and 
thereby helping the transition of research into products. Thus, one 
could view customers in the IAIP Directorate helping program managers 
in HSARPA shape the programs for their needs. While HSARPA will need to 
have programs that have short term and intermediate term payoff, one 
can visualize the role of the NSF in helping HSARPA as an executive 
agent in its early years while it is being fully configured. In the 
steady state a relationship between HSARPA and NSF along the lines of 
the DARPA-NSF model would be highly desirable, with NSF providing 
longer term sustained funding.

Other Agency Funding for Cybersecurity. Since the needs of different 
mission agencies in cybersecurity are somewhat different it would be 
important to have funding from NASA, DoE, and other mission agencies 
for their own needs. Additionally the role of the National Institute of 
Standards and Technology (NIST) could be an important one in managing 
testbeds, whetting and developing cybersecurity standards and best 
practices. NIST has also been an important executive agent for managing 
DoD programs and could continue to do so for DHS.

        2 Funding Gaps and Research Priorities for Cybersecurity

        The technology recommendations for suggested areas of funding 
        given here were developed by a group of researchers, industry 
        participants and the venture community over the last two years 
        in a series of workshops, meeting and studies:
        1. 25th June 2002, Meeting with a large sample of participants 
        from Venture firms, DoD; OSD, DARPA, ONR, NSA, the President's 
        Critical Infrastructure Protection Board, large industry 
        participants such as IBM, HP, Oracle, Symantec, Microsoft, 
        Intel, non profits such as SRI, I3P, hosted by me in Palo Alto
        2. 18th September 2002, Meeting with industry leaders and Mr. 
        Richard Clarke Head of the President's Cyber Security 
        Protection Board on the details of the Presidential 
        Cybersecurity Plan held at Palo Alto.
        3. 19-20 September 2002. Sztipanovits (Vanderbilt), Stankovic 
        (Virginia), and I ran the NSF/OSTP workshop on New Technologies 
        for Critical Infrastructure Protection and Cybersecurity in 
        Leesburg, Virginia with technology recommendations for the 
        White House Office of Science Technology and Policy. OSTP 
        report of this workshop will be released shortly.
        4. October 7-8 Workshop on Testbeds for Security, Squires 
        (Chief Scientist of HP) led a meeting on networking research 
        testbeds.
        5. August 2001, NSF Workshop on New Directions in Security, 
        Doug Tygar, Berkeley
        6. August 2002, DARPA Information Sciences and Technology study 
        on Security with Privacy, Doug Tygar.
While the whole list of participants is too long to list, I would 
especially like to acknowledge the help of former colleagues at DARPA, 
Terry Benzel, Doug Tygar, and Ruzena Bajcsy of the University of 
California Berkeley, Janos Sztipanovits of Vanderbilt University, Jack 
Stankovic of the University of Virginia, Teresa Lunt of PARC (formerly 
Xerox PARC), Pat Lincoln and Victoria Stavridou of SRI, Patrick Scaglia 
and Steven Squires of HP, Robert Morris of IBM, David Tennenhouse of 
Intel, Jerry Fiedler of Windriver Systems for their help in developing 
these recommendations.

Computer trustworthiness continues to increase in importance as a 
pressing scientific, economic, and social problem. The last decade has 
seen a rapid increase in computer security attacks at all levels, as 
more individuals connect to common networks and as motivations and 
means to conduct sophisticated attacks increase. In today's environment 
there is heightened awareness of the threat of well-funded professional 
cyber hackers and the potential for nation-state sponsored cyber 
warfare. Cyber attacks are increasingly motivated by the financial gain 
and global politics. A parallel and accelerating trend of the last 
decade has been the rapidly growing integration role of computing and 
communication in critical infrastructure systems, such as financial, 
energy distribution, telecommunication and transportation, which now 
have complex interdependencies rooted in information technologies. 
These overlapping and interacting trends force us to recognize that 
trustworthiness of our computer systems is not an IT issue anymore; it 
has a direct and immediate impact on our critical infrastructure. 
Security is often a collective enterprise, with complicated 
interdependencies and composition issues among a variety of 
participants. This poses a challenge for traditional competitive 
economic models. Clearly there is an acute need for developing much 
deeper understanding of and scientific foundation for analyzing the 
interaction between cyber security, critical infrastructure systems and 
economic policy.

The fundamentals of reliable infrastructure have not been adequately 
worked out for complex networks of highly interacting subsystems, such 
as the power grid and the airspace-aircraft environment. These are 
complex, often dynamically reconfigured, networks. The primary 
challenge for future generations of these systems is to provide 
increasingly higher efficiency, while assuring joint physical and 
logical containment of adverse effects. Increasingly, autonomous but 
cooperative action is demanded of constituent elements. Examples 
include the technology needed to support aircraft in high-capacity 
airspace, enabling the execution of parallel landing patterns under 
terminal area control. A deregulated power grid draws new market 
participants. These new players may produce highly variable efficiency, 
potentially adverse environmental effects, and they may pose hazards to 
system-wide stability. This trend towards autonomous, cooperative 
action will continue, with the demands of current and next-generation 
systems for open, interoperating, and cooperating systems. The 
achievement of a satisfactory level of interoperable functionality is 
both enabled by, and dependent upon, advances in information and 
control infrastructure for coordinated operation. Furthermore, entirely 
new capabilities, such as networks of devices for pervasive sensing and 
actuation are becoming viable, and the control and communication 
technologies for their effective use must be fully developed and 
integrated into distributed infrastructure systems.

Although reference frequently is made to the next generation of 
technologies as ``intelligent agent'' systems or self-healing or self-
reconfiguring or autonomic systems, this terminology conceals a complex 
of carefully integrated systems and software concerns. There is no 
panacea; services must be carefully engineered from the ground up in 
order to safely support a facade of highly autonomous action. Advances 
in software and information technology have improved the potential for 
a better substrate for future, more reliable infrastructures. The 
technology needs may be classed into the following categories:

1. Unsolved Difficult Research Problems in Information Assurance and 
Survivability. The areas of research highlighted here are:
        a. Intrusion and Misuse Detection: methods need to be 
        automatic, predictive, have a low false alarm rate, and 
        possibly identify the adversary.
        b. Intrusion and Misuse Response: methods should provide a 
        shared situational awareness, automatic attack assessment, a 
        dynamic reconfiguration of the system and possibly an automated 
        counter attack.
        c. Security of foreign and malicious code: desired attributes 
        for systems that protect against malicious mobile code include 
        confinement of access and capability and encapsulation of the 
        code.
        d. Controlled sharing of information: the ability to 
        dynamically authorize the sharing of information and automated 
        data tagging.
        e. Distributed Denial of Service (DDoS) and Worm Defense: 
        solutions are needed for modeling, measurement and analysis of 
        attacks, detection of the attacks, attribution, dissipation of 
        the attack, and possible retribution.
        f. Secure Wireless Communications
        g. New and Emerging Challenges
                i. Peer to peer computing
                ii. Security in ubiquitous and nomadic computers
                iii. Human factors and ergonomics in security
                iv. Networks surveillance and hygiene
                v. Insider threat detection, monitoring and response

2. Technologies for Strong Security with Strong Privacy
        a. Selective Revelation: the goal here is to minimize 
        revelation of personal data while facilitating analysis through 
        the approach of partial, incremental revelation of data.
        b. Strong Audit: the goal here is to protect abuse by watching 
        the watchers: everyone is subject to audit, there is cross-
        organizational audit, and usage records are tamper proof. 
        Possible new technologies include encrypted searches and 
        crypto-protocols.
        c. Rule processing technologies: there is need for a formal 
        language for expressing privacy rules and tools for automated 
        checking of compliance, a privacy toolbar for helping users. A 
        related technology is the one needed for digital rights 
        management

3. Secure Network Embedded Systems. The emerging infrastructure of the 
future will be based on wired and wireless networked devices 
ubiquitously embedded in the environment to provide ``sensor-webs'' of 
information for monitoring and controlling infrastructure networks. The 
embedded software, which will be present in these complex systems, 
needs to have the following attributes:
        a. Automated Design, Verification and Correctness by 
        Construction. A large number of infrastructures suffer from 
        being difficult to configure correctly and the resulting 
        glitches are frequently as serious as cyber attacks. In 
        addition they need to be fault tolerant: such systems are 
        referred to as High Confidence Systems.
        b. Layered Security for Embedded Systems: the defenses need to 
        be in depth to protect from attacks from the physical layer up 
        through the applications layer:
                i. Physical Layer: protection from attacks like jamming 
                and tampering
                ii. Link Layer: protection from unfairness and over 
                frequent collisions of packets
                iii. Networks and Routing Layer: protects from attacks 
                due to greed, homing, misdirection and black holes.
                iv. Transport Layer protection from attacks such as 
                flooding and desynchronization.

4. Validated Modeling, Simulation and Visualization of Critical 
Infrastructures and their Interdependencies
        a. Tools for the assessment of the level of risk
        b. New modeling and simulation tools for complex systems
        c. Development of simulation testbeds for teaming exercises, 
        response preparation and assessment.

  3 A Collaborative University Research Program in Ubiquitous Secure 
                               Technology

Here I describe a sample collaborative university research program that 
is focused at research problems in many of the areas described above. 
It is important to note that activities of this scale need to be 
engaged in by the scientific community in groups rather than as 
individual institutions. At Berkeley we have found it important to 
build such partnerships and consortia for research and development. We 
have put together a team of some of the strongest research universities 
led by Berkeley and including Stanford University, Vanderbilt 
University, Cornell University, Carnegie Mellon University, along with 
San Jose State University, Smith College, Fiske University to develop a 
Team for Research in Ubiquitous Secure Technology (TRUST) to radically 
transform the ability of organizations (software vendors, operators, 
local and federal agencies) to design, build, and operate trustworthy 
information systems for our critical infrastructure. TRUST will bring 
together a research team with proven track record in relevant areas of 
computer security, systems modeling and analysis, software technology, 
economics, and social sciences. The research team will be advised and 
supported by vendors of information technology and critical 
infrastructure (utility, telecommunication, finance, and 
transportation) protection providers and stakeholders.

                     3.1 Technical Research Program

Our multidisciplinary approach allows solutions to emerge from an 
integrated of view of computer security; software technology, analysis 
of complex interacting systems, and economic policy in the following 
areas:

Composition and computer security--Computer security attacks today 
occur on a minute-by-minute basis. Organizations producing individual 
components, such as routers or central office switches, have 
increasingly devoted energy to protecting those components against 
attack. However, protection of individual components does not always 
result in protection of the entire systems: different machines and 
different systems running on a single network often have complex 
interdependencies--and a malicious attacker can exploit those 
interdependencies for example in denial of service attacks, inter-
machine authentication failures, and routing disruptions. Attackers can 
attack systems where different software programs must interact on a 
single operating system (examples include e-mail with attachments 
leading to e-mail worms, buffer-overflow problems caused by unexpected 
use of software function libraries, and windowing systems displaying 
bogus, malicious systems messages.) Modularization can increase the 
problem: when common IT components are integrated with specialized 
applications and embedded systems, deep knowledge of the underlying 
computational model is needed to avoid vulnerability. TRUST will bring 
together an integrated scientific approach to composition and computer 
security.

Privacy--As a large amount of commercial and communication activity has 
moved to the Internet and World Wide Web, privacy concerns have 
increased both for individual users and organizations. Users perceive 
they have little control over information, and often those perceptions 
are correct--organizations are unable to accurately describe policy 
procedures and privacy-information crimes such as identity theft have 
increased sharply. Even disclosure of apparently innocuous information, 
such as an e-mail address, leads to unsavory activities, such as spam, 
which in turn can grow to a magnitude that can cause systemic problems. 
Organizations also have a need for privacy--not only to protect their 
customers, but also in cross-organizational exchanges including 
auctions and communications. Privacy is a challenging problem because 
when information is shared (laterally, between organization, or 
vertically, between different subsystems) each of the individual 
components involved in the sharing, the mechanism for sharing, and the 
consequences of the sharing, all present opportunities for invading 
privacy. Issues related to privacy emerge as a result of interaction 
between technology and economic policy, such as in online bidding on 
energy markets or dynamic allocation of the frequency spectrum. To 
tackle privacy, TRUST will develop solutions to the complex tradeoff 
between technology, economic policy and security. This will require a 
new look at the fundamental underpinnings of information management, 
storage, and retrieval.

Critical infrastructure protection--Critical infrastructure systems are 
large networks that move energy, information and material. Information 
technology is used to monitor, control and manage these systems by 
means of vast networks of computing equipment. Faults caused by natural 
disasters or malicious attacks can cause these networks to completely 
fail, leading to widespread damage. Critical infrastructure protection 
requires making systems that are highly robust and available in the 
presence of hostile attacks. TRUST will approach computer security from 
a holistic systems view, considering a union of concerns including 
physical design, performance, power consumption, reliability and 
others. For example, we don't just consider secure and highly available 
communication between sensor devices and SCADA (Supervisory Control And 
Data Acquisition) centers, TRUST will consider the potential impact of 
feasible security attacks on the power distribution network, and the 
impact of signal encryption on feedback control loops. Anecdotal 
evidence and the findings of more systematic red team activities such 
as the Joint Chiefs' Eligible Receiver program, strongly suggest that 
the United States is highly vulnerable to attacks on its critical 
infrastructure--including key utilities (gas, water, and energy), 
communications services, finance, transportation, medical coordination, 
government services, and emergency services. Even in a single 
organization, such as a national telecom service provider, critical 
infrastructure protection is difficult, because these systems are 
highly complex and involve so many components that even their designers 
cannot understand all the interactions. The interaction of different 
critical infrastructure systems, and their interaction with public 
(critical or non-critical) systems, creates complex dependencies and 
control paths. Today, we have no good way of detecting these 
interdependencies, although hackers have proven themselves highly 
capable of finding attack opportunities and exploiting subtle 
vulnerabilities.

TRUST will take a systems view which raises a broad set of trust 
questions: they range from protecting individual privacy to protecting 
large complex interacting critical infrastructure, from embedded 
systems to networks, and they have a strong focus on security problems 
arising from composition. Not only is a large effort necessary to take 
the broad view--and to anchor this view in the context of large-scale 
operational environments - but this work requires strength from a wide 
variety of disciplines both inside computer science (cryptography, 
programming languages, distributed systems, networking, human-computer 
interfaces, logic and model checking, configuration, software 
engineering, etc.) and outside computer science (economics, policy, 
law, statistics).

           3.2 Economics, Public Policy, Societal Challenges

Solutions to today's problems are an essential requirement to 
fulfilling the vision of ubiquitous computing. Many of today's security 
vulnerabilities in networked embedded systems and SCADA are very 
specialized and hence visible to only a few. However, as society 
increasingly employs the use of software agents to control and organize 
multiple aspects of day-to-day life these security vulnerabilities will 
become impediments to their widespread adoption. A vision for the 
future of information technology in society, implies that the presence 
of ubiquitous computing will bring with it access to interfaces that 
will become part of every day interchange for a wide class of citizens.

Investigations need to be directed so as to lend maximum benefit to 
social questions such as those in the area of economics and incentives. 
These are particularly pressing as questions of liability and insurance 
are moved up in the nations business and legislative agenda. Issues of 
liability have become an important topic given the cost of security 
incidents. Economic and legal analysis suggests that a due care 
standard provides appropriate incentives, but how should the standard 
be set in practice? Without a clear understanding of sufficient 
standards or best practices, insurance companies do not have a clear 
basis on which to offer insurance policies covering security incidents. 
The interaction between liability, insurance, and care has been 
examined extensively in the law and economics literature. However, new 
questions that arise in the context of information security as 
"accidents" are often deliberate attacks. Hence an analysis of the 
incentive of attackers must be better understood and modeled. In 
addition to these incentive problems, there are also a number of purely 
economic issues that need to be better understood. How can one quantify 
the benefits and costs from various security policies? How do public 
and private security policies interact? What are the nature and size of 
``transactions costs'' associated with security? TRUST will address 
these questions in the course of our effort. It is anticipated that the 
research results will provide a solid basis for the establishment of 
policies, procedures and eventually case law for industry and 
government in managing the risk of computer security incidents.

                       3.3 Education and Outreach

American prosperity in the new millennium and increasing national 
security concerns make it important to increase the number of students 
who will join the nation's technical enterprise as researchers. This is 
crucial in the cyber security space as there is currently a severe 
shortage of trained scientists (and almost no women and minorities) in 
the information security field. Additional need arises from our 
concerns about the ``weakest link'' of security. If even one user makes 
a serious error, it can endanger all the systems connected to his or 
her machines. We have a need to raise the level of security awareness 
of all people who use computers and depend on their results--namely, 
all citizens. TRUST brings a strong focus on educational outreach 
activities through its members many activities. Educational activities 
will be integrated with TRUST research, through graduate programs, 
summer programs and directed research projects with under represented 
educational institutions.

                           4 Testbed Research

As discussed earlier, over the past ten years,there has been an 
increasing investment in research aimed at developing cyber security 
technologies, by government agencies (NSF, DARPA, DoD) and by industry. 
However, the Nation still lacks large-scale deployment of security 
technology sufficient to protect our vital infrastructure. One 
important reason is the lack of an experimental infrastructure for 
developing and testing next-generation cyber security technology. 
Neither existing research network infrastructures (Abilene, vBNS) nor 
the operational Internet meet this need, due to the inherent risks of 
testing malicious behavior in operational networks. New security 
technologies have been tested and validated only in small- to medium-
scale private research laboratories, which are not representative of 
large operational networks or of the portion of the Internet that might 
be involved in a security attack.

To fill this critical gap, we will build an experimental infrastructure 
network to support the development and demonstration of next-generation 
information security technologies for cyber defense. This cyber Defense 
Technology Experimental Research Network (DETER Network) funded jointly 
by the National Science Foundation under its Networking Research 
Program in Computer and Information Sciences and Engineering (CISE) 
directorate and the DHS Science and Technology Office will provide the 
necessary infrastructure networks, tools, methodologies and supporting 
process--to support national-scale experimentation on emerging security 
research and advanced development technologies. .

Once again, we at Berkeley have led in putting together a broad based 
coalition of partners including the University of California Davis, 
University of Southern California-Information Systems Institute, 
Network Associates Laboratories, SRI, Menlo Park, the Pennsylvania 
State University, Purdue University, Princeton University, University 
of Utah, and industrial partners Juniper Networks, CISCO, Intel, IBM, 
Microsoft, and HP. The DETER project will create, operate, and support 
a researcher- and vendor-neutral experimental infrastructure that is 
open to a wide community of users. Furthermore, the DETER project will 
apply scientific benchmarks and measurements to both the creation of 
the experimental infrastructure itself and to validation of the 
experimental results. Two important defenses that we will develop on 
this testbed are:

1. Distributed Denial of Service Attacks--One major objective of the 
DETER network is to make scientific advancements in 1) understanding 
the effects of sophisticated, large-scale DDoS attacks and 2) defending 
against them. Techniques and software capable of disabling large 
portions of the Internet for hours or days could be developed 
relatively easily today by sophisticated hackers or nation states. 
However, because such an attack has never been observed ``in the 
wild'', the scientific and operational communities' understanding of 
the underlying scientific phenomenon is at best fragmentary and 
speculative. Internet infrastructure components that are pushed to 
their limits by such attacks may exhibit non-linear or unstable 
behaviors that diverge from predictions derived from models, 
simulations, overlay networks, and scaled down demonstrations. As a 
result, we cannot accurately predict the impact of a large-scale attack 
on different points in the Internet topology. We plan to conduct 
experiments to improve understanding of the scientific phenomenon of a 
sophisticated large-scale DDoS attack. with special attention paid to 
the following factors:
         Detection--What kinds of DDoS attacks can the 
        mechanism detect, how accurately, and under what conditions?
         Mitigation--What kinds of DDoS attacks can the 
        mechanism mitigate (via blocking or rate limiting), how 
        effectively, at which locations in the networks, and under what 
        conditions?
         Autonomy vs. Coordination--To what extent does the 
        mechanism's effectiveness depend on deployment in multiple 
        locations with communication and coordination across locations, 
        and how effective can the mechanism be if such coordination is 
        not possible?
         Collateral Damage--To what extent does the mechanism 
        impede benign traffic, and under what conditions, i.e., does it 
        do more harm than good?

2. Worm Defenses--Worms present a substantial and growing threat to the 
Internet and to large government and commercial enterprise networks. 
The recently released SQL Slammer (Sapphire) worm provided a stark 
illustration of the dramatic speed and potential impact of a simple 
worm, spreading to more than 75,000 hosts within ten minutes and 
causing ATM failures, airline flight cancellations, and widespread 
network outages. The DETER Network can play a crucial role in 
supporting study of the behavior of these worms and evaluation of new 
worm defense technologies. Worm behavior is currently only poorly 
understood. Through testbed experimentation, researchers can study 
different models of worm propagation (e.g., random scanning, target-
list, coordinated, hybrid) and their effects on propagation rates in a 
realistic network environment. They can further study effects of the 
network congestion caused by worm propagation through a large network, 
determining how such congestion affects legitimate applications and the 
worm itself as infection spreads.

5 A Model for Public-Private Partnerships for Rapid Technology Transfer 
                            in Cybersecurity

The issues in transitioning cybersecurity research and development are 
immediate and pressing. There has arguably been a market failure in 
bringing cybersecurity technologies to the market. The most common 
complaint that one hears from vendors and service providers run 
something like: ``No one will pay for security.'' or ``Security is 
every one's second most favorite priority'', or ``Security products 
suffer from the paradox of the common good''. ``Will the Federal 
government play the role of market maker in early adoption of secure 
products?'' ``Is there sufficient demand to stimulate new companies 
around new ideas in cyber-security'' ``Who will provide roadmaps to 
help the investment by established companies and the venture community 
in cyber-security products?'' However, there is reason to feel optimism 
for change, provided that some steps are taken immediately. Experience 
gained from the national response to the potential perils of the Y2K 
conversion are worth revisiting in the context of cybersecurity, with 
especial attention to the role of the mandatory SEC filings for 
corporations to explain their Y2K strategy.

A critical issue for cybersecurity is the ability to quickly transition 
products from the laboratory and the research community to industry. A 
fundamental organizational problem that exists today is the lack of 
mechanisms for filling in the gap between the end of a successful 
Federal research program and the investment by the venture community 
and industry in products. Research prototypes need to be hardened, 
tested on large scale test beds, informed, customized and modified in 
response to the needs of a diverse set of customers before they can 
attract capital to allow them to be integrated into products. In 
addition industry, especially systems integrators and the larger IT 
companies would benefit from roadmaps informed by this technology 
transition. The term public-private partnerships is used to describe 
the need for cooperative arrangements among academia, industry, venture 
capital, and government with individual stake holders in the 
infrastructures to bring the newest products to the market place and 
then to the infrastructure stake holders. It is important for the 
research and development community to play a role in developing the 
relevant non-profits and trade groups to pursue transfer of ubiquitous 
secure technology. It is important for us to continue to hold focused 
workshops and seminars on particular topics relating to infrastructure 
protection and cyber-security. Research and Development will need to 
learn and evolve with results, using an iterative investigate-develop-
educate-apply cycle. It is critical to develop science, technology and 
proof of concept prototypes that will be tested through models that 
emerge from a series of analytical and case studies, experimentation 
and simulations. For example, through participation with the Secret 
Service's New York City and San Francisco Electronic Crimes Task Force 
it has been possible for the cybersecurity research community to 
develop an understanding of the needs of cybersecurity for the 
financial community.

A success story in public private partnerships, which has all the 
hallmarks that would be desirable for cybersecurity, is in the area of 
semiconductor manufacturing. The Semiconductor Industry Association 
(SIA) and Semiconductor Research Consortium (SRC) are fine examples of 
non-profit organizations, which have facilitated both the funding of 
rapidly, transitioned research to the semi-conductor industry and led 
the continual development of roadmaps for the electronics industry. DoD 
funding, both from the OSD and DARPA, from the earliest days of this 
research has been instrumental in maintaining a strategic national 
component both for competitiveness and also for maintaining US 
superiority in a vital industry sector. My own sense is that non-
profits of the same ilk as the SIA and SRC, with the same kind of 
partnership with DHS and DoD, could play an important role for 
developing both a mechanism for rapid transition of focused research 
and road mapping for industry and the investment community. Once again, 
I feel here that for strategic national security reasons that DoD 
partner with DHS in co-funding such ventures.

                          6 Concluding Remarks

Thank you Mr. Chairman and Committee members for the opportunity to 
provide this testimony to the House Subcommittee on Cybersecurity, 
Science, Research and Development, of the Committee on Homeland 
Security. We laud you for holding this very important set of hearings 
and for engaging in a matter of deep national and homeland security. 
The research community offers the Subcommittee our full support and 
cooperation, and every success in your deliberations.

    Mr. Thornberry. I thank the gentleman. And I neglected to 
say at the outset that each of your full statements will be 
made part of the record. And also, let me compliment each of 
you on your full written statements, because they did a very 
good job of directly addressing the questions in which this 
subcommittee is interested, and I appreciate that very much.
    Let me now turn to our next witness. Dr. Steve Bellovin is 
a member of the National Academy of Engineering at the National 
Research Council. He is also a technical leader and fellow from 
AT&T Laboratory. Dr. Bellovin, thank you for being with us. And 
you are now recognized for 5 minutes.

   STATEMENT OF STEVEN BELLOVIN, PH.D., TECHNICAL LEADER AND 
                    FELLOW, AT&T LABORATORY

    Mr. Bellovin. Thank you, Mr. Chairman, Ms. Lofgren, and 
members of the committee. I am delighted to come to help you.
    I should add, one of my other roles, I am Security Area 
Director for the Internet Engineering Task Force, which is the 
group responsible for most of the standards used on the 
Internet today.
    We face a very serious cybersecurity problem. Usually we 
can protect an individual high-value system, though it is hard. 
I run my own personal computers as tightly as I know how to; in 
the last 2 years, probably there were a dozen different ways 
that, if someone sent me the right message at the right time, 
they could have taken over this system. And this is run about 
as tightly as anything can be and still be connected to public 
networks.
    We cannot protect all of the machines, and we simply don't 
know how to. We don't even know what the magnitude of the 
threat is even from ordinary hackers, let alone nation states 
and possible cyber terrorists. The available data on what kinds 
of attacks, on the number of attacks, is simply lacking. We 
need more research to help us understand what is going on, 
because you need different defenses against cyber terrorists 
than you do against ordinary hackers.
    Most of the security problems we see today are caused by 
buggy software. Buggy software is probably the oldest unsolved 
problem in computer science. I have no reason to think it is 
going to be solved in my professional lifetime. If we design a 
software correctly, though, we can restrict our attention to 
the crucial pieces for security and probably get those rights. 
Software reliability has improved. It is no longer unusual to 
see a server that has been up for a year or more. But we have 
to design software with that sort of division in mind. We know 
somewhat of how to do that, but not nearly enough.
    We need new mathematical formal frameworks for assessing 
and measuring the security of a system. A locksmith can tell 
you how long a safe can resist an attack with certain kinds of 
tools. A computer scientist can't do the same.
    Pure research on cryptography, basic research on 
cryptography is probably not a priority. It is not that 
cryptography is not important--I have done a lot of 
cryptographic research myself--but we have far more science 
there than we have currently applied. We need a great deal of 
effort on technology transfer from the theoreticians to the 
practitioners; and on engineering, taking the cryptographic 
mechanisms and actually engineering them to be used on deployed 
systems.
    I would note that open standards are better for this 
because they promote diversity. The lack of cyberdiversity, 
like the lack of biodiversity, leaves us very vulnerable to a 
single infection vector, a single attack vector. This is a very 
serious issue in the computer industry today, because many 
other trends push towards one source rather than many.
    If we have all the security technologies, it is often too 
hard to use. We need to do a lot of work on the human factors 
of computer security. Most people don't configure the systems 
securely because, frankly, it is too hard to do so. I find it 
hard sometimes myself, and I am a professional in this field, 
trying to understand some of the messages and prompts that I 
get.
    We need incentives for vendors to develop more secure 
systems. That is, both security features and more reliable, 
less buggy software. And we need incentives for end users to 
use these secure systems and these secure features.
    We need to improve systems administration. This isn't a 
sexy area, but most actual penetrations are caused by failure 
to apply available patches to correct known vulnerabilities. It 
is once the patch comes out that most of the activity takes 
place. Not always, but that is the large, vast majority of 
system penetrations. But no responsible system administrator 
will patch a production system without testing it. System 
administration is not a prime area for research; it seems too 
mundane. Nevertheless, if we can have better tools for 
automating the administration, for testing systems, and, by the 
way, for improving the resources available to system 
administrators both in government and in industry, this has got 
the potential for a very large payoff. This is some low-hanging 
fruit.
    Security also depends on authentication. Authentication is 
a subtle business. It is hard to get right. If you get it 
wrong, you may have a system failure, you also violate 
individual privacy. It is important to pay attention to both of 
these factors when designing systems.
    There are no simple answers to the cybersecurity problem. 
There is no one technology that is going to solve it for us. 
There are a number of areas, however, that if we put in the 
appropriate resources, I think we can make a lot of progress 
and get systems not absolutely secure--there is no such thing--
but markedly more secure than they are today.
    Thank you, Mr. Chairman, Ms. Lofgren, members of the 
committee.
    Mr. Thornberry. Thank you, Doctor.
    [The statement of Mr. Bellovin follows:]

              PREPARED STATEMENT OF MR. STEVEN M. BELLOVIN

                      Cybersecurity Research Needs

1. Introduction
    It is quite clear that cybersecurity is vital to our nation's 
safety. A wide variety of National Research Council reports, summarized 
in Cybersecurity Today and Tomorrow--Pay Now or Pay Later [1], have 
illustrated the threat in no uncertain terms.
    Although there are things that the information technology 
profession--software vendors, network operators, and end user sites--
can and should do today to improve computer security, the simple fact 
is that there are limits on how good a job it can do. Even with 
unlimited financial resources, and the best will, we could not do an 
adequate job. Quite simply, we do not know how to mount an adequate 
defense. It is usually possible to protect an arbitrary resource; it is 
not currently possible to protect all critical resources.

2. Threats
    The types of defenses that are necessary depend on the nature of 
the likely attacker. Schemes that will keep out the stereotypical 
``hacker''-- i.e., the bored teenager with too much time and too few 
morals--are not very effective against a nation-state. The former 
typically use tools downloaded from someone more competent; the latter 
could develop its own custom tools, and combine them with physical 
world techniques such as ``the three B--bribery, blackmail, and 
burglary''--or terrorist attacks.
    We do not have an adequate categorization of the threat model. Too 
little research has been done on who launches what kind of attacks. It 
isn't an easy thing to do; apart from the fact that most attacks are 
never detected, many organizations are reluctant to disclose their 
vulnerabilities. But we need to know the attackers' capabilities if we 
are to devise adequate defenses.

3. Basic Research Questions
    Most computer security problems are caused by buggy software [3]. 
It would be naive to assume that the problem was solvable now, when it 
hasn't been solved despite efforts stretching for more than 50 years. 
Nevertheless, we must continue to focus effort on it. If nothing else, 
the need now is to solve a subtly different problem: making a small 
subset of software correct, rather than software as a whole. We may be 
able to achieve it; today's operating systems are far more reliable 
than those used a generation ago.
    However, if we are to focus our efforts on the critical software, 
we must learn how to divide up systems appropriately. We have long 
known how to do that for operating systems, but many of today's 
problems come from faulty applications. More generally, we must learn 
how to build secure systems from insecure components, just as we can 
produce highly reliable computer systems from unreliable electronic 
parts.
    We need new formal frameworks for analyzing the security of a 
system, and for specifying its security behavior. We do not have 
adequate tools for understanding how ``strong'' a computer system is; 
at best, we can say that some system can more or less Do certain things 
reliably. By contrast, civil engineers can tell you how much weight a 
bridge can hold, while locksmiths can tell you how long it will take to 
break into a safe using a specified set of tools.
    Formal, mathematical statements have proved to be powerful tools in 
some areas of computer science. We need to be able to apply them to 
computer security issues.
    Although basic cryptographic research is important and should be 
continued, it is not a high priority. As noted, most penetrations 
cannot be prevented by cryptographic means. It is more important to do 
a better job using the cryptographic science we have. Note that I say 
this as one who has published more than a dozen cryptographic research 
papers.
    Most basic research work is done at universities. But it is not 
possible to scale up the amount of basic security research very 
quickly. There are not that many professors who are capable of doing 
such work; there is a limit to how much money each one can profitably 
use.

4. The Need for Engineering
    Although, as noted, there is a need for more basic research, a 
great deal of prior research has not yet been translated into practice. 
For example, we have far more cryptographic science than we have 
network protocols that use this science. We need to support technology 
transfer to industry groups and standards organizations; we cannot 
protect our infrastructure with theoretical constructs. (I note that 
open standards are better; apart from the ``many eyes'' notion, with 
open standards there can be multiple independent implementations of the 
same function. The National Research Council noted that the lack of 
diversity in platforms was a major risk factor [3].)
    More subtly, much security technology is not employed because it's 
too hard to use. We need research in the human factors of security 
technology.
    Assuming that industry does the necessary cryptographic and human 
factors engineering, the results must be translated into practice. This 
may require incentives for software vendors to develop the code, and 
for end users to employ it.
    As noted earlier, most security holes are due to buggy code. That 
is bad enough; what is worse is that most penetrations exploit bugs for 
which patches are available but have not yet been applied. The cause is 
not laziness or incompetence by systems administrators; rather, it's 
reflective of the immense difficulty of the systems administration 
task. Patches have a higher bug rate than base code, and may thus be 
more likely to create new security holes; beyond that, a remarkable 
amount of code functions because of an implicit reliance on some 
underlying bug that was present on the development systems. Fixing a 
bug may, as a side-effect, disable essential applications. No 
responsible systems administrator will install a patch on a production 
system without extensive testing, but this behavior leaves the machine 
vulnerable. We need research to solve this dilemma. Systems 
administration is not a typical research topic; nevertheless, it is the 
area with the biggest potential payoff for a relatively modest 
investment.
    It is worth noting that systems administration is often a high 
stress, low status job. Administrators often struggle to perform basic 
tasks because of inadequate resources. Measures to improve systems 
administration, in industry and government, would likely have a 
significant effect on practical computer security.
5. Privacy
    Often, computer security depends on proper authentication of 
authorized users. Authentication technologies, ranging from passwords 
to biometrics, are subtle and difficult to use properly. Beyond simple 
issues of correctness, any authentication technology can be used in 
ways that violate personal privacy [2]. Both research on cybersecurity 
and deployment of technology should protect privacy to the extent 
feasible.
6. Conclusions
    There are no simple answers to the problem of cybersecurity. What 
is needed is a combination of basic research, technology transfer, and 
applications of new and previously known techniques. We, as a nation, 
cannot afford to neglect the issue.

References
[1] Computer Science and Telecommunication Board, editor. Cybersecurity 
Today and Tomorrow--Pay Now or Pay Later. National Academies Press, 
2002.
[2] Stephen T. Kent and Lynette I. Millett, editors. Who Goes There?: 
Authentication Through the Lens of Privacy. National Academies Press, 
2003.
[3] Fred B. Schneider, editor. Trust in Cyberspace. National Academies 
Press, 1999.

    Mr. Thornberry. There are several areas that you mentioned 
we will certainly come back to in questions.
    Finally, we have Mr. Dan Wolf, Director of Information 
Assurance at the National Security Agency. Members will 
remember that Mr. Wolf has helped us before. Really, the first 
activity of this subcommittee was kind of a Members-only 
workshop on cybersecurity which Mr. Wolf put on for us.
    Welcome back, and we appreciate your being here. You are 
now recognized for 5 minutes.

    STATEMENT OF MR. DANIEL G. WOLF, INFORMATION ASSURANCE 
               DIRECTOR, NATIONAL SECURITY AGENCY

    Mr. Wolf. Thank you, Chairman Thornberry, and members of 
the subcommittee. My name is Daniel Wolf, and I am NSA's 
Information assurance director.
    NSA's Information Assurance Director is responsible for 
providing information assurance technologies, services, 
processes, and policies to protect national security 
information systems. We are also responsible for conducting 
research and development.
    In regards to your theme for this hearing, Cybersecurity--
Getting It Right--
    Mr. Thornberry. Excuse me, Mr. Wolf. Would you pull that 
microphone just a little closer to you? Some of us are having 
trouble hearing, including me. There you go. Thank you.
    Mr. Wolf. In regards to your theme for this hearing, 
``Cybersecurity--Getting It Right,'' I am not sure that NSA has 
all the answers or we have always got it right, but I am quite 
confident during our 50 years of deploying communications, and 
now cybersecurity products, we have learned quite a few 
lessons. Some people want to keep NSA in a box labeled ``for 
classified information only.'' They say that NSA's perspective 
is too narrowly focused on national security systems. However, 
I believe quite to the contrary. It has been my experience that 
there is little difference between the cybersecurity that is 
required for a system processing top secret military 
information and one that controls a segment of the Nation's 
critical infrastructure.
    The information management principle within the national 
security community has always been the concept of need to know, 
but the fundamental information principle for homeland security 
is need to share. Because the threat always rolls downhill; 
that is, our adversaries will always attack the weakest link. 
Information must be protected across the entire system. A 
three-sided castle is not very safe. The entire community must 
share the same standards if we are to protect everyone on all 
four sides of the castle.
    Your invitation to this committee outlined a number of 
areas where you wanted some specific comments and answers. The 
first was in technical approaches to optimize cybersecurity. I 
believe that the highest payoff for optimizing cybersecurity 
would be creation of an interoperable authentication system 
deployed widely throughout the Federal, national security, 
first responder, and critical infrastructure community. This 
authentication system also forms the basis for all of the other 
cybersecurity services.
    It is also important to note here that the most critical 
infrastructures like this PKI should be built using U.S. 
technology. I have concerns with foreign software, unknown 
trust and quality, being integrated into critical U.S. systems.
    My next priority to cybersecurity is effective border 
protection. Just like our national borders or the perimeters of 
our buildings, we need to protect our cyber borders. Effective 
border protection includes many different technologies, 
including firewalls, virtual private networks, high-assurance 
guards, and of course intrusion detection.
    It has also been estimated that over 90 percent of all 
successful attacks on DOD systems are against known 
vulnerabilities. System operators struggle to keep up with all 
the patches that are issued each month. A system left unpatched 
soon becomes a target like an unlocked sports car with the keys 
in the ignition. Therefore, we need an automated patch 
management system.
    Your second question dealt with advanced technologies and 
should they be pursued to outpace attacks. Today, most of the 
information coordination during a cyber attack occurs at the 
speed of humans. Code Red infected 50,000 machines in an hour. 
We need the ability for networks to work together automatically 
to weather such an attack.
    Another significant research topic is attack attribution, 
the capability to geolocate and identify the source of attacks. 
Without confident knowledge of who and where an attack was 
mounted, it is impossible to decide on the appropriate 
response. A rapid and reliable capability that separates 
nuisance hackers from more serious threats could increase the 
overall effectiveness of every cybersecurity practitioner in 
both the government and the private sector.
    Areas needing higher priority and funding. There is little 
coordinated effort today to develop tools and techniques to 
effectively and efficiently examine either source or executable 
software in large applications. We need a national software 
assurance center to pull together representatives from 
academia, industry, Federal Government, national labs, the 
national security community, sharing techniques to solve this 
growing threat. It could liken us to the Manhattan Project that 
was mentioned earlier. This is a significant problem, I 
believe.
    In today's environment, the need is particularly acute for 
ways to counter security vulnerabilities found in popular 
commercial operating systems. While many of these 
vulnerabilities can be fixed by properly configuring the 
system, the goal is to configure these systems to be as secure 
as possible right out of the box. I am happy to learn from your 
last hearing that some equipment vendors are now offering the 
security standards as the default configurations.
    NSA, working with DISA, NIST, the NIPC, the former NIPC, 
the FedCert, SANS, CIS, developed a set of consensus benchmark 
security standards. These standards provide a sort of, if you 
want to call it, preflight checklist of security settings. The 
benchmark standards represent an effective model based on 
agreement between and among security experts. NSA is proud to 
be part of this project and will continue to support the 
community in establishing security standards.
    The fourth area was in the role of transfer among 
government, academia, and industry. NSA requirements for 
cybersecurity products for national security uses are identical 
to the requirements found in other mission-critical systems; 
for example, homeland security and a critical infrastructure 
protection. We have developed a number of programs leveraging 
commercial information technology. My written statement 
provides the details, but let me just highlight a few of these 
programs.
    The National Information Assurance Partnership, or NIAP, is 
a U.S. Government initiative designed to meet security testing, 
evaluation, and assessment needs of both information technology 
producers and consumers.
    Another is the NSTISSP 11. This is a national security 
community policy requiring the acquisition of information 
assurance products that have been validated in accordance with 
either common criteria or other approved methods.
    Another is the Centers of Academic Excellence in 
Information Assurance Education. This program promotes higher 
education and information assurance, and produces a growing 
number of professionals with IA expertise in various 
disciplines. Fifteen universities have been designated as 
centers of academic excellence to date. We need this type of 
program for our workforce development. We must invest in our 
future, our people's future.
    And the next area is perspective on leveraging national 
security standards for homeland security. The key to success 
for protecting the homeland is secure interoperability. NSA has 
created a number of secure interoperability standards for 
national security use that are directly applicable for homeland 
security and public safety. Some sectors are already adopting 
these standards. If we are going to share information, these 
things are extremely important.
    In conclusion, it has been my pleasure to share the work of 
my agency with the committee today. I believe that much of the 
research and development initiated by NSA for use in the 
national security community is directly transferrable to the 
needs of homeland security. We must change our fundamental 
assumptions from ``need to know'' to ``need to share.'' We must 
share policies and processes across the community. 
Cybersecurity products and technologies have been the focus of 
my remarks today, but technology alone will never be good 
enough to protect us. It is ultimately getting cybersecurity 
right is more about what you do than what you buy.
    Thank you for the opportunity to speak to you today.
    [The statement of Mr. Wolf follows:]

                PREPARED STATEMENT OF MR. DANIEL G. WOLF

    Thank you Chairman Thornberry and the members of the Subcommittee. 
I am honored to be here and pleased to have the opportunity to speak 
with your committee to discuss cybersecurity research from the point of 
view of the National Security Agency as we conduct our mission to 
address threats to the security of critical U.S. Government information 
systems.
    I also would like to thank the Chairman and other members of the 
Subcommittee for their strong interest and attention to this vital 
area. In my opinion, your leadership is important for raising awareness 
of the serious security challenges we all face in our age of 
interconnected, inter-dependent digital information networks.
    My Name is Daniel Wolf and I am NSA's Information Assurance 
Director. NSA's Information Assurance Directorate is responsible for 
providing information assurance technologies, services, processes and 
policies that protect national security information systems. We are 
also responsible for conducting the research and development of 
information assurance technologies and systems.
    I would like to note that NSA's Information Assurance Directorate 
and its predecessor organizations have had technical and policymaking 
responsibility regarding the protection of national security 
telecommunications and information processing systems across the 
Executive Branch since 1953.
    In regards to your theme for this hearing: ``Cybersecurity--Getting 
It Right.'' I am not sure that NSA has all of the answers or that we 
always have gotten it right--but I am quite confident that during our 
50 years of deploying communications and now cyber security products we 
have learned quite a few lessons. We have had tremendous successes and 
our share of failures. We also have gained a deep understanding and 
respect for the challenges the nation must overcome to begin to tame 
cyberspace.
    Some in government and industry want to keep NSA in a box labeled 
``for classified information only.'' They suggest that NSA's 
perspective is much too narrow due to our focus on the stringent 
requirements of national security systems. However, I believe quite the 
contrary. It has been my experience--and my testimony will soon 
address--that there is little difference between the cybersecurity that 
is required for a system processing top-secret military information and 
one that controls a segment of the nation's critical infrastructure.
    Both systems require the element of assurance or trust. Trust that 
the system was designed properly. Trust that it was independently 
evaluated against a prescribed set of explicit security standards. 
Trust that it will maintain proper operation during its lifetime, even 
in the face of malicious attacks and human error. It has been my 
experience that effective cybersecurity must be baked into information 
systems starting at the R & D phase. Trust cannot be sprinkled over a 
system after it is fielded.
    Homeland security presents another reason to suggest that 
cybersecurity requirements must converge. The information management 
principle within the national security community has always been the 
concept of need-to-know. But the fundamental information principle for 
homeland security is need-to-share. With need-to-share we must develop 
technical solutions for secure interoperability that may be called on 
to tie top-secret intelligence systems to a local first responder 
system.
    Because the threat always rolls downhill, that is to say, 
adversaries always attack the weakest link. Information must be 
protected across the entire system. A three-sided castle is not very 
safe. Therefore, I contend that in almost all cases the cybersecurity 
requirements found in national security systems are identical to those 
found in e-commerce systems or critical infrastructures. It follows 
then that the research challenges, security features and development 
models are also quite similar.
    With these similarities in mind, NSA has been working hard to 
converge these cybersecurity markets through a series of programs and 
research initiatives. Our goal is to leverage our deep understanding of 
cyber threat and vulnerability in a way that lets us harness the power 
and innovation provided by the information technology industry. We 
believe that the resulting cybersecurity solutions will protect all 
critical cyber systems, regardless of the information they process.
    I think it will be useful for me to provide a brief description of 
NSA's cybersecurity responsibilities and authorities. I will then turn 
to the specific questions you asked me to answer in your invitation.
NSA Information Assurance Background
    When I began working at NSA some 36 years ago, the ``security'' 
business we were in was called Communications Security, or COMSEC. It 
dealt almost exclusively with providing protection for classified 
information against disclosure to unauthorized parties when that 
information was being transmitted or broadcasted from point to point. 
We accomplished this by building the most secure ``black boxes'' that 
could be made, employing high-grade encryption to protect the 
information. In the late 1970s, a new discipline we called Computer 
Security, or COMPUSEC, developed. It was still focused on protecting 
information from unauthorized disclosure, but it brought with it some 
additional challenges and threats, e.g., the injection of malicious 
code, or the theft of large amounts of data on magnetic media.
    With the rapid convergence of communications and computing 
technologies in the early 1980s and especially with the explosion of 
the personal computer, we soon realized that dealing separately with 
COMSEC on the one hand, and COMPUSEC on the other, was no longer 
feasible, and so the business we were in became a blend of the two, 
which we called Information Systems Security, or INFOSEC. The 
fundamental thrust of INFOSEC continued to be providing protection 
against unauthorized disclosure, or confidentiality, but it was no 
longer the exclusive point of interest.
    The biggest change came about when these computer systems started 
to be interconnected into local and wide area networks, and eventually 
to Internet Protocol Networks, both classified and unclassified. We 
soon realized that in addition to confidentiality, we needed to provide 
protection against unauthorized modification of information, or data 
integrity. We also needed to protect against denial-of-service attacks 
and to ensure data availability. Positive identification, or 
authentication, of parties to an electronic transaction had been an 
important security feature since the earliest days of COMSEC, but with 
the emergence of large computer networks, data and transaction 
authenticity became an even more important and challenging requirement.
    Finally, in many types of network transactions it becomes very 
important that parties to a transaction cannot deny their 
participation, so that data or transaction non-repudiation joined the 
growing list of security services often needed on networks.
    Because the term ``security'' had been so closely associated, for 
so long, with providing confidentiality to information, we adopted the 
term Information Assurance, or IA, within the Department of Defense to 
encompass the five security services of confidentiality, integrity, 
availability, authenticity and non-repudiation. I should emphasize here 
that not every IA application requires all five security services, 
although most IA applications for national security systems--and all 
applications involving classified information--continue to require high 
levels of confidentiality.
    Another point worth noting is that there is an important dimension 
of Information Assurance that is operational in nature and often time-
sensitive. Much of our work in IA is found in providing an appropriate 
mix of security services that are not operational or time-sensitive, 
e.g., education and training, threat and vulnerability analysis, 
research and development, assessments and evaluations, and tool 
development. However, in an age of constant probes and attacks of 
networks, an increasingly important element of protection deals with 
operational responsiveness in terms of detecting and reacting to these 
time-sensitive events. This defensive operational capability is closely 
allied with and synergistic with traditional IA activities, but in 
recognition of its operational nature is generally described as 
Defensive Information Operations, or DIO. NSA's responsibilities in 
this area have grown considerably since the late 1990's.
    To meet this DIO challenge, NSA's National Security Incident 
Response Center (NSIRC) provides real-time reporting of cyber attack 
incidents, forensic cyber attack analysis, and threat reporting 
relevant to information systems. Through round-the-clock, seven-days-a-
week operations, the NSIRC provides the Departments of Defense, the 
Intelligence Community, Federal Law Enforcement, Department of Homeland 
Security and other Government organizations with information valuable 
in assessing current threats or defining recent cyber intrusions.
    NSA's responsibilities and authorities in the area of information 
assurance are specified in, or derived from, a variety of Public Laws, 
Executive Orders, Presidential Directives, and Department of Defense 
Instructions and Directives. The Secretary of Defense is the Executive 
Agent for National Security Telecommunications and Information Systems 
Security. The Director of NSA has broad responsibilities in providing 
for the security of national security \1\ telecommunications and 
information systems processing national security information, 
including:
---------------------------------------------------------------------------
    \1\ The Computer Security Act of 1987 defines national security 
systems as telecommunications and information systems operated by the 
US Government, its contractors, or agents, that contain classified 
information or, as set forth in 10 USC Section 2315, that involves 
intelligence activities, involves cryptologic activities related to 
national security, involves command and control of military forces, 
involves equipment that is an integral part of a weapon or weapon 
system, or involves equipment that is critical to the direct 
fulfillment of military or intelligence missions.

         Evaluating systems vulnerabilities
         Acting as the focal point for cryptography and 
        Information Systems Security
         Conducting Research and Development
         Reviewing and approving security standards and 
        policies
         Conducting foreign liaison
         Assessing overall security posture
         Prescribing minimum security standards
         Contracting for information security products provided 
        to other Departments and Agencies
         Coordinating with the National Institute of Standards 
        and Technology (NIST); providing NIST with technical advice and 
        assistance
    While protecting the confidentiality of classified information via 
extremely strong cryptographic systems was a major part of NSA's 
mission in the past, our mission has changed emphasis considerably over 
the last ten years. We now spend the bulk of our time and resources 
engaged in research, development and deployment of a full spectrum of 
IA technologies for systems processing all types of information. NSA's 
days of just building ``crypto for classified'' are long gone.

Specific Issues Related to Cybersecurity R&D
    Your invitation outlined a number of areas where you wanted 
specific comments and answers.

1. Technical approaches to optimize cybersecurity.
    I believe that the highest payoff for optimizing cybersecurity is 
the creation of an interoperable authentication system deployed widely 
throughout the federal, national security, first responder and critical 
infrastructure community. The typical approach used is a public-key-
infrastructure (PKI) system with a smart card that contains your cyber 
credentials. This is the type of system that NSA and DISA have built 
for DoD. A national PKI system is required that allows for strong 
authentication in cyberspace for homeland security.
    If we have this national system in the future--then when a first 
responder connects to a DHS website to access information or upload a 
report--we will know exactly who they are. We can then assign various 
privileges according to the role that the person is assuming for that 
specific information transaction. This authentication system also forms 
the basis for all of the other cybersecurity services from protecting 
the control of Supervisory Control and Data Acquisition (SCADA) systems 
to encrypting your email and passwords.
    It is also important to note here that the most critical 
infrastructures, like a PKI, should be built using U.S. technology. I 
have concerns with foreign software of unknown trust and quality being 
integrated into critical U.S. systems.
    My next priority for cybersecurity is effective border protection. 
Just like our national borders or the perimeters of our buildings, we 
need to protect our cyber borders. Effective border protection includes 
many different technologies.
         The most important technology is a firewall. Firewalls 
        help networks resist attacks by establishing a strong but 
        resilient border between our protected network and the external 
        Internet.
         We also need encrypted tunnels, also called virtual 
        private networks or VPN's. These devices sit between critical 
        networks to protect the information as it moves between secure 
        networks over unprotected pipes.
         Another necessary border security technology is called 
        a ``guard''. A guard is used when we need to share information 
        between security domains. Consider the case of an intelligence 
        report that is created on a top-secret network. It must be 
        sanitized to unclassified and then sent to a local police 
        department. It would be dangerous to allow this information to 
        move between security domains without review. High assurance 
        ``guards'' are designed to automatically and safely allow 
        certain information packets to flow between systems but stops 
        all others.
         Finally, effective borders require the ability to 
        detect and respond to intrusions. Just like a security camera 
        on a bank, cyber intrusion detection systems monitor the flow 
        of information around your border and detect suspicious 
        activity.
    The best way to protect a system from attack is to eliminate its 
vulnerabilities. The best way to eliminate vulnerabilities is to 
improve the way we write software. High on my research priority list is 
the need for assured software design tools and development techniques. 
We also need to improve computer operating systems by including 
functionality to enhance their ability to defend themselves from 
attack.
    The elimination of vulnerabilities is the goal but the reality is 
that we are a long way from achieving this goal. Attacks are common and 
vulnerabilities are discovered daily. It has been estimated that over 
90 percent of all successful attacks on DoD systems are based on 
vulnerabilities that are already known and that have an updated 
software fix or ``patch'' available. The rare system operator can keep 
up with all of the ``patches'' that are issued each month. A system 
left un-patched soon becomes a target like an unlocked sports car with 
the keys in the ignition. Therefore, another way to optimize 
cybersecurity is with an automated patch management system.
    This system would also use strong authentication as provided by a 
PKI but the software producer would sign the new application instead of 
a person. The patch would be automatically and safely sent to your 
system. The PKI guarantees that it is comes from an authentic source 
and has not been corrupted.

2. What areas of advanced technology should be pursued to outpace 
attacks?
    Research is required to improve a cybersecurity system's ability to 
modify itself on-the-fly. New attacks are constantly emerging and new 
vulnerabilities are discovered even in the most carefully designed 
systems. The ability to update must be safely executed and as 
transparent to the user as possible.
    NSA is working on a multi-year, nearly $3B development program 
called Cryptographic Modernization (CM) that has some of these 
features. There are over 1.3 million cryptographic devices in the U.S. 
inventory. Over 75% of these systems will be replaced during the next 
decade. Future security systems are being designed to use the network 
to safely program and reprogram their operating characteristics 
automatically and transparently to the user.
    Research is also needed to learn how to build cybersecurity systems 
that can continue to operate even while under attack. Resilient 
systems, like those being investigated by DARPA and others will be 
needed in the future. The goal is to have a system that degrades 
gracefully instead of causing a cascade of insecurity.
    I would also suggest that considerable research is needed to 
effectively coordinate information during a cyberattack. Today, most of 
this coordination occurs at the speed of humans. But attacks are 
carried out in seconds and are often carried out automatically.
    The CODE RED attack in 2001 infected 50,000 machines per hour, 
ultimately causing billions of dollars in damage. We need a capability 
for our networks to work together automatically to weather an attack. 
Incident information formats, automatic remediation algorithms, the 
ability to learn attack specifics from intrusion detection devices and 
other network sensors and then share this info with other networks 
without human intervention are high priority requirements.
    Another significant research topic is the ability to enhance attack 
identification methods. Most intrusion detection or system misuse 
systems today rely on patterns or signatures to identify the bad 
behavior. This works well for known attacks but is useless against 
novel attacks. The ability to detect attacks and misuse from anomalous 
behavior is needed.
    The ability to detect suspicious or anomalous behavior is also 
useful to identify insider attacks. Studies have estimated that 50 
percent of the most damaging attacks come from insiders. An insider is 
unlikely to use sophisticated attacks because they already have an 
account on the system--but the ability to monitor system use during off 
hours or track users accessing unusual accounts provides vital clues 
for detecting insiders.
    Continuing with the cyber attack theme--I believe that one of the 
hardest problems we must solve in cybersecurity is attack attribution. 
That is the capability to geolocate and positively identify the source 
of attacks on the Internet. Without confident knowledge of who and 
where an attack was mounted, it is impossible to decide on the 
appropriate response. A rapid and reliable capability that separates 
nuisance hackers from more serious threats would increase the overall 
effectiveness of every cybersecurity practitioner in both government 
and the private sector. Effective attribution by law enforcement 
leading would also deter the casual hacker and allow resources to spent 
on more serious cases.

3. Suggest advanced technology programs needing higher priority & 
funding.
    A significant cybersecurity improvement over the next decade will 
be found in enhancing our ability to find and eliminate malicious code 
in large software applications. Beyond the matter of simply eliminating 
coding errors, this capability must find malicious software routines 
that are designed to morph and burrow into critical applications in an 
attempt to hide. There is little coordinated effort today to develop 
tools and techniques to examine effectively and efficiently either 
source or executable software. I believe that this problem is 
significant enough to warrant a considerable effort coordinated by a 
truly National Software Assurance Center. This center should have 
representatives from academia, industry, federal government, national 
laboratories and the national security community all working together 
and sharing techniques to solve this growing threat.
    We also need the ability to trust the hardware platforms we use for 
critical applications. Most microelectronics fabrication in the USA is 
rapidly moving offshore. NSA is working on a Trusted Microelectronics 
Capability to ensure that state-of-the-art hardware devices will always 
be available for our most critical systems.
    The DoD is currently undertaking a major program called 
transformational communications. This program is developing the 
military communications infrastructure of the future and it will be 
delivering high-bandwidth, secure, multi-faceted digital capabilities 
across the defense enterprise and down to the individual warfighter. 
Many new cybersecurity requirements are being generated by this 
initiative and they will require significant R&D resources. For 
example, additional key management infrastructure capabilities, 
techniques for multi-level security networks, and ultra-high bandwidth 
encryption are a few of the new technologies being driven by this 
requirement. It is important to note that the results of this program 
will be dual-use. The technology being developed will have application 
for solving many of the same challenges that are found in homeland 
security systems.
    In today's Information Technology environment, the need is 
particularly acute for ways to counter security vulnerabilities found 
in popular commercial operating systems and applications. While many of 
these vulnerabilities can be fixed by properly configuring the system, 
the goal is to configure these systems to be as secure as possible 
``right out of box.'' Building on the hugely popular security 
configuration guides for Windows 2000, NSA, working with Defense 
Information Systems Agency, the National Institute of Standards and 
Technology, the FBI's National Infrastructure Protection Center (now at 
DHS), the General Services Administration's FedCert, the SANS 
Institute, the Center for Internet Security and vendors--developed a 
set of consensus benchmark security standards. These standards provide 
a sort of "preflight checklist" of security settings.
    The benchmark standards represent an effective model based on 
agreement between security experts, system operators and software 
vendors. A number of standards for the most popular technologies are 
being adopted by many government and private sector CIOs.
    I am happy to learn from your last hearing that some equipment 
vendors are now offering the security standards as the default 
configuration. I also understand from your hearing last week that 
industry gave high marks to the great work being done by the Center for 
Internet Security. NSA is proud to be a part of this project and will 
continue to support the community in establishing security standards. 
This consensus approach may not eliminate every vulnerability, but by 
working together, we can harden our systems against common attacks.

4. Role of technology transfer among government, academia, and 
industry?
    NSA is motivated by a sincere belief that the requirements for 
cybersecurity products and services for national security uses are 
identical to the requirements found in other mission critical systems 
e.g., homeland security and critical infrastructure protection. We have 
developed a number of programs and policies targeted leveraging the 
commercial information technology.
         The National Information Assurance Partnership (NIAP) 
        is a U.S. Government initiative designed to meet the security 
        testing, evaluation, and assessment needs of both information 
        technology producers and consumers. NIAP is collaboration 
        between the National Institute of Standards and Technology and 
        the NSA in fulfilling their respective responsibilities under 
        the Computer Security Act of 1987. The partnership, originated 
        in 1997, combines the extensive security experience of both 
        agencies to promote the development of technically sound 
        security requirements for IT products and systems and 
        appropriate metrics for evaluating those products and systems. 
        The long-term goal of NIAP is to increase the level of trust 
        consumers have in their information systems and networks 
        through the use of cost-effective security testing, evaluation, 
        and assessment programs. NIAP continues to build important 
        relationships with government agencies and industry in a 
        variety of areas to help meet current and future IT security 
        challenges affecting the nation's critical information 
        infrastructure.
         NIAP also produces cybersecurity specifications, 
        called protection profiles that have already been developed for 
        low and medium assurance applications and are periodically 
        updated. The profiles are available on the NIAP website for 
        anyone to use to describe the features needed for cybersecurity 
        applications.
         NSTISSP #11 (National Security Telecommunications and 
        Information Systems Security Policy #11) is a national security 
        community policy governing the acquisition of information 
        assurance products. The policy mandates, effective 1 July 2002, 
        that departments and agencies within the Executive Branch shall 
        acquire, for use on national security systems, only those 
        products that have been validated in accordance with the either 
        the Common Criteria, or other approved methods. Additionally, 
        NSTISSP #11 notes that departments and agencies may wish to 
        consider the acquisition of validated COTS products for use in 
        information systems that may be associated with the operation 
        of critical infrastructures as defined in the Presidential 
        Decision Directive on Critical Infrastructure Protection Number 
        63.
         The Information Assurance Technical Framework Forum 
        (IATFF) is a NSA sponsored outreach activity created to foster 
        dialog between U.S. government agencies, industry, and academia 
        seeking to provide their customers solutions for information 
        assurance problems. The ultimate objective of the IATFF is to 
        agree on a framework for information assurance solutions that 
        meet customers' needs and foster the development and use of 
        solutions that are compatible with the framework. The forum 
        serves to increase awareness of available security solutions 
        and allows attendees to establish contacts with other 
        individuals and organizations dealing with similar problems. 
        The Information Assurance Technical Framework document, 
        currently in its third revision that provides over 500 pages of 
        technical guidance for protecting information and information 
        systems.
         The Centers of Academic Excellence in Information 
        Assurance Education Program is an outreach effort designed and 
        operated by NSA in the spirit of Presidential Decision 
        Directive 63. The program goal is to reduce vulnerability in 
        our National Information Infrastructure by promoting higher 
        education in information assurance, and producing a growing 
        number of professionals with IA expertise in various 
        disciplines. Fifty universities have been designated as Centers 
        of Academic Excellence to date. NSA has also been using the 
        skills found at the service academies in a number of 
        interesting ways. One exciting program is the service academies 
        competition for attacking and defending networks. We also 
        sponsor visiting professors in IA. We need this type of program 
        for our workforce development - we must invest in our future.
         NSA is also working to transfer techniques to 
        cybersecurity service providers. One of the services that NSA 
        offers under this authority is system security assessment. 
        Since NSA has limited resources to meet the ever-growing demand 
        for INFOSEC Assessments, a training and certification program 
        was developed as a partnership between NSA and private INFOSEC 
        Assessment providers.
         NSA also created the INFOSEC OUTREACH Program to 
        combine the substantial Information Systems Security talents of 
        government and industry partners. The program provides insight 
        into secure design, security evaluation, and the security 
        considerations of system certification. Working together, the 
        partnership of government and industry can meet the increasing 
        demands for state-of-the-art secure telecommunications and 
        information systems.
         NSA and the International Information Systems Security 
        Consortium (ISC)2 developed a new Information Systems Security 
        Engineering Professional credential for information security 
        professionals who want to work on national security systems. 
        The new certification will serve as an extension of the 
        Certified Information Systems Security Professional, offered by 
        (ISC)2 for information security.

5. How are research priorities and programs determined in the national 
security area?
    We base our priority decisions on a number of factors. The first 
factor is determined by the technologies and systems most used by our 
customers. For example, we recently started a comprehensive R&D program 
to enhance the security of PDA's and wireless 802.11 networks over the 
last two years because of the explosion of the use of these systems by 
our DoD customers.
    We also maintain a large number of cooperative research agreements 
with many of the most important technology vendors to help us keep 
ahead of their development cycles. We also work with small firms 
ensuring that their innovative technologies are fully informed by our 
cybersecurity expertise. This insight allows us to program for 
anticipated cybersecurity enhancements of our systems, or in the best 
case, influence our industrial partners, large and small, to add 
additional IA features during development.
    Our researchers also participate in R&D agenda setting panels and 
boards with the NSF, DARPA, National Laboratories, and industry 
associations. We collaborate with the R&D functions in our customer's 
organizations. All of this information is used in making an R&D 
priority and programming decision.
    NSA is also unique in that we have considerable insight into the 
threat presented by various adversaries from our intelligence 
activities. Threat profiles are developed and these, in part, drive our 
research agendas.
6. Share your perspectives on leveraging national security standards 
for homeland security needs?
    National security standards are developed for--and are intended to 
be leveraged for all critical cybersecurity requirements.
         In order to promote secure interoperability between 
        wired and wireless systems NSA initiated an industry and 
        government consortium to agree on a common signaling plan 
        called the future narrowband digital terminal (FNBDT). Although 
        in reality it is not just narrow band anymore but a broad 
        specification, FNBDT includes a common voice processing 
        capability, a common signaling protocol, a common crypto-
        algorithm base, and a common key management process. FNBDT has 
        become the primary security standard for cell phones, military 
        radios and many emerging public safety communications devices 
        intended to serve homeland security missions and first 
        responders all around the world.
         We also created the High Assurance IP Interoperability 
        Specification (HAIPIS), which will ensure interoperability with 
        all future generations of IP network encryptors. The IP, or 
        Internet protocol, is the backbone of the worldwide Internet. 
        This new cybersecurity specification has become extremely 
        popular and new products, based on this specification are being 
        released regularly.
         Many of the technologies that we are suggesting for 
        homeland security requirements were developed to support 
        coalition military warfare. These systems were designed to 
        cost-effectively support a highly mobile and constantly 
        changing set of information sharing partners. We are confident 
        that they are exactly what many homeland security applications 
        require.

Conclusion
    It has been my pleasure to share the work of my agency with the 
committee today. I believe that much of the research and development 
initiated by NSA for use in the national security community is directly 
transferable to the needs of homeland security. We all need to work 
together to shape the demand side of the market. Everyone needs 
trustworthy technology. We cannot afford to cut corners.
    We must change our fundamental assumption from need-to-know to 
need-to-share. We must share policies and processes across the 
community. Cybersecurity products and technologies have been the focus 
of my remarks today but the technology alone will never be good enough 
to protect us because--ultimately--getting cybersecurity right is more 
about what you do than what you buy.
Thank you for the opportunity to speak before the subcommittee today.

    Mr. Thornberry. I thank the gentleman, and all the 
witnesses, for their testimony. It is rather remarkable to me 
how much consistency there is really between among all three of 
you.
    At this time, I would yield to the gentlelady from 
California for questions.
    Ms. Lofgren. Thank you, Mr. Chairman. And as I have in past 
hearings, I am really struck by how fortunate we are in this 
subcommittee to be able to really call on some of the smartest 
people in the whole country, and then they come and share with 
us. So it is a delight to listen to each of you.
    I have many questions, but let me just start in with Dr. 
Sastry, because one of the concerns I have, you mentioned 
HSARPA as an encouraging element of the new Department and one 
with great promise. Before you were leading the Department at 
Berkeley, you ran the technology, the cyber part for DARPA. And 
I am wondering if you can reach back to that part of your 
experience and give us some advice on what we might do to 
actually get HSARPA up and running.
    Right now there is, I believe, a recently hired deputy 
director, and that is it. I mean, it was last month you 
couldn't even call the division because there wasn't a phone 
number or an office. And there is no director, there is no 
employees. If you were the czar, what would you do to jump-
start that effort so it could be as productive for the country 
as DARPA was?
    Mr. Sastry. Thank you very much, the Honorable Ms. Lofgren. 
I had the good fortune to serve under the deputy directorship 
of Jane Alexander, who is now the Deputy Director of HSARPA; 
she was the Deputy Director of DARPA. So I think we are 
fortunate to have some leadership with experience in the DARPA 
model.
    The way I would configure HSARPA is perhaps quite 
substantially along the lines of the DARPA model with a few 
differences. The way DARPA programs are organized are they are 
mission-oriented in the sense that they are 3-to 5-year 
programs with very definite outcomes. And so even in the 
information assurance and survivability suite of programs, we 
had one on secure systems, we had one on fault tolerant 
networks, we had one on coalitions. And each one of those was 
separately organized, bite-sized pieces of research. And in 
addition, the way those were informed by the needs of the 
services and the needs of the service labs was to have the 
service labs be the individual CTARs of the technical 
contractors for executing the contracts.
    So I feel that the IAIP Directorate, the Board of Security 
Directorate, and the Emergency preparedness directorate could 
provide staff to be the executors of the contracts that come 
out of HSARPA, very much in that model.
    Now, the questions about how one ramps up quickly to this 
is a very important one, and I think it will take some time to 
hire the right program managers and to have adequate turnover, 
the way DARPA does, so as to keep new ideas coming into the 
agency. One suggestion is to actually use existing mechanisms 
of partnership with NSF the way DARPA does, or with DARPA 
itself in the short run, to be able to ramp up to such a state 
where it has its own program managers.
    The one thing I do differently from DARPA is, because there 
are sort of short-and intermediate-term needs which have to be 
met in the other directorates, I think I would really have a 
separate office which concentrates on the technology transition 
issue. And the technology transition issue would be about 
setting up the correct structures to make sure that, as the 
programs mature, those get taken up. And I alluded to some 
mechanisms that I thought were useful.
    Ms. Lofgren. Mr. Wolf expressed concern about foreign 
software or software developed offshore and its reliability. Do 
you, Dr. Bellovin and Dr. Sastry, share that concern?
    Mr. Bellovin. I am concerned about all software's 
reliability and correctness. I am not in the position to 
understand how much greater the threat is when it is coming 
from elsewhere, but we are dealing with a screen door, not a 
vault door in a lot of the software.
    Patching systems--I was asked this question leading up to 
Y2K. A lot of the Y2K intermediation work was done offshore. I 
was asked if I was concerned about that, and my answer was, I 
am concerned about anybody patching systems regardless of who 
they are, because patches have a much higher bug rate, hence, 
vulnerability rate, than base code.
    So I think if we had the technology to examine any code, no 
matter where it was, for security and assurance, or vendor back 
doors which sometimes are put in for maintenance purposes, we 
would be in a lot better shape. And I would leave to 
professionals to understand how much greater the threat is from 
overseas.
    Mr. Sastry. If I could amplify on that, I fully agree with 
Dr. Bellovin. I think that one has to be worried about all 
software. And one of the problems about these complex systems 
has been that even though one can trust individual pieces, when 
you put them together, the overall systems tend to suffer from 
all kinds of problems. So I think that there are some glints of 
hope. But I think that the technologies for guaranteeing that 
software, whether it is written overseas or in the United 
States, is in fact more or less correct by construction, are in 
their infancy.
    One specific one that has come out of Carnegie-Mellon is 
called proof-carrying code. And this is the notion of providing 
code which comes with its own certificate so one can 
independently prove to one's self that it works the right way. 
The drawback has been that it is not scalable to large systems.
    Now, I think that there is an area of research about how 
you compose and put together large systems. And this is perhaps 
what we have to do on the fly today to reduce vulnerabilities. 
And so I guess there are no easy answers.
    Mr. Wolf. If I could add a comment to that. Really, there 
are two pieces to that. One is certainly the quality of the 
code. And as was referenced earlier, certainly there is a lot 
of buggy code out there. But the other is the trust factor. And 
when you think about the globalization of IT and the people 
that are writing code offshore now, there is a wide variety, 
many of whom you can say that we trust, and there are others 
that you might not have so much trust in.
    And frequently my organization is asked, for example, by 
law enforcement to look at code and say, is there a back door 
in this? Is there something malicious in it? That is a very 
difficult problem, and the tools aren't necessarily there to do 
that right now. And so that is the reason that we have talked a 
lot about the idea of a national lab that looks at software. 
Certainly, you know, the goal would be that you write codes so 
that up front the code is good and you have trusted code 
trusted modules. But in many cases we don't have that luxury. 
And if you think about the critical infrastructure of Wall 
Street or the power grid in the east coast, and you look at who 
wrote some of that code, you might be a little concerned.
    Ms. Lofgren. I am intrigued by this, and I don't know if we 
will have time for a second round. But I am wondering whether 
some of the research--I don't think that is a function you 
would want the Federal Government to provide, and yet it might 
work nicely with the research that is being discussed, maybe 
the test bed research that was referenced in the testimony, so 
that you might have--I mean, the last thing you want is the 
heavy hand of the Federal Government on the creative element, 
and yet we might want some way to examine and have a test bed 
research component for critical elements of the infrastructure.
    Is that sort of what the two doctors are proposing?
    Mr. Sastry. So, I think test bed research is really a lot 
of what is needed to take ideas from the research stage into 
systems that work. So, the specific kinds of test beds that I 
alluded to certainly for network defense, distributed denial of 
service and worm attacks, are coming in with an increased 
frequency. There are a lot of different solutions that the 
research community is putting out, but very few service 
providers have faith in them simply because they haven't been 
tried out on systems of adequate magnitude. So also in this 
software verification the questions of how much faith you can 
put in proof-carrying code, which is a piece of code that you 
add to a piece of software to check whether it is actually 
meeting the functions that it was supposed to and whether or 
not it has back doors.
    So I think that a test bed activity is one of the things 
that is needed to fill the chasm between research and what 
comes out of a university or what comes out of other research 
agencies, research groups, and products.
    And then the questions about the regulations. I think that 
while it is true that it is not completely clear whether one 
ought to be heavy-handed in the regulation, I do think that as 
in the Y2K case, the Federal Government had a very, very 
important role in 1997 by the SEC asking for companies to file 
their plans for what they were doing with Y2K.
    Ms. Lofgren. If I may. I don't disagree that the Federal 
Government must play some role. The question is, what is that 
role? And I think we have discussed many times, and I think 
there seems to be consensus among most of the members of the 
subcommittee, that a heavy-handed regulatory role is probably 
not the optimal role for the government to play, but there is a 
role for the government to play.
    Mr. Bellovin. There is a need for test beds. The 
fundamental problem of software is scale. We can do small 
things well, both developing and testing; we can't do large 
things well. That is where a test bed, an opportunity to try 
certain things at scale in an experimental setting would be 
very, very useful. And there are some things where it is easier 
than others. Network technology, it works better.
    Software. Most of the large software systems are developed 
by industry. A mass--a software project by definition is very 
many people over many years with real users and real changes 
over the life span. That is hard to put into a test bed. 
Nevertheless, an industry/government/academia cooperation is 
useful, because industry has the software that everybody is 
relying on, including the Defense Department. We are all 
running commercial off-the-shelf software for the most part, 
and we have to get this right to secure the critical 
infrastructure.
    Ms. Lofgren. I think I have more than used up my time, and 
I would like to thank the Chairman for his courtesy and yield 
back.
    Mr. Thornberry. The gentlelady is asking some very good 
questions.
    The Vice Chair of the subcommittee, the gentleman from 
Texas.
    Mr. Sessions. Thank you, Mr. Chairman.
    On behalf of this committee, as you have heard us say, we 
appreciate all three of you being before us today. I think this 
is an important exercise for this subcommittee and for our own 
knowledge.
    Mr. Wolf, I think I would like to direct my question to 
you, but I am not sure it would be limited to you. You speak 
very forthrightly and clearly about effective border 
protection. And, quite honestly, that makes my mind race. I am 
a free trader. I believe in goods and services and information 
flowing back and forth between countries. And I believe one of 
the most powerful parts about the World Wide Web is its 
availability to people for commerce and other activities. 
However, the need of this great Nation to protect itself and 
its intellectual property, its secrets, and other things that 
emanate from that is important also. And in my mind, I 
understand--I think I understand border, but I am not sure that 
I do, and it is because I really don't have a concept of where 
all these nodes are that bring traffic into this country to 
where they share our information.
    And standards body. When I was at Bell Labs, we were a part 
of a standards body organization for switch manufacturers.
    I would like for you, if you could, to perhaps go through 
in a detailed way about what you see as this border or cyber 
border. And are there things that we as this country should be 
doing, just like trade agreements, to say--or just like Customs 
would be at an airport in a foreign country or visitors coming 
to this country. Should we place a burden upon knowing who is 
coming here and where they came from? And I know this is hard 
on a real-time basis. Or even if just information that would 
travel with that packet that would comment about where someone 
originated. I think you see where I am coming from. Can you 
address that?
    Mr. Wolf. Okay. And I guess let me start by saying when 
they talk about border protection, you are really talking about 
protecting--if I can start, say, with your computer at home, in 
terms of having a firewall such that you can control in terms 
of who comes into your computer, who has access to the 
computer, the kinds of things that come in and go out of your 
computer. So that is not restricting you from going to anywhere 
in the world, okay, to look at something on the Internet. But 
it is meant to stop a hacker, for example, from coming into 
your computer and stealing your tax information. So we talk 
about firewalls. And firewalls have a set of privileges that 
you can identify with them in terms of how strict and how high 
up you want to put the wall, if I can say it that way.
    We also talk about intrusion detection systems. So now if 
you go a little further out from, say, your home computer and 
you want to develop a profile of what kind of activities are 
coming across that boundary, looking for hackers, for example, 
that is kind of what we would call border protection. In terms 
of looking for malicious activity, threats, hackers, whether 
that is a terrorist, a nation state, state, whatever. So you 
are, if you will, protecting your computer environment, 
protecting cyberspace.
    Now, if you take that a little further to the borders of 
the United States, that would be a very difficult task to put 
up, if you will, some kind of protection around the United 
States, and probably not necessarily a good investment. But you 
certainly would want to put sensors maybe on the periphery of 
the U.S. again to look at hackers, to look at people trying to 
come in to do malicious things to you, and to look also at 
maybe data that is leaving the U.S. the idea of--and I talk 
sometimes, and I think in my testimony talk a little bit about 
the insider. You know, is there information leaving a facility 
that you wouldn't want to leave? Is somebody on the inside 
pushing information out to another entity?
    So when we talk about border protection, we are really 
talking about how do you protect your enterprise, what kind of 
protections do you put around it so that somebody can't come in 
and do something malicious to your enterprise? So, not really 
restricting in terms of, you know, the Internet as a whole, but 
it is more the protections that you want to put in to make sure 
that somebody isn't doing something malicious to you.
    Mr. Sessions. So the border could mean any individual 
computer as opposed to in the border I was describing as the 
United States of America?
    Mr. Wolf. Yes. So we are not necessarily talking 
geographic. In DOD, we have something called ``defense in 
depth,'' and we talk about the enterprise level, the 
information backbone. There are several levels that we talk 
about in terms of doing protections. So it is not necessarily a 
physical boundary in terms of around the United States. 
Although there may be something in terms of implementing a 
network of sensors to look for hackers, to look for kinds of 
activities, malicious activity. That may be something that we 
want to do.
    Mr. Sessions. Okay. Any of the other gentlemen choose to 
speak?
    Mr. Bellovin. Yeah. I am in favor of border protection to 
the extent it is possible; I was the author of the first book 
on firewalls in 1994. But it is a much more challenging problem 
today than it was in 1994, because the amount of 
interconnection has increased tremendously. A modern 
corporation will have hundreds to thousands of external links 
that penetrate its firewall to its outsource functions, to its 
joint venture partners, to its customers, to its suppliers. All 
of this is done electronically, and all of this is done by 
means of mechanisms that bypass the firewall, go through the 
border.
    In other words, we have many more border crossings than we 
do today. The virtual private network technology that lets me 
work from my hotel room exactly as if I was inside my office at 
AT&T works very well; but if the same employee who is 
telecommuting via VAN is using that same computer to surf the 
Internet individually, we have a problem because we don't have 
an effective border. We are moving more towards a motel rather 
than a hotel model. In the hotel, there are one or two 
entrances and everyone is walking past the front desk. In the 
motel, every room has got its own door to the outside. It is a 
lot harder to secure that, and we are moving more towards that 
ladder. We have to find a scalable solution to let us protect 
all of these doors.
    I would note that tracing things, where they are coming 
from outside the country, is a lot harder. The hackers don't 
use their own computers for the most part. They use their own 
computers to hack an easy target, maybe in a university 
someplace or a small company, and use those to hack a few more. 
Five levels away, that is where they will launch the attack 
from. The attack may be coming from inside or the outside, but 
you don't know where the controlling messages came from. And 
that is what makes it so hard to trace back these things. 
Authentication credentials, they are stealing the credentials 
identity today. It would be very hard to fundamentally 
reengineer things to get around that.
    Mr. Sastry. I share you sentiments about being open enough 
to, A, have IT products come into the country, and also for us 
to be able to sell IT products in other parts of the world. And 
so I think that open standards, which I think is one of your 
concerns, are in fact better than standards where one erects 
barriers.
    But having said that, I think that one does need to have 
the sense of being able to dial up and down security so that 
even if you did have this motel model and sometimes--and 
physical security with different threat levels and being able 
to dial up and down security depending on your perception of 
how threatening the environment around you is, the questions of 
how to do this are I think are open research issues.
    Also, I think that the questions about being able to trust 
software, I think it is easy to trust individual pieces of 
software and to be able to test individual pieces of software 
regardless of where they are written.
    On the other hand, the problems are about what happens when 
you try to compose them. And the biggest single problem is when 
you put together complex systems--and people inevitably build 
complicated systems for reasons of functionality--that is when 
we really don't have guarantees both in security and also in 
privacy because of the kinds of data sharing that occurs across 
large systems.
    So coming back, I think in the earlier parts of our 
testimony both Steve and I, Steve Bellovin and I, agreed that 
really sort of the bottleneck problem is to be able to compose 
secure systems so as to guarantee that the overall system 
works. And I think that the way to do that is not actually to 
stop people from sending software in or for us to be able to 
sell overseas.
    Mr. Wolf. And if I could add one more comment. We talk 
about border protection and firewalls. You also need to think 
about what functions you want somebody to be allowed to do on 
your computer. So it is not just put a border up and protecting 
it, but it is what do you want them to do. Do you want them to 
be allowed to look at Web pages? Do you want them to be able to 
move files around? So there is a whole set of things to go 
along with that. So it is sort of the motel model in terms of 
defining what you can do in the motel.
    Mr. Sessions. I appreciate that, gentleman. That obviously 
led me right to what Mr. Wolf was talking about, and that is 
our own systems is our border. And I appreciate the discussion. 
I yield back.
    Mr. Thornberry. I thank the gentleman.
    The gentleman from Rhode Island, Mr. Langevin, is 
recognized.
    Mr. Langevin. Thank you, Mr. Chairman. I want to thank 
members of the panel for being here, and your testimony, and 
really some of the questions I have prepared you have 
addressed. But I would like to give the opportunity to expand 
on them a little more. And I will start with asking if you can 
discuss whether there is sufficient information sharing taking 
place between researchers who discover most vulnerabilities and 
the companies who created the products and the DHS. And also, 
how could the government help to foster an environment where 
researchers and companies could better work together?
    Mr. Langevin. And then, expanding on that point, what do 
you see as government's role in terms of increasing security 
and standards setting? Should it be fostered through 
partnerships and purchasing criteria, or should we take a more 
active role? I know you discussed this a bit already, but if 
you can expand upon that. And basically would government-
mandated standards, such as the common criteria, be a baseline 
or hindrance for future innovations? If you could take a crack 
at those, I would appreciate it.
    Mr. Bellovin. When it comes to vulnerability reporting, 
there is pretty good cooperation between the people who find 
the holes and the vendors. There is sometimes an unrealistic 
expectation of how soon a problem can be resolved. More 
responsiveness, at least acknowledgment, would certainly help. 
I think it is cases of people getting frustrated at reports 
being ignored. In general that is a path that works well.
    Sometimes people have unrealistic expectations about what 
can be done. You know, the problems are generally subtle, or 
they wouldn't be there in the first place.
    For standard setting, I would suggest the procurement model 
is much better. We don't know exactly what we are doing. There 
is a saying, if we know what we were doing, it wouldn't be 
called research. And to try to mandate certain things is 
probably premature given the state of the art. The Common 
Criteria is a useful step forward. As an NRC report a few years 
ago pointed out, it doesn't really address a lot of the 
software models we are dealing with today. It is also extremely 
expensive to produce software that meets these criteria and can 
continue to meet these criteria over the life cycle of the 
hardware and software platform.
    This has tended to make such systems slower, much less 
modern, and much more expensive than the commercial off-the-
shelf alternatives, which has generally led people to buy the 
commercial off-the-shelf alternatives, because they don't 
perceive the threat, there is no particular push back, no 
incentives, as I said earlier, for people to install the more 
secure software in most situations.
    Mr. Langevin. Okay.
    Mr. Sastry. I share a lot of the comments made by Dr. 
Bellovin.
    Let me talk a little bit about the information-sharing, 
which is one of your questions. I think that information-
sharing is an important step. The ISACs are certainly an 
attempt to try to get information-sharing across industry 
sectors.
    My perception is that there is a lot of concern in industry 
about sharing this information, partly because there isn't a 
lot of sensitivity about how this information would be 
protected by FOIA requests. Of course, there are ways, there 
are other transactions, authorities and other procurement 
mechanisms by which this information could be protected. I 
think industry needs to be sensitized to the fact that they 
can, in fact, share this information without its being open to 
public scrutiny.
    My sense also is that there is a certain amount of funding, 
and I think the Federal role in being able to smooth this 
information-sharing is not to be underestimated. I think that 
there is a sense that a lot of especially small companies feel 
that they are sort of doing that on their own dime. So I think 
that if they had a greater sense of feeling protected when they 
shared the information, and also they were given some help, 
some financial help, for sharing this, I think this would go a 
long ways to where it is helping the ISACs.
    Mr. Langevin. Could you expand on that. How we do that? How 
we foster that?
    Mr. Sastry. I think there are mechanisms inside DHS, and I 
think there are questions of appropriation of a certain amount 
of resources simply for the ISACs. And the other transaction 
authority is simply the contractual mechanism that can be--that 
can be chosen to be exercised by the Department of Homeland 
Security to actually protect the information from FOIA 
requests.
    I think they have the--I do think that they have the OTA 
authority to do so. The telecom--and the telecom folks that we 
talked to at BellSouth and others were really quite concerned 
about being sort of reassured about this, partly because this 
OTA is not a well-known contracting instrument, and people 
don't know all of its possibilities, I guess.
    Mr. Langevin. Thank you.
    Mr. Wolf. A major part of my mission, if you look at my 
mission statement, is to discover vulnerabilities, because my 
job is to provide secure systems for the national security 
sector. So we put a lot of effort into discovering 
vulnerabilities. And we work very closely with industry. We 
work very closely with academics in terms of how we do that.
    We have various reach agreements such that--with various 
companies, they are called CRADAs, cooperative research 
agreements, so that we get access, for example, to source code, 
and again, with the idea of how do you improve the source code 
to improve the security. When we find a problem, we go back to 
the company, we explain what the problem is, and in many cases 
provide them some of the technology to help improve their 
product, because, again, we are trying to build product.
    That is my main goal is to get product out there for the 
national security sector. Of course, the byproduct of that is 
it is dual-use technology. So anything I provide to national 
security in many cases can be applied other places.
    So I would say there is a very close relationship in terms 
of working with industry on that. I can probably go through 
many, many examples of successes that we have had in that area.
    You mentioned about security settings and benchmarking. I 
think that is a very, very important thing. I mentioned that in 
my testimony in terms of how do you configure things out of the 
box so that they are very secure. And we are very active in 
that particular area. Common criteria is something that we 
strongly support. We put a lot of effort into common criteria.
    Common criteria, what it does is it is really, I will say, 
raising the bar, if you will, in terms of information 
assurance. It is not the ultimate answer, it doesn't make it 
perfect, but what it does is it does put products through a 
fairly rigorous testing for certification, so that given a set 
of functions that the product is supposed to do, that you have 
demonstrated that it does do those functions under certain 
conditions.
    Now, again, it doesn't solve all of problems, but it does 
raise the bar. And common criteria probably needs common 
criteria 2, some additional things to common criteria. And I 
share the comments and agree that common criteria can be a 
little expensive for companies, and that is something we are 
also trying to work in terms of how we can improve either the 
timeliness of things getting through the process, or how we can 
do something in terms of helping in terms of financially. But 
that is a difficult problem to resolve.
    We have reached out to homeland security, in particular Bob 
Liscouski in the IP, and have talked to him about working with 
us in NIAP and how we can leverage the kinds of things that he 
needs to do with the national security sector. So together what 
we do is we come to the table with a larger, if you will, 
market share. If we just looked at the national security 
sector, that is not a big sector in terms of many of these 
products. So in terms of getting the things through common 
criteria through NIAP, if there is homeland security and 
national security, that makes it a much larger market, and 
makes it more cost-effective in terms of a company going 
through that and getting that process done.
    I guess the other question was about mandated standards. I 
don't believe we should mandate standards. We should establish 
standards. We should sort of recommend standards. But I think, 
you know, one of the problems with standards, and I certainly 
see it in my sector, we have everything from a small military 
installation with a small requirement to some large network 
like the SIPRNET, and to try to mandate one standard in those 
two extremes is very, very difficult for anybody to meet.
    So I think you want to establish a set of standards, 
recommended standards, and do it that way rather than make it 
mandatory, because one size does not fit all.
    Mr. Bellovin. Let me echo that. It if was that simple to 
ship a secure system, Microsoft and Sun Microsystems and 
everyone else would have done it years ago. How you use, how 
you configure a network or system depends on its purpose. A 
laptop that is used for text editing and e-mails has very 
different configuration requirements than a software 
development machine, which is very different than a Web server, 
which is very different than a database server and so on.
    There are about as many different uses of computers and 
configurations as there are computers, and one size does not 
fit all.
    Mr. Sastry. If I may just respond to your question of 
partnerships. And now I will sort of take the academic. I think 
the problems, the research problems and the development 
problems, are really too large for just about any group in this 
Nation. So I think it is especially important for research 
groups to work in teams. And at Berkeley we have really found 
it very, very important to collaborate with large numbers of 
research groups across the length and breadth of the Nation.
    The questions are then about what facilitates this 
collaboration is really at the academic, at the research level, 
that we have open standards where we don't use IP protections 
inside universities for protecting the kinds of software and 
systems research that we do, but at the same time we allow for 
industry partners to be able to uptake that information and 
take it out of the open source development, and then take it 
and encapsulate it into their products. And so, for instance, 
in sort of a research center and trust, which we are doing with 
Stanford, Carnegie Mellon, Cornell and Vanderbilt, we have 
found it very important that we voluntarily have adopted an 
open source IP policy amongst ourselves, while making sure that 
the companies, the industrial partners, can actually take the 
open source materials that are created, the secure trusted 
systems that are created, and then go take it into their 
proprietary products. That is sort of something that I think 
that the research sector can do in this particular space.
    Mr. Wolf. One of the exciting things that is happening in 
NSA right now is that--.
    Mr. Thornberry. The gentleman from Rhode Island elicited a 
host of interesting responses, which we certainly may want to 
pursue, but in the interests of time, let me turn to other 
Members, because we have gone well over double the 5 minutes.
    Mr. Langevin. I thank the Chairman for his latitude in 
allowing the panel to answer.
    Mr. Thornberry. I appreciate the gentleman's questions. 
Excellent questions.
    Does Chairman Cox wish to ask questions at this time?
    Mr. Cox. I do. Thank you, Mr. Chairman. I wonder if I could 
ask Dr. Sastry and Mr. Wolf whether you agree with the 
statement made by Dr. Bellovin in his testimony that when it 
comes to cyber, most basic research is being done in our 
universities. Is that your opinion as well?
    Mr. Wolf. I would--
    Mr. Sastry. I am sorry?
    Mr. Cox. If you could not hear the question, I am asking 
whether you agree with Dr. Bellovin's assessment that when it 
comes to cyber, most basic research is being done in our 
Nation's universities?
    Mr. Sastry. I would say so, even though there are pockets 
of excellence in industrial research labs as well, such as Dr. 
Bellovin's group itself.
    Mr. Wolf. I would disagree. I would say it is done in many 
places. Cybersecurity covers--there are many facets to that. I 
would point to DARPA, I would point to NSF, I would point to 
some of the things that NSA is doing. I would point to the 
national labs. There is some very interesting work being done 
in the national labs in cybersecurity. Again, some of that is 
classified research, so everybody doesn't necessarily get to 
view that.
    Certainly in the academic areas, there is lots of work 
being done, and we partner with the academics, so it is being 
done in many places. I don't think there is one area that--one 
organization that you can point to, one entity, and say that 
they are doing most of it.
    Mr. Cox. Well, I ask the question not because I think that 
Dr. Bellovin would disagree with anything that you just said, 
but because I think, Dr. Bellovin, one of the points that you 
are making is that it is--that we know essentially where the 
researchers are, and that it is difficult to scale up; that we 
can throw a lot of money at this, but we also have to spend 
just as much time thinking about which direction we are going, 
because we can't make it up on volume. We are not going to be 
able to reproduce all of this. Is that a fair statement of your 
point, Dr. Bellovin?
    Mr. Bellovin. Yes, that is it basically. I am not saying 
there is no basic research. There is certainly a very large 
need for applied research which does go on very many places. 
But university research can't be scaled up, basic research 
can't be scaled up by too much, because there aren't the people 
to do it yet.
    Of course, these are the people who are training the future 
generations of researchers. So it is very important that we 
encourage this, because it is not a problem that is going to go 
away any time soon.
    Mr. Cox. Well, taking that point, as supplemented and 
augmented by Mr. Wolf's comments, and we are well aware that we 
have the Federal piece, some of it is not public, so maybe our 
estimates of whether majorities here or there might even be a 
little soft, we are going to--I am going to infer from this, 
and this is the premise of my next question, that we are going 
to need to rely on our Nation's universities for some of the 
big objectives that we are attempting to tackle here, that this 
is going to be a partnership, and the Federal Government is 
going to partner with our universities.
    And then that takes me to, Mr. Wolf, your next point, and 
our Ranking Member Ms. Lofgren also questioned you about this a 
little bit, and that is our need to focus on U.S. technology, 
and whether this is possible if we have open standards, if we 
have a lot of people participating, if we are using the private 
sector as well as universities, it is not all in a black 
program in the Federal Government; is it realistic to assume 
that this is possible?
    Mr. Wolf. Well, I think it would be difficult to say that 
we would use all U.S. That wasn't my point. My point was really 
that there are certainly critical areas where you want to have 
a good control of, you know, your hardware and your software, 
maybe in a critical infrastructure, certainly in the national 
security sector.
    So if you have a system, you may want to look at certain 
areas and put better controls over the--I will say both the 
quality and the trustworthiness of the software. My comment 
about, you know, national software assurance laboratory, that 
may be a way of taking software, wherever it is written, and be 
able to validate it and say, yes, this is trusted software. The 
world right now, we are--IT is globalizing. Lots of work is 
going offshore. The U.S. cannot do everything. As I say, it is 
globalizing.
    So it is a matter of how do you look at software code. How 
do you validate it? How do you say you trust it? So whether it 
is U.S. or foreign written, it is really a question of trust. 
How do you establish trust in the software to make sure that it 
really does what it says it does? So it is not only the 
quality, but also the trusthworthiness.
    Mr. Cox. To the extent that our focus is on firewalls, or 
at least on that genre of technology that is meant to help 
networks resist attacks, an additional reason besides our own 
homeland security that we need to be concerned about theft, 
about penetration of these programs is that other nation states 
who are wary of the Internet, don't want their citizens using 
it, and who are using black boxes and firewalls to prevent 
their citizens form having access to the outside world would be 
thrilled to lay their hands on the most sophisticated 
technology that we have developed at taxpayer expense in order 
either to prevent their citizens from having access to the Web, 
or to trace the behavior of their citizens so that when they 
are doing things on the Internet that the government doesn't 
approve of, they can land them in jail.
    What can we do, therefore, to focus on security of the 
tough measures that we are trying to develop in our own 
country? And for this purpose I include both cybersecurity and 
physical security. And I address that to all three members. My 
time has expired. I thank the Chairman.
    Mr. Sastry. So your question is really quite interesting. 
Let me first talk about security and privacy. So the questions 
about building in privacy with--strong privacy with strong 
security, my own sense is that the kinds of technology 
solutions that help foster strong privacy include things like 
audit, include things like watching the watchers to try to 
determine who is watching what; also, these questions of 
selective revelations, which means that queries are answered 
narrowly so as to selectively reveal information little by 
little rather than have access to a lot more than is asked for; 
and then finally the questions about being able to understand 
if certain privacy standards are being met, and there are a 
host of new technologies, such as encrypted queries, crypto 
protocols is what they are called, for being able to enforce 
that.
    So I think that in terms of taking worldwide leadership, I 
think we can really build in strong privacy into our strong 
security solutions. And then, of course, the questions of how 
this may be used overseas, of course those are much more 
complicated ones, but nonetheless we will have products which 
have strong privacy safeguards build into it. So, I think that 
this is one thing that we can do to sort of foster our ideals, 
while providing strong security.
    And I think that this message is somehow a little different 
from a message which says that you have to give up privacy in 
order to get security, because the technology indicators are 
all that--in fact, they are mutually reinforcing, rather than 
one at the expense of the other.
    Mr. Wolf. Not necessarily a complete answer to your 
question, but certainly one of the things is--at the national 
security sector is that we do have levels of protection that 
you put into various systems. So, for example, levels of 
encryption, where you have the--I will say the high-grade 
encryption, which is for the most significant and the most 
sensitive communications, where you may have over levels of 
encryption that aren't quite as good, but are still adequate to 
protect the information.
    So you can think of that in terms of the products that we 
are putting out. You may have a higher level of protection in 
terms of protecting the power grid in a product than maybe the 
general product that would be available that would be sold 
overseas. So there are ways that you can do them.
    Mr. Bellovin. The firewall technology, one of the 
criticisms of firewalls is that they assume that everyone on 
the inside is a good guy, is following the rules. This is a 
problem in industry as well. But in terms of the model you 
speak of, with repressive governments trying to isolate their 
citizens from the Internet, in that case it is the people on 
the inside who are actively trying to get around the firewall 
technology. And firewalls are not very good at that. There are 
some that do better than others.
    We are better off with strong firewall technology to 
protect ourselves with multiple overlapping layers of defense 
in depth to prevent people from the outside getting in, using 
overt mechanisms to provide insider behavior, ones that don't 
scale to a whole country, whereas outbound traffic is 
relatively unrestricted, and you rely on internal auditing. 
That, I think, would not pose nearly as much of a threat of 
being used by repressive governments to keep their own citizens 
from accessing the Internet. So I don't think there is any 
particular conflict there.
    Mr. Cox. Well, I am happy to hear that.
    Thank you, Mr. Chairman.
    Mr. Thornberry. Thank the Chairman.
    The gentleman from North Carolina.
    Mr. Etheridge. Thank you, Mr. Chairman. And let me thank 
you and the Ranking Member for this meeting, and for our 
distinguished guests for being here today. It has been very 
interesting thus far, and I appreciate that.
    Gartner, Incorporated, a respected IT consulting 
organization, has estimated that about 90 percent of the cyber 
intrusions could be avoided if individuals and companies 
consistently maintained the security of their computer systems 
by monitoring use and installing software patches to identify 
security flaws.
    Number one, do you agree with that? And, number two, do you 
believe that software vendors could make security maintenance a 
little more user-friendly? If each one of you would just touch 
on that.
    Mr. Bellovin. I would guess that it is more like 95 to 98 
percent than 90 percent. I very much agree with that statement. 
But, as I indicated in my written testimony, patching systems, 
especially production systems, is a much more challenging thing 
than it should be. I will not update my PC after about April 
1st until I have filed my taxes, because I can't take the risk 
of some unrelated change disabling the tax preparation software 
I use. And you have got that problem in spades if you are 
running a corporate Web server, a major corporate or government 
database and so on.
    As Dr. Sastry has indicated, the composition of systems, 
the components of complex systems working together properly is 
a very, very difficult and unsolved problem. We don't know how 
to do this. This is why patching is so hard. It is not that the 
administrators are irresponsible, or that the vendors haven't 
supplied good tools, it is that we don't know how to do it 
easily, reliably and without breaking something else.
    Mr. Sastry. Mr. Etheridge, if you were like me, when you 
are installing a computer and you have all of these queries 
which say, will you do this, will you do this? I think 
everybody's tendency is just to press, yes, yes, yes, or no, 
no, no randomly. So I think what you are alluding to is a big, 
big hot-button item.
    So people talking about human computer interaction. So I 
think the notion of human computer interaction for security to 
make it easier for people to actually understand what they are 
doing and be able to configure their systems is--I think is a 
vast and rather untapped area of research in cybersecurity. If 
anything is needed right away, it is one of those for the--and 
I agree with your statistics, too.
    Mr. Wolf. Operationally my organization does red-teaming, 
which is an organization that tries to penetrate networks. So 
we have customers in DOD that ask us to go look at their 
networks and to see if we can get into them. And I can verify 
that your 90 percent is probably correct. It is the networks 
that haven't been properly patched, configured properly. We 
look for those kinds of things. That is usually the door that 
we get in.
    If I look at the statistics that come out of the defense--
of the DOD networks, that come out of the JTF-CNO, I think 
their statement is it is about 90 some percent of the attempts 
to hacks are really trying to get at things that haven't been 
patched properly.
    In my testimony I talked about automatic patching and how 
that is a significant research agenda item. I believe that 
needs to be done. How do you make patching much easier for the 
system administrators? They are overwhelmed with the number of 
patches and problems and configuration settings that they have 
to do every day. And the idea of having preconfigured systems 
coming out of the box that are security-conscious in terms of 
here are the right settings, I think, is also another step 
forward.
    Mr. Etheridge. As you have noted before, and others before 
us, that the government, universities and the industry need to 
encourage more students to get into math, science and all of 
the science areas of technology in order to produce more 
graduates who can deal not only with cybersecurity, but with 
this whole issue of technology that we are dealing with.
    And let me go to each one of you on this one, starting with 
you, Dr. Sastry. Is the academic community acting in a way in 
retaining the number of scientists needed in the research area 
as it relates to cybersecurity as we look down the road, and, 
more specifically, making these systems more user-friendly? 
Because I think that is the key to getting the security.
    Mr. Sastry. Sir, it has been recognized that human computer 
interactions for cybersecurity is something that we need to 
focus on. The realization has kind of surprisingly recently. So 
in some ways the work is only now beginning.
    The questions about training the workforce, I think these 
are very, very--this is a really a very important item for us, 
because security, of course, depends on making sure that the 
entire populace is educated about all the needs of 
cybersecurity, because, of course, it is only as strong as the 
weakest link. I think that there has been in the last 2 years a 
shift in enrollments. I am in an electrical engineering 
computer science department. So there has been a shift away 
from computer science towards computer engineering, which in 
some ways is encouraging, because it does encourage people to 
now start thinking about information technology as a technology 
that is woven into the fiber of our everyday life and into our 
societal scale systems.
    But other disturbing trends are that the percentage of 
women that are coming into electrical and computer engineering, 
we have actually given up the advances that we made in the mid-
1990s in the last 4 or 5 years. That indeed is subject for 
concern; so also with other segments of the population. So at 
Berkeley, we have actually started going out and visiting high 
schools to try to get them thinking about cybersecurity already 
in high school, and certainly in Oakland and San Jose and all 
of the neighboring schools. So your remarks are really on 
target for our priorities.
    Mr. Etheridge. Thank you, sir. I see that I am out of time. 
But I would be intrigued, because I think it is important in 
every area of industry as well.
    Mr. Bellovin. I don't have anything to add on that.
    Mr. Wolf. I was just going to comment on our outreach 
program to educational institutions. We have the Centers of 
Excellence. We have 15 universities have an IA curriculum. We 
work with the service academies. We are currently starting to 
do some things at the community college level, sort of what you 
were saying in terms of kind of moving up through the lower 
levels up through the universities. We clearly need to make 
more people aware of IA in terms of things that need to be 
done.
    Mr. Etheridge. Thank you.
    Mr. Thornberry. Thank the gentleman.
    The gentlelady from the Virgin Islands, Dr. Christensen.
    Mrs. Christensen. Thank you, Mr. Chairman. I don't expect 
that--I want to thank you for this hearing as well. I am 
becoming better informed on the area of cybersecurity, although 
I am still far from being an expert. My questions are going to 
be a little different.
    Dr. Sastry, in your testimony, you talked about whether the 
Federal Government would play the role of market maker and 
asked was there sufficient demand to stimulate new companies 
around ideas. It would seem to me that a fairly sizable demand 
would be in the private sector, and incorporations for security 
and for cybersecurity.
    We recently did Bioshield to encourage and expedite the 
development of countermeasures for bioterrorism agents, which 
will involve a significant expenditure on the Federal 
Government's part. Do you foresee in the area of cybersecurity 
that the Federal Government would have to provide most of the 
funding, or do you see that there is really a sufficient demand 
in the private sector that there would be more cost-sharing on 
the private side, and there would seem more diverse use, other 
than for homeland security, for government use in these kind of 
products?
    Mr. Sastry. Thank you very much for your question. I think 
that the big market, of course, is in the private sector. And 
the big market is in the infrastructures which are certainly 
not owned by the Federal Government, which are privately owned.
    The question, of course, has been about jump-starting this 
market. So, just to give you an example, there has been a big 
buzz in the venture community about investing in security for 
the last 2 years. But, on the other hand, a number of the 
portfolio companies that come out of the venture community 
actually have not had a stream of revenue in secure products. 
So our sense is that since the Department of Homeland Security 
itself is committed to, in its Border and Security 
Directorates, IAIP Directorates and the Emergency Protection 
Directorates, to buy secure products, our sense is that having 
this--having this sort of as a badge to distinguish these 
products will actually jump-start the market in the private 
sector.
    I think my own expectation is that that would not--it is 
not something that one ought to or perhaps could subsidize. On 
the other hand, I think that if one--when I said a market 
maker, it was just a question of jump-starting the market by 
adopting certain sets of secure products in the beginning.
    I think the same--and the model, again, is a little bit 
like the DOD model. So the Internet actually grew from the 
ARPANET being used for certain DOD applications, and then sort 
of everybody else sort of jumped onto it, and so also for high-
performance computing, which resulted in PCs. So that is sort 
of the market-maker analogy that I was using.
    Mr. Bellovin. I would agree that much of the funding and 
energy has to come from industry. The Government's role is to 
create the appropriate incentives. If you look at the history 
of, say, cryptography, there is 100 to 150 years' worth of 
experience of people saying, I have got a really cryptographic 
solution and then going bankrupt because nobody wanted to buy 
it, because they didn't appreciate that they actually needed 
this technology.
    We are sometimes seeing the same thing in the computer 
security community today. There are solutions that have not 
been adopted by corporations that don't perceive the threat. It 
is only in the last few years that more than, say, the 
financial community and the military have really begun to 
realize that there is a real threat out there, and a real 
market.
    I note in the last year or so Microsoft has finally gotten 
religion about security and started to take some very admirable 
projects and efforts, from what I have heard, internally, doing 
a very nice job. But it is going to take years for this to have 
an effect. But the real question, and this is the role for 
government, is to create incentives for corporations and 
government agencies to start thinking about security when they 
design systems and when they procure systems, creating the 
incentives for them to do so. That is a difficult problem, but 
that is a role for government.
    Mr. Wolf. I would agree with some of the things that have 
been said so far, but I would sort of focus a little bit on the 
global IT, the amount that is being spent in the U.S. 
Government on IT, the amount that is being spent on information 
assurance kinds of products.
    Mrs. Christensen. Can I just interrupt your answer to just 
add, that I understand that less than 1 percent of the science 
and the technology budget, or about $80 million, is being 
directed to cybersecurity and R&D. Is that adequate? Could you 
also--.
    Mr. Wolf. I am sorry. Say that again.
    Mrs. Christensen. I understand that about $80 million is 
directed to cybersecurity R&D in the Science and Technology 
Directorate budget. It seems like you were going to talk about 
the amount of government spending. This is in the Department of 
Homeland Security.
    Mr. Wolf. Okay. I am not--
    Mrs. Christensen. Could you also respond to whether that is 
adequate?
    Mr. Wolf. I think we need to be spending more money in 
research really and in cybersecurity. I think there is a lot 
more things. I think we are underfunded in many areas.
    The comment that I was going to make is that, you know, we 
have tried to move from a demand--or a supply side to a demand; 
that customers are educated in terms of information assurance, 
in terms of cybersecurity, and they are looking for products 
and demanding products, that they actually need them.
    That is one piece. The other piece is the idea of maybe 
looking at insurance. If you look at a facility in terms of you 
evaluated it, is it certified, and then there is an insurance 
break that goes along with the corporation that, quote, has 
good system administrators, they have gone through some 
certification process, you have a reasonable architecture, that 
is a way in terms of--rather than overregulating or enforcing 
standards--that you indirectly, okay--you can create more of a 
demand for the products.
    Mrs. Christensen. Thank you.
    Thank you, Mr. Chairman.
    Mr. Thornberry. Thank the gentlelady.
    The gentleman from Kentucky Mr. Lucas.
    Mr. Lucas. Thank you, Mr. Chairman.
    This is a hypothetical, sort of a holistic, big picture 
question. I would ask each of you to comment on this. Let's 
assume for the moment that you have been put in charge of 
cybersecurity for the Federal Government, Homeland Security, 
and have you been asked to prepare a budget for that job, to do 
an adequate job, and that you submit this budget, and you get a 
third of that budget, one-third of the money that you think you 
need. I would ask you how would you prioritize what you would 
spend that money on, if you only got a third of the resources 
that you felt you needed to do the job. I would like for each 
of you to answer that.
    Mr. Bellovin. Well, if you are talking about operational 
networks, I would first put money into systems administration, 
because, as we said, 90 percent of the attacks are from known 
holes that haven't been patched. That would be my first 
priority, to improve the resources for system administration 
and what they need to do the job. Past that, for research 
funding, I would start to focus on composition of secure system 
development.
    Mr. Sastry. I understood your question to be about research 
money. Of course, for the operational aspects, I would fully 
agree with getting systems administration to the fore and 
empowering systems administrators to be more involved in 
decision-making.
    For the research money, the way I see it, it is sort of a 
world of networks and systems. One has got to protect the 
systems of the computers, the networks on top of it, and then 
finally coalitions of systems on top of it. So I think that if 
the research money was cut in a third, I would make sure that 
there was coverage at every one of those levels, at the level 
of individual systems, at the level of networks, and then, of 
course, at coalitions, of groups of users.
    Having said that, I think then the question about a few 
areas to invest in, I think there the notion of how you build 
complicated systems which are trustable from pieces that can be 
trusted, which is the composition that we keep coming back to, 
needs to cut across all of these layers. Then I think the human 
computer interaction question that Mr. Ethridge raised, I think 
that is equally important to me.
    And finally, the third thing I would do would be the test 
beds to make sure that the research got out to companies that 
could then sort of produce product.
    So those are sort of a matrix. I would make sure that the 
network systems are all populated, and then the three areas--
those would be my three pet areas.
    Mr. Wolf. I would start, I agree with the operational 
aspects, to make sure that your operational pieces were secure. 
So it is the system administrators, it is the patches, it is 
the kinds of things that we have talked about so far.
    The second area that I think I would look at would be sort 
of my--I will call it my infrastructure. Given that I only have 
a third of the budget that I need, I would look at my 
infrastructure and try to build an infrastructure that I could 
then build on in the future, so--as you get your funding for 
the following years. So, if you want to call it--maybe it is 
the--I won't say the key management infrastructure, but it is 
the PKI, it is the kind of things that you could then build 
tools and techniques and products and services on in future 
years. That would be my second area.
    And the third, I think that I would take a step back, and I 
would look at all of my systems, my networks, my--whatever my 
operation is, and I would try to identify what are the most--I 
will call them the critical areas and apply the dollars to 
those as maybe the third venture there.
    And, of course, I would also put a piece to research, 
because I think a lot of times we are very short-sighted when 
funds are cut--I worked for the government for many years--that 
we tend to cut the research piece. If you tend to favor the 
operational piece, but the research piece is your investment in 
the future. If you don't put dollars towards that, then 5 years 
from now you will be dead in the water.
    Mr. Lucas. Thank you very much, Mr. Chairman. We have got a 
vote coming up, so I will stop there.
    Mr. Thornberry. The Chair appreciates the gentleman.
    Does the gentlelady from Texas have questions she would 
like to ask?
    Ms. Jackson-Lee. Thank you very much to the Chairman and 
the Ranking Member for holding this hearing.
    Mr. Chairman, I ask unanimous consent that my statement be 
submitted into the record.
    Mr. Thornberry. Without objection.
    Ms. Jackson-Lee. I appreciate the testimony of the 
witnesses and their indulgence. I am in a Science Committee 
mark-up that is going on simultaneously, and so I thank you 
very much for your patience.
    I just want to focus in one area very quickly. We do have 
votes on. That is the need for the prominence of cybersecurity 
issues under the Department of Homeland Security. And what we 
have noted is that the funding has not been where we would like 
it to be. A Director has not yet been appointed. It all 
suggests that we need to refocus our attention on this area.
    So if you would answer these questions quickly, I would 
appreciate it. One, my understanding is, or my sense, that as 
we are going into the 21st century, Y2K we were all focused on 
what technology, Internet, could do to this Nation. Literally 
we were in a panic about it being able to stop us in our 
tracks. After 9/11 we began to focus on some very real concerns 
about security.
    I don't know where we placed the need and the focus of 
security in this instance, cybersecurity, inasmuch as we are 
still in the same boat, that the--the attack on our security 
infrastructure, our technology infrastructure could bring this 
Nation to its knees. So my question to you is have we focused 
enough?
    The second part of it, with respect to research, have we 
expanded it enough? I believe we should start expanding our 
reach to universities around the Nation, research entities 
around the Nation, and as well make sure we include Hispanic-
serving institutions, historically black institutions, Native 
American-focused institutions, and others in areas that can 
address the questions of urban and rural security as relates to 
technology.
    And if you would answer those questions, I would appreciate 
it very much. And I thank the gentlemen for their testimony.
    Mr. Sastry. You have certainly hit the issues that are most 
important to the research community. Our sense, too, is that it 
would be useful to have a focused Federal effort in 
cybersecurity research, and a focused effort which, in fact, 
involves groups of institutions across the length and breadth 
of the Nation.
    There is a very, very substantial educational agenda, and 
the educational agenda does indeed need to reach out to every 
corner, as you have correctly pointed out. I am in complete 
agreement.
    Now, the questions about--I do believe that DHS and HSARPA 
could be the place where cybersecurity research could be given 
marquis status and then be adequately funded and adequately 
managed. And I felt that the DARPA model was actually a pretty 
effective model for doing this. The Defense Advance Research 
Projects Agency, the DARPA model, was an executive model for 
managing--this is HSARPA.
    Ms. Jackson-Lee. You would encourage the creations of 
consortiums with joint working relationships with universities 
around the Nation?
    Mr. Sastry. Right. The coalitions, of course, could be 
created by the institutions themselves, or in the form of 
research programs in the DARPA model where you actually bring 
institutions together, and a program manager, a Federal program 
manager then sort of builds the bridges between those 
institutions.
    Ms. Jackson-Lee. Do you see the need also for enhancing 
experts within the minority communities, because we are 
certainly limited in the Ph.D. candidates and Ph.D. graduates 
from those communities?
    Mr. Sastry. That is absolutely true. And that is true all 
the way from the high school level up all of the way through 
the graduate programs and the faculty as well.
    Ms. Jackson-Lee. Anyone else?
    Mr. Bellovin. A national research counsel panel I was on 
noted that--concluded that today there probably could not be a 
massive disaster caused by a pure cyberattack, something close 
to the scale of 9/11. It doesn't mean it can't happen in the 
future. As we become more networked, as industrial processes, 
so-called SCADA systems, controlled power lines and industrial 
processes and so on, as things become more networked, the 
danger will increase. We have a few years before we are there. 
We need to take precautions right now.
    And I would note that everybody's computers can be 
leveraged for launching attacks. There has been reports in the 
papers in the last few weeks about personal computers being 
hacked to serve spammers and pornographers and so on, which 
means that anybody's computer in every sector of the society, 
we need to learn how to secure these. And individuals need to 
learn how to protect things, too.
    Ms. Jackson-Lee. Thank you.
    Mr. Wolf. There is a long list of research topics that need 
to be done, and clearly we need to leverage everybody in terms 
of working on those topics. So the idea of having some sort of 
coordinated effort in terms of where research--who is doing 
what I think is needed. We have done a lot of outreach recently 
with DARPA, NSF, academics, et cetera, to try to understand 
where research is being done to leverage all of that.
    Second, we are going out to the academic institutions with 
our list to try to get some help in terms of doing the 
research, and that is all universities that are out there.
    And your other comment about the--sort of the threat. I am 
not sure we really understand the threat in terms of how 
serious an attack on the infrastructure of the U.S. could be. I 
think there needs to be some focus on that.
    Ms. Jackson-Lee. Thank you.
    Thank you, Mr. Chairman.
    Mr. Thornberry. I thank the gentlelady.
    As the witnesses know, we do have votes on. I am not going 
to ask you to stay during these votes. So, with each of your 
permission, what I would like to do is submit some additional 
questions in writing to you. I think there are a number of 
areas that you have touched on that I want to follow up, 
including this whole software verification issue, this issue of 
translating research into the real world, which I think is a 
major, important issue. The whole human factors things that you 
all have talked about, about government research and how it 
affects the private market, you don't have to write those down, 
we will send those to you in writing.
    Mr. Thornberry. But needless to say, you all have touched 
on a number of things that have been very helpful to us. I want 
to thank each of you for taking the time to be here and to be 
with us today, and with that, this hearing stands adjourned.
    [Whereupon, at 11:45 a.m., the subcommittee was adjourned.]

                                 

```