U.S. GOVERNMENT PRINTING OFFICE

67–018 CC WASHINGTON : 2000

COMPUTER SECURITY: ARE WE PREPARED FOR

CYBERWAR?

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

INFORMATION, AND TECHNOLOGY

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SIXTH CONGRESS

SECOND SESSION

MARCH 9, 2000

Serial No. 106–160

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

DAVID M. MCINTOSH, Indiana

MARK E. SOUDER, Indiana

JOE SCARBOROUGH, Florida

STEVEN C. LATOURETTE, Ohio

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

BOB BARR, Georgia

DAN MILLER, Florida

ASA HUTCHINSON, Arkansas

LEE TERRY, Nebraska

JUDY BIGGERT, Illinois

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

HELEN CHENOWETH-HAGE, Idaho

DAVID VITTER, Louisiana

HENRY A. WAXMAN, California

TOM LANTOS, California

ROBERT E. WISE, JR., West Virginia

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

CHAKA FATTAH, Pennsylvania

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

HAROLD E. FORD, JR., Tennessee

JANICE D. SCHAKOWSKY, Illinois

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

DAVID A. KASS, Deputy Counsel and Parliamentarian

LISA SMITH ARAFUNE, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY

STEPHEN HORN, California, Chairman

JUDY BIGGERT, Illinois

THOMAS M. DAVIS, Virginia

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

JIM TURNER, Texas

PAUL E. KANJORSKI, Pennsylvania

MAJOR R. OWENS, New York

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

BONNIE HEALD, Director of Communications

BRYAN SISK, Clerk

TREY HENDERSON, Minority Professional Staff Member

(III)

C O N T E N T S

Page

Hearing held on March 9, 2000 .............................................................................. 1

Statement of:

Gerretson, Jim, director of operations, Information Assurance, ACS Defense, Inc.; Mark Rasch, senior vice president and legal counsel, Global

Integrity Corp.; and James Adams, chief executive officer, iDEFENSE .. 161

Tritak, John, Director, Critical Infrastructure Assurance Office, Department of Commerce; John Gilligan, Chief Information Officer, Department of Energy, and co-chair, Security, Privacy, and Critical Infrastructure Committee, CIO Council; Karen Brown, Deputy Director, National

Institute of Standards and Technology, Department of Commerce; and

Rich Pethia, director, Computer Emergency Response Team Coordination Centers, Software Engineering Institute, Carnegie Mellon University .................................................................................................................. 5

Letters, statements, et cetera, submitted for the record by:

Adams, James, chief executive officer, iDEFENSE, prepared statement

of ..................................................................................................................... 186

Biggert, Hon. Judy, a Representative in Congress from the State of

Illinois, chart on computer security management key players ................. 196

Brown, Karen, Deputy Director, National Institute of Standards and

Technology, Department of Commerce, prepared statement of ................ 38

Gerretson, Jim, director of operations, Information Assurance, ACS Defense, Inc., prepared statement of ............................................................... 165

Gilligan, John, Chief Information Officer, Department of Energy, and

co-chair, Security, Privacy, and Critical Infrastructure Committee, CIO

Council:

Information concerning initiatives and activities ................................... 22

Prepared statement of ............................................................................... 26

Horn, Hon. Stephen, a Representative in Congress from the State of

California:

Followup questions and responses ........................................................... 159

Prepared statement of ............................................................................... 3

Pethia, Rich, director, Computer Emergency Response Team Coordination

Centers, Software Engineering Institute, Carnegie Mellon University,

prepared statement of ................................................................................... 46

Rasch, Mark, senior vice president and legal counsel, Global Integrity

Corp., prepared statement of ....................................................................... 173

Tritak, John, Director, Critical Infrastructure Assurance Office, Department of Commerce, prepared statement of ................................................. 9

Turner, Hon. Jim, a Representative in Congress from the State of Texas,

prepared statement of ................................................................................... 152

(1)

COMPUTER SECURITY: ARE WE PREPARED

FOR CYBERWAR?

THURSDAY, MARCH 9, 2000

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

INFORMATION, AND TECHNOLOGY,

COMMITTEE ON GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 10 a.m., in room

2247, Rayburn House Office Building, Steve Horn (chairman of the

subcommittee) presiding.

Present: Representatives Biggert, Walden, and Turner.

Staff present: J. Russell George, staff director and chief clerk;

Matt Ryan, senior policy administrator; Bonnie Heald, director of

communications; Bryan Sisk, clerk; Ryan McKee, staff assistant;

Trey Henderson, minority professional staff member; and Jean

Gosa, minority staff assistant.

Mr. HORN. The hearing of the House Subcommittee on Government Management, Information, and Technology will come to

order. Earlier this year, the Nation successfully met its first technological challenge of the new millennium, Y2K. Although the time,

labor, and $100 billion cost for this effort, private and public, we

learned much from this experience. Those lessons will be especially

important now as we turn to the second technological challenge of

the new year, computer security.

We are here today to learn. In April 1996, this subcommittee

held a similar information hearing on the year 2000 computer

problem. Our questions will be many of the same questions we

asked in that hearing 4 years ago. We want to know the dimension

and scope of these cyber attacks. We want to know what efforts are

being undertaken toward solving the problem, and we want to

know what the Federal Government is doing to address this problem.

Since the early 1990’s, the worldwide use of computers and computer networks has skyrocketed. The Internet has revolutionized

the way governments, nations, and individuals communicate, and

the way to conduct business. The Internet and electronic mail are

now available 24 hours a day to anyone with a desktop computer,

a modem, and a telephone line. Yet, without rigorous efforts to protect the sensitive information contained in these computer systems,

many of the Nation’s essential services, telecommunications, power

distribution, national defense, and so on down the line are vulnerable to cyber attacks.

2

Over the last few weeks, several of the Nation’s most viable

Internet websites have fallen prey to ‘‘denial-of-service computer

attacks.’’ Although these attacks disrupt essential business services, they only scratch the surface of cyber attacks that may be taking place in other highly integrated computer networks.

Our first panel of witnesses today will discuss the vulnerability

of the Nation’s vital computer systems and the Government’s efforts to protect them. Our second panel, from the private sector,

will demonstrate how easy it is to invade or hack a computer system, and what organizations can do to protect these systems. We

welcome each of you and we look forward to your testimony.

If you will stand and raise your right hands, we will swear you

in.

[Witnesses sworn.]

Mr. HORN. The clerk will note that all four witnesses affirmed

the oath. We will start with Mr. Tritak, Director of Critical Infrastructure Assurance Office, Department of Commerce. Mr. Tritak.

I might say, the way we work here, once I announce you, your full

statement is automatically put in the record.

The staff has read it and when we have had a chance, we read

it. We then want you, if you could, to summarize it in 5 minutes.

Do not read it, whatever you do, but give us from your heart what

this problem is. That is what we are interested. When you are all

done, we will then have questions, 5 minutes on each side when

those Members come here. We will try to get a rounding out of

what the testimony is.

So, Mr. Tritak, you are first.

[The prepared statement of Hon. Stephen Horn follows:]

3

4

5

STATEMENT OF JOHN TRITAK, DIRECTOR, CRITICAL INFRASTRUCTURE ASSURANCE OFFICE, DEPARTMENT OF COMMERCE; JOHN GILLIGAN, CHIEF INFORMATION OFFICER,

DEPARTMENT OF ENERGY, AND CO-CHAIR, SECURITY, PRIVACY, AND CRITICAL INFRASTRUCTURE COMMITTEE, CIO

COUNCIL; KAREN BROWN, DEPUTY DIRECTOR, NATIONAL

INSTITUTE OF STANDARDS AND TECHNOLOGY, DEPARTMENT OF COMMERCE; AND RICH PETHIA, DIRECTOR, COMPUTER EMERGENCY RESPONSE TEAM COORDINATION CENTERS, SOFTWARE ENGINEERING INSTITUTE, CARNEGIE

MELLON UNIVERSITY

Mr. TRITAK. Thank you very much, Mr. Chairman.

I am grateful for this opportunity to appear before you today to

begin a dialog with you and your committee on the issues relating

to critical infrastructure assurance and computer security. In the

way of talking about infrastructure, one of them I want to mention

is that my slides just showed up. If you do not mind, I would like

to just put them up before you.

Mr. HORN. Sure. Keep talking. They can put them up.

Mr. TRITAK. In any event, Mr. Chairman, Americans have long

depended on delivery of essential services over the Nation’s critical

infrastructures. The need to assure the delivery of these services

against significant disruptions has been a concern of infrastructures, owners, and operators for as long as there have been electric

power plants, telecommunications systems, airlines, railroads,

banking, and financial services. In other words, critical infrastructure assurance itself is not new.

What is new is the increasing reliance on information technology

and computer networks to operate those infrastructures. This growing reliance introduces new complexities, interdependencies, and

potentially vulnerabilities. The threat that individuals, groups, and

nation states are seeking to identify and exploit these

vulnerabilities is real and growing.

[Chart shown.]

Mr. TRITAK. In recognition of this, President Clinton issued

PDD–63 establishing the protection of the Nation’s infrastructures

as a national security priority. As you can see from the chart, Mr.

Chairman, PDD–63 sets forth an ambitious goal. It calls for a national capability by 2003 to protect our critical infrastructure from

intentional attacks that could significantly diminish the Federal

Government’s ability to perform essential national security missions and to ensure general public health and safety, State and

local government’s ability to maintain order, and to deliver minimal essential services to the public.

Three, the private sector’s ability to ensure the orderly functioning of the economy and the delivery of essential telecommunications, energy, financial, and transportation services. The important conclusion of PDD–63 is that critical infrastructure assurance

is a shared responsibility. With 90 percent of the Nation’s infrastructures being privately owned and operated, the Federal Government alone cannot guarantee its protection.

In response to the issuance of PDD–63, the Federal Government

had to organize itself in order to meet the challenges posed by this

unique national security challenge. A national coordinator for secuVerDate 11-MAY-2000 10:28 Nov 08, 2000 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 C:\DOCS\67018.TXT HGOVREF1 PsN: HGOVREF1
6

rity, infrastructure protection, and counter-terrorism was created

to oversee national policy development and implementation, as well

as to advise the President and national security advisor on the

same.

My Office of Critical Infrastructure Assurance Office was created

to coordinate policy development for the national plan, to assist

agencies in analyzing their critical infrastructure dependencies,

and to coordinate national education and awareness efforts. The

National Infrastructure Protection Center was created at the FBI

to serve as a threat assessment center, focusing on threat warnings, vulnerabilities, and law enforcement.

For each infrastructure sector that could be a target for infrastructure cyber or physical attacks, a single government department or agency was established as a lead agency for working directly with representatives from private industry.

[Chart shown.]

Mr. TRITAK. Earlier this year, President Clinton issued the first

version of the national plan. Displayed before you is the cover. It

says a lot about what the plan is and is not. First, the plan focuses

on the cyber dimensions for securing critical infrastructures and

underscore the new challenges posed by the information age. That

is not to say that physical infrastructure protection is no longer important. It is.

Future versions of the plan will reflect that importance. In fact,

the plan is designated 1.0 and subtitled, An Invitation to a Dialogue For a Good Reason. It is very much a work in progress. It

concentrates on the Federal Government’s efforts in infrastructure

protection. The plan acknowledges that this is not enough. We

must work closely with industry and include them in the national

planning process.

We must also deal with the fact that there is an international

dimension to national information assurance, as well as a domestic

one. Of course, we must work closely with you in the Congress to

ensure that your concerns, ideas, and interests are reflected in subsequent versions of the plan.

[Chart shown.]

Mr. TRITAK. To meet the goal of PDD–63, the national plan establishes 10 programs for achieving three broad objectives. First,

steps must be taken to identify the key elements and systems that

constitute our critical infrastructures. Their vulnerability to attack

must be assessed and plans must be developed to address those

vulnerabilities.

In so preparing, we hope to prevent attacks from reaching their

target in the first place. Next, should such attacks occur, we must

develop a means to identify, assess, and warn about them in a

timely manner. The attacks must then be contained. Disrupted

services must be restored and affected systems must be reconstituted.

Finally, we must lay a strong foundation upon which to create

and support the Nation’s commitment to achieving the first two objectives. These include coordinated research and development,

training, and employing information security experts, raising

awareness, and, where appropriate, identify potential legal or legislative reforms.

7

[Chart shown.]

Mr. TRITAK. The President requested $2 billion for critical infrastructure protection in his fiscal year 2001 budget request. This

represents a 15 percent increase over fiscal year 2000 funding. Of

this, 85 percent supports protection of agency infrastructures; 72

percent goes to supporting critical infrastructure efforts within the

national security agencies.

Our President proposes a number of key initiatives in his budget

request. I will just highlight a few. The Federal Cyber Service Initiative seeks to redress the shortage of information security expertise in the Federal Government. This shortfall reflects the scarcity

of college-level programs in information security. It also reflects the

inability of the Government to compete for highly skilled workers

in this area.

Our goal is to recruit, train, and retain a cadre of IT specialists

for Federal service. The Federal Intrusion Detection Network will

serve as a centralized burglar alarm system for critical computer

systems within civilian government agencies. Intrusion Detection

Systems will be installed and operated by the civilian agencies.

Alarm data indicating anomalous computer activity will be sent

through the agency, by the agency to the GSA for further analysis.

Only if there is evidence of criminal behavior will data be sent

to the NIPC and law enforcement. FIDNet will not monitor any

private network traffic. It will comply with all existing privacy

laws. The Partnership for Critical Infrastructure Security attempts

to build on the efforts already underway between government and

industry.

It seeks to bring the individual sectors together to encourage a

cross-sectoral dialog as a common concern, such as the growing

interdependencies among the infrastructure owners and operators.

The Partnership also provides a form for infrastructure owners and

operators to engage other interested stakeholders, including the

audit community, insurance community, Wall Street, and the investment community, and of course mainstream businesses who

are the ultimate consumers of infrastructure services.

Now, the partnership is dedicated to the belief that once industry

recognizes a business case for action, economic self-interest in the

market can go a long way toward addressing the challenges of infrastructure assurance. That is not to say that self-interest in the

market alone can solve these problems, because they cannot.

Where they cannot, and what national security interests of their

country requires, the Federal Government must step in to address

any gaps and vulnerabilities that may exist.

Last month, over 200 representatives of more than 120 companies began to organize their participation in this Partnership. I

think the Partnership represents a good step in not only addressing

issues of common concern, but also for industry to take a lead in

addressing the problems that confront us today. When you have

good partnership between industry and government, we are better

able to identify and define our respective roles so that where there

8

are gaps, where the market cannot address a problem of concern

to the Nation, we can fill that gap.

Given the limited time, Mr. Chairman, I am going to conclude

my remarks here and I look forward to your questions.

[The prepared statement of Mr. Tritak follows:]

9

10

11

12

13

14

15

16

17

18

19

20

Mr. HORN. Thank you very much. I would appreciate it at this

point in the record if you would submit the national plan for the

record. So, without objection, it will be put right after this point.

We now go the next gentleman who is very familiar to this committee. You are doing a fine job. Mr. John Gilligan, Chief Information Officer, Department of Energy, and Co-Chair, Security, Privacy, and Critical Infrastructure Committee of the Chief Information Officer Council. Mr. Gilligan.

Mr. GILLIGAN. Thank you, Chairman Horn.

As you noted, I come before the committee speaking in both my

role as Chief Information Officer of the Department of Energy and

as well the Co-Chair of the Federal CIO Council Security, Privacy,

and Critical Infrastructure Committee. As I prepared for this testimony, I gave a lot of thought to what I viewed were the two critical

issues that I face as a Federal CIO. I would like to spend a moment

addressing these issues for you.

Up-front, let me tell you that my biggest issues are not technology challenges. The primary challenge is educating and convincing line management that computers and networks, as well as the

information they possess and process, should be treated and managed as mission-essential and strategic organization resources. Let

me illustrate my point with an example.

Last summer, at one of the Department of Energy laboratories

we conducted a security audit. The laboratory was evidenced as

having the best firewall within the Department, very good security

policies, and adequate protection of our classified systems. However, that same organization had a number of instances of what I

refer to as no-brainer security weaknesses. For example, there were

a number of computer systems that had software configurations

that were years out of date.

In this case, they were not taking advantage of dozens of patches

that had fielded to upgrade the security of those systems over the

years. In addition, there were a number of systems where their

passwords, including system administrator passwords were easily

guessed, or in some cases even used the term ‘‘password.’’ These

and other weaknesses provided relative ease of a potential hacker

to break into the laboratory’s unclassified computer system.

As I evaluated this apparent paradox, the same organization

having both the best and the worst security practices, the root

issue became clear to me. The organization was not focusing on information technology as an overall laboratory resource, rather only

sub-sets of the systems and networks were being pro-actively managed. Most of the unclassified computers were procured and operated as work center or personal resources.

I have found similar dichotomy at a number of other daily sites.

The problem at this lab was not the absence of sound security policies or lack of security technology knowledge, but the fact that

management of computers had become highly decentralized and, in

many cases, was a personal task. I found that the number of system administrators approached the number of laboratory employees.

The security audit findings highlighted to the laboratory director

and senior management that they had fundamental problems with

information technology management. The solution required a funVerDate 11-MAY-2000 10:28 Nov 08, 2000 Jkt 000000 PO 00000 Frm 00024 Fmt 6633 Sfmt 6633 C:\DOCS\67018.TXT HGOVREF1 PsN: HGOVREF1
21

damental change in how computers, networks were purchased, installed, and operated. I firmly believe that this is the most significant and pervasive problem facing Federal agency CIOs.

A second challenge I face is working with Federal managers in

the Department of Energy in determining how much security is

enough. That is, how much is adequate? In the past, primary security focus was on the protection of national security information,

classified systems, and more easily controlled mainframe computers. Adequate security was defined by security gurus, in most

cases, with much input from line management, and defined, in

most cases, in absolute terms.

Today, we use computers for a wide variety of missions where it

is not cost effective or appropriate to apply the same protection

mechanism or security policies in all cases. We have information

relating to national security. Personnel data and business operations must be protected to ensure confidentiality. On the other

hand, we have public websites where we want to protect the integrity of the information. In addition, there are mission impact and

perception factors which influence what is adequate, as well as rapidly changing threats, missions, and technologies.

Federal security policies require an assessment of risk to guide

management decisions on what is adequate. Sounds easy. I would

submit that it is not. The Federal Government is also held to a

very high standard and one that continues to change and become

more stringent over time. In my testimony, I have included some

status updates within the Department of Energy on our recent security activities. I will not detail them here.

I would like to, however, turn for a few minutes to the work of

the CIO Security, Privacy, and Critical Infrastructure Protection

Committee, which I co-chair with Roger Baker, CIO of the Department of Commerce, and Fernando Robano, CIO of the Department

of State. Our committee is developing a set of products that we believe will augment and accelerate improvements in implementing

adequate levels of protection in assuring appropriate privacy of

Federal information and systems.

I would like to submit for the record a brief summary of our committee activities.

[The information referred to follows:]

22

23

24

Mr. GILLIGAN. I would also like to highlight a few of the committee’s efforts. Our project to develop and Information Technology Security Maturity Framework is intended to help guide agencies and

senior government officials in establishing and maturing an effective cyber security program. Following the example of the successful Software Capability Maturity Framework developed by Carnegie Mellon University, the Information Technology Security Maturity Framework recommends the building block approach to security.

Emphasis is placed at lower levels on critical foundation activities, such as documented policy, and clearly defined assigned responsibilities, as well as robust training and security assessment of

progress. I have brought a display that summarizes the six levels

of security maturity described in the draft framework. The Security

Committee believes that all agencies should be working toward

achievement of level 2 in the near term.

This level describes what is called a documented security program. It is based on policy and guidance from the General Accounting Office, the Office of Management and Budget, and the National

Institute for Standards and Technology. The committee is working

to develop specific evaluation criteria, a checklist guide that could

be used for level 2, as well as further definition of level 3.

We have invited the Software Engineering Institute and the General Accounting Office to participate in the refinement of the

framework. The committee also has initiatives in the development

of a tool that will allow us to identify and make available the Federal agency’s best security practices. We are developing sample

agency policies and guidelines dealing with security and privacy.

We are working to accelerate the use of so-called public key

encryption. We are working with the Information Technology Association of America in the development of security solution benchmarks, linked to common electronic services such as financial track

statues with the public, benefit inquiries over the web, and electronic submission of contractor pricing proposals.

I would like to conclude my remarks with some recommendations

from my perspective as co-chair of the Security, Privacy, Critical

Infrastructure Committee. The first two recommendations deal

with funding for security. First, I recommend that organizations

specifically identify and analyze their expenditures in cyber security. In this regard, I suggest that we work with the government

and industry to establish and refine benchmarks against which line

managers can assess whether their investment is comparable to

similar organizations.

Work by the Gardner Group suggests that a reasonable range for

cyber security spending is somewhere between 1 and 5 percent of

an organization’s spending for information technology. Second, I

would recommend consideration of increased funding for a set of

governmentwide security initiatives that are focused not on multiyear research or product development, but on short-term immediate operational benefits for Federal agencies.

I note that most of our CIO Council cyber security efforts are focused toward ongoing operational support. Furthermore, I recommend that we continue to tightly tie our cyber security efforts

25

with other initiatives to improve overall management of information technology resources from an enterprise perspective.

Finally, I suggest that we continue to focus our education efforts

toward government managers. I believe managers need to know

how to make risk tradeoffs. What they need is greater awareness

of their responsibility in managing information technology as a

strategic resource, as well as simple benchmarks and metrics, such

as funding levels and a maturity framework, against which they

can evaluate organization-specific risks, as well as the progress of

their cyber security programs.

This concludes my testimony. I look forward to your questions.

[The prepared statement of Mr. Gilligan follows:]

26

27

28

29

30

31

32

33

34

35

Mr. HORN. Thank you very much, Mr. Gilligan.

Our next witness is Ms. Karen Brown, the Deputy Director, National Institute of Standards and Technology, otherwise known as

NIST. With the Weather Bureau there, I wonder why we cannot

be MIST? Anyhow, the Department of Commerce. Thank you for

coming.

Ms. BROWN. Thank you.

Thank you Mr. Chairman and members of this subcommittee for

the invitation to speak to you today about computer security issues.

Computer security continues to be an ongoing and challenging

problem that demands the attention of the Congress, the executive

branch, industry, academia, and the public. Computer security is

not a narrow technical concern.

The explosive growth in electronic commerce highlights the Nation’s ever-increasing dependence upon the secure and reliable operation of our computer systems. Computer security has a vital influence on our economic health and our Nation’s security, and we

commend the committee for your focus on this security. Today, I

would like to address NIST computer security activities that contribute to improving computer security for the Federal Government

and the private sector.

I would also like to briefly describe for you our proposed new program activities for next year. Under NIST statutory responsibilities, we develop standards and guidelines for agencies to help protect their sensitive, unclassified information systems. In meeting

the needs of our customers in both the public and private sector,

we work closely with industry, Federal agencies, testing organizations, standards groups, academia, and private sector users.

As awareness of the need for security grows, more secure products will be demanded in the marketplace. Addressing security will

also help ensure that electronic commerce growth is not limited because of security concern. What does NIST do specifically? To meet

these responsibilities in customer needs, we first work to improve

the awareness of the need for computer security, which is an ongoing effort.

Additionally, we research new technologies and their security implications. We work to develop security standards and specifications to help users specify security needs, and establish minimum

security requirements for Federal systems. We develop and manage

security testing programs in cooperation with the private sector to

enable users to have confidence that a product meets a security

specification.

We also produce security guidance to promote security planning

and secured system operations in administration. I will briefly discuss the need and benefits of each. First, there is a need for timely,

relevant, and easily assessable information to raise awareness

about risk, vulnerabilities, and requirements for protection of information systems. This is particularly true for new and rapidly

emerging technologies which are being delivered with such speed

in the Internet age.

We host and sponsor information sharing among security educators, the Federal Security Program Managers’ Forum, and industry. We seek advice from our external advisory board of computer

experts. We meet regularly with members of the Federal computer

36

security community, including the Chief Information Officer of the

Security Committee, and the Critical Information Assurance Office.

We actively support information sharing through our conferences, workshops, webpages, publications, and bulletins. A second need is for research on information technology vulnerabilities

and cost effective security. When we identify new technologies that

could potentially influence our customer security practices, we research these technologies and their potential vulnerabilities.

We also work to find ways to apply new technologies in a secure

manner. The solutions we develop are made available to both public and private users. Research helps us to find more cost effective

ways to implement and address security requirements. The third is

the need for standards and for ways to test that standards are

properly implemented on products. For example, cryptographic algorithms and techniques are essential for protecting sensitive data

and electronic transition.

NIST has long been active in developing Federal Cryptographic

Standards and working in cooperation with private sector voluntary standards organizations in this area. We are currently leading a public program to develop the Advanced Encryption Standard

[AES], which will serve 21st Century Security needs. Another aspect of our standards activity concerns public key and key management infrastructures.

We have been actively involved in working with industry and the

Federal Government to promote the security and inter-operability

of such infrastructures. Standards help users to know what security specifications may be appropriate for their needs. Testing complements this by helping users have confidence that security standards and specifications are correctly implemented in the products

they buy.

Testing also helps reduce the potential vulnerabilities that products contain that could be used to attack systems. For over 5 years,

we have led the Cryptographic Module Validation Program, which

has now validated about 90 modules, with another 50 expected this

year. This successful program utilizes private sector accredited laboratories to conduct security conformance testing of cryptographic

modules against the Federal standard we developed and maintain.

Many of these activities are being done in cooperation with the Defense Department’s National Security Agency in our National Information Assurance Partnership.

The goal is to enable product developers to get their products

tested easily and voluntarily, and for users to have access to information about test products. Under this program, we have also led

the development of an international mutual recognition arrangement, whereby the results of testing in the United States are recognized by our international partners, thus reducing costs to the industry.

Advice and technical assistance for both government organizations and private sector is the fourth need. While I have given you

a few examples of NIST work, I obviously have not covered everything. I want to emphasize there is still much more to be done.

37

Please keep in mind that approximately $6 million of direct congressional funding supports both our Federal and industry computer security responsibilities. This is plainly not enough.

Thank you.

[The prepared statement of Ms. Brown follows:]

38

39

40

41

42

43

Mr. HORN. Thank you very much. That was very helpful testimony. We now go to our last witness on this panel. I must say, Mr.

Pethia, everywhere I talked and saw people in the last 3 weeks

putting this panel together, the first magic word was Carnegie Mellon. So, we are glad to have you come here. We hope to visit your

campus sometime. You can show us around.

Mr. Rich Pethia is the director, Computer Emergency Response

Team Coordination Centers, Software Engineering Institute at Carnegie Mellon University in Pittsburgh.

Mr. PETHIA. Mr. Chairman and members of the subcommittee, I

would like to thank you for the opportunity to come and talk to you

today about computer security. Today, I would like to describe a

number of the trends that impact security on the Internet. I will

illustrate the results of those trends and then outline some steps

that I think will help us all effectively manage the increasing risk

of damage from cyber attacks.

My perspective comes from the work that we do with the CERT

Coordination Center. The Center is charted to respond to security

emergencies on the Internet, and to work with both technology producers and technology users to facilitate response to major security

problems. Since 1988, we have handled over 24,000 separate security incidents, and analyzed more than 1,500 separate computer

vulnerabilities.

The current state of Internet security is cause for concern. The

vulnerabilities associated with technology used on the Internet put

government, business, and individuals at risk. Security is influenced by many factors. An organization that wishes to improve its

security has to deal with a lot of issues. First of all, the Internet

itself is growing at an amazing rate.

As the technology is being distributed, so is the management of

that technology. System administration and management often fall

upon people who do not have the training, skills, resources, or interest needed to operate their system securely. This problem is

about to get worse. Now that we have direct Internet connection to

homes, schools, libraries, and other venues that do not have training and security staff.

These always-on rarely protected systems will allow attackers to

continue to add new systems to their arsenal of captured weapons.

Intruder tools are becoming increasingly sophisticated and also becoming increasingly user-friendly and widely available. This technology is evolving like any other.

Sophisticated developers of intruder programs package their tools

in user-friendly forms and make them widely available. As a result,

even unsophisticated intruders can use them.

On the technology side, when vendors release patches or upgrades to solve security problems, organizations’ systems often are

not upgraded. The job may be too time consuming, too complex, or

just too low a priority for the system administration or staff to handle. There is little evidence of improvement in the security features

of most products. Today, we continue to receive new vulnerability

reports in second generation and third generation products.

Developers are not devoting sufficient effort to apply lessons

learned about the sources of vulnerabilities and doing the engineering work necessary to remove them. Finally, engineering for ease

44

of use is not being matched by engineering for ease of secure administration. Today, we would all find it ludicrous to safely operate

and drive an automobile, a person would have to be a master mechanic.

Yet, today we expect our computer users and novice system administrators to have detailed technical knowledge of all the intricacies and nuances of the technology. We are simply developing technology that is not fit for use in today’s environment. Because of

these and other factors, organizations and individuals who are

using the Internet become vulnerable to various kinds of cyber attack, including the denial-of-service attacks that were widely publicized in February.

The key point about this attack, this attack type, is that although an organization may be able to harden its own systems to

help prevent having its systems used as a part of a distributed attack vehicle, there is essentially nothing a site can do with currently available technology to prevent becoming a victim of these

coordinated denial-of-service attacks.

The best an organization can do today is get ready to respond

and have its response capabilities in place, should it ever become

the victim of one of these attacks. These attacks work by having

intruders compromise vulnerable systems. They collect these vulnerable systems into aggregated attack networks. These networks

act in unison to attack a single victim.

The network can be activated remotely at a later site by a master computer. Communication between the master and the networks is encrypted, often making it difficult to locate the master.

Once activated, these tools proceed on their own. They are rapidly

evolving. Individual nodes in the attack network can be automatically reprogrammed to change the type of attack so that it becomes

increasingly difficult to build defenses against this technology.

Clearly, we have entered a new era in the Internet, where the

power of the Internet itself is now being used to attack people who

are connected to it. At the CERT, we constantly monitor trends and

watch for new attacks and tools. We became aware of this new

form of denial-of-service attack in late August, early September

1999. Denial-of-service attacks are not new.

These kinds of attacks have been around since 1994, with significant increases in 1996 and 1998. By the end of September, it was

evident that this was a new form of attack. It was something we

had never seen before. We called together a workshop of 30 international experts who came together for 2 days in Pittsburgh and

produced a paper that explains the threat posed by these intruder

tools, as well as guidance to organizations about how to protect

themselves and be prepared, and how to be ready to respond.

This paper, along with other advisories, were issued to the community in December. We have had a series of communications out

to the Internet community. The problem is serious. It is complex.

A combination of approaches must be used to reduce the risks associated with this ever-increasing dependence on the Internet. First

of all, we need better ability to collect, analyze, and disseminate information on assurance issues.

A lot of what we do today is reactive. We see a problem. We analyze it. We understand what just happened. That is no longer adeVerDate 11-MAY-2000 10:28 Nov 08, 2000 Jkt 000000 PO 00000 Frm 00048 Fmt 6633 Sfmt 6633 C:\DOCS\67018.TXT HGOVREF1 PsN: HGOVREF1
45

quate. New forms of attack are now happening at Internet speed,

both automated attacks, like these distributed denial-of-service attacks, as well as new forms of viruses, such as Melissa that showed

up in March of this year.

Today, we need to find analysis methods that build a predictive

early warning capability. We need to be able to understand what

is going to happen before it happens, which means we need new

ways of analysis. In addition, better attention paid to collecting information. There has been a lot of discussion and debate about

instrumenting networks to collect data to watch the traffic on the

network to anticipate what the problems might be.

Certainly, there is a need to be concerned about privacy, but we

have to find some way to balance our need to collect information

about the operation of networks with our need to keep individual

transactions and user’s activities private. Until we get a better

view into what is happening on our networks, we are going to have

a very difficult time defending against new forms of attack.

Third, we need to invest in better education and training to raise

the level of security and security awareness. In particular, we need

to focus on bringing the understanding of security issues to senior

and middle management in government, as well as in industry.

Until there is management commitment, and management commitment of resource to solve this problem, little is going to happen.

Part of that includes encouraging the development of comprehensive security programs with well-defined responsibilities for managers, users, and system administrators.

Finally, all of this is only going to help us mitigate the problem,

stem the flow of quality that we are having. It will not solve the

problem. In order to get ahead of this problem, we need to support

research and development activities that will lead to a new generation of technology on the Internet and other broad-scale networks.

Systems that are easier to secure, systems that do not require so

much constant attention, systems that do not repeat the

vulnerabilities of the past, the long-term solution is better technology.

That is going to take years. Until we get there, we need better

management approaches. Thank you.

[The prepared statement of Mr. Pethia follows:]

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

Mr. HORN. Thank you very much.

We will now go to questioning. It will be 5 minutes to a side. We

will get everybody in here in three rounds, if you need them.

[Pause.]

Mr. HORN. This looks like a vote.

What I want to do is start on one issue. Then I will yield to Mr.

Turner. As I listened to the comment about maybe we need a tzar

in this area, usually my spinal column starts wiggling. As a student of Russian history, I keep wondering what happened to a lot

of tzars and who is Rasputin in this operation? So, I guess I would

ask, is the Koskinen model a good one for this?

Now, with the Koskinen model, then when Mrs. Maloney and I

wrote the President, then talked to him and said, look, you have

got to get somebody to coordinate this effort. Some were waving the

flag for a tzar. I was not. The way it worked out, one, the President

picked a person that he had known before he was President and

had trust in.

No. 2, we made him assistant to the President, which is the highest rank you can have in the White House hierarchy. No. 3, he was

not in OMB. He was housed near there. The President had him

and the President spread the word to the Cabinet that this is serious business, when they finally got around to it.

No. 4, they called on each of the Deputy Secretaries that really

run departments and obviously involved the Chief Information Officers, who are the people we ought to be spending the time to be

the managers they are supposed to be of communications and information in their particular agencies. So, I guess I would simply like

to get the feeling of you as to whether that was a successful model

that we could also apply to computer security and not have some

tzar in OMB.

Of course, as you know, I am trying to split the management

part out of OMB. It might well roost there, but the fact is the

model I think worked the way it did. I do not know if any of you

want to take that and say, hey, there is another way to look at

this. Go ahead. Mr. Gilligan.

Mr. GILLIGAN. Sir, let me give you some perspectives. I think the

model with the particular individual, John Koskinen, worked extremely well. I think there were a number of factors that made it

work well, one of which was the personal characteristics and

strength of John Koskinen. I think there were also some other factors that made it effective. That was the urgency and the immediacy of Y2K heightened the interest across the board.

There was a need and a willing acceptance of someone to help

lead the effort across government and across really the country. It

is not clear to me that an exact parallel to that would work as effectively in computer security. I know that there has been some

frustration, and there continues to be at all levels, with our difficulty of pulling together across-government activities in this area.

So, it is clear that we need to emphasize and we need to work

in that area. Obviously it is something the CIO Council is trying

to address, and yet we realize that we have limited abilities as

well. So, while I would not specifically endorse the exact model, I

think we need to continue to look for some way to better leverage

our across-government efforts in this area as a part of our solution.

148

Mr. HORN. Any other thoughts on this? Mr. Tritak.

Mr. TRITAK. I would agree with those comments.

Mr. HORN. So, you would like that model?

Mr. TRITAK. I think what is intriguing about the Koskinen and

the Y2K effort generally is, in many respects, the Y2K was your

first critical infrastructure challenge to the United States. It had

a lot of things going for it. First of all, there was a recognition. In

fact, industry actually led the way. The government took a little

while to get onboard.

There was an acknowledgment of what the challenge was. There

was a known problem. The people rallied for it. I think that when

you look at the Koskinen model, it is important to look at what the

factors of success were. You have identified quite a few of them. He

was viewed as having the authority. He worked very closely with

the Cabinet. The Cabinet knew that when he walked into the room,

who he was, and what he stood for.

We certainly cannot under-emphasize the importance of a leadership and view it as someone who is speaking with authority on behalf of the President; especially when you are talking about acrossagency issues, which critical infrastructure really is all about. If

you look at the way this has evolved, there was a time probably

when the Computer Security Act was actually passed where you

could talk about a computer system within an agency. It was that

agency’s system.

Now, you are looking more at an interconnected set of systems.

You have to ensure, in terms of the government as a whole providing a service to the Nation, that you have strong links across government agencies, as well as within them, so that you do not create

weak links in the chain. Now, with that said, I think that we have

to look very closely about how the challenges, as ongoing, differ

from the Y2K experience before you talk about institutionalizing a

new position.

I think certainly some of the ingredients that you indicated bear

close scrutiny and attention on that. In fact, you could make the

case that, that kind of leadership becomes even more essential in

some regards when the known threats are not as immediate, but

you know they are out there and they could happen at any time

as opposed to a date-specific.

Mr. HORN. Any other comments on this?

I will yield 5 minutes to the gentleman from Texas. If you would

like, we could recess now to go vote, and then come back, and then

start with your 5 minutes. Is that OK with you?

Mr. TURNER. That is fine.

Mr. HORN. OK. We are going to be in recess then for 20 minutes

so we can get these two votes.

[Recess.]

Mr. HORN. This subcommittee will be in order. We will proceed

with the questioning. It is 5 minutes for Mr. Turner, the ranking

member from Texas.

Mr. TURNER. Thank you, Mr. Chairman.

I appreciated your comments. I really get the impression that

what you were saying to us is that there is a lot of work that has

got to be done in the area of new technology before we will ever

have any hope of really having a secure Internet. I guess I was

149

kind of curious as to what types of things you are talking about?

We made the comparison a minute ago to the Y2K problem.

To me, what we are talking about today dwarfs the Y2K problem.

In that arena, we had a date certain we were working toward. We

knew if we made it past that date, we had succeeded. The government was able to provide a coordinating role for both the public

and the private sector. This challenge seems to be so much greater.

When you say we need better technologies, what kinds of things

are we talking about?

Mr. PETHIA. First of all, the driving factor behind my belief is

that more and more devices attached to Internet are going to become consumer items. I think we are already there with personal

computers. We are almost there, even with some devices like routers and fire walls, when you think about having these things installed in libraries, in doctors’ offices, and in places where you

would not expect to find someone with a degree in computer

science.

That is going to continue. We are going to have all kinds of devices at home. We are going to have hand-held portable units. We

are going to have cell phones connected, as we already do, into the

Internet. So, from one perspective what we need to do is to make

security much simpler than it is today. You can configure a very

secure personal computer, be it a Unix box or a Microsoft Windows

box.

All of the mechanics are there to do that, but it is not easy. It

takes a lot of understanding and a lot of knowledge. Not only do

you have to get it right the first time, you have to keep it that way

over time as you add new applications into your personal computer.

So, if you think back to the 1960’s when all computers were hard

to use in all kinds of ways, the industry responded very well with

a lot of research and development in easy-to-use, in fact ease of use

was the buzz word for the industry back then.

We need the same effort today, in terms of security controls and

security mechanisms. Bring those controls and mechanisms to the

point where the average user could use them. I think that is sort

of a near-term, by ‘‘near-term’’ I mean a 2- to 3-year effort that

could show some results, significant results, major results in that

period of time.

Mr. TURNER. I forget the name of the group or company that is

certifying whether something is secure or not. I read about it somewhere. Is that the kind of thing that would motivate the private

sector to be sure they develop their products in a way that they can

be secure?

Mr. PETHIA. I think that kind of thing will certainly help. I think

the tension is going to be between the length of time it takes to

do the evaluations and the market forces that keep driving new

products. Very often, the situation of doing an exhaustive evaluation takes time. By the time you are through with that evaluation,

the marketplace has already moved on to the next generation of

products. I think we have to struggle with that issue.

Mr. TURNER. That seems to be one of my greater concerns because this field moves so fast. It is always the private sector that

is moving forward. We had some government effort over there,

though it is not in one place right now. It seems that the governVerDate 11-MAY-2000 10:28 Nov 08, 2000 Jkt 000000 PO 00000 Frm 00153 Fmt 6633 Sfmt 6633 C:\DOCS\67018.TXT HGOVREF1 PsN: HGOVREF1
150

ment effort, even if we consolidate it, is always going to be a step

behind what is really going on in the private sector.

So, it is forcing you to try to think of private sector incentives

to try to make this all happen. I cannot get it in my mind that the

government is going to be able to keep up with it.

Mr. PETHIA. I think the private sector interest is rising. I think

as more and more damage happens on the Internet, people are

going to begin to understand that investing in security is something they are going to need to do in order to keep their businesses

operational. So, I think that is happening. I see a big increase in

private sector interest today, over just a year ago. That trend has

been going on for several years.

I think the marketplace, in my opinion, has become complacent.

The marketplace is currently accepting whatever the vendors

produce. I think an awareness campaign and an understanding

that technology can be changed; technology does not have to be the

way it is today is something that would help move, first of all, the

consumer to a better understanding of the kind of quality the consumer should expect from a product.

Then finally, the technology producers, as they begin to see a

marketplace for that new product, to begin to produce. There is a

place where I think government campaigns focused on broad-scale

awareness, understanding, helping the consumer, both in government and outside government, understand that technology possibilities exist beyond what we have available to us today, I think,

would go a long way to spur that kind of effort.

Mr. TURNER. Is it a reasonable suggestion to think in terms of

a second Internet? After all, we are even getting to the point where

much of what takes place can even be done in a wireless mode. Is

there a reason to consider that there could be more than one Internet? That there are secure Internets so that we can solve some of

our national security type problems and others in a way that we

know that we are protected?

Me. PETHIA. Certainly, I think there are some needs for high security in some applications where those networks and systems will

remain isolated and should remain isolated from the broad Internet. I think the last 10 years of history has told us that the Internet is going to continue to evolve. It is going to continue to lure

people because of the broad connectivity that is available over the

Internet, and also because of the dramatic lower cost of operating

on this huge network where everybody shares the expense.

I think the economics are going to continue to push most organizations toward the Internet. I think the challenge as to rather than

trying to isolate from the Internet, the question is how do we go

about fixing the Internet so that we can all enjoy the level of security that we need?

Mr. TURNER. Your effort at Carnegie Mellon, through the Computer Emergency Response Team, seems to me to be an excellent

private sector initiative. Do you think government is capable of duplicating that or will it be best left to efforts like yours?

Mr. PETHIA. I think it is going to take a combination of efforts.

There are within the government a number of computer emergency

response teams in the DOD, in the Department of Energy, and in

some of the other agencies. There is the FedCIRC activity which

151

we actually participate in. So, I think there is a large government

effort there. One of the advantages that I think we have is that in

addition to the reactive work that we do, we are also housed in a

research university.

So, in the private sector where you can have these kinds of reactive capabilities to help us understand what the problem is, but

also marry with that a research and development capability we can

move toward solution. That, I think, is a good combination. So,

there perhaps is a way where government can team with organizations in the private sector, with the government doing some of the

response reactive work, ensuring that they have close working relationships with technology researchers so that the researchers really

understand what the real problems are.

Mr. TURNER. Thank you, Mr. Chairman.

[The prepared statement of Hon. Jim Turner follows:]

152

153

154

155

156

Mr. HORN. I thank the gentleman.

Now, I yield to the gentlewoman, the vice chairman from Illinois,

Mrs. Biggert to question the witnesses for 5 minutes.

Mrs. BIGGERT. Thank you, Mr. Chairman.

If I could ask unanimous consent to include my opening statement.

Mr. HORN. Without objection, it will be so ordered as read at the

beginning, after Mr. Turner’s opening remarks.

Mrs. BIGGERT. Thank you.

This is a question for all of you. What is the real threat from

cyber terrorists to the Federal agencies’ mission critical systems? I

know that is a broad question, but how does the administration’s

recently released National Plan for Information Systems Protection

address the plans to mitigate these terrorist threats? I think when

we were talking about Y2K, we had our mission critical systems.

I think that was what was really addressed there. First of all, is

there a threat from the terrorists?

Mr. TRITAK. Well, I think the national plan makes clear that the

threats posed by cyber terrorists as well as nation states is growing. I would urge you, if you have not already, to get a briefing by

Mr. Michael Vaddis at the National Infrastructure Protection Center who could give you a lot more detail, an appropriate level of detail than I can get into. One of the reasons for PDD–63 stemmed

from a Presidential commission which asked the question, what are

the new threats to the Nation? The cold war is over. It is unlikely

that anyone would be foolish enough again to take on the United

States with armed forces. So, what are they?

That question was initially prompted, of course, by a number of

events that were happening in the mid-1990’s, the Towers’ bombing, Oklahoma City. What is going on here? The recommendation

of that commission was to say that the critical infrastructure of

this country are increasingly becoming vulnerable to types of attacks that could be delivered over the information super highway.

Why? Because as was indicated earlier, traditional infrastructures are increasingly relying on computer networks, not only to receive e-mail, but actually perform operational functions of their

business. As you move further and further into deregulation, the

need to cut your costs to make the margins up, you are going to

be relying more and more on information technologies to perform

functions which traditionally may have been performed by manual

labor for example.

Also, in the past, if a computer operational system went down,

say in the electric power industry, they have ways of shifting over

to manual type responses in order to keep the flow of services

going. Now, over the long-term, more and more of those primary

functions are performed by information technology, and if those

systems are then networked either through the Internet or some

wide area network systems, the potential for someone being able to

get in and cause damage increases.

Now, I am glad you also mentioned the critical systems because

this is a very important thing about critical infrastructure assurance. What we are concerned about are those systems within our

critical infrastructures which, if disrupted, could cause immediate

and significant harm to the Nation’s security, its economy, or the

157

health and welfare of its people. If someone means to do harm,

they are going to want to leverage their efforts to find weak links

in the chain.

So, one of the purposes of the effort that is outlined in the national plan is to begin to raise this issue with industry to make

clear that this is more than just a hacking problem. Frankly, they

deal with that now. They know that they are being hacked. Their

websites are being looked at. The idea that if more and more of

their business relies on information technology, for example, banking and finance, e-commerce, where the very nature of the revenue

stream turns on information technologies. This is a different problem.

The same thing within the Federal Government. There was a

time when you could talk about a computer system within the Federal Government and it was the agency’s system. It was insular.

It was self-contained. Now, like everywhere else, you are getting

inter-connectivity between agencies. They are depending on different services, both within government as well as outside of government.

This inter-dependency is one of the newer challenges. An agency

can get their security concerns right, but if they are dependent

upon systems which do not have their security right, that is where

the vulnerability lies. Your types of attacks which, again, Mr.

Vaddis will be in a better position to talk to you about this, they

are looking for the weak links. They are not simply going to willynilly take on any piece of the information infrastructure. They are

going to look for where the highest value payoff is going to come

from.

Mr. GILLIGAN. I think Mr. Tritak has done a good job of summarizing the significance of the threat and many of the characteristics

that contribute to it. I would only add a couple of thoughts. One,

I think it is not just linkages between agencies, but linkages within

sites and within agencies where you find I think unknowingly our

interconnection.

We are just about intermeshed in our network connectivity

among systems that we have the same vulnerabilities. I think second, we really, in my view, have kind of two tiers of threat. Unfortunately, a lot of our emphasis and visibility is on what I will call

the lower tier, which is a very unsophisticated, but today, because

of the vulnerabilities, is ineffective and gets a lot of visibility.

Now, I think there is one that is much more sophisticated. We

only get glimpses of it. In many cases, that is something we do not

share a lot of insight. It is almost masked. That is, we are seeing

some of these lower sophistication threats. That is what we are focusing a lot of attention. I think we need to because you need to

dampen those out of the system before you can really start to focus

and then get the protection that you need to address the more sophisticated attack.

Ms. BROWN. Well, I think both gentlemen have done a really

good job. I would only add that I think one of the key challenges

is not just today’s problem, but the ongoing problem. There is new

software every month. There are new systems every month. So,

there is not a single fix, as in the Y2K, as Mr. Turner and everyone

158

has talked about. There was a single crisis. There was a single

thing that we had to fix.

This is going to be an ongoing problem, and ever more difficult

in many ways to stay on top of as we become more and more global. So, we need to look at what can we do today, but also on the

more fundamental things to make our systems fundamentally secure. How do we design the systems and how do we design the software so it is not up to the user to fix and put the patches, which

will always be there? Somehow, how do we fundamentally make

the system more robust?

Mr. PETHIA. I am building briefly on Mr. Gilligan’s remarks; this

idea of two tiers of threat. At the lowest level, and one of my big

concerns, and the reason that I am advocating for increased emphasis on analysis, capability, and data collection is that the lowlevel threat, the amount of noise generated by that threat is now

so huge. We literally get 50 new incidents reported to us every day.

We are only 1 of 90 emergency response teams, as well as a number of government agencies who focus on this issue.

There is so much activity out on the network today. It is very difficult to pull out from all of that noise the one or two key things

that you really need to pay attention to. In order to stay ahead of

this problem, I think we are going to need to become much more

sophisticated in the way we collect and analyze incidents data. So

we can look for those key indicators that there is something really

significant going.

Mrs. BIGGERT. Thank you. Thank you, Mr. Chairman.

Mr. HORN. Thank you. May I suggest that if we have some additional questions, that we have a time problem here. A number of

us are involved in things that just go every 15 minutes, starting

at around 12:05 p.m. So, if you do not mind, we would like to submit some of these questions, I know that I have, to you. Take your

time, but we would love to have them in the record at this point,

your best thoughts, if that is OK with you.

[The information referred to follows:]

159

160

161

Ms. BROWN. Thank you very much for the opportunity.

Mr. HORN. Well, we thank you. The chart here I particularly

want your comments. That is our question 5, for the majority. I

think you have it. Now, this was prepared by counsel, Mr. Ryan.

He is 100 percent Irish. I am only 50 percent Irish. It is not even

St. Patrick’s Day. I look at that. I looked for Jesse Jackson on the

floor. It looks like the Rainbow Coalition. He is serious about this

and we are.

So, we would like your best shot at it, in terms of all of these

organizations and how they can work on computer security issues.

The key question still remains on who is coordinating this operation? Are there various ways, given the private sector, the Federal

sector, the State sector, the local sector, the non-profit sector? So,

if you would struggle a little with that, we would appreciate it.

Well, thank you very much for coming. We will now swear in the

next panel.

Mr. HORN. We have Mr. Jim Gerretson, Director of Operations,

Information, Assurance, ACS Defense, Inc.; Mr. Mark Rasch, senior

vice president and legal counsel, Global Integrity Corp.; and Mr.

James Adams, chief executive officer, iDEFENSE.

Gentlemen if you will just stand and raise your right-hands.

[Witnesses sworn.]

Mr. HORN. The clerk will note all three witnesses affirmed. We

will begin, Mr. Gerretson with you. It will be 5 minutes for a summary. We are going to have to stick to that. We all have your papers. If you were not in the room, they automatically go in at this

point in full. If you can give us a summary, and then we would like

to have some questions before noon. Then we are going to have to

break.

So, Mr. Gerretson, it is all yours.

STATEMENTS OF JIM GERRETSON, DIRECTOR OF OPERATIONS, INFORMATION ASSURANCE, ACS DEFENSE, INC.;

MARK RASCH, SENIOR VICE PRESIDENT AND LEGAL COUNSEL, GLOBAL INTEGRITY CORP.; AND JAMES ADAMS, CHIEF

EXECUTIVE OFFICER, iDEFENSE

Mr. GERRETSON. Mr. Chairman and members of the committee,

thank you for giving me the honor of testifying today. I am here

today to give you a brief presentation on hacking. We believe that

in order to start to fix your systems and networks, that you have

to understand the enemy, and hackers really are the enemy. The

following presentation will take you briefly through what we call

the hacker protocol and demonstrate just some of the tools and

techniques used by hackers to gain access to your systems.

All of the tools that you are going to see today are freely available on the Internet or you can go to a local computer show on a

weekend and, for $10 per CD, buy a full CD of different types of

hacks. The current data base that we have contains over 3

gigabytes of data. What you see on the screen before you is what

we call the hacker protocol. Different people may use different

terms, but professional hackers in nation states that implement

hacking as warfare do follow the same concepts.

The thing that is important to recognize here is this is highly

structured in its approach and in its planning. A good hack, for betVerDate 11-MAY-2000 10:28 Nov 08, 2000 Jkt 000000 PO 00000 Frm 00165 Fmt 6633 Sfmt 6633 C:\DOCS\67018.TXT HGOVREF1 PsN: HGOVREF1
162

ter or for worse, is invariably a well-thought-out, well-executed operation.

Mr. HORN. I might add on that very useful chart that, that will

be placed in the record at this point, without objection. All other

charts will be put in appropriately where they have been used by

the witness or the staff. So, all of those charts will go in the final

hearing report.

Mr. GERRETSON. Thank you, sir.

[Slide shown.]

Mr. GERRETSON. The first phase of the hacking protocol is intelligence gathering. This is primarily an espionage operation. There

are many facets to it. Social engineering is a large part. I may act

as a user calling up a help desk and say I have forgotten my password. Help desks are setup to be very helpful. They will frequently

say, the default password is, or your network is. So, I get a lot of

information that way.

Open source materials such as newspapers, prospectuses, and library magazine articles are also a wonderful way of getting information. You hear the term a lot, but ‘‘dumpster diving’’ is also a

very popular way of getting information on your system.

[Slide shown.]

Mr. GERRETSON. Once we have done the intelligence gathering,

the next step is to do reconnaissance. Again, to define the target.

Your domain host is the name of your computer system on the network. I want to know what I have got, see if I can attack it, and

how I can attack it. This is what we are going to show you. It is

a freely available program called NMAP. We are going to take that

information that we have gathered and scan your network to determine what is there. The program that we are using is called Ping

Sweep.

[Slide shown.]

Mr. GERRETSON. In simple terms, my computer is going out to

your network and saying, hello, are you there? Your computers are

coming back and saying, yes, I am. What you see here, with these

being listed, are computer targets that have come back and said,

I am here. What we have now done is identified a target set. We

are not wasting our time.

[Slide shown.]

Mr. GERRETSON. The next slide, we are going to take one of those

targets that we have identified and go and look for additional information. What we are trying to do is find out what services are

open, as you see, I am pointing out. These are all considered services on a computer. This one, for example, is finger, which we will

talk about in a second.

What we are doing is finding a means to attack your system. We

are also going to go out to try to find out the operating system that

your computer is running which is again identified. Once we have

this information, we can now go and do specific probes. What we

are going to do is take that information and look for a way to get

into your system.

[Slide shown.]

Mr. GERRETSON. This presentation that we are going to show you

now is one of the tools called Finger. It is an information gathering

tool, you are seeing it used in a way it was never intended to be

163

used. In order to attack and control the system, you need three

things. You need a valid user name. You need a valid password,

and you need a host address from the computer system that is allowed to talk to you.

If you look across here, as I am highlighting ‘‘student one,’’ I now

have a valid ID and I now have a valid computer system that I am

talking from. I have two of the three items that I need to attack

this system.

[Slide shown.]

Mr. GERRETSON. This next scan, web servers as we are all aware,

are a wonderful target for attack. It used to be that in order to do

the attack, I had to know all of the systems and all of the

vulnerabilities. Now, I have a tool that will run it for me automatically. It requires very little work on my part. It identifies the server type that is running and will simply go out and scan all of the

CGI weaknesses on this web system. I do not even have to know

what these systems are now.

I do not have to know what these vulnerabilities are. It just tells

me it finds one. I go out to my tool kit, pull in this particular attack and away I go. Once we do that, we are trying to get a toehold

on the system. This is basically I just get into your box any way

I can. I cannot control the data. I do not need it, but I am on it

and it gives me the next step.

[Slide shown.]

Mr. GERRETSON. The next step is to go from just being a user

into what we call the root or administrator level of the system then

we really do own this box. I am going to skip this example.

[Slide shown.]

Mr. GERRETSON. We are going to go and actually break into this

system and take it over. It acts as a user system. What this program does is it shows us actually going in and doing an attack on

the system that in a matter of about 15 seconds turns us into the

root administrator of the box, simply from being a user. Once we

have gotten control of the system, there are a lot things we can do.

We could kill this box. We could take the information. But what

we do want to do is use it again later. So, we are going to hide our

track. We do not want people to know we are there. We can do that

by deleting files or modifying log files. We are going to show you

a quick example of how we just simply modify a log file.

[Slide shown.]

Mr. GERRETSON. This is a program called Wipe. We have a user

account. We are called ‘‘Reacher.’’ We get into the system. If the

system administrator were to check his logs, he would say, why is

this guy here. But we have gone and wiped it. We are no longer

there. We are now invisible to the person that runs this machine.

[Slide shown.]

Mr. GERRETSON. We can put Trojans on the system. A Trojan is

a program that will look like something that is a valid program

that is supposed to be there, but in effect it is a program that does

a lot of bad things. In this brief example, listen. We can record

every keystroke you type on the system. We can turn on your

sound system. So, if you have a microphone, we can record everything that is said in the area, and you will never know what happened.

164

[Slide shown.]

Mr. GERRETSON. Now, sounds bad and it gets worse. I will make

a bold statement that if you are connected to the network, and if

I have enough time and want to make the effort, I can hack you.

The only sure fire way to protect your system is to disconnect it

from the network. Take out your floppy. Take out your CD and

then lock it up in a secure room. Anything short of that, eventually

it can be had.

It sounds pretty bad, but there is hope. It is not all bad; just

mostly bad. The first thing is you have to have a vulnerability assessment. You have to know what your security posture is. Second,

we believe in the defense-in-depth approach. It is vital. There is no

single solution to make your system secure. You have to have layered approachs that complement each other.

The next thing, training is the key. As the earlier witnesses said,

there are good people out there, but they just do not understand

security. One of the key things to recognize is the solution that

works today may not work in 6 months. You will never have a final

solution. You are constantly reassessing.

Thank you for your time.

[The prepared statement of Mr. Gerretson follows:]

165

166

167

168

169

170

171

Mr. HORN. Thank you very much.

We now have our second witness, Mr. Mark Rasch, who is the

senior vice president and Legal Counsel for the Global Integrity

Corp. Perhaps you would like to tell us a little bit about the corporation.

Mr. RASCH. Yes, thank you, Mr. Chairman.

I work for Global Integrity Corp. It is a company that does information security consulting work for the private sector. So, our clients tend to be things like banks, insurance companies, Fortune

100 companies that take the problem of information protection. Notice I used the term ‘‘information protection’’ and not computer security. They take that problem seriously.

What we are trying to protect here is not the computers themselves, but the information that is contained on those computers.

So, the perspective that I bring is what the private sector sees as

the problem and what the private sector is trying to do itself to try

to solve the problem. One of the things we noticed is that the Commerce Department issued a report in the last couple of days that

indicates that U.S. retail e-commerce sales for the fourth quarter

of 1999, that is October through December, was about $5.3 billion.

What has happened is this Internet that we created 20 years ago

is being asked to do something that it was never designed to do.

That is to support a national economy; to support a national infrastructure that it was never designed to do. So, what happens is we

have this distributed computer network, which was essentially unsecured. All of the security to that network is essentially added

afterwards.

That is being designed now and being asked to protect the critical infrastructure. The attacks that we saw a few weeks ago

against Yahoo, Ebay, and others also demonstrated another problem. As a lawyer, this is one that concerns me much more than

what concerned me about the year 2000 bug problem, from a litigation standpoint. That is that we are only as secure as everybody

else on the Internet.

As the previous panel discussed, these are targets of opportunity.

People attack systems because they can get in. They attack the

ones that they feel that they can get into. Also, the fact that even

if you have done stuff to harden your system, people will break into

other people’s systems and use those to attack you. So, what we

have is a serious looming litigation problem, or what we would call

downstream liability.

If you are attacked by somebody and the attack is coming from

another corporation that did not secure the systems, and you go to

your lawyer and ask, can we sue, which is always the dumbest

question to ask a lawyer because the answer is always yes. The

question is who are you going to sue, the 17- or 18-year-old hacker,

if they are ever identified, or the corporation from whom you are

attacked?

So, the idea of a worldwide web that is dependent upon the security of everybody else creates targets of opportunities, not just for

hackers, but for lawyers as well. One of the problems also that we

have seen is a massive increase, not only in the use of the Internet

and the use of the Internet for electronic commerce, but of these

types of criminal activity.

172

For example, from 1998 to 1999, theft of intellectual property increased from 15 percent. Unauthorized access by hackers from inside is up 28 percent. Insider abuse to the Internet is up 17 percent. System penetration by external parties increased 32 percent.

Why is this happening? The first reason is that attack technologies

are becoming very easy to use. So, as Mr. Gerretson just showed,

you can go to any hacker convention, pick up a copy of this disk,

put it in your machine, and knowing no more than a lawyer, which

is a fairly low standard I would say, put this in your machine and

launch an attack on any computer on the Internet.

You do not need to know a lot. It is point and click and you are

in. So, the tools are getting easier to use. They are becoming more

widely available. In addition, with the growth of the Internet, you

have tens of thousands and probably of millions of insecure computers out there that are used as targets of opportunity and methods of attack. The software is becoming increasingly complex and

much more difficult to secure.

Software manufactures who are building this software are trying

to design it to be functional. If you are coming out with a new word

processing program or you are trying to come out with a new operating system, and you are under competitive pressures to get it out

to market, you want to make sure that it is functional. Until companies demand security and the government demands security as

an integral part of functionality, I do not think the manufacturers

are going to ship these things as being at least more secure.

So, these are some of the problems. What is the private sector

doing? Well, speaking just for Global integrity, we are doing two

things working with the financial services industry, which I think

is a model for both the government and for other private sector enterprises. One of them is something called the BITS Laboratory

that we are working with the Banking Industry Technology Secretariat and a consortium of banks.

What they are doing is they are developing a series of security

standards. We at Global, are testing computer products, hardware,

software, and other types of products, against the security criteria.

The idea is that the marketplace then will say, for example, banks

will say unless your software had been tested against these criteria, we will not buy it. Unless it is pre-configured to be in a secured manner, we will not buy it.

So, we are using the marketplace as a method of trying to ensure

security. The second thing is the Financial Services Information

Sharing and Analysis Center [FSISA]. This is something that we

are doing. Financial services industries, banks, insurance companies, and the like have a secure method of sharing information

amongst themselves about attacks and vulnerabilities.

Let us face it, they do not want to tell people that they have been

attacked, but they are happy to share information among themselves, if that will lead to more security. These are some of the

models that are currently in place. We need to do more in the private sector and in the government sector to help secure the infrastructure.

Thank you.

[The prepared statement of Mr. Rasch follows:]

173

174

175

176

177

178

179

180

181

182

183

184

Mr. HORN. Thank you very much.

Our next witness and the last one on this panel is Mr. James

Adams, chief executive officer of iDEFENSE.

Mr. ADAMS. Chairman Horn and members of the committee, I

want to thank you very much for inviting me here today. Few revolutions are accomplished without bloodshed. Already as we plunge

headlong into the knowledge age, we are beginning to receive the

initial casualty reports from the front lines of the technology revolution.

From the headlines, you would think that the recent denial-ofservice attacks were the beginning of the end of cyber world as we

know it. Nothing could be further from the truth. These were mere

in-breaks on the audio-V commerce. Consider instead that some 30

countries have aggressive, offensive information warfare programs.

All of them have America firmly in their sights.

Consider too that if you buy a piece of hardware or software from

several countries, among them, some of our allies, there is real concern that you will be buying doctored equipment. It will syphon

copies of all material that passes across that hardware or software

back to the country of manufacture.

The hacker today is not just the stereo-typical computer geek

with a grudge against the world. The serious hacker today is much

more likely to be in the employ of government, big business, or organized crime. Consider the band of Russian hackers who, over the

past 2 years, have syphoned off an enormous amount of research

and development secrets from United States corporate and government entities in an operation code named Moonlight Mays television.

I would like to focus on this nexus between the public and private sectors, and on the government’s efforts to respond to the

growing threat. A couple of illustrations to begin; 20 years ago,

some 70 percent of all technology development was funded by the

public sector. Today, that figure is under 5 percent. In other words,

in the course of one generation, every government agency should

have changed how it does business.

Has that happened? No. Looking ahead for that same 20-year period, we will see the following. The ordinary computer that you

have on your desk will have the computing capacity of the human

brain. At the same time, research offers the possibility of our ability to manufacture perfectly the human body. So, in the course of

a generation, our view of life, death, family, society, and culture,

the bed rocks of our way of life down this century will have

changed forever.

Is government or the private sector thinking and planning for

such fundamental change? No. One further point; the pace of the

revolution is accelerating rapidly. Yet, the pace of change within

government seems to be exactly the same today as it was 10 years

ago. How has the government responded so far? Well, there has

been the usual President’s Commission and then the Principal’s

Working Group, then the bureaucratic compromise that nobody

really wanted, and then the national plan which arrived 7 months

late and was not a plan at all, but an invitation to further discussion.

[Chart shown.]

185

Mr. ADAMS. These two charts that I brought today illustrate the

current chaos. What you see is a totally disorganized organization

chart. One that, if it were in the private sector, would be a sign

of eminent bankruptcy. You see no clear leadership. You see duplication of efforts; the waste of billions of dollars of taxpayers’

money, and the struggle by stovepipe agencies to retain power, influence, and money.

In other words, there is no coherent strategy and the tactics are

not about winning a war, but about preserving turf. There are, of

course, some notable exceptions to this. You have heard from one

of them today, John Tritak. What is needed today is an outside entity with real power to implement drastic change in the way government approaches technology and the underlying security of its

systems.

What is needed most is a personal entity that would draw on

skill sets in many areas that will overlap those of the CIO, CFO,

or CSO, and most of the other officers or entities in any organization. Let us give this new person the title of chief of business assurance. He or she would be in charge of the Office of Business Assurance. Business assurance is more than security, more than technology, and more than a combination of the two.

It is an understanding of the whole environment and what that

means for a business or a public sector operation. The CBA’s task

would be to continuously gather and synthesize infrastructure-related trends and events to intelligently evaluate the technological

context within which the organization operates, to identify and assess potential threats, and then to suggest defense action.

Viewed from the positive side, to assess the technological revolutions’ opportunities and propose effective offensive strategies. The

Office of Business Assurance must be a totally independent organization with real teeth and real power within government. There is

much in common between government and industry when it comes

to the challenges and the opportunities that the technology revolution poses.

Both sectors face a common threat. Both sectors share common

goals. Both employ technologies that are, in essence, identical. Both

must work together to protect each other. I will leave you with this

thought. You will employee total transformations of the way business and government is conducted internally and externally going

forward. We have heard a great deal in recent months about the

potential of a digital divide that is developing between the computer-haves and the computer-have-nots.

I believe there is another digital divide that is growing between

the American Government and its citizens. If this committee’s efforts do not move forward in changing this culture inertia, there is

real danger that the digital divide that exist between the government and the private sector will only widen. We cannot afford a situation where the governed feel that their government is out of

touch and increasingly irrelevant to their lives.

Thank you.

[The prepared statement of Mr. Adams follows:]

186

187

188

189

190

191

Mr. HORN. Thank you. All three of you have made some really

excellent suggestions. Let me start some of this query. Let me note

that, Mr. Rasch, you were very active before you took your current

job. You were a trial attorney with the Fraud Section of the Criminal Division of the U.S. Department of Justice. You left the Department in 1991. You were the sole attorney in the Computer Crime

Unit. That was on a part-time basis.

The Computer Crime and Intellectual Property Section of the Department of Justice today consist of 18 attorneys. The Internet consisted of perhaps 60,000 computers. Then you have made some

very thoughtful things. Let me pursue this. I turned to Mr. Ryan,

the counsel to the subcommittee, when you were testifying. I said,

let us draft a bill that would make this simply illegal.

Now, how does the Justice Department, what does it use to be

able to get after hackers now? What laws? Do you need new legislation which would ban them and get those out of here?

Mr. Rasch, the principal statute that exist to prosecute Federal

computer crimes is 18 U.S.C. Section 1030, which is the Federal

computer crimes statute. That focuses on activities. For example,

intentionally accessing a computer without authorization or disrupting authorized access to a computer. So, for example, the recent attacks and the denial-of-service attacks squarely come within

the ambit of that statute and are being aggressively investigated

and could be prosecuted under that.

Mr. HORN. Is there any first amendment concerns on this?

Mr. RASCH. Probably not. This is action and not speech. Although

just as burning down a building may be an expression, it is certainly is not a protected expression. There are some first amendment concerns in the area of encryption and some legislation.

There is some case law on the question of whether or not software

itself acts as a form of expression. That relates to these type of

hacker tools.

The dissemination of hacker tools themselves; whether or not

that type of dissemination is criminal. There are really two separate statutes that could be used there. One is the Digital Millennium Copyright Act which passed last year, which is right now

being used in a civil lawsuit against the people who attempted to

reverse-engineer the DVD codes to allow them to pirate software

and things like that.

So far, it has withstood a challenge on Constitutional grounds.

The second one would be 18 U.S.C. Section 1029 which makes it

illegal to disseminate what are called access devices, which could

be such things as passwords and things like that.

Mr. HORN. Any comments on those?

Mr. ADAMS. I think you raise an interesting, Chairman. I would

just make this in addition to what Mark was saying. There has

been a great deal of focus on law enforcement. Of course, law enforcement has a prominent role to play in this. The speed of the

revolution is such that, that is very much after the fact, obviously.

An event has occurred. We failed and therefore we have to do

something about it.

By the time somebody is caught and prosecuted, the revolution

has moved several steps forward. So, we need to think about what

does the prevention look like in the globally virtual environment in

192

which we find ourselves. Then if that fails, of course you need

something to follow that up. The first step has to be a much more

comprehensive approach to prevention, warning, intentions, good

intelligence, and so on.

Mr. HORN. At this point, I am going to turn the Chair over to

the vice chairwoman, Mrs. Biggert, the gentle woman from Illinois.

I, unfortunately, have other commitments that I have got to do. I

want Mr. Turner and Mrs. Biggert to get all of the questions out

that they can. So, thank you particularly for functioning and coming here.

Mrs. BIGGERT [presiding]. Mr. Turner, you are recognized for

questions.

Mr. TURNER. Mr. Adams, you were showing us your two charts

here, which I guess were designed to display the multitude of efforts within various Federal agencies to deal with information system security. Rather than look at that as a failed effort, I guess it

shows that every agency is struggling to try to keep up with the

problem.

There are obviously some things that we ought to do to consolidate the effort. This battle is so dependent upon technical expertise. One of the battlefields where we should be fighting on is to

figure out how to train people to work for the good guys. There are

probably people within these Federal agencies that are noted to be

outstanding technical experts that do good work in trying to find

solutions and trying to make the systems secure.

Are we going to be constantly behind the curve in terms of what

government does? I think it is probably difficult to attract the best

and the brightest to the public sector. I am sure that Global Integrity and others of the world are going to be reaching out and trying

to pay the salaries necessary to attract the people who could really

create the defensive mechanisms you need.

Mr. ADAMS. I think those are very good points. We clearly face

a very difficult dilemma. The government is at the front line here,

as is the private sector. The private sector, my largest number of

recruits come from government agencies. The private sector is hiring the best and the brightest and moving forward very quickly.

Clearly, there needs to be a relationship between the public and

private sector. Look, for example, at what the CIA is doing to try

and keep itself up to speed with the pace of technology change.

It is doing that by establishing essentially a venture capital arm

that is the interface between the public and private sector. So, you

have that on the one hand; different ways of doing it. On the other

hand, something that the Federal Government can do dramatically

different is push education into the system, so that what we are

doing is seeding the next generation and the generation after that

to keep itself up to speed.

The Federal Government is going to be an enabler. It is not going

to be able to mandate very much. This revolution is occurring outside of its orbit. So, it can do a lot of things to influence it. It needs

to, I think, do that more creatively so that it is seeding the population. We have tremendous shortages of skills at the moment in

the whole area of computers, and computer security, information

security, and so on.

193

So, how to tackle that more creatively and aggressively is going

to be a very important issue which is partly where it all comes

back to leadership. You need to have a more creative and pushthrough process than we have at the moment.

Mr. TURNER. If you were to have a free hand at creating an entity that would do that, what would it look like?

Mr. ADAMS. Well, I think what the lesson we have learned in this

revolution from the private sector is that if you take an old economy company and you try and transition it to the new economy,

this will largely fail. What you have to do is do the Apple Computer model. You setup a new building, different people, and put

a pirate flag on the roof. They developed a culture and they forced

something else into the system, which is why this idea of a Business Assurance, some sort of entity that sits outside of the Federal

Government that is able to communicate effectively with the private sector and with the public sector and force through change.

What those charts illustrate is, as you rightly say, lots of people

try to fix it. These are people of good will, by and large. They are

unable to move collectively aggressively enough. They are falling

further and further behind in the revolution, which is this disconnect. It is very dangerous in a democracy. So, if you can have

a way of driving through change, something with real power, the

Koskinen model, but with muscle, not just please will you all sit

around the table.

If you do not do this, you will be held accountable for failure.

That is something where there is an opportunity perhaps because

it is the private sector that has the expertise and the energy. That

is going to continue to be the case. That is just going to be a fact

of life. So, much better to try and figure out a way to bridge that

gulf, rather than say, well, we can actually fix it all ourselves. It

is all about a partnership between the private and the public sector, making that work and then driving it into the public sector.

That is the trick for you all to try and come up with a way of

creating something very muscular that will force change, rather

than saying, well, let us get around to it in another couple of years.

Too late.

Mr. TURNER. Although we obviously have to let the CIA do their

own thing, would that kind of model work for the rest of government?

Mr. ADAMS. I think it is too early to say at the agency. Clearly,

what we know is that they are bringing some interesting technology back into the system. The problem comes then is this is a

voluntary exercise. We found this really cool stuff. We think you

should use it. Can the culture be forced to change? The CIA is a

very inert bureaucracy like a lot of government agencies. Will that

drive it through?

I think it is an interesting model in creating the place for dialog,

but it is a difficult challenge. For example, there is a government

agency that is currently revising its ways of procuring things, trying to keep on the front of technology. It feels that it is making a

big step forward by doing changes in 2 years; design and implementation in a couple of years. My company is not into design and

implementation in 90 days. I cannot afford to do it because I am

losing market share.

194

So, how do you change that culture to a place which is much

more reflective of what is happening in the private sector? It is a

very difficult challenge. It has to, I think, have somebody. You are

talking about very big picture stuff here; billions, and billions, and

billions of dollars, where you have a single entity that says you do

this my way or it is not going to happen; so forcing it.

This is very counter-culture to the way governments traditionally

work. One of the great strengths of democracy and the great

strength of government entities is that they slowly evolve. They

move forward to match a pace. Well, in a revolution that is very

hard because you cannot afford to evolve in the same way. You

have to either become a revolutionary or you get swept away. We

have seen examples of that throughout history.

That is why this is both a dangerous and a very challenging

time; dangerous because it can threaten the institutions that provide stability, but a tremendous opportunity for America as the

leading Nation in the world to move with the revolution, embrace

it, and drive it forward. The government and the private sector

have to come together somehow to make that so.

Mr. TURNER. Thank you.

Mrs. BIGGERT. Thank you. Mr. Gerretson and probably Mr.

Rasch, how vulnerable are home computer users? You mentioned

that the whole Internet is only as secure as the most vulnerable

link. Then after that, if after they surf the web and turn off their

modems, are there still risks to the system?

Mr. GERRETSON. I will take the first shot at that. The first answer is if you are on a dial-up modem, you are vulnerable while

you are connected. Cable modems and DSL are widely becoming

available now. They are always on. I run a private network at my

house. I have a firewall. Every night I have probably six to eight

of what I call drive by shootings where somebody comes and just

tries out my system to see if they can get a hold of it.

The answer is they are very vulnerable. There is very little protection on them because it sits on there. Without that firewall, I

probably would have been one of what they call the zombie machines attacking Yahoo and would have never known it. As the

cable modems and the DSLs get more and more ubiquitously available, it is a huge problem.

Mr. RASCH. I would mirror that. We did a study at Global where

we left a cable modem on at a home PC and simply tested it to see

how many times, without a firewall deliberately, to test to see how

many times it was attempted to be attacked. We found that in 1

month, almost 6,000 attempted attacks on a home PC.

What was interesting about that study, however, was the fact

that these attacks were coming from Eastern Europe, from Africa,

from Asia, as well as from the United States. So, these are coordinated concerted attacks on any computer that they can find on the

Internet. That would include home PCs in the always-on mode;

particularly, those on DSL connections or cable models.

Mrs. BIGGERT. So, in theory, these really then could lead you

into, let us say, a Federal agency through those computers?

Mr. RASCH. Absolutely.

Mr. GERRETSON. That is right.

195

Mrs. BIGGERT. OK. Then we talked in the first hearing about this

chart with the yellow bubbles at the top and sides representing the

executive branch, and then those organizations that also have a

stake-hold in the Federal computer security.

[The information referred to follows:]

196

197

Mrs. BIGGERT. So, to me, it looks very similar to your chart, Mr.

Adams. The problem is that we have kind of a blank in the middle.

So, would you all agree that we need an outside coordinator to be

in control of this to coordinate all of our efforts?

Mr. GERRETSON. Well, ma’am, I would say that my first question

when I saw this chart and I was talking to Mr. Ryan about this

is, who is coordinating the coordinators? It seems to be somewhat

disorganized. I would like to make one little statement about that.

The one advantage that the Federal Government has is that they

know they are screwed up. We do a lot of commercial work.

If you get outside of the IA Groups, they do not even know they

are in trouble. So, yes, you are lagging behind, in some cases, but,

at least you know you are lagging behind. That is kind of contrary

in view, but there are advantages to what you are doing. This is

a problem.

Mr. RASCH. What I see as the problem is a definition of function.

What we really need somebody to do is to say, not so much just

coordinate the efforts, but say, alright, testing. That is NIST. For

developing new technologies, that is somebody else. Basically, not

so much coordinating, but defining who has what roles. One of the

things that happened with the development of the Computer Emergency Response Team at Carnegie Mellon, the CERT Team, it was

a wonderful idea, and remains a wonderful idea, and works very

well.

Now, we have dozens, and dozens, and dozens of computer emergency response teams. The problem with that is it is like living in

a town that has 20 different 911 numbers. So, you run into a problem of who are you going to call. So, you need to really define the

functions first and then decide who is going to coordinate between

and among those functions.

Mrs. BIGGERT. This has been very interesting. Obviously, you

have heard the bells. We have another vote. So, I think that we

will have to adjourn at this time. We will be having several more

hearings. I know that we will be pursuing this more in-depth. I

agree with you that we are behind and we need to look at this

problem. I think that this has been a great start for this committee. So, I really appreciate you all participating and look forward

to asking more questions of you, I am sure, in the future when we

get into this.

So, without more, this committee hearing is adjourned.

[Whereupon, at 12:05 p.m., the subcommittee was adjourned.]

Æ