```

[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]

                    INDUSTRY SPEAKS ON CYBERSECURITY

=======================================================================

                                HEARING

                                 of the

                     SUBCOMMITTEE ON CYBERSECURITY,
                 SCIENCE AND RESEARCH, AND DEVELOPMENT

                               before the

                 SELECT COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED EIGHTH CONGRESS

                             FIRST SESSION

                               __________

                             JULY 15, 2003

                               __________

                           Serial No. 108-16

                               __________

    Printed for the use of the Select Committee on Homeland Security

 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 house

                               __________

                      U.S. GOVERNMENT PRINTING OFFICE
97-672 PDF                 WASHINGTON : 2004 _____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512-1800  
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-00012004

                 SELECT COMMITTEE ON HOMELAND SECURITY

                 CHRISTOPHER COX, California, Chairman

JENNIFER DUNN, Washington            JIM TURNER, Texas, Ranking Member
C.W. BILL YOUNG, Florida             BENNIE G. THOMPSON, Mississippi
DON YOUNG, Alaska                    LORETTA SANCHEZ, California
F. JAMES SENSENBRENNER, JR.,         EDWARD J. MARKEY, Massachusetts
Wisconsin                            NORMAN D. DICKS, Washington
W.J. (BILLY) TAUZIN, Louisiana       BARNEY FRANK, Massachusetts
DAVID DREIER, California             JANE HARMAN, California
DUNCAN HUNTER, California            BENJAMIN L. CARDIN, Maryland
HAROLD ROGERS, Kentucky              LOUISE McINTOSH SLAUGHTER,
SHERWOOD BOEHLERT, New York            New York
LAMAR S. SMITH, Texas                PETER A. DeFAZIO, Oregon
CURT WELDON, Pennsylvania            NITA M. LOWEY, New York
CHRISTOPHER SHAYS, Connecticut       ROBERT E. ANDREWS, New Jersey
PORTER J. GOSS, Florida              ELEANOR HOLMES NORTON,
DAVE CAMP, Michigan                    District of Columbia
LINCOLN DIAZ-BALART, Florida         ZOE LOFGREN, California
BOB GOODLATTE, Virginia              KAREN McCARTHY, Missouri
ERNEST J. ISTOOK, JR., Oklahoma      SHEILA JACKSON-LEE, Texas
PETER T. KING, New York              BILL PASCRELL, JR., New Jersey
JOHN LINDER, Georgia                 DONNA M. CHRISTENSEN,
JOHN B. SHADEGG, Arizona               U.S. Virgin Islands
MARK E. SOUDER, Indiana              BOB ETHERIDGE, North Carolina
MAC THORNBERRY, Texas                CHARLES GONZALEZ, Texas
JIM GIBBONS, Nevada                  KEN LUCAS, Kentucky
KAY GRANGER, Texas                   JAMES R. LANGEVIN, Rhode Island
PETE SESSIONS, Texas                 KENDRICK B. MEEK, Florida
JOHN E. SWEENEY, New York

                      JOHN GANNON, Chief of Staff

         UTTAM DHILLON, Chief Counsel and Deputy Staff Director

               DAVID H. SCHANZER, Democrat Staff Director

                    MICHAEL S. TWINCHEK, Chief Clerk

                                 ______

   SUBCOMMITTEE ON CYBERSECURITY, SCIENCE, AND RESEARCH & DEVELOPMENT

                    MAC THORNBERRY, Texas, Chairman

PETE SESSIONS, Texas, Vice Chairman  ZOE LOFGREN, California
SHERWOOD BOEHLERT, New York          LORETTA SANCHEZ, California
LAMAR SMITH, Texas                   ROBERT E. ANDREWS, New Jersey
CURT WELDON, Pennsylvania            SHEILA JACKSON-LEE, Texas
DAVE CAMP, Michigan                  DONNA M. CHRISTENSEN,
ROBERT W. GOODLATTE, Virginia          U.S. Virgin Islands
PETER KING, New York                 BOB ETHERIDGE, North Carolina
JOHN LINDER, Georgia                 CHARLES GONZALEZ, Texas
MARK SOUDER, Indiana                 KEN LUCAS, Kentucky
JIM GIBBONS, Nevada                  JAMES R. LANGEVIN, Rhode Island
KAY GRANGER, Texas                   KENDRICK B. MEEK, Florida
CHRISTOPHER COX, CALIFORNIA, ex      JIM TURNER, Texas, ex officio
officio

                                  (ii)

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

The Honorable Mac Thornberry, Chairman, Subcommittee on 
  Cybersecurity, Science, and Research & Development, and a 
  Representative in Congress From the State of Texas.............     1
The Honorable Christopher Cox, Chairman, Select Committee on 
  Homeland Security, and a Representative in Congress From the 
  State of California............................................    45
The Honorable Jim Turner, Ranking Member, Select Committee on 
  Homeland Security, and a Representative in Congress From the 
  State of Texas.................................................    62
The Honorable Robert E. Andrews, a Representative in Congress 
  From the State of New Jersey...................................    58
The Honorable Donna M. Christensen, a Delegate in Congres From 
  the U.S. Virgin Island.........................................    47
The Honorable Bob Etheridge, a Representative in Congress From 
  the State of North Carolina....................................    45
The Honorable Sheila Jackson-Lee, a Representative in Congress 
  From the State of Texas........................................    54
The Honorable Zoe Lofgren, a Representative in Congress From the 
  State of California............................................     1
The Honorable Loretta Sanchez, a Representative in Congress From 
  the State of California........................................    52
The Honorable Pete Sessions, a Representative in Congress From 
  the State of Texas.............................................    49
The Honorable Lamar S. Smith, a Representative in Congress From 
  the State of Texas.............................................    40

                               WITNESSES

Mr. Jay Adelson, CTO & Founder, Equinix, Inc.
  Oral Statement.................................................    18
  Prepared Statement.............................................    20
Mr. Whitfield Diffie, Chief Security Officer Sun Microsystems, 
  Inc.
  Oral Statement.................................................     8
  Prepared Statement.............................................    10
Ms. Tatiana Gua, Chief Trust Officer and Senior Vice President, 
  America On-Line (AOL) Core Services, AOL Time Warner
  Oral Statement.................................................    28
  Prepared Statement.............................................    30
Mr. Frank Ianna, President--AT&T Network Services, AT&T 
  Corporation
  Oral Statement.................................................    22
  Prepared Statement.............................................    24
Dr. James Craig Lowery, Chief Security Architect/Software 
  Architect and Strategist, Dell Computer Corporation
  Oral Statement.................................................    14
  Prepared Statement.............................................    16
Mr. Phil Reitinger, Senior Security Strategist, Microsoft 
  Corporation
  Oral Statement.................................................     2
  Prepared Statement.............................................     4

                                APPENDIX
                   Materials Submitted for the Record

Responses to Questions for the Record from Dr. James Craig Lowery    72
Responses to Questions for the Record from Mr. Jay Adelson.......    72
Responses to Questions for the Record from Mr. Frank Ianna.......    74
Responses to Questions for the Record from Ms. Tatiana Gau.......    78
Responses to Questions for the Record from Mr. Phil Reitinger....    79

 
                    INDUSTRY SPEAKS ON CYBERSECURITY

                              ----------                              

                         TUESDAY, JULY 15, 2003

                      U.S. House of Representatives
             Subcommittee on Cybersecurity, Science
                               and Research and Development
                     Select Committee on Homeland Security,
                                                   Washington, D.C.
    The subcommittee met, pursuant to call, at 10:02 a.m., in 
Room 2118, Rayburn House Office Building, Hon. William 
Thornberry [chairman of the subcommittee] presiding.
    Present: Representatives Thornberry, Sessions, Boehlert, 
Smith, Camp, Linder, Lofgren, Sanchez, Andrews, Jackson Lee, 
Christensen, Etheridge, Lucas, Langevin, Meek, Cox (ex 
officio), Turner (ex officio), also present, Dunn.
    Mr. Thornberry. [Presiding.] The hearing will come to 
order.
    This hearing of the Subcommittee on Cybersecurity, Science, 
Research & Development will take testimony today on industry 
perspectives on cybersecurity.
    And let me first thank each of the witnesses for making the 
effort to be here today. As you look down the line, it is truly 
not only a group that has a lot to offer to this subcommittee, 
but the world leaders in so many fields.
    So I appreciate each of you being here, and I appreciate 
the staff being able to assemble this panel and all we have, 
and enable us to learn from it.
    Ms. Lofgren and I again ask unanimous consent that members 
other than the chairman and ranking member waive oral written 
statements--oral opening statements, written opening statements 
will be made part of the record and each of the witnesses 
written statements will also be made a part of our record.
    And at this time the Chair will yield to the distinguished 
gentlelady from California, Ranking Member Ms. Lofgren.
    Ms. Lofgren. Thank you, Mr. Chairman.
    This is a terrific panel and I know that we at the end of 
the day will know more about what we face as a nation in the 
area of cybersecurity and will have, I think, a better idea of 
the prudent steps that we should take.
    I am especially pleased--I mean, every one of the witnesses 
is spectacular--but I would like to issue a special welcome to 
Whit Diffie, who was part of the encryption wars that Mr. 
Goodlatte and I engaged in with so many of the members of the 
committee a few years ago, and the inventor of public key 
encryption.
    I hope that as we hear from the witnesses, we can 
particularly hear about your company's investment into research 
and development on cyber vulnerabilities, and without going 
into specifics, learn about the various types of cyber attacks 
your company has faced in the past year, your company's 
policies on information-sharing relative to cyber attacks as 
well as any experience you have had in dealing with the 
Department of Homeland Security.
    As the chairman and I have discussed in past occasions, I 
think we all know the issue really is what benchmarks do we put 
in place, how do we audit or ensure benchmarks are being met, 
and which carrot and stick do we put in place.
    And those are broad categories, but the details are 
troublesome.
    And so that is what we are, I think, dealing with and we 
know that most of the infrastructure that needs to be protected 
is in the private sector, so it is absolutely so important that 
you are here today.
    And I would ask--well, we already have consent to put my 
full statement into the record.
    And I thank the chairman for yielding.
    Mr. Thornberry. Thank you, gentlelady.
    And I think we see things exactly the same.
    We are not going to be successful as a country without a 
partnership with each of you and other industry folks.
    So at this time I want to turn to our witnesses.
    As I mentioned, your full written statement will be made 
part of the record, and I will invite each of you to either 
summarize it or make such comments as you wish.
    We are going to go down the row.
    And I am going to start with Philip Reitinger, who is 
senior security strategist with Microsoft.
    Thank you for being here with us today.
    And you are recognized for five minutes.

 STATEMENT OF MR. PHIL REITINGER, SENIOR SECURITY STRATEGIST, 
                     MICROSOFT CORPORATION

    Mr. Reitinger. Thank you very much.
    Good morning.
    Good morning, Chairman Thornberry, Ranking Member Lofgren, 
and members of the subcommittee.
    As the chairman indicated, my name is Phillip Reitinger, 
and I am a senior security strategist with Microsoft 
Corporation.
    I want to thank you for the opportunity to appear before 
you here today to provide our views on an issue that affects 
government, businesses and consumers--cybersecurity. Microsoft 
is deeply committed to confronting the challenges of 
cybersecurity and we recognize our responsibility to make our 
products ever more secure.
    Our efforts accelerated after September 11 and crystallized 
when Bill Gates launched our trustworthy computing initiative 
in January 2002. Trustworthy computing is Microsoft's top 
priority and involves every aspect of the company. Last year, 
we had all 8,500 developers on the Windows team stop developing 
new code to focus on security. We spent over two months 
training our developers, reviewing the security of existing 
codes, reducing potential vulnerabilities, modeling threats, 
and conducting penetration testing of the code. This critical 
investment cost us an estimated $200 million dollars and 
delayed by months the release of our recent Windows Server 2003 
product.
    Trustworthy computing, broadly, means that we are working 
to ensure that computers better protect the security of 
personal and corporate information, enable people in 
organizations to control how their information is used, and are 
more reliable. Security, privacy, reliability and business 
integrity are the core pillars of our trustworthy computing 
initiative. In this effort, we are working to create products 
and services that are secure by design, secure by default, 
secure in deployment, and to communicate openly about security.
    Secure by design means two things. Writing more secure code 
and architecting more secure products and services. Secure by 
default means writing computer software that is secure out of 
the box, whether in a home environment or an IT department. 
Secure in deployment means making it easier for consumers and 
IT professionals to maintain the security of their systems. And 
communications means sharing what we have learned, both within 
and outside of Microsoft, particularly through our industry-
leading response center.
    The trustworthy computing goals are ingrained in our 
culture and are part of the way we value our work. Yet, we 
recognize that trustworthy computing and improved cybersecurity 
will not result from the efforts of one company alone. As 
demonstrated by my colleagues on this panel, we are not alone 
in these efforts. Microsoft is dedicated to working together 
with these industry partners and with government leaders to 
make the goals of trustworthy computing an industry-wide 
reality.
    We do so in a number of forums, including the IT ISACs, the 
Partnership for Critical Infrastructure Security, the National 
Cybersecurity Alliance and the Trusted Computing Group. We also 
recognize that technology, alone, cannot provide a complete 
answer.
    I want to outline a few specific areas where government 
policy can help promote cybersecurity. First, the government 
can help by recognizing IT products engineered for security and 
by securing its own systems. This can include purchasing 
common-criteria certified products, and even awarding a Malcolm 
Baldrige type of award for security solutions.
    Secondly, we support additional federal funding for 
cybersecurity research development, including university-driven 
research that can be transferred to the private sector so that 
industry can further develop this technology and deploy it 
widely.
    Third, we support an international law enforcement 
framework that establishes minimum criminal liability and 
penalty rules for cyber crime, so that cyber attackers cannot 
escape punishment for attacks against the United States by 
seeking refuge outside our borders.
    Fourth, the government must be both a provider as well as a 
consumer of valuable threat information.
    Finally, even with the creation of the Department of 
Homeland Security and the National Cybersecurity Division, both 
of which Microsoft supported, cybersecurity remains an 
interagency problem. Without a multi-disciplinary effort by 
both government and industry, we will not succeed.
    In conclusion, Microsoft is committed to strengthening the 
security of our products and services and is equally committed 
to working with governments and our industry peers on security 
issues.
    In the end a coordinated response to cybersecurity risks 
offers the greatest hope for promoting security and fostering 
the growth of a vibrant online economy. Thank you very much.
    [The statement of Mr. Reitinger follows:]

               PREPARED STATEMENT OF MR. PHILIP REITINGER

    Chainnan Thornberry, Ranking Member Lofgren, and Members of the 
Subcommittee: My name is Philip Reitinger, and I am a Senior Security 
Strategist at Microsoft reporting directly to Microsoft's Chief 
Security Strategist. I want to thank you for the opportunity to appear 
today to provide our views on an issue that affects governments, 
businesses, and consumers around the world--cybersecurity. It is the 
responsibility of all of us to ensure that the tremendous benefits of 
technology for governments, business and consumers are not thwarted by 
attacks on our computer systems. Because most cyber attacks are not 
discovered or, if discovered, are not reported, and because we have no 
national or international statistically rigorous measurement of damages 
from cyber crime, the exact cost of cyber attacks to companies and 
consumers is unknown. But four things are clear:
    First, there are people in cyberspace who seek to corrupt our 
systems. These criminals act with the knowledge that they are highly 
unlikely to be caught, let alone prosecuted and imprisoned.
    Second, the known damages are significant--perhaps in the billions 
of dollars annually. Software applications and operating systems, and 
the networks on which they reside, are ubiquitous and integral to 
society, and attacks upon them can cause significant disruption.
    Third, as September 11th taught us, our preconceived notions of the 
risk from terrorism and other threats may underestimate the actual risk 
by orders of magnitude. A cyber attack on the backbone of one of our 
nation's critical information infrastructures could disrupt America's 
physical and economic well-being and have a massive worldwide impact.
    Fourth, and most important, these attacks have an impact greater 
than immediate financial loss. Perhaps their greatest cost is the loss 
of consumer trust in information technology. Without such trust, 
society cannot realize the full potential of information technology. 
Thus, the effort to achieve cybersecurity--to achieve the trust 
necessary to reap the benefits of the digital age--is a critical 
priority for us all.
    At Microsoft, we are deeply committed to cybersecurity and we 
recognize our responsibility to make our products ever more secure. We 
are at the forefront of industry efforts to enhance the security of 
computer programs, products and networks, and better protect our 
critical information infrastructures. We also work closely with our 
partners in industry, government agencies and law enforcement around 
the world to identify security threats to computer networks, share best 
practices, improve our coordinated response to security breaches, and 
prevent computer attacks from happening in the first place. These 
efforts accelerated after September 11 and crystallized when Bill Gates 
launched our Trustworthy Computing initiative in January 2002.
    Today, I want to describe the ways in which we believe industry and 
government can work in partnership to promote cybersecurity. First, I 
will discuss our commitment to Trustworthy Computing and how it is 
reflected in our products and our research and development efforts. 
Next, I will discuss our efforts to join forces with industry and 
government to help guard against cyber-threats and enhance security for 
businesses and consumers. Finally, I will address government's critical 
and tailored role in enhancing cybersecurity.
    Microsoft's Commitment to Trustworthy Computing
    Trustworthy Computing is Microsoft's top priority and involves 
every aspect of the company. Last year, we had all 8,500 developers on 
the Windows team stop developing new code to focus on security. We 
spent over two months training our developers, reviewing the security 
of existing code, reducing potential vulnerabilities, modeling threats 
and conducting penetration testing of the code. This effort cost us an 
estimated $200 million dollars, and delayed by months the release of 
our recent Windows Server 2003 product. But we know that it was worth 
these costs, and it was a critical step to enhance the security of 
Microsoft's key software platform.
    ``Trustworthy Computing'' broadly means that we are working to 
ensure that computers better protect the security of personal and 
corporate information, enable people and organizations to control how 
their information is used, and are more reliable. We also are working 
to ensure that when problems do arise, they can be resolved immediately 
and predictably. Security, privacy, reliability and business integrity 
are the core pillars of our Trustworthy Computing initiative.
    The security pillar of Trustworthy Computing is most relevant for 
today's hearing. Under this pillar, Microsoft is working to create 
products and services that are Secure by Design, Secure by Default, and 
Secure in Deployment, and to communicate openly about security.
         ``Secure by Design'' means two things: writing more 
        secure code and architecting more secure products and services. 
        Writing more secure code means using a redesigned software 
        development process that includes training for developers, code 
        reviews, automated testing of code, threat modeling, and 
        penetration testing. Architecting more secure products and 
        services means designing products with built in and aware 
        security, so that security imposes less of a burden on users 
        and security features are actually used.
         ``Secure by Default'' means that computer software is 
        secure out of the box, whether it is in a home environment or 
        an IT department. It means shipping products to customers in a 
        locked-down configuration with many features turned off, 
        allowing customers to configure their systems appropriately, in 
        a more secure way, for their unique environment.
         ``Secure in Deployment'' means making it easier for 
        consumers and IT professionals to maintain the security of 
        their systems. We have a role in helping consumers help 
        themselves by creating easy-to-use security technology. Due to 
        the complexity of software and multiple environments in which 
        it may be placed, software will never be perfectly secure while 
        also being functional. Accordingly, ``secure in deployment'' 
        means providing training on threats and security; offering 
        guidance on how to deploy, configure and maintain products 
        securely; and providing better security tools for users, so 
        that when a vulnerability is discovered, the process of 
        patching that vulnerability is simple and effective.
         ``Communications'' means sharing what we learn both 
        within and outside of Microsoft, providing clear channels for 
        people to talk to us about security issues, and addressing 
        those issues with governments, our industry counterparts, and 
        the public.
    The Trustworthy Computing goals are real and specific, and this 
effort is now ingrained in our culture and is part of the way we value 
our work. It is demonstrated by our enhanced software development 
process. It is demonstrated by our continued development of more 
sophisticated security tools, including threat models and risk 
assessments, to better identify potential security flaws in our 
products. It is demonstrated by our formation of what we believe to be 
the industry's best security response center to investigate immediately 
any reported product vulnerability and build and disseminate the needed 
security fix. And perhaps more clearly than anything else, it is 
demonstrated by our delay in releasing a product for months to continue 
to improve its security. In short, security is--as it should be--a 
fundamental corporate value. We make every effort to address security 
in the initial product design, during product development, and before a 
product's release, and we remain committed to security in the product 
once it has gone to market.
    At times, of course, people worry that increased security may lead 
to an erosion of privacy. It is important to note that we do not view 
security and privacy as in inevitable conflict. In fact, we think 
technology can help protect both simultaneously. We hear repeatedly 
from customers that they need new ways to control how their digital 
information is used and distributed. In response, we are working on a 
number of emerging rights management technologies that will help 
protect many kinds of digital content and open new avenues for its 
secure and controlled use. For example, we are on the verge of 
releasing Microsoft Windows Rights Management Services (RMS), a premium 
service for Windows Server 2003 that works with applications to help 
customers protect sensitive web content, documents and e-mail. The 
rights protection persists in the data regardless of where the 
information goes, whether online or offline. In this way it allows 
ordinary users and enterprises to take full advantage of the 
functionality and flexibility offered by the digital network 
environment--from sharing information and entertainment to transacting 
business--while providing greater privacy and persistent protections.
    Much work on Trustworthy Computing, however, remains ahead of us. 
One key piece of that work is the Next-Generation Secure Computing Base 
(NGSCB). This is an on-going research and development effort to help 
create a safer computing environment for users by giving them access to 
four core hardware-based features missing in today's PCs: strong 
process isolation, sealed storage, a secure path to and from the user, 
and strong assurances of software identity. These changes, which 
require new PC hardware and software, can provide protection against 
malicious software and enhance user privacy, computer security, data 
protection and system integrity. We believe these evolutionary changes 
ultimately will help provide individuals and enterprises with greater 
system integrity, information security and personal privacy, and will 
help transform the PC into a platform that can perform trusted 
operations, to the benefit of consumers.
    Microsoft's Collaboration with Third Parties on Security 
Initiatives
    Notwithstanding the robust nature of our own efforts, we recognize 
that Trustworthy Computing and improved cybersecurity will not result 
from the efforts of one company alone. And, as will be demonstrated by 
my colleagues from this and the next panel, we are not alone in these 
efforts--responsible information technology companies increasingly 
focus on security as a key corporate goal. Microsoft is dedicated to 
working together with these industry partners and with government 
leaders to make the goals of Trustworthy Computing an industry-wide 
reality. For example, as part of our work on NGSCB, we work with a 
variety of hardware and software partners to ensure that the PC 
platform has built-in protection against future viruses, threats from 
hackers, and unauthorized access to private information and digital 
property.
    In April of this year, we joined four other industry partners (AMD, 
Intel, IBM and Hewlett-Packard) in establishing the Trusted Computing 
Group (TCG), a not-for-profit organization formed to develop, define, 
and promote open standards for hardware-enabled trusted computing and 
security technologies. The primary goal is to help users protect their 
information assets (data, passwords, keys, etc.) from external software 
attack and physical theft and to provide these protections across 
multiple platforms, such as servers, PDAs, and digital phones.
    In addition to these efforts, Microsoft remains committed to a 
multi-disciplinary approach to security that extends beyond technical 
solutions and specifications. Early detection and warning of 
cybersecurity threats, public education on cybersecurity, incident 
response, and prosecution of cyber-crimes, among other things, are all 
key aspects of creating a more secure computing environment. In order 
to have effective prevention and response, there must be an emphasis on 
cooperation and information sharing. For this reason, we have been 
supporters of the National Cyber Security Alliance and the Partnership 
for Critical Infrastructure Security, and we work closely with 
government agencies and other industry participants on both an 
informational and operational level to prevent and investigate computer 
intrusions and attacks.
    We also helped found the Information Technology - Information 
Sharing and Analysis Center (IT-ISAC) and provided its first president. 
The IT-ISAC coordinates information-sharing on cyber-events among 
information technology companies and the government. We continue to 
support and are working with other members to improve the IT-ISAC's 
efforts to coordinate among members, with the government, and with 
other ISACs. Such efforts are critical because this nation's 
infrastructures were and are designed, deployed, and maintained by the 
private sector. The interdependencies among infrastructure sectors mean 
that damage caused by an attack on one sector may have disruptive and 
perhaps devastating effects on other sectors. Voluntary information 
sharing and industry-led initiatives, supported by government 
cybersecurity initiatives, comprise an essential first line of defense 
against such threats.
    We believe that the information sharing engendered to date by the 
IT-ISAC and other ISACs is an important step in enhancing public-
private cooperation in combating cybersecurity' threats. Yet, there 
remains room for progress and government and industry should continue 
to examine and reduce barriers to appropriate exchanges of information, 
and build mechanisms and interfaces for such exchanges. This effort 
must involve moving away from ad hoc exchanges and toward exchanges 
that are built into business processes. This will require working 
toward a common understanding of the information that is valuable to 
share, when and how such information should be shared, and the means by 
which shared information will be protected. The keystones are trust and 
value--if an information sharing ``network'' provides value and the 
participants trust it, then information will be shared. While the 
appropriate structure and form of this network are still evolving for 
both industry and government, we are eager to see a robust exchange of 
information on cybersecurity threats and will work with government, our 
industry partners, and with the ISAC community toward that goal.
    Where Government Policy Can Make a Difference
    While the sorts of technology-related steps outlined above can 
address many of the security challenges we face, technology alone 
cannot provide a complete answer. A comprehensive response to the 
challenges of cybersecurity depends on both technology and public 
policy--and critically, on how technology and policy interact with and 
complement one another. I want to outline a few specific areas where 
government policy can be particularly helpful in promoting 
cybersecurity.
    First, the government, through public attestations and its own 
security practices and procurement efforts, can help by recognizing IT 
products engineered for security. For example, the late Commerce 
Secretary, Malcolm Baldridge, was honored by having a quality award 
named after him and bestowed upon businesses that demonstrate 
outstanding quality in certain areas. We understand that the Department 
of Homeland Security is considering a similar award for high quality 
security solutions. We think this is a good idea and we are ready to 
support the government as it develops and implements this visible 
incentive.
    Likewise, the government can lead by example by securing its own 
systems through the use of reasonable security practices and buying 
products that are engineered for security. Where appropriate--such as 
for national security agencies and other agencies, issues, and services 
for which security is of the utmost importance--this should include 
purchasing products whose security has been evaluated and certified 
under the internationally-recognized (and U.S. supported) Common 
Criteria for Information Technology Security. Such efforts to procure 
only security-engineered products, and specifically such clear support 
for the Common Criteria, will help strengthen the government 
infrastructure. In doing so, the government also will help set a high 
standard for security--one that ultimately is necessary to enhance the 
protection of critical infrastructures.
    Second, public research and development can play a vital role in 
advancing the IT industry's security efforts. Accordingly, we support 
additional federal funding for cybersecurity research and development 
(R&D), including university-driven research. The public sector should 
increase its support for basic research in technology and should 
maintain its traditional support for transferring the results of 
federally- funded R&D under permissive licenses to the private sector 
so that industry can further develop the technology and deploy it 
widely.
    Third, Microsoft believes that greater cross-jurisdictional 
cooperation and capability among law enforcement is needed for 
investigating cyber-attacks. Cyber-attackers can easily transit any 
border, as demonstrated by the I LOVE YOU and Anna Kournikova viruses 
and the Solar Sunrise attacks, all of which were international in 
scope. Enhanced law enforcement cooperation across local, state and 
international borders, along with increased law enforcement capability 
internationally, is vital for law enforcement to prevent and 
investigate cyber attacks. We therefore support an international law 
enforcement framework that establishes minimum criminal liability and 
penalty rules for cyber crime so that cyber-attackers cannot escape 
punishment for cyber attacks against the U.S. by seeking refuge outside 
of our borders.
    Fourth, government has a critical role to play in facilitating 
information sharing. Government sharing its own information with 
industry is essential both to protect critical infrastructures and to 
build value in an information sharing network. In short, the government 
must be a provider as well as a consumer of valuable threat 
information.
    Finally, government must recognize that even with the creation of 
the Department of Homeland Security and the new National Cyber Security 
Division (NCSD)--both of which Microsoft supported--cybersecurity 
remains an interagency problem. Accordingly, one of the key roles for 
the new Department, and specifically for NCSD, will be building 
incentives for effective government action, helping other government 
agencies develop new business processes that support homeland security, 
and reducing government stovepipes. Without a multidisciplinary effort 
by both government and industry, we will not succeed.
    Conclusion
    Microsoft is committed to strengthening the security of our 
products and services and is equally committed to working with 
governments and our industry peers on security issues, whether by 
offering our views on proposed regulatory and policy measures or 
participating in joint public/private security initiatives. In the end, 
a coordinated response to cybersecurity risks--one that is based on 
dialogue and cooperation between the public and private sectors--offers 
the greatest hope for promoting security and fostering the growth of a 
vibrant online economy.

    Mr. Thornberry. Thank you.
    We will now turn to our next witness, which is--who has 
already been partially introduced, Whitfield Diffie is vice 
president and fellow at Sun Microsystems, and has been one of, 
if not the key leader in public key cryptography. And thank you 
for being here. You are recognized for five minutes.

STATEMENT OF MR. WHITFIELD DIFFIE, CHIEF SECURITY OFFICER, SUN 
                       MICROSYSTEMS, INC.

    Mr. Diffie. Well thank you very much.
    When people look back on this era we are in, the end of the 
twentieth century, the beginning of the twenty-first, I think 
what is going to be remembered is the era of a transition from 
a physical society to a virtual society, an information 
society, an electronic society. And things that we now regard 
as fairly arcane security mechanisms will come to be seen as 
fundamental social mechanisms in the same way that 
interpersonal recognition, which is a security mechanism, is 
perhaps the most fundamental mechanism of society.
    Now, information security at this point is in my view 100 
years old. There is a lot of prehistory, a lot of cryptography 
in the Renaissance and things like that. But the critical thing 
was the introduction of radio, because radio was the 
communications medium so valuable that nobody could afford to 
ignore it. And yet it was a medium in which all of the 
traditional security measures typified by the diplomatic pouch 
had no applicability at all. And consequently, cryptography was 
the only mechanism available to protect radio.
    Now there are some other more technical ones, but 
cryptography is the most general one. And that swamped the code 
clerks.
    First World War, they were working with techniques intended 
to encrypt a small volume of messages that were going to go 
into other protective channels. Suddenly they had to encrypt a 
vast fraction of what was communicated by radio. And this 
started a race to automation and a race to develop good 
cryptography that dominated information security for most of 
the twentieth century. I am pleased to say that I think that as 
a practical matter, we have largely solved that kind of 
problem. And I will just list one example of something that 
happened within the past few months.
    Within the past 4 years or so, the U.S. adopted a new 
national cryptographic standard. It is called the Advanced 
Encryption Standard. And it was actually formally adopted the 
26th of November, 2001. Unlike its predecessor, the data 
encryption standard, it was designed to be as secure as anybody 
could want. And that fact has been recognized this spring in 
the issuance of CNSS-15, policy memorandum from the Committee 
For National Security Systems, recognizing the AES is adequate 
to be used for the protection of classified national security 
data.
    Now, there is still a long way to go. Even in that 
direction we are a long way from having the first piece of 
comsec equipment that uses AES. But this is a crucial 
milestone.
    Later in the 20th century, communications security, 
cryptography centered security was joined by computer security. 
And in the first generation of this in the 1970s and 1980s, the 
envision was what was then called timesharing, lots of 
processes running on the same computer. That program was not 
entirely successful, although I am pleased to say that one of 
its best products is one of ours: Sun's trusted Solaris system 
is used widely throughout the federal government for high 
security applications.
    But what happens if a secure computing, more than if the 
problem was solved, was that the problem changed?
    And it became a problem of network security, and we went 
into--curiously, one of the greatest developments in security 
is something Sun not originated but certain pioneered, which is 
client-server computing: dividing functionality out among the 
computers of a network so that one appeals to another for 
services.
    We introduced the Java programming language--a different 
style of writing programs with security very high among its 
qualifications.
    Cryptography has become much more widely available and much 
better developed than it was back in the first period of 
computer security.
    And the cost of hardware has fallen so that we can support 
computer security better with dedicated hardware.
    In short, we have a whole new ball game. It also happens we 
have a whole new challenge.
    Today when we say, as say a lot at Sun, The network is the 
computer, we are not saying a shadow of what we will be saying 
when we say that five to 10 years from now.
    We are entering an era--the current buzzword is ``Web 
services.'' I don't know if the buzzword will persist, but the 
concept will endure.
    Computers communicating with computers and subcontracting 
work to them. You need data mining done? You need a movie 
rendered? You go out and you look at yellow pages, you find a 
computer, a resource that has the equipment to do this, and you 
get it done, they return their bill.
    Suddenly we face a new set of security requirements and 
these are characterized by negotiation--one computer has to 
agree with the other what is going to be done; and by 
configuration control--a computer has to demonstrate to the 
other that it is capable of doing these things.
    So we are in the infancy of a computer-mediated society and 
economy. And one of the critical things we know: We have to be 
careful. The decisions we make in security today are going to 
influence the structure of society all through the 21st 
century.
    So we need both not to rush into regulation, particularly 
not to respond to disasters by sudden patch-up regulations, but 
to exercise foresight in this area to devote efforts to 
studying this area and to plan well for the security measures 
we need.
    Very often the short sight of individual users drives 
security policy. They prefer what appears to be convenience in 
applications over a sound structure that gives them secure 
operation because they don't anticipate the inconvenience of 
being broken into and having lots of down time. I think that 
government will have a big but what must be a very carefully 
considered role to play in this.
    Security is going to be far more than just technology. It 
is going to influence law, it is going to influence business. 
The example I gave in my written testimony is: You capture the 
current contracting and subcontracting mechanism in things that 
happen in fractions of a second between computers. What are you 
going to do about adjudication? Nothing we have at the moment 
speaks to the time scale and complexity of operation--of 
business operations--that is approaching.
    I would like to close with one concrete suggestion, 
prefaced with some very important thanks. There was a proposal 
within the past year ago to move the computer security division 
of NIST into the new homeland security department. And we at 
Sun and many in industry thought that this was ill-considered 
because that division had learned over its 15 years of 
operation after the Computer Security Act of 1986 to work with 
industry, to field standards that industry actually accepted 
and used.
    And we feared that the move into a department with a more 
military and more classified and more closed style would lead 
to standards that were not so enthusiastically received by 
industry.
    So I would like particularly to thank representatives 
Boehlert, Goodlatte and Lofgren for their support in this 
matter.
    But I think the computer security division at NIST needs 
much more support and has now a vital role to play. My 
colleague spoke about the importance of common-criteria 
certification for security processes. And that is a very 
valuable mechanism; it is very much in need of improvement.
    The set of classifications within that system are 
complicated, hard for users to understand, hard for them to 
know the difference between something certified at EAL-2 and 
EAL-4. It needs to be simplified; evaluation needs to be 
improved and speeded up, but probably most important--something 
that the government is best placed to do--is that a validation 
mechanism for these ratings needs to be put in place, something 
that follows this history of evaluated products, determines 
whether they are really functioning securely, and is able to 
speed back the record of break-ins or attempted break-ins to 
these products in order to improve the evaluation products and 
guarantee that when we have security certification it really 
means the things are secure.
    Thank you very much.
    [The statement of Mr. Diffie follows:]

PREPARED STATEMENT OF MR. WHITFIELD DIFFIE, CHIEF SECURITY OFFICER SUN 
                           MICROSYSTEMS, INC.

    When historians write the history of the late 20th century and the 
early 21st, they are likely to see it as the period when the world 
moved from the physical to the virtual. When face to face meetings, 
written letters, and visits to showrooms were progressively replaced by 
phone calls, e-mail, and web browsing. As information, and with it 
human culture, come to travel more and more in a digitized, computer-
mediated world, the computer and communications infrastructure must be 
expanded to provide the fundamental mechanisms needed to support the 
totality of human culture. One of these, widely recognized but little 
understood, is security.
    Information security: essentially, the protection of information in 
electronic media, is about a century old. The field has a long 
prehistory. Information has been protected on paper and in crude 
telecommunication channels, like signal fires, for millenia but 
information security as we know it today dates from the development of 
radio and from the use of radio in WWI.
    The first major problem in information security was cryptography. 
Despite cryptography's romantic aura and long history, prior to radio, 
cryptography was always a secondary security measure. A dispatch on 
paper might be enciphered but its primary protection lay not in the 
encryption but in the careful handling of the diplomatic bag. Although 
telegraph messages were frequently sent in code, the customers were 
relying more on the integrity of the telegraph companies than on the 
codes for security.
    The use of radio, particularly military radio in wartime, was 
different. Radio was so valuable that no one dared forgo its use. Prior 
to radio, Britain's First Sea Lord, who commanded the largest navy in 
the world had only a vague idea of where his ships were. He might 
dispatch a flotilla on a mission and not hear anything about their 
progress for weeks or months. Within a few years of the introduction of 
radio, the First Sea Lord could expect to reach any ship in the fleet 
within hours. Today, of course, with the exception of submarines, this 
process is virtually instant, like making any other phone call.
    The problem with radio from a security viewpoint is that everyone 
can listen to the radio and often the people you don't want listening 
get better reception than the ones you do. This promoted cryptography 
from a secondary security measure to a primary one. It was the only 
security measure of any use in protecting radio transmissions and it is 
still the primary one. The result was to swamp the code clerks, whose 
hand techniques were designed to add extra protection to a small 
fraction of military traffic, not provide the primary protection to 
most of it.
    The result was the race to automate cryptography, and the resultant 
race to automate cryptanalysis, that dominated cryptography throughout 
the 20th century. For half a century, military cryptography was 
dominated by rotor machines: electromechanical devices that embodied 
cipher alphabets in rotating wheels and automated the polyalphabetic 
ciphers that had been known since Renaissance Italy but had been too 
prone to errors to see extensive use. Mechanization reduced the errors, 
increased the speed, and allowed much more thorough protection than 
could be achieved by hand.
    In the 1930s, a new kind of rotor machine was developed in the US, 
one in which the wheels, of one rotor machine were moved by the actions 
of another rotor machine. This machine, called Sigaba, was the most 
secure cryptosystem of its era and it appears that no Sigaba traffic 
was read in the WWII period.
    By the time of WWII, the US had secure cryptographic systems for 
protecting ten-characterper-second telegraph traffic but little ability 
to protect voice or other broader-band signals. The first secure 
telephone was developed during the war. The system, called Sigsaly, 
provided very secure, surprisingly comprehensible voice communications 
with one severe drawback: the system occupied thirty-racks of 
equipment, weighed as many tons, and cost millions. At first, the only 
customers who could ``afford'' Sigsaly were Roosevelt and Churchill. 
Even though, Sigsaly's were later provided to major military commands, 
there were never more than a dozen of them. However limited in 
deployment, Sigsaly was proof of concept for secure voice and the need 
to develop higher speed cryptosystems dominated cryptographic 
development for decades.
    Although, like all important subjects, cryptography is still beset 
with profound unsolved problems, it is no longer the limiting resource 
in secure communication that it was for most of the 20th century. Good 
cryptographic systems are now available and the mathematical 
foundations on which they rest are widely understood.
    The new status of cryptography is exemplified by the US Advanced 
Encryption Standard (Federal Information Processing Standard 197). AES 
is the successor to the US Data Encryption Standard (FIPS-46) which was 
adopted in 1977. At that time, the National Security Agency, recognized 
the need for a cryptographic system to protect government information 
outside the national-security sphere. Because such a system could not 
achieve its objectives without being made public, NSA worried that it 
would also be used by the enemies of the United States. The result was 
a compromise, a system that NSA considered strong enough for its 
intended application but weak enough that it would not present an 
insurmountable obstacle if NSA encountered a DES cryptogram that it 
felt sufficiently motivated to read. The development process, although 
formally open, was in fact closely held and the compromise became the 
subject of a long-running controversy.
    When the DES came to the end of its useful lifetime in the late 
1990s, the National Institute of Standards and Technology set out to 
replace it. This time the process was entirely different. After a 
public process of developing the requirements for the new algorithm, a 
solicitation drew fifteen candidates from around the world. The 
candidates were studied over a period of two years in a process that 
involved three public conferences. Five finalists were selected from 
the fifteen and then one winner was selected from the finalists. On the 
26th of November 2001, an algorithm designed in Belgium was selected as 
the national standard of the United States.
    To those who had watched the evolution of US cryptographic policy 
over the previous three decades, the AES seemed miraculous but an even 
more surprising turn occurred this spring, which was publicly announced 
in June. The Committee on National Security Systems of the Department 
of Defense issued Policy Directive 15, which authorized the use of AES 
(in approved implementations) for all levels of classified national 
security information. It will be years before we are applying COTS 
infosec technology to the majority of our national security systems but 
we have just passed a essential way point on that road.
    Although, unification of other aspects of cryptography have not 
reached the same level of standardization, key-management techniques 
based on the first generation of public-key cryptographic systems is in 
use for both government and private sector security. Second generation 
key-management techniques based on elliptic curve cryptosystems 
promises a greater degree of unification within the decade.
    In the latter half of the 20th century, cryptography was joined by 
another information security problem: secure computing. With the 
development of computers capable of running more than one program at a 
time, came the problem of running two different programs with different 
security levels or different owners and preventing them from 
interfering with each other. In the 1970s and 1980s there was great 
optimism about the prospects of developing a multi-level secure 
operating system.
    This program called for extensive system specifications and formal 
verification that the systems met their specifications. This proved 
expensive and fewer systems emerged than had been expected. Among the 
successes is Sun's Trusted Solaris, a high-security operating system 
that is widely used in DoD and the Intelligence Community. In a 
reflection of the rising importance of security, the enhanced-security 
features of Trusted Solaris are being steadily integrated into the 
main-stream Solaris product and the two systems will be merged in the 
next major release.
    Despite such isolated successes as Trusted Solaris, the problem of 
secure computing has been transformed more than solved. In the 1970s an 
organization of moderate size, such as Rand or the MIT Lincoln 
Laboratory would have a small number of big computers, perhaps only 
one. Every program that was run would have to be run on the one 
machine. If it was so sensitive that it could not be run in the 
presence of other programs, for fear that they might be spying on it, 
it would have to pay the high price of having the machine to itself.
    As the seventies flowed into the eighties, two factors came 
together to change this. Computers got cheaper and became available at 
a variety of prices and a variety of levels of performance. Equally 
important, the ARPAnet, ancestor of the Internet, became available. 
This meant that a sensitive project no longer had to make arrangements 
for using a shared computer. It could purchase its own computer, 
appropriate to its needs an budget, put the computer in a room, and 
lock the door. Its communications with the outside world, if it needed 
any, could be handled through network channels more easily controlled 
than the communication paths internal to an operating system.
    Client-server computing, the concept on which Sun was built, 
although rarely thought of as a security mechanism, has made a major 
contribution to security. In the network environment, a sensitive 
database can be isolated on a machine by itself, communicating with the 
rest of the world through a network connection. Enforcing the 
databases' access policies against users of other machines on a network 
is far easier than enforcing them against other users on the same 
machine.
    Another key success in computer security came with the Java 
language. In the 1970s, DoD aspired to purchase ``untrusted'' 
applications, such as compilers and run them on classified data, in 
this case secret programs. Untrusted in this case means ``uncleared.'' 
The programs in question came from reputable software manufacturers but 
from manufacturers who did not have DoD facility clearances or cleared 
workforces. In the 1990s, this objective was magnified several fold. 
With the rise of the Internet, it became valuable for client computers 
to import applet programs in real time from servers. As the cost of 
putting up a server is small, the applets no longer could be counted on 
to come from reputable computer manufacturers. ``Untrusted'' had 
reached a new level; a workstation needed the ability to run programs 
about which it knew nothing and get useful work out of them, without 
exposing itself to excessive risk. The Java solution is to write the 
programs in a portable language which is structured to allow the client 
machine to verify the structure of the incoming program before 
executing it.
    Given the substantial effort that has been devoted to computer 
security over the past thirty years, the mixed results of that effort, 
and the fact that the need for security is steadily increasing, it is 
reasonable to ask what the prospects are today for major improvement. 
If one answers, as I would, that the prospects are quite bright, one 
must also answer the question ``Why?''
    As described above, the answer is that in large part, we are facing 
a new problem. The computer security problem seen in the 1970s has 
changed into a network security problem of the 21st century. Some 
problems have been solved, some problems remain, and many new problems 
have appeared. Equally important is the fact that new tools have become 
available. In the 1970s, cryptography was primitive by comparison with 
its development today. Two aspects of cryptography especially crucial 
to computer security, public key cryptography and hashing functions 
were in their infancy. Equally important, the National Security Agency, 
whose monopoly of cryptographic erudition was far greater then than 
now, was the major backer of secure computing research but discouraged 
the application of much cryptographic techniques to the problem in 
unclassified research. The final piece of the puzzle is the ever-
decreasing cost of computing. It is now feasible to dedicate computing 
capacity to security in a way that was not feasible even a decade ago.
    An early example of a hardware-based approach to security problems 
is the domaining system of Sun's E12K and E15K servers. These servers 
can assign processors to processes and confine the resources available 
to those processes within a hardware-enforced domain. The effect is to 
combine much of the security advantage of running the process on an 
isolated computer with the advantage in cost and flexibility of running 
it on a shared computer.
    It is a fair summation of our present position in information 
security that we have an excellent toolkit in the cryptographic area 
and a moderately good one in the computer security area. Having good 
toolkits is not the same as having good security, however; if it were, 
the security of the cyberinfrastructure would be far better than it is. 
Much of what needs to be done can be characterized as routine. New code 
needs to be written with greater care than has often been customary, 
old code needs to be repaired, and the security mechanisms that we know 
how to build--keying infrastructures, for example--need to be built, 
shaken down, and brought to a level of operational quality that allows 
us to depend on them. Other challenges loom on the horizon, however.
    For as long as I have known the company, Sun has had the slogan: 
``The Network is the Computer.'' and every year the slogan becomes 
truer. For years, it has been difficult for me to detect whether files 
I was using were on my own desktop or stored on a server some distance 
away. More recently, it has become possible to call on specialized 
computing and storage processes outside my own machine. These more 
recent techniques go under the name ``Web Services.'' At present most 
uses of web services involve interaction of a program currently being 
used by a human being--most often a browser--with a remote website 
supplying a service. In the near future--five or ten years at the 
most--this will evolve into a primarily computer to computer activity.
    Today, the activities of both the public and the private sectors 
consists largely of business to business contracting and subcontracting 
processes. Some of these require great imagination and will for the 
indefinite future be performed by humans; others are routine and will 
be automated at a steady rate. Computers needing services will consult 
``yellow pages'' directories of available services; choose providers 
according to price and capability; send out work orders; receive their 
results; and pay their bills.
    Two sorts of web-based businesses are easy to foresee. The first 
are specialized businesses; businesses that offer a specific sort of 
service. They may have proprietary algorithms for such computationally 
intensive activities as graphic rendering or datamining; they may have 
access to specialized data such as the results of physical, biological, 
or social studies; they may have vast amounts of computing power. At 
present, Google provides an example of all three. It possesses vast 
amounts of computing power that it uses to build specialized databases, 
available to no one else, and it delivers information to its customers 
using specialized algorithms for both building and searching the 
databases.
    A second kind of business that is in its infancy is more general in 
character: utility computing. As a business, utility computing is 
rather like property rental. Many companies, rather than owning 
property, rent their offices and often subcontract to their landlords 
the provision of furniture, food, environmental controls, etc. As 
utility computing matures, a startup-- based perhaps on development of 
a new datamining algorithm--will no longer need to raise sufficient 
capital to have the powerful computer required to do production runs 
for its customers. It can wait for work to come in, then turn around 
and lease computing capacity from a ``computer cycle provider.''
    What sort of security measures will be required in this 
environment? They will parallel those of the current contractual 
mechanisms, particularly those employed for government contracts. When 
a system integrator contractor subcontracts the fabrication of a part 
for a military aircraft to a machining business, it is trusting not 
only that the work will be done correctly but that the plans for the 
part will be returned and that the subcontractor will not make extra 
copies for competitors. In choosing its subcontractor, the system 
integrator will seek a provider with a suitable facility clearance. 
Contracting on this scale is generally for work lasting from days to 
years and often reflects long-standing business relationships.
    The computers will do it all faster. It is hard to predict exactly 
how far in the future this vision is but at some point, contracts for 
specialized data processing are likely to be negotiated and fulfilled 
in seconds.
    The two problems that will be at the forefront of security research 
and development over the next decade are negotiation and configuration 
control. They will parallel existing business functions but they will 
take place at much higher speed and without moment-to-moment human 
oversight. The circumstances will encorporate many mechanisms now in 
use such as reputation assessment (clearance, Better Business Bureau 
membership) but in a far less forgiving environment. When contracting 
goes badly at present, problems are generally referred to the courts. 
When contracting goes badly on the scale of seconds, what mechanism 
will step into the breach?
    As we move our economy and society further and further into 
computer mediated telecommunication channels, the role of cybersecurity 
in homeland security will grow steadily. There will not be general 
agreement on the proper course of action. Our decisions will advantage 
some legitimate parties and disadvantage others. The solutions to the 
problems that arise will thus be as much legal and political as 
technical and will tax both our resources and our imaginations.

    Mr. Thornberry. Thank you, sir. We will now turn to Dr. 
Craig Lowery, who is chief security architect and a software 
architect and strategist at Dell Computers.
    Welcome, sir, you are recognized.

 STATEMENT OF DR. JAMES CRAIG LOWERY, CHIEF SECURITY ARCHITECT/
  SOFTWARE ARCHITECT AND STRATEGIST, DELL COMPUTER CORPORATION

    Dr. Lowery. Thank you Chairman Thornberry, Ranking Member 
Lofgren, members of the subcommittee. My name is Craig Lowery, 
software architect and strategist for Dell.
    We are very pleased to be here this morning, and we would 
like to wholeheartedly concur with your opening themes of 
partnership and consensus, because Dell believes that that is 
the best way to go about achieving more secure systems for 
everyone. Since everyone is using these systems, we all play a 
role.
    We see a universe of technology which has vendors and 
customers that are working in partnership together. It is not 
reasonable to think that one party or the other has a complete 
key to solving the security puzzle.
    Vendors bring products to market, and they must make 
reasonable allowances for security as part of the design of 
those products. And customers have a responsibility, too, in 
the way that they deploy those products.
    It is possible to create a product that is ``secure,'' when 
it is shipped as a single component, but when it is placed into 
an aggregate configuration it could very well be part of an 
insecure infrastructure that is created.
    So it is not a one-sided approach that should be considered 
to solving the security puzzle. It has to be partnership-and 
consensus-driven. One of the things that is defining about Dell 
as a company is its direct business model, which you may have 
heard about.
    If you haven't, I will give you just a little bit of a 
glimpse into it, because it very much influences how we are 
approaching this problem, among others.
    The direct business model means that Dell believes that 
having direct relationships with our customers is the best way 
to go about delivering solutions to them, because we can hear 
directly from them the problems that they are having, they are 
trying to solve, the solutions that they need.
    One way to arrive at consensus of customer input, customer 
feedback, is through standards. We are a very standards-
oriented company. We prefer to deliver standards-based 
solutions, because we believe that that is, first of all, 
something that has gone through a consensus process, either 
formal or sometimes more informal, through user groups.
    We also see that that consensus process develops a standard 
which everyone understands, there are no surprises, and can be 
delivered to, we can deliver products to that. That is very 
much in line with our direct business model.
    One of the concrete examples that I have for you this 
morning of this strategy at work is a new offering from Dell 
which is based on work that is been done by a group called the 
Center for Internet Security, or the CIS.
    The Center for Internet Security is a group of users across 
sectors of industry, government, education, finance and health 
care, who have gotten together their security experts and have 
pooled their knowledge of experience and best practices, the 
best way to go about securing things.
    And the product of this group is a set of things called 
benchmarks. These benchmarks are settings for pieces of 
software, such as operating systems, which the users that are 
members of the CIS agree are the best settings, according to 
their research and their work.
    At the request of our government customers, we have taken 
those settings for Microsoft Windows 2000 and we are now making 
those settings available direct from our factory, pre-
installed, on certain products, specifically our Optiplex, our 
Latitude notebooks and our Precision Workstations.
    This is the direct result of our philosophy and the work of 
the consensus mechanism in the industry to bring about 
immediate changes into the security landscape at this time.
    We certainly see that security is a moving target, and that 
as things progress these improvements will appear not as a 
change to settings that we have to make, but that are going to 
be built directly into software products, and we see that 
already happening at the source.
    We are also working in other areas to deliver more secure 
solutions to our customers at their request, things like smart 
cards, which are a form of authentication that has been 
requested by customers.
    We now have smart card readers built into our D series 
Latitude notebook computers, and also we have keyboards for our 
systems which read smart cards.
    We have biometric technology, which we have been 
evaluating, and we have decided that some of those solutions 
meet our requirements and those of our customers, and we are 
now making those things available through our Software and 
Peripherals Department.
    Standard physical locks for chassis and racks and things 
like that are always something that we are attending to and 
making sure are securing the physical hardware, and new types 
of products, for example, such as fire walls, which we are 
making available through Dell to our customers so that they are 
able to get their security solutions, or most of their computer 
solutions, directly from us.
    So in summary, we do believe that security is best achieved 
in partnership and consensus, things we are very happy to hear 
that are being expressed here today.
    Our direct model, we believe, puts us in a position to 
really make use of standards and to help disseminate that kind 
of information. The CIS offering is a concrete example of that 
in action.
    We continue to evaluate best-of-breed solutions in the 
security space and bring them to market as our customers 
request them.
    Thank you for your time.
    [The statement of Dr. Lowery follows:]

          PREPARED STATEMENT OF DR. JAMES CRAIG LOWERY, PH.D.

    Chairman Thornberry, Ranking Member Lofgren, and Members of the 
Subcommittee, thank you for the opportunity to discuss Dell's 
perspective on cybersecurity and the role of technology, specifically 
hardware and software security products. My name is Craig Lowery and I 
am the chief security architect in the Dell Product Group.
    Headquartered in Round Rock, Texas, a suburb of Austin, Dell was 
founded in 1984 on a simple concept: that by selling computer systems 
directly to customers, Dell could best understand their needs and 
efficiently provide the most effective computing solutions to meet 
those needs. Today, Dell is the world's leading computer systems 
company. The company employs approximately 40,000 team members around 
the globe. We design, build and customize products and services to 
satisfy a range of customer requirements from the desktop notebook, 
server, storage and professional services needs of the federal 
government agencies, to those of the largest global corporations, and 
to those of consumers at home.
    To fully appreciate Dell's security strategy, one must understand 
Dell's direct business model. We believe that the best customer 
solutions are most efficiently derived through direct relationships 
with our customers and suppliers. Our build-to-order system allows 
customers to order computers tailored to their needs, manufactured 
specifically for and delivered directly to them. We believe that 
customers receive the best value from products built with standard 
technologies; to that end, we seek to foster standards throughout the 
industry to reduce cost and increase customer flexibility and choice. 
As I will explain, each of these facets of the direct model plays a key 
role in how Dell is approaching computer system security.
    Cybersecurity has become increasingly important for our industry 
due to the need to provide products to our customers to better protect 
their IT systems from cyber attacks and viruses. Until recently, most 
company security solutions have been proprietary and customized to fit 
their specific needs. As the need for IT security has grown from 
supporting specific applications to that of protecting critical IT 
infrastructure, our industry, including Dell, has pushed for 
standardization to make security more affordable and widely available.
    As a technology vendor, Dell is committed to delivering value 
through reducing the costs of acquisition, deployment, interoperation 
and maintenance of our products, including our security products. Dell 
believes that these benefits are best achieved through the benefits of 
industry standard technologies. Specifically, Dell believes that 
standards in the security arena are driving and will continue to drive 
these technologies to levels of maturity that make them more 
transparent to the end-user and thus suitable for widespread adoption 
in the industry. As these technologies mature, Dell leverages the 
benefits of its direct model to bring these technologies to market 
quickly and affordably.
    Securing information systems is only possible through partnership 
between vendors and customers. Security is a moving target, and the 
products and services addressing security needs necessarily evolve as 
the landscape changes. Vendors are responsible for bringing to market 
products that incorporate widely accepted security design goals. 
Customers are responsible for deploying the products in a manner 
consistent with effective security best practices. Vendors must be open 
to customer feedback to understand their security concerns, and 
customers must be diligent to provide that input.
    Dell is placing more and more emphasis on security as a chief 
design consideration in all of our products. Certainly as a hardware 
vendor, we are acutely aware of the need for physical security through 
mechanisms such as locks and detection devices. Our efforts to deliver 
more secure products extend beyond hardware. Since we custom-build the 
systems we ship, including factory installing operating systems and 
applications, we have the opportunity to continually improve upon the 
software configurations we offer to customers. We work closely with 
software providers during their design and implementation phases. We 
are able to identify and integrate tested security components into our 
factory-installed software so that customers can enjoy the benefit of 
best solutions ``out-of-the-box.'' Pre-installed virus protection is 
one example.
    An important security benefit of our build-to-order system is that 
it reduces the time between when we make changes to our products in the 
factory, and the time a customer receives the product. Therefore, if we 
improve the security of a product, our system helps to minimize the lag 
time in getting it to the customer since there is no inventory that 
must first be moved in the distribution channel.
    Another example of creating an even more secure software 
configuration is a new Dell offering available through our custom 
factory integration unit. Dell is beginning to offer desktop systems 
installed with Microsoft Windows 2000 pre-set to the Center for 
Internet Security's Level I benchmark. This is a separate offering from 
our ``normal'' Windows 2000 installation, which continues to be 
available.
    The CIS Level I benchmark is a consensus standard which the CIS 
considers the best and least restrictive security settings for Windows 
2000. These settings were developed with input from government 
agencies, business, universities, and individual security experts. In 
providing the factory installed benchmark systems, Dell is responding 
to customer demand for a hardened operating system direct from the 
factory. Although it is designed for our public segment customers such 
as federal, state and local governments, this product can benefit any 
organization wishing to receive a certain level of security with a 
system directly from Dell.
    System BIOS passwords and hard-drive passwords continue to play an 
important role in security. For even more robust forms of 
authentication and access control, Dell now offers integrated smart 
card readers in our Latitude D-family notebooks as a standard feature, 
and in our smart card reader keyboard for desktops. In addition, Dell 
offers biometric authentication solutions in the form of add-on 
peripheral devices. Dell is actively involved in new developments in 
wireless security standards such as Wi-Fi Protected Access, and the 
emerging 802.1li standard.
    Through our software and peripherals department, Dell is able to 
provide customers with thirdparty solutions that meet their demanding 
standards, such as wireless products, firewalls, and security software.
    Again, security requires cooperation between vendor and customer. 
At Dell, we know our customers face many challenges when it comes to 
successfully deploying an IT infrastructure that is secure, usable, and 
manageable. We provide deployment and management assistance to our 
customers in several forms to help them in these efforts.
    In addition to telephone support, Dell provides access to our 
technical support web site. Premium technical support is available to 
customers requiring even faster response. Our engineers develop white 
papers and journal articles targeting many content areas, including 
computer system security. These articles are also freely downloadable 
from our web site at dell.com/powersolutions. We are actively engaged 
with security organizations such as the SANS Institute, the CERT 
Coordination Center, the Center for Internet Security, and the Free 
Standards Group.
    Dell also makes available pre-packaged and customized services, 
helping to ensure consistent, repeatable processes for our customers. 
Dell's service offerings include everything from onetime services to 
deploy and configure, to fully managed solutions where we take on the 
day-today tasks of running your IT infrastructure. Security is one of 
many aspects we consider in providing these services to our customers.
    Dell is a security-aware and privacy-aware company. We know that 
security is of increasing importance to our customers, and we are 
striving to deliver more secure products and services, as well as those 
that are security-specific, as they become available. We deliver 
security solutions in a way that is consistent with Dell's model: 
quality, low cost, easily integrated standards-based solutions that 
meet our customer requirements, delivered directly to them. We look 
forward to working with this Subcommittee as it considers ways to 
improve cybersecurity.
    Thank you again for inviting me to participate in today's hearing 
and for seeking Dell's perspective on cybersecurity. I would be happy 
to answer any questions.

    Mr. Thornberry. Thank you, sir.
    As my colleagues can tell, we have roughly divided up the 
witnesses into two groups. We have heard from three witnesses 
that are roughly in the field of products, and now we are about 
to turn to three that are roughly in the field of services 
although with these companies, clear lines are difficult to 
draw.
    We will now turn to Jay Adelson, who is a founder and chief 
technology officer of Equinix, which is the largest 
independent, or neutral, provider of interconnection and data 
center services in the world.
    Welcome, sir. You are recognized for five minutes.

   STATEMENT OF MR. JAY ADELSON, CTO & FOUNDER, EQUINIX, INC.

    Mr. Adelson. Thank you. Chairman Thornberrry, Congresswoman 
Lofgren, distinguished members of the committee, I sincerely 
appreciate having the opportunity to be here today as a 
representative from Internet industry, and more specifically, 
the perspective of critical Internet infrastructure, the 
Internet itself, network access points, or commonly known as 
Internet exchange points.
    As you said, my name is Jay Adelson. I am the founder and 
chief technology officer of Equinix. And the reason Equinix has 
a unique perspective on the issue of Internet security is, as 
you said, we are the largest neutral provider of 
interconnection. Equinix's facilities, therefore, serve as the 
meeting places for all the various elements of Internet, 
ranging from enterprise users, large Internet Web sites, 
network providers, telephone carriers, cable companies and 
subscriber services.
    Much of the Internet industry knows us as an exchange point 
or NAP where most of the Internet traffic in the United States, 
or significant portions, converge as they pass from one 
network, such as AT&T, to another, such as AOL, as well as the 
place where important sites, such as Google, Yahoo, Paypal, IBM 
customers and others place their critical infrastructure.
    A good analogy for an exchange point is that we function as 
an international airport for Internet networks and services. 
And our airlines are networks and our travelers are data bits 
and bytes. There are 100 exchange points in the world bearing 
services and levels of security though, in common, they all 
facilitate this exchange of traffic.
    While my distinguished panel members are part of well 
known, large vendors and network service providers, the chances 
are, while you may not have been exposed to Equinix in the 
past, you stand to receive e-mail that traverse our exchange 
points and surf Web sites housed in our facilities. The very 
fact that Equinix is a physical part of the Internet 
infrastructure, where such a large percentage of the Internet 
itself, happens is not as well known. It illustrates the fact 
that the Internet itself is a massive structure interconnecting 
independent entities very difficult to accurately measure, 
monitor, and international in scope.
    Equinix, like international airports, focuses heavily on 
the physical security of our data centers. And we have 
instituted check points, audit trails, people traps, steel 
cages, layers of biometric security, et cetera, and very strong 
security operations procedures. Our customers demanded these in 
the late 1990s when we built them. And we based the security 
design and requirements from our financial service customers 
and recognize that there was no physical security standard on 
which to build and base our new design.
    We were not able to find any of these reference standards 
to the level of security operation procedure we felt, and our 
customers felt, were appropriate for such an important hub as 
Internet traffic. It didn't exist. So, therefore, we made a 
conscious decision, as part of our business plan, to be the 
most physically secure exchange point in the United States.
    But this model is fairly unique in that market forces 
allowed us to develop this new approach to providing heightened 
physical security.
    A balance must be achieved between network service 
providers, hardware vendors and their users. Ultimately, users 
must bear, as my colleagues suggested, the largest 
responsibility for protecting their assets. Network service 
providers and software and hardware vendors supporting the 
Internet industry can only empower the Internet users with 
systems and services that enabled secured use of the Internet.
    There are strong economic limitations to the scope of 
physical and logical protection network service providers can 
reasonably implement. But at a minimum, a baseline standard of 
configuration and administration can be met.
    The cyber and physical security best practice, developed by 
the Network Reliability and Interoperability Committee, are a 
good example of how infrastructure operators are able to 
provide baselines for all network operators to follow. These 
range from information about network configuration to 
background checks for employees in critical facilities. And as 
a nation, we must continue to advance research and development 
to increase the embedded security level as well as support 
these standards at the network level and with edge users.
    There are a surprisingly high number of autonomous networks 
and systems that affect the health of the Internet. A common 
misunderstanding is that only a few very large networks, known 
as backbones, create the largest impact.
    As incidents of the past have taught us, there are many 
more players, enterprises, domain name service providers, 
foreign networks and small regional networks that can impact 
network stability and security.
    These entities are scattered all over the world, their 
security policies and procedures are as diverse as the networks 
and services that they operate.
    While information sharing with the federal government is a 
newer concept in the Internet arena, information sharing is 
fairly robust within the Internet technical community, and it 
has to be. We are all customers and providers to one another, 
and a major failure on the Internet impacts all infrastructure 
operators at the bottom line.
    We communicate with our account reps, our technical help 
desk, our emergency contacts, to restore services as quickly as 
possible. It is not clear, however, how to integrate the 
federal government into the commercial information-sharing 
exchange.
    The government has an opportunity to act as a means to 
spread the word during a crisis, and tools such as the Cyber-
Warning Information Network are a good start, although the 
original intent of these systems must not be diluted.
    Opening the communication channels is critical when every 
second counts, but choosing what data is appropriate through 
ISAC-to-ISAC communications, versus leaving it open, limits 
their effectiveness.
    The federal government must do more to expand information-
sharing with infrastructure owners, and establishing the 
National Cyber-Security Directorate at the Department of 
Homeland Security is a good first step.
    In the event of a cyber-crisis, it is important for the 
Department of Homeland Security to understand that the 
infrastructure owners, the network operators in particular, are 
the first responders.
    Speed is of the essence in responding effectively to these 
types of crises, and therefore adding communications steps and 
information management runs the risk of slowing down the 
response.
    For infrastructure operators, the Internet is first and 
foremost a commercial enterprise, and thus restoration of 
service is critical in order to meet the service level 
agreements with customers, as well as to support the Internet 
commerce generally.
    This must be recognized as processes are developed, and, as 
well, centralization of all this information will improve 
accuracy in communication. The methods of information 
distribution must be relatively instantaneous and flat in 
hierarchy.
    In conclusion, Equinix strongly supports the work of the 
Department of Homeland Security in working to promote both 
physical and cyber-security for our nation's networks. And I 
very much appreciate the opportunity to testify here today, and 
would be happy to answer questions that the committee may have.
    [The statement of Mr. Adelson follows:]

                 PREPARED STATEMENT OF MR. JAY ADELSON

    Chairman Thornberry, Congresswoman Lofgren, distinguished members 
of the Committee; I sincerely appreciate having the opportunity to be 
here today as a representative from Internet industry, and more 
specifically, the perspective of critical infrastructure of the 
Internet itself, the Internet Exchanges, or Network Access Points 
(NAP).
    My name is Jay Adelson, and I am the Founder and Chief Technology 
Officer of Equinix. The reason Equinix has a unique perspective on the 
issue of Internet security is that we are the largest independent, or 
``neutral,'' provider of interconnection and data center services in 
the world. Equinix's facilities serve as the meeting places for all the 
various elements of the Internet, ranging from enterprise users, large 
Internet web sites, and network providers such as telephone carriers, 
cable companies and subscriber services.
    Much of the Internet industry knows us as a NAP operator, or 
Network Access Point, where most of the Internet traffic in the United 
States converges as it passes from one network, such as AT&T, to other 
large networks, such as UUNet or AOL, as well as the place where 
important web sites, such as Google, Yahoo!, PayPal, or IBM customers, 
place their critical infrastructure.
    A very good analogy for a NAP operator is that we function as an 
international airport for Internet networks and services, though our 
airlines are networks, and our travelers are the data bits and bytes. 
There are over a hundred NAPs throughout the world, varying in services 
and levels of security, though in common they all facilitate the 
exchange of Internet traffic.
    While my distinguished panel members are part of well known, large 
network service providers, chances are that while you may not have been 
exposed to Equinix, you have sent or received e-mails that have 
traversed our exchange points, and surfed websites housed in our 
facilities. The very fact that Equinix, as a physical part of the 
Internet infrastructure, where such a large percentage of the Internet 
passes, is not as well known, illustrates the fact that the Internet 
itself is a massive structure of interconnecting, independent entities, 
very difficult to accurately measure or monitor, and international in 
scope.

Role of Industry and Equinix In Securing Cyberspace
    The Internet exists on multiple layers, both the physical and the 
logical. At the physical level, the industry has a long way to go to 
secure itself. While some infrastructure operators provide advanced 
cyber and physical security, some operators have not yet incorporated 
security into their basic business plan. This provides the Internet 
industry as whole with much room for improvement.
    Equinix, like international airports, focuses heavily on the 
physical security of our datacenters, and have instituted checkpoints, 
audit trails, man traps, steel cages, five layers of biometric 
security, high-availability video, concrete embankments and strong 
security operations procedures. Our customers have demanded this 
physical security from our facilities. When we built them in the late 
nineties, we based the security design on the requirements from our 
financial services customers, and recognized that there was no physical 
security standard upon which to base our new design. We were not able 
to find any reference standard for the level of security operations 
procedure we felt, and our customers felt, was appropriate for such an 
important hub of Internet traffic. It simply didn't exist.
    Equinix, therefore, made a conscious decision as a part of our 
business plan to be the most physically secure NAP operator in the 
United States. However, our model is fairly unique in that market 
forces allowed us to develop a new approach to providing heightened 
physical security for critical Internet assets. At this point, 
Equinix's customer base represents over 90% of the Internet routing 
table, as over 120 of the largest and most prolific Internet networks 
use our locations as their critical hubs.
    Equinix, as a central exchange point between networks, will 
continue to do our part to physically secure the Internet assets. At 
the logical level, the implementation issues are international in 
scope, with literally thousands of independent players requiring 
education and motivation to adopt modem security practice.

Industry Responsibilities
    A balance must be achieved between network service providers, 
hardware vendors, and their users. As secure as a network may be from 
compromise, or as many features that a hardware or software vendor 
places in their products, ultimately users must bear the largest 
responsibility for protecting their assets.
    Network service providers, and software and hardware vendors 
supporting the Internet industry can only empower the Internet's users 
with services and systems that enable secured use of the Internet. 
There are strong economic limitations to the scope of physical and 
logical protections network service providers can reasonably implement, 
but at a minimum, a base-line standard of configuration and 
administration can be met.
    The cyber and physical security best practices developed by the 
Network Reliability and Interoperability Committee (NRIC) are a good 
example of how infrastructure operators are able to provide baselines 
for all network operators to follow. These range from information about 
network configuration to background checks for employees in critical 
facilities. However, best practices are often difficult and costly for 
smaller networks, enterprises, universities, governments, or 
individuals to implement. As a nation we must continue to advance 
research and development to increase our imbedded security level, at 
the network level and with edge users.

Information Sharing
    There a surprisingly high number of autonomous networks and systems 
that affect the health of the Internet. A common misunderstanding is 
that only a few, very large networks, commonly known as backbones, 
create the largest impact. As incidents of the past have taught us, 
there are many more players, including enterprises, content providers, 
domain name server operators, foreign networks and small regional 
networks, that can have significant impact on network stability and 
security. Recent research Equinix conducted shows evidence of there 
being over 13,000 entities, not including network service providers, in 
the global Internet that manage their own multi-network connectivity, 
injecting their network information into the global Internet. These 
entities are scattered all over the world, and their security policies 
and procedures are as diverse as the networks and services they 
operate. While abuse from one of these entities can be mitigated 
through good security practice, a large number of them are as relevant 
in information sharing as the network operators themselves.
    While information sharing with the federal government is a newer 
concept in the Internet arena, information sharing is fairly robust 
within the Internet technical community. It has to be--we are all 
customers and providers to one another, and a major failure on the 
Internet impacts all infrastructure operators at the bottom line. We 
communicate with our account representatives, with our technical help 
desks, with our emergency security contacts, to restore service as 
quickly as possible. What is not yet clear, however, is how to 
integrate the Federal government into the commercial information 
sharing exchange.

How the Federal Government Can Help with Information Sharing
    The Federal Government has the opportunity to act as a means to 
spread the word during a crisis as a central moderator. Tools such as 
the Cyber Warning Information Network are a very good start, although 
the original intent of these systems to be a tool during a crisis for 
the Internet community must not be diluted. Opening the communication 
channels is critical when every second counts. Choosing what data is 
appropriate for ISAC to ISAC communications, versus leaving it open, 
limits their effectiveness.
    The Federal government must do more to expand information sharing 
with Internet infrastructure owners. Establishing the National Cyber 
Security Directorate at the Department of Homeland Security is a good 
first step. However, for the Federal government to become a trusted 
partner for information sharing purposes, it will have to develop 
business plans and models to highlight how and where the government is 
best suited to assist the Internet infrastructure in protecting and 
restoring itself.
The Role of the Department of Homeland Security
    The DHS has two unique and immediate functions that it should 
provide to infrastructure operators. First, DHS should provide a 
platform for information to be shared, amongst infrastructure sectors, 
and to the states. Second, DHS should be working in partnership within 
industry to promote the development of cyber security standards and 
baselines, to ensure a national approach to cyber-security. Clarifying 
the Federal government's role as the ``Public'' partner in our Public--
Private Partnership, cited in the National Strategy. to Secure 
Cyberspace, will be a critical task for the new Cyber Security 
Directorate. A network operator, content provider, or NAP operator all 
have different roles to play in a crisis, and the value of the response 
will be contingent upon the DHS having a clear understanding of what 
data is appropriate for which group, and what action, if any, the 
government is capable of taking.
    In the event of a cyber-crisis, it is important for the DHS to 
understand that the infrastructure owners, the network operators in 
particular, are the ``first responders.'' Speed is of the essence in 
responding effectively in these types of crisis, and therefore adding 
communication steps and information management runs the risk of slowing 
down the response. For infrastructure operators, the Internet is first 
and foremost a commercial enterprise, and thus restoration of service 
is critical, in order to meet service level agreements with customers, 
as well as to support Internet commerce generally. As a result, crisis 
communications at the technical level between the largest 
infrastructure operators is generally very good. Trust and experience 
has played a large role in increasing the response capabilities of the 
largest infrastructure operators, and the government will have to 
develop trust and experience as it becomes a part of cyber-security. 
This must be recognized as processes are developed, as while 
centralization of the information will improve accuracy, the methods of 
information distribution must be relatively instantaneous and flat in 
hierarchy. Working with industry as the ``first responder'' will be an 
immediate challenge, and a new paradigm for DHS that requires dedicated 
effort.
    In conclusion, Equinix strongly supports the work of the Department 
of Homeland Security in working to promote both physical and cyber-
security for our nation's networks. I very much appreciate the 
opportunity to testify today, and would be happy to answer any 
questions that the Committee may have.

    Mr. Thornberry. Thank you, sir, appreciate it. Frank Ianna 
has been with AT&T for more than 30 years, including most 
recently as president of AT&T network services.
    Earlier this year he announced his intention to retire, but 
they can't let him go. And so we are glad you are here within 
us today, sir, and now you are recognized for five minutes.

STATEMENT OF MR. FRANK IANNA, PRESIDENT, AT&T NETWORK SERVICES, 
                        AT&T CORPORATION

    Mr. Ianna. Chairman Thornberry, thank you very much, 
Congresswoman Lofgren and members of the subcommittee. Let me 
summarize my testimony with several points, and then 
recommendations under some of those points.
    First, along the idea of cyber and physical security. 
Cyber-threats are particularly challenging to the service 
industry for four reasons.
    First, attackers do not need a physical presence or a large 
investment in a physical presence to cause harm. They could do 
it remotely.
    Point number two is that all vendors of products and 
services, hardware and software, whether they are switching 
elements or computing elements, have critical roles to play in 
enhancing the overall cyber-resiliency of mission-critical 
services.
    And several recommendations can spring from this, such as 
software and equipment vendors and network operators and 
standards bodies should have products that have built-in 
baseline security features. With system administration, any 
interaction of these should be made simple.
    Service providers and vendors should collaborate also to 
develop an overall security management system so that we could 
see very instantaneously the traffic anomalies happening on 
networks, then we could respond very quickly too.
    And the government can stimulate development of more secure 
products by funding research and development of inter-operable 
software and hardware standards to provide network management 
described above.
    The third point is that there is extensive interconnection, 
as some of my colleagues have mentioned, this is very nature of 
communications among telcom and IP providers and data network 
providers.
    And each of these carriers are interconnected to form a 
service for a consumer or a business.
    We must help each other. And we have to communicate with 
each other, our operations centers, on a continuous basis. A 
significant failure in one network can cause a significant 
failure in another network. And in many cases, the symptoms of 
a failure in one network actually show up first in the other 
network.
    Carriers today do share network disruption information 
directly between their operation centers, ours, the global 
network operation center in Bedminster and all the other 
carriers that we interface with, and with the Telecom 
Information Sharing and Analysis Center, the Telecom ISAC, 
today.
    For example, the slammer worm that we detected on January 
25, 2003 was the fastest-spreading worm in history, but 
industry worked together with the Telecom ISAC and with 
government to share our mitigation plans, our strategies and 
our notification procedures.
    Point number four, insider threats to our network should 
not be discounted. A malicious insider may easily circumvent 
cyber-security protections employed to discourage outside 
threats. So a recommendation here would be to have 
infrastructure providers and governments work together to 
develop a process to ensure that all employees and contractors 
with access to critical facilities undergo background checks, 
screening and National Crime Information Center reviews.
    Now, the next point is talking about public and private 
partnerships. What we are saying here is that there is a good 
opportunity to have a public/private partnership with the 
government. The telecom ISAC, for example, is a good example of 
this, it is the number one long-standing public/private 
partnership in telecom.
    Point number six, is companies will only engage in 
sustained and meaningful information sharing when there is a 
compelling business case to do so and only in a trusted 
environment. And this is for two related reasons. The 
government should consider adopting the NCC funding model to 
enhance effectiveness of other ISACs where the government is 
actually funding some of the infrastructure for us to 
communicate amongst each other.
    For example, the round-the-clock staffing is not borne 
exclusively by the private sector, it is borne by the 
government. And the government partners provide value back to 
the industry. Two examples here, the government should provide 
value to other ISACs in the form of useful and timely threat 
information, and supporting industry's response recovery 
efforts during the crisis.
    The NRIC, as my colleague here mentioned, the National 
Reliability and Interoperability Council, which is really the 
sixth incarnation of that council created every 2 years, is a 
long-standing partnership that the FCC and the Telecom industry 
started in 1992.
    The FCC--and point number seven--has wisely recognized that 
to be successful, the effort must be: number one, voluntary; 
number two, developed by industry experts; and number three, 
adaptable to different network providers to reflect differing 
architectures and approaches. What constitutes a network 
failure in a wire line voice network is very, very different 
than what constitutes a failure in an IP-provided network, for 
example.
    Two final points here. Number one, information about 
physical locations and capabilities of network infrastructures 
must be carefully safeguarded. We have seen instances where 
much public information has been put out and there are lot of 
requests for information. We recommend here that particularly 
we work with the Department of Homeland Security and 
particularly the states.
    We may not be only getting one request from the federal 
government, and we actually could be getting 50 requests from 
different states to provide very macro and very specific threat 
and vulnerability information. And we believe that the 
Department of Homeland Security should be the focal point for 
coordinating process amongst all federal agencies and states so 
that we ensure that the information is properly managed.
    And then finally we should expand our public and private 
partnership. Private sector critical infrastructures providers 
must have the opportunity to provide input to portions of the 
new national emergency response plan that address how the 
private sector would respond in a national crisis. I would like 
to thank you for allowing me to make these comments, 
summarizing the positions that AT&T has from our experience in 
these industries. Thank you very much.
    [The statement of Mr. Ianna follows:]

                 PREPARED STATEMENT OF MR. FRANK IANNA

Thank you for this opportunity to testify on behalf of AT&T regarding 
industry views on cyber security. My name is Frank Ianna, and I am the 
outgoing President of AT&T Network Services. My testimony will describe 
AT&T's views on several aspects of this very important issue.
AT&T is among the premier voice and data communications companies in 
the world, serving businesses, consumers, and government. The company 
runs one of the most sophisticated communications networks in the U.S., 
backed by the research and development capabilities of AT&T Labs. A 
leading supplier of data, Internet and managed services for the public 
and private sectors, AT&T offers outsourcing and consulting to large 
businesses and government. With approximately $37 billion of revenue, 
AT&T has about 40 million residential customers and 4 million business 
customers who depend on AT&T for high-quality communications. As such, 
we have an overarching interest in preserving and promoting a safe, 
secure and robust infrastructure that will be a key enabler of economic 
growth and prosperity of the United States. We therefore very much 
appreciate the opportunity to offer these comments today.
Cyber vs. Physical security:
Sound security practices obviously must address both physical risks and 
cyber risks. Cyber security risk management is more focused on the 
``logical'' or user's view of the way data or systems are organized as 
compared to physical security risk management of our network which is 
topology/technology-focused. But cyber threats are particularly 
challenging for at least four key reasons. First, attackers do not need 
physical presence to do significant harm, and a cyber ``saboteur'' 
could launch attacks from anywhere. Nor does it take a large investment 
to launch a cyber attack, only a PC and access to the Internet.

Second, the availability and deployment of cyber security capabilities 
is not only a service provider issue, but requires the involvement of 
product developers, vendors, and end-users. Software code is becoming 
increasingly complex and the number of lines of code is multiplying at 
an incredible rate. Thus no single entity has complete control over the 
security of its product or service. The very structure of to day's 
hearing reflects that reality - that all vendors of products and 
services have critical roles to play in enhancing the overall cyber-
resiliency of mission-critical services. Industry, standards bodies, 
software and equipment vendors, network operators, and end-users of all 
products and services that make up the Internet should ensure that 
these products have built-in baseline security features and that these 
features are appropriately configured and kept up-to-date. System 
administration of current cyber products is much too difficult. Vendors 
need to be encouraged to simplify their products and employers need to 
increase the level of expertise required to perform this vital task.

One specific area in which service providers and vendors could 
cooperate that would make a vast improvement in cyber-security is in 
the development of an overall security management system that would 
provide detailed traffic statistics to the Network Operations Centers 
of major IP backbone providers about the transmission of packets on our 
networks and detect and respond to anomalies, as we do today in our 
public switched telecommunications network.

Government can also play a key role in stimulating development and 
deployment of more secure products and services, not by trying to 
impose compliance at some arbitrary level, but by funding research and 
development of interoperable software and hardware standards to provide 
the network management that would enable network operators to detect 
and stop malicious attacks in the core network. Government can also 
create strong incentives for the deployment of these capabilities 
through its purchasing power as a user of more secure cyber 
capabilities.

Third, because there is extensive interconnection among 
telecommunications and IP networks, carriers must assist one another 
because a significant failure in one network can affect another 
network. In fact, telecommunications carriers today share network 
disruption information directly between Network Operations Centers, and 
with the sector Information Sharing and Analysis Center (ISAC). The 
Slammer worm, which was detected on January 25,2003, was the fastest 
spreading worm in history. This worm affected more than 90 percent of 
vulnerable hosts within 10 minutes, far more quickly than Code Red of 
2001. Industry participants worked together through the Telecom ISAC 
and with the government to share mitigation plans. The good news is 
that the Slammer worm had no payload; the bad news is that a similar 
worm could be launched with a malicious payload. We need to be better 
prepared by building more secure technology and employing better 
processes to support security controls for the entire network.

Lastly, though cyber threats can originate anywhere, the insider threat 
should not be discounted, because a malicious insider may easily 
circumvent cyber security protections that are deployed to discourage 
outside threats. To address this issue, providers of critical 
facilities must work with others in industry, and with government at 
all levels to develop and employ a standard process to ensure that all 
employees and contractors with access to critical facilities undergo 
appropriate background checks, screening, and National Crime 
Information Center reviews. Government can play a key role by helping 
to develop the most efficient process, and by acting as a centralized 
resource to coordinate requests from industry for reviews. This is good 
and will help.

Now, having said that, I want to add that those service providers of 
critical infrastructure have had to solve the problem of access long 
before it became prominent following the events of September 11. Many 
people enter and leave critical infrastructure facilities every day. 
The location may be any location where multiple providers have placed 
facilities and equipment. These individuals may be communications 
technicians from different service providers who are maintaining 
equipment housed in the building. There are others who also may need to 
gain access to a building, such as power contractors, janitors, vending 
machine operators, copying machine technicians, etc. During the day, 
any number of non-communications-related individuals go in and out of 
telecom buildings. One solution that AT&T has implemented is to escort 
all non-badged individuals who need access to critical locations. AT&T 
has made strong security a top priority for many years, but because we 
are so extensively interconnected with other infrastructure operators, 
we must also closely cooperate with our peers, arguably to a greater 
extent than in any other infrastructure. Our industry has of necessity 
been a leader in the information sharing process long before the 
President's Commission on Critical Infrastructure Protection and PDD-63 
recommended the formation of sector-specific, information sharing 
forums in May, 1998.

    Developing an effective ``public-private partnership``:
As you know, most of the country's critical infrastructures are owned 
and operated by the private sector, thus the private sector must play a 
key role in safeguarding those infrastructures. With cyber security, 
the private sector has an even more important role, because the 
responsibility for implementing adequate security measures falls not 
only on core infrastructure providers like AT&T, but also on government 
and business enterprises that deploy and rely on cyber information 
systems to perform business-critical functions. For these reasons, much 
has been said about the need for an effective ``public-private 
partnership'' to share security-related information and to address 
security-related threats and vulnerabilities. These are laudable goals, 
and in fact, AT&T and other telecommunications companies have been 
working together to identify and address security risks, and to develop 
security-related best practices in partnership with government, for 
many years. Two of the most significant partnerships are noteworthy.

    The Telecom-ISAC
Much of the benefit attributed to a partnership between government and 
industry involves the need to encourage robust, timely, two-way 
information sharing about threats, vulnerabilities, intrusions and 
anomalies. New protections provided in the recently enacted Homeland 
Security Act significantly reduce the possibility that sensitive 
information shared voluntarily for these purposes might be disclosed 
publicly. Nevertheless, companies will only engage in sustained and 
meaningful information sharing when there is a compelling business case 
for doing so, and only in a trusted environment. We at AT&T have a lot 
of experience in this area. Telecommunications carriers have shared 
information informally with the National Communications System (NCS) 
since 1984. In 1991, the National Security Information Exchange (NSIE) 
was established as a forum in which government and industry could share 
information in a confidential, trusted environment. Since March of2000, 
the NCS's National Coordinating Center (NCC) has served as the 
Information Sharing and Analysis Center, or ``ISAC'' for 
Telecommunications. Telecom-ISAC participants, including industry and 
government representatives, gather and share information on threats, 
vulnerabilities and intrusion attempts. Information is analyzed to help 
avert or minimize disruptions to the telecommunications infrastructure. 
The results are aggregated and disseminated as provided by agreement 
among the ISAC members. In addition, the NCS hosts the NCC and is the 
lead agency for the telecommunications support functions under the 
Federal Emergency Response Plan. In that capacity, the NCC is 
specifically charged with assisting in the coordination of 
telecommunications restoration and provisioning during national 
disasters through government and industry cooperation on a 24-hour 
basis. NCS and the telecommunications carriers also collaborated on the 
development of the ``Government Emergency Telecommunications Service'' 
or ``GETS'', which provides government and industry personnel with key 
national security or emergency preparedness responsibilities with the 
ability to gain priority access to the public switched telecom network 
in times of significant network congestion.

There are two related reasons why we believe that the telecom-ISAC has 
been particularly successful. First, the Telecom-ISAC is funded largely 
by government appropriations, so the core infrastructure and round-the-
clock staffing is not borne exclusively by the private sector, as is 
the case with other ISACs. Second, government ``partners'' provide 
value back to the industry participants. First, the information-sharing 
goes two ways. The government routinely provides specific threat and 
alert information to industry representatives. Second, in real crises, 
the government NCC representatives quickly engage as ombudsmen on 
behalf of industry, helping industry gain access to impaired locations 
for purposes of restoration and recovery, and they represent the needs 
of concerns of the industry in terms of coordinating response. On 
September 11, 2001, the NCC helped network providers gain access to 
Ground Zero to restore communications, including arranging for military 
air transport for some of our key disaster recovery personnel who were 
stranded in California when commercial aircraft were grounded. The 
ability of government to deliver this kind of assistance, proven 
repeatedly in crises of differing degrees over the years, has led to an 
atmosphere of trust and cooperation in which we in industry have felt 
comfortable sharing sensitive information with the government and with 
our competitors in times of crisis.

This level of trust is essential because in order for information about 
security concerns and incident response activities to be useful to 
companies and to the government, it must be shared quickly. This need 
for expediency results in reports that are initially incomplete and 
potentially inaccurate, and there can be unintended consequences if the 
information is not treated with care. This trusted environment has also 
allowed industry and government partners to engage in periodic 
``exercises'' to test the potential impact of different threat 
scenarios based on accurate network data from multiple carriers.

    The National Reliability and Interoperability Council (NRIC)
Another example of the partnership that has worked and should be the 
model for any government and industry problem solving is the Network 
Reliability and Interoperability Committee (NRIC). First organized by 
the FCC in 1992, the NRIC was established following several telecom 
outages to study the causes of the outages and to make recommendations 
to reduce their number and effects on consumers. Since then, some 50 
telecom carriers, equipment manufacturers, state regulators and 
consumers have participated. This has been a standing committee for 
over 10 years, and is a forum where industry and government come 
together for the good of the industry to work specific issues. Y2K was 
one such issue. NRIC VI is focused on Homeland Security with teams 
addressing both Physical and Cyber security. The product is a set of 
best practices (proven processes used in the industry) for service 
providers and equipment/software vendors to use to mitigate risk of 
attacks.

Another feature of NRIC is the monitoring and analysis of the 
performance of the public switched network based on reliability data 
collected during the last 10 years. The Network Reliability Steering 
Committee NRSC, a voluntary industry committee, reviews each outage 
report submitted to the FCC, looks for trends, publishes the results 
quarterly and annually, and looks for ways to improve the collective 
performance of the network. A new phase of this work, currently 
underway in the NRIC, is collecting similar outage data on wireless, 
cable and ISP networks in order to conduct data analysis, enable 
performance improvement, and develop new best practices. In leading 
this effort, the FCC has wisely recognized that to be successful, it 
must be: 1) voluntary; 2) developed by industry experts; and 3) 
adaptable by different network providers to reflect differing 
architectures and approaches.

    Safeguarding sensitive proprietary information:
As a private sector operator of a major part of one of America's most 
important critical infrastructures, we carefully safeguard all 
information about the physical locations, capabilities and components 
of our world-wide infrastructure. While some security experts discount 
the ``security through obscurity'' approach to risk management, I 
disagree. A July 9 Washington Post article describing the ability of a 
GMU graduate student to amass copious quantities of sensitive 
information about a vast array of critical infrastructure facilities 
highlights the danger of making sensitive information too easily 
available. In fact, we would suggest that if possible, this student's 
report be provided by the Department of Homeland Security to the 
appropriate industry body, presumably the Telecom-ISAC, for analysis of 
its accuracy. It is in keeping with national security interests to 
assess the extent to which a motivated individual can develop a map of 
the infrastructure through compilation of publicly available 
information. The findings would be very useful in developing safeguards 
to prevent the continued proliferation of such information.

While this kind of threat clearly is of major importance for physical 
security, it also presents a very significant, indirect threat from a 
cyber-security perspective because the information could be used to 
launch simultaneous cyber and physical attacks, which could result in 
exponential reductions in network capacity and potentially dramatic 
customer impact.

Despite these concerns, we are increasingly solicited by various 
governmental entities for very specific, extremely sensitive, 
proprietary information about our capabilities and maps of our network 
facilities and routes. States are attempting to compile lists of the 
critical assets of AT&T and other carriers for purposes of critical 
infrastructure protection. We are concerned about the breadth, open-
endedness, lack of specificity, potential cost, and ability to 
safeguard and keep confidential any information that is provided. 
Neither states nor the federal Government should expect this 
information from network operators. First, security-related information 
that is provided to government entities outside the federal Department 
of Homeland Security may not be adequately protected from federal and 
state Freedom of Information laws. Even more importantly, it is not 
clear that information collected on a wholesale or generalized basis 
advances homeland security in any way, and may create greater risks to 
homeland security. In fact, proper analysis of any potential 
vulnerability requires a detailed assessment of the specific facilities 
of concern, the services they support, and the impact mitigation 
strategies applicable to those services. Instead of making arbitrary 
requests for massive downloads of extremely sensitive information, 
states should work with the Department of Homeland Security (DHS) and 
directly with critical infrastructure providers to determine what 
specific information is really needed and to establish coordinated 
processes and procedures. The DHS should be the focal point for the 
coordination across the regions, states, and municipalities, as well as 
across key industry sectors, to ensure that the information is useful, 
responsive, and properly managed.

Expanding and refining the ``public private partnership''
We understand that the Department of Homeland Security, in coordination 
with the nation's governors, is updating and expanding the Federal 
Disaster Response Plan into a National Response Plan, and that private 
sector critical infrastructure providers will have the opportunity to 
provide input to portions of the plan that address how the private 
sector would respond in a national crisis. We applaud this approach, 
and look forward to continuing to work with the country's leaders, both 
public and private sector, to ensure that the private sector's views 
are considered and our capabilities are reflected in the evolving plan. 
I would also like to emphasize that a significant challenge during the 
recovery from the attacks of September 11 was physical perimeter 
control procedures that were changed as the responsible government 
authority shifted from local to state to federal control. As NSTAC 
recommended to the President, I also recommend that Congress task the 
Department of Homeland Security to partner with industry in developing 
a physical perimeter control plan to be part of the National Response 
Plan for use by all government authorities.

AT&T would like to particularly thank Chairman Thornberry, 
Congresswoman Lofgren and the Members of this Subcommittee for holding 
a hearing on this important issue. I offer AT&T's assistance to the 
Committee as well as my own, and I would be glad to answer any 
questions you may have.

    Mr. Thornberry. Thank you, sir.
    Finally, batting cleanup as they say, Tatiana Gau is chief 
trust officer and senior vice president at America Online. 
Thank you for being here and you are recognized for five 
minutes.

 STATEMENT OF MS. TATIANA GAU, CHIEF TRUST OFFICER AND SENIOR 
       VICE PRESIDENT, AOL CORE SERVICES, AOL TIME WARNER

    Ms. Gau. Thank you, Chairman Thornberry, Representative 
Sessions, Representative Lofgren and members of the 
subcommittee. Thank you for the opportunity to testify before 
the subcommittee on the important issue of cybersecurity.
    My name is Tatiana Gau, and I am the chief trust officer 
and senior vice president, America Online, where much of my 
focus is on cybersecurity, consumer protection, privacy and 
online safety.
    At AOL we are committed to playing the leadership role on 
the issue of security. Employing our technology, tools and 
educational resources we strive to provide secure products and 
services, to ensure a safe and secure environment online, and 
to educate our members to help them protect themselves.
    As part of these efforts, we have developed extensive plans 
to address security issues in our products and services, our 
network and on the Internet.
    AOL is working hard to implement recommendations in the 
President's national strategy to secure cyberspace that apply 
to our service. This strategy lays out some very important 
steps that the private sector should take and that AOL is 
undertaking to protect consumers.
    We have designed elements of the next version of our 
software, AOL 9.0 Optimized, to fit the recommendations in the 
strategy. AOL embraces the partnership between government and 
private sector envisioned by the strategy, and we are committed 
to working with our vendors and competitors to strengthen 
security at the network and the end-user level.
    Online security is an ongoing process.
    At AOL, network security is an important part of the cyber 
safety equation. In order to prevent denial-of-service attacks 
and other intrusions, AOL, like many other ISPs, has integrated 
dynamic denial-of-service mitigation protection at all levels 
of our system which help us protect against attempted attacks.
    We monitor our network for viruses and take both proactive 
and reactive measures to prevent, detect and eliminate them.
    AOL also employs significant protections to safeguard 
access to member data. And we have incorporated many new safety 
and security features in our next client software, which is 
expected to be available later this summer.
    These cutting-edge safety and security features include: a 
free firewall for broadband users provided in partnership with 
Network Associates; free and premium antivirus services which 
are automatically updated every time a user logs on to AOL; 
advanced spam filters; and computer checkups that enable our 
members to diagnose and fix security problems within their 
systems.
    Through easy-to-use, behind-the-scenes protective measures 
and checkups, we are helping our consumers help themselves, 
especially in instances where the user may not know how to 
install or update security settings on their own.
    Clearly no tools or technologies are useful unless 
consumers know about them and know how to use them. That is why 
AOL also undertakes significant effort to provide a wide range 
of educational resources.
    For example, AOL's safety and security area online includes 
specific information about the security features that AOL 
provides and tips on how members can protect themselves against 
scams and viruses as well as how to protect their credit card 
numbers and passwords.
    It also hyperlinks members to industry collaborative Web 
sites, like Stay Safe Online, GetNetWise, the FTC's information 
security Web page, for other specific suggestions and 
reinforcement of our messages.
    In addition to informing our members about security risks 
and solutions, we recognize that online leadership means taking 
on responsibilities beyond the AOL community. To that end we 
have undertaken numerous initiatives such as joining with other 
leading private-sector companies to form the National 
Cybersecurity Alliance, in partnership with the federal 
government.
    The Alliance Web site, www.staysafeonline.info, provides 
clear and concise consumer tips on information security as well 
as security background papers and research studies.
    Just last month, in response to an Alliance study, and as 
part of our ongoing educational outreach, we launched a media 
campaign to inform high-speed users about the dangers of an 
unprotected broadband connection. The primary goal of this 
unprotected broadband media campaign has been to reinforce the 
message that Internet users need to be cyber secure citizens 
and ensure that their computers cannot be hijacked by hackers 
to engage in cyber crime.
    Many of the initiatives I have outlined here involve close 
cooperation with our partners in industry and government and 
could not succeed without the existence of reliable processes 
for sharing information. Internet attacks can come from any 
part of the network of networks that constitutes the Internet 
and come in many different changing forms.
    For this reason, AOL strongly supports the development of 
information-sharing and analysis centers--ISACs--and through 
these and other fora actively engages in sharing information 
about cyber-threats and-attacks.
    And, because cyber-attacks can happen quickly and at any 
time, all ISPs should have a 24/7 point of contact within their 
company to work with other ISPs, other providers and 
governments to respond to potential cyber-threats.
    We believe that government can play a valuable role working 
with the private sector in encouraging dialogue among all 
industry players to promote information sharing and helping to 
educate consumers and businesses. We look forward to working 
with the Department of Homeland Security to achieve this goal, 
and we applaud the creation of the National Cybersecurity 
Division last month to continue and expand on many of these 
public-private partnership objectives.
    Thank you for the opportunity to be here today.
    [The statement of Ms. Gau follows:]

                 PREPARED STATEMENT OF MS. TATIANA GAU

    Chairman Thornberry, Representative Sessions, Representative 
Lofgren, and Members of the Subcommittee, on behalf of America Online, 
Inc., I would like to thank you for the opportunity to testify before 
the Subcommittee on the important issue of cybersecurity. My name is 
Tatiana Gau, and I am the Chief Trust Officer and Senior Vice President 
at America Online, Inc., where much of my focus is on cybersecurity. I 
oversee the integrity of the user experience, consumer protection, 
privacy, online safety, accessibility, community standards and policy, 
as well as crisis management and coordination for all of the company's 
brands.
    At AOL, we are committed to playing a leadership role on the issue 
of security. Employing our technology, tools, and educational 
resources, we strive to build secure products, provide a safe and 
secure environment within which to surf the Internet, and educate our 
members to help them protect themselves. As part of these efforts, we 
have developed extensive plans to address security issues in products, 
our network, and on the Internet.
    To succeed in the area of security, we work with our members to 
give them the tools and knowledge that they need to protect themselves. 
We cooperate with other ISPs, mailers, and members of the computer 
industry on our plans and initiatives. We also work closely with the 
FTC, FCC, and other federal and state entities. Because of the nature 
of the Internet, we believe that only through cooperation among all the 
parties can we properly address cybersecurity as a whole, both for our 
members and the public in general.
    AOL is working hard to implement recommendations in the President's 
``National Strategy to Secure Cyberspace'' that apply to our service. 
This Strategy lays out some very important steps that the private 
sector should take and that AOL is undertaking to protect consumers. As 
I will describe, we have designed several features of the next version 
of our software, AOL 9.0 Optimized, to fit the recommendations in the 
National Strategy. AOL embraces the partnership between government and 
the private sector envisioned by the National Strategy, and is 
committed to working with our vendors and competitors to strengthen 
security at the network and end-user levels.
AOL'S COMMITMENT TO SECURITY
    At AOL, safety and security are our top priorities. We have worked 
hard to develop a culture within the company where the starting point 
for all of our products and services is safety and security. However, 
online security is an ongoing process. It means providing consumers 
with easy-to-use security technologies, educating consumers about what 
to do to help keep their machines and the rest of the online community 
secure, controlling the use of our networks and keeping them safe, 
keeping personal information private, avoiding scams, and educating 
consumers about safe computing practices. Because we recognize that 
safety is one of the keys to instilling consumer confidence in the 
online medium and is critical to the continued growth and expansion of 
the Internet, we are working continuously to safeguard our members' 
accounts and computers and our infrastructure.
    The AOL approach to consumer security is therefore threefold, with 
a focus on: 1) building more secure products and technology, 2) 
providing state-of-the-art security tools to our members, and 3) 
educating consumers-both at AOL and beyond-to keep security in mind 
while surfing the Internet. In each of these areas, we work with others 
in industry and our friends in the government in a partnership aimed at 
providing a secure network for all users.
    1. BUILDING SECURE PRODUCTS AND TECHNOLOGY
    Our company strives to develop and deploy the best security 
technology available. The AOL brand includes many products and services 
that many people do not realize are part of AOL, including AIM, WinAmp, 
and Netscape. We have invested in all of these products and services 
with the aim to provide the best security technology available for our 
subscribers.
    We believe that network operators must make security a top 
consideration in every decision about their networks. We believe that 
they should monitor their networks for intrusions, apply all security 
patches for their software in an expeditious fashion, and employ a 
variety of other applicable best practices.
    At AOL, network security is an important part of the cybersafety 
equation. We monitor our network for viruses and take both proactive 
and reactive measures to prevent, detect, and eliminate them. We have a 
dedicated team of network security specialists who are on call 24 hours 
a day, seven days a week to protect the security of our infrastructure. 
Moreover, AOL member-to-member communications take place within a 
controlled environment, and are facilitated over our highly secure data 
transit network.
    In order to prevent denial-of-service attacks and other intrusions, 
AOL has integrated denial-of-service mitigation protections at all 
levels of our system, which help us protect against attempted attacks. 
AOL is no stranger to the cybersecurity fight. We are under almost 
constant attack from hackers and spammers who target our networks. To 
combat these attacks, AOL and other ISPs have designed Intrusion 
Detection Systems (IDS), which unobtrusively monitor corporate networks 
in real time for activity such as known attacks, abnormal behavior, 
unauthorized access attempts, and policy infringements. These systems 
can be used proactively to block certain types of infections and 
attacks. For example, ISPs can be configured to recognize and block 
inbound traffic that could otherwise infect AOL's corporate data 
systems. IDS also can be used to detect computer compromises through 
signatures that identify known hostile traffic patterns. When these 
compromises are detected in AOL's network, the IDS system generates an 
alert to the AOL security staff, which responds immediately.
    When file attachments containing new viruses are reported to AOL by 
our members, a signature is built and passed on to anti-virus software 
vendors and our own IDS machines so that the viruses can be detected in 
subsequent attacks. We alert our customers as to how they can prevent 
further propagation of a virus and reach out to other providers where 
we detect abnormal Internet traffic that may be generated by a virus.
    AOL also employs significant protections to safeguard access to 
member data. AOL keeps passwords strictly confidential; verification of 
screen names and passwords is performed on AOL's secure servers. We 
recognize that a sound security system involves not only use of tools 
such as firewalls, intrusion detection systems, and anti-virus 
software, but that our employees play an integral role in protecting 
security. To this end, access to member data is granted on a need-to-
know basis, and employees are extensively trained and screened prior to 
being granted access privileges. We also conduct periodic internal 
auditing of network records of data access to detect and promptly 
address suspicious activity.
    2. PROVIDING OUR MEMBERS WITH SECURITY TOOLS
    We are particularly proud of the safety and security features of 
our new client software, AOL 9.0, which is expected to be available 
later this summer. These cutting-edge safety and security features 
include a free firewall for broadband users, free and premium anti-
virus services, advanced spam filters, and a computer ``check-upt' that 
enables our members to diagnose and fix security problems within their 
systems. Some of these features have already been launched but will 
come together as a complete package in AOL 9.0.
    To assist both our narrowband and broadband members, AOL runs a 
virus scan on all e-mail attachments that it receives from the Internet 
or that are uploaded from our members. If a problem is detected and we 
can fix the filet we do so and deliver it to the addressees. If it is a 
Trojan horse, something that by its very nature cannot be fixed, we 
return the e-mail (but not the attachment) to the sender with a 
warning. However, e-mail attachments are only one way that a computer 
can get infected with virus. AOL, therefore, has a premium anti-virus 
offering that, after downloading a small program, will guard a 
subscriber's computer from viruses on floppy disks or CDs. In addition, 
every time a subscriber signs on to AOL, the virus definition file is 
updated with the latest virus definitions--the most important step in 
protecting your computer because more than 250 new viruses are released 
on the Internet every month.
    In addition, AOL is providing broadband members with a customized 
firewall to guard against hackers and other unauthorized intruders by 
helping build a wall around the member's computer. The wall, when 
properly configured, blocks access to sensitive files, financial 
records, and personal data stored on the member's computer. AOL has 
teamed with Network Associates to provide free firewall protection.
    We strongly believe that all users, whether an AOL member or a user 
of another service, should install, regularly update, and run anti-
virus software at least once a week. If the user has broadband, he 
should also install and run a firewall. These two steps alone would 
dramatically increase the security of consumers' computers.
    In addition, AOL has built in an array of security features to 
address the growing problem of spam. AOL already blocks as many as 2.4 
billion spam messages in a single day. To empower our members and to 
track down and block spammers more quickly, we provide users with a 
``Report Spam'' button on the AOL 8.0 software, which gives us rapid 
reports of spam that evades our filters. Building on the ``Report 
Spam'' feature and based on extensive member feedback, AOL 9.0 will 
contain unparalleled spam fighting tools that will make it easier for 
members to manage spam and to protect themselves from unwanted mail. 
These tools include very advanced filters, as well as a feature that 
will block images and URLs from unknown senders unless a member chooses 
to see them. This feature will help ensure that spammers cannot force 
e-mail that could compromise the security of members' computers. We 
also are working closely with Congress on legislative solutions to 
spam.
    AOL 9.0 also empowers users to be proactive toward security by 
providing for computer check-ups. Through these easy-to-use check-ups 
and behind-the-scenes protective measures, AOL can diagnose and fix 
security as well as connectivity problems on a member's computer. We 
help the member help themselves, especially in instances where the 
member may not know how to install or update security settings on their 
own.
    3. EDUCATING CONSUMERS AT AOL AND BEYOND
    AOL devotes significant time and energy to providing a wide range 
of well-placed education tools and resources that our members would 
find difficult to avoid. Because our members spend an average of 70 
minutes per day online with AOL, we have ample time to remind them 
about security, and we do. This time online also has implications for 
the safety of the infrastructure. With more people staying online 
longer, those computers can be used to launch a distributed denial-of-
service attack.
    For this reason, AOL spends considerable resources to highlight 
safety and security information available on the AOL service. First, 
members can easily reach safety, security, and privacy information on 
the service with a toolbar button-which is always right in front of the 
member. Second, we have promoted and will be promoting even more 
educational material on spam and Internet scams with our Welcome Screen 
space. A recent Welcome Screen promotion on scam e-mails had the 
highest click-through of any Welcome Screen promotion (including those 
on Britney Spears) until we started our current promotion on spam. Spam 
is currently the number one area of interest to our members.
    One important feature of our service is its Safety, Security, and 
Privacy area. Member security begins with educational tools that are 
clear, easy to find, easy to use, and easy to customize. Collectively 
taking care of our community, this site urges members to ``protect your 
home computer and the nation's Internet infrastructure.'' The site 
includes specific information about how members can protect themselves 
against scams and viruses, as well as how to protect their credit card 
numbers and passwords. It also hyperlinks members to industry 
collaborative sites like ``StaySafeOnline,'' ``GetNetWise,'' and 
``Site-Seeing Tips: Travel Insurance for Cyberspace'' for other 
specific suggestions and reinforcement of our messages.
    Another key feature of our service is AOL Keyword: Help. This 
feature provides a resource for members who need assistance on any 
topic, including security. This process is easy to navigate, clear and 
simple to understand. At Help, one of six listed topics is ``Online 
Safety.'' Clicking this link gives the member online safety subtopics 
to choose, including information on protecting your password, avoiding 
computer viruses and spotting scams and schemes. Clicking any of these 
choices gives the member a menu of related short, simple, useful 
articles such as ``Password Requests in E-mail,'' and ``Password 
Stealing Schemes.''
    In addition to providing many avenues for our own members to be 
fully informed about security risks and solutions, we recognize that 
online leadership means taking on responsibilities beyond the AOL 
community. AOL feels keenly an obligation to use our resources wisely 
for the benefit of all consumers in the online world. To that end, we 
have undertaken numerous initiatives.
    For example, we have joined with other leading private sector 
companies to form the National Cyber Security Alliance, a unique 
partnership with the federal government that fosters awareness of 
cybersecurity through educational outreach. The Alliance website, 
http://www.staysafeonline.info, provides clear and concise consumer 
tips on information security. AOL is proud to have participated in the 
design of that site, to be hosting it on our web servers, and to be 
dedicating substantial resources toward driving traffic there.
    To gauge consumer attitudes toward and readiness regarding 
cybersecurity, AOL has commissioned studies independently and with 
others in industry to help identify areas where efforts and initiatives 
can further enhance security. We use the results of these studies to 
tailor solutions to members' attitudes and practices. A recent study 
conducted by the Alliance demonstrated that the overwhelming majority 
of broadband consumers lack basic protections against the dangers of an 
always-on connection to the Internet. The study revealed that most 
consumers do not realize that they lack those protections or that their 
computers and personal information are at risk.
    In response to this study, and as part of our ongoing educational 
outreach, we launched a major campaign in June to inform high-speed 
access users about the dangers of an unprotected broadband connection. 
The primary goal of this Unprotected Broadband media campaign has been 
to reinforce the message that Internet users need to be cybersecure 
citizens and ensure that their computers cannot be hijacked by hackers 
to engage in cybercrimes.
    4. THE IMPORTANCE OF INFORMATION SHARING
    Many of the initiatives we have outlined above involve close 
cooperation with our partners in industry and government and could not 
be successful without the existence of reliable processes for sharing 
information. Because Internet attacks can come from any part of the 
network of networks that constitutes the Internet and come in many 
different, changing forms, information sharing regarding security 
threats is essential to good cybersecurity. For this reason, strongly 
supports the development of Information Sharing and Analysis Centers 
(``ISACs''), and through these and other fora actively engages in 
sharing information regarding cyber threats and attacks.
    This cooperation has proven very important to the continued stable 
operation of the Internet. For example, in February of 2000, the ISP 
industry worked together to combat the largest attack on the Internet 
to date by a single individual in Canada who was able to organize a 
large scale denial-of-service attack on several large websites, 
temporarily knocking them out of service. As the attack occurred, the 
large players in the ISP industry quickly communicated with each other, 
through informal technical contacts, to isolate and locate the source 
of the attacks. As a result of the industry's quick response, service 
to the websites was restored in a matter of hours, and the 
functionality of the Internet as a whole was never interrupted.
    This type of response is typical in the ISP industry, and these 
well-established informal procedures and responses proved to be 
effective in remedying subsequent attacks on the infrastructure, such 
as NIMDA and Code Red viruses.
    When our IDS system detects or we receive reports of new viruses, 
we build a signature and pass along to anti-virus software vendors as 
well as our own IDS machines. We also reach out to other ISPs when we 
detect abnormal traffic patterns that may reflect a virus or hacker 
attack, and have a Cybersecurity team on call 24 hours a day, seven 
days a week available to address indications or reports of security 
threats. Indeed, because cyber attacks can happen quickly and at any 
time, we believe strongly that all ISPs should have a similar 24/7 
point of contact within their companies to work with other ISPs to 
respond to potential network abuses.
    Information-sharing can also help on the law enforcement side of 
the cybersecurity equation. AOL works closely with law enforcement and 
other government agencies to deal with threats to the critical 
infrastructure, even when those threats may not directly affect AOL or 
our members. AOL has a dedicated team of professionals, including 
former prosecutors, who work with law enforcement in investigations of 
cybercrimes, including hacking and other security threats. We cooperate 
with authorities not only in responding in a timely fashion to their 
requests for information during an investigation, but also pro actively 
in alerting law enforcement to potential network threats. AOL has 
worked closely with government and law enforcement to identify and 
locate major hackers whose actions have threatened the Internet, 
including the creator of the infamous Melissa virus.
    We look forward to working with our colleagues in industry and 
government to build upon these existing mechanisms for cooperation and 
information-sharing, and to ensure that the lines of communication are 
open and clear.
THE ROLE OF GOVERNMENT AND PUBLIC-PRIVATE PARTNERSHIPS
    We believe that government can work with the private sector in the 
following key areas of cybersecurity: 1) encouraging dialogue among all 
industry players to promote informationsharing; 2) educating the public 
about staying alert to potential network abuses; and 3) promoting 
active cooperation between industry and government in finding and 
apprehending hackers. Many of the initiatives we outlined above have 
involved close cooperation between government and industry players in 
these areas.
    With responsibilities for cybersecurity now coming under the 
primary purview of the Department of Homeland Security's Directorate 
for Information Analysis and Infrastructure Protection, we applaud its 
creation of the National Cyber Security Division (NCSD) last month and 
believe it can continue and expand on many of these public-private 
partnership objectives. We look forward to working with the NCSD, 
particularly as it seeks to:
         identify risks and help reduce vulnerabilities to 
        government's cyber assets and coordinate with the private 
        sector to identify and help protect America's critical cyber 
        assets. As previously stated, government can play a very 
        valuable role in keep the lines of communication open and clear 
        about cyber threats and cybersafety;
         oversee a consolidated Cyber Security Tracking, 
        Analysis & Response Center (CST ARC), which hopefully will 
        serve as an effective, single point of contact for the federal 
        government's interaction with industry and other partners on a 
        24x7 basis. The CST ARC should work closely with existing ISACs 
        and should seek to develop tools to increase communications 
        among all players; and
         create cybersecurity awareness and education programs 
        and partnerships with consumers, businesses, governments, 
        academia, and international communities. In coordination with 
        the National Cyber Security Alliance and its StaySafeOnline 
        campaign, and other organizations, the NCSD should seek to 
        advance the development and expansion of education programs 
        without delay.
    We look forward to seeing DHS's execution of the actions and 
recommendations outlined in the National Strategy to Secure Cyberspace, 
and will support those efforts as we continue to work closely with 
government and law enforcement in minimizing threats to our 
cybersecurity.
CONCLUSION
    We applaud the Subcommittee for its examination of these issues as 
companies such as ours undertake significant efforts on behalf of our 
members and the Internet as a whole. We will continue to work hard to 
implement recommendations laid out in the National Strategy in our 
products and our outreach initiatives, and encourage other companies to 
do so as well. We are deeply committed to addressing cybersecurity in 
partnership with government and with our suppliers and others in our 
industry. We look forward to continuing to work with Congress, the 
Administration, and others in industry toward ensuring cybersecurity.

    Mr. Thornberry. Thank you.
    It is a little bit frustrating from this side of the dais 
because I think the subcommittee could spend an entire hearing 
with each of you. And yet what we are trying to do is also get 
our arms and brains around the larger problem, the overview. 
And so we appreciate each of you being here today.
    I want to mention before we turn to questions that toward 
that end this subcommittee is sponsoring, with CRS, a workshop 
on cyber-security, and I would encourage all members to have 
their staff members attend. It is Monday, July 21, in the 
Cannon Caucus Room. Ms. Lofgren and I have sent information on 
this to each of your offices. We have some fine folks who are 
there and I would recommend that you send your people.
    I would like to start with a kind of a broad overview 
question addressed to each of you. And a number of you have 
talked about this in your statement. But, again, in the 
interest of trying to see if there is consensus and in broad 
form where we go, I would like for each of you to briefly 
address this question. We are not going to have time to get all 
into it, but we will go back.
    And here is, I guess, my question. The market is driving 
each of you towards some measure of greater security. First 
question is, are you comfortable that that market-induced level 
of security is sufficient for our nation's security or is 
something more required than where the market is going to take 
you?
    Secondly, if you think something more is required--and I 
don't assume that--but if you think something more is required, 
then just in rough outline what is the federal government's 
role in achieving that extra measure beyond which the market 
allows you to go.
    Again, I would ask each of you to be relatively brief in 
your answer, because I want to turn to other folks, but that is 
kind of the big question that this subcommittee is grappling 
with. And so I would like to just go down the line.
    Mr. Reitinger, if you would start?
    Mr. Reitinger. Thank you, Mr. Chairman. I will try to be 
very brief.
    I think the market is going to go a long way. This is a 
very innovative industry. And as you heard from the panel 
today, across the industry we are seeing security innovation.
    It is possible that in selected areas the market will not 
go as far as the nation needs for national or homeland security 
purposes. I have two points on that.
    One, you can't look at that broadly, though. In other 
words, the market may not go far enough in a particular place, 
or in another particular place or sector. So I think it is less 
a broad question and more a particularized question.
    Second, it is dynamic. In other words, the question is not 
where is the market now, but where is the market going and 
where do we need to be? Do we need to look at the direction we 
are going in.
    Second point, even if the market is not going to go as far 
as we want to go, I would urge policy makers to move in as, I 
believe my estimable colleague Whit Diffie said, as tailored a 
fashion as possible. Just because the market may not go as far 
as you need for national security doesn't mean to leap to 
regulation or some other mandatory step.
    I think one of the critical functions for the new 
Department of Homeland Security is to take a very close look at 
where the market is going, figure out what it is going to do, 
where there may be gaps, and then figure out the best and least 
intrusive way to close that gap. And I think some of the 
suggestions we would have I stated in my written statement and 
I outlined for the committee and won't repeat.
    Thank you.
    Mr. Thornberry. Thank you.
    Mr. Diffie?
    Mr. Diffie. I think I will take it for granted that there 
is some role for government in this and just spend a moment or 
two just looking at what that might be.
    I think it is important for the government to do those 
things that it is uniquely qualified to do. So, for example, 
the government has access to information that is not available 
or not as readily available in the private sector. And so, as I 
said in my testimony, I believe that a follow-up mechanism for 
measuring the actual security of systems in operation should be 
used to validate the certification mechanisms.
    This turns on the fact that the intelligence information 
needed to do that is very hard for industry to get because 
individual pieces don't want to share it and they share it more 
readily with the government.
    I also believe the government has played a very important 
role in standardization. I cited the advanced encryption 
standard. If it is anything like as successful as its, I 
believe, more controversial predecessor, the data encryption 
standard, that will be something that the fact the U.S. 
government took this on as a standard will have a transforming 
effect.
    Finally, there is government's incomparable role as a 
customer, both in the sense that the government could perhaps 
show more foresight in putting security forth as a requirement 
for the systems that it uses but also in a unique ability to 
engage in certain large purchases, so to speak. So, one of the 
problems--we have had a long discussion of why public key 
infrastructure has not developed as well as many of us hoped. 
And I believe at root that is a capital development problem. 
That is to say, like a telephone infrastructure, a keying 
infrastructure becomes more valuable, the more of it there is. 
And so it is hard to get it started.
    So, if you contrast general government and civil sector 
keying activities with those of the Department of Defense, 
which has a focused mechanism for putting out up-front 
development costs, you see that they got much better results in 
a shorter period of time.
    So I think the government needs to consider what major 
steps like that it might take.
    Mr. Thornberry. Thank you. Dr. Lowery.
    Dr. Lowery. I am wondering if there will be much left to 
say by the time you get to the end of the row because many of 
the themes that you have heard expressed so far to my right we 
also concur with. In particular, government's role as a 
customer is one that we see as extremely important. You have a 
lot of opportunity to give us input through our direct 
relationship with you as a customer of Dell, for example, to 
tell us what it is that you want.
    And the CIS benchmark offering is a prime example of this 
in action. This is a result of government customers asking for 
that. So, as a customer, I think you have immediate impact to 
how industry works through market forces.
    The coordinating role of government also should be 
reemphasized because since we do believe in standards or where 
this is going to happen, the consensus that needs to be driven 
here, a coordinating role is important to make that happen. And 
I think that government helping to arrive at standards is an 
important function that you can provide. And we would like to 
see more involvement in helping to coordinate the standards 
that are already being developed through the market.
    Mr. Thornberry. Thank you.
    Mr. Adelson, is market enough? And if not, where does 
government fit?
    Mr. Adelson. I believe market drives much of the end-user 
requirement, end-user type of applications and tools. While 
government can certainly advise and inform the service 
providers to provide those tools, market will only go so far as 
to, say, create my end-user environment, something from 
Microsoft, something from AOL.
    At the network infrastructure level, for example, if two 
networks have authentication when they speak with other, users 
never see that. They don't know if it is on or off. And so, in 
order to get network infrastructure going, you have to have 
certifications and standards, create some kinds of best 
practices, check against them, and then be able to advise the 
user community that a network has met or not met those 
standards.
    Mr. Thornberry. Thank you.
    Mr. Ianna.
    Mr. Ianna. Answer to the first question. I think that the 
market will take it a long way but not all the way. And I think 
the government can help here.
    And I would liken this back to when the FCC and the Telecom 
industry created the network reliability council. I there were 
some failures in the industry, local carriers, long distance 
carriers. And I think they were dragged in front of a hearing, 
and were asked two basic questions.
    Number one, how reliable is the public switched 
telecommunications network? And there was not a lot of good 
information to give that answer. And if you couldn't answer the 
first question, you certainly couldn't answer the second one, 
is it getting better or is it getting worse?
    Forming the network reliability council brought all of the 
participants in the industry together, NRIC as it is now 
called.
    And we now have some 44 quarters worth of data broken down 
amongst the components, the physical components, of wire line 
networks as to what causes failures. And we know how reliable 
it is and is it getting better or worse and what is causing a 
particular problem.
    So I would suggest that the way that we approach this--is, 
to have a voluntary public forum that we could share 
information, best practices and the like and that we set a 
standard to answer the question: How cyber secure are we? And 
there is going to be a metric around that. And is it getting 
better? Is it getting worse? Because it will continuously 
change. As we interconnect one network to another network, if 
somebody introduces a new application, the holes or the 
opportunities for hackers to get in and do something will 
change continuously.
    By the way, I think you could also answer the question 
amongst different industry segments, the financial industry, 
the water industry, the power industry. And each one of those 
can focus on their own mission-critical services and how cyber-
secure they are and how they need to be. And we could share 
information amongst those ISACs too.
    Mr. Thornberry. That changing nature is part of the 
challenge for government because we don't change very fast, 
particularly when we are talking about laws and regulations. So 
I think that is a good point that several of you made.
    Ms. Gau?
    Ms. Gau. I have been with AOL since the mid-1990s and never 
has there been a time where I haven't had to argue until I was 
blue in the face about the need and the good business sense to 
include security in our products. Our consumers are demanding 
it now. Extensive research that we have done shows that it is 
first and foremost on their minds when they are surfing the 
Internet, especially if they have family involved.
    And they may not be thinking about the nation's critical 
infrastructure in that context, but they are thinking about how 
to be safe themselves and how to protect their point of 
vulnerability. And obviously, they have the buying power.
    Well, consumers are not the only buyers out there. As some 
of my colleagues have mentioned, government can play a role 
here in really driving the market for more secure products. 
One--a similar situation might be with Section 508 of the 
Americans with Disabilities Act which requires that companies 
include accessibility in their products if they are going to 
sell to the government. Similar types of approaches could be 
taken in the area of security.
    With respect to what more could the government do, I would 
go back to the mission of the National Cybersecurity Division 
and to homeland security in general in this area with respect 
to information-sharing, providing those of us in the industry, 
those of us that are working to keep the critical 
infrastructure up in place with information that we might not 
be able to easily obtain elsewhere; to provide for research and 
development in areas that we are not able to. And to also work 
to educate all users, consumers, businesses and other 
government agencies alike about the need for cyber-security.
    Mr. Thornberry. Thank you.
    Ms. Lofgren?
    Ms. Lofgren. Thank you, Mr. Chairman. This is a very 
helpful panel.
    And actually, if I am listening to you, I am hearing broad 
agreement on many themes: that we do need standards. We need 
accountability towards those standards. We need a role for 
government in coordination and maybe assisting in the 
development of those standards, additional research.
    I am glad, Mr. Ianni, that you mentioned the physical 
infrastructure issue because that is also--I don't want to 
belabor that. But that is something that we--you know, we are 
thinking hackers, but actually the tradition of terrorists has 
been guys with bombs. So we should not overlook that element.
    I have a question because Mr. Diffie mentioned that we do 
now will have a downstream effect. And I think about that all 
the time, that if we make a misstep now that it will have an 
impact, you know in 10 or 50--my children will live with the 
mistakes that I make. And so I especially want to avoid them.
    And while we are focusing on security, which we must do, I 
am eager to hear from you, what is the worst thing we could do 
as the federal government that would either impair our 
security, but also impair our liberty in the future? I am 
concerned about what we might do now that would impact the 
architecture of the Internet to the detriment of our free 
society. And I am wondering if you have thought about those 
issues and what your thoughts might be. Each of you, starting 
with Mr. Reitinger
    Mr. Reitinger. Thank you, Congresswoman. Although it is a 
little unfair for me to go first on each of these. I will be 
very brief so I don't cut folks off.
    I would say I think the worst thing that you could do is 
something that would impair security and privacy innovation. 
Doing something in such a way that the ability of industry to 
respond to the increasing market demand for security and the 
increasing need for homeland and national security, that 
ability would be impaired in some way.
    Mr. Diffie. I guess my greatest concern is that these 
technologies will get bottled up and become the properties of--
to give the jargon, certain elites, in the way that say, drug 
development is now regulated. I think it is very important that 
people continue to own their own computers, genuinely to own 
their own computers, to have the root authority and the actual 
power to control what their computers do. So that we get 
security sort of by an aggregation from the ground up of all of 
the individual citizens, rather than something imposed by some 
government-industry security mechanism that restricts either 
security practices, security uses, or in general, the use of 
computers by the citizenry.
    Dr. Lowery. I think anything that you do which does not 
allow for the fact that security is a moving target is going to 
be ill conceived. It is a changing landscape from day to day.
    So anything that is done above and beyond what customers 
are asking us to do, I think has to be very carefully 
considered, because ultimately, as time moves forward and we 
are looking back on what we are deliberating today 15 years 
from now, we very well may say, How could we have foreseen this 
happening?
    So we have to be very open minded about what could happen 
in the future, and not kid ourselves that we have all the 
answers today.
    Mr. Adelson. I think anything that government does that 
would slow down first response, and from, you know, that if, 
your good intentions aside, monitoring or controlling the 
``Internet,'' with quotes around it, you know, is something 
that is far beyond the scope, and if you tried to implement 
such a thing, I fear that the Internet itself would actually be 
at increased risk toward our, you know, how fast you get back 
up after a national crisis.
    Mr. Ianna. I think the worst thing that the government 
could do is not listen to the industry participants as to what 
they are capable of doing, and what can be done in a timely and 
cost-efficient manner.
    I go back to some of the NRC days, where we were trying to 
define a failure. And if you ask a consumer group, they may 
come up with something that says, Well, this is a failure, and 
every time you have this failure you need to file a report.
    We would have cut down acres of trees and buried Washington 
in paper and not improved the state of reliability had we 
adopted some of those that the industry said, This can 
constitute a failure, and this is what we want to improve. We 
work together in a true partnership.
    I really believe that all of the industry participants in 
that case, in telecom, although we were fierce competitors, 
came together in the best interests of the country.
    So listening to the participants about what is doable and 
what can be done quickly and cost-effectively, I think, is very 
important. Not listening to them, I think, would be a very big 
mistake.
    Ms. Gau. Well, I have to echo all my colleagues' comments, 
particularly in the area of developing standards that might be 
obsolete by the time they would be published, because security 
is a moving target, and it is an ongoing process.
    Additionally, I think, one of the worst things government 
could do would be to not engage and further strengthen 
relations with the private sector.
    There have been ongoing dialogues, AOL have very close 
working relationships with government and also with law 
enforcement at the state and local levels, and we are engaged 
in a continual dialogue.
    But anything that would hamper our ability to respond, 
whether it is some type of system where we have to go through a 
central control without being able to first focus on what we 
need to do as a company to get our business back up and to be 
able to provide the service to our customers would be a 
mistake.
    Mr. Thornberry. The gentleman from Texas, Mr. Smith.
    Mr. Smith. Thank you, Mr. Chairman. Mr. Reitinger, let me 
address my first question to you and ask you to call upon your 
experience with the Department of Justice, where you served 
prior to joining Microsoft.
    There, according to your bio, you were a prosecutor of 
computer crimes. One of the frustrations we have on this 
committee, and I have to say we have in on the Judiciary 
Committee, as well, is not being able to quantify the number of 
computer crimes, not knowing how many are committed, not 
knowing what the trends are, and therefore, not being able to 
necessarily address the problems as much as we should.
    As you know, when computer crimes are prosecuted, they are 
kept track of by statute not by type. What can we do to get a 
better handle on the types of computer crimes that are 
committed, how many are committed and what the trends are?
    Mr. Reitinger. Thank you very much, Congressman.
    I think your frustration is widely felt. One of the 
concerns--and you will see in the opening of my written 
statement, as I think in prior testimony the committee has 
seen, there is a general sense that we don't really know what 
the scope of computer crime and computer damages are. We 
actually don't have a statistically rigorous measurement of the 
amount of harm from computer crime and computer attacks.
    There are government agencies that do that sort of thing, 
the Census, the Bureau of Justice Statistics. I would think 
that having a statistically rigorous analysis of the amount of 
harm that our economy faces as a result of computer crime would 
be a very valuable thing and help close what I think of as the 
knowledge gap that we face in addressing questions in that 
area.
    Mr. Smith. I agree and I think that is exactly what we need 
to do. And I will try to engage in some discussions with the 
various agencies to try to collect that information for the 
reasons that you stated. Thank you.
    Dr. Lowery, in regard to your testimony, you mentioned some 
of the initiatives that Dell has taken as far as systems 
security goes. Would you go into a little bit more detail of 
specifically about what Dell has done that you find effective.
    Dr. Lowery. Yes, I would be glad to.
    Dell has responded to customer input, specifically from our 
federal customers, to deliver from our factory directly to them 
Microsoft Windows 2000 installed on Dell computers, 
specifically the Optiplex, Latitude and Precision Workstations, 
that are already set with the configuration settings from the 
Center for Internet Security, which I mentioned before.
    The reason that we have done this is purely because 
customers have requested it. Also, we see it as something that 
can be made available to all of our customers. It is not 
something that is restricted to our federal customers. We think 
that everyone can benefit from it.
    So this is an example of industry best practices as they 
exist currently, today, that we can bring to market with very 
minimal lag time because of our direct model. We build--most 
every system that we ship is custom built to that particular 
customer's order. And so as soon as we have new information 
that impacts product safety or security and we are able to get 
that into the product and into the factory, it is in our 
customer hands typically in five to 10 days after that as we 
start shipping it.
    So that is why we have taken that role. We can deliver that 
technology fairly quickly to our customers that have requested 
it.
    Mr. Smith. Thank you, Dr. Lowery.
    Mr. Reitinger, let me go back to you and Ms. Gau. Both of 
you have had extensive experience dealing with the federal 
government. We have heard in response to some earlier questions 
that we need to establish a better relationship with the 
federal government. We need to do more listening, and so forth. 
Specifically, though, how do you think the federal government 
can better, or more enhance cybersecurity?
    Ms. Gau, let me begin with you.
    Ms. Gau. At the risk of sounding repetitive, I am going to 
go back to the information-sharing, the research and 
development, coordination with private sector and education 
components that actually form the mission of the National 
Cybersecurity Division.
    One of the areas that we are looking at right now in terms 
of the industry is information-sharing with each other and how 
we can continue to improve on those processes that already 
exist, such as 24-7 contacts that exist amongst the players in 
the industry. And taking that a step further, really having 
that kind of cooperative relationship with government at the 
DHS level in the National Cybersecurity Division is something 
that I would very much look forward to.
    At this point, we are still developing our relationship 
with DHS and I look forward to seeing the Cybersecurity 
Division get going, so to speak, and engage us more actively.
    Mr. Smith. Okay. Thank you.
    Mr. Reitinger?
    Mr. Reitinger. Thank you very much, Congressman.
    I will also--I think the main points we have hit on and Ms. 
Gau also retracked there--let me touch on one point on 
information-sharing. There is an anecdote I have heard about 
something that occurred long ago, before the IT ISAC in 
particular was formed, where my boss' predecessor, Howard 
Schmidt, got a call in the middle of the night from the network 
operation people who said we are seeing a spike in network 
activity. He came in and he saw that there in fact was an issue 
and started calling his colleagues, including a colleague from 
Sun.
    They were able to sort of quickly see that this spike was 
occurring across the networks and take some action. In 
particular, Howard was able to reach out and talk to people at 
the Department of Defense, and as a result, a lot of DOD 
computers got protected as a result of that.
    This goes to show that we already have a lot of ad hoc and 
very valuable information-sharing that is taking place. What we 
need to do now is put that on rails, make it a part of business 
processes for both government and industry so it becomes a part 
of how we do business. And the government, I think, can help a 
lot in that regard, in particular in some of the ways Mr. Ianna 
was referring to.
    Mr. Smith. Thank you, Mr. Reitinger.
    Thank you, Mr. Chairman.
    Mr. Thornberry. Thank you.
    The Chair's intention is to call on members in the order of 
appearance at the hearing. And I will now call on the gentleman 
from North Carolina.
    Mr. Etheridge. Thank you, Mr. Chairman. Let me thank you 
and the ranking member for holding this hearing, and more 
specifically, for our witnesses being here today, because I sit 
here and think of so many questions, so much information and so 
little time on such a critically important question.
    Mr. Reitinger, let me ask you the first one, because I am 
going to go from your written testimony, if I may, and then I 
will come back and ask the others. The next time I will go in 
reverse order from the other end. But yours first.
    You stated that cybersecurity remains an interagency 
problem, as you said earlier, and that a key role for DHS and 
the National Cybersecurity Division is building industries for 
effective government action in helping other agencies develop 
procedures that support homeland security.
    What has the department done thus far to fulfill this role? 
And have its efforts produced results that industry is feeling?
    Mr. Reitinger. Thank you, Congressman.
    I might be the wrong person to ask that question to. The 
people who could best answer it would be in the department.
    I am very encouraged by a lot of the activity that the 
department is undertaking. I think they are very new. They were 
only officially stood up less than six months ago. But 
listening to the things that they are saying, particularly 
Assistant Secretary Liscouski, on the issue of cyber-security, 
I am looking forward with hopeful expectation to the things 
that they are going to accomplish.
    In particular, one of the things that I think they are 
doing is focusing on deliverables, getting things done in both 
the short term and the medium term as they look towards the 
long term.
    I think there is a tremendous problem there. There are a 
lot of government stovepipes that need to be tackled. And I 
think the entire department needs a lot of help from across the 
bureaucracy and from this committee. But I feel very hopeful 
about it.
    Mr. Etheridge. Thank you. Want you to understand, I asked 
you that question because you have been inside and now moved 
outside, and I think it is critically important to hear your 
views on it.
    Let me start on the other end and ask this question of each 
one of you very quickly, because each one of you touched on 
about the security issues that you are employing that you have 
ramped up.
    And my question is, what event or events prompted the 
additional focus on security from your strategic standpoint as 
an industry? Because different ones have talked about the 
customer demands--that does it. Was it customer demand or was 
it an attempt to differentiate between products or some other 
events? Because you have shared with us the need for industry 
to be given a goal, but at the same time industry's going to 
take certain actions.
    It would be of interest to me and I think to others on this 
committee to know some of the things that have driven that.
    Ms. Gau. As a consumer-facing business, the AOL perspective 
is going to be geared, obviously, towards what we see with our 
consumers.
    Whereas there have been the early technology adopters, as 
well as other people out there in the marketplace that have 
always been concerned about security, I would say that it was 
probably right around the time of the Melissa virus in the year 
2000 when the mass market of consumers all of a sudden realized 
that, My gosh, a virus, and the whole story of how it 
propagated and how the guy then got caught and the cooperation 
that was entailed in catching the guy--it really all of a 
sudden woke people up.
    And it was about the same time that also there were the 
attacks against eBay and a number of other major providers that 
were taken down for a brief period of time, as well as some 
privacy breaches, some high profile privacy breaches that took 
place that year.
    So I would say it was really in 2000 that we started seeing 
our consumers identifying safety and security as a top priority 
for them in the security research or general research that we 
do on a routine basis to understand our customers.
    Mr. Ianna. Actually, it starts from customer demand, but 
that only starts from the base of what you know and what you 
are trying to protect against. For example, in a data network 
you are saying, I am trying to make it as reliable as I 
possibly can. People know about cable cuts, they know about 
software failures--trying to make sure that this network is 
four nines of reliability. All of a sudden some other new thing 
comes up, somebody does a distributed denial-of-service attack, 
and you are hosting that Web site in your network. You now have 
to be aware of the fact that this goes on and how do you 
mitigate it.
    So it is not only customer demand but it is an event that 
occurs that is a new form of failure that you very quickly have 
to adapt to.
    And unfortunately, as networks get more and more 
sophisticated--for example, let us say for example in data 
networks now, Wi-fi becomes a very popular form of access. I 
guarantee you we will see different types of failures and 
different types of potential intrusions in gathering 
information in that network than we have seen in other 
networks, maybe because of the unsecure nature of transmitting 
some of that information.
    So it is the baseline of what you know always augmented by 
something new happening and customers saying, ``I don't want 
that to happen to my application. What are you, AT&T, what are 
you, service provider, ISP, doing to prevent that from 
happening again?'' And that is what drives our continuous 
development.
    Mr. Adelson. I will speak to the physical components, since 
that is our area of speciality.
    There was no specific event which changed the focus on 
physical security for us. I know back in 1996, I worked at 
Digital Equipment, in their research, and what we found was 
that the participants--and infrastructure radically changed 
from 1996 to 1997, and started to include companies like Alta 
Vista and Yahoo and Google, as well as the network service 
providers. Their requirements for physical security had 
commerce behind it, and it changed all of the focus.
    And so, for example, exchange points moved from a central 
office to a robust physical infrastructure. That is really the 
closest thing to an event--it is really a market shift that 
focused our change.
    Dr. Lowery. Congressman, I would say that I perceive no 
specific event, but instead a succession of events that are 
also progressive, kind of ramp-up.
    And also, as Mr. Diffie mentioned earlier, we are making a 
transition to more virtual world. And so it is becoming more 
important, and becoming something that we rely on increasingly. 
And this has been happening over the past three or 4 years. The 
time lines you have already heard.
    So that does drive customer demand. As customers become 
more aware of how much they have invested in these 
technologies, and how much those technologies impact them 
personally, they start making more specific requests.
    And as I said, we are always open to our customer input. 
That is what we are looking for. We look to them to help us 
make a determination as to where we go next as far as what we 
should be doing with our products.
    Mr. Diffie. Well, he stole my line. I thought I was going 
to be first to say that I couldn't remember any explicit event.
    As I go back over the half dozen things I can list, which 
seems to be significant Sun contributions to security--client 
server computing Java, hardware domaining, trusted Solaris--my 
sense is that they are the responses to our perception of our 
customers' needs in security, as opposed to their desires in 
security.
    So, for example, with the rise of the World Wide Web, the 
development of a computer language intended to have security 
with mobility--in this case, mobility of code--was intended to 
enable the sort of business development that we saw.
    And I think that is the kind of reflection that is always 
going to be required in this area, that you are never able to 
determine security requirements merely by market survey.
    Mr. Etheridge. Thank you, Congressman.
    Rather than listing a specific event, I will briefly 
mention three factors that I think play outside of customer 
demand, one of which relates to what Mr. Diffie was just 
talking about.
    First, I think there is a business imperative to build 
trust. Security is in a sense less a size of the slice of the 
pie issue as it is a size of the pie issue.
    For all of us to do better and be more successful, we need 
people--and for society to be more successful--we need people 
to utilize information technology broadly. That is not going to 
happen unless people trust information technology. And so we 
need to accomplish that.
    Second, September 11. September 11 taught is we need to 
worry not just about the foreseeable, but also the 
unforeseeable.
    And third, and this is a point related to what was just 
talking about: social responsibility. With market share comes 
responsibility. And we as large and important corporations have 
a responsibility to look towards protecting the security and 
privacy of our customers.
    Mr. Thornberry. Thank you very much.
    Thank you. Chairman Cox.
    Mr. Cox. Thank you, Mr. Chairman.
    I want to thank this panel for being exceptionally 
educational and for your willingness to devote some careful 
thought into providing your fair testimony even before you got 
here and, of course, for your years of experience that enabled 
you to do that.
    And I want to thank the chairman and the ranking member for 
organizing this particular focus on cybersecurity. As members 
of the panel know, in organizing this Committee on Homeland 
Security, and indeed, in organizing the Department of Homeland 
Security last year, the Congress had it in mind to pay 
particular attention to our information infrastructure. And 
this subcommittee is the only subcommittee in either the House 
or the Senate devoted to cybersecurity.
    I make the point because so much of our focus on what we 
now call homeland security, on fighting terror, is really 
coming to grips with technology, whereas in the 20th century, 
only nation states could pose WMD threats to us; in the late 
20th century, we found that such dirt-poor nations as North 
Korea could pose similar threats. And now we are finding that 
terrorist bans, and ultimately I am sure we will come to the 
conclusion in the 21st century, that individuals will find 
their own capacity to harm civilization levered by psychology 
in the same way that this technology is improving our 
productivity in all other peaceful aspects of our existence.
    And so I want to make sure that as we organize the 
Department of Homeland Security, we are focused not just on, 
for example, the Internet the way we know it today but on where 
this technology is headed, because 10 years ago if we would had 
this hearing and asked these questions with all that time to 
prepare, we still couldn't have prepared ourselves because so 
much of what we have today was unknowable at the time. And we 
want to make sure that in the future we are nimble.
    So in matching the strengths and weaknesses of the federal 
government, which we have all agreed today need to be a partner 
in this venture with those of the private sector, I find that 
one of the federal government's characteristics is extremely 
troubling. And that is that it tends to be ponderous and 
sluggish in its movements in developing regulations or in 
implementing its policies. Whereas what typifies not only the 
private sector but, in specific, the technology industry is 
lightning quick ability to change. And this change is going on 
all around us, not just our nation, but around the world.
    And so, my question is as we have gone from, for example, 
code red 2 years ago to slammer this year and we have got our 
reaction time to a matter of minutes, and we may be looking at 
even seconds, when what you are asking the federal government 
to do is help post best practices, how do we deal with the fact 
that it might take too long for the federal government to be 
the clearinghouse for this information?
    And anyone who wants to jump at that is welcome to do so 
because you are all expert in this.
    Mr. Diffie. Well, I will take a brief crack at it and say I 
think that the federal government should not be apologetic for 
being ponderous and slow. It is running the largest enterprise 
in the world. And I don't think if we look at the record that 
we would see, in cases where it is active in haste, it has 
necessarily acted very wisely.
    I think the important thing in here is that there are long-
term principles. Federal legislation must recognize the 
principles, speak to the principles, speak to provision of 
resources, and certainly weave the rapid reaction much further 
down the chain from Congress, perhaps to parts of federal 
agencies and to industry and individuals.
    Mr. Cox. Well, that certainly reflects my views, 
particularly when it comes to writing legislation. I want to be 
sure as a norm here in Congress that we try not to write 
technology into the law, because ultimately the lawyers will 
then make sure that in order to comply with the law, you 
maintain the technology that is written in the statute.
    And that will be a very, very bad world indeed. And so, I 
think your recommendation is getting us on the right track. I 
would be happy to hear further.
    Mr. Ianna. Yes, I think the answer to that question or a 
answer to that question is there are many solutions to a 
problem of sharing information. For example, the Telecom ISAC, 
we have to be very comfortable with that one. It has been a 
good government/industry partnership.
    I think the thing that we could be ponderous on is that 
there are many good solutions, and deciding which is the right 
one, we spend too much time on. I think they are all about 80 
percent right.
    And I think we need to spend more time on taking a good 
example of what works and then applying that to other 
industries not and worry about not making the right solution, 
but making the solution right, and leave the quick, rapid 
response to an ISAC or to an information sharing way lower down 
in the chain, but get the people and the participants 
participating in that very quickly and define what you want to 
protect and how you want to define your measure of success very 
quickly.
    And just say, for example, if you are protecting water, 
what is our critical systems that we want to have? What is the 
level of cybersecurity we need around those? Let the industry 
participate in that. And then, further down the chain, let them 
go implement those solutions.
    And then you will have to continuously look at it, because 
threats will change, lots of things will change, networks will 
change, but you will have a history, then, of are we getting 
better or are we getting worse? And that is the key.
    Mr. Thornberry. Mr. Reitinger?
    Mr. Reitinger. Just briefly, chairman, thank you.
    I think that this is a--cybersecurity is a network problem 
much like the Internet, and requires a network response. The 
government has some very important nodes on that network, with 
some strengths and weaknesses, and probably needs to 
concentrate on the things it does well and must do, as Whit was 
saying before.
    Within DHS, I think it needs to concentrate on three 
things: people, process and technology. And I think of those 
three, they are all important, just to expand a little on 
process. There are a lot of government business processes that 
are no longer well suited to protecting homeland security in a 
new environment. And DHS needs to lead that transition and 
incentivize--I know it is a private sector word--but 
incentivize that transition within government for processes 
that effectively protect homeland and national security.
    Mr. Cox. I thank you, Mr. Chairman. My time has expired.
    Mr. Thornberry. I thank the Chairman.
    Ms. Christensen?
    Mrs. Christensen. Thank you, Mr. Chairman. I want to 
welcome the panelists. We have had some briefings on 
cybersecurity that left us a lot less hopeful than informed 
than the information you have provided for us today.
    I want to begin by asking Mr. Adelson a question. Putting 
what you do in the perspective of first responders is very 
helpful. And communications, steps in information management, 
is an issue for all of the first responders, the fire, police, 
everyone. Is this a part of the ongoing dialogue that the 
private sector is having with the federal government? And do 
you have any recommendations as to what this committee can do 
to better make that more efficient so that you can respond in a 
timely manner?
    Mr. Adelson. Sure, I believe that there is a lot of 
learning going on right now, and I should stress that we are in 
the initial stages of determining where the threshold should be 
in information sharing. Information sharing being the critical 
component, as you have said, as an exchange point operators 
seen the communication problems that go on between network and 
service providers and vendors in government today, we know that 
it is a monumental task and should be approached very 
carefully.
    Classic example of this is the Freedom of Information Act 
provisions that really must be preserved to protect network 
service providers so that they can freely share that 
information with government without concerns.
    And I feel that that is one example of a number of areas 
where really we have to understand the full scope of what is at 
stake for network service provider before engaging in any kind 
of formal process.
    But I am encouraged by the process that is happened so far 
on the standards and suggestions that I have seen.
    Mrs. Christensen. You raise the trusted environment again. 
And that is really critical between the private--between 
private industry and between private industry and government. 
Are there recommendations from any of the panelists as what 
this committee can do to foster that trusted environment so 
that the communications can flow as it needs to flow?
    Mr. Ianna. The trusted environment can exist in a 
government-private partnership. We have seen it work in the 
telecommunications environment. We are concerned about sending 
lots of information to not only one place, but multiple places 
to then have it become public, which may not be in our best 
interests.
    The other thing, I think, that is really important is to 
get to the level of protection that I think we all want. A 
macroanalysis of vulnerabilities will not get you there, in my 
opinion. You have to get to the microanalysis of each and every 
industry and network.
    An example that I give is I could create a network for a 
large bank out of AT&T services, SBC services, Microsoft 
services, Equinix services, et cetera. And that could be very, 
very physically secure and very logically secure. I could take 
the same bank and the same four vendors and create a network 
that is not physically secure and not logically secure, just by 
putting the parts together differently or having absence of 
pieces.
    So a macroanalysis does not get you there. It is a 
microanalysis, and it has to be done at the industry and at the 
entity level. A lot of the components to create very secure, 
cyber secure, and very physically secure networks are there 
already. And a macroanalysis of this may not get you there. It 
has to get down to the, I believe, the individual network 
level.
    Mrs. Christensen. Well, maybe I can--I don't see anyone 
else jumping to answer, so I will ask my last question.
    The government and the private sector have been 
collaborating and discussing security before the creation of 
the Department of Homeland Security. Has there been good 
continuity in that collaboration? Has it improved? Has the 
creation of the department, bringing all of the different parts 
under one umbrella, has it become more cumbersome? Has this 
dialogue between the private sector and the government improved 
since the Department of Homeland Security over these issues? Or 
is it more complicated because of all of the different pieces 
coming under this one umbrella?
    Mr. Adelson. Well, I will say that my experiences before 
the Department of Homeland Security, while encouraging that 
there were efforts underway, we are, you know, minimally 
exposed to. Part of it is because, you know, we were focused on 
our customers and we didn't have the resources to have someone 
here in this environment at all times to interact with 
government.
    One of the components of DHS which was encouraging for us 
was they were reaching out. And for the first time we were 
hearing from government with a request to learn. Like this 
hearing today is a great example of that. So I think we are 
headed in the right direction.
    Mr. Ianna. I would just like to say that as part of this, 
many state governments have done something similar. And 
certainly, from a response request and the amount of effort 
that you have to put into it, and the vulnerability of 
information and create a few lists in 51 places, as opposed to 
one place, also. I would like to see more coordination and 
templating amongst the states to the federal level also. I 
think that would be very helpful.
    Mrs. Christensen. Thank you.
    Thank you, Mr. Chairman.
    Mr. Thornberry. Thank you.
    Vice chairman of the subcommittee, Mr. Sessions?
    Mr. Sessions. Thank you, Mr. Chairman.
    I am sorry to have skipped back and forth, but I heard the 
testimony from Mr. Diffie, and I heard you talk about standards 
by the government. I heard, certainly, Mr. Ianna talk about 
government standards that would be good for us to development. 
And part of the dialogue and discussions then that Dr. Lowery 
was the CIS.
    The question I have got for anyone on the panel is is there 
any consensus on a best practice?
    Mr. Ianna, I just heard you say you could develop a secure 
network that would be great. And depending on how you put the 
pieces of the puzzle together, it may or may not be secure 
using even the same vendors.
    Is there a best practices model out there that should be 
looked at, sanctioned, if not by some government entity, by I 
think they are called CIS? Is there something out there today 
that says this is the most secure way that we know of today to 
develop the architecture? Or would everything just be so robust 
you would have to literally pay somebody thousands of dollars 
to come and piece, part it for you? How difficult is that? And 
does the government follow a model, from what you can tell, as 
related to whatever this business model may be? Anybody?
    Mr. Ianna. I will try a shot. There are best practices that 
industry participants have shared. The NRIC previously the NRC 
is a good example of that. As we came across failures and we 
analyzed failures, we figured out what do people do? And what 
do people do well and what do people do not so well, or 
companies within that? And we created best practices and we 
shared them. And we are doing that right now in NRIC 6 at the 
physical level and at the cyber level.
    But to paint the entire problem, I believe, with one set of 
best practices, I would just urge that we don't fall into the 
trap. For example, a best practice for a financial application 
at a very high level transmitting, you know, hundreds of 
millions or billions of dollars in transactions may be one set 
of best practices.
    And somebody surfing the Web for information may be a 
totally different set of best practices with different levels 
of security, fire walls, et cetera.
    So I believe that best practices do exist in industries. I 
think we have some proof of it in the telcom industry. I can't 
speak for others. I think there are--power industry, for 
example, et cetera. But I don't know if there is one best 
practice that fits all sizes of all types of networks and 
applications that the government should sanction. I don't know 
if we should go that far.
    Mr. Sessions. Then, what would you say? Dr. Lowery, you 
might want to speak to this, but what would you then say, and 
your observations about the United States government, following 
these known best practices, how well do you think they do?
    Mr. Ianna. Well, that is a good point.
    The government is a very big customer. And it can drive 
some very big changes in the industry or practices in the 
industry just from its own purchasing power. So if the 
government decided, for certain networks, that it wanted these 
levels of cybersecurity, firewalling, anti-virus software, 
automatic updates, et cetera, it could drive that particular 
standard for that level of security because you have the 
purchase power of a large customer.
    Mr. Sessions. And how well do you think the government 
does?
    Mr. Ianna. I really can't paint that with one brush. I 
don't have an answer.
    Mr. Sessions. Good. There are examples of very, very good? 
Or do you enough about this to speak on this?
    Mr. Ianna. I probably don't know enough about it.
    Mr. Sessions. Okay. Thank you.
    Ms. Gau. If I may, I just wanted to pick up on one element 
that Mr. Ianna mentioned. And that was the auto updating.
    When you look at some of the organizations in the industry 
today that put out security standards, there are a number of 
them other than CIS. And they try to market it as a service. 
There are even security seal programs just like there are 
privacy seal programs where the industry is trying to take a 
self-regulatory approach to establishing a baseline level of 
security for certain applications.
    The problem is that as we have already said, security is an 
ongoing process and a moving target. And as part of any of 
these standards, as part of any potential piece of legislation, 
it needs to be auto updating. And there lies the dilemma.
    Mr. Sessions. I would love to see it stay away from 
legislation, but to be able to say there is some standards body 
that we believe enunciates the best practices and becomes a 
model. And somebody talked about this. I think that that could 
be a way to highlight someone. And I think that is the best way 
that we ought to pat somebody on the back but not with rules 
and regulations.
    Dr. Lowery, did you have a comment or someone else?
    Dr. Lowery. Just wanted to expand on the Center for 
Internet Security and also what has already been said, just to 
expand on that somewhat, that security is not one-size-fits-
all. There are best practices, though, which are broadly 
applicable. And the Center for Internet Security benchmark 
level one is intended to be that kind of best practice.
    They also have level two benchmarks, which are much more 
rigorous. And then you could also turn to individual companies 
and the products that they provide, and they can give you also 
their recommendations on how to best secure their products. So 
you look at the situation in which the technology is going to 
be deployed. You adopt best practices, which everyone has 
already agreed these are good ideas, and then you specifically 
tailor the security for your environment.
    Mr. Diffie. So let me speak to two aspects of what you have 
said. One is that the question you are asking about how well 
the government has done is really one in my mind that if in 
need of objective measurement, that is to say, I think, that it 
would behoove the government to just go through, make provision 
for assessing the security in operations of the computer 
systems its using.
    And then, asking about each individual sort of product and 
installation configuration, should we have been doing this. 
Should we continue to buy more things of this kind from the 
spender, whatever? A reactive--an energetic, a due diligence 
customer approach.
    The other point is it is the most critical thing in 
security in many ways, is a realistic vision of the threats. 
And we have before in Washington seen the impact of unrealistic 
visions in both directions, one of which is not to worry about 
it, and the other of which, particularly during the Cold War, 
is to let us security enthusiasts, and I have--though were many 
in the federal government, get in a position to try to push, in 
this case, civilian agencies to meet various kinds of military 
standards that merely cost a lot of money.
    And because there was a general--not an inevitable, but a 
general antagonism between security and flexibility, you must 
be very careful about how you impose practices and security 
standards on agencies so as not to interfere with their getting 
of their work done, which is the primary thing.
    Mr. Reitinger. Briefly, Congressman, to re-emphasize what 
Dr. Lowery said, there is no one-size-fits-all solution. Anyone 
taking a particular configuration of the system, for example, 
needs to take a look and see whether that meets their 
particular environment.
    But one additional point, one thing that can be done, and 
something that Congress did last year was pass a management 
framework for information security in the federal government as 
a part of FISMA. So that is not a one-size-fits-all, that is 
actually a management framework that addresses security in 
federal government systems.
    Mr. Adelson. You asked a specific question about whether 
best practice could secure, and I just wanted to point out best 
practices are important, but there are still a lot of research 
that needs to be done at the industry level to fully secure 
vulnerabilities that we have exposed over the course of the 
next few years in the infrastructure, and we can't just leave 
that. Federal government could help with funding of research, 
for example, to help us get us there.
    Mr. Sessions. I thank the panel.
    Thank you, Chairman.
    Mr. Thornberry. I thank the gentleman. And I might mention 
next week this subcommittee is having a hearing trying to focus 
on the research and development ahead and what those needs are 
and how those resources ought to be directed. And so, I think 
the gentleman makes a good point.
    The gentlelady from California, Ms. Sanchez?
    Ms. Sanchez. Thank you, Mr. Chairman. I have some specific 
questions for--and so, I will call out the names when I come to 
the question for you all.
    I just want to say thanks for having me, Mr. Chairman, and 
I know I have learned quite a bit.
    I am a member from California, and I represent Orange 
County, which has a pretty good information and high-tech 
community. So I have been working with some of my colleagues, 
like Anna Eshoo and Zoe Lofgren and others on some of these 
issues like encryption and everything over the years. But I 
mean, this is just such a large area for us to try to focus on. 
I really appreciate all of you being here today for it.
    Mr. Reitinger, even if an underlying operating system is 
considered secure, can programs running on that platform still 
cause problems like spreading viruses or attacking other 
systems? And if that is the case, would we need to security 
check every piece of software that we run?
    And if we do that, do you foresee proprietary problems if 
its necessary to check source codes of all programs, for 
example, for security holes, embedded viruses and other issues?
    Mr. Reitinger. Certainly, applications as well as operating 
systems can have vulnerabilities and can pose difficulties. I 
think what is essential is to use software that is developed by 
companies that use a robust quality assurance or software 
assurance process where they, in the course of development do--
use trained developers, track their source code, do code 
reviews, do external third-party reviews, do penetration 
testing and seek external certification, such as the common 
criteria, for their products.
    And I think that provides a fair amount of assurance that 
the products are as secure as they can be under the 
circumstances.
    Ms. Sanchez. Thank you.
    Mr. Diffie, you say that the latest encryption standard is 
as secure as you need to be. And I was just discussing with Ms. 
Lofgren where we were with encryption, because we have been 
working on this for awhile. I know it is a regulatory process 
now, and we seem to have an ability to move encryption 
standard, if you will. Can you explain what you meant by as 
secure as we need to be at this point?
    Mr. Diffie. I apologize--I don't think that was probably 
exactly the term I used. I think I said a secure as one could 
want. And what I meant precisely is that when the data 
encryption standard was fielded 25 years ago, it had to give, 
getting into technicalities, a 56-bit key, about a billion 
billion possible keys.
    And that number was chosen, at the time, to be a compromise 
between the desires of the intelligence community and the 
perceived security needs of civilian government.
    The advanced encryption standard offers three different key 
lengths: 128, 192 and 256. And as far as my community, the open 
cryptographic community can tell, and as far as we understand 
from NSA, what they believe, we do not know how to break into 
AES encryption at any of those key lengths faster than just 
looking through the keys. That is infeasible at all three of 
those lengths.
    And so to take the words of the preface to an old Soviet 
encryption standard, this algorithm places no limitation on the 
security of the data to be protected.
    So that is exactly what I meant, that the intent here and 
what we observe in the public community and what NSA tells us 
all accord in saying that this is as secure as any 
cryptographic algorithm we know of.
    Ms. Sanchez. Thank you. I hadn't quite heard it put that 
way so thank you for your information on that.
    Dr. Lowery, you talked about a partnership between the 
vendors and the customers. Vendors provide security-minded 
products, and customers make sure that they have proper 
security settings. I am concerned about the customer who might 
not know how to keep things secure or inadvertently creates 
problems within the system. Can you elaborate on the 
responsibilities that you think we would like to see customers 
take on with respect to security?
    And how do we, as a government, encourage that? Because, 
you know, we are as secure as our weakest link and it could be 
one of these users.
    Dr. Lowery. I think one of the most important things you 
can do is to educate end users, not about technical aspects of 
security, but simply about the role that they play as 
individuals, as gatekeepers, into a larger community of data 
sharing and information sharing.
    If we could get the end users to understand that as a 
participant in e-mail, for example, simply opening an 
attachment has ramifications that not only affects them, but 
could affect others. Just an awareness of their ability to 
impact others through how they use these technologies could go 
a long way to improving security for everyone who participates 
in these systems.
    Ms. Sanchez. Thank you.
    I see that my time is up. I have some other questions, but 
I will submit them for the record, Mr. Chairman.
    Thank you, gentlemen and--
    Mr. Thornberry. The Chair thanks the gentlelady.
    The gentlelady from Texas, Ms. Jackson Lee.
    Ms. Jackson Lee. Thank you very much, Mr. Chairman. And 
thank you and the ranking member for holding this important 
hearing.
    To the panelists, thank you for your presentation and your 
indulgence on members who have several hearings going on at 
once.
    Let me take personal privilege and express my appreciation 
that Dell is still in Texas, in Austin, Texas. We are gratified 
for that. And to thank AOL Time Warner for being one of the 
first groups to host members of Congress out into the Virginia 
location. I think that is prior to the merger, but we thank you 
very much. This is an important issue.
    The bell is ringing, I believe, so let me quickly comment.
    Mr. Thornberry. If the gentlelady would yield briefly?
    The Chair's intention is to go until we have about 7 or 8 
minutes left in this vote. My understanding is we have two 
votes. And then I would like to come back. Hopefully, we would 
be gone no more than 15 minutes, and then we could resume. And 
so that is my intention.
    Thank the gentlelady.
    Ms. Jackson Lee. In an article, and the date is a little 
fuzzy, so I will just refer to the article, talks about the 
administration abolishing the high-level Critical 
Infrastructure Protection Board and the fuzziness of the 
administration's position on cybersecurity. And I would be 
interesting in your assessment on what the sense of the 
industry is with respect to where government is on 
cybersecurity particularly in the loss of Richard Clarke, who 
was a very visible government person on these issues and the 
fact that this board now has been recomprised in DHS with a lot 
lower profile and staffing, if you are familiar with that 
particular board.
    But that was the board that had the face of the 
administration, and that is the Critical Infrastructure 
Protection Board that generated after the turn of the century 
and of course, after 9/11.
    My question is what can we do in government as relates to 
cybersecurity? And I ask these questions. Do we need more 
information sharing? Do we need more firewalling? And do we 
need a best practices? And in your opinion, what are the three 
things that the government may need to do immediately to 
improve cybersecurity? If you want to point it at the 
department or point it at this select committee because we are 
supposed to be the fixer-up-it in terms of trying to find 
solutions.
    I would appreciate your response to that, whoever wants to 
jump in. Or we could start--we will start in that direction, 
yes.
    Ms. Gau. Thank you. I appreciate you reference to the 
former Critical Infrastructure Protection Board and Richard 
Clarke, whom I worked with quite closely, with him and his 
staff on the national strategy that came out. One of the things 
I have noticed is that there has been little reference, other 
than my own, to the national strategy to secure cyberspace. And 
although there are critics of the document that say it is too 
watered down and that it does not really lay out 
responsibilities, it simply makes recommendations.
    It nonetheless serves as a blueprint. And there are 
detailed actions and recommendations outlined in that document 
that address all of the issues we have been discussing today.
    One of my recommendations would be to indeed look at that 
document, engage more actively in pursuing the actions and 
recommendations in the document, and to look towards perhaps 
elevating the level of attention that the national 
cybersecurity division has right now.
    My personal experience and AOL's experience has been that 
when that board existed and Richard Clarke was in place, we had 
a much more active relationship with the White House on 
cybersecurity than we do now.
    And whether or not the placement of the national 
cybersecurity division within DHS is the appropriate location 
is not something that I believe I am qualified to speak to. But 
we would like to see a similar level of attention and priority 
given to the issue of cybersecurity.
    Ms. Jackson Lee. One of the points you mentioned was 
firewalling versus information sharing. And let me just say 
that security is an almost unlimited excuse for keeping things 
secret. And very often in the short run that is the right thing 
to do. But I think it should be recognized that secrecy in 
regard to security matters should always be thought of as a 
vulnerability. Because no matter how hard you are trying to 
keep a secret, your opponents might discover it. And the ideal 
security systems are ones that operate in a very open 
environment, and do not depend on secrecy about themselves.
    So I want to say that although we in industry very often 
have a parochial interest in the government helping us keep 
secrets about how our products work, about what our 
vulnerabilities have been, that the long-run interest of 
government is probably in promoting and requiring greater 
openness.
    Ms. Jackson Lee. Can I get one person to answer the 
question, what the government needs to do right now in 
cybersecurity--just one person, and then?
    Mr. Adelson. I will say--
    Ms. Jackson Lee. I appreciate it.
    Mr. Adelson. --promote the Department of Homeland Security 
as the epicenter of information sharing for industry and 
federal, state and local government--number one.
    Number two, preserve the federal information act 
protections and the Critical Infrastructure Information Act.
    Number three, consider funding for outreach to promote the 
sharing, research and development of security and testing.
    I just want to say that that is an introduction. Right? But 
that is the immediate thing that could see support for, those 
three things would be critical right now.
    Ms. Jackson Lee. Anyone else?
    Mr. Ianna. Just to echo that, there are some examples of 
ISACs that I believe are working well. I could speak for mine 
in telecommunications industry ISAC as well as the Network 
Reliability Council sponsored by the FCC. We see effective 
partnerships between the government and the private sector, 
particularly where the government is funding part of the 
infrastructure, which I believe is important, which the other 
ISACs may not be experiencing. That might be a good model to 
move to those other ISACs.
    Ms. Jackson Lee. You think it needs to be elevated in the 
Department of Homeland Security from where it is now?
    Mr. Ianna. I can't say that. I just say that there is an 
effective--it seems to be, from my perspective in this 
industry, an effective model in Homeland Security right now, in 
telecom ISAC.
    If the other ISACs are struggling--and I don't know if they 
are--with information sharing, maybe a funding, a government 
funding of some of those ISACs would be helpful.
    Ms. Jackson Lee. Does anyone believe it should be elevated 
from where it is in the Department of Homeland Security to a 
higher presence, this whole idea of cybersecurity?
    Mr. Diffie. I am willing to say yes, but I think that is 
something to give a considered answer would require a bit of 
study of what is actually being done, organization of the 
department.
    Ms. Jackson Lee. Did you have a response, sir?
    Mr. Reitinger. I would say that I think cybersecurity is a 
critical issue. I think one reaches a point where 
reorganizations become harmful rather than helpful.
    What we are interested now is seeing action and working 
with the department to make it as productive and effective as 
possible.
    Ms. Jackson Lee. Thank you.
    Mr. Thornberry. The Chair thanks the gentlelady.
    As I mentioned, we have two votes, and my intention is to 
be back in about 15 minutes to continue this hearing.
    Again, I thank all of our witnesses for their patience.
    And we will resume shortly.
    The subcommittee stands in recess.
    [Recess.]
    Mr. Thornberry. The subcommittee will resume its setting. 
Obviously, other members are going to be coming back after the 
vote.
    And again, I thank the witnesses for their patience.
    Let me ask about a couple of areas as members are coming 
back. One of the things that I am struck by in each of your 
testimony today is a somewhat different tone from some of the 
testimony we received before.
    In some of our previous meetings and hearings, there is a 
feeling that the advantage lies with the cyber attacker, that 
the advances in technology are really working to the advantage 
of the people who are trying to break into systems and find out 
things, and that our response is lagging further and further 
behind, and for a variety of reasons, which they have 
enumerated. And it is a somewhat pessimistic view of our 
country's ability to protect against particularly sophisticated 
sorts of attacks.
    I would be interested in that larger sense from what you 
all see in your business dealings every day, whether you share 
that view of and concern that attacks are growing exponentially 
both in number and in sophistication. And that it is going to 
be very difficult for us to stay ahead of the bad guys, if you 
will.
    Mr. Diffie?
    Mr. Diffie. Well, let me suggest to start with that we are 
ahead. Our economy, I know, is not as its best at this instant, 
but fundamentally, it is a great, thriving, robust institution. 
Our society, likewise. So a lot of the way you view this issue 
of how many attacks there are how sophisticated they are, how 
much damage they did you is really just a matter of setting 
thresholds, which are going to come out very emotional, because 
loosely speaking, any level of attack is irritating to us.
    And I would be very skeptical that on balance development 
and cyber attacks so far could actually be said to have slowed 
our society down very much.
    Moving to a slightly more technical level, I would say that 
we have unquestionably made major achievements in some areas of 
security, which, if adequately widely deployed, would put an 
end to many of these things. And so, this again comes down 
almost to a matter of definition. When you are trying to 
protect, you are trying to protect the whole curtain wall of 
your fortress. And somebody who punches any hole through it 
gets credit. So we will probably always be chafing at the 
number of cases in which we failed.
    But I think that if you look at the overall development, 
and not just of security techniques, but of computer software. 
You will find it is far more robust, far more reliable, far 
more resistant to attack today fundamentally than it used to 
be.
    The difficulty comes out of the degree to which this is a 
dual-use technology. And the technology is in the hands of a 
wide diversity of people, some of whom don't have our best 
interests at heart. What worries me maybe most in planning 
about this is that we think of it a lot as cyber crime and as a 
cyber nuisance.
    And that as so far, we have not seen any 9/11-like, let 
alone a nuclear bombing-like attack on the United States by 
cyber methods.
    I believe it is still a matter of speculation whether that 
could by itself be comparable in damage. When you look at our 
own military doctrine, we use cyber warfare conjoined with 
physical warfare.
    But the thing that worries me is that we are not making 
sufficient preparation for protecting ourself against cyber 
attack by what I think of as real enemies, enemies who have 
assets outside the United States, outside the control and to 
some degree outside the retribution of the United States, who 
can develop and cook their attacks long enough that they will 
be really dangerous when they happen.
    Mr. Reitinger. I would just reiterate, Mr. Chairman, that I 
am equally positive about what industry can and will 
accomplish. I think the priority has changed.
    One area that we do have to attack is the issue that has 
come up a number of times of information sharing. Sadly, 
hackers are still better at sharing information than perhaps we 
in government and industry are. They are great at describing 
vulnerabilities in systems and building wonderful GUI-based 
attack tools to use. We need to share information to that same 
level.
    But I remain very positive that government and industry 
working together and industry innovating will achieve new and 
better security solutions. And we are actually better off and 
we are getting better off over time.
    Dr. Lowery. Mr. Chairman, I would add to that that a 
pessimistic or defeatist attitude is not warranted. We have a 
very positive outlook on this as well. There are really no 
technical reasons that we should be less secure than we are 
perceived to be.
    Again, I point back to education as a prime component of 
this. That many of the problems that continue to arise, this 
lag that you may be perceiving is really a gap in education, 
which we could rectify if we put resources behind educating 
those who are using the technology so they use it in a more 
responsible manner.
    Mr. Thornberry. And Ms. Gau?
    Ms. Gau. With respect to AOL suffering a debilitating 
cyber-attack, I would be optimistic in saying that I don't 
believe it could happen. However, let me just say that AOL is 
attacked by hackers on a daily basis. We see all forms, all 
varieties and all numbers of hacker attacks. And they have 
increased and varied in techniques over the years. And as a 
result, not only have we had to invest money into the systems 
that we have in place to monitor the network, but also the 
staff that we have in place to be there. We have also had to 
make sure that we are eternally vigilant about these issues.
    And to the extent that we remain vigilant and that we use 
the security technology that is available today, I believe we 
are in a good position. However, there is still the human 
element. The human element being the weakest link. And there, 
again to reiterate education, it is not only on a public 
awareness level, but it is also making sure employees are 
trained, that they understand what are the steps that they need 
to take.
    Mr. Thornberry. And I want pursue the education issue in 
just a second. Just real briefly, are you finding it more 
difficult to stay ahead of the hackers? I mean, you said you 
are putting more resources into it, is it becoming increasingly 
difficult to stay a step or two ahead?
    Ms. Gau. I would not characterize it as being more 
difficult, no.
    Mr. Thornberry. Okay, that is helpful.
    Gentleman from New Jersey, Mr. Andrews?
    Mr. Andrews. Thank you.
    I would like to thank the witnesses for their outstanding 
work and testimony today.
    Thank the chairman and the ranking member for another in a 
series of truly edifying and challenging hearings. Thank you 
for your work.
    I want to go back to the question the chairman raised at 
the beginning of the questions here because I think it is the 
central focus that we have. He asked whether the panel thought 
that the market alone would bring us to a sufficient point of 
security or whether there was a point beyond that. And I think 
I heard the consensus was that although the market would take 
us a very long way indeed that there was an increment of 
security above and beyond what the market would do.
    The second point of consensus that I am hearing is that one 
of the ways, one of the most effective ways the government can 
help us stretch the market, stretch the market solutions is 
through the creative use of our purchasing power as a customer 
that demands these products.
    The third thing that I am hearing a point of consensus is 
that that purchasing power must be carefully calibrated and 
distinguished among various sectors. What the Agriculture 
Department would buy would be something very different than 
what the Defense Department would buy. That it needs to be 
continuously upgraded. A theme that I am hearing from the 
panel, and really from the members, is that if we have a static 
standard of what is sufficient that you are all going to leave 
us behind in the dust, at least I hope you will if that is the 
case.
    And the final point of consensus that I am hearing is 
that--I think I am hearing is that we need to do a surgical and 
thoughtful job of articulating what those standards ought to 
be. We shouldn't haphazardly define the standards.
    What I would like to ask the panel is if I have misstated 
any point of consensus here, please tell me. And I say that 
without pride of authorship, I am simply reporting what I think 
I hear, number one. And number two, if it was your job to 
design the standard-setting function within the Department of 
Homeland Security and within the U.S. government generally, 
what would that institution look like? What kind of institution 
would it be that would tell our purchasing people what it is 
they should demand when they buy a system that protects the 
Social Security Administration's record? Or when they buy a 
system that protects the troop deployment databases of the 
Marines Corps? Or whatever else.
    And we will start with our friend from AOL at the right 
side.
    I, just parenthetically, my last name begins with 'A' and 
in law school a lot of professors call on students in 
alphabetical order. It is a very harrowing experience. So when 
I taught law school, I start at the other end of the alphabet 
so I wanted the people at the other end to get their just 
deserts. So because you have had to wait so often today, we 
will start at your end.
    Ms. Gau. Picking the latter part of your question with 
respect to what would an institution look like that might set 
security standards for the government, I think that the model 
of everything we are talking about where it would be an 
institution that would work closely with the private sector 
together, as we all hope to do, with Department of Homeland 
Security. That there would have to be dialogue to establish 
what the baseline security standards would be.
    And such an institution, presumably, would have tentacles 
into procurement processes such that they could mandate the 
different standards, just as there are other standards such as 
those that I have referenced earlier today such as 
accessibility standards and products.
    Where it might best fit, I don't think I am really in a 
position to say either. But I think that such an attempt by the 
government to indeed mandate that as a customer and a consumer 
of these goods that government would move in the direction to 
push manufacturers and service providers to include the 
baseline security standards is a step in the right direction.
    Mr. Andrews. I want to be clear also, as I know you said, I 
am not talking about mandating standards on the private sector. 
I am talking about mandating our own internal standards for 
demanding product when we go into the private sector.
    Yes, sir.
    Mr. Ianna. I think the question has to be answered this 
way, what level of security do you want to be able to espouse? 
Do you have a metric to be able to easily convey to the public 
that we have raised the cyber-security level to this level? And 
we have to create that metric, just like we had to create the 
metric in network reliability.
    What are we talking about? We are talking about, you know, 
how many DPMs, defects per millions of failures you have and 
what constitutes a failure, et cetera.
    And then I think it has to be done on a--you can't eat this 
elephant all in one bite. You have to do it in small bites. And 
every sector needs to define, I believe, their critical systems 
that they need to have cyber-defense around. And once you have 
done that, do we have, for example, the critical systems cyber-
protected to this gold level in the Department of Agriculture 
or how long will it take us to get there.
    Then I think--if I were in the government, I would be 
trying to convey to people that we have a methodical way of 
convincing people that we know what we are doing. We know what 
direction we are going in. And we know how we are on our 
journey to get there.
    And secondly, lastly actually, it is not static. The minute 
somebody says I am protected to the gold level, a new threat 
comes in and the gold standard has to be redefined.
    Mr. Andrews. Sir?
    Mr. Adelson. I believe that that is the key is the dynamic 
nature. And perhaps one way to achieve a dynamic standard, if 
you--that is kind of a contradiction in terms, but--is to 
actually involve in real time, industry. And by real time, I 
mean having individuals who represent industry be part of a 
panel wherever this group sits in government, where they can 
provide that data and how it has changed in real time.
    And I suggest that just because industry, because of the 
market forces, is going to be thinking about that with a great 
degree of diligence. And I would expect that their message 
should be heeded, even across different sectors, as it applies 
to, you know, buying power within government.
    Mr. Andrews. I hear you. Boy, that would raise significant 
issues about protection of intellectual property. I mean, we 
want to do that, but we want to do it in a way that doesn't 
punish the private sector concern for participating in that, 
right?
    Mr. Adelson. I think there are certainly protections that 
can be put in place so that communication can happen. I can 
tell you that it is relatively rare, although it does occur, 
where, you know, data about an incident is something that I 
might fear being propagated.
    However, data about the security technology itself is 
really mostly, in terms of consumer products, you know, 
certainly the case, public data. And there is a lot out there 
which would go a long way. And certainly within the standards 
set, I would hope that these would be technologies that 
everyone can purchase.
    So there isn't a lot there to hide.
    Mr. Andrews. Thank you.
    Dr. Lowery. Congressman, I think you have accurately 
summarized at least what we believe at Dell. And as far as how 
I would structure this entity that you have referenced, I don't 
know that I would be an expert in helping you to architect such 
an organization. But things that you should consider when you 
are developing the standards for the government, consider what 
I said earlier and that is that there is a baseline of security 
which is just prudent for everyone to adhere to. And then each 
particular application of technology must be scrutinized in the 
context in which it will be used and security for that purpose 
needs to be customized for it accordingly.
    Mr. Andrews. Thank you.
    Sir?
    Mr. Diffie. I think that what we have to keep in mind is 
the breadth of the activity you are talking about. Government 
has a major movement in the last, say 20 years, to move to 
commercial off-the-shelf technology to support all its 
activities wherever it can, to narrow back the, you know, 
technical nuclear, the technical comsat with things. It all 
stems from going away with the national arsenal system 80 years 
ago.
    Second, all of this is in some sense dual-use technology in 
terms of the role it plays in cyber-crime and cyber-warfare and 
cyber-security. So you are building things out of standard 
components, components that people use for a very wide range of 
things in society.
    And finally, this is an international problem. We cannot 
afford, as we did during the Cold War, to think of our own 
security needs in isolation from those of our trading partners 
and indeed the rest of the world.
    So let me suggest that this organization, which is going to 
need to walk down the Potomac on its tiptoes, I am afraid, has 
to be a meeting ground with a prudent ability to manage 
information relations between quite a number of constituents. 
Its government customer--and I construe that broadly; the 
intelligence and law enforcement communities on which it will 
depend for a lot of the kinds of feedback information I have 
been talking about; the industry on which it will depend almost 
entirely for products and processes and support; and the 
international community, the international standards 
organizations and many different kinds of governmental and non-
governmental and industrial organizations throughout the world.
    So the best I can say is I am very in favor of openness in 
the standard-setting function. And that that should be 
specialized so the cases where closed things are needed, that 
we should give careful thought to the way the information-
restricted activities take place and be sure that that is 
subordinate to the general openness that will allow us to 
accommodate ourselves to everybody's needs.
    Mr. Andrews. Follows your principle that secrecy creates 
vulnerability as I think you said at the beginning.
    Mr. Diffie. Yes, actually, I think that actually this 
principle's a little broader than this. My view is this is 
infeasible without a lot of information-sharing that has been 
stifled in the past.
    Mr. Andrews. Yes, sir, thank you.
    Mr. Reitinger. I will be very brief, Congressman. First 
off, on standards, one suggestion I would have is that as, 
again, I am repeating a lot of what Whit is saying, that we 
avoid having specific government standards to the extent 
possible. I think if you rely on industry-based market-driven 
standards, you will find the government keeps more up to date 
than if it sets government-specific standards which will maybe 
become hoary in a shorter period of time.
    The second thing is that I think it would be useful to turn 
and see what is happening at NIST under some of the processes 
started under the Federal Information Security Management Act. 
NIST--I would have to go back and reread the act, but I know 
NIST recently published FIPS 199, which has a categorization of 
information and information systems into risk categories.
    My understanding is that under that last act, they are 
going to go on and produce guidelines for how to protect that 
information. And that might be a very valuable process for this 
committee to look at and watch.
    Mr. Andrews. Thank you very much.
    Thank you, Mr. Chairman.
    Mr. Thornberry. Thank the gentleman for, again, asking 
excellent questions.
    The ranking member of the full committee, the gentleman 
from Texas.
    Mr. Turner. Thank you, Mr. Chairman.
    First, I want to compliment you, Mr. Chairman and Ms. 
Lofgren, our ranking member, on your leadership in the area of 
cybersecurity. Those who have been a part of your hearings and 
your also compliment you on the leadership you are both 
providing in this important area.
    Dr. Lowery I want to compliment Dell for your leadership in 
providing or offering your Center of Internet Security Level I 
benchmark to your customers.
    There is no question that your business model selling 
directly to customers provides an excellent opportunity to 
promote the purchase of a secure computer system.
    I guess your interest in providing security arose out of 
the Department of Defense requirements. By then turning that 
into an offering to others with the stamp of approval of the 
Center for Internet Security, it seems to me that it should 
become something very quickly that most people would want to 
pay for.
    Dr. Lowery. We agree with that assessment too, Congressman. 
We were directed to CIS by federal customers, who pointed to 
the CIS as a source of best practices that they agreed with.
    We evaluated the CIS and their benchmark settings, and we 
heard that a product offering where we could make those 
settings in the factory was feasible, that we could do as our 
customer requested. We did that, and we got it in such a way 
that others can benefit from our work and the work of CIS.
    We are very excited about the offering. We hope that it 
will contribute to improving the security landscape as it 
exists.
    Mr. Turner. Well, I commend you for it. The issue before us 
and the same one raised by Congressman Andrews: How do we 
replicate this? As I understand it, there is a host of entities 
out there that say they certify or they recommend certain 
security measures. Every company, you know, is looking for 
somebody. Not everybody looks to the Center for Internet 
Security. Some look to other groups out there.
    If we want to accomplish what I think is the goal that most 
of us share--self regulation--wewant to be sure the industry 
provides the leadership on security initiatives.
    As has been pointed out, if government is the role of 
creating standards they will be outdated the moment that they 
are drafted.
    It is clear we need a viable ongoing effort among industry 
partners to set some standards.
    How would you suggest, Dr. Lowery, or any of the witnesses, 
that we decide on a consensus organization made up of that we 
would look to as the good housekeeping seal of approval, if you 
will, for security. We should have something so we would know 
that if it had that stamp of approval on it, then that was the 
best you could buy. As you all have said, if you don't want to 
buy such a certified approved product then that is you choice.
    At the very least we would have provided an industry-wide 
approved certification that is recognized by the buying public. 
Then we would encourage the buying public to make a choice. The 
reason I believe strongly that is the right way to go is I 
think security is on everybody's mind. I think this problem can 
be solved in this fashion voluntarily, if industry will work in 
cooperation with government we will have a standard-setting 
entity that everybody knows about and respects, and therefore, 
will follow.
    I know how it was in our house when we made our last 
computer purchase. We were thinking about security now. And I 
think most people are. I don't think any business in America 
wants to be caught short in not providing security to its 
business systems.
    The liability and the risk are too great.
    So how can we get there with a standard that people will 
follow?
    Dr. Lowery. I think everything you said is true. And I also 
perceive that there are a lot of little organizations, for lack 
of larger ones. Each of them are trying to make sense out of 
the security problem and have delivered into the spaces they 
perceive where there is a gap, what they call their standard or 
a consensus that they have arrived at.
    I think all of them are valuable. None of them should be 
belittled because their stuff often comes from small sector 
doing something.
    But I do also see the need for convergence, a consensus 
process. Dell would also welcome seeing a more consolidated 
approach to achieving the standards. The fewer standards that 
there are, the easier it is for us to bring them to market.
    The only caution that I would give you in trying to 
approach a singular standard or a single organization, which 
does that, is that organization must understand that security 
is not one side fits all. We had to be very careful in its 
deliberations and in standards that it might recommend. To keep 
that in mind, that we must be sure that security fits the 
situation, that it is going to be the deployable technology.
    As far as the way to actually achieve the convergence, I 
think we are seeing some of that already. I am not exactly sure 
what to recommend what we do to hasten the convergence.
    Mr. Turner. Anyone else?
    Mr. Diffie. Let me extend that not one but sole point as 
saying it is important to remember that security is always a 
secondary objective. You always want to do something and you 
want to do it securely. So having an underwriters lab like 
stamps that would go on everything happens to be particularly 
tricky in security, because security is more contextual 
probably more than the other safety technologies. And so 
although your car, of course, depends on how it is driven and 
how it is maintained, as well as how it was built, that kind of 
environmental characteristics are even more important in the 
security area.
    So I think that a labeling scheme, we already have several, 
is not going to be trivial to achieve.
    Mr. Reitinger. Two brief points, Congressman. First off, as 
you suggested, there are lots of good standards or other 
organizations out there developing things and certifying things 
such as the common criteria.
    Second, I have got some very good news, which is although 
one size does not fit all--I agree very much with that--it is 
important to have as much consistency as possible among 
different people providing advice to consumers.
    And so Microsoft, for example, is working closely with the 
Center for Internet Security to converge our guidance on how to 
secure our products going forward. That kind of activity is 
taking place in industry. We are talking amongst ourselves and 
we are trying to solve the problem. And I think we are solving 
the problem.
    Mr. Turner. Thank you. Thank you, Mr. Chairman.
    Mr. Thornberry. Let me delve--I thank the ranking member--
let me ask briefly about the information sharing, because a 
number--we have talked about it a lot and it has come up in 
different contexts. Mr. Ianna, you talked, I know, specifically 
about the telecom ISAC and it being successful. What I hear 
from others is that their ISACs are not nearly as successful as 
you have become. And you mentioned government funding being one 
of the things that is not the case with the others.
    And then I am also struck, Mr. Adelson, one of the comments 
you made is that we share information real well on a technical 
level, but what that leads me to think, Okay, where do we not 
share information real well? That is going to be for the areas 
that are competitive, the things that are not so technical. And 
so the view has been expressed that there is a limit to how far 
information sharing is ever going to reach.
    That when you are dealing with competitors and industry 
grouping, they are only going to go so far. And they will talk 
about FOIA, and then they will talk about anti-trust and then 
they will do something else that they talk about.
    Whatever it is, it is going to be an obstacle to--and I am 
not criticizing that, but it is a natural thing.
    I guess I am interested in observations--Mr. Ianna, I will 
start with you--about this subject of information sharing. Are 
there legitimate barriers that the federal government needs to 
break down? Or is it more a question of a trusting sort of 
relationship that has to develop over time, at least for 
industry to share information with the federal government?
    So you see ISACs as--I will say salvageable--some people 
say they are not, need to start from scratch. And if so, how do 
we make them? And I realize there are too many things to get 
into. But I would appreciate each of your suggestions on this 
information sharing idea.
    Mr. Ianna. Well, first of all, I think one of the other 
keys on the telecom ISAC and other structures surrounding 
that--I mention ENRIC--is beware their time. They have been in 
existence for quite some time. ENRIC goes back almost 11 years. 
I don't know when. Probably more than that. So there has been 
time when they worked together.
    Believe me, the first few years when we started ENRIC at 
NRC, we had the exact same thing. I can imagine that Microsoft 
and MCI and AT&T and Sprint saying we are all going to share 
our failures. All right, it was not easy, okay, number one. 
Number two, it came down to a situation that we realized that 
by very nature we were all interconnected. And we were all just 
interconnected. And the failures that we would see in one 
network might show up in another network because we all used 
similar types of equipment.
    And I think some of those--some of those--you know, we all 
use equipment from a set of vendors that might experience a 
failure. So want to be able to know what happened.
    And then I think that the next thing that we experienced 
was nobody likes to advertise a failure. And there was a lot of 
debate about, Well, when I have a failure, it is AT&T and can I 
ask AT&T?
    And we had this debate. And we started out as they were 
masking it. And finally, after a while, we just said, Okay, 
here they are, here are the failures. And last year AT&T had 
20-something FCC reports on this--had three. I know how many 
MCI had. I know how many Sprint had.
    But the good news of that, the good news of that is that we 
do have quarters, 40 quarters worth of statistically valid data 
on failures on wire line networks. Now the debate going on at 
the NRC is others saying, Look, wireless for data networks, et 
cetera, will be voluntary. We will map the data, et cetera.
    So I think there are ways of sharing the information. And I 
think what it all comes down to in the end is that we can 
improve the situation of the whole lot. There are competitive 
issues. We worried about anti-trust. We worried about 
information sharing and competitive things. And we had lawyers 
praying over that for a while. And we got past that.
    And I think the end result has been that we have listed--
now the FCC has sat in front of you, and you ask is the network 
reliable? Can it give you a number? Can you say it is getting 
better or worse? And they can break it down by quarter. And 
they can break it down by technology.
    So I think the answer is it does work. It takes time. It 
takes trust. And the other issue of information sharing that I 
know a lot of people--and I am worried about also is when we do 
share information, is the problem about sharing information 
from one competitive entity to another, which you don't want to 
have happen as a competitive concern, but then making that 
information then public.
    I think some of the protections that went into the Homeland 
Security Act around information protection are good and need to 
be enforced so that we don't have information getting pulled 
out under Freedom of Information Act, something that we have 
shared that we don't want to become public and also that 
doesn't become public.
    Mr. Adelson. There are a few points that we made that I 
would like to comment on. First, regarding the telecom ISAC, I 
absolutely agree that the telcom ISAC has worked for 
telecommunication-specific issues. But just using 9/11 as an 
example, during that crisis, there were between 25 and 50 
extremely large critical networks and service providers in the 
United States who did not get any contact and were not part of 
any telecom ISAC. That is one issue.
    Secondly, on recent research you could do on the Internet 
would point to over 13,000 independent entities that are 
relevant to Internet stability, even for the biggest carriers.
    To put an ISAC together for Internet infrastructure would 
require representation not only from network service providers 
anymore, but from content providers, enterprise and vendors. 
Why so diverse? It is a function of the hierarchy used to be a 
carrier sold to a content provider who provided services for a 
user and so on.
    Now it is much more of a level playing field. And those 
players need to be represented at a security level in 
discussing these issues. So I don't know how to do that with an 
ISAC with the Internet. That is one issue.
    Secondly, you mentioned the technical communication that is 
going on. The real difference between the Internet and other 
industry areas where that communication happens is that the 
Internet is extremely interdependent. My ability to stay up is 
dependent on my peer--is the term used--and their ability to 
stay up. And so, because of that interdependency, there has 
been a tendency to communicate.
    Furthermore, because security issues on the Internet are 
technical in nature, we have been fortunate in that most of the 
communication that is been required at least for disaster 
recovery are handled by technical people. I mean, there are 
exceptions, the provisioning side, for example, who somewhat 
separate from the technical. But there has been some industry 
success there.
    And I think as we expand beyond network to network 
communications and go into network and enterprise 
communications, this is where I see a central point of contact, 
a central group becoming really critical, 13,000, 50,000, 
however many entities require some critical information. I am 
not comfortable relying on the industry itself to provide that 
intercommunication well.
    Ms. Gau. Actually, you took one of the points I wanted to 
touch upon relating to information sharing and is there a 
competitive barrier to doing so. I think, once again here, we 
see the marketplace forces in action. As we are networks 
connected to networks connected to each other, and we are in 
the interdependent, even though we have points of redundancy.
    If AOL sees a hacker attack coming on, that we might be 
able to sustain, but we might know that somebody else might not 
be able to or in more, should we say, self-centered interests, 
we don't want anything bad to happen to anybody else because if 
they go down, we are going to get a ton of mail thrown back at 
us from their servers as an example of a denial of service 
attack back on us.
    So we are actually motivated not only to maintain the 
stability of the Internet and the ability of people, for 
example, to send e-mail to AOL, but also for us to be able to 
maintain our own service and not have to then deal with a 
situation where somebody else has gone down.
    Additionally, in that same regard, not only are we reaching 
out to individual providers and companies and partners that we 
have that we know are going to potentially be impacted by a 
particular attack or a particular vulnerability, we do share 
that information with government and we do so in an effort to 
ensure that that information is made available to the mom and 
pop ISP that may not be able to have access to that information 
because, as you have pointed out, they don't have the resources 
to have somebody sitting here at the table.
    That is where we would really strongly like to continue to 
work with the government, in particular, the Department of 
Homeland Security and the new cybersecurity division.
    Mr. Thornberry. Mr. Ianna, let me ask you one brief 
question. You mentioned, which is not something I had thought 
of much before the demands placed upon you from 50 different 
states for information, which is information sharing in a 
little different way. Do you think that there needs to be 
some--you mentioned a template which implies that the federal 
government would require certain information and the same sort 
of thing could be sent to the states.
    Do you think that there is a need for some sort of 
legislation that preempts states from asking for the same or 
additional information? You know, we did that with ARISA on 
insurance where the federal standard is the thing that, you 
know, trumps everything else. If you are--if all of you could 
get demands from lots of different jurisdictions which would be 
impossible to keep up with, it seems to me.
    Mr. Ianna. I don't--I can't speak to whether legislation at 
the federal level would be the best way to do it. I would say 
certainly, cooperation, or saying look, if we are going to have 
a standard, let us make the federal government the standard. 
And if I just need to parse out the data for this state, here 
is the data for that state.
    I don't know. I could go back and research, but after the 
FCC at the federal level in NRIC, or NRC, started asking for 
outage reports, several states followed with that. I don't know 
how many. I think it is probably more than a dozen or so about 
outages in their states and whether or not they followed the 
same rules, et cetera.
    But I think it would benefit the industry, only because of 
this--particularly in cyber defense, it is very hard to 
determine the geography of where the issue is and where it 
started. It might be impacting something in a particular state, 
but the cause might have been in a totally different state.
    So trying to define geographic boundaries in a cyber 
environment is not the same as trying to define physical 
boundaries against physical attacks.
    So from a cyber perspective, it certainly would be helpful 
to have a template or a focusing organization, like Department 
of Homeland Security, say let us do it this way. Let us do it 
once. And then we could give you your data, okay, that is, you 
know, for your state.
    Mr. Thornberry. I suspect in all areas of information 
sharing that differences between industries are a key thing. I 
mean, I can see a number of the things you all are talking 
about that require information sharing for the IT sector may 
not apply to electricity or agriculture, some of the other 
critical infrastructures which have been identified and may be 
the same case here. Depends on how much the states regulate, 
for example, electricity or telecommunications as to the 
leverage they have to put demands upon you for any information.
    Mr. Ianna. Just one other point that was made by the 
gentleman to my right about the telcom ISAC and the IT-ISAC. 
One of the things that we found out is because, particularly on 
data communications and computer-based Internet communications 
et cetera, the telcom ISAC and the information technology 
computer ISAC are twisted together very tightly.
    For example, with the slammer virus, our security people 
were not only working with the telcom ISAC, but also obviously 
with the IT-ISAC. It was the computers on the network that were 
causing the problem with the virus and that was impacting the 
networks. So they are very tightly twisted together. And you 
can't just look at one, they are very tightly twisted together.
    Mr. Thornberry. Good point.
    The gentlelady from California have additional questions?
    Ms. Lofgren. Just one. And I am mindful that you have been 
here a long time, and we certainly do appreciate it. I think 
really the information you have provided us, each of you today, 
has been enormously helpful. And we may want to follow up with 
you as we proceed with additional questions and ideas.
    But listening today, obviously, this is a complicated area. 
But it may be further complicated by constraints that are 
being--that we may face as we go down the road. I heard the 
comment relative to the lawyers praying over the anti-trust 
implications. That was a cute way to put it.
    Recently, we expanded the exemptions for anti-trust risk 
for entities that are setting open technical standards. And I 
think it is important that the openness be part of it. And I am 
wondering--this will be two questions--whether we have 
sufficiently addressed anti-trust concerns in the development 
of open standard setting in this arena?
    And then secondarily, I can't remember who, mentioned the 
issue of the need to be able to deploy solutions in ways that 
are not burdened by intellectual property protection and 
whether anyone has advice for us in that area as well, those 
two implications of IP as well as anti-trust.
    Do we need to change the law in any way?
    Mr. Diffie. Well, I am not sure. I think there are 
ramifications from the question I don't understand. But the 
intellectual property issue has come in here in two different 
ways. One is a fairly ordinary issue of things that are 
particularly--are patentable and therefore royalties are owing 
to the patent holders in turn for using that technology.
    The other is in this argument in the computer industry 
between open source and closed source coding practices. And 
that is one of the ones that I think presents a thorny problem 
because in security there is, as I said earlier, a very 
explicit respect in which closeness is a vulnerability. At the 
same time, proprietary techniques, trade secrets are an 
essential basis of our business practices in this country.
    So we need to find a business model that permits the users 
of products with security requirements and security 
implications to be able to verify that the products have the 
security characteristics they need. And to do this, to see if 
we can do this and still allow ourselves the benefits of 
allowing some manufacturers with proprietary techniques.
    I don't have a clearer statement of it than that. But I 
believe it actually is one of the research frontiers in this 
area and it is a business frontier.
    Ms. Lofgren. One of the--I mentioned to Chris Henkin a 
comment that--I won't mention the fellow's name, and I don't 
think there is a chance in the world that the federal 
government will do this, that it was recommended by the--
someone in law enforcement that we establish a kind of a 
software clearinghouse and that the federal government would 
clear, you know, all the software. I think that is a very bad 
idea.
    But the issue is how do we achieve assurance? Obviously, 
not with a government agency. But how do we do this, for lack 
of a better word, the audit function for the security? Whether 
it is software or networks or hardware, how is that best 
achieved? How do we set up a structure so that occurs?
    Mr. Reitinger. Congresswoman, I think my answer to that 
would be the one I gave when you asked a similar question 
earlier, which is making sure that the vendor that is providing 
the software has a robust software assurance and quality 
assurance process that the government can review and make a 
judgment upon. I think vendors are moving in that direction. A 
lot of them are there already. And I think it is important and 
valued for customers to know about that process.
    Mr. Diffie. So I would say in this respect we should look 
at the successes and failures of an existing model, which is 
that for decades the National Security has been the executive 
agent for information security for the Defense Department and 
some other areas of the U.S. government. And they have done, in 
many ways, a good job.
    On the other hand, the mechanisms they have, whose strength 
is in the, unfortunately, their unification of intelligence and 
security and their ability to trade off between the two and 
make use of their intelligence function in monitoring the 
security of their products.
    They show no sign of being able to cope with the problem 
that we face, for the following reason. The Defense Department 
is a very large organization, but it is very unified. Everyone 
in the Defense Department knows the chain of command, starting 
with the President down through the secretary of defense.
    And the important point about the Internet as a place is 
that so many people stand their by rights. You don't get to vet 
your personnel in the whole world.
    So we have an extraordinary diversity. And I think your 
suggestion is one of the major critical points. You can ask 
what the track record and what the development methodologies of 
your suppliers are. It is also true that there is an ever 
developing methodology in two directions. One is vetting 
individual applications, knowing that you are going to be able 
to minimize the damage they can do you.
    This, just incidentally, is one of the targets to which 
Java is devoted. The other is in building operating systems 
that have sufficient capacity to confine applications so that 
the applications can't do damage to other things.
    And this is one: The declining cost of hardware has allowed 
us to devote more and more hardware to that explicit objective. 
Sun's largest servers now have what is called hardware 
domaining, which is a very robust way of containing processes.
    So I think that the proposal that the federal government 
should vet all the software is on the face of it is infeasible 
whether or not?
    Ms. Lofgren. Well, it is a non-starter anyhow.
    Mr. Diffie. Whether it is desirable or not, it is perfectly 
infeasible. But that both the original 1970s, 1980s DOD 
objective of building an operating system that could maintain 
what the Soviets called praksa; prison laboratories, where they 
didn't have to trust the staff because they weren't going to 
let them go anywhere. Or at standpoint in Java we call sandbox 
or at the other end improving software development methodology, 
which will have a profound impact not only in security but 
through all of our economy. I think both of these things will 
play a role.
    Mr. Ianna. I think there are--as a service provider who 
uses a lot of these different types of hardware and software 
technology, either in the provision of service directly or the 
support systems that help us provision and maintain these 
services, we have a practice where we try to test the software 
in our laboratory and attempt--and I do use the word 
``attempt''--to simulate many of the conditions that we may 
find in the network before the software and the hardware is 
introduced into the network. It is called an integrated test 
network.
    Some vendors find that process very, very cumbersome. It 
does add time to our development process and our deployment of 
technology.
    But the alternative is to have software out there which may 
have an interaction with some other software out there which 
creates something that is very bad for your customers on your 
network.
    I would like to be able to say that we find every bug in 
every software issue that we have and we know of every 
interaction that is bad that can happen out there, that is not 
the case. But we do have--and we have shared practices in the 
telcom ISAC and, the NRIC, on ways of testing those things.
    By the way, it was interesting, at least what I was 
thinking about this issue, one of the interesting things here 
is we had a time in our recent history where we had to do this 
very quickly, because we didn't have all the time in the world, 
and that was for Y2K. We had a date certain that we had to do 
something.
    And we picked a way of doing it because we couldn't make 
all the permutations, so we shared a lot of information. And if 
I knew this software interacting with this switch with this 
operating system was okay by some other vendor's test, I 
accepted that and I shared my tests with somebody else too. 
Otherwise, you would have, you know, even if you took one 
second for every test in the 3 years, you wouldn't have been 
able to test all the permutations. And that worked extremely 
well.
    The difficulty we have in this situation is we don't have a 
date certain when something is going to happen. And we don't 
know--the thing that might happen is not defined and will 
change. And creating that sense of urgency around that I think 
is important for us at the government level and at the industry 
level to do that we must be cyber secure and we must take this 
very seriously. We do only because we have had failures where 
software was the cause.
    Ms. Gau. Fortunately, at this point, we have not suffered a 
large-scale cyber attack by a foreign government or foreign 
agents so to speak. But AOL, as I mentioned, experiences hacker 
attacks on a daily basis. And over the years, we have found 
that that kind of pounding of our systems has helped us 
identify security problems that we are then able to fix. 
Because as it turns out, the hacker in question was just a 
teenager working, you know, on the computer, or not working, 
but playing on the computer in the home, and wasn't really 
seeking to do anything but to gain bragging rights for having 
accomplished something.
    And obviously, not everyone can do that to every product 
that they are going to put out into the market. There is only 
so much beta testing you can do. But one of the things that we 
have done with vendors of ours, particularly, for example, 
companies that participate in the shopping area on AOL, what we 
consider certified merchants. We require them to undergo 
security audit with one of two firms that we identify to them.
    Now, on a large-scale basis, that is not realistic, because 
there are costs involved. And so only the big players can 
really come to the table if they want to be in the shopping 
area on AOL because they are going to have to pay for this 
security audit.
    But there is no question that stress-testing of systems and 
perhaps further R&D, as well as further incubation periods for 
products might lead in a direction where we have less products 
in the market place that you have security holes discovered in 
once they hit consumers.
    Ms. Lofgren. Mr. Chairman, we should let them have lunch.
    Mr. Thornberry. I think the gentlelady's point is well 
taken.
    Let me thank each of you again for your time and your 
contribution. Let me also invite each of you to continue to 
discuss these issues with the members and the staff of this 
subcommittee.
    As we move ahead, we are going to continue to need your 
input and our suggestions.
    For example, next week we are having this hearing on 
research and development. What areas do you think the federal 
government should concentrate its research and development in 
the area of cybersecurity? If you have thoughts on that, we 
would like to hear it.
    Again, thank you for being here.
    And this hearing stands adjourned.
    [Whereupon, at 1:16 p.m., the subcommittee was adjourned.]

                                APPENDIX

                   Material Submitted for the Record

Responses to Questions for the Record from DELL, Dr. James Craig Lowery

1. There has been widespread concern among computer industry insiders 
that DHS is not taking information security vulnerabilities seriously 
enough. There is still no Undersecretary for Information Analysis and 
Infrastructure Protection, and even when one is in place, there is 
concern that information security will be relegated to second-class 
status. Industry has expressed the interest in expanding partnerships 
with government agencies to improve security, but DHS does not appear 
to be moving quickly to embrace this idea.

        a. What do you see as the government's role in increasing 
        security and standards setting? Could it be fostered through 
        partnerships (such as those done through National Institute for 
        Standards and Technology) and purchasing criteria? Would 
        government mandated standards, such as the Common. Criteria, be 
        a helpful baseline or a hindrance to future innovation?
Response: Dell is interested in sharing its insights and views on 
cybersecurity with the Department of Homeland Security. Overall, the 
government's role in increasing, security and standards setting is as a 
customer and through its participation in organizations such as the 
Center for Internet Security in an open, voluntary and consensus-based 
process that includes input from all stakeholders.
    Security is a moving target, and the products and services 
addressing security needs necessarily evolve as the landscape changes. 
Government mandated standards would likely result in a one-size fits-
all approach that fails to address the security problem and would also 
be and obstac1e to innovation in our industry. Additionally, there is 
some concern that the process associated with the setting of government 
standards would be slow and cumbersome that technology and knowledge 
would always be ahead of government standards.

        b. From what you can tell, is there sufficient information-
        sharing taking place between researchers who discover most 
        vulnerabilities, companies who created the products and DHS? If 
        CERT were formally connected to DHS, would that-help FedCIRC 
        with information dissemination and the remediation of security 
        problems and breaches?
Response: We support the information-sharing that is taking place with 
organizations such as CERT Coordination Center, the SANS Institute, the 
Center for Internet Security, and the Free Standards group. These 
organizations are working to develop 'security solutions based on 
consensus and standards with the input from government agencies, 
businesses, universities, and individual security experts and to 
disseminate information. In order for these organizations to remain 
effective, it is important for Federal departments such as the 
Department of Homeland Security to participate in these organizations.

        c. How can the government help companies be more responsive to 
        known security issues? Would a law providing safe-harbor, with 
        a sunset, help encourage companies to quickly fix security 
        issues after they are discovered?
    Response: The Federal Government should provide information on its 
cybersecurity needs to its vendors as well as provide its input and 
views to organizations that are engaged in an open, voluntary and 
consensus-based process for the development of security standards.

  Responses to Questions for the Record from EQUINIX, Mr. Jay Adelson

1. There has been widespread concern among computer industry insiders 
that DHS is not taking information security vulnerabilities seriously 
enough. There is still no UnderSecretary for Information Analysis and 
Infrastructure Protection, and even when one is in place, there is 
concern that information security will be, relegated to second-class 
status. Industry has expressed the interest in expanding partnerships 
with government agencies to improve security, but DHS does ,not appear 
to be moving quickly to embrace this idea.

        a. What do you see as the government's role in increasing 
        security and standards setting? Could be fostered through 
        partnerships (such as those gone through National Institute for 
        Standards and Technology) and purchasing criteria? Would 
        government mandated standards, such as the Common Criteria, be 
        a helpful baseline or a hindrance to future innovation?
Response: The government has an opportunity to assume a leadership 
position in the coordination of efforts to create common security 
standards. While like many voluntary standards, they do not require 
regulatory enforcement such standards can be useful as competitive 
differentiators and therefore industry-driven.
    Partnerships would be required to fulfill this need, as currently 
the federal, government does not have the background, and relationships 
required on an international level to begin this dialogue. It would be 
of tremendous benefit to the industry if this could change, and via the 
UnderSecretary for Information Analysis and Infrastructure Protection, 
such expertise could be established within the DHS over time.
    The government has had a role in developing cyber and physical 
security best practices through the FCC's Network Reliability and 
Interoperability Counsel (NRIC), which can provide a model and a 
starting point. However, in our opinion, NRIC is not an effective place 
to create these best practices going forward, as it only represents 
regulated entities, a small subset of Internet infrastructure. 
Migrating the homeland security best practices work from NRIC to DHS 
will allow the scope of that work to be expanded to include previously 
untapped communities and a better representation of Internet 
infrastructure in general.
    Purchasing criteria to meet certain standards, as well as process 
and technology criteria, would be inclusive in these standards. While 
it would be appropriate for the federal government to act as an early 
adopter of these Common Criteria, the purchasing power of government 
does not alone constitute a significant enough motivator to catalyze 
adoption of these standards.

        b. From what you can tell, is there sufficient information-
        sharing taking place between researchers who discover most 
        vulnerabilities, companies who created the products and DHS? If 
        CERT were formally connected to DHS, would that help FedCIRC 
        with information dissemination and the remediation of security 
        problems and breaches?
Response: Our visibility into the information-sharing between DHS and 
other entities is limited. Certainly, at an operational level, we have 
seen no indication that DHS has had any significant communication with 
elements of the industry that represent the Internet infrastructure, 
outside of the major router manufacturers arid the top five 
telecommunication carriers. While five years ago this may have been 
sufficient, the Internet infrastructure has evolved into tens of 
thousands of individual influential entities that all require 
significant communication from DHS in the event of a crisis or in 
crisis preparation. CERT need not be formally connected to DHS for 
CERT's information to be better propagated. The communications path 
between DHS and industry can potentially be better funded and 
maintained than the communication path between CERT and industry, and 
this neutral organized approach could incorporate other information 
outside of CERT in the decision-making process of who to tell what 
information.
    In sharp contrast to DHS' current communication practice with 
industry, informal industry-based communication practice is strong 
between similar service providers, such as ISPs and telecom carriers, 
outside of any ISACs. Unfortunately, enterprises and large content 
providers have been excluded from this self-developed communication due 
to their relative infancy in the Internet infrastructure, and therefore 
this provides an excellent opportunity for DHS to develop these 
practices, particularly amongst the largest population of Internet 
infrastructure businesses represented by enterprise and content.

        c. How can the government help companies be more responsive to 
        known security issues? Would a law providing safe-harbor, with 
        a sunset, help encourage companies to quickly fix security 
        issues after they are discovered?
Response: Current communication plans from government to industry are 
event-driven. A major restructuring of this concept for the Internet 
industry would be necessary, shifting the approach to scheduled 
communication in addition to event-driven communication. The nature of 
business revenue priority would typically defocus enterprises from 
maintaining up-to-date information, however government-approved 
standards, that require regular participation by enterprise, would 
ensure proper communication practice.
    Laws providing safe-harbor would appropriately address privacy 
concerns. In essence, laws that protect service providers from brand 
damage after an event, such as exemptions from the Freedom of 
Information Act, would be necessary to ensure two-way communication.

    Responses to Questions for the Record from AT&T, Mr. Frank Ianna

1. There has been widespread concern among computer industry insiders 
that DHS is not taking information security vulnerabilities seriously 
enough. There is still no Undersecretary for Information Analysis and 
Infrastructure Protection, and even when one is in place, there is 
concern that information security will be relegated to second-class 
status. Industry has expressed the interest in expanding partnerships 
with government agencies to improve security, but DHS does not appear 
to be moving quickly to embrace this idea.

        a. What do you see as the government's role in increasing 
        security and standards setting? Could it be fostered through 
        partnerships (such as those done through National Institute for 
        Standards and Technology) and purchasing criteria? Would 
        government mandated standards, such as the Common Criteria, be 
        a helpful baseline or a hindrance to future innovation?
    Response: Government should first ensure that its procurement 
activities across Federal, State, and Local settings are properly 
coordinated through a common set of security standards. This is a 
logical first step for our nation--and frankly, unless such 
coordination can occur between these separate government entities, it 
will be unlikely to occur in a more diverse commercial setting. 
Selection of which standard to use is not the critical issue; security 
best practices are well understood and agreed upon by current security 
professionals. The more important issue is that the selected standard 
be uniformly applied--and government procurement is the obvious place 
to start.

        b. From what you can tell, is there sufficient information-
        sharing taking place between researchers who discover most 
        vulnerabilities, companies who created the products and DHS? If 
        CERT were formally connected to DHS, would that help FedCIRC 
        with information dissemination and the remediation of security 
        problems and breaches?
Response: Information sharing about vulnerabilities has certainly 
gotten much better and companies like AT&T are taking advantage of that 
information to better protect against and respond to vulnerabilities as 
they are identified. For example, information shared quickly during the 
recent slammer and blaster events helped AT&T take the necessary 
assessment and remediation actions that much more efficiently and 
effectively. Regarding CERT specifically, what is most important is 
that CERT be among the resources available to DHS as part of the 
overall public-private partnership for information-sharing purposes. It 
seems unnecessary for CERT to be ``formally connected'' to DHS in order 
for it to continue to be a valuable tool for DHS and the private sector 
alike. The much more urgent issue is the prevention and removal of 
vulnerabilities from commonly used products such as commercial 
operating systems and applications.

        c. How can the government help companies be more responsive to 
        known security issues? Would a law providing safe-harbor, with 
        a sunset, help encourage companies to quickly fix security 
        issues after they are discovered?
Response: Government should foster a competitive commercial environment 
in which marketplace forces reward products and services that are free 
of security vulnerabilities. One area in which this can occur relates 
to government procurement (see above); another relates to a renewed 
assessment of the proper assignment of liabilities should such 
vulnerabilities result in business losses for users. That said, it is 
also important to ensure that companies that act responsibly by 
identifying vulnerabilities through timely and prudent evaluation, by 
notifying its customers and by otherwise handling identified flaws in a 
responsible manner are protected from liability and thus not 
discouraged from acting responsibly.

2. Several experts have cited the threat of cyber attacks by well-
organized and technically savvy terrorist groups--specifically Al 
Qaeda. An article in the Washington Post last year laid out chilling 
scenarios in which terrorists might carry out cyber attacks that could 
do the same amount of damage to our critical infrastructure as tons of 
explosives. Another fear is the coordination of a cyber and physical 
attack, so that our response capabilities would be compromised or even 
shut down just when we need them most.

        a. Do you agree that these threats are real? If so, how much of 
        a priority should they be? Are there other variations of the 
        cyber threat that should be getting more attention than they 
        have?
Response: It is difficult for an individual private-sector entity such 
as AT&T to assess the degree of actual cyber-threats, especially those 
outside of the telecommunications industry, and Congress should look to 
government intelligence agencies, and not the private sector, to gauge 
the likelihood and severity of cyber-threats. Nonetheless, the increase 
of attempted intrusions and disruptions that we have identified over 
time does suggest that there are real threats, and addressing these 
threats continues to be a high priority for AT&T, and should be for 
companies within each critical industry sector. Like the FCC/NRIC 
model, each industry sector should work together to identify the 
critical systems that could be exploited to cause disruptions, and 
develop and observe voluntary best practices to improve each company's 
intrusion detection, deterrence and disaster recovery capabilities. 
This assessment must be done separately for each sector, and 
specifically for each mission-critical system at the ``micro'' and not 
``macro'' level to be sure that characteristics unique to each system 
are identified and evaluated. Furthermore, each sector should develop 
measures around these best practices so that each industry's progress 
can be measured over time. In addition, it is important for companies 
that own and operate critical infrastructures, such as AT&T, to have 
ongoing communications with government intelligence entities to stay 
informed as new threats are identified.

        b. Are we, and specifically is DHS, doing enough now to address 
        the possibility of large-scale cyber attacks? If not, what more 
        needs to be done--is it a question of changing priorities? 
        hiring additional personnel? placing a higher-ranking official 
        in charge of the cybersecurity issue?
Response: The Department of Homeland Security was only created in March 
of this year, making it nearly impossible for a private-sector 
corporation such as AT&T to fairly assess its effectiveness in 
addressing cyber-security. Certainly more can be done, and naming a 
senior official responsible for cybersecurity will help.

        c. What is being done to research or combat the possibility of 
        viruses, worms or other cyber threats morphing, so that they 
        are impossible to protect against?
Response: The global cyber community is currently investing countless 
hours and resources in the establishment of incident response teams 
that identify and respond to viruses, worms, and other cyber attacks. 
While this is appropriate given our current global cyber security 
posture, such security investment could be redirected toward alternate 
innovations that could help enable new services and hence drive the 
economy. As such, the primary research issue should involve the 
prevention and removal of security vulnerabilities from occurring in 
the first place. This must start with the vendors of software products 
that are used almost ubiquitously across the globe on servers, 
workstations, and other devices. Virtually every major security 
incident being experienced in recent months rely on the presence of 
such software vulnerabilities.

        d. From what you can tell, is there sufficient information-
        sharing taking place between the intelligence community (and 
        specifically the DHS Intelligence Analysis Directorate), which 
        analyzes threats, and the science and technology arena (and 
        specifically the Science and Technology Directorate), where new 
        solutions and tools can be developed to counteract the most 
        likely or most worrisome threats?
Response: The private sector is not in a position to assess the quality 
of information sharing between these two nascent directorates within 
DHS.

        e. Do you feel the Information Sharing Analysis Center (ISAC) 
        established under Presidential Order is the right structure for 
        information sharing between sectors and the federal government? 
        What would you recommend as an optimal model for ISAC-like 
        activities? How is DHS working with your industry ISAC?
Response: We agree with the ISAC concept but would suggest that there 
is no single model that would meet the needs of every critical 
infrastructure. Infrastructure operators in some sectors, such as 
telecommunications, have a compelling need to communicate frequently 
through multiple points of interface. This is because the components, 
or segments, of the telecommunications infrastructure as interconnected 
and the functioning of each segment has significant implications for 
other operators. These communications channels are frequently exercised 
because incident management in the telecommunications industry is a 
daily necessity, due to the widely dispersed assets, which are exposed 
to a multitude of threats. Other infrastructures, such as electric 
power, probably have a similar requirement. However, an infrastructure 
such as water, likely does not have the same need for many operators to 
communicate with one another on a regular basis.
For infrastructures such as telecommunications, we believe the National 
Coordinating Center (NCC), operated by the National Communications 
System (NCS), which is a component of DHS, is the best model. It was 
established in 1984 and has functioned as an ``ISAC'' for over twenty 
years. The federal government operates the center while the private 
sector provides representatives for ``resident'' and ``non-resident'' 
memberships. The NCC is the focal point for coordination of disaster 
response for telecommunications under the Federal Response Plan (FRP). 
Government funding and participation in this ISAC makes a compelling 
business case for participation by the private sector.

        f. How has the insurance industry reacted to the development of 
        cyber attacks and cyber terrorism as a risk factor for your 
        industry? Are losses caused as a result of such incidents 
        generally covered under existing policies, or have new products 
        been created to specifically address this risk factor? Do you 
        have any sense of the impacts on insurance costs?
Response: The insurance industry has begun to develop new insurance 
products albeit this market is in the formative stages. Losses caused 
by cyber-related terrorist acts are generally not covered under 
existing policies. Though some new insurance products have become 
available, few insurance companies are willing to take on such risk, 
and even where available, coverage is limited and costly. There has 
been no impact to our insurance costs because this risk is excluded 
from our policies. If we chose to purchase insurance that protected 
against loss from this risk our insurance costs would increase.

3. Providing patches to vulnerabilities is time and resource intensive. 
How does your company address the problem of legacy equipment and 
software with respect to cybersecurity? Are older and discontinued 
products supported with respect to fixing newly discovered security 
flaws? If so, how is the end user notified? Is there a role for the 
federal government in this process?
Response: This is a significant and costly issue from a cybersecurity 
perspective. In many cases, security patches are not provided to 
address flaws in legacy systems and software, and we are left with no 
choice but to replace potentially vulnerable but otherwise operational 
capabilities. For example, commercial operating systems are often 
periodically ``retired'', at which point vendors will no longer provide 
remediation, patches or support. Entities running those operating 
systems have no option but to replace them or risk the possibility that 
vulnerabilities could be exploited.

4. Up to this point, cybersecurity has depended on voluntary consensus 
across industry. The Federal Communications Commission (FCC) has a 
process via the National Reliability and Interoperability Council 
(NRIC) that seems to have worked for the telecommunications sector, but 
much of this was based on the FCC regulatory role for that industry.
        a. Could DHS fill this void for establishing best practices, 
        common criteria, and standards for Information Technology 
        products and services, particularly for the Internet? If so, 
        how might that be structured?
Response: With regard to telecommunications, the Network Reliability 
and Interoperability Council, established in the early 1990's, has 
developed best practices for the wireline communications industry for 
reliability, physical and cyber security, etc., and the NRIC has 
expanded its work in the last few years on best practices to address 
IP-based, wireless and cable services. The Council has also established 
processes for standards and for templates (criteria) for 
interconnection and interoperability. Therefore, we do not see a void 
with regard to telecommunications. DHS should be encouraged to interact 
with the FCC/NRIC with regard to telecommunications best practices. 
This model could be used by other sectors as well, but each sector 
should be responsible for working with the appropriate government 
agencies (e.g. perhaps DOE and FERC for the electric power industry, 
Treasury and the Federal Reserve for the financial services industry), 
in conjunction with DHS, to develop and implement best practices 
tailored to each specific sector.

        b. Are there aspects of standards for which a mandatory 
        approach might be more appropriate, as is the case, for 
        example, in health care or telecommunications?
Response: The standards process is a necessary part of the service 
industry. In telecommunications, standards are essential because 
suppliers and competitors are all interconnected using ubiquitous 
standards agreed to by the industry. Service industry participants work 
the standards process in various standards committees such as ATIS and 
IETF for the telecommunications industry. The benefit of the standards 
process to the industry is the ability to gain consensus by all 
participants. This ensures that all ``voices'' are heard from and one 
group does not dominate the process. ANSI provides for accreditation to 
ensure that standards committees do follow this procedure. (if they are 
certified). However, a mandatory approach to security standards would 
be extremely difficult, and participation may be in jeopardy since 
industry participants will have concerns and the open exchange of 
information will not be as forth coming. Rather than attempting to 
mandate security standards, a better approach is to use an NRIC-like 
approach (described further in 2(a) and 4(a) above) and allow peer 
performance pressure to be the stimulus for improvement in the market 
throughout each sector.

        c. Some major auditing firms want to help companies assess 
        their security vulnerabilities and develop plans to address 
        them. How is the business case being formed to justify the 
        additional costs?
Response: Business Continuity is an essential process for each 
enterprise. Each enterprise does some degree of Business Continuity and 
risk assessment/remediation. This risk assessment must examine closely 
the ``expected value'' of each security investment, because even though 
the probability of loss is low, the impact could potentially be quite 
high. This analysis is key in order to establish accurate priorities in 
where to invest limited security resources. The use of external 
auditing firms helps the enterprise with their business continuity 
process. Use of auditing can be for: validation of internal risk 
assessment, identification of gaps, new opportunities or thoughts 
processes, certification of center operations, etc.
    The business case for auditors would be part of the business 
continuity business case.

5. Emergency preparedness and disaster recovery are common themes for 
the physical infrastructure, but there does not appear to be adequate 
attention to these areas for cyberspace.

        a. From the perspective of your industry, how should the 
        Department of Homeland Security prioritize its cybersecurity 
        activities, from threat detection through disaster recovery?
Response: Priority one should involve remediating vulnerabilities in 
software that powers our critical infrastructure. Investments in 
software engineering process improvements, research into better tools 
for ensuring correctness of software, and increased attention to 
correctness in government procurement activities should be paramount in 
the DHS plans.
    In addition, DHS alone cannot achieve the charter of the 
department. It will take partnership with the industry to develop the 
priorities and programs to meet the demands of the ``new'' cyber world 
we all live in now. Any major initiative that could have a significant 
impact on private sector infrastructures should include, from the 
outset, industry participation, guidance and expertise. For example, 
much has been said about the possibility that the government might 
establish a center for cyberspace security. However, before undertaking 
such an important project, government and industry need to work 
together to explore whether we should have a national center for cyber 
space security or not, and if so, who would participate, and how it 
would operate.

        b. What should be the threshold for federal involvement in the 
        event of a cyber attack? When should it be left entirely to the 
        private sector to respond?
Response: While the majority of critical infrastructure is owned and 
operated commercially, a non-trivial percentage (15% by most estimates) 
is controlled by government. Accordingly, government must ensure that 
it is properly responding to cyber attacks for these resources. Leading 
by example may be the most powerful means for improving the overall 
security posture of the nation.
In addition, thresholds for determining when federal government should 
get involved should be established on a sector-specific basis. In 
telecommunications, thresholds have been defined through the NS/EP 
process and the work of the NCC/NCS. Each event is different and it is 
difficult to define what the threshold should be to capture a process 
that would be applicable to all events. In the cyber world, each event 
has unique characteristics and it is difficult to define what is the 
critical nature of the event. The NCC/NCS has a long history in knowing 
when to pull the service providers together for a common restoration. 
Many of the principles applied over the years to the telecommunications 
structure can be transferred to the cyber arena. The NSEP process 
should be adopted for these purposes. These principles can and should 
be applied to other sectors, and adjusted for each sector that reflect 
the needs and particular characteristics of that sector. In fact, the 
threshold could be different in each industry sector.

        c. What role could the federal government play in 
        reconstituting Internet service if a major debilitating attack 
        were to occur?
Response: To the degree that government-controlled infrastructure is 
included in the overall Internet community (e.g., NIPRnet, DISN, FTS-
2001, etc.), government should obviously take the lead in coordinating 
proper reconstitution of such resources with its vendors, suppliers, 
and partners. More importantly, government should try to take the lead 
in preventing such attacks from occurring through the software 
vulnerability reduction measures outlined above.
In addition, the government should look to the NCC/NCS, established in 
1984 with the break up of the Bell System, to coordinate communications 
restoration when appropriate. Over the years the NCC has expanded its 
membership from traditional circuit switched providers to internet-
related providers and vendors. In fact, during the September 11th 
event, the NCC, with its links to the White House, worked with industry 
to restore Wall Street first as part of the recovery. Continued use of 
the NCC/NCS in the ``trusted' environment is the best way for the 
recovery process to work when required.

        d. In the event of a major cyber attack, what are your concerns 
        with respect to disaster recovery for your company and more 
        broadly? Do you think that existing continuity and recovery 
        planning are sufficient? If not, what more needs to be done?
Response: AT&T has the premier physical Disaster Recovery capability in 
the industry, which addresses the physical replacement of destroyed 
assets. AT&T has invested over $300M in infrastructure and processes 
that can be deployed to recover from such a disaster scenario. In 
addition, AT&T has detailed business continuity and recovery plans for 
all of our key data centers and systems. These processes are exercised 
regularly and overseen by resiliency experts at AT&T Labs to ensure 
that plans are tested and refreshed as warranted. We also monitor the 
health of our networks constantly and can identify and address 
abnormalities very quickly. Even in these tight economic times, AT&T 
has continued to invest including expanding our disaster recovery 
capabilities to our key facilities outside the United States. It is 
important for all entities, but especially operators of critical 
infrastructures, to perform periodic and rigorous assessments of their 
mission-critical functions to minimize the impact that disruptions 
might otherwise cause.
With regard to recovery from a major cyber attack, disaster response 
could take many forms. There are basic principles to guide the 
recovery: first, the detection and analysis of traffic data anomalies 
and other indicia in real-time; and second: remediation actions, which 
could range from applying software patches and upgrades, to 
quarantining and inoculating infected LANs, to shutting off routers to 
prevent further damage and rebooting machines using ``clean'' saved 
software.

        e. Is there a need for a coordinated international response as 
        part of the efforts to protect national information 
        infrastructures? What form might this response take?
Response: Obviously, global coordination is required. Multinational 
corporations do this across their business unit structure, often in a 
seamless manner.
In addition, the international environment is critical to controlling 
the health of the Internet. From a disaster recovery viewpoint, AT&T is 
investing in recovery for service nodes in Europe.
    Our Business Continuity and Risk Assessment processes are currently 
being refreshed in light of changed conditions. Establishing a working 
group across national boundaries could have benefit just as the NRIC 
Council has provided benefits in the communications industry. Cyber 
attacks can come from anywhere, therefore international cooperation at 
both the government and industry levels is a necessary component. 
However, currently, it is be very difficult for the private sector to 
engage in effective information-sharing and security coordination 
efforts in a global context because there are so many different 
approaches to information protection and disclosure world-wide at this 
time. There is a critical role for the U.S. government to play in 
structuring this partnership to ensure that U.S. corporations and 
citizens are protected by U.S. laws. Active private sector 
participation requires significant harmonization to ensure adequate 
legal protections such as protection of sensitive information are 
continually maintained.

     Response to Questions for the Record from AOL, Ms. Tatiana Gau

1. There has been widespread concern among computer industry insiders 
that DHS is not taking information security vulnerabilities seriously 
enough. There is still no UnderSecretary for Information Analysis and 
Infrastructure Protection, and even when one is in place, there is 
concern that information security will be relegated to second-class 
status; Industry has expressed the interest in expanding partnerships 
with government agencies to improve security; but DHS does not appear 
to be moving quickly to embrace this idea.

        a. What do you see the government's role in increasing security 
        and standards setting? Could it be fostered through 
        partnerships (such as those done through National Institute for 
        Standards and Technology) and purchasing criteria? Would 
        government mandated standards, such as the Common Criteria, be 
        a helpful baseline or a hindrance to future innovation?
Response: We believe that government's role is to lead by example on 
cybersecurity, to encourage information sharing and the development of 
industry best practices; support R&D, and to enter into partnerships 
with industry to improve cybersecurity in areas where it is lacking. 
Because cybersecurity is such a rapidly evolving area we do not believe 
that government mandated standards are a particularly effective 
approach, as such standards could quickly become obsolete. However, we 
do think that government procurement standards may be helpful in 
encouraging best practices throughout the private sector.

        b. From what you can tell, is there sufficient information-
        sharing taking place between researchers who discover most 
        vulnerabilities, companies who created the products and DHS? If 
        CERT were formally connected to DHS, would that help FedCIRC 
        with information dissemination and the remediation of security 
        problems and breaches?
Response: To our knowledge, while there is a good deal of information-
sharing taking place among researchers and IT companies, there is not 
yet significant information-sharing between DHS and the ISP sector. We 
applaud the recent decision by DHS to create a government CERT that 
will coordinate with the private sector. We believe such a 
collaborative approach will create an environment that is conducive to 
information-sharing and cooperation.

        c. How can the government help companies be more responsive to 
        known security issues? Would a law providing safe-harbor, with 
        a sunset, help encourage companies to quickly fix security 
        issues after they are discovered?
Response: AOL and other industry leaders already spend very significant 
sums of money on cybersecurity. However, government can foster greater 
responsiveness to known security issues through information-sharing, 
and by educating the public about security issues, as AOL does through 
its service. Government can play a particularly important role by 
providing easy-to-access security warnings for small business and home 
users.

    Responses to Questions for the Record from MICROSOFT, Mr. Phil 
                               Reitinger

1. There has been widespread concern among computer industry insiders 
that DHS is not taking information security vulnerabilities seriously 
enough. There is still no UnderSecretary for Information Analysis and 
Infrastructure Protection, and even when one is in place, there is 
concern that information security will be relegated to second-class 
status. Industry has expressed the Interest in expanding partnerships 
with government agencies improve security, but DHS does not appear to 
be moving quickly to embrace this idea.

        a. What do you see as the government's role in increasing 
        security and standards setting? Could it be fostered through 
        partnerships (such as those done through National Institute for 
        Standards and Technology) and purchasing criteria? Would 
        government mandated standards, such as the Common Criteria, be 
        a helpful baseline or a hindrance to future innovation?
Response: The government has a vital and tailored role to play in cyber 
security. First and foremost, the United States Government is the owner 
and operator of some of the largest and most sensitive computer 
networks in the world--its actions regarding its own cyber security can 
serve to demonstrate both the importance of the problem and best-in-
breed solutions. Accordingly, the U.S. Government must act as a model, 
buying technology engineered for security, and implementing state-of-
the-art security practices.

Second, the U.S. Government must attack the ``knowledge gap'' regarding 
cyber security--even today we do not know the quantitative risks posed 
by a lack of cyber security, and in which areas public and private 
actions fall short of addressing these risks. Business leaders are very 
good at risk management, but some of the risks posed by cyber crime and 
cyber attack are best known to the Government and need to be shared, to 
the greatest extent possible, with the private sector. This will 
enhance the business case for cyber security to the benefit of all. In 
particular, we all need to know more about interdependency between 
sectors and how that may affect our economy and our nation. Moreover, 
even with the increasing business focus on cyber security and enhanced 
private sector action, in some areas there may be a national or 
homeland security need for computer and network security above what the 
market will provide. Therefore, the government, with knowledge of the 
risk in hand and recognizing the dynamic nature of the problem, needs 
to conduct an analysis of where private action may fall short and then 
determine the best way to address this shortfall through tailored 
action.

Third, the U.S. Government needs to otherwise catalyze and enhance 
private action. There is and has been considerable activity in the 
cyber security realm, which can lead to two contrary but related 
mistakes. The first is to think that all, this activity is progress, 
and that the cyber security problem is close to being solved. The 
second is to view this activity as mere churn without progress. In 
fact, considerable progress has been made, with the private sector 
increasingly focusing on and devoting resources to cyber security, and 
the public sector taking actions such as creating the Department of 
Homeland Security and adopting an improved information security 
governance structure though the enactment of the Federal Information 
Security Management Act. The federal government is uniquely able to 
continue and enhance this progress. It can help reduce the ``churn'' by 
examining the activity that is taking place and identifying and 
supporting the private and public initiatives that offer the best 
opportunity to solve problems. It can, help to develop and support 
metrics by which the private sector can judge its status and 
capabilities. As identified in my testimony, the federal government 
should provide more support for cyber security R&D (among the topics 
could be improved development tools, security for Internet-scale 
computing, human-computer interaction and security, priority routing, 
basic protocol research, and wireless security). And with respect to 
information sharing, besides sharing its own information (see above), 
the federal government can catalyze information sharing by the private 
sector by working with it to develop interfaces and protocols for 
sharing information among the various players and for the subsequent 
protection and use of that information--this would help to ease the 
burden of sharing information and increase the trust that shared 
information would be handled appropriately.

Fourth, the U.S. Government must fulfill its particular 
responsibilities as a national government, including for national and 
homeland security. These include continuing to enhance the capability 
of law enforcement to catch and punish cyber criminals, because without 
an effective deterrent the amount of cyberc crime will continue to 
grow. The Government can also raise public awareness about computer 
security, and build international relationships and agreements that 
enhance computer security worldwide.

The government role in standards setting is also vital if properly 
tailored--in our view, the market should drive the emergence of open 
standards. If market competition is permitted to determine which 
standards succeed, users are most likely to get the best mix of 
security and value, while the process itself will ensure that more 
secure standards constantly replace those that are less secure. That 
said, the government can and should set the requirements for its IT 
purchases, relying to the greatest extent possible on the standards 
developed, through market-driven means. This gives the government the 
benefit of widely interoperable and more up-to-date technology and 
processes.

Moreover, as your question also suggests, where appropriate the 
government's acquisition policies should include purchasing software 
whose security has, been evaluated and certified under the 
internationally-recognized (and U.S. supported) Common Criteria for 
Information Technology Security. Policies requiring the acquisition of 
software that has received appropriate Common Criteria certifications 
should be developed and applied consistently and evenhandedly, and we 
applaud DoD's recent efforts to make clear that its security policies 
apply to software that has been developed under all business, 
development, and licensing models. Such efforts to procure only 
security-engineered technology, and specifically such clear support for 
the Common Criteria, will help strengthen the government infrastructure 
and motivate markets.

The government should, however, avoid mandating standards for use by 
the private sector. Legislated standards are likely to become quickly 
outmoded--indeed, they may be outmoded at enactment. Standards are 
already ``following'' rather than ``leading,'' that is, standards tend 
to enshrine best current practice rather than encapsulate expected 
innovation. Adopting a particular standard in legislation or regulation 
may enshrine outdated and antiquated technology and practice on our 
most critical infrastructures. Mandatory standards can also restrict 
innovation, by reducing the benefit from developing new technology or 
practices that are non-compliant, 'and also skew innovation, by 
favoring one technology or practice over another. Finally, mandating 
standards can actually drive security to a floor. Here, as elsewhere, 
the government must tailor its activity to meet specific needs, and act 
in the least intrusive manner possible, to avoid damaging the market's 
continuing innovation.

        b. From What you can tell, is there sufficient information-
        sharing taking place between researchers who discover most 
        vulnerabilities, companies who created the products and DHS? If 
        CERT were formally connected to DHS, would that help FedCIRC 
        with information dissemination and the remediation of security 
        problems and breaches?
Response: Information sharing regarding vulnerabilities is certainly 
taking place, and of course I would like to see it improve. Responsible 
disclosure of vulnerabilities minimizes risk to users, the
Internet, and the critical infrastructures that depend upon it by 
giving vendors an opportunity to develop a fix for a vulnerability 
before giving attackers the knowledge necessary to launch attacks. 
Microsoft applauds and thanks those researchers who follow responsible 
disclosure policies.
Therefore, Microsoft is working with other industry leaders to propose 
and institutionalize industry best practices for handling security 
vulnerabilities in ways that more effectively protect Internet users. 
We are a founding member of the Organization for Internet Safety (OIS), 
an alliance of leading technology vendors, security researchers, and 
consultants that is dedicated to the principle that security 
researchers and vendors should follow common processes and best 
practices to efficiently resolve security issues and to ensure that 
Internet users are protected. See www.oisafety.org. Last month, OIS 
published a set of best practices for reporting and responding to 
security vulnerabilities. These guidelines, which were built with input 
from across the security community, provide specific, prescriptive 
guidance that establishes a framework in which researchers and vendors 
can work together to improve the speed and quality of investigations 
into security vulnerabilities, then jointly provide guidance to help 
users protect themselves and their infrastructures. We view these best 
practices as an important step in elevating standards for 
accountability on all fronts and among all audiences in managing 
security vulnerabilities.
With regard to the formal connection of CERT to DHS, I would need 
further information on how such a proposal would work before commenting 
in detail.
        c. How can the government help companies be more responsive to 
        known security issues? Would a law providing safe-harbor, with 
        a sunset, help encourage companies to quickly. fix security 
        issues after they are discovered?
Response: The U.S. Government can help companies be more responsive to 
known security issues by taking the actions described above--being a 
leader and securing its own systems, addressing the knowledge gap, 
catalyzing and enhancing private sector activity, and fulfilling its 
governmental responsibilities. In particular, addressing the knowledge 
gap will help business both to make rational decisions about cyber 
security and risk management and to implement the best defense.
As for your question about Safe Harbor, I would need more information 
about the proposal to comment.

                                 

```