U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

82–173 PDF 2002

COMPUTER SECURITY IN THE FEDERAL

GOVERNMENT: HOW DO THE AGENCIES RATE?

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY,

FINANCIAL MANAGEMENT AND

INTERGOVERNMENTAL RELATIONS

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SEVENTH CONGRESS

FIRST SESSION

NOVEMBER 9, 2001

Serial No. 107–115

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

MARK E. SOUDER, Indiana

STEVEN C. LATOURETTE, Ohio

BOB BARR, Georgia

DAN MILLER, Florida

DOUG OSE, California

RON LEWIS, Kentucky

JO ANN DAVIS, Virginia

TODD RUSSELL PLATTS, Pennsylvania

DAVE WELDON, Florida

CHRIS CANNON, Utah

ADAM H. PUTNAM, Florida

C.L. ‘‘BUTCH’’ OTTER, Idaho

EDWARD L. SCHROCK, Virginia

JOHN J. DUNCAN, JR., Tennessee

——— ———

HENRY A. WAXMAN, California

TOM LANTOS, California

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

JANICE D. SCHAKOWSKY, Illinois

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

JAMES C. WILSON, Chief Counsel

ROBERT A. BRIGGS, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY, FINANCIAL MANAGEMENT AND

INTERGOVERNMENTAL RELATIONS

STEPHEN HORN, California, Chairman

RON LEWIS, Kentucky

DAN MILLER, Florida

DOUG OSE, California

ADAM H. PUTNAM, Florida

JANICE D. SCHAKOWSKY, Illinois

MAJOR R. OWENS, New York

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

ELIZABETH JOHNSTON, Professional Staff Member

JUSTIN PAULHAMUS, Clerk

DAVID MCMILLEN, Minority Professional Staff Member

(III)

C O N T E N T S

Page

Hearing held on November 9, 2001 ........................................................................ 1

Statement of:

Dacey, Robert F., Director, Information Security, U.S. General Accounting

Office .............................................................................................................. 5

Forman, Mark A., Associate Director, Information Technology and EGovernment, Office of Management and Budget ....................................... 33

Letters, statements, etc., submitted for the record by:

Dacey, Robert F., Director, Information Security, U.S. General Accounting

Office, prepared statement of ....................................................................... 8

Forman, Mark A., Associate Director, Information Technology and EGovernment, Office of Management and Budget, prepared statement

of ..................................................................................................................... 38

Horn, Hon. Stephen, a Representative in Congress from the State of

California, prepared statement of ................................................................ 3

(1)

COMPUTER SECURITY IN THE FEDERAL GOVERNMENT: HOW DO THE AGENCIES RATE?

FRIDAY, NOVEMBER 9, 2001

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY, FINANCIAL

MANAGEMENT AND INTERGOVERNMENTAL RELATIONS,

COMMITTEE ON GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 10 a.m., in room

2154, Rayburn House Office Building, Hon. Stephen Horn (chairman of the subcommittee) presiding.

Present: Representative Horn.

Staff present: Russell George, staff director and chief counsel;

Bonnie Heald, deputy staff director; Elizabeth Johnston, Darren

Chidsey, and Earl Pierce, professional staff members; Jim Holmes

and Fred Ephraim, interns; David McMillen, minority professional

staff member; and Jean Gosa, minority assistant clerk.

Mr. HORN. The Subcommittee on Government Efficiency, Financial Management and Intergovernmental Relations is now in order.

In the aftermath of the terrible events of September 11th, the Nation has prudently focused on its computer security vulnerabilities.

Most of this examination has been focused on the risks to the country’s physical infrastructure. However, as the oversight conducted

by this subcommittee during the last 6 years has shown, the Nation cannot afford to ignore the risks associated with cyberattacks.

Federal agencies rely on computer systems to support critical operations that are essential to the health and well-being of millions

of Americans. National defense, emergency services, tax collection,

and benefit payments all rely on automated systems and electronically stored information.

Without proper protection, the vast amount of sensitive information stored on executive branch computers could be compromised

and the systems themselves subject to malicious attack. As the recent spate of computer viruses and worms have shown,

cyberattacks have the potential to cause great damage to the Nation.

It is imperative that the public and private leaders of this Nation

know where weaknesses exist in their organizations so they can effect corrective action.

With that in mind, I am releasing an assessment of how Federal

agencies rate in their computer security efforts. This is the second

year that we have issued a grade on the subject. It is a disappointing feeling to announce that the executive branch of the Federal

2

Government has received a failing grade for its computer security

efforts.

Last year Congress passed the Government Information Security

Reform Act which was intended to ensure that Federal agencies establish agency-wide computer security programs that adequately

protect the systems that support their missions. Based on the requirements of that law, the subcommittee has assessed the

progress of 24 major executive branch departments and agencies in

reaching the goals of enhanced computer security. Overall, the Federal Government received an F in this effort. The Office of Management and Budget [OMB], has set the standard. The staffs of the

General Accounting Office and our subcommittee staff review the

OMB inventory. Agency Inspectors General and Chief Information

Officers and Chief Financial Officers have been very helpful in this.

Two thirds of the agencies failed completely in their computer security efforts: The Department of Defense, whose computers carry

some of the Nation’s most sensitive secrets, F. The Department of

Energy, along with the Nuclear Regulatory Commission which

oversees the Nation’s nuclear facilities and other programs, F. The

Department of Transportation, which includes the Federal Aviation

Administration, an F. The Department of Health and Human Services, which holds personal information on every person who receives Medicaid and Medicare. In all, 16 Federal agencies failed

this examination completely.

Five other agencies managed to keep their heads above water,

but just barely. The Federal Emergency Management Agency, the

General Services Administration, Environmental Protection Agency, and the Department of Housing and Urban Development at the

Department of State all earned Ds.

The National Aeronautic and Space Administration did slightly

better, scoring a C-minus. The Social Security Administration,

which performed an admirable job of preparing for Y2K, earned

only a C-plus on its computer security program. And the National

Science Foundation’s B-plus was the highest grade awarded this

year.

All of us in Congress are well aware that the Nation is in a state

of war. It is not anyone’s intention to place this great land at further risk of attack. It is, however, very important that the new administration take heed of the sobering assessment the subcommittee is providing and work expeditiously to address this most important need.

[The prepared statement of Hon. Stephen Horn follows:]

3

4

5

Mr. HORN. And we have two excellent witnesses today, and that

is Robert F. Dacey, Director, Information Security, U.S. General

Accounting Office. We also have Mark A. Forman, Associate Director, Information Technology and E-Government, Office of Management and Budget.

Gentlemen, as you know, we swear in witnesses here and your

staff that have accompanied you, and the clerk will keep tabs of

who the staff are and so forth and put it in the hearing record. So

if you will stand and raise your right hands.

[Witnesses sworn.]

Mr. HORN. The clerk will note that we have six witnesses and

supporters.

And our first witness is Robert Dacey, the Director, Information

Security U.S. General Accounting Office. Welcome.

STATEMENT OF ROBERT F. DACEY, DIRECTOR, INFORMATION

SECURITY, U.S. GENERAL ACCOUNTING OFFICE

Mr. DACEY. Thank you. Mr. Chairman, I am pleased to be here

today to discuss our recent analysis of information security audits

and evaluations of unclassified computer systems at 24 major departments and agencies. As you requested, I will briefly summarize

my written statement.

Overall, the audit shows that significant pervasive computer security weaknesses continue to place Federal assets and operations

at risk. As with other large organizations, Federal agencies rely extensively on computerized systems and electronic data to support

their missions. If these systems are inadequately protected, resources such as Federal payments and collections could be lost or

stolen. Computer resources could be used for unauthorized purposes or to launch attacks on others.

Sensitive information such as taxpayer data, Social Security

records, medical records, and proprietary business information

could be inappropriately disclosed or browsed or copied for purposes of espionage or other crimes. Critical operations such as

those supporting national defense and emergency services could be

disrupted. Data could be modified or destroyed for purposes of

fraud, deception or disruption, and agency missions could be undermined by embarrassing incidents that result in diminished confidence in the Federal Government’s ability to conduct its business

in a secure manner.

Further, these risks are rapidly increasing. Greater complexity

and interconnectivity of systems including Internet access are providing additional potential avenues for cyberattack.

Second, more standardization of systems hardware and software

is increasing the exposure to commonly known vulnerabilities.

Third, the increased volume, sophistication and effectiveness of

cyberattacks, combined with readily available intrusion, or hacking

tools, and limited capabilities to detect cyberattacks.

And, fourth, other nations, terrorists, transnational criminals,

and intelligence services are developing cyberattack capabilities.

The threat of cyberattacks can also arise from hackers and others.

For example, the disgruntled organization insider is a significant

threat, since such individuals often have knowledge that allows

them to gain unrestricted access and inflict damage or steal assets.

6

Given these risks, I would like to turn to the status of Federal

agency information security. Our most recent analysis of reports

published from July 2000 to September 2001 continue to show significant weaknesses in Federal unclassified computer systems that

put critical operations and assets at risk.

We have reported the potentially devastating consequences of

poor information security since September 1996 and have identified

information security as a governmentwide high-risk area since

1997, and most recently in January 2001. As the body of audit evidence continues to expand, it is probable that additional significant

deficiencies will be identified.

Weaknesses continue to be reported in each of the 24 agencies

included in our review, and they covered all six major areas of general controls which are those policies, procedures, and technical

controls that apply to all or most of computer processing and help

ensure their proper operation.

This chart illustrates the distribution of weaknesses for the six

general control areas across the 24 agencies. As we have reported

in the past, information security problems persist in a large part

because agency managers have not yet established comprehensive

security management programs.

As further evidence of vulnerabilities, the Inspectors General reported significant deficiencies in agency-critical infrastructure protection efforts. During the past 2 years, a number of improvement

efforts have been initiated. For example, several agencies have

taken significant steps to redesign and strengthen their information security programs. In addition, the Federal Chief Information

Officer or CIO Council has issued a guide for measuring agency

progress which we assisted in developing. And the President issued

a national plan for information systems protection in January

2000.

More recently, partially in response to the events of September

11th, the President created the Office of Homeland Security with

duties that include coordinating efforts to protect public and private information systems in the United States from terrorist attack. The President also appointed a special advisor for cyberspace

security to coordinate interagency efforts to secure information systems and created the President’s Critical Infrastructure Protection

Board to recommend policies and coordinate programs for protecting critical infrastructure. The Board is to include a standing committee for executive branch information systems security, which is

to be chaired by an OMB designee.

These actions are laudable. However, given recent events and the

reports that critical assets and operations continue to be highly

vulnerable to computer-based attacks, the government still faces a

challenge in ensuring that risks from cyberthreats are appropriately addressed in the context of the broader array of risks to

the Nation’s welfare.

Accordingly, it is important that Federal information security be

guided by a comprehensive strategy for improvement. As the administration refines its strategy that it has begun to lay down in

recent months, it is imperative that it take steps to ensure that information security receives appropriate attention and resources and

that known deficiencies are addressed.

7

First, it is important that Federal strategy delineate the roles

and responsibilities of the numerous entities involved in Federal

information security and the related aspects of critical infrastructure protection. Further, there is a need to clarify how these activities of these many organizations interrelate, who should be held accountable for the success and failure, and whether they will effectively and efficiently support national goals.

Second, more specific guidance to agencies on controls that they

need to implement could help to ensure adequate protection. Currently agencies have wide discretion in deciding what computer security controls to implement and the level of rigor with which they

enforce these controls.

Third, there is a need for effective agency monitoring to determine if milestones are being met and testing to determine if policies and procedures are operating as intended. Routine periodic audits such as those required in recent government information security reform legislation would allow for more meaningful performance measurement.

Fourth, the Congress and the executive branch can use audit results to monitor agency performance and take whatever action is

deemed advisable to remedy identified problems. Such oversight is

essential for holding agencies accountable for their performance, as

was demonstrated by the OMB and congressional efforts to oversee

the year 2000 computer challenge.

Fifth, agencies must have the technical expertise they need to select, implement, and maintain controls to protect their systems.

Similarly, the Federal Government must maximize the value of its

technical staff by sharing expertise and information.

Sixth, agencies can allocate resources sufficient to support their

computer security and infrastructure protection activities. Some

additional amounts are likely to be needed to address significant

weaknesses and new tasks. OMB and congressional oversight for

future spending on computer security will be important to ensuring

that agencies are not using the funds they receive to continue ad

hoc piecemeal security fixes that are not supported by strong agency risk management process.

And, last, expanded research is needed in the area of information

security protection. While a number of research efforts are underway, experts have noted that more is needed to achieve significant

advances.

Mr. Chairman, this concludes my statement. I will be pleased to

answer any questions that you have at this time.

Mr. HORN. Well, thank you Mr. Dacey.

[The prepared statement of Mr. Dacey follows:]

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

Mr. HORN. We now go to Mark A. Forman, Associate Director,

Information Technology and E-Government, Office of Management

and Budget. Welcome here.

STATEMENT OF MARK A. FORMAN, ASSOCIATE DIRECTOR, INFORMATION TECHNOLOGY AND E-GOVERNMENT, OFFICE OF

MANAGEMENT AND BUDGET

Mr. FORMAN. Thank you, Mr. Chairman. Thank you for inviting

me here to discuss the administration’s efforts in the areas of computer security. Before getting to the substance of my testimony, I

would like to commend you and the committee for your past and

current efforts to shine the spotlight on Federal agency security

performance. I believe that only by keeping the pressure on this

issue will we get the improved performance, will we be able to

achieve and sustain the targets that we are all searching for

achieving.

As you know, the President’s given a high priority to the security

of government assets including information systems and the protection of our Nation’s critical information assets. The President has

taken a number of steps to address these risks. Last month the

President signed Executive Order 13228 which established the Office of Homeland Security and the Homeland Security Council.

The Executive order provides for the implementation of a comprehensive national strategy for detecting, preparing for, preventing, protecting against, responding to and recovering from terrorist

threats and attacks within the United States to work with Governor Ridge on issues related specifically to the topic of today’s

hearing—that is, the security of information systems—the President appointed Richard Clarke as Special Advisor for Cyberspace

Security and issued Executive Order 13231, ‘‘Critical Infrastructure

Protection in the Information Age.’’ The President has made OMB a member of both the Homeland

Security Council and the Critical Critical Infrastructure Protection

Board. We will help identify resource shortfalls and duplication and

ensure that funding requests are included in the President’s budget, as necessary, and properly managed when appropriated by Congress.

OMB’s presence on both organizations also reflects our statutory

role regarding the security of Federal information systems. Now,

over the last 3 years, Congress has passed two laws that have

helped to shape our current efforts in security. In 1998 the Government Paperwork Elimination Act, GPEA was passed. GPEA addressed OMB and agency responsibilities for conducting business in

an electronic environment and recognized that improved government performance demands an ability to broadly accept authenticated electronic business transactions. Last year, through passage

of the Government Information Security Reform Act, which we will

refer to as the ‘‘Security Act,’’ Congress strengthened the legal

framework for the executive branch to address computer security

needs.

Working within this legal framework, OMB is to continuously

improve Federal security programs. Our guidance ensures that

agency senior managers devote greater attention to security; requires agencies to tie security to their capital planning and investVerDate 11-MAY-2000 10:09 Oct 21, 2002 Jkt 000000 PO 00000 Frm 00037 Fmt 6633 Sfmt 6633 C:\DOCS\82173.TXT HGOVREF1 PsN: HGOVREF1
34

ment control process and to their budget as required under the

Clinger-Cohen Act, the Security Act, and indeed by our policy. It

helps agencies get user buy-in for security control and processes to

ensure that they enable business operations. It requires that security is part of agency program management. And it makes adequate security a condition for funding by requiring that security

controls and their costs be explicitly identified.

The agencies have reported that for fiscal year 2002 they are investing approximately $2.7 billion for security and critical infrastructure protection. Of course, there are embedded security elements such as software and protocols within our overall IT spending. So this is buried within a total information technology budget

for 2002 of approximately $45 billion.

But a high dollar figure says little about effective security. In

fact, we have done some analysis on our evaluation of the 2002 reports and we found there is no significant relationship between the

percent of IT spending on security to the security performance of

that agency.

Now, as you know, several of your ratings, based on our staff discussions, are a little tougher than ours. Some of yours are a little

lenient. If we were to add in your ratings though, I have no doubt

that would show a negative relationship between IT spending and

their security performance. So——

Mr. HORN. Let me just ask for a fact here, to get it in the record.

Is that figure you gave us $2 billion, was that it?

Mr. FORMAN. $2.7 billion.

Mr. HORN. $2.7. Does that include the intelligence hardware,

software?

Mr. FORMAN. It would for the Defense Department, but not for

Intelligence Community spending.

Mr. HORN. OK. Because I think some of that needs to be carved

out before we look at the 24 agencies, minus one or two. Go ahead.

Mr. FORMAN. In essence, we don’t believe that simply adding

more money will solve the problems. It has not worked for IT in

general. It shifts attention away from effective management and

investment of existing resources, and we don’t believe it will work

for IT security.

To ensure that security is addressed both in apportionment of

the 2002 agency funds and in their 2003 budget request, we have

established four criteria: First, agencies must report their security

costs for each measure and significant IT systems. Systems that

fail to document their security costs will not be funded.

Second, agencies must document in their capital asset plans that

adequate security controls have been incorporated into the lifecycle

planning and funding for each system.

Third, agency security reports and corrective action plans are

presumed to reflect agencies’ security priorities and thus are a central tool that we are using in prioritizing funding for systems at

the agencies.

And, four, agencies must tie their corrective action plans for a

system directly to the capital asset plan for that system, thereby

establishing the audit trail that we know that the actions are underway.

35

In September we began to receive the agency reports as required

by the Security Act. We are reviewing them now because we know

that there will be much consultation with the agencies regarding

their submissions. It is too early to make public our specific findings regarding any particular agency. I will point out at this point

that we do see the Defense Department is operating a significantly

higher level of performance in security than your ratings would

suggest. But later I will provide you some broad observations.

First I want to talk about our process and how we have gone significantly further than the law requires insofar as reporting and

follow-up. As you know, the Security Act’s reporting requirements

are relatively narrow, requiring only that the agency Inspectors

General submit an annual independent evaluation to OMB. But because security is a high priority for this administration, we have

expanded the Security Act’s reporting requirements. We have

issued guidance throughout the year on meeting these requirements, including detailed instructions to agencies on how to report

the results in an executive summary. To ensure that reporting does

not devolve into a paper drill, we are also requiring that agencies

produce for their own use and send to us copies of corrective action

plans and milestones for each weakness found by an IG evaluation,

a program review, or any other review conducted throughout the

year including GAO audits. These plans bring a discipline to the

process and make tracking progress much easier for all involved.

We will also seek brief quarterly certifications that corrective actions are on track. We intend to use the security reports from the

agencies, the information we have gathered from meetings with the

agencies on integrating security into their capital planning process

and in budget submissions with other sources to determine whether OMB must take steps to assist agencies in quickly correcting the

most serious weaknesses.

In general, based on the security reports, we found across the 24

CIO agencies that the most common problems involved inadequate

compliance with existing OMB security policies and a failure to follow the implementing guidance for the Security Act.

Based on our preliminary findings, agencies have to do a better

job testing and evaluating the basic security controls; improve the

ongoing maintenance of system security; greatly improve employee

training and awareness programs; do a better job integrating security into their capital planning and budgeting process; recognize

greatly increased risk of interconnection; require that every system

supporting operations and their assets are reviewed annually as

part of the program review; install readily available patches for

commonly known vulnerabilities. As you know this is a chronic

problem identified by GAO, the IGs, and most any security program in view.

It’s also commonly reported from FedCIRC and others as the

cause of some 90 percent of the successful attacks on the agency.

This list represents what I would call the blocking and tackling,

and not the policy gaps, but the details of what needs to be done

in the agencies.

The reporting requirements of the Security Act have given us a

starting point to measure the performance, a baseline. And this is

our first opportunity to analyze the comprehensive information

36

from agencies, and from this we can move forward on resolving the

security concerns.

I would also like to take a moment to update you on two other

security-related initiatives we are working on. The first involves

our E-Government initiatives. We are currently working with agencies on a number of high-payoff, cross-agency E-Government initiatives. All of these initiatives will address security within their business cases as we’re requiring a detailed business case be made for

each of them.

Additionally, we have three specific initiatives that deal with security issues.

First, E-authentication, ensuring that parties to a transaction

are authorized to participate, and it would ensure the integrity of

the transaction.

Second, the wireless networks initiative, ensuring effective and

interoperable communications between public safety officials

throughout all levels of government, Federal, State and local, before, during and after the response to an emergency.

And, third, disaster assistance and crisis response, providing a

one-stop portal containing information from all public and private

organizations involved in disaster preparedness response and recovery.

A second major issue on another front is that we are directing

large agencies under a Project Matrix view. Project Matrix identifies the critical assets within an agency, prioritizes them, and then

identifies interrelationships within that agency and beyond into the

enterprise architecture. Fiscal year 2002 funds will be re-allocated

to provide for Matrix review. Once the reviews have been completed at each large agency, OMB will identify cross-government

activities and the associated lines of business. In this way, we will

have identified both the vertical and the horizontal critical operations; in other words, within an agency or department and between agencies and department, and the assets and the relationships beyond government; in essence the government’s critical enterprise architecture.

I’d just like to sum up with a few comments. We are planning

to engage the agencies in a number of ways to address the problems that have been identified. We are going to be emphasizing

both the responsibilities and the performance of agency employees,

in addition to accountability for exercising those responsibilities,

and consequences for poor performance. At the same time, we are

going to focus on achieving sustained senior management attention

at the agencies. In the past this has been a chronic problem that

we at GAO and others have found over the years to be the underlying cause for poor security performance.

And, Mr. Chairman, as you know, I worked for many years on

the Senate Governmental Affairs Committee. Computer Security

Act oversight was part of my portfolio. And we have a chronic issue

of getting department secretaries and agency heads to focus on

this. I am quite pleased this year that in the agency it gives a report, it is a Security Act report. We had many agency heads and

secretaries signing-off on the report. So I am pleased that we are

finally starting to get the senior executive view in this important

issue.

37

In discharging our responsibilities under the Security Act, the director will be communicating with the appropriate agency heads to

impress upon them the true improvement in security performance

that has to come out of external oversight from OMB, the IGs and

GAO. Congressional committee is insufficient. It’s got to come from

within the agencies. So we’re impressing upon them the importance

of holding agency employees, including the CIOs and program officials, accountable for fulfilling their responsibilities under the Security Act. There have to be consequences for inadequate performance. We will also underscore an essential companion to that accountability, the clear and unambiguous authority to exercise those

responsibilities.

Again, I want to thank you and the committee for your help and

continued focus on this important area. It’s vital that we all work

together to maintain this as a priority issue, and thus promote a

more secure government. Thank you.

[The prepared statement of Mr. Forman follows:]

38

39

40

41

42

43

44

45

46

47

48

Mr. HORN. Thank you, Mr. Forman. Both you and Mr. Dacey

have fine careers in the private sector as well as the public sector,

and I guess I would ask you if you looked at these charts and the

subcommittees charts, what would you do if you were still in the

private sector?

Mr. FORMAN. Well, I have two—— Mr. HORN. Would there be a new computer director?

Mr. FORMAN. I have two views on this. No. 1, I would and I will,

as well as the Director of OMB, use your data and our data in communications as part of the 2003 budget process. That will go back

to the hill.

And as I indicated in our testimony, we have authorities on the

apportionment of funds in 2002. I think we have made clear that

we’re not going to fund systems that don’t meet the requirement

of what we require to be a valid business case, and computer security at the heart of that.

The second thing that I think we all need to be cognizant of, the

reports, as I read the evaluation, are based on valuation of agency

reports, you know, whether from the IGs and GAO, or from the

agency themselves. And I don’t believe we have the data that we

need into the details, so if I go into a server form or a data center

have they been pulling down, for example, the IIS patches that

they need to deal with Red Worm? We put out a call via FedCIRC

to get the CIOs to ensure that indeed this was occurring. And what

we found out is, yes, it had occurred. There were no issues in many

of the agencies. What we found out in some other agencies, this

was not on the platter of some of the CIOs. So when we get into

the details I think we are going to find a mixed bag, and I think

that is where we need to go over this next year.

Mr. HORN. Mr. Dacey, you have a similar career in the private

and public sector. What would you do if you had this bunch of

grades dumped on your desk some morning?

Mr. DACEY. Well, I think the first step is along the lines of what

Mark had said. I think you really need to take an assessment of

really how bad or good is your security, what’s working good and

what’s working bad. Since we started doing work probably in 1996,

generally in connection with the CFO Act and other congressional

requests, we have gained a lot more information as the years have

gone on and continued to find significant weaknesses in computer

systems. But I don’t think that we have an end-all analysis at the

type of detail level that Mark referred to.

So I would suggest the first thing to do which is contemplated

by the GISRA legislation is to go out and ensure that you really

understand the nature of those vulnerabilities and weaknesses. I

think, again, that needs to be done. We have not had time to really

analyze the GISRA reports to see how much additional work has

been completed beyond what was done before GISRA. But I think

that is an important area.

Second, I think it is important to realize that what needs to be

incorporated is really an acknowledgment that computer security is

part of your basic operations. It’s really a responsibility of everyone

in the agency, and you really need to put in place reasonable and

adequate computer security management programs to ensure that.

I think it is very important for management to have some regular

49

analysis of their systems as well in order to manage and maintain

some level of accountability and performance measurement. I think

those are important aspects of the GISRA legislation as well because we do have an annual accounting now, at least for the 2

years that the law currently covers, to address that issue, and

then, given the identification of these weaknesses, really setup a

very active plan to address them, including looking at ways to benefit from what is being done across other agencies.

What I see now a lot is each agency trying to address their computer security, setting up what they believe to be an adequate security process. Even within agencies, bureaus within agencies are

setting up sometimes vastly different levels of security based upon

their judgments. I think there needs to be a coalescing of some of

that information, establishment of some common level of controls,

at least a baseline, to tell people here’s what you really need to

have, and not have each agency try to figure out on their own how

they get to that point in time. Those are the kind of things I think

I would suggest from a private sector approach to try to address

a problem of this magnitude.

Mr. HORN. The chief information officers have a council, and they

have subcommittees and committees within that council. Are you

both members of that, or at least Mr. Forman for the administration?

Mr. FORMAN. I serve as the director for the council.

Mr. HORN. Yeah. Now, do you think they take this seriously, or

is this just regarded by either OMB or this subcommittee that they

say, oh, just another piece of paper we’ve got to fill out; how are

we going to solve that problem and get them involved to really

know it’s serious?

Mr. FORMAN. I think that they do take this seriously. As you

know, we have reorganized the council and haven’t completely finished the deployment of that. Security is one of the areas that we

are working through a number of options. But we have chosen to

disband for now the Security Committee, and I think it is important to understand why. We’ve got a good best practices guide out

of that committee. We had many members on that committee who

are in key agencies. We do not see any correlation based on the

data between membership on that committee and either your

scores or our scores of success. We need to get into the nitty-gritty

details.

We have a Work Force Committee. There are two key elements

of the workforce that we and the CIOs need insight on. No. 1, what

are the standards of performance for security personnel? What

types of skills should we be looking at, both in terms of who we’re

hiring and who are in those positions within the government. And

I’m forever cognizant of the fact that 80 percent of our IT work

force is through contractors. So what are the basic skills and capabilities we need? We need more insight on that and then we need

to hold the agencies accountable. That task was given to the Work

Force Committee.

The second type of work force skills, Web masters, Web designers, virtually everybody, every career field in IT, now has some aspect of security. So clarifying those responsibilities, those knowlVerDate 11-MAY-2000 10:09 Oct 21, 2002 Jkt 000000 PO 00000 Frm 00053 Fmt 6633 Sfmt 6633 C:\DOCS\82173.TXT HGOVREF1 PsN: HGOVREF1
50

edge requirements and skill requirements, is the other thing that

the Work Force Committee is doing.

The Best Practices Committee will continue to focus on best practices. We have chosen to give National Institute for Standards and

Technology a higher role in this arena as a source not only of the

Federal information processing standards, but also a terrific source

of best practices.

The third area in this is the architecture area. We have an Architecture Committee. We have to get agreement among the CIOs

of some of the common best practices as they relate directly to the

architectural elements. So it is my intent to force that debate and

that consensus building that we need via that committee.

Now we are looking at how do we best drive the cross-cut across

all the CIO agencies. And to date, quite frankly, I’ve been fighting

the maintenance of a committee just to talk about this, because we

do not see that correlation between committee membership and

success.

With that said, we have some other options. Do we appoint a

couple of people, CIOs that basically marshal across the other

standing committees to focus on security and ensure that it’s getting out to all the other CIOs? We had a roundtable discussion a

couple of weeks ago, a 2-hour discussion where the CIOs to a ‘‘T’’ were either there in person or there with their deputy CIO. So I

believe they are very focused on this issue. And we have a 5-page

list of ideas we need to focus on and alternative ways to handle

that. We are pulling that material together now. We will have another meeting and discussion of this at the CIO Council coming up

next month to make some choices on how we’ll proceed.

Mr. HORN. Were you at OMB when the argument—I don’t know

whether you have it an argument or what—between the council

and OMB as to what kind of questions ought to be used to look at

what the hardware and software are with these computer operations? And were you there when this particular group—and this

grading thing we have done is really just look at what OMB did,

send out to 24 of the major agencies and departments, and that’s

all we did. Do you think we have been unfair in reaction to these

grades?

Mr. FORMAN. I am not quite sure I understand the question, but

let me try.

Mr. HORN. Well, were you around when this particular inventory,

let’s say, was sent out by OMB, and we simply—and GAO—simply

said OK, they put the questions to them and let’s see if it works?

Mr. FORMAN. It actually occurred just before I came on board,

the original criteria were sent out.

Mr. HORN. So you’re innocent so far.

Mr. FORMAN. No. Hold me accountable. Let me give you my view

on this.

Mr. HORN. Yeah.

Mr. FORMAN. Accountability and authority go hand-in-hand for

me. If you hold me accountable, I have a way to hold the agency

accountable.

Mr. HORN. Good. We’ll do that. Maybe we’ll see you a few months

from now. And one of my friends in the Cabinet on the Y2K thing

simply took our grades and put it on his door, so every time a civil

51

servant went in to see him, that grade was right in their face. And

he said it helped, a little bit of—that grading got them moving. So

what else can we do? What else can you do? You’re the one now

on the frying pan.

Mr. FORMAN. As I mentioned, in preparation of the fiscal year

2003 budget, we have got some rather strong action that we intend

to take as part of the past act, discussions that I hope will lead to

reconciliation of gaps that we see and will address, some of the

poor grades that you see as part of the 2003 budget submission.

You will see that result, I hope, coming back very well in the President’s budget submission.

Second, as I mentioned, we intend to use the Clinger-Cohen Act

authorities on basically the apportionment process. So what I

would ask is your cooperation, because I am sure that there may

be other agencies or vendors that come to the Hill and talk about

how unfair that is. That will take persistence and backbone by all

of us to be true to these ideals.

Mr. HORN. How would the government have fared if, on September 11th, a cyberattack accompanied the physical attacks on the

Nation? Would that have got them moving on such things as security? Or is it just, as I said earlier, well, let’s see the paper, OMB.

We have been around here a long time and it’s the same old game.

So what do you think?

Mr. FORMAN. I think things have clearly shifted, and I would

daresay that it may not be as press-worthy. But if you look at the

worms that came out this summer, that our battle in the computer

security arena really started in perhaps the July timeframe when

the first of the worms started to hit. So I know from OMB’s standpoint all the way up to the director, this is, believe it or not, the

type of thing that we would talk about at these staff meetings. We

are very focused on this. And it started in July.

Mr. HORN. Well, when you provide us with examples of agencies

whose requests will not be funded because they’ve failed to document their security costs, that would be an example of getting their

attention. Is that what you’re planning to do?

Mr. FORMAN. Well, we hope that we will be able to——

Mr. HORN. Or are you being Mr. Nice Guy?

Mr. FORMAN. At some point, I’m sure that I’ll appreciate the time

when somebody calls me Mr. Nice Guy, after we go through this

budget process. We hope that based on the feedback that we’re giving to the agencies and will continue to give with the agency in

preparation for the 2003 budget, that we will reconcile these issues.

Obviously, if we are unable to reconcile the issues, that list will be

in the budget.

Mr. HORN. Do you agree with GAO’s recommendation to establish mandatory standards for Federal agencies?

Mr. FORMAN. I think it is a question of the details on the standards. I think we have laid out some fairly clear standards in both

the requirements for the government information Security Act reporting and within the guidelines of what we put into my testimony. I think a little bit more specific standards. The standards

that we have been promulgating along the lines of how do you hold

the agency accountable and link that to funding are actually in

52

both A–130 and the A–11, our basic budget documentation. So I

think that is consistent with what GAO is proposing.

I actually think there is another set of standards that get down

to the real technology. When do certain data elements have to have

a security wrapper, which with XML technology is currently available. When do certain elements of transactions or certain uses of

virtual private networks have to have encryption or other types of

security? It’s those standards that I want to get the agreement via

the CIO Council Architecture Committee, and that is the process

I would like to pursue for buy-in purposes.

Mr. HORN. Mr. Dacey, let me ask you on the September 11th

question, how would the government have fared if on September

11th a cyberattack accompanied the physical attacks on the Nation? How would GAO feel about that?

Mr. DACEY. Well it’s difficult to speculate what would have happened. I know on the physical side we had disruptions in communications and other areas. Fortunately at this point in time, we

haven’t suffered from disastrous effects of a cyberattack. As in our

testimony we stated, though, there are signs that things are getting more serious, more sophisticated, that it could really be a serious issue. Particularly when you look at how dependent we, the

Federal Government, are on computer technology and communications channels being available to do our business on a day-to-bay

basis. So I think when you look at those things, you have to start

analyzing what could go wrong.

And in terms of the critical infrastructure, I think that’s one of

the areas that Mr. Forman refers to needs attention and has been

given attention, and, through Project Matrix, has really had to

identify what those critical areas are so they be protected adequately; at least focus the priority on protecting those first to ensure they are protected.

But I think that is an exercise that needs to be done, certainly

in the Federal Government. And then as part of the overall CIP

structure, consideration of what needs to be done or what is being

done in the private sector. There’s a private sector partnership

here, because a lot of the critical infrastructures that even the Federal Government depends on for communication, electricity, and

others are all controlled by the private sector, mostly controlled by

private sector interests. So I think it is important that those be

dealt with, too.

So I think we have, certainly, challenges ahead of us to make

sure our systems are secure before something happens that is more

disastrous. Again, we’ve had a lot of attacks, it’s cost a lot of

money; I don’t want to diminish the fact that they haven’t been serious, because they have. A lot of productivity, a lot of money has

been lost. We had the testimony before this committee out in California in the field hearing and talked a little bit more about that

along with the other witnesses, but I think it is an issue that just

needs to be addressed now; and again in an organized fashion, not

to say that it isn’t, but it needs to go forward, again, with really

a strategic plan. And I think some of those things we’re starting

to see at this point in time.

Mr. HORN. Well, the General Accounting Office has been reporting on many security weaknesses in the Federal systems for—as

53

your testimony just notes—Federal systems for several years. Yet

based on today’s grades, agencies don’t appear to be making any

progress in strengthening their security. Do you agree?

Mr. DACEY. Well, I think we are seeing not necessarily every

agency, but many are making some significant progress in improving security. We talked about a couple of those certainly. We had

the issue to report earlier this year on the electronic filing system,

and IRS had taken extreme efforts to make sure that was secure

for this last filing season. We have had a lot of improvement to the

Department of Defense as well, although they continue to face challenges in putting together a security management program, they do

have some of the basic elements in place at this point in time. So

there have been improvements. What is really challenging I think

in this environment is that the pace of these risks is increasing extremely rapidly. Some of the factors that make it more of a risk are

increasing at a fast pace, so we are not dealing with a static target

that we need to hit. I think the target’s moving perhaps more

quickly than we are at this point. I’m not saying it is, but I’m just

saying that’s the challenge to keep up with that.

So I think in terms of perspective, again, a lot has happened.

Probably if you want to secure the systems, the pace may need to

be stepped up a bit from what it has been to catch up.

Mr. HORN. Do you feel any of these grades are being easy on people or being too tough on people? What’s your thinking on that?

Mr. FORMAN. I’m concerned just about some of the discrepancies.

You have a couple of grades that are easier than ours. We’re going

to hold the agencies accountable, I think, for the harder grades in

those cases. The Defense Department is the big gap that we see between our grades and where you graded it harder than we have.

I suspect that is because they came over and presented much more

material to us than your staffs had access to. You know, I don’t

know that would change necessarily the grades that you give them.

But that would be the only discrepancy, major discrepancy I would

say.

Mr. HORN. Which grades would be easier?

Mr. FORMAN. I’m probably not willing to get into that at this

point. We’re going to reserve that for the directors’ communications

with the agency heads.

Mr. HORN. So you’ve got sort of several professors down there

that are putting different kinds of grading or what? Or can you

agree on what an F means or an A means? Or is this the 60’s, anybody down there in the 60’s? Because if there are, you know, what

the heck, it’s just give everybody pass/fail.

Mr. FORMAN. No, there aren’t that many discrepancies. There are

very few discrepancies. Please let me leave it at that.

Mr. HORN. OK. We’ll see what happens in about 2 or 3 months

from now, see if we’ve made some real progress. And I am curious,

Mr. Forman, while I understand the government information security reform requirements do not establish a date by which OMB

must submit its required reports to Congress, when will OMB submit this report?

Mr. FORMAN. Our intent is to submit it with the budget. If it is

not with the budget, it will be very near to that submission. And

54

of course that goes along with the basic enforcement mechanism

that we are pursuing.

Mr. HORN. Well, that’s—I’m glad to hear because we were wondering where that was. You’re OMB’s associate director for IT and

E-Government, don’t agencies’ security weaknesses as indicated by

the deplorable grades we assigned today, post a formidable obstacle

to implementing more E-Government initiatives? How does OMB

and E-Government strategy explicitly address computer security?

Are we on the wrong thing, or how much of that, if you will look

at all of the inventory and the form, that was sent out by OMB,

is this a 5 percent or is it a 25 percent? Do they take it—how do

they take it? That’s what I’m after, in terms of percentage, that

they worry about and try to do something about.

Mr. FORMAN. Well, I think for each of the E-Government initiatives it is a 100 percent, because we made very clear that we are

going to use the A–11 guidance in putting together the business

case for each of these E-Government initiatives. In doing the work

of our quicksilver task force, our E-Government strategy team, we

identified several cross-cutting barriers. Of course, as you would

anticipate and as you pointed out, there are a number of securityrelated items that came out of that. And indeed, that is this E-authentication initiative that we’ve begun. That’s going to have a

business case as well. Now, we have included that in any one of

the customer segments, the bulk of our initiatives focus on a customer segment government, citizen government, and business etc.

The security initiative is a cross-cutting initiative. It relates to

agency-to-agency or within-agency transactions as well as interactions between Federal, State and local governments, governments and businesses, and government and citizens.

That business case, as all the business cases, will have to report

not just to me but to a steering group. The steering group will in

most of the initiatives be comprised of the different management

councils, CIO Council, etc. In this case, the steering group we’re

going to use is that Architecture Committee of the CIO Council. So

when we come to resolution on authentication and digital signature

and E-signature elements, which we found is the most critical element for the E-Government initiatives, that agreement has to get

the support of all of the CIOs because it has to be embedded across

the department and agencies.

There is another infrastructure issue that came out of the task

force, which basically I refer to as the business architecture analysis. And integrating that with the Project Matrix data at each department as we look across the business architecture, all the agency-to-agency interactions, is another level of analysis that we’ll continue to do coming out of the task force.

Mr. HORN. Let me ask Mr. Dacey. In your testimony, you state

the number of incidents are increasing, yet one agency, OPM, reported that during the past year it only experienced one security

incident which involved limited infection by the ‘‘I Love You’’ virus.

How do you react to this statement?

Mr. DACEY. Well, I think one of the challenges that we have is

twofold. First of all, one of the basic premises on security is to have

the first adequate level of security in place, particularly at your perimeters, for people to get into your systems, but security, as good

55

as it can be, is never going to be foolproof. So there is always going

to be opportunities for people to breach that, even in a good security situation.

So you really need to have effective incident detection processes

in place to identify when that has happened and to really identify

unusual or anomalous activities. I think what we are finding, both

in the Federal agencies as well as the challenge in the private sector, is the identification of that type of intrusion. I know one of the

parts of the GISRA legislation is that agencies have effective incident detection systems in place. In working and discussing things

with the CERT Coordination Center, which is funded heavily by

the Federal Government and receives a lot of information from

both private and public sector in terms of incidents, they said their

information indicates that as many as 80 percent of incidents are

not detected, and that is across the board. So I think we have a

tremendous challenge. That is in fact one of the areas that research

and development could really help to identify better techniques, because we do have a ways to go to really develop more effective

mechanisms to identify those.

The volume of scans and activities coming into any agency is

phenomenal. We have a rather small laboratory that we use to help

do the work that we do. We’ve gotten 3 million or so scans of our

system within 3 years, and that is something that is not well advertised, even our address. I know even at home personally, when

I go online, my firewall is picking up three or four incidents an

hour of someone trying to get access to my system. So activity is

happening out there. We just need to have a better system to figure

out what is valid and what is not valid in those systems, and it is

going to be a challenge.

Mr. HORN. Along this line, the subcommittee based its grades on

information submitted to OMB by the agency CIOs and IGs in

their reports on the annual agency security program reviews required by the Government Information Security Reform Act passed

last year as part of the fiscal year 2000 Defense Authorization Act.

Now, how do you account for the substantial discrepancies that

we noted in several cases between the CIOs report and those of the

Inspectors General? Are some agencies’ CIOs underreporting their

vulnerabilities?

Mr. DACEY. Well, I think one of the challenges as part of this

process—again, not having fully analyzed what was reported—is to

really get in place a mechanism whereby there can be some agreement on whether the security controls are effective or not. What we

have seen in the past is that a lot of the analysis and actual testing

of those systems is being done by the Inspectors General, and although we note some activity by managers actually testing their

own systems, we haven’t seen a lot of that happening to date. So

what I think you have oftentimes are situations where the ID is

actually going out as we do, trying to break into systems, trying

to really analyze those controls, and I think what we need to do,

which has started to happen with GISRA, is say, managers—program managers, you’re the ones responsible for security. It’s not

the GAO or the IG coming in every once in a while and doing a

testing of this system or that system. Management really needs to

put in place procedures and processes to monitor their own systems

56

on an ongoing basis regularly, which, again, GISRA facilitates that

through annual reporting processes.

So I think there are bound to be some difference, at least initially. I would hope that over time, though, that if the agency manages to actively test their own system, which is a very important

piece of the legislation, that they will find similar types of weaknesses, and you’ll reach some conversions. There’s always going to

be some differences in judgment, of course, but I think overall that

is the biggest difference now, is the methods by which maybe that

management was obtained. A lot of this information from the management side may have been through just various means, assessments, questions that went out to the field and talked about

whether the security is adequate and what they have done. I don’t

know.

Mark may be able to shed some more light, because we haven’t

been privy to all the detailed information, but again, that would be

one potential area as to why there are some differences and how

those two might converge in the future.

Mr. HORN. When we went through the Y2K situation, Mr.

Koskinen was the Deputy Director for Management. Nothing much

happened, and he retired, and then the President very well called

him back, and he was a friend of the President’s, and much like

Governor Ridge, that—he’s got Mr. Clarke, a lot of respect for both

the Governor and Mr. Clarke on these matters. If I were a Deputy

Secretary or something, I’d sure want to please him. So the question is, is he the Lone Ranger that comes in across the prairie and

you guys are just waiting for him to do your jobs? How do they

think about that at OMB?

Mr. FORMAN. First of all, in both Executive orders, it is very

clear that OMB maintains its role for the oversight and management, if you will, of agency security. So while we’re disbanding the

CIOs Council Security Committee, under the Executive order in the

Critical Infrastructure Protection Board, OMB does chair a security

committee that has been created for Federal infrastructure. So the

linkage and the working relationship will be very good, I think.

Not at all would I say that we’re going to toss our responsibility

up the hill. This will be another area where we hope to be held accountable for the work, but I want to build on something that Mr.

Dacey said. You know, when we look at this, ultimately it’s got to

be built into—we’ve got to have security built into the actual programs. GAO several years ago laid out how do you manage capital

investments in general. Our focus on the business case process is,

I believe, the appropriate focus that we should move forward. So

in the capital planning process, the first step is make sure security

is part of the business case, and that is essentially the phase that

we’re in now in driving into the agencies. I think by us saying

we’re simply not going to fund the business case that does not incorporate the appropriate security controls, complies with that first

phase of GAO’s three-part practice.

The next phase is the actual program control. Is it actually being

built in? Are the agencies and are the program managers working

on the security components or modules as they execute that program? The third phase is the followup, and it is not just lessons

learned and best practices. I think that’s exactly as Mr. Dacey has

57

said, we’ve got to have the affirmative testing, that in fact the security is break-proof at that point.

The difficulty is every time you move forward in preventative approaches for security, the hackers move forward in a way to break

through that. So we’re dealing a little bit with the moving target.

We have to make sure that is integrated and updated, and I’m a

big fan of maintaining the business cases and controls over those

business cases. So I believe that the approach that’s been laid out

for capital investment management is the same that we should be

employing here.

Mr. HORN. Are you seeing any changes or new computer security

initiatives within the agencies since September 11th?

Mr. FORMAN. Absolutely. We have much help from our friends on

the Hill. As you know, we have at least one bill suggesting that we

spend $1 billion more on computer security. We appreciate the cooperation and the focus on security. Clearly, more money is not the

issue. Focus is, and the details, as I think you’ve focused on in your

scores where we need to look.

Mr. HORN. And you’re saying how much do you think you can get

out of them this time? Because I went around last year with the

number of things the executive branch wanted, and some of them

got it and some of them didn’t. It was a little haphazard. So it is

nice for OMB and you to get it moving. And how much do you

think you can get from them?

Mr. FORMAN. In terms of focus on this, I have to say based on

the reports that have been submitted—and, again, I’m quite impressed with this—this is the first time that I have seen Secretary

level or agency head level focus on this issue. And so I think that

occurred before September 11th. This was—the reports came in

September 10th, and it’s just I think after that become all the more

important and it’s recognized. I hope we get full compliance by the

Secretaries. Our intent is in the process between now and the final

submanagers of the budget, that we will have that communication

at the level of the OMB Director to the Secretaries of the agencies.

Mr. HORN. Mr. Forman, we discussed that OMB and CIOs and

IGs and their reports, and that those were required by the Government Information Security Reform Act passed last year as part of

the fiscal year 2000 Defense Authorization Act, and I’d like it on

the record, is OMB satisfied with the quality of these reports and

how do you account for the substantial discrepancies that we noted

in several cases between the CIOs reports and those of the IGs and

are some agency CIOs underreporting their vulnerabilities?

Mr. FORMAN. When you say are we satisfied with the quality of

the reports, are we satisfied with the quality of the content or the

completeness of the reports, I guess would be my question? I think

that in both cases, we’d say we’re not fully satisfied. So let me explain that a little bit. This is the best set of information that we’ve

had so far going back to 1987 in the Computer Security Act on

agency assessments. We want more. That’s the bottom line.

In some cases, the agencies have come back afterwards and provided us the additional information, in many cases. Are we satisfied with the content? There are clear examples of dramatic

progress versus the information that we had received before. I

would say that the high—areas where you have given agencies

58

higher grades are not an area where we are seeing any of the agencies. So my answer would be, as has been said before I believe before this committee, I don’t do C work. I don’t want the agencies

to do C work. I’m not satisfied.

Mr. HORN. Good. Glad to hear it. How long will it take you to

turn them around?

Mr. FORMAN. I don’t know the answer to that. I’d like to be able

to come before you a year from now and to say that we’ve got a

substantial amount of Bs. That clearly is where we’d like to go. On

the other hand, as I’ve said before, there’s another level of details

associated with what we’ve got to get across the CIOs. The work

force skills and the compliance with those skills that may not show

up in the reports, the agreement on some of these security protocols and standards and so forth, that I believe is a critical element

of how you should hold me accountable. But again, that won’t show

up in these reports. So I’ve got a lot to do, and I don’t know if I

can get to that level of B in a year from now.

Mr. HORN. To what degree does the President and OMB and all

of those who see the retiring situation in the bureaucracy and how

we replace it with very committed people and have understanding

of the new world that they didn’t come out of 20, 30 years ago? So

are we going to get some incentives of getting new people into the

government where we need them badly and get people to go around

to the State universities in particular, I would think, and—but I’m

a bias there. And those are the people that stay with it, when I

looked at them in a study 30 years ago, and it still seems to be

true. So what’s the plan?

Mr. FORMAN. Absolutely, on the work force we’re taking a number of initiatives, and, again, I’d say that these are in two prongs.

One, the types of security personnel or computer security,

cybersecurity personnel that we’re hiring, their skill-sets, how we

build their competencies and indeed the training program. The second is in a number of other job categories, Web masters, Web applications designers, the skills to do object-oriented architectures and

so forth. So we have to ramp-up those skills.

Now, one point that I have to make here is that the vast majority

of our work force are not Federal employees. I think we’ve made

tremendous progress with the CIO Council Workforce Committee,

under Gloria Parker and Ira Hobbs, to move forward on a curriculum. You may be familiar with the CIO university concept that basically lays out a curriculum for graduate school and related training. What we’re finding is that as much or more contractor personnel are going through this course work than Federal employees. So

we’re making—which should be, you know, given the ratio of our

work force, Federal versus contractor, we should be seeing that.

We’re making that progress, and I will continue to push forward

in that arena.

Mr. HORN. Well, thank you very much. It’s been a useful situation of going through these things, and I think 1 year is too much

to wait, and we’re going to have to think about it in maybe a

month and a half and 2 months and a half to get, and I would hope

OMB would say, get with it, and then we don’t have to give Fs.

So—and as you say, you don’t want to have a C student there eiVerDate 11-MAY-2000 10:09 Oct 21, 2002 Jkt 000000 PO 00000 Frm 00062 Fmt 6633 Sfmt 6633 C:\DOCS\82173.TXT HGOVREF1 PsN: HGOVREF1
59

ther. Often they’re the ones, however, that are hiring people of a

grant and what not and get rather rich in Silicon Valley.

So anyhow, we thank you for coming, and I want to thank the

staff here that helped put it all together and worked with us in

terms of the grading situation. Russell George, staff director and

chief counsel; Bonnie Heald, the deputy staff director; Elizabeth

Johnston to my left, professional staff; Darren Chidsey, professional staff, Earl Pierce, professional staff, and Jim Holmes and

Fred Ephraim, interns. We’re glad to have them, and on the minority side, David McMillen, professional staff; Jean Gosa, minority

clerk; and our faithful court reporters are Christina Smith and

Michelle Bulkley. So thank you.

And with that, we’re adjourned.

[Whereupon, at 11:12 p.m., the subcommittee was adjourned.]

[Additional information submitted for the hearing record follows:]

60

61

62

63

64

65

66

67

68

69

70

Æ