U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

82–355 PDF 2002

LESSONS LEARNED FROM THE GOVERNMENT

INFORMATION SECURITY REFORM ACT OF 2000

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY,

FINANCIAL MANAGEMENT AND

INTERGOVERNMENTAL RELATIONS

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SEVENTH CONGRESS

SECOND SESSION

MARCH 6, 2002

Serial No. 107–124

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

MARK E. SOUDER, Indiana

STEVEN C. LATOURETTE, Ohio

BOB BARR, Georgia

DAN MILLER, Florida

DOUG OSE, California

RON LEWIS, Kentucky

JO ANN DAVIS, Virginia

TODD RUSSELL PLATTS, Pennsylvania

DAVE WELDON, Florida

CHRIS CANNON, Utah

ADAM H. PUTNAM, Florida

C.L. ‘‘BUTCH’’ OTTER, Idaho

EDWARD L. SCHROCK, Virginia

JOHN J. DUNCAN, JR., Tennessee

——— ———

HENRY A. WAXMAN, California

TOM LANTOS, California

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

JANICE D. SCHAKOWSKY, Illinois

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

JAMES C. WILSON, Chief Counsel

ROBERT A. BRIGGS, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY, FINANCIAL MANAGEMENT AND

INTERGOVERNMENTAL RELATIONS

STEPHEN HORN, California, Chairman

RON LEWIS, Kentucky

DAN MILLER, Florida

DOUG OSE, California

ADAM H. PUTNAM, Florida

JANICE D. SCHAKOWSKY, Illinois

MAJOR R. OWENS, New York

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

CLAIRE BUCKLES, Professional Staff Member

JUSTIN PAULHAMUS, Clerk

DAVID MCMILLEN, Minority Professional Staff Member

(III)

C O N T E N T S

Page

Hearing held on March 6, 2002 .............................................................................. 1

Statement of:

Dacey, Robert F., Director, Information Security, U.S. General Accounting

Office; Mark A. Forman, Associate Director, Office of Information Technology and e-Government, Office of Management and Budget; Arden

L. Bement, Jr., director, National Institute of Standards and Technology; Roberta L. Gross, former Inspector General, National Aeronautics and Space Administration; Robert G. Gorrie, Deputy Staff Director, Defense-wide Information Assurance Program Office, Office of

the Assistant Secretary of Defense for Command, Control, Communications and Intelligence; and Karen S. Evans, Chief Information Officer,

Department of Energy .................................................................................. 17

Davis, Hon. Thomas M., a Representative in Congress from the Commonwealth of Virginia ......................................................................................... 6

Letters, statements, etc., submitted for the record by:

Bement, Arden L., Jr., director, National Institute of Standards and

Technology:

Followup questions and responses ........................................................... 120

Prepared statement of ............................................................................... 73

Dacey, Robert F., Director, Information Security, U.S. General Accounting

Office, prepared statement of ....................................................................... 20

Davis, Hon. Thomas M., a Representative in Congress from the Commonwealth of Virginia, prepared statement of .................................................. 10

Evans, Karen S., Chief Information Officer, Department of Energy, prepared statement of ........................................................................................ 109

Forman, Mark A., Associate Director, Office of Information Technology

and e-Government, Office of Management and Budget, prepared statement of ........................................................................................................... 54

Gorrie, Robert G., Deputy Staff Director, Defense-wide Information Assurance Program Office, Office of the Assistant Secretary of Defense

for Command, Control, Communications and Intelligence, prepared

statement of ................................................................................................... 98

Gross, Roberta L., former Inspector General, National Aeronautics and

Space Administration, prepared statement of ............................................ 86

Horn, Hon. Stephen, a Representative in Congress from the State of

California, prepared statement of ................................................................ 3

Schakowsky, Hon. Janice D., a Representative in Congress from the

State of Illinois, prepared statement of ...................................................... 69

(1)

LESSONS LEARNED FROM THE GOVERNMENT

INFORMATION SECURITY REFORM ACT OF

2000

WEDNESDAY, MARCH 6, 2002

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY, FINANCIAL

MANAGEMENT AND INTERGOVERNMENTAL RELATIONS,

COMMITTEE ON GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 10 a.m., in room

2154, Rayburn House Office Building, Hon. Stephen Horn (chairman of the subcommittee) presiding.

Present: Representatives Horn, Schakowsky, and Maloney.

Staff Present: J. Russell George, staff director and chief counsel;

Bonnie Heald, deputy staff director; Claire Buckles, professional

staff member; Justin Paulhamus, clerk; Michael Sazonoff, intern;

David McMillen, minority professional staff member; and Jean

Gosa, minority assistant clerk.

Mr. HORN. A quorum being present, the Subcommittee on Government Efficiency, Financial Management and Intergovernmental

Relations will come to order.

The Federal Government relies on computer systems to provide

essential services to the Nation and its people. These large, complex systems help regulate the economy, collect taxes, pay benefits,

and defend the Nation. The speed and accessibility of the technology have greatly enhanced government operations and have provided citizens with nearly instant access to their government.

Yet, those operations are at risk. Computers at the White House,

the Department of Defense, the Department of the Treasury, and

the Department of the Interior have all been successfully attacked.

The security vulnerabilities at the Department of the Interior are

so severe that a U.S. District Court judge in Washington has ordered the Department to disconnect its Trust Asset and Accounting

Management System from the Internet. This system handles about

$500 million a year in royalty and lease payments to Native Americans.

These are not the only troubled agencies, however. In November

2001, the subcommittee issued its second annual report card grading computer security efforts at 24 major executive branch agencies. Overall, the executive branch earned an abysmal grade of ‘‘F.’’

That grade was the same during the Clinton administration and

now the Bush administration.

2

We have known for more than a decade that the government’s

information systems are vulnerable, yet little has changed. In a report issued last month, the Office of Management and Budget concluded that a significant part of the problem falls to senior managers who have failed to focus sufficient attention on computer security. I agree. The various bureaucracies need to be pushed by the

political appointees, so we can have a better record.

Since 1987, Congress has passed legislation to address Federal

computer security weaknesses. The most recent law, the Government Information Security Reform Act, was enacted in the year

2000. This law requires Federal agencies to assess the nature and

sensitivity of the information stored in their computers and then

develop appropriate security plans to protect that information. In

addition, it requires that, for the first time, agencies conduct annual computer security evaluations and report the results to the

Office of Management and Budget.

Agencies filed their first reports in September 2001. Clearly, the

full benefits of the law have not been realized. Agencies have not

yet developed security plans that balance protection and risk. However, they are beginning to focus on the problem. The act is scheduled to sunset next year.

Today’s hearing will explore how Federal agencies have implemented the act and what additional steps might be taken to ensure

that effective safeguards are in place. We must identify the weaknesses in order to correct them. We must use the ‘‘lessons learned’’ from the Government Information Security Reform Act to take effective, urgently needed action to ensure that it is reauthorized and

improved.

I welcome today’s witnesses, and I look forward to working with

each of you to ensure the security of the government’s information

technology resources.

I will enter into the record at this point as an exhibit after my

opening remarks the Computer Security Report Card of November

9, 2001.

[The prepared statement of Hon. Stephen Horn follows:]

3

4

5

6

Mr. HORN. The ranking member is coming, and I see that my colleague, Mr. Davis, has been here now as panel one, and we’re delighted to have you here. You have been a major force in the work

of e-government and the work of technology generally. So the gentleman from Virginia, Mr. Davis.

STATEMENT OF HON. THOMAS M. DAVIS, A REPRESENTATIVE

IN CONGRESS FROM THE COMMONWEALTH OF VIRGINIA

Mr. DAVIS. Let me first commend you and your staff for the tremendous work you have done on Federal information security during your tenure as chairman of this subcommittee and your previous chairmanship of the Government Management, Information,

and Technology Subcommittee. It’s a privilege working with you on

this critical topic.

I want to thank you for giving me the opportunity to speak on

this issue in the context of today’s hearing, examining the lessons

learned from the implementation of the Government Information

Security Reform Act of 2000 [GISRA].

Unquestionably, the events of September 11th and the ensuing

war on terrorism have produced a variety of responses throughout

the world. Nowhere has the response been so fervent as here in our

Nation’s Capital. From the creation of the new Office of Homeland

Security to security-related legislation, there is an unprecedented

awareness of the vulnerabilities we face.

This new awareness has naturally focused more attention on security matters, particularly with respect to information security.

Yet, this issue and the fact that Federal information systems continue to be woefully unprotected from both malevolent acts and benign interruptions have presented a grave concern to me for a

number of years. I know that you and the members of this subcommittee share that concern as well.

From our work in the Government Reform Committee, it is clear

that the state of Federal information security suffers from a lack

of coordinated, uniform management. Resolving this problem becomes even more imperative when you consider the many objectives we hope to achieve through the efficient and cost-effective use

of information technology and the advancement of electronic government. These objectives include electronic procurement, telecommuting, a comprehensive information-sharing network, and improved provision of services to citizens and businesses. The common element of these goals is the interconnectivity that they each

require to facilitate communications between different public and

private entities.

Poor information security management has persisted in both the

public and private sectors long before IT became the ubiquitous engine driving governmental, business, and even home activities.

After all, the information security implicates both the physical and

the cyber-environment.

A decade ago, technology stood as one of many factors important

to the mission and performance objectives of the Federal Government. But no longer is technology ‘‘one of many.’’ Instead, the Information Revolution and the ever-evolving technologies that support

its collection, assimilation, and communications have become integral to the functioning of our government.

7

As our reliance on technology and our desire for interconnectivity

have grown over the past decade, intensifying with the advent of

the Internet, our vulnerability to attacks has grown exponentially.

The high degree of interdependence between information systems,

both internally and externally, exposes the Federal Government’s

computer networks to benign and destructive disruptions. This fact

is tremendously important in understanding how we devise a comprehensive and yet flexible strategy for coordinating, implementing,

and maintaining Federal information security practices throughout

the Federal Government as the threat of electronic terrorism increases.

Yet, Federal information security management continues to falter. Despite consistent evaluations since 1997 showing that Federal

information security is a government-wide, high-risk issue, GAO

continues to find ‘‘pervasive and continuing weaknesses.’’ And, of

course, as this subcommittee found last November, 16 of the 24

Federal agencies evaluated in 2001 each received a disappointing

grade of ‘‘F,’’ with only one agency receiving a grade higher than

a ‘‘C+.’’ Of course, while these grades are disappointing, they reflect the

difficulty of implementing effective security management without

sufficient commitment and guidance from an accountable entity

within each agency, and for the Federal Government as a whole.

In July 2000, I introduced legislation that would have created,

among other things, a new Federal Chief Information Officer in the

Executive Office of the President. One of the primary components

of that bill expanded upon the then yet-to-be-enacted Government

Information Security Reform Act [GISRA], introduced by Senators

Fred Thompson and Joe Lieberman.

My legislation, entitled, ‘‘the Federal Information Policy Act’’ [FIPA], reflected my firm belief that there needs to be an executive

branch office that holds both the prestige and the accountability for

strategically modernizing our stovepipe IT structure. At the same

time, that office must have the authority to prioritize cross-jurisdictional e-government initiatives and networked information and

telecommunications networks, in order to achieve efficiencies and

secure Federal information systems.

With the establishment of a new office of Associate Director of

IT and Electronic Government within the OMB, I have opted to

withhold the reintroduction of Federal CIO legislation until I have

had an opportunity to evaluate the progress that OMB has been

able to achieve in carrying out the administration’s Enterprise Information Management and Integration initiative.

That said, my concerns regarding the pervasive and persistent

weaknesses in Federal information security management, infrastructure, and accountability remain strong. These are concerns I

know you also share, Mr. Chairman, and I applaud your subcommittee’s steady work in bringing to the forefront the critical

need for immediate and focused attention on this issue.

Yet, I would add that, to the extent that increased security concerns rely on the ability of the public and private sectors to share

information securely, it is even more critical that the Federal Government put its own house in order with respect to the security of

its own Federal information and telecommunications systems. It is

8

for this reason that I have just introduced legislation similar to the

information security provisions in FIPA, and I am very pleased

that you have agreed to co-sponsor this measure with me, Mr.

Chairman.

The overall purpose of these efforts is to strengthen the information security management infrastructure of the Federal Government. The bill, entitled, ‘‘the Federal Information Security Management Act’’ [FISMA], undertakes this objective by building on the

foundations laid out by GISRA. As you know, GISRA requires

every Federal agency to develop and implement security policies

that include risk assessment, risk-based policies, security awareness training, and periodic reviews.

With GISRA set to expire on November 29th of this year, the

Federal Information Security Management Act permanently reauthorizes this legislation and implements additional measures designed to enable the Federal Government to become a reliable public partner for protecting America’s information highways. In general, FISMA streamlines GISRA’s provisions and requires that

agencies utilize information security best practices that will ensure

the integrity, confidentiality, and availability of Federal information systems.

Moreover, the bill seeks to strengthen the role played by the National Institute of Standards and Technology in developing and

maintaining standards and guidelines for minimum information security controls. Agencies would be required to identify the risk levels associated with their systems and implement the appropriate

level of protections accordingly. This latter objective is especially

important in light of the interconnectivity of information systems.

We need to implement a framework that ensures that when systems interconnect with each other, there is a uniform management

infrastructure and universal benchmark for measuring the risks

and vulnerabilities of Federal information systems.

We cannot afford to delay enactment of this legislation. At a time

when uncertainty threatens confidence in our Nation’s preparedness, the Federal Government must make information security a

priority. I am heartened by the President’s bold commitment to

tying the budget process to individual agency performance, and to

using information security as one measurement of that performance. However, the information security cannot go the way of any

other ‘‘issue du jour.’’ It is a constant management requirement

that requires eternal vigilance, and the ranking of its importance

to Federal operations cannot fluctuate from one administration to

the next.

It is my hope that we take this opportunity, in the context of extending GISRA, to signal Congress’ deep concerns that information

security is not being taken seriously by every agency and department. We must demand that in our networked era, where technology is the driver, every Federal information system must be

managed in a way that minimizes both the risk that a breach or

disruption will occur and the harm that would result should such

a disruption take place.

We will learn a lot today as we determine the impact that GISRA

has had on the information security practices throughout the Federal Government. I very much look forward to working with you,

9

Mr. Chairman, the members of this subcommittee, and other concerned Members of the House and Senate as we move forward on

strengthening GISRA and improving our government’s overall information security management. Thank you.

[The prepared statement of Hon. Thomas M. Davis follows:]

10

11

12

13

14

15

16

Mr. HORN. I thank you for all the work you have done. Could you

translate those two things, like ‘‘FISMA’’, was it, or something?

Mr. DAVIS. Right, it’s the Federal Information Security Management Act. Of course, GISRA was the previous act.

Mr. HORN. Now is it true that Mr. Richard Clark is really fulfilling the office that you and some of our friends in the Senate wanted to do?

Mr. DAVIS. Part of it. I think that is as close as we can come to

it, yes, sir.

Mr. HORN. Yes. Well, my understanding is that he is a pretty

tough-minded person.

Mr. DAVIS. He is a tough-minded guy.

Mr. HORN. So that is what we want.

Mr. DAVIS. Exactly.

Mr. HORN. OK. So, in a sense, part of that which everybody has

wanted is now underway. So we just have to wait to see what OMB

and he do to get the thing done.

Mr. DAVIS. Mr. Chairman, the question always is you have a

tough-minded person, but how much authority do they actually

have, when push comes to shove? When they get on the phone, who

are they calling from, how seriously are they taken at the other

end of the line? That is what really remains to be seen.

Mr. HORN. Yes, well, you are certainly right on that. If the President backs him up, the Cabinet Secretaries I am sure will listen,

and if it becomes part of a Cabinet agenda, that will help on this.

Mr. DAVIS. Mr. Chairman, as you know, we went through this

with the Y2K issues—— Mr. HORN. Right.

Mr. DAVIS. [continuing]. Where they went through two or three

czars.

Mr. HORN. Right.

Mr. DAVIS. Most of them having two or three other jobs and not

having the clout until the administration finally brought in the appropriate person who had the clout and put it together at the end.

Mr. HORN. And had the ear of the President.

Mr. DAVIS. Yes, had the ear of the President.

Mr. HORN. Knew him before he was here.

Mr. DAVIS. Exactly, and, more importantly, when they called, the

people on the other end of the phone knew that he was speaking

for the President.

Mr. HORN. Yes.

Mr. DAVIS. And John Koskinen turned that around.

Mr. HORN. Right. Well, thank you very much——

Mr. DAVIS. Thank you.

Mr. HORN [continuing]. For your presentation. If you would like

to stay with us, we are delighted to have you, if you wish.

Mr. DAVIS. I will stay for a few minutes. Thank you, Mr. Chairman.

Mr. HORN. OK. We will now swear in panel two, and that is Robert F. Dacey, Director, Information Security, U.S. General Accounting Office; Mark A. Forman, Associate Director, Office of Information Technology and E-Government, Office of Management and

Budget; the Honorable Arden L. Bement, Jr., Ph.D., Director, National Institute of Standards and Technology; the Honorable RoVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
17

berta L. Gross, Former Inspector General, National Aeronautics

and Space Administration; Robert G. Gorrie, Deputy Staff Director,

Defense-wide Information Assurance Program Office, Assistant

Secretary of Defense for Command, Control, Communications and

Intelligence, and our last presenter on this panel will be Karen S.

Evans, Chief Information Officer, Department of Energy.

As you know, since this is an investigating subcommittee, you

raise your right hands to accept the oath.

[Witnesses sworn.]

Mr. HORN. The clerk will note that all six witnesses affirmed.

Please be seated. We will start with Mr. Dacey, the Director of

Information Security, U.S. General Accounting Office, which is

Congress’ right arm in terms of getting things done. GAO is presided over by the Comptroller General of the United States. We

have a first-rate person in that role right now in General Walker.

So we are always glad to hear what the General Accounting Office

has to say on these areas.

STATEMENTS OF ROBERT F. DACEY, DIRECTOR, INFORMATION SECURITY, U.S. GENERAL ACCOUNTING OFFICE; MARK

A. FORMAN, ASSOCIATE DIRECTOR, OFFICE OF INFORMATION TECHNOLOGY AND E-GOVERNMENT, OFFICE OF MANAGEMENT AND BUDGET; ARDEN L. BEMENT, JR., DIRECTOR,

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY;

ROBERTA L. GROSS, FORMER INSPECTOR GENERAL, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION; ROBERT G. GORRIE, DEPUTY STAFF DIRECTOR, DEFENSE-WIDE

INFORMATION ASSURANCE PROGRAM OFFICE, OFFICE OF

THE ASSISTANT SECRETARY OF DEFENSE FOR COMMAND,

CONTROL, COMMUNICATIONS AND INTELLIGENCE; AND

KAREN S. EVANS, CHIEF INFORMATION OFFICER, DEPARTMENT OF ENERGY

Mr. DACEY. Mr. Chairman and members of the subcommittee, I

am pleased to be here today to discuss the Federal Government’s

first-year implementation of government information security reform provisions. As you requested, I will briefly summarize our

written statement.

Federal agencies rely extensively on computerized systems and

electronic data to support their missions and critical operations.

Concerned with reports that continuing pervasive computer security weaknesses place Federal operations at significant risk of disruption, tampering, fraud, and inappropriate disclosures of sensitive information, the Congress enacted the reform provisions to

reduce these risks and provide for more effective oversight of Federal information security.

Mr. Chairman, as you know, we have been conducting a review

of the implementation of the reform provisions for you and the

Ranking Member. Today I will provide a preliminary result of our

review.

The initial implementation of reform provisions is a significant

step in improving Federal agencies’ information security programs

and addressing their information security weaknesses. The legislation consolidates information security requirements into an overall

management framework covering all agency systems. It adds new

18

statutory evaluation and reporting requirements and OMB and

congressional oversight.

Agencies have noted a number of benefits of this first-year implementation, including increased management attention to, and accountability for, information security. In addition, the legislation

has resulted in other important actions by the administration, such

as plans to integrate information security into the President’s management agenda scorecard. Also, agencies have taken steps to redesign and strengthen their information security.

OMB oversight, which included formal guidance, review and

analysis of agency-reported material, agency discussion and feedback, and monitoring of corrective actions, has helped agency implementation and reporting efforts. Although agencies generally

considered OMB guidance beneficial, the initial implementation of

reform provisions highlighted the need for further guidance in several areas.

Last month OMB released its first required annual report to the

Congress on the results of agency implementation efforts. As a result, in this report OMB commended agency improvement efforts,

but noted that many agencies have significant deficiencies in every

important area of security. OMB also identified a number of common agency security weaknesses, including lack of senior management attention, inadequate accountability for job and program performance, and a limited capability to detect vulnerabilities or intrusions.

We agree that OMB’s report to the Congress and the agency reports are a valuable baseline and believe that OMB’s report provides a useful overview of OMB and agency efforts to comply with

the reform provisions. I would like to personally commend the

OMB staff for their efforts in this endeavor.

Nonetheless, certain additional information, including the adequacy of agency corrective action plans and the results of audits of

evaluations for national security systems, is needed by Congress to

fully assess and oversee these efforts and deliberate over agency

budgets.

OMB has not authorized agencies to release some agency material, such as agency corrective action plans, to the Congress or

GAO. We plan to continue working with OMB in an effort to find

workable solutions to obtain this information.

Agency reports to OMB show that agencies have not established

information security programs consistent with the provisions of the

legislation and that significant weaknesses exist. Although agency

actions are now underway to strengthen information security and

implement these requirements, significant improvements will require sustained management attention, as well as OMB and congressional oversight.

The IG’s independent evaluations of agency implementation efforts also played a key role in the implementation process. The IG’s

first-year efforts were largely based on existing or ongoing audit

work that had been planned to evaluate agency information security, which in a number of instances consisted primarily of audits

of financial systems.

While their future efforts should expand to include more systems,

the IG’s first-year evaluations helped to identify significant weakVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00022 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
19

nesses in all 24 agencies, weaknesses that were not always identified by agencies in their reports.

Given the recent events and reports that critical operations and

assets are highly vulnerable to cyber-attack, it is essential that

Congress have adequate information to oversee and fund the Federal information security efforts, and that these efforts be guided

by a comprehensive strategy for improvement. In addition, there

are a number of important steps that the administration and the

agencies should take, including delineating the roles and responsibilities of the numerous entities involved in Federal information

security and the related aspects of critical infrastructure protection,

providing more specific guidance to agencies on the security controls they need to implement, and allocating sufficient agency resources for information security.

Mr. Chairman, this concludes my statement. I would be pleased

to answer any questions that you or other members of the subcommittee may have.

[The prepared statement of Mr. Dacey follows:]

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

Mr. HORN. Thank you very much for that succinct opening.

Mark A. Forman is the Associate Director, Office of Information

Technology and e-Government, Office of Management and Budget.

Welcome.

Mr. FORMAN. Thank you, Mr. Chairman, and thank you, Congressman Davis, both for your leadership and your vision as it relates to e-government and computer security. Having your focus

and the oversight on this issue is critically important to the success

of the initiatives that we are trying to accomplish for governmentwide security. We understand not only the need for this, but we appreciate your having the hearing and the focus on this.

I would like to say good morning and thank you for inviting me

here to discuss the lessons learned from the implementation of the

Government Information Security Reform Act. I, too, have submitted the prepared testimony, and I will take a synopsis of that in

my oral presentation.

As you know, the President has given a high-priority to security

of government assets, and this includes government information

systems and protection of the Nation’s critical information assets

from cyber threats and physical attack. We believe that protecting

the information and the information systems on which the Federal

Government depends requires agencies, first, to identify and resolve the current weaknesses and risks, as well as to then protect

against the future vulnerabilities and threats.

Last October the President issued Executive Order 13231, the

Critical Infrastructure Protection in the Information Age. That established the Critical Infrastructure Protection Board and created

the chair as a special advisor to the President for Cyberspace Security.

Now the President has made OMB a critical member of this

board. Our presence reflects our statutory role regarding security

of Federal information systems. In addition, there are several committees under the board, and we chair the Standing Committee on

Executive Branch Information Systems Security.

The administration has been proactive in implementation of the

Government Information Security Reform Act, and I will refer to

this from now on as the Security Act. This includes expanding the

reporting requirements to include the Chief Information Officer

and senior agencies’ officials’ input with the Inspectors General.

We have moved beyond simply reporting security weaknesses

and are focusing on agency work to remediate the security weaknesses. The basic push behind our continuing work is a strong

focus on management implementation of security.

We have recently taken the following two steps to help ensure a

strong focus on maintaining senior management attention to security: First, in January, OMB Director Mitch Daniels sent letters to

the heads of agencies and departments communicating our concerns regarding their fiscal year 2001 security performance. In general, agency heads responded back in writing with a commitment

to resolve their past flaws. OMB will soon meet with all of the 24

large agencies and departments to discuss the work in implementing their corrective action plans.

Second, the President has charged Director Daniels with overseeing implementation of the management agenda through the use

52

of an executive branch management scorecard. This scorecard

tracks agency improvement in five governmentwide areas and assigns a red, yellow, or green score.

One of these areas is expanding electronic government, and we

are incorporating IT as a core criterion within that. This means

that if an agency does not meet IT security criteria, it will not

achieve a green score, regardless of the agency’s performance under

the other e-government criteria.

I would now like to talk a little bit about our report to Congress,

the findings, some of the next steps. As you know, one of OMB’s

responsibilities under the Security Act is to submit each year a report to Congress that summarizes the results of security evaluations conducted by agencies and reported to OMB. On February

13th of this year, Director Daniels transmitted this report to the

Congress.

At this time I would like to recognize the tremendous amount of

work of agency program officials, CIOs, IGs, my staff, and all of

their staffs in conducting the reviews and evaluations upon which

the report is based. This was a large effort for all involved, and the

report illustrates this work, as well as the ongoing efforts of agencies to remediate their weaknesses.

Additionally, the National Institutes of Standards of Technology

continue to play their critical role in promoting IT security requirements among agencies. OMB policy requires that each agency’s

program implement policy standards and procedures consistent

with NIST guidance. NIST has developed a security questionnaire,

and most agencies use this document as the basis for conducting

their annual reviews under the Security Act.

The OMB report represents a first year of implementation. It is

a valuable baseline that has recorded the security agency performance. Even though the Security Act only required us to summarize

the results, we expanded the report. We included the results of CIO

and program official reviews in the recent activities we have undertaken in preparing the fiscal year 2003 budget decisions, OMB

findings, and next steps, as well as additional efforts that we have

undertaken and the agencies have taken to improve Federal information technology security.

From our assessment of agency performance, we have both validated the earlier positions on what the problems were and identified at a high-level important lessons learned. I would like to briefly sum those up.

First, security is primarily a management problem, not a technical or funding problem. Are you willing to support us if we push

to get someone fired because they will not implement a security

plan? Second, increased spending does not necessarily translate

into increased security performance. Third, high-quality IG audits

are necessary. The IGs provide an important, independent validation function. Fourth, agency employees with specific security responsibilities must have the authority to fulfill their responsibilities and at the same time have to be held accountable for their

performance.

There are a number of additional actions I have described. A key

part of the written testimony I would ask you to look at are the

actions under the OMB Security Committee of the Critical InfraVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00056 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
53

structure Protection Board. Therein we have laid out a process to

focus more rapidly on actions needing to be addressed, because this

is an ever-changing issue both in terms of vulnerability and

threats.

I would also ask you to take a look at the decisions that we have

made in the budget, and would ask your support in the appropriations decisions that ultimately will have to make these into reality.

Finally, I would like to focus on the governmentwide initiatives

that we have underway leveraging the project matrix work and the

enterprise architecture work. The development of the governmentwide enterprise architecture assessment is critical and a central

part of not only our e-government efforts, but our cyber-security efforts. Basically, to more clearly identify and prioritize the security

needs for government assets, OMB is going to direct all large agencies to undertake a project matrix review, and that was a key element of the 2003 budget.

Again, I would like to thank you for the opportunity to testify.

We have a summary in the testimony of the six government problems that we identified in the report, and I would be willing to answer any questions in that regard at the appropriate time.

[The prepared statement of Mr. Forman follows:]

54

55

56

57

58

59

60

61

62

63

64

65

66

67

Mr. HORN. Well, thank you very much. I want to emphasize what

you just did now, the President’s Executive order, which was Critical Infrastructure Protection in the Information Age, and he established a board, as you suggested. The chair, who serves as a special

advisor to the President for Cyberspace Security, and that, of

course, is Richard Clark, who serves as the Board and he is the

Special Advisor to the President for Cyberspace Security. He reports both to Governor Ridge on issues that affect homeland security and to the National Security Advisor, Condoleezza Rice, on the

issues that affect national security.

The President has made OMB a member of the Critical Infrastructure Protection Board. Are you on that board as part of it?

Mr. FORMAN. Yes, I am.

Mr. HORN. I think it shows the President has taken some real

action with people that did have his ear.

I am going to have to recess now. When I come back, the ranking

member, Ms. Schakowsky, will have her statement in, and we will

then go down the line. We have a Journal vote before us.

Ms. SCHAKOWSKY. Is there an opportunity for me to do that now?

Mr. HORN. Sure, sure. She will put it in now, and once she finishes, we are in recess.

Ms. SCHAKOWSKY. Thank you, Mr. Chairman. I appreciate that.

I want to thank the chairman for holding this hearing and for

his leadership on computer security issues in the House. I look forward to working with him to improve government information security reform language that was passed in the Congress.

It was passed in the last Congress as a part of the Defense Authorization Act, and as such, really didn’t get, in my view, adequate

review in the House. No hearings were held, and we had very little

opportunity to affect the content.

Consequently, under Representative Waxman’s leadership, we

sought and received a 2-year sunset on this legislation. Our experience over the past year has substantiated the wisdom of that approach.

There are a number of problems in this legislation that have already come to our attention. I am hopeful that today’s hearing will

help us put together a more complete picture of the actions to make

this legislation more effective.

One problem has already come to our attention. One of the problems is the reports prepared by the agencies. We asked the GAO

to use agency information security reports to develop the scorecards for our hearing last fall. It came as a surprise when the administration refused to allow access to those reports, claiming that

they were predecisional and part of the budget process. After much

negotiation, we were finally given access to executive summaries,

hardly a satisfactory outcome.

A more serious shortcoming of this legislation is the absence of

any system to assure that all agency systems are checked and protected. Today few, if any, agencies have a complete inventory of its

computer systems, even though just such an inventory was required for Y2K compliance just 2 years ago. Without a complete inventory, it is impossible to know if all systems have had the risks

assessed and the protections tested. We must make sure that every

agency maintains a current inventory of systems and has in place

68

a systematic process to assess risk for those systems and to test the

protections in place.

I am sorry that I was late. I do look forward to hearing today’s

witnesses, if not reading the testimony, and hope that each of you

will understand that we share the common goal of assuring the

public that our systems have adequate protection. So I thank you

all for coming today.

We will be back.

[The prepared statement of Hon. Janice D. Schakowsky follows:]

69

70

71

[Recess.]

Mr. HORN. Recess has ended, and we will begin next with Mr.

Bement, who is the Director of the National Institute of Standards

and Technology [NIST]—not in the mist, but NIST. [Laughter.]

Dr. BEMENT. Right. Thank you, Mr. Chairman.

Mr. HORN. As a little kid, I remembered well the standards and

your beautiful campus out there.

Dr. BEMENT. You are more than welcome anytime, Mr. Chairman.

Thank you very much for giving me the opportunity to speak to

you about NIST’s role in cyber-security. NIST’s Computer Security

Program supports the vision of strong cyber-security and its critical

role both in homeland security and e-government. Our agency has

specific statutory responsibilities under both GISRA and the Computer Security Act of 1987 for developing standards and guidances

that help Federal agencies to protect sensitive, unclassified information.

Specifically, NIST has published a guidance for firewalls, intrusion detection, cryptography, public Web servers, and risk management. We also conduct computer security research in close cooperation with industry and academia. We work to find ways to apply

new technologies in a secure manner.

The solutions that we develop are made available to both public

and private users. This research helps us to find more cost-effective

ways to implement and address security requirements.

I would now like to highlight a few of our more important recent

contributions to improve cyber-security in Federal agencies. In December the Secretary of Commerce approved the Advanced

Encryption Standard [AES], as a Federal security standard. Within

days, commercial firms were announcing products that incorporated the AES. It is clear that AES soon will be used extensively

internationally and be available in a wide array of commercial

products to protect sensitive Federal information. We expect AES

will be used daily to secure trillions of dollars in electronic transactions and to protect sensitive personal business and government

information.

The Chief Information Officers’ Council and NIST developed a security assessment framework to assist agencies with a very highlevel review of their security status. The framework established the

groundwork for standardizing on five levels of security and defined

the criteria agencies could use to determine if the levels were adequately implemented. By using the framework levels, an agency

can prioritize agency efforts as well as to evaluate progress.

Building from the framework, NIST issued a more detailed security questionnaire that most agencies use to conduct their programmed system reviews. This document provided guidance on applying the framework. In addition, the guide provides control objectives and techniques that can be measured for each area. Many

agencies use this to prepare their GISRA responses to OMB.

NIST also recently formed a team that specializes in helping

Federal agencies navigate through the dangers of cyberspace. The

Computer Security Expert Assist Team [CSEAT], helps agencies

understand how to protect their computer systems, how to identify

72

and fix existing vulnerabilities, and how to anticipate and prepare

for future security threats.

The CSEAT reviews are also valuable to NIST. They give us a

firsthand look at how NIST guidance is implemented, helping us to

improve our products and processes.

Our new information-sharing Web site for Federal agency security practices covers a host of topics ranging from contingency planning to network security. Computer security professionals from various Federal agencies have contributed much of the material on the

site. The site also contains the best practices for critical infrastructure protection and computer security identified by the Federal

Chief Information Officers’ Council. The site is one of the latest additions to NIST’s Computer Security Resource Center and is one of

the busiest and most popular spots on the entire NIST Web site.

Another aspect of our work involves security testing which complements security standards by giving users confidence that the security standards and specifications are implemented correctly in

the products they buy. NIST and our Canadian counterpart have

set up a joint program to help ensure correct and secure implementation of unclassified cryptographic algorithms and products. Statistics show that 48 percent of the modules tested voluntarily

under this program have security flaws that were corrected during

testing. So, without our program, the Federal Government would

have only a 50/50 chance of buying products that correctly implemented cryptography.

I would like to point out that in carrying out our responsibilities

under GISRA and the Computer Security Act, we consult frequency

with other agencies. In particular, we work very closely with the

Office of Management and Budget. We consult with OMB representatives on the Federal Chief Information Officers’ Council, the

Federal Computer Security Program Managers’ Forum, and the

Committee on National Security Systems. We soon will serve on

the newly formed Committee on Executive Branch Information Systems Security. I would like to take this opportunity to commend my

OMB colleagues for their steadfast support in promoting our security standards and guidelines with Federal agencies.

Let me close by emphasizing that our national commitment to

improved cyber-security must be increased in Federal agencies and

elsewhere. NIST has a proven track record of success and stands

ready to play key roles in this and other facets of homeland security.

Thank you very much, Mr. Chairman. I will be pleased to answer

any of your questions.

[The prepared statement of Dr. Bement follows:]

73

74

75

76

77

78

79

80

81

Mr. HORN. Thank you, and we are delighted to have your paper

in particular.

We now turn to the Honorable Roberta L. Gross, former Inspector General, National Aeronautics and Space Administration. I lost

track of you. You have been a witness here before. When did you

leave the Inspector General’s position?

Ms. GROSS. Saturday.

Mr. HORN. Saturday? OK.

Ms. GROSS. But your staffer had asked me prior to the time, and

I had told her that I would be leaving, but we talked about I would

still come. So here I am.

Mr. HORN. Great. Well, welcome. So if we could summarize your

testimony?

Ms. GROSS. Absolutely. I thank you for inviting me to testify

today on GISRA, and my testimony is obviously based on my recent

experience as NASA’s Inspector General. I served in that post from

August 1995 through March 2, 2002. I am also basing it on my experience as being the former Chair of the IGs’ IT Roundtable,

where we discuss cross-cutting issues across the government.

Last year I, along with a representative of the GAO, testified before the Senate Committee on Governmental Affairs on a precursor

of GISRA, Senate bill 1993. The then-chair of the committee, the

Honorable Senator Thompson, began his opening statement by recounting how time after time the GAO kept writing reports, Inspectors General kept writing reports, about serious lapses in IT security, deficiencies in IT capital, in human resources planning. He observed that over the years law after law was passed, regulation

after regulation, and the issues seemed to reoccur and nothing

seemed to get better, and it was no wonder, with so many laws and

regulations, that this Senator rhetorically asked, ‘‘Why are we enacting GISRA?’’ The answer is that GISRA was needed, GISRA has

had success, and it can be improved.

My remarks are going to be divided into three sections: bad

news—I couldn’t be an Inspector General, or former Inspector General, without that, right? Good news, next steps, and lessons

learned.

During our GISRA reviews and audits at NASA, we found problems in each of the six areas highlighted by OMB. I am only going

to address three of them, using NASA as an illustration, and I incorporate by reference my written testimony.

The three that I would like to use as illustration are, one, lack

of senior management attention; two, limited programs for security

awareness and education, and, three, failure to exercise oversight

of contractor security services.

While some of the agency’s IT practices are more mature than

those at many agencies, and I notice that NASA got a ‘‘C-,’’ and

they are above one of the yellow lines, NASA management has historically been unwilling to recognize and/or fully acknowledge the

significance of the IT weaknesses and deal with them in a timely

manner. There are various interrelated reasons for that.

They were engaged, since I have been there, in downsizing, funding problems, but also, seriously, an unwillingness of middle management or IT security officials to tell senior management the extent of the problem, as well as lack of reception by senior manageVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00085 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
82

ment to hear about the extent of the problem. So that is a good

segueway into the first problem: senior management attention.

Leaderships of all the agencies occupy bully pulpits by virtue of

their positions. They can regularly remind staff of their IT responsibilities and obligations. No cost; talk is cheap. What should they

be doing?

They should be addressing their employees in as many forums as

possible and reinforce that IT security is everybody’s responsibility.

For example, we saw that the former Administrator used his office—this is at NASA again—used his office as a bully pulpit for

safety. Safety was NASA’s No. 1 core value. At senior staff meetings, leadership reiterated this value, discussed lessons learned,

and tracked programs related to safety.

However, no similar attention to ITS, other than during the Y2

crisis. Y2 came and went, and senior management attention came

and went. I hope the new Administrator will use his office as a

bully pulpit on IT issues.

Let’s talk about the CIO. The CIO also did not utilize the bully

pulpit to communicate IG findings, and we had the same findings

over and over again, and NASA agreed to implement our recommendations over and over again. They didn’t monitor these recommendations that they agreed to implement.

Instead of using the bully pulpit and communicating to the staff

and saying, ‘‘Don’t wait for the IG. Why don’t you look to see if

your systems have similar problems? And here are some suggestions that the agency IG recommended. Maybe these will be fixes

for you.’’ This really didn’t happen.

But I do want to point out the good news. Since the GISRA report, the CIO has shown improvement in communicating and sharing his communications with the OIG about IT vulnerabilities we

identified in the IT reviews. I used lack of communication as one

of the reasons why we found material weakness for purposes of the

GISRA report; the CIO failed to use a very low-cost/no-cost forum.

No. 2, another problem highlighted by OMB, as well as the IGs,

is insufficient security awareness and training. Civil servants and

contractors, they all need to have the training before being given

access to systems. If personnel have more responsibilities and higher-level sensitivities to systems, they need to have different kind of

training.

But NASA did not establish 100 percent training participation

for the targeted groups for all its measures, despite the age-old

adage: ‘‘You’re only as good as your weakest link.’’ The point is not

that you are going to make 100 percent of your goal, but shouldn’t

that be your goal? How could you have less than 100 percent for

people to be trained as your goal? Otherwise, you’re going to allow

and accept weak links.

Our biggest complaint on this training issue was that NASA did

not have all of its civil servant system administrators trained, but

even more significant is that they excluded, as their performance

measure, contractor personnel. Guess what? Seventy-nine percent

of NASA’s systems administrators are contractors. Their training is

not even measured; they are not even tracked in terms of whether

they have the appropriate training. This is an obvious risk for

which NASA did not implement compensating controls.

83

Oversight of contractor responsibility. Over and beyond incorporating IT clauses into contracts, which OMB addressed and we

address, you still have to make sure that you know who these contractors are with who you are working with. They have wide-range

responsibilities. Think about it. They are your systems administrators. They purchase and provide desktops. They are the ones that

safeguard sensitive information. They maintain your systems. They

put the patches in your system.

Who are these people? What are they doing? And are you oversighting them? Contractor oversight is an area where the government needs to be attentive, and certainly NASA does.

OK, good news. OMB focuses greater cooperation between OIGs

and CIOs. I do want to say and give credit to two individuals who

are here. Never say IGs don’t say good things about people. Glen

Schlarman and Kamela White are both here. There’s Glen, and

Kamela, she’s hiding over there.

Mr. HORN. Why don’t you speak that back into the mike? They

didn’t quite catch it.

Ms. GROSS. OK. Both Kamela and Glen are here. In forwarding

their summary report to Congress, they did not try to paint a rosy

picture, but tried to present an accurate picture, and this wasn’t

always easy because sometimes it looked like the IGs and the agencies were reporting on two different worlds.

I also want to commend them for their steadfast insistence that

management work with IGs in developing corrective action plans.

This has been a welcomed increase in cooperation between IGs and

CIOs. IG after IG report this.

Equally important, GISRA brought accountability to the heads of

the agencies. They had to forward the report. They had to forward

an IG report as well as the agency report and put their name on

it. It was their report. No more plausible deniability. They couldn’t

claim they didn’t know what the IT issues were at their agencies.

That was real good.

OK, next steps, and I’m going quickly—GISRA I think should be

extended in some form for 2 to 5 years, so that agencies will implement agreed-upon changes. In subsequent legislation, Congress

should consider to allow the IGs to have more flexibility in their

reporting responsibilities. This year it will still be the same, but if

you still have to do this kind of level of intensity without having

additional funding from the agency and OMB, you are not going to

be able to move into other high-risk areas. Unlike when Congress

passed the CFO audit and most IGs got more resources, that didn’t

happen for GISRA.

Another suggestion is that there should be a sunset provision

maybe in the 3 to 5 years, so you can evaluate is what you want

to do. Are the means overtaking the end? So I think a sunset provision is good.

Another way to ensure greater uniformity is to eliminate the

act’s bifurcation of responsibilities for national security programs.

Under the act, the agency head asks an outside evaluator to come

in, look at national security systems, which the IG later reviews.

NASA’s IG’s office never got that security report in time to review

it for the GISRA Act.

84

The IGs use at the least, a uniform evaluation methodology.

They will either use government standards, PCIE-wide standards

for reviews, or GAGAS, government auditing standards for their

audits. This is not always the case. Agency heads bring in different

people. Who knows what standards they are using? So this should

be eliminated, and it should be having the IGs do 100 percent of

that.

These next steps require a focus on agencies’ infrastructure for

reporting intrusions, and also the agencies’ first-responders. Are

they training first-responders? When you have a program manager

they want to fix the problem. Often their fixes may increase the

problem. Maybe the intruder is still in the network trojanizing the

systems. Program managers don’t always know what they are

doing when they fix problems, partly because they are not coordinating with law enforcement. IGs must look at, and I think this

should be an area of Congress could look at to see if they are actually, the agencies, are implementing law enforecement coordination. The Congress passed the USA Patriot’s Act of 2001 to help

law enforcement with the cyber war. One section allows victims of

computer attacks to authorize persons acting in color of law to

monitor trespassers on their computer systems. This provides law

enforcement with the same authority in the cyber world that a police officer has in the normal world if there is a burglary in

progress. This had to be amended so the monitoring wouldn’t be

considered wiretapping. This is important. I want to commend

Howard Schmidt, vice chair, President’s Critical Infrastructure

Board. He is working with Richard Clark. He has initiated contacts

with NASA’s Inspector General’s office to help frame a OIG-wide

response for the victim agencies. NASA, under my term, established the first Inspector General’s Computer Crimes Unit, and

Howard was turning to our unit in part because we were recognized both nationally and internationally for our expertise. It is

crucial that OIGs help their victim agencies and those agencies

look to this monitoring provision. Let’s not wait for the cyber-attack, the law has already passed.

Nobody has procedures. I know, because I put a request for monitoring into the agency, and it is under review. We need to have

more sense of urgency for something like this. The law was passed

because there was an urgent situation. That urgency cannot wait

for the next attack, and if that is a cyber attack——

Mr. HORN. Let me ask you a minute about this particular aspect

on the follow up and getting that. Did they use the Carnegie-Mellon operation in part or did they use the FBI one?

Ms. GROSS. Carnegie-Mellon is not a law enforcement entity.

They get information from both the private sector, and government

agencies. Part of the way Carnegie-Mellon works, is sharing of information. Although it is not a law enforcement entity, they do

have a member of the FBI on the Cert. They do share information

with law enforcement. It goes back and forth, but it is not a law

enforcement entity.

The FBI also wanted this Computer Security Act passed. They,

like any other law enforcement entity needed that in order to do

the monitoring; consensual monitoring by the owners of systems

when you know there is a burglary, a cyber burglary in process,

85

they can monitor. They needed that provision. There’s no nationwide or agencywide practices on how to use that authority though.

But, again, remember with the FBI, the FBI has to look at the

private sector, universities and international entities. The group

that really looks for their victim agencies is the OIGs. Many of

them know the agency people; they know the systems; they know

the programs. You might have a shot at figuring out the intent and

motive of intruders if IGs are involved.

They have fully qualified law enforcement special agents. This is

a way of ensuring those much needed protections.

Right now, you have a focus of the FBI looking at physical terrorism. The role of the IGs becomes even more paramount because of

that. They need to step-up to the plate. I would be glad to speak

more on that. I can wax eloquent on that issue.

Mr. HORN. We will get to that again, but we will move on to Mr.

Gorrie.

Ms. GROSS. Yes.

[The prepared statement of Ms. Gross follows:]

86

87

88

89

90

91

92

93

94

95

Mr. HORN. Robert G. Gorrie is the Deputy Staff Director, Defense-wide Information Assurance Program Office, and Assistant

Secretary of Defense for Command, Control, Communications and

Intelligence.

When did you fill that Assistant Secretaryship?

Mr. GORRIE. No, sir, I am Office of the Assistant Secretary. They

have that a little backward there.

Mr. HORN. I see, OK.

Mr. GORRIE. I conspire to that, though, but—— Mr. HORN. Well, remind me, who is the Assistant Secretary in

that area?

Mr. GORRIE. Mr. Stenbit is, sir.

Mr. HORN. Mr. Who?

Mr. GORRIE. John Stenbit.

Mr. HORN. How do you spell the last name?

Mr. GORRIE. S-T-E-N-B-I-T.

Mr. HORN. OK, yes, because I haven’t really followed it, but in

the days of Y2K, until the General occupying the effort left, I know

there’s been sort of up and down under the previous administration. I assume Mr. Stenbit, then, is the Bush administration?

Mr. GORRIE. Yes, sir, he followed Mr. Art Money, who was the

previous ASDC3I.

Mr. HORN. Well, go ahead.

Mr. GORRIE. Yes, sir, thank you, Mr. Chairman and members of

the subcommittee. I am honored to be here and pleased to have the

opportunity to speak with your committee about lessons learned by

DOD from assessments we conducted in response to the Government Information Security Reform legislation.

Secretary Rumsfeld, in his testimony last month before the

House Appropriations Defense Subcommittee, identified six key

transformational goals for the Department. Leveraging information

technology to create seamless, interoperable network-centric environments is one of those foundation transformational goals.

However, as our dependence on information networks increases,

it creates new vulnerabilities, as adversaries develop new ways of

attacking and disrupting U.S. forces. In recognition of this dichotomy, the Secretary established the protection of U.S. information

networks from attack as another foundation transformational goal.

Emphasizing that transformation is not an event, Secretary

Rumsfeld described it as an ongoing process or a journey that begins with a transformed leading-edge force. Mr. Stenbit, the DOD

CIO, is committed to support our transformation by providing the

power to that information leading edge. To do that, he established

three goals for his supporting efforts of Mr. Rumsfeld, and one of

those is making the exchange of information available on a network that people depend and trust.

Now all of these goals in large measure are influenced by our

ability to provide information assurance to the edge and throughout the entire information enterprise. Our senior leadership’s stated commitment to these goals is testament to the importance

placed on information assurance within DOD.

The Department initiated work on its 2001 assessment in January 2001. The former DOD CIO, Mr. Art Money, established an IA

Integrated Process Team to lead the assessments. In addition, the

96

DOD IG ensured that independent audits were performed to assess

and test DOD programs and policies for effectiveness and compliance with the law and other policies, procedures, standards, and

guidelines.

The analysis of the system-specific data and the responses to the

OMB questions indicate that DOD has good IA policies, practices,

and procedures in place, but needs verification of compliance. Without a capability to enforce and properly audit IA policy compliance,

it is difficult to ensure that all systems operate based on up-to-date

procedures and proper configurations.

Based on the data analysis, however, it is evident that even for

those systems lacking accreditation, most have robust IA measures

in place and programs with high IA awareness. DOD has a strong

foundation in IA that will be expanded and more fully developed

as that program matures.

Without question, though, the biggest single lesson learned during the conduct of GISRA 2001 was the problems associated with

our Security Certification and Accreditation Program. Compliance

is a major issue. However, stricter audit and enforcement of

DITSCAP, which is our Defense Information Technology Security,

Certification, and Accreditation Program, stricter audit and enforcement of that will not necessarily rectify the problem. Non-compliance is more a symptom of the complexity of that process and

the clarity of its implementing policy. These problems were previously identified, but definitively confirmed in the GISRA 2001 assessment.

That certification and accreditation policy is undergoing dramatic

modification in policy as well as in implementation. The DOD policy governing DITSCAP will streamline the certification and accreditation process and provide better clarity on definitions and responsibilities. DOD is also pursuing the use of automated tools to

ease the documentation burden on security and systems administrators. The combination of these two efforts should significantly

improve our ability to conduct certification and accreditation and,

as a result, improve compliance.

DOD, through the Defense Information System Agency, has also

aggressively implemented comprehensive connection approval programs for both our Non-Secure and Secret Internet Protocol Router

Networks, the SIPRNET and the NIPRNET. These programs have

initial and subsequent periodic validation of network certification

and accreditation as a precondition for connection to the network,

and this will serve as a valuable compliance control mechanism to

make sure that those programs are fully carried out.

The DOD IG identified oversight and review of IA policy implementation and programming of funds and resources to support IA

as areas requiring attention in the last GISRA assessment. Conduct of worthwhile oversight and review of IA policy implementation requires not only an established process, but also relevant and

current IA policy. As mentioned in the IG report, DOD Directive

5200.28 was, or still is, our current security policy, but that happened to be written in 1992 and was woefully out-of-date.

In its place, DOD is issuing a series of new IA directives and instructions to accommodate a more complex IA environment. The

capstone directive is in formal coordination now within the DepartVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00100 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
97

ment and will be released soon. Other supporting directives have

recently been released or will be released later this year. The responsibilities established in these directives are clear and concise,

as are the management controls associated with the policies.

Oversight of budgets and programming to support IA is one of

the functions of my office, the Defense-wide Information Assurance

Program Office. We are now reviewing, with all the DOD components, the services, and the agencies, IA budgets and programs

during their development to coordinate efforts across the Department and to check for policy implementation. Subsequent to that,

we conduct reviews to match the resource allocations and expenditures with the original plans to make sure that they match.

Now, those were the things we noticed during regular GISRA.

However, there were some procedural lessons learned that we also

developed. One, as was mentioned previously, was to work closely

with the DOD IG in the conduct of GISRA. Unfortunately, during

last year’s GISRA, we weren’t able to do that because of time constraints and previous scheduling problems with the DOD IG. They

looked at one small population of DOD systems, and we looked at

another population. Optimally, we would have looked, both we

would have done an assessment of DOD systems and then the IG

would have come behind us and audited the same systems to verify

the veracity of the information that we were getting.

Because of that, DOD’s Fiscal Year 2002 GISRA assessment efforts will focus on three particular areas. One is review of selected

systems from 2001, and then we will go in and take a look at the

major DOD networks, and also the third part of that is the departmental response to OMB IA management process questions.

Approximately 168 systems from the 2001 assessment will be reviewed. The second area of this year’s effort will focus on a random

sample of major local, wide, and metropolitan DOD area networks.

Then the final area in 2001 will be the response to the OMB IA

management questions. OMB has indicated that the questions will

be similar to those in the 2001 assessment, and will encompass all

aspects of IA throughout the Department, from training and awareness to response capability. As DOD components conduct their assessments, the DOD IG will audit the subset of the 168 systems

from last year, again, as I said before, to verify compliance and the

veracity of the information that we collected.

We in DOD find the GISRA assessments as a valuable tool. Combined with other assessment tools we have—for instance, the Joint

Chiefs of Staff Joint Monthly Readiness Reviews, the Commandersin-Chief’s Integrated Priority Lists, Mission Need Statements, and

other requirements documents—we are better able to discern what

actions and direction are needed to be taken to sustain our IA posture and to transition to a more robust posture. Having identified

these necessary actions and directions, we were able to better coordinate more effectively our oversight and coordination of the Department’s IA budgets and the entire enterprise-wide program.

That’s it, sir.

[The prepared statement of Mr. Gorrie follows:]

98

99

100

101

102

103

104

105

Mr. HORN. Thank you very much. I want to ask you about the

role of Mr. Stenbit. Now he is Assistant Secretary for the three

C’s—Command, Communications, and what else is it?

Mr. GORRIE. Command, Communications, and Control and Intelligence.

Mr. HORN. Control and Intelligence?

Mr. GORRIE. Yes, sir, and he is also the DOD CIO.

Mr. HORN. Yes. Now is that too much for one person to handle?

Mr. GORRIE. No, sir. Actually, it is probably a pretty good combination because not only does he see or oversee the policy and the

budgetary parts of IT within the Department, but then, again, as

the CIO of DOD, that gives him a more pervasive view not only of

the programming and budgeting aspect and bringing new systems

on board, but getting into the daily operational things that go on

within the Department.

Is it too big of a job to handle? No. I mean, he obviously has staff

to deal with his CIO functions and also with his Assistant Secretary functions, but to have that all brought together in one person is valuable, because you get to see not only the policy development and also the procurement side of it, but also the operational

side of it.

Now there are people who would disagree with that and say that

we should split this function and have a separate DOD CIO and

a separate Assistant Secretary for Command, Control, Communications and Intelligence. The jury is still out on that. I don’t personally subscribe to splitting those responsibilities, but until I become

the Secretary, I won’t be able to make that decision, sir. [Laughter.]

Mr. HORN. Well, I would like a little table with little boxes as

to how many people we have for those various functions. I have

gone through this with another agency 5 or 6 years ago. They piled

everything onto what Congress had said about Chief Financial Officers, Chief Information Officers, and the thrust of that was to get

somebody of high-rank that we could get in the private sector or

in the executive branch out of the Senior Service. We just looked

at it, and not much was happening because the poor soul was overloaded.

So I would like a chart at this point in the record. Without objection, it will be put there. So if you and everybody else can give us

one, just so we can see the picture of who’s helping and how many

are helping and addressed to this?

Mr. GORRIE. Yes, sir.

And if I might add one other reason why I don’t think you necessarily want to separate those functions is because the level—if

you split those functions, I don’t know that necessarily the level of

importance of the person holding that job would carry enough sway

within the Department to have influence. At the Assistant Secretary level—and, actually, I think it should be at the Under Secretary level, but, again, I am not in a position to make that call— there is enough leverage there, and they have enough influence

and the ear of the Secretary of Defense to make things happen. If

you split it and diluted it, that might not necessarily be the case.

Mr. HORN. I have great admiration for the Secretary of Defense.

I remember, going back about seven administrations, one person

106

had about 12 of the functions we now have Assistant Secretaries

hold. As you know, he did a very fine job. But when we have troubles in this area, where we haven’t had it yet up where they can

get a C, B, or A in looking at the computing operation, it just

means we have got to focus on that and not be waylaid by all the

other things that are very important.

Mr. GORRIE. Yes, sir.

Mr. HORN. OK, so we now have our last presenter, Chief Information Officer Karen S. Evans of the U.S. Department of Energy.

Glad to have you here. When were you appointed? I see January

28th.

Ms. EVANS. Yes, sir, just 6 weeks ago.

Good morning, and thank you for this opportunity to appear

today to address the very important issue of improving the security

of our Federal information systems. I was named the Department

of Energy’s Chief Information Officer 6 weeks ago, on January 28,

2002. As the CIO, I believe that effective cyber security is a balance of managed policies, procedures, technology, training, and people. It is also a major enabler of our Department’s information

technology initiatives, especially our e-government initiatives.

My remarks today focus on the implementation of the Government Information Security Reform Act, improvements in the Department’s cyber security infrastructure, and our plans for further

strengthening our cyber security posture.

GISRA provides a comprehensive framework for establishing and

ensuring effectiveness of security controls over information resources that support Federal operations and assets. Secretary

Abraham submitted the Department’s first annual security review

last September. This committee established grading criteria, and

the Department received an ‘‘F.’’ The scoring acknowledged that we were either complete or in the

process of implementing 9 of 10 areas. Our raw score was 71. The

score was weighed against weaknesses identified by our previous

Department Inspector General and the Office of Independent Oversight and Performance assurance audits and assessments. Our

final scoring was lowered to 51.

Since the passage of GISRA, the Department has taken an active

leadership role to further strengthen its cyber security posture.

First, we developed and incorporated an enterprise-wide perimeter

defense strategy to reduce the number and the severity of successful attacks. Analysis reveals that while the overall threat from

virus and malicious code increased, the number of successful intrusions diminished. Virus and malicious code incidents dropped from

60 in fiscal year 2000 to 39 in fiscal year 2001, a 35 percent reduction. In addition, while probes and scans escalated over 2,000 percent from fiscal year 1999 to 2001, unauthorized access and Web

defacements diminished by over 50 percent.

In addition, we have trained 6,200 managers and cyber security

staff in the last year alone, and are continuing an aggressive training and awareness program, so that every Department member is

aware that cyber security is an integral part of his or her job.

Like many other government agencies, we still have a long way

to go, but we have an excellent foundation on which to build. We

recognize the importance of cyber security as a management issue.

107

Our goal is to give line management the authority to determine

how to implement policy, because it is in the best position to assess

the appropriate levels of protection.

Our Performance Improvement Plan and Performance Report

Card provide a clean remediation road map for those program offices with GISRA-identified deficiencies, and our sites have made

significant progress toward their elimination.

Today I am pleased to announce additional cyber security initiatives. First, I will focus initially on developing and implementing

a Department-wide certification and accreditation process to ensure

that our unclassified information systems comply with departmental cyber security policies. Our Certification and Accreditation

Program will establish a Department-wide process to certify that

an information system or a site complies with documented security

requirements, and that the program will continue to maintain an

accredited security posture throughout the system life cycle.

Processes such as certification and accreditation are insufficient

without adequate risk-management and configuration management

directives. The Department has identified some shortcomings in its

approach in both areas, and I am committed to developing directives in these areas.

The Department is also committed to protecting our national critical and mission-critical assets. As one of the first five agencies to

complete the Critical Infrastructure Assurance Office Project Matrix Step One, we now have a comprehensive list of our most critical assets, which we used to focus our enhanced protection efforts.

In addition, I am committed to implementing a robust, independent validation and verification process to provide an additional objective level of assurance regarding the continuity of operations for

all of Department of Energy’s mission-critical cyber assets.

The Department has also initiated a renewed IT capital planning

process to manage the cost of acquiring and maintaining IT assets.

We are improving that process to ensure the seamless integration

of security into each system’s lifecycle costs. Although each of these

efforts is only a part of our cyber security program, together they

are effective tools to protect the Department’s critical information

assets. They will also serve as enablers for our electronic government efforts.

I am intent on making the Department a national center of excellence for safeguarding classified and unclassified information on

electronic systems. This will be accomplished through three objectives: strengthening the Department’s cyber security community,

ensuring a Department-wide risk-based approach to cyber security

implementation, and enhancing protection of our internal cyber assets, especially our nationally critical and mission-critical assets.

As CIO, I have been given programmatic authority to provide

management oversight of the Department’s cyber security program

through the use of information technology capital planning and investment process. Our Performance Improvement Plan and Performance Report Card clearly communicate the status of identified

issues of concern. This plan builds upon the foundation provided by

GISRA and fosters solution-sharing within the enterprise.

Our performance metric program provides us feedback on key

elements for a healthy cyber security program. I am moving forVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00111 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
108

ward to strengthen our approach to risk and configuration management; implement a comprehensive certification and accreditation

process, and an independent validation and verification process.

With these initiatives, I am confident that the Department will

continue to strengthen its cyber security posture.

Success in this area takes continued and focused efforts due to

the increasing complexity of threats and the rapid evolution of

technology. We at the Department are committed to meeting this

challenge.

Mr. Chairman, this concludes my statement, and I would be

happy to answer any questions.

[The prepared statement of Ms. Evans follows:]

109

110

111

112

113

114

115

116

117

Mr. HORN. Thank you very much. We appreciate your presentation.

We are now going to go down the line for a few questions. I

would like all of you to give us some information on them.

The question basically is, are there adequate standards and

known best practices to implement an effective information technology security program, especially for the CIOs, as to where that

source is. Is it OMB? Is it GAO, so forth?

Mr. Dacey.

Mr. DACEY. Let me answer that question at two levels. I think

we have some guidance at GAO with respect to overall security

management programs. I have included that as best practices from

leading organizations for security management programs and for

risk-assessment.

With respect to more details controls, I think there isn’t consistent information out there. There is a lot of good information in industry, and there is a lot more being developed. I would say that

NIST, a combination of NIST and the NSA, through the NIIAP, another organization, and some others, are starting to develop more

detailed policies. These have been received fairly well for those who

are trying to implement security in their systems. So it is, again,

at two levels: one at the management level and one at the detailed

standards level.

Mr. HORN. Mr. Forman.

Mr. FORMAN. I think the focus is wrong there. I think there are

a plethora of standards, best practices tools. I think you have got

to go beyond the United States and look at what the U.K. has done

and other countries.

The reality that we are working in, the environment that I am

trying to bring about here, has to operate as fast as the Internet.

Traditional bureaucratic processes simply will not give us the security we are looking for. We have—and I will lay out some of the

elements of the puzzle—threat data aggregation, NIPC at the FBI,

FedCirc for the Federal Government, Cert at Carnegie-Mellon, the

Sands Institute, the National Security Agency, organizations within the Defense Department.

So if there is a threat on the Internet and it moves at Internet

speed, by the time any one of these organizations finds out about

it and puts out an alert, you or I may hear about it on WTOP coming into the office in the morning. That is a day.

We are talking about, on the other hand, an annual process with

GISRA. We are moving to a quarterly process to oversee the management by the President’s Management Council for Security Management. At once I feel, yea, finally, after for me 12 years of trying

to get management attention, we’ve got the management attention;

we’ve got a terrific set at both the policy levels and the technology

levels of standards from NIST, from NSA, from DOD, and others.

Those standards are adequate to do what we need to do for the

management policy, but they are inadequate to address some of the

major issues within the Internet in regards to vulnerabilities.

We need to look at how we put in place a process, not standards.

If, in the end, we want fast identification of threats, fast remediation of vulnerabilities, we need to make sure that we are providing for that infrastructure. I fear the path we are going on right

118

now is identifying people who are accountable, identifying visible

sets of metrics and are they following them? If so, the potential exists to ignore the fact this stuff is moving in hours or days, not

months, quarters or years.

In essence, this is what we are trying to bring about with the

Critical Infrastructure Protection Board. The process needs threat

data aggregation. It needs vulnerability assessment. We have to

make some decisions as a country about the remediation and deployment of remediation. In other words, is that going to be industry-driven or government-driven? I fear that the type of structures

we put in place for Y2K, from a bureaucratic standpoint, won’t

work now.

So, clearly, all of that is evolving, and we are working through

that. But, by the same time, there is this issue of enterprise security issue, and that has been the focus of GISRA. That has been

the focus of many people at this table as well as many of our staff

in the back for well over a decade. There we have made the

progress.

I would rather see the focus being on, ‘‘What do we need to be

successful at Internet time’’ than, ‘‘How do we continue down this

path of enterprise security management in a bureaucratic process?’’ Mr. HORN. You mentioned that there were certain nations that

would seem to be ahead of us in some of these areas. Could you

give us a feeling for that?

Mr. FORMAN. I wouldn’t say necessarily ahead of us in the sense

that they have done a better job, but had some perhaps more complete or some accepted standards. I think the U.K was one of those.

I know when I was at IBM, we used the U.K. standard for our security audits that we did in a number of industries. Since then, of

course, NIST has, I believe, widely recognized, has put together a

much broader set of standards from the technology level to the

management level, which now many of the CIOs adopted. We

didn’t have that 2 years ago.

Mr. HORN. Dr. Bement, how do you feel about what’s happening

abroad that we might use in our own administration?

Dr. BEMENT. Well, in this area I think our current standards and

accepted best practices are current and will put us in good standing, but it’s very dynamic. The technology is changing rapidly. So

we have to continually review these standards. Also, our risk models need to be changed as we get new threat information. So we

have to keep on top of that.

But we have cross-cutting alliances with Canada, with the U.K.,

and many other countries in the work that we do.

Mr. HORN. How about Australia?

Dr. BEMENT. Pardon me?

Mr. HORN. How about Australia? Or New Zealand? I mean,

they’ve got a particularly different government.

Dr. BEMENT. I think all the members of the Coordinating Committee are very closely coupled with the work that we do, and Australia, New Zealand, Canada, the U.K. would be included in that.

I feel that, apart from the standards and the best practices, and

again we’re going to come right back again to training, awareness,

high-level oversight and compliance, there has to be enforcement of

compliance. There has to be critical monitoring, and, of course, peoVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00122 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
119

ple really have to continually keep on top of the changes, as Mr.

Forman mentioned. I think those are the critical issues.

Mr. HORN. Moving to another country before we finish that part

of the question, India produces a tremendous number of very talented people that relate to computing.

Dr. BEMENT. Yes, that is correct.

Mr. HORN. What do we know about India’s Government. Many

or most of the people probably come to the United States. I don’t

know if they are within the Government of India, but do you have

any thoughts on that?

Dr. BEMENT. I don’t know that NIST has strong interactions with

India and I don’t know that we have a number of citizens from

India working at NIST. We may have some. But I am certainly

aware of the fact that industry looks to the talent and the capabilities in India and draws on that very actively. Of course, we also

interact very much with industry. So indirectly we probably do

have some connections.

Mr. HORN. Ms. Gross—— Dr. BEMENT. Oh, Mr. Chairman, may I ask a privilege?

Mr. HORN. Sure.

Dr. BEMENT. I have another hearing in 15 minutes, and if I may,

I would like to be excused.

Mr. HORN. Fine, and if we have a couple of questions, we will

send them to you, and we will put them in the record at this point.

Dr. BEMENT. I would be pleased to respond to those. Thank you.

Mr. HORN. Fine. Thank you.

[The information referred to follows:]

120

121

122

Mr. HORN. Ms. Gross, how do you feel about, are there adequate

standards and known best practices to implement an effective information technology security program?

Ms. GROSS. I think there are a number of standards that are developing and, if implemented, would make our systems safer. I

think you have to talk about human capital. You can have all the

policies and all the procedures, but, ultimately, security is a matter

of layers. It is policies; it is procedures; it is having the right people. If you don’t have the right person as the CIO, you don’t have

the right people in law enforcement. It doesn’t matter that you

have an NIPC if the people there are not technical agents or they

don’t have technicians that know what they are doing.

You can’t have this vision of reacting to Internet speed unless

you make sure that, in fact, you have the human capital in place.

We need to start reacting with Internet speed; about making sure

we have the right people in the right places. I think you can get

your layers of policies and procedures, but I am not sure we have

been good about sharing best practices. You have organizations like

SANS to give out some and so does OMB.

I think this focus needs to be done. What are those best practices? You can’t have that many ‘‘F’s’’ and say that we have people

that know what best practices are or know what the right procedures are, or don’t have the right people in place.

Mr. HORN. How about your thoughts, Mr. Gorrie?

Mr. GORRIE. Standards and best practices, yes, sir, there are

standards and best practices out there, and we use them, but they

have to be tailored to specific environments. You just can’t run out

willy-nilly and pull them out of the blue. The NIST guidance for

evaluating systems, NASA, NIST, security configuration, guidance

for operating systems, they’re all good, but you have to bring them

in and build them into your own system and then evolve your own

system along the way.

To just elaborate a little bit on what we heard about human capital, the training of people and the problems we have associated

with that, people turning over and leaving the service and things

like that, that is really more symptomatic of a deeper problem.

That is again what was alluded to before, which is the velocity of

the technology.

In order for us to be able to track that velocity or track that technology as it moves forward, you are constantly having to retrain

people, constantly having to modify operational techniques and procedures to keep up with that. However, as we look at that technology as it progresses along, we find that, in the terms of my boss,

it isn’t born secure, that security isn’t built in from the beginning.

That is what needs to be done, not only the technological security,

the crypto-algorithms, the built-in entries and detection and things

of that nature, but also a systemic view where you have to have

security management built into it, too. It can be a very, very secure

box, but if you can’t put it in the system and be able to manage

all these disparate security devices, then you’re sort of barking up

the wrong tree.

I think Mike Vatis, when he testified before your committee last

September, sort of alluded to that problem, that it is not necessarily the training of the people; it is not necessarily the operVerDate 11-MAY-2000 10:56 Nov 05, 2002 Jkt 000000 PO 00000 Frm 00126 Fmt 6633 Sfmt 6633 C:\DOCS\82355.TXT HGOVREF1 PsN: HGOVREF1
123

ational techniques that you employ, is looking ahead to where technology is going and to try to track it. Now that is only part of the

problem. You can track technology and try to build in security

later, but the better part would be to engineer in security at the

front, and not only the security technology, but to enable it to be

managed effectively.

Because today we have applications that are point-click, and before you used to have to sit down forever and a day to program

these things out. What we need is security and security management that is also point and click, which would remediate some of

our training problems, would remediate some of our operational

problems, and go a long way to making this big bear of information

security a little bit easier to tame.

Mr. HORN. Two weeks ago I was talking about various things

with members of the NATO Assembly. Of course, you have a lot of

problems in terms of the various countries in the Eastern part of

Europe. I wonder, is the CIO role of Mr. Stenbit, do they relate to

NATO and different things, where we do a lot of computing?

Mr. GORRIE. Yes, sir. As a matter of fact, one of the reasons I

am here today, and not my boss, is that he is in first—not China,

somewhere in the Far East, and then going down to Australia and

New Zealand. But there is a very large international play in the

ASDC3I and in the CIO, too.

One, interface with the five I’s, which are the five English-speaking nations, the United States, the U.K., Canada, New Zealand,

and Australia. But then even further than that, in through all the

NATO subcommittees that we sit on, and then the Partnership for

Peace People, and all the other people that it is expanding to, and

then actually to even third-party countries to make sure that, when

we need to go somewhere, that we have not only infrastructure

support, but infrastructure support that has high availability, security, and some confidence that there isn’t anybody prowling around

in that infrastructure.

Mr. HORN. On Y2K, and now on this, where computing is a

major factor, it comes up under Department of Defense, and they

didn’t do too well overall. When they have a lot of other things

there besides the services. My instinct was that the Air Force was

way ahead of the father, namely, the DOD, and we would have

been giving them an ‘‘A’’ and still giving a ‘‘D’’ to the other groups,

like Logistics and Procurement.

I just wonder, is there a way to get the pressure so that the services that are doing well with CIOs—and maybe my instinct is

wrong; you’re on top of it, but I just think sometimes we ought to

put the ‘‘A’s’’ there if they are doing ‘‘A’’ work.

Mr. GORRIE. I don’t know if I can address that, sir. I mean, I

work with not necessarily the CIOs, but their IA underlings. I don’t

know if I am qualified to answer that question.

Mr. HORN. Well, if you could get me an answer, I would like to

know that——

Mr. GORRIE. Yes, sir, I will.

Mr. HORN [continuing]. Because we ought to see the breakdown

by the services and make sure that they are moving along on a

path, and they aren’t just off in a corner.

124

Mr. GORRIE. From that particular perspective, sir, at least as far

as IA goes, and that is my area of responsibility, so the only thing

that I can talk to, you have each of the services—at least about 3

years ago, when I was on the Joint Staff, there were certain services that excelled in particular areas. For instance, the Air Force

was far ahead of the Navy and the Army in terms of its ability to

do intrusion detection, consolidated intrusion detection, across the

enterprise. Such is not the case now. They have pretty much become even-keeled, because of the sharing of best practices and

being able to go in and audit the capabilities for the individual

services to do those things and then to apply resources for those

services and actually prod them along to come about a little bit better.

Things like information assurance vulnerability alerts, where we

find out that there is a particular vulnerability in a piece of equipment or piece of software, those things are starting to become enterprise-wide endeavors, and not strictly limited to the services.

The services have realized that in order to be successful in this

world, that they have to exercise enterprise-wide solutions and not

just limit them strictly to services, because they are all vulnerable.

They all ride the basic backbone network. They all, both security

and non-secure, know that if they are going to succeed, that they

have to cooperate, and by and large they are cooperating.

So from that perspective, the IA perspective, I do not see a great

disparity in the capability of either the Air Force, the Army, or the

Navy, or, as a matter of fact, across any of the agencies. We have

endeavored, like I said before, to try to enforce enterprise-wide solutions rather than stovepipe solutions within the services.

Mr. HORN. If you would, just for the record, on IA, could you

spell it out?

Mr. GORRIE. Information Assurance. I’m sorry, sir.

Mr. HORN. OK, and that’s your office basically?

Mr. GORRIE. The Defense-wide Information Assurance Program

Office, yes, sir.

Mr. HORN. Yes. Is that the way most of the agencies have—— Mr. GORRIE. Federal agencies or?

Mr. HORN. Yes, Federal.

Mr. GORRIE. I don’t know that. The DIAP, or Defense-wide Information Assurance Program Office, was mandated in legislation,

and I can’t think off-the-top-of-my-head what that was, but it was

in 1998, where the Secretary was told, ‘‘You will have a defensewide information assurance program,’’ and a year after that’s when

the office that I belong to was formed. Now whether or not that is

as pervasive across all of the other Federal agencies, I can’t speak

to that, sir.

Mr. HORN. OK, thank you. That was Secretary Cohen that put

that mandate in.

Mr. GORRIE. Yes, sir.

Mr. HORN. Yes, well, he was very knowledgeable in that area, as

a Member of the Senate.

Ms. Evans, any thoughts on best practices? Because you have put

a lot of emphasis on it.

Ms. EVANS. Yes, I did. It is my opinion that we do have adequate

standards and that there are best practices available today for a

125

good security program. In many cases a lot of the best practices are

obtained currently from our National Laboratories, and they are

being used by other Federal departments and agencies.

The Department itself does use the NIST standards best practices for our own classified systems, and we use the Committee on

the National Security Systems for best practices for our classified

systems. But I believe to have an effective security program, it is

a discipline that needs to be practiced every day, and it has to be

incorporated into the daily operations.

So a lot of the comments that have been made by my esteemed

colleagues here I support all the way down the line, in that as a

CIO I need to incorporate that for the Department as a whole, so

that it is practiced on a daily basis, so that we can effect remediation in Internet time, when a vulnerability is identified.

Mr. HORN. Well, thank you. That is very helpful.

Let me ask just a few more questions, and then we will call it

a day.

Ms. Gross——

Ms. GROSS. Yes?

Mr. HORN [continuing]. You’ve got a very active record, through

the President’s Council on Integrity and Efficiency, in helping both

the agencies and Inspectors General implement the—excuse us.

[Bells are ringing.] How many minutes? Ten? It is 9 minutes to go.

You can see you are about to be released by the votes. This

would be a great place if it wasn’t for all the votes, you know.

[Laughter.]

You have given us some very good testimony. So, Ms. Gross,

helping both the agencies and the Inspectors General implement

the government information security reform provisions, I was just

interested; you have been active in this. You have helped in that.

What challenges do you see for Inspectors General expanding their

annual evaluations to encompass all agency systems?

Ms. GROSS. I think the challenges for the Inspectors General are

to make sure that there is implementation with agreed-upon recommendations, but I think a wider perspective than just the narrow, let’s do the next GISRA report, which is very time-consuming

and very resource-intensive, is to make sure that they are focusing

on issues governmentwide. I think that it is very important that

the individual Inspectors General go back into the PCIE, which is

the IGs’ group, and look to see both best practices and also look to

see about how can they help. Since the President is going to have

an initiative with e-government, IG’s need to make sure that information will be available, that it will be secure, and that it will have

integrity. Unless the IGs move out governmentwide and look past

their own agencies, I think we are going to have a problem. So that

would have been my thrust.

Mr. HORN. Well, thank you.

Mr. Forman, has your office considered imposing mandatory security standards and requirements on Federal agencies?

Mr. FORMAN. Requirements we have; we will continue to do that,

and we will tighten that up. Standards we rely on NIST, under the

Computer Security Act for Federal information processing standards.

126

There is another area where some people would call them standards, but they are architecture elements that are agreed upon.

They are not technology standards at the NIST or FIPS level. For

that, we have orchestrated—and I have actually done some

changes in my role as directing the CIO Council. We have the Architecture Committee, which focuses on this. Lee Holcomb, the CIO

at NASA, chairs it. John Gilligan, who had been chairing or cochair of the Security Committee is now co-chair of the Architecture

Committee. It is through that I believe we can be most successful.

There is a final element, which is, how do we get patches out

rapidly when major threats are identified? That is an area where

we need to rapidly get in touch with at least 40,000 people. So I

am making increasing use of FedCirc for that.

Mr. HORN. Well, I want to thank the following people that prepared this hearing: J. Russell George, staff director and chief counsel, standing-up back there; and Bonnie Heald, deputy staff director; Claire Buckles, on my left, a very fine professional staff member on loan to us. And thank you.

Earl Pierce, professional staff, isn’t here today, and then Justin

Paulhamus, majority clerk, is with us doing a great job. He just

came in with us. And Michael Sazonov, subcommittee intern, and

our court reporter, Joan Trumps. Thank you very much, and

thanks to all of you.

If we might, I think we will send you a few questions, and put

them at this point in the record.

So, unfortunately, I have got to get over there and vote. We are

adjourned.

[Whereupon, at 12:01 p.m., the subcommittee was adjourned, to

reconvene at the call of the Chair.]

[Additional information submitted for the hearing record follows:]

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

Æ