U.S. GOVERNMENT PRINTING OFFICE

69–819 DTP WASHINGTON : 2001

ENHANCING COMPUTER SECURITY: WHAT TOOLS

WORK BEST

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

INFORMATION, AND TECHNOLOGY

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SIXTH CONGRESS

SECOND SESSION

MARCH 29, 2000

Serial No. 106–181

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: (202) 512–1800 Fax: (202) 512–2250

Mail: Stop SSOP, Washington, DC 20402–0001

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

DAVID M. MCINTOSH, Indiana

MARK E. SOUDER, Indiana

JOE SCARBOROUGH, Florida

STEVEN C. LATOURETTE, Ohio

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

BOB BARR, Georgia

DAN MILLER, Florida

ASA HUTCHINSON, Arkansas

LEE TERRY, Nebraska

JUDY BIGGERT, Illinois

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

HELEN CHENOWETH-HAGE, Idaho

DAVID VITTER, Louisiana

HENRY A. WAXMAN, California

TOM LANTOS, California

ROBERT E. WISE, JR., West Virginia

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

CHAKA FATTAH, Pennsylvania

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

HAROLD E. FORD, JR., Tennessee

JANICE D. SCHAKOWSKY, Illinois

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

DAVID A. KASS, Deputy Counsel and Parliamentarian

LISA SMITH ARAFUNE, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY

STEPHEN HORN, California, Chairman

JUDY BIGGERT, Illinois

THOMAS M. DAVIS, Virginia

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

JIM TURNER, Texas

PAUL E. KANJORSKI, Pennsylvania

MAJOR R. OWENS, New York

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

MATT RYAN, Senior Policy Director

BRYAN SISK, Clerk

TREY HENDERSON, Minority Counsel

(III)

C O N T E N T S

Page

Hearing held on March 29, 2000 ............................................................................ 1

Statement of:

Brock, Jack L., Jr., Director, Governmentwide and Defense Information

Systems, U.S. General Accounting Office, accompanied by Jean Boltz,

U.S. General Accounting Office ................................................................... 7

Collier, Paul, division general manager, Identix, Inc .................................... 39

Nelson, Dave, Deputy Chief Information Officer, National Aeronautics

and Space Administration ............................................................................ 27

Letters, statements, et cetera, submitted for the record by:

Brock, Jack L., Jr., Director, Governmentwide and Defense Information

Systems, U.S. General Accounting Office, prepared statement of ............ 13

Collier, Paul, division general manager, Identix, Inc, prepared statement

of ..................................................................................................................... 42

Horn, Hon. Stephen, a Representative in Congress from the State of

California, prepared statement of ................................................................ 3

Nelson, Dave, Deputy Chief Information Officer, National Aeronautics

and Space Administration, prepared statement of .................................... 30

Turner, Hon. Jim, a Representative in Congress from the State of Texas,

prepared statement of ................................................................................... 5

(1)

ENHANCING COMPUTER SECURITY: WHAT

TOOLS WORK BEST

WEDNESDAY, MARCH 29, 2000

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY, COMMITTEE ON GOVERNMENT REFORM, Washington, DC.

The subcommittee met, pursuant to notice, at 10 a.m., in room

2154, Rayburn House Office Building, Hon. Stephen Horn (chairman of the subcommittee) presiding.

Present: Representatives Horn and Turner.

Staff present: J. Russell George, staff director and chief counsel;

Matt Ryan, senior policy director; Bonnie Heald, director of communications; Bryan Sisk, clerk; Ryan McKee, staff assistant; Trey

Henderson, minority counsel; and Jean Gosa, minority assistant

clerk.

Mr. HORN. A quorum being present, the Subcommittee on Government Management, Information, and Technology will come to

order.

This is the second in a series of hearings to examine computer

security concerns in the Federal Government. The subcommittee’s

first hearing 3 weeks ago shed light on two important topics,

awareness of the increasing number of computer threats against

Federal and private computer systems, and the need for a coordinated Federal effort to meet this challenge.

History is full of claims of developing the ultimate weapon,

whether it was a battleship, a supersonic fighter jet, or a weapon

capable of massive destruction. Today’s computer systems and networks provide the newest frontier, the weaponry of knowledge.

With only a few keystrokes, computers provide massive amounts of

information, information that only a decade ago would have taken

months or years to compile. It is, of course, imperative that these

computers and the wealth of information they contain be protected.

Nearly all computer networks are vulnerable to attack at some

level, but steps can be taken to prevent or reduce those intrusions.

Organizations must focus on two areas, physical security and information security. No one would buy an expensive house, furnish it,

then walk away leaving the doors wide open. Physical assets must

be protected. Yet many organizations fail to take basic precautions

to protect either their facilities or their computer systems.

Electronic government and electronic commerce trends should

continue to dictate the way important data are exchanged. From

tax refunds and health records to credit card purchases and Social

2

Security numbers, organizations must demonstrate that the information flowing into their computers is secure. Tools are available

to help organizations and citizens protect their computers against

unwanted and unruly intruders. However, they must be carefully

used to ensure that they lead to meaningful improvement. Today

our witnesses will talk about some of these tools that can enhance

computer security at little or no cost. We welcome our panel of witnesses. We look forward to their testimony.

[The prepared statement of Hon. Stephen Horn follows:]

3

4

Mr. HORN. It is now my pleasure to call on the ranking member

of the subcommittee, Mr. Turner of Texas, for an opening statement.

Mr. TURNER. Thank you, Mr. Chairman. This is the second in a

series of hearings that the chairman has designated to discuss the

issue of computer security in the Federal Government, and it is apparent to all of us that we have become increasingly dependent

upon computer systems and the Internet. It represents one of our

greatest strengths, but perhaps also one of our greatest weaknesses

and vulnerabilities.

While we rely extensively on electronic data, we have become increasingly vulnerable. The General Accounting Office has stated

that our computer security system is not where it needs to be to

protect ourselves from cyberinvaders. We lack an overall comprehensive program in the Federal Government to protect our computer system, and billions of dollars in Federal assets and large

amounts of sensitive data are at risk to the threat of hackers, both

foreign and domestic.

I am pleased that the chairman has chosen to focus upon this

issue of computer security, and I look forward to hearing from each

of our witnesses today.

Mr. HORN. I thank the gentleman.

[The prepared statement of Hon. Jim Turner follows:]

5

6

7

Mr. HORN. Let me tell you the procedure here. Some of you have

testified here before, but when we introduce you, and we will go

in the order it is on the agenda, your statement, as written, is fully

in the record. What we would like you to do is spend 5 minutes and

at the most 8 or 10 to summarize your statement, not read it to

us. We can read. Then we have more time for dialog between the

three of you and dialog with the Members here today.

So we, as you know, swear in all witnesses before these subcommittees of government reform, and if you will stand, raise your

right hand, we will swear you in.

Anybody that is going to give you advice, swear them in, too.

[Witnesses sworn.]

Mr. HORN. The record will note that three witnesses and one

helper affirmed the oath.

So we will now start with Mr. Brock of the U.S. General Accounting Office, part of the legislative branch of Congress, who does a

wonderful job on both programmatic and fiscal matters.

Mr. Jack Brock is no stranger to this subcommittee. He is Director of Governmentwide and Defense Information Systems for the

U.S. General Accounting Office, otherwise known as GAO.

Mr. Brock.

STATEMENT OF JACK L. BROCK, JR., DIRECTOR, GOVERNMENTWIDE AND DEFENSE INFORMATION SYSTEMS, U.S.

GENERAL ACCOUNTING OFFICE, ACCOMPANIED BY JEAN

BOLTZ, U.S. GENERAL ACCOUNTING OFFICE

Mr. BROCK. Thank you very much, Mr. Chairman. Good morning

to you. Good morning, Mr. Turner.

I would like to note that my license plates say Native Texan.

I would also like to introduce Ms. Jean Boltz. Ms. Boltz is a senior manager in my group and actually directs a great deal of our

computer security work.

Mr. HORN. That’s B-O-W-L-T-Z.

Mr. BROCK. B-O-L-T-Z.

Mr. HORN. I am glad I asked.

Mr. BROCK. I know you have had a prior hearing on computer

security, and in that hearing you discussed the importance of good

security, but good computer security is important to every facet of

government operations. It assures the integrity and the confidentiality of information and key processes. It is important to national

security. It is important to other critical operations. It is important

in assuring the integrity of transactions between the government

and its citizens; and as e-commerce and e-government become more

prevalent, it is the cornerstone of making sure that those services

actually achieve the objectives of better government, more efficient

government, more productive government.

What we found, though, in our work, as you have noted, is that

at virtually every major agency that we go to computer security,

the computer security practices within those agencies doesn’t

match the importance of the topic. We or other independent auditors whose work we reviewed have found serious computer security

weaknesses in virtually every major Federal agency, and these

weaknesses threaten or potentially threaten the ability of these

agencies to protect the confidentiality of key data, to perform critiVerDate 11-MAY-2000 08:42 Feb 16, 2001 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 C:\DOCS\69819.TXT HGOVREF1 PsN: HGOVREF1
8

cal operations, and assure the integrity of important financial and

data transactions. I have identified several examples in my testimony, but I would just like to quote here what we found at EPA,

which is our most recent report.

We found serious and pervasive problems that essentially render

EPA’s agencywide information security program ineffective. We

found that the current security program planning and management

is largely a paper exercise that has done little to substantially identify, evaluate, and mitigate risk to the agency’s data and systems.

What we found essentially, Mr. Chairman, that EPA has a central network, and most of EPA’s business functions operate off that

network. We were able to penetrate the firewall, which was largely

ineffective, penetrate limited access controls, and essentially could

have had access to most of the information and processes that ran

throughout the entire agency. So the entire agency in this case was

vulnerable.

EPA is not alone. Recent reports at DOD, at NASA—Mr. Nelson

will be talking about that in a moment—the State Department, the

National Finance Center, the Veterans Administration all had serious weaknesses. I would, at the risk of preempting Mr. Nelson, say

that they have made substantial strides in improving their program, and our limited followup work has substantiated those improvements.

I would like to spend just a moment, if I could, going over the

common problems that we find at agencies, and we have a chart

that I would refer you to. Mr. Mike Gilmore is up there handling

the charts.

First of all, computer security programs have to support the organizational mission and goals of the agency. They can’t be divorced from what the agency does, or they are not relevant.

Running across the agency is an entitywide security program

planning and management. This is what assures the relevancy of

your computer security program to what you are trying to achieve

at the agency. And then under that we have found a series of problems that are present in most of our reviews. First of all, many

agencies do not have relevant security program planning and management, and we are going to talk about that in a little bit, but

that’s the root of the problem. When you look at access controls—

access controls, you were talking about a house, access controls

represent the fence around the house. They represent the lock on

the door. They are not in place.

Here we are talking mainly about processes that provide authentication that you are who you say you are and, second, that limit

your rights to material that’s relevant to you.

Software development and change controls. We are actually

doing an assignment for you right now and we are meeting with

your staff next week to go over the results of that. That means that

when you change software, when you make changes in code, or

when new software is introduced, that is tested to make sure that

you are not maliciously—you are inadvertently introducing new

weaknesses into your application, we find that to be a common

problem in many agencies, where that testing is not done, and

weaknesses are then inserted into an application that was previously strong.

9

The next one is on service continuity controls, there you want to

maintain the ability to recover from disaster, or if the worst happens, that you are able to take strides to recover your operations

and to move forward. Many agencies that we have gone to do not

have good service continuity controls, would not be able to reconstruct their principal systems, and would have difficulty bringing— coming back up to speed in an acceptable amount of time.

System software controls, these are really sort of the heart and

brains of many systems. These are the basic operating systems, the

utilities, that if you don’t have good controls over these, a hacker

or an intruder can go in and assume control over the entire network by becoming a systems administrator and assuming higher

powers than he or she should.

And then finally segregation of duties, if you don’t separate the

duties from the person who writes the code, the person who inserts

the code, the person who tests, the various people who have some

element of authorities over the computer security, then you run the

risk of empowering one person or a small number of people with

too much authorities. It is much like someone who might have authorities over receiving funds, recording those funds, disbursing

those funds, and then doing the final accounting. The more you

place those duties in the hands of one or a very small number of

people, you run the risk of malfeasance.

These are the problems, and you requested that we prepare for

you a listing of things that you could do to fix the problems. This

really falls into two categories: Is what can you do right now, and

what do you need to do on a long-term to have more permanency?

Again, I am going to go back to your house example.

Ideally, in a house you have some sort of an alarm system, a fire

suppressant system, or whatever. In this case, the house is on fire.

Building a fire suppressant system isn’t going to do you much good.

You have to throw a pail of water on it right now. So we have identified a number of actions that an agency can do now.

Any agency could start on this this afternoon and work on it. So,

again, I would refer you to the next table up there, and we have

identified a number of things in our work that can be done. The

diagram there is designed so that if you take these actions, you

will, in fact, be compressing risk and minimizing risk. The first

thing you need to do is to increase awareness at all levels, and at

the management levels managers need to be aware that this is

their information, these are their programs, that poor computer security endangers their activities that they have accountability and

responsibility for.

At the user level, you need to make users aware that actions

they take in terms of poor password control, sharing passwords, not

following agency procedures and processes may, in fact, endanger

the system, and at the technical level system administrators need

to be aware that if they don’t take their actions seriously, if they

don’t have the right kind of training, if they don’t institute software

patches or whatever, they are also endangering the system. So

there needs to be a much higher level of awareness in most agencies.

Second, you have to make sure that the controls you have work.

I know there are going to be tools demonstrated here today. Every

10

agency has tools, and when we go into agencies, we frequently find

that those tools aren’t working. They are not turned on. They are

not monitored. So agencies are spending money for tools, but they

are not using the tools. It is very similar to the set of tools I have

in my garage that my father gave me when I moved here from

Texas 27 years ago. He said, you will need these tools, and I am

sure I do need the tools, but they are still in the tool box.

The same thing with many agencies. Tools are present, but they

are not turned on, they are not monitored. You are really not sure

that they are working or not.

Third, is implementing software patches. The Carnegie Mellon

CERT-CC has said in most of the intrusions they get, most of the

incidents that are reported to that organization exploit known

vulnerabilities, and for most known vulnerabilities there are existing patches that could be implemented. Many agencies are aware

of the patches. They don’t follow the advisories that are coming up

from the vendors, they don’t follow the advisories that are coming

out from the CERT, or they don’t follow the advisories that come

out of their own agencies. By not patching software with known

holes, they are leaving in place known vulnerabilities that offer a

hacker or an intruder an opportunity to enter into their system.

Next, is to identify and propagate pockets of excellence. Almost

every agency we go to, regardless of their overall program and

whether it is good or bad, have individual centers or individual programs that work really well. Unfortunately, they are working in

concert with other programs that don’t work so well, and so sometimes the good effect there is mitigated. But if agencies would identify those pockets of excellence, use those as best practices within

the agency, where the agency culture to some degree has already

accepted these practices, propagate those across the agency, there

would be opportunities for immediate improvements.

Finally, to focus on the most common vulnerabilities first, when

we go into agencies, we find throughout the agency that there are

a few set of problems that come up time and time again, and surprisingly enough, when we go from one system administrator to the

other, they are frequently not aware of the problems that their

compatriot down the hall is facing. These need to be shared within

the agency. Those need to be addressed first.

Further, we are finding that many of these common problems

also exist across agencies, and, again, there is very little sharing

of that information across the agency.

If we could turn to the next chart, please.

And these are things agencies can do now. However, computer

security is very dynamic. The technology is changing in a hurry.

The tools are changing. The techniques that intruders might be

using are changing. So the program really has to have a sense of

structure in order to make sure that the computer security program is dynamic and, in fact, changes as the threat and risk

changes.

About 2 years ago we did a study of leading organizations that

had good computer security, and we found a common set of practices in these agencies that we believe are appropriate for Federal

agencies to use. In fact, the Federal CIO Council endorsed these

11

practices, and several agencies have included them within their

own policy and structure.

The S. 1993, the computer security bill introduced by Senators

Thompson and Lieberman earlier this year, also incorporates these

practices, they start off with a central focal point for computer security. Regardless of whether the agency is decentralized or centralized, the central focal point—there was always a central focal

point. I think this is true at NASA, where NASA is highly decentralized, and yet Mr. Nelson is the central focal point for security.

The real cornerstone of that, though, is that agencies need to assess the risk and determine needs. Without risk assessment, you

can’t move to that next box and have effective controls and policies.

Your controls and policies need to be built on your risk assessment.

They need to be appropriate for the risks that you are facing and,

from that, promote awareness. Again, you can increase awareness

at all levels on a general level, but at some point the awareness

needs to be focused on your exact controls that you are using, how

to use them, and on the risks that you are facing so that people

throughout the organization can take appropriate action; and then,

finally, monitor, and evaluate.

There are two parts to that. First, managers need to do their own

self-evaluation so that they can continually assess where the agency is; and second, there needs to be an independent evaluation,

something that we might do or the NASA IG might do that would

allow both the agency and the oversight agencies or committees

such as yourself to take a look at what is going on within the agency. We feel that if this framework was adopted, truly adopted, by

agencies, it would go a long ways toward correcting the common

problems that we see.

By establishing a framework, we think that an agency can fulfill

several key tasks: One, that agency actions are appropriately controlled and coordinated; that the testing tools are appropriately selected and tested; that personnel involved in using the tools are

trained; that good practices and lessons learned are shared on an

agencywide basis; that controls are systematically tested to ensure

that they are effective; and that appropriate risk management decisions are made regarding the best way to address and identify

problems.

I would just like to highlight that a little bit. If you do not assess

the risk, the controls that you have implemented may or may not

be appropriate. You may well be spending too much money. You

may not be spending enough money. But almost certainly you will

have the wrong kind of control in place, and you really won’t address your company’S problems.

In conclusion, we also believe, Mr. Chairman, there needs to be

some reconsideration of the current legislative framework. The

Computer Security Act and A–130, which provides the regulations

for the Computer Security Act, really is a system-based piece of

legislation. It is based on making every system good and that the

accumulation of those good systems will, in fact, represent a good

agency program. I don’t think that works. It hasn’t worked. Legislation needs to be considered that would, in fact, provide a management framework and a management perspective.

12

Also CSA has two categories of information. It is classified or

nonclassified, sensitive or nonsensitive. Actually, information is

graduated. Some systems are at a very low level of risk. Some are

at a high level of risk, and policies need to be implemented that

really reflect that gradation. It doesn’t recognize the need for an

independent audit, and second—or third, it doesn’t recognize the

need for more prescriptive guidance that would give agencies more

of a framework.

Finally, there is no call for central leadership, somebody that can

stir the pot, somebody that can make sure that things are being

done, someone that can provide leadership across the government.

That completes the summary of my statement, Mr. Chairman.

Mr. HORN. Thank you very much, Mr. Brock. That’s a most helpful summary.

[The prepared statement of Mr. Brock follows:]

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

Mr. HORN. I might add, I mentioned that all of your texts will

be in when we introduce you. So will your resumes.

The next gentleman, the next two, have very rich resumes. Dr.

David Nelson in particular has certainly been through the whole

computer community, I can see, in terms of committees and responsibilities you have had.

Currently, he is Deputy Chief Information Officer at the National

Aeronautics and Space Administration.

Mr. Nelson.

STATEMENT OF DAVE NELSON, DEPUTY CHIEF INFORMATION

OFFICER, NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

Mr. NELSON. Thank you, Mr. Chairman. Members of the subcommittee, I am pleased to appear before you today to discuss

NASA’s views on the security of our information technology environment. I have submitted my written statement for the record. My

oral summary will be quite consistent with that of Mr. Brock.

I would like to emphasize three points. My first point is the importance of a sound management framework for information technology security. Two years ago, NASA did not have a satisfactory

framework. Since then we have worked hard to align our policy, organization, funding and objectives for effective security.

This began with senior management attention and support, including the recognition that information technology security is required for safety of lives and property. In an internal study, we

benchmarked ourselves against good organizations and copied the

best of what we found. We accepted the recommendations of the

General Accounting Office review of NASA security that Mr. Brock

referred to.

Our actions included issuing up-to-date policy, establishing a

senior Council to set strategic directions, clarifying management

responsibilities, budgeting for key tasks and collecting metrics of

progress.

NASA places operational responsibility for information technology security on line management, complemented by a cadre of

computer security professionals who provide technical assistance

and oversight.

I have mentioned budgets and metrics. If I could have the chart,

please.

This chart shows one of our metrics. Plotted is the number of serious incidents. Those are things like destruction of data, theft of

passwords, or damage to software, versus on the X axis the percent

of the information technology budget that is spent on security.

Each point is a specific center, and the data is real. Notice the

trend line. As you start from the left, as the percentage of budget

increases to about 2 percent, the number of incidents levels off.

This suggests that spending about 2 percent of information technology budget on security gives a good return on information.

Spending less increases risk, as shown by the trend line. Spending

more may not add much return. We have compared notes on this

metric with leading companies. They see the same sort of trend

and the same sort of sweet spot.

28

Now, this metric isn’t perfect, but it gives us a place to start.

Metrics like this are our headlights. They guide our actions and indicate where we need to work harder.

My second point is the importance of training. NASA is a highly

technical organization. We create and modify leading-edge information systems to serve our missions. Security risk evolves as threats

and, as a result, vulnerabilities change, so our personnel must understand the principles of effective security and apply them to

changing situations. Program and project managers must be

trained to evaluate risks and vulnerabilities in designing and maintaining systems entrusted to them. System administrators must be

trained to properly configure and upgrade their systems, to recognize attacks and to respond to them. Users must be trained to

practice good security, to recognize certain types of attack, and to

know how to get help.

Over the last 2 years, NASA has developed or acquired new

training material for managers, system administrators, and users.

This training is now mandatory for all civil servants, and we are

gathering metrics on its delivery. In addition, NASA has requested

comments on a draft regulation that would require NASA contractors to adhere to the same standards of training that apply to civil

servants.

My last point is the importance of appropriate tools. Security

tools, which are a combination of computer hardware and software

programs, help to protect systems and defend against attacks.

The technical details of a particular attack may be very complicated, but once the attack is understood, defense against it can

be incorporated into a tool that is easy to use by a trained person.

Organizations with modest funding, but substantial technical

skills can obtain free, reputable tools from the Internet that offer

good capability. However, they may not be well-documented or supported and may be somewhat difficult to use. NASA tends to purchase key commercial tools and augment them with free tools. Obviously, purchased commercial tools have a higher initial cost.

However, they are often easier to use and may have a lower sustaining labor cost.

Most successful attacks are enabled by a relatively small number

of weaknesses, as Mr. Brock has observed. These include lack of

virus detection software; trivial passwords that can easily be

cracked, that means decrypted; failures to install patches for wellknown software vulnerabilities; and poorly configured computers

with open vulnerability holes. Tools help us to deal with each of

these classes of problems. In my written statement, I have described a number of these and the practices that NASA uses.

New problems keep appearing, along with new defenses. Thus,

the tools and their use must evolve. There is no substitute for good

proactive management that can respond quickly and effectively.

Unfortunately, easy-to-use tools for attacking systems are also

available on the Internet, and they are constantly getting better.

This means it takes less skill to mount a sophisticated attack than

it used to. The ecologists would call this a classic predator-prey situation in which both predator and prey evolve quickly to secure

competitive advantage.

29

In conclusion, NASA is facing the challenge of the evolving security universe by marshalling effective management, effective training, and effective technology. We are in an environment of increasingly numerous and serious threats, along with systems whose

vulnerabilities tend to increase as they become more complicated.

Fortunately, our tools and process allow us to make progress in

dealing with this environment, but it is a never-ending process. We

take response—we take seriously our responsibility as stewards of

the public’s space and aeronautics information and systems. We are

committed to working with other agencies of the executive branch

and with the Congress to ensure that we maintain the proper balance between accessibility of research results and protection of our

information technology investment.

Thank you for the opportunity to testify before you today. I look

forward to answering your questions.

Mr. HORN. Well, thank you very much.

[The prepared statement of Mr. Nelson follows:]

30

31

32

33

34

35

36

37

38

39

Mr. HORN. Those bells show that there is a vote on the floor, so

we are going to have to go into recess for 20 minutes before we will

take up Mr. Collier and then the questions. So relax.

[Recess.]

Mr. HORN. The subcommittee will now end the recess for the voting on the floor, and we will begin with Mr. Paul Collier, division

general manager of Identix Solutions.

You might want to tell us a little about Identix Solutions. Put

in a plug so I can understand it.

Go ahead, Mr. Collier.

STATEMENT OF PAUL COLLIER, DIVISION GENERAL

MANAGER, IDENTIX, INC.

Mr. COLLIER. Thank you, Mr. Chairman. Thank you for inviting

me to be a part of this distinguished panel today. My testimony

will focus on technology available that offers a significant advance

in the protection of computer networks and critical data systems.

The greatest challenge we face in controlling access to computers

and information is positive user authentication. Recent events

show that the proliferation of the Internet, our increased reliance

on computer-based information and the rapid growth of mobile

computing has far outpaced our ability to secure these systems.

Traditionally the use of passwords has been our best defense. Recent advances in password cracking software and increased computer processor speeds have required passwords to become more

complex and changed more frequently.

The human element in this new equation has been pushed to the

limit. We now see more passwords written on the back of mouse

pads, on desk leaves, and even on Post-It notes affixed to monitors.

In addition, users tend to leave work stations logged on and unattended because of the added inconvenience.

It should be noted that there is no single technology that can

serve as a panacea for positive user authentication. However, a

combination of available technologies, working in concert, can provide a significant advance in addressing this need. The positive

user authentication model consists of three elements, something

you have, something you know, and something you are: Something

you have, such as a smart card with a digital certificate embedded

in the microprocessor; something you know, a simple PIN, as few

as four digits; and something you are, one or more biometrics.

Someone can give an unauthorized individual their smart card or

token and tell them their PIN number or password. The biometric

is the only nontransferable element in this model. Briefly, a biometric is a quantitative measurement of a unique human attribute

or behavioral characteristic, such as fingerprints, face, voice, iris

pattern, etc.

Using fingerprints as an example in this model, a finger is placed

on a sensor and then scanned. The image of the fingerprint is then

processed by a series of algorithms which convert it into a binary

representation or template. This template is then compared to a

reference template stored either on a computer or a card-based

data storage medium. Like most biometrics, you cannot reverse-engineer this binary representation and recreate the fingerprint

image.

40

Fingerprint biometrics have been used in many civil and government programs for over 10 years. They have been very effective in

reducing fraud, eliminating multiple identities, and securing access

to sensitive areas.

These wide-scale deployments have served as real-world proving

grounds for this technology and involve many millions of people.

Knowledge gained from these programs and applied to improvements and cost reductions help produce much of the commercial

products available today.

The Federal Government, in partnership with industry, has

made a significant contribution to the evolution of biometric technology. Biometrics would not have advanced to their present level

without the help of such agencies as the Department of Defense,

the National Security Agency, the Departments of Justice, Energy,

Treasury and the National Institute for Standards and Technology.

Like many technologies, biometrics have become faster, better,

and cheaper. An example, only a few years ago the cost to integrate

fingerprint biometric technology was approximately $3,000 per

computer. Recent advances have reduced the cost to less than $100

per computer. History has shown the ephemeral nature of benchmarks in information technology, and in the near future we can anticipate still further reduction in costs and improved performance.

Commercial Off-The-Shelf products are entering the government

market via GSA schedule and other procurement vehicles. The recent Smart Access/Common ID procurement by the General Services Administration represents a 10-year, $1.5 billion governmentwide contract that includes provisions for biometrics used for both

physical and logical access.

Mr. Chairman, with your permission, I would like to demonstrate

two of the products available today. The first is configured to demonstrate the positive user authentication model that I discussed

earlier. The computer work station that you see here is in a locked

mode. Attached to it is a keyboard with an integrated smart card

reader and fingerprint scanner. These are commercially available,

and the government has really taken to this particular one. The

user takes his or her smart card, which, as you can see, has the

smart card chip on the back, and inserts it into the work station.

The log-on prompts the user to choose their log-on ID, enter the

four-digit PIN number, which is the something-you-know portion—

it is telling me I haven’t put my finger on the scanner—and then

place my finger on the scanner to complete the log-in process.

If the user removes the smart card from the computer keyboard,

the system locks.

The second product, which is available commercially, many of the

components of which were developed in conjunction with the National Security Agency, is a PC card which has a built-in fingerprint scanner. This is a simple replacement for password configuration that you see here. The user need only go up to the computer,

place their finger on the scanner, and the log-on process is complete, nothing to remember.

In 1998, several key companies founded the International Biometrics Industry Association. The charter is a nonprofit trade association to promote competition, establish an industry code of ethics,

represent industry concerns, and serve as a single voice on major

41

issues such as privacy, computer security, e-commerce, and legislative issues.

I would like to thank the chairman for the opportunity to appear

here today and demonstrate these products to you. Thank you, Mr.

Chairman.

Mr. HORN. Well, we thank you and your other two colleagues

there.

[The prepared statement of Mr. Collier follows:]

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

Mr. HORN. Let me just ask you about the biometric technology

chart. While going over to vote and coming back, I talked with Mr.

Tauzin, who is very interested in this, and he is going to have a

meeting of the Internet group here on May 19th and 20th. So we

hope what will come out of this testimony of yours and the previous panel a couple of weeks ago will be helpful.

One of these patterns is rather interesting to me. A few years

ago, the Immigration and Naturalization Service put on a demonstration in a room in the Capitol, various things they could do

to identify people. I was fascinated by the one where you put your

hand in.

Is that on your chart, the vein patterns, paren, hand? Is that the

one, or is that separate from that?

Mr. COLLIER. They are different technologies, though they are essentially similar.

Mr. HORN. Looking at the spread of your fingers, and they

claimed it was better than fingerprints.

Mr. COLLIER. Well, we all have claims, I guess. The hand geometry system used by the Immigration and Naturalization Service,

I think, were deployed in their INS-Pass Program and are still

working to this day. Hand geometry is a viable technology. Fingerprints appear to be what the government has embraced because of

the long experience with them.

Mr. HORN. Yes. So is there any sort of works on this that will

give us an idea as to which is the better of the two between fingerprints and the hand pattern? Anybody research that?

Mr. COLLIER. I believe they both have their place. There are

about 15 different biometric disciplines. There is no one discipline

that fits all scenarios. The real issue comes down to cost per seat,

per deployment. Some of the biometrics available are extremely effective, but may cost $100,000 per unit to deploy. It is never going

to see widespread deployment at that cost.

There are studies that have been done by the National Security

Agency that are available. There are studies done by the National

Biometric Test Center at San Jose State University, and Sandia

Laboratories did some studies several years ago for the Department

of Energy.

Mr. HORN. This is a question really for all of you, and that’s

based on the testimony. It appears many computer security tools

are free or at little cost, and I guess the question is this: Why

aren’t more agencies taking advantage of all the security tools

readily available to them? What is your experience on that?

Mr. BROCK. Well, I think that many tools are free, are readily

available. Many of the tools you can actually download from the

Internet or are made available from vendors free or low charge.

What we have seen is that agencies inconsistently use the tools,

or they don’t provide the appropriate training to understand how

to use the tools, or they don’t even know how to turn the tools on.

So while the tools are available, they are just not used properly.

That seems to be the biggest problem that we have found.

Mr. NELSON. I would agree and would add there is motivation

and resources involved. As I said in my testimony, nothing is free

because there is a labor cost. Many system administrators were

sort of pressed into the job. They weren’t well-trained. It is a new

68

field, and many of them are overloaded because management

doesn’t appreciate the importance of security, so that even if they

know in principle the tools are available, finding the time to acquire them, to understand them, and to deploy them and to then

take action based on them is a pretty big load.

As I indicated in my testimony, at NASA we have deployed uniform suites of commercially acquired tools because our study—I

won’t say it was a thorough study, but we looked at the cost of

labor and the ease of use, and we found that the commercial tools

were a better buy for us, but then augmented by selected free tools.

No tool is perfect.

Mr. HORN. I was interested in your testimony where you put the

stress on training and supervision, and you remind me now on

management we put a measure through here, and it is, I think, almost law, or it is still in the Senate, and that would be to give the

new President, whoever that is, a chance to relate to the top management that he would bring in. Ordinarily, between the Cabinet,

the independent agencies, that’s about 30. Then you have got about

300 Commissioners and Under Secretaries, so forth.

I think we definitely ought to get on that agenda, then, their understanding of this type of security management. If it goes up that

high, and they don’t understand it, I think it will—and staff will

note this, and we will put it in maybe even as two words or something in what is coming out of the Senate.

Mr. NELSON. What we did at NASA at the Administrator’s direction, the Chief Information Officer and I—I am Deputy Chief Information Officer—visited each of our 10 centers and headquarters

and gave hands-on training briefings to the center senior and middle managers.

Now, that wasn’t a lot of time, but it emphasized that we meant

business, and we talked about metrics. We talked about actions we

were taking. We talked about their responsibilities. It seems to be

working. So I would commend the administration to think of something like that.

Mr. HORN. Yes, I agree. The way we got leadership finally on the

Y2K thing in the executive branch was when Mr. Koskinen was

picked and went around and sat down with all the Deputy Secretaries of each department to get them to understand that this

was serious business.

Any other comments on that? Mr. Collier.

Mr. COLLIER. The tools that are available at little or no cost need

only the person’s desire to implement them. We constantly see

Windows basic tools for securing systems totally inactive. It is a

tradeoff between security and convenience. Biometrics, we feel,

brings both to the party in the sense that it does give you the

speed. It is not something else to flip on and flip off. It is not something else lengthy to remember. If we look at what we have done

at passwords to overcome this ability for people to break into our

systems by finding out what our passwords are, it is not the dog’s

name anymore; it is not a simple thing that you can keep for a

year, or your wife’s maiden name. It is an upper/lower case, full

eight-character ASCII 2 set. It is extremely difficult for anyone to

remember that. Change it every 30 to 60 days, and give them three

or four to remember, it can bring about a problem.

69

So I think the real issue is utilizing the tools that are available

and making the operators understand that the security is important at the risk of what little inconvenience it is going to cause.

Mr. HORN. Well, with reference to this subject, where on the

Internet can organizations and citizens find these tools? Is it there?

Mr. NELSON. Let me speak to that. In my testimony I indicated

two sites. One, is our own NASIRC site, www.nasirc.gov. The second, that I indicated was the Carnegie Mellon CERT that I think

Jack also mentioned. They have a good set of tools.

With search engines and other news groups, it is probably a halfhour to get started. I mean, this is very easy to do. This is probably

the easiest step. There is the step of, well, what is good and what

is not so good; what is easy to use, what is not so good—what is

not so easy to use. But access is the easy part.

Mr. BROCK. I would agree with that.

Mr. HORN. Intrusion detection tools can either be manual or

labor-intensive. Is there a better way to monitor potential intruders?

Mr. BROCK. Intrusion detection tools are a necessity. What is difficult about intrusion detection tools is actually following up. I

mean, if you—you have an intrusion detection tool, and you are

logging in intrusions, you need to followup. The issue that we

found at many agencies is if they have intrusion detection tools,

and they are logging them in, frequently they are not following up

on the incidents to take corrective action or to do something to stop

the intruder. That’s why they are labor-intensive. You have to look

at each one individually.

I can’t recall any intruder detection tool that would automatically

fix the problem or stop the intrusion. At some point somebody has

to intervene.

Mr. NELSON. Let me speak to that. Right now, and I agree with

what Mr. Brock said, right now it is manual, it is labor-intensive.

At NASA we require that every incident be reported to the IT security manager at the center, and then to our NASIRC, which we use

as a coordination means.

So we send out encrypted alerts to our security people at all centers based on the incidents reported by each center. Many of those

incidents are detected by the intrusion detection tools. The securities managers followup with the system administrators to get

things fixed. Again, that’s quite manual.

What we are looking at and what I would encourage the industry

to work harder on is automated, if you will, artificial intelligence

means to identify intrusions and identify a recommended course of

action. One of the things we are looking at doing, we have not done

it yet, is to gather from each center—see, we are using the same

tool—into a centralized analysis location what those tools are reporting and apply the artificial intelligence to the set of reports. We

find that if one NASA is—one NASA center is being attacked, often

several others are. These are coordinated attacks. But I repeat, the

artificial intelligence tools for analysis do not appear to exist yet.

It is an area that NASA is tracking carefully, and we hope that in

the next year or two we will see something we can start to deploy.

Mr. BROCK. If I could just add to that, Mr. Chairman, that’s true.

The intrusion detection tools are very immature at this point, and

70

they are evolving. Again, another risk is that as—is once an agency

or an individual buys a tool, that tool is changing rapidly, and the

intrusion detection tools, they are changing very rapidly, and they

are not at a stage of maturity now where they are going to provide

the final answer.

Mr. HORN. Is there any way you can tell with the intrusion that

the—the type of computer is doing that, or is it just hopeless? Because I am looking at individuals have one capacity generally; foreign governments do have another capacity. If any of them have

something such as a Cray computer in terms of what they can spin

around and test things against to break through particular firewalls, I am just curious about that.

Mr. NELSON. Usually we can tell what is called the source Internet protocol address, and that identifies the location of the attacker

fairly well. Occasionally those addresses can be what they call

spoofed, which means they are faked, but typically we can identify

that.

Now, your discussion about the difference between an individual

and a foreign country, I wouldn’t make too much of that because

groups of individuals are acting together, and the power of modern,

even personal computers and certainly work stations is fully adequate to mount an attack that is very serious.

So we pay a lot of attention to individuals. Obviously when we

sense that it is a better organized group, all the way up to a government, we pay particular attention to it, but we wouldn’t want

to make too fine a point on that distinction.

Mr. HORN. Any other thoughts on that?

OK. Mr. Brock, you mentioned in your statement that poor security planning and management is, ‘‘the rule rather than the exception.’’ So why is this posture the rule and not an exception?

Mr. BROCK. I wish there was a real simple answer to that and

that it would be easy to fix. It is, unfortunately, like a lot of other

issues, and very similar to the Y2K issue, is that it—the actual

computer security break-ins, the failings there are technical. The

correction is a management issue. There have to be resources devoted to it. There have to be dollars, and there has to be training,

and the people that own the processes, that own the information,

that are accountable for that need to be accountable for computer

security. That is not the case, and until that ownership occurs, I

don’t think you will see widespread, systematic repair of the poor

computer security problems.

I think that happened in Y2K, in large part because of the intensive oversight in Congress, in large part because of Mr. Koskinen

coming on board, in large part because Federal managers were

made aware there was a crisis. Those three elements have not yet

been put in place for computer security.

Mr. HORN. Well, you have put them very well, and that’s what

I was leading to, in the sense that when Mr. Koskinen came on

board as assistant to the President, he worked with the Chief Information Officer’s Council and got the best out of them. And I

guess I would ask, does the Federal Government need one organization or one high-ranking information technology officer to coordinate security planning and management? Do we need to continue

a sort of Koskinen situation and relate it to security?

71

Mr. BROCK. That’s an excellent question. I guess when you start

off saying that’s an excellent question, that means you are going

to be wondering about my answer.

Mr. HORN. Is there an excellent answer?

Mr. BROCK. I hope so.

Mr. HORN. We are college professors. We ask questions. We don’t

answer them.

Mr. BROCK. Well, I will go ahead with the answer now.

The—I believe there needs to be a Federal CIO. I think very

strongly that the information management issues, the information

technology issues that run across agencies are serious. It is not just

in computer security, but it is in terms of how you control your investment dollar. It is do you have an architecture that will support

your business needs and your technical needs. There are a series

of issues that need to be addressed on a consistent basis.

I think the CIO Council has done a reasonable job of looking at

some of these, but they are not in power. They don’t have budget.

They don’t have staff. They are volunteers on this. There needs to

be someone who is providing more direction, more leadership.

Now, in terms of—and I believe that in this case a Federal CIO

would also be responsible for computer security.

Similarly, if you decided that computer security was an important issue in terms of critical infrastructure protection, where you

were also involving the private sector and you were involving physical security as well, I could easily see a role for a national coordinator for critical infrastructure protection that might be separate

from a Federal CIO who would be dealing primarily with agency

responsibilities.

Mr. HORN. I have one reservation here, having been in the largest educational system in the country, which is California State

University system. When you put somebody in the system headquarters, everybody sort of says, oh, that’s their problem, and pretty soon they forget that it is their problem. They are the campus

administrators; that’s where it happens. It doesn’t happen in headquarters. They never educated a student in their life. A university

does, and so do our departments. They are mission-oriented, and

they are producing things. I worry if, say—to say, well, that isn’t

my business, let those people over in OMB; or if we can separate

it into the Office of Management or the Office of Budget, and that’s

what worries me. Doesn’t that really sort of let up the heat on the

individual, the independent agencies, Cabinet departments?

Mr. BROCK. If I could go back to the Y2K experience, I think that

even though there was a national coordinator with Mr. Koskinen,

he clearly held agencies accountable for their actions, as did the

President. I was here for several hearings, and you were holding

those agencies accountable.

I think you can keep the heat on the agencies. That’s where the

responsibility lies for good computer security.

Mr. HORN. Right.

Mr. BROCK. But the focal point, the Federal CIO, could assist in

that. I do not think that the Federal focal point should become the

stopgap; that this will solve the problems. That still has to occur

at the agencies, but certainly a CIO at the national level could

propagate good practices, could leverage resources that were availVerDate 11-MAY-2000 08:42 Feb 16, 2001 Jkt 000000 PO 00000 Frm 00075 Fmt 6633 Sfmt 6633 C:\DOCS\69819.TXT HGOVREF1 PsN: HGOVREF1
72

able to that individual and serve a role, frankly, very similar to the

one that Mr. Koskinen served.

Mr. HORN. Yes. We had a specific time period that wasn’t going

to be for 10, 20, or 100 years. It was just going to be a few months,

and that’s really what it boiled down to. And the job was very well

done obviously, but that’s—I need that balance, I think.

Mr. BROCK. Yes.

Mr. HORN. So you don’t have people say, hey, it isn’t my problem,

they do that over there, and wash their hands of it. I don’t think

that will help us at all.

Mr. BROCK. No, it would not.

Mr. HORN. Yes. But we certainly ought to have somebody that

had the right skills, people skills, so they aren’t some czar. The

czar makes my spine shudder. But so that they are a coordinator

in getting people in the various systems that overlap to work together, that’s the way I would view that coordinator role.

Mr. BROCK. I would agree. I think that the success of any coordinator or official like that does depend very much on that individual’s personal skills in terms of working with a very diverse group

of organizations who have different needs and different objectives.

That’s a difficult job, very hard job.

Mr. HORN. That’s right.

Mr. Nelson, any thoughts on that?

Mr. NELSON. Yes. Just to add a bit to Mr. Brock, I agree up to

possibly whether a CIO, Federal CIO, is warranted. As you know,

that’s being debated within the administration, and I won’t take a

position on that.

I agree with him that one does not want to separate the computer security aspects from other aspects of management. We are

focusing on computer security today because, indeed, it is a new

problem. I am an optimist, and I think we are going to get this

problem under control, and if we have a legacy of a fragmented

management approach, it is going to take on a life of its own.

A number of years ago, I worked on environmental protection

and on OSHA problems, and one of the things that I pushed on

was to reintegrate those functions. I called them the OSHA Mafia,

back with management, because management was abdicating its

responsibility, and, frankly, the Mafia in some cases were running

rampant with things that didn’t make sense. Now, that’s a very

personal observation. It’s not NASA’s observation. But my experience in this area tells me that you want to integrate, you want to

set high standards, you want to measure, you want to train, but

you put the responsibility on the people who have to make the

tradeoffs and get the job done.

Mr. HORN. I agree with you completely on that. You say it very

well.

Mr. Collier, any further thoughts on this?

Mr. COLLIER. Mr. Brock and Mr. Nelson both mentioned that

communication between different agencies and even within a particular agency is a critical element here. Within the government,

of course, the Critical Information Assurance Office paper that

came out this past year points to that. The CIOs do have several

venues in which they talk to each other. The Government InformaVerDate 11-MAY-2000 08:42 Feb 16, 2001 Jkt 000000 PO 00000 Frm 00076 Fmt 6633 Sfmt 6633 C:\DOCS\69819.TXT HGOVREF1 PsN: HGOVREF1
73

tion Technology Services Board, I think, has done a good job in at

least keeping the communication flowing between agencies.

But I would tend to agree with you that to establish an individual to take on this responsibility may not be the proper way. The

proper way to do this would be probably to continue the communications, the lines of discussions, between agencies.

Mr. HORN. In your statement, Mr. Brock, you mentioned that

your audits have shown that Governmentwide computer security is

generally weak because current policies and controls are not operating effectively. You also stated that the General Accounting Office audits frequently find the same vulnerabilities over and over

and over again.

In your opinion, what would you specifically suggest that agencies do to strengthen existing policy or to create stronger policies?

What is your thinking on that?

Mr. BROCK. The—you are correct. Our reports have found the

same problem over and over again.

A couple of observations. First of all, many of the policies have

no relationship or a limited relationship to the problems that we

are finding. They are not specific to the issues and problems that

are within an agency. We believe that policies and procedures need

to be based on the risk that the agencies are facing, and if you do

a good risk assessment, you can then, in fact, determine policies

and procedures that will minimize or mitigate those risks.

Second, most agencies aren’t testing their controls. They rely on

GAO or IG to come in and do the test, so there is too limited information within the agency, one, about what the risks are and

whether the policies would be reflective of reducing that risk, and

second, are the controls in place working, are they being tested?

Those are the things that we would do to, one, develop policies that

are appropriate, and, second, to strengthen existing policies to

make them more responsive.

Mr. HORN. You also suggested that agencies develop and distribute lists of vulnerabilities. To whom would these lists be distributed?

Mr. BROCK. Well, first of all——

Mr. HORN. Should it be GAO; should it be OMB; what, CIO

Council?

Mr. BROCK. Everyone.

Mr. HORN. All of the above?

Mr. BROCK. First of all, let’s start within the agency. I believe I

mentioned earlier within some agencies we would go to, they do not

distribute such lists within the agency so that people that are literally down the hall are not getting these lists. So, first of all, you

need to start within the agency.

Second, there are other organizations, such as the CERT-CC, the

Carnegie Mellon, the Fed CERT, the GSA runs, organizations that

do have distribution mechanisms that are appropriate as well.

Mr. HORN. Yet Dilbert and the cubicle is broken down?

Mr. BROCK. Yes.

Mr. HORN. Mr. Brock, you stated that establishing a framework

for managing security is important. What specific elements of the

framework are missing at most agencies?

74

Mr. BROCK. If I could indulge Mr. Gilmore to put up the circular

chart, the wheel.

The risk management cycle, we believe, is the framework. I will

go back to an answer I just gave you, that the framework has to

start with a central focal point, the accountability. From there, determine what the risks are, develop controls based on that risk,

promote awareness, and then continuously monitor and evaluate.

That’s the framework.

Certainly there are things that you can do independent of that

framework, or you don’t have to implement everything in that

exact cycle, but it is dynamic. It is continuous. The threat is growing. The threat changes. The technology grows. The technology

changes. The services that an agency provides change. So the risk

management cycle has to roll on a continuous basis.

Mr. HORN. So it is interactive in many ways?

Mr. BROCK. Yes, sir.

Mr. HORN. Gentleman, Mr. Nelson, Mr. Collier, what do you

think about that approach there, just as one vision?

Mr. NELSON. Yes. I agree with Mr. Brock. I would like to give

you some examples of what we are doing at NASA along these

lines.

I said before that it starts with management. We have identified

what we call special management attention systems. These are important computer systems for NASA’s missions, and we are requiring 100 percent completion of security plans for those systems by

this year, and we have asked our Inspector General to audit that,

including the involvement of management in those plans and management signature on the readiness of those systems to operate.

But we have had to operate in parallel because the risk is too

great. So at the same time we have identified what we call the top

50 vulnerabilities in NASA, and we have distributed that list to

every center. It was done by consensus, not somebody in a closet,

but using the tools that I described, all of our systems are being

audited for the presence of those vulnerabilities. When those

vulnerabilities are detected, management is informed of them and

asked to correct them, and then those systems are rescanned.

Now, management, if in its interest it believes that some of those

vulnerabilities must maintain because the risk is tolerable and the

loss to mission is too great, they can do a waiver. But this forces

them to act even before some of their plans are completed, because

we think that it is too much of a crisis.

Mr. HORN. OK. Any other comments on that question?

Mr. COLLIER. I would agree that it is a management and policy

issue. When the Department of Defense began its studies of biometrics back in the late 1980’s, early 1990’s, there was as much

emphasis placed on the people interface to biometrics as there was

on the technology side.

I found that a very refreshing model. I mean, the human element

is really what is the issue here. Technology pretty much does what

we make it to do, and it keeps on doing it. In the area of security,

however, the Department of Defense studies, especially of the National Security Agency, involved the study of time, motion, and the

people’s acceptance of a new way of doing things, and labor was

definitely a part of the decisionmaking process.

75

I think that’s a critical element in moving forward, to remain dynamic enough to meet the threats as they continue to improve on

a day-to-day basis.

Mr. HORN. Mr. Nelson, any further comment on that question?

Mr. NELSON. No, thank you.

Mr. HORN. Mr. Turner has joined us. I am delighted to yield such

time as he may need for questioning.

Mr. Turner.

Mr. TURNER. Mr. Nelson, I wanted to ask you if you could describe for us the kind of computer intrusions and attacks that you

have experienced. We talk about this all the time, and I don’t really have a good grasp on the scope of the problem. So can you quantify that and maybe give us some specific examples of how some

hacker has invaded your system, what the consequences have

been?

Mr. NELSON. Yes.

Mr. TURNER. I know that we always read this is a widespread

problem.

Mr. NELSON. Yes.

Mr. TURNER. I don’t think we have a real feel for how widespread

it really is.

Mr. NELSON. First of all, NASA experiences a lot of attacks, hundreds to thousands per month.

Mr. TURNER. You say hundreds to thousands?

Mr. NELSON. Hundreds to thousands—of serious—to thousands

per month of serious attacks.

Mr. TURNER. Hundreds to thousands?

Mr. NELSON. Yes. And we are not unusual, although we may be

are slightly favored.

Let me give an example of an attack which has several of the elements we have been talking about in our testimony.

I am not going to describe the center, but in this particular instance a system administrator observed that someone from a foreign country had logged into the computer and had no reason to

think why that person should have—should be able to log into the

computer. He did this by examining records logs, so he was doing

the right thing.

Now, he found by looking at the log that the person had used a

well-known vulnerability to take over that computer; in other

words, to achieve what is called root access. That’s like god of the

computer. You can do anything with the computer if you are root.

Then the person used that vulnerability and his godlike powers

to install what is called a password sniffer. This is software that

observes the network traffic flowing by and looks for packets that

have passwords in them. And he was able, the intruder, to grab a

number of passwords, some of which were for accounts at another

center. So using those passwords and then the ability to log on as

a user, the attacker went to another center and attacked several

other computers.

Now, the sad part about this was that the initial vulnerability

should have been fixed. The system administrator thought he had

fixed it. He installed what is called a patch. It is a thing like a

Band-Aid; it is like a patch that changes a software to get rid of

the vulnerability, but the patch didn’t take. It was a defective inVerDate 11-MAY-2000 08:42 Feb 16, 2001 Jkt 000000 PO 00000 Frm 00079 Fmt 6633 Sfmt 6633 C:\DOCS\69819.TXT HGOVREF1 PsN: HGOVREF1
76

stallation process, and the system administrator didn’t know it. So

he was hit twice with the same vulnerability.

Now, we have had other attacks, and we keep track of how much

they cost, that have had a direct cleanup cost in time and resources

approaching half a million dollars, one attack. Of course, it affected

a lot of computers.

Mr. TURNER. You say one attack cost half a million dollars?

Mr. NELSON. Approached half a million, a little under. The numbers are not, of course, audit quality, but these are expensive attacks. It took—in the case that I am referring to of almost half a

million dollars, it took about a month to put all of these computers

back together again. It was a major problem.

We have had centers actually take themselves off the Internet,

in other words totally sever connections with the outside for a brief

period of time, because they felt that they were being attacked, the

risk was too high, they needed that time to fix things up.

Now, the incidents that I am describing now are a year or two

old, and we don’t have such bad problems now, but we still get significant attacks.

Does this help? Does this give you a sense of—oh, one area that

I didn’t describe is theft of data. We had an incident not too long

ago where substantial number of documents were stolen by an

Internet attack.

Mr. TURNER. And what—were those sensitive documents?

Mr. NELSON. No, fortunately not. They were copyrighted. They

had commercial value. They were not sensitive. And these particular documents were not resident on a NASA computer. It was a

NASA account that was used, and there was a serious weakness

in the vendor’s security. But that’s an example of an attack that

NASA was peripherally involved with.

Mr. TURNER. So you say there are hundreds to even maybe 1,000

attacks per month?

Mr. NELSON. Correct.

Mr. TURNER. Now, have you been able to successfully determine

the source of any of these attacks? Or do these things just go on

daily, and you try to prevent them, but you don’t know who did it?

Mr. NELSON. We can determine the source of most of them, at

least within the country, and maybe the organization. And we work

closely with our Inspector General and then with the FBI, and several of these have been prosecuted and the perpetrator convicted.

In a—on a regular basis, if we see an attack, we inform the organization that the attack is coming from, and often the attack is from

someone not connected with that organization, but someone who

has seized a computer, seized meaning this root access, god powers

within the organization. The organization may not know it. That

could be a government organization or a private organization in

this country or abroad.

So one wants to be careful saying we are being attacked from a

certain country; they must be hostile. Maybe they are the victim.

Mr. TURNER. So there have been some convictions that have resulted from your investigation?

Mr. NELSON. Yes, sir. Yes, sir.

77

Mr. TURNER. Would it be fair to say that the vast majority of the

attacks, that the source of them are—that you never quite figure

out who did it?

Mr. NELSON. Yes.

Mr. TURNER. Or where they are from?

Mr. NELSON. Yes. Not in who the individual was or what their

motives were, that’s correct. And attack isn’t necessarily successful.

I want to make it clear that when I talk about hundreds to thousands of attacks, I am including all of the incidents that we gather

metrics on. The successful attacks would be a lot smaller, and increasingly we ward off those attacks. We use another metric of

what is the success rate of incidents, and we are seeing the numbers turn over. It is sort of a nice payoff for the hard work we have

gone through in the last couple of years that our numbers are getting better. The attack rates are going up. The successful attack

rates are going down.

Mr. TURNER. Tell me the examples of intrusions from foreign

governments or agencies of foreign governments.

Mr. NELSON. I don’t have data on that that I would be confident

in saying, even in a conversation. So I am sorry, I do not have any

data on attacks by foreign governments that I would have any confidence in reporting.

You know, it is hard to know, when you have an attack from an

IP address, even if that is located within an agency of a foreign

government, is that the activity of a foreign government. To the

best of my knowledge, we have no evidence of NASA attacks by

agents of foreign governments, but I do not have high confidence

in that statement because we do not have good data.

Mr. TURNER. The convictions that have resulted from the efforts,

what kind of individuals are we talking about that have actually

been convicted of a crime?

Mr. NELSON. Our Inspector General would be a lot more authoritative on this, but I believe they have tended to be fairly young

males working either alone or with others of like mind, but at least

my knowledge is that they do not appear to be part of what one

might call organized either crime or terrorism in the conventional

sense. Their prime aim, as I recall—but I think if you would like

we could submit for the record a response from our Inspector General, I could request it—but as I recall, they have not been industrial espionage cases or the like.

Mr. TURNER. I do think it would be helpful, with the chairman’s

permission, to ask you to at least give us some indication maybe

for the last 2 or 3 years of the number of attacks, how they have

been resolved, and whatever information you can provide us about

the source of them, because at least by looking at it as a whole,

we would get some picture for us to look at of how serious this

problem really is.

Is that possible to put that kind of data together to give us an

overview?

Mr. NELSON. Indeed, it would. If you will give us just a little leeway.

We try to not advertise the successful attacks. Our experience is

that one of the motivations for attackers is the recognition, if you

will, the thrill. We are very leery of playing to that.

78

Mr. TURNER. I suspect that your reticence on that point is shared

by many people in various agencies of the government, and I think

one of the difficulties that we have as a committee in trying to address this problem is trying to get some data together to indicate

how serious this problem really is.

Mr. NELSON. We would be eager to work with you on getting

data that is helpful to you.

Mr. TURNER. When you deal with these kind of intrusions, do you

rely upon NASA employees, or do you rely on contractors to help

you resolve them?

Mr. NELSON. Both. Many of NASA’s services are now operated by

contractors, and so we have integrated those contractors into our

operations. In our testimony—in my testimony, I mentioned that

we have a draft regulation out for comment that would require the

same training standards for our contractors as for ourselves. NASA

has not outsourced or not contracted out our security responsibilities. So where we have contractors operating systems within our

centers, or otherwise directly attached to NASA, we retain the responsibility and the capability for detecting and responding to attacks.

Now, that response may be asking the contractor to do something. Since they are well-integrated now into our planning, they

are eager to do that.

I think the system is working fairly well, but it has added a complication of crossing these contract boundaries.

Mr. TURNER. Is it possible for an intruder to compromise the success of any of our missions? I know you have had a tremendous

problem recently with success in some of the Mars missions. Is it

possible that a problem could be created of that nature by an intruder into our computer systems?

Mr. NELSON. We take pretty strong security precautions for mission-critical systems. Having said that, there is always a possibility. We are into risk management. Risk avoidance is very difficult.

We do, though, take, as I said, very strong precautions, including

in some cases simply severing the critical system, planned severing

from any outside communication to minimize that risk, but we are

talking about risk management, not risk avoidance.

Mr. TURNER. Thank you, Mr. Chairman.

Mr. HORN. Well, we thank you. That was a very useful interchange, questions and answers.

Let me go back, Mr. Nelson. Has your top 50 list of

vulnerabilities been distributed outside of NASA?

Mr. NELSON. Not to my knowledge. It was a list that we arrived

at working among ourselves, and it is a list that we have programmed into our auditing tools. So it is, in effect, automated now.

But I am not aware that we have distributed it outside the agency.

There are other agencies that are doing similar lists, and I think

the overlap would be pretty large.

Mr. HORN. Well, would it be helpful if in a report from this subcommittee that we use some of that information if there are ones

beyond NASA that differ, and then the question would be does that

encourage hacking or doesn’t it? But how we deal with it, I think

we have to get the word out.

79

Mr. NELSON. We wouldn’t want it known what number 51 is, and

50 was a good round number, and that 50 will change. It is partly

getting well. We have had to beat on this one, as I indicated earlier, to get managements attention, but we expect that next year’s

top 50 will be a different list, and it may not even be 50. But, yes,

with appropriate precautions we would be willing to share that list,

certainly, with responsible people in other agencies.

Mr. HORN. On Mr. Turner’s point, I just suggested to Mr. Ryan

that we find from Justice how many have been jailed and where

are they. I know a few are in the Atlanta prison, but I think it is

good to get at least some of them. We don’t have to make heroes

out of them. We can say Mr. Blank and Ms. Blank or whatever, because I don’t want to have this be the award system for hackers.

Let me ask you, again, Mr. Nelson, another thing. You gave a

very interesting chart when you said you are spending roughly 2

percent of the funding for information technology on security provided adequate protection. Two percent seems like a very modest

amount to spend on security, so I guess do you think that’s pretty

low, and should we invest more?

Mr. NELSON. I can only speak for NASA, and we do gather budget data on our actual costs. Our information technology budget as

a whole is about $2.1 billion, and our fiscal year 2000 expenditure

on information technology security is about $46 million, which is a

little bit over 2 percent.

Now, we don’t know that that is optimally allocated. So I would

say at first, my initial reaction is that NASA—and that increased

quite a bit, by the way, from 1999 to 2000. But NASA is now

spending about the right amount, and it is a case of efficient allocation so that we hit the most important things.

Mr. HORN. So you think you are at the right level of spending

on this then?

Mr. NELSON. Approximately.

Mr. HORN. OK.

Mr. NELSON. Yes. Now, Mr. Collier, in your written statement,

you explained that the prevalence of computer passwords written

on the back of computer mouse pads, on desk leaves, and even on

paper attached to computer monitors do exist. I know what you

mean. I think it is all around Capitol Hill, too.

In addition, you stated that remembering a PIN, the personal

identification number, is a key piece of computer security. In your

opinion, what can individuals do to better recall passwords?

Mr. COLLIER. Aside from memory exercises, if we are going into

this 8 character password with, again, a full keyboard set of characters, I think the idea is to do something to move away from these

complex passwords. The positive user authentication model that I

presented earlier is an effort to do just that. Again, we have the

human being factor here at the edge of the envelope.

Our company has clients, for instance, in the wire transfer business where they have 25 passwords to remember. Now, unless you

are the Great Kreskin, it is pretty difficult to do that. So I think

rather than trying to formulate ways to help people remember

passwords, we have to find ways to eliminate them entirely, and

I think the positive user identification model, which I think the

80

DOD originally had come up with 10 years ago, is a move toward

that.

Mr. HORN. Does that mean a certain unit has to be built on every

machine to do that in terms of the fingerprint and all of the rest?

Mr. COLLIER. Biometrics are certainly one of the legs of the stool.

The cost, again, is coming down greatly. Right now we are seeing

it move into the mainstream, certainly in the commercial world,

protecting enterprise systems within large corporations. The Federal Government is doing it at the division and command level

now, and I think it is just a matter of time before we see biometrics

not only in computers, of course, but in many, many areas of our

lives where we have to remember passwords, PINs, and the like.

Mr. HORN. If you had the, say, thumb identification to access

your particular personal computer, is there any way a hacker getting into that would be able to digitize the lines and everything

else so they could duplicate that?

Mr. COLLIER. At the direction of the computer industry and the

Department of Defense, primary responsibility from the NSA side

of things, we have addressed the issue of intruder attacks, we do

encrypt the signals coming out of the scanner, so they can’t be

sniffed. Our product in the sense of the templates is part of the operating system which is part of the layered security shell around

the password protection. We do secure sessions between all pieces

of hardware, as well as between client and work station. There

have been a lot of efforts put into making this stuff spoof-resistant.

James Bond might still be able to get in, but not the average user,

that’s for sure.

Mr. HORN. Well, I was interested when one of you compared the

need for looking at how you divide the issues in computer security

are very much like a responsible accounting operation when you

are handling a lot of money, and you want more than one, and my

chief auditor said many years ago—he said, make sure everybody

takes a vacation. The system—when they found one in another system in California where the vice chancellor just happened to be

buying bales of hay for his ranch, but not the university ranch, he

was charging it to the university, and the only way they found that

was when he finally took leave and somebody said, gee, this is

strange, and that was solved.

That’s, I think, what we have to do here. Is there something

along that line that we ought to be telling everybody that runs a

computer center in the Federal Government and how we could

apply what people do in the finance and auditing in universities

and corporations for standard practice?

Mr. Brock.

Mr. BROCK. Segregation of duties is perhaps one of the most absolute basic controls there is for any type of operation, whether it

is financial matters, as you were talking about, or computer security.

In fact, when you look at any critical operation from beginning

to end, you can make breaks in there where you say, we are going

to have a division of labor, and in computer security, if you were

looking at a process of changing software, you can make breaks

from the people who make the change to the people who do the

81

testing to the people who do the installation, to make sure that

there is an independence there.

You could do that for other aspects of security as well.

Mr. HORN. Well, in other words, in your opinion, are Federal

agencies susceptible to having one individual either intentionally or

inadvertently render the computer system useless due to the lack

of segregation of duties or separation of duties involved?

Mr. BROCK. I don’t have the exact numbers now, but we have—

maybe I do have the exact numbers.

Mr. HORN. Ms. Boltz, glad you came today.

Mr. BROCK. We don’t have numbers, but we did identify, for example, at the Department of Defense and VA that system program

and security administration duties were combined. So the people

who were establishing the controls were also doing the programming.

At the FMS, we were saying that programmers had access to

production data. So, in both cases they were able to combine pieces

of information; if they had chosen to, could have taken over programs and assumed other responsibilities as well.

This is fairly common. In some respects, it is done not out of a

malicious intent. It is done because I think, as Mr. Nelson alluded

to, you have too few people trying to do too many things.

Mr. HORN. Any other thoughts on that, Mr. Nelson, Mr. Collier?

Mr. NELSON. Yes, I would say I agree with Mr. Brock. However,

in the scientific and technical area, the terminology may be different, and so one has to be a little careful not to be too rote in

the prescriptions. What applies well to a financial system may not

apply very well to a scientific data analysis system. The principles

are correct, but the application has to be careful.

Mr. HORN. Yes. Mr. Collier.

Mr. COLLIER. You know, applications that we run into within the

government, we have established some two-man rules in some

cases. We have established complex procedures to ensure reduction

in fraud, for instance, in transferring of funds, payment of benefits,

etc. What I think biometrics and this security model bring to the

party there, and that’s what we are hearing from the government

agencies, is we now have established the fact who was sitting behind the monitor when this fraud took place, not a matter of someone could have gotten my PIN or whatever. The banking industry

has really embraced this because of the nonrepudiation issues and

the home banking and wire transfers. As we get less and less on

a face-to-face human basis, the problem increases, and they are

trying to do something about the future that we know is going to

explode before it does.

Mr. HORN. Thank you. Any other thoughts on that?

Mr. BROCK. No, sir.

Mr. HORN. One of my last questions here will be, in your opinion

is the current legal framework, which includes the Computer Security Act of 1987 supporting Federal information security requirements, is that adequate? What needs to be updated or modified?

Are there things that should be dealt with? Mr. Turner and I will

be glad to move that legislation, if there is need for it. What does

the CIO Council think on some of these things?

82

Mr. NELSON. Let me take that. In my opinion, the legal framework is pretty good. I am not a lawyer, so I will speak generally.

But there is a potential problem that we are dealing with, and I

think Mr. Brock alluded to it in his oral remarks. It has to do with

classification.

The laws governing classification in this country are rather strict

with regard to national security systems, and as the importance of

information security has increased and the role of commercial and

private systems has increased in their aid to national defense, then

the question of where strictly national security stops and broader

areas that are related to security starts. And so the particular

problem that we are having is that we believe that within NASA

a compendia, that is, lists, of open serious vulnerabilities, such as,

for example, would be turned up by what we call a penetration test

where we hire somebody or on our own to go through all of our systems and look to see how hackers would get in, that those lists are

very sensitive, and my understanding—and we have been working

with our legal staff and with the National Archives and Records

Administration, which has ultimate classification authority, on the

criteria under which these can be classified.

The issue is a little murky, but right now it looks like maybe

they cannot be, not even at a confidential level. So it could be that

some clarification of the extent of national security provisions in

this gray area of civil systems closely allied with national security

systems would be helpful.

Mr. HORN. Well, that’s very interesting because this is the subcommittee that has oversight for the National Archives and the

Freedom of Information, and we try to balance all of that. If there

isn’t a need for classification, it shouldn’t be classified. So I would

welcome any thoughts you have on that, and I know Mr. Turner

would also.

So—— Mr. BROCK. Mr. Horn.

Mr. HORN. Mr. Brock.

Mr. BROCK. Can I have a moment of disagreement? I have been

agreeing with Mr. Nelson all along.

I do not think the overarching framework is adequate. As we

mentioned in the testimony, the Computer Security Act is based,

I think, on an old way of doing things. It is based on an environment that existed before the Internet. It was based on a mainframe

environment, and I believe that it was based on an environment

where locks and keys were the prevalent security devices. It’s system-based. It is not management-oriented. It misplaces responsibility and accountability. I think it needs to be overhauled.

I think there needs to be more emphasis placed on management

accountability. I think there needs to be more emphasis placed on

risk assessments and risk determination. I believe there needs to

be more emphasis placed on independent audit and management

audit so that controls can be evaluated. Those are not present in

the Computer Security Act.

Now, as you know, there is no law against good management.

There is no law or anything to prevent an agency from doing all

of those good practices, but at the same time there is no law or legislation or regulation that really encourages that type of action and

83

then provides a lever or an oversight mechanism to the administration or to the Congress for assuring that that framework is being

met.

Mr. HORN. Well, thank you, because that was the answer I was

going to lead with a question, and I am so used to Joe Wilmingson

following me around the country on Y2K that I always asked, and

now I will ask you and anybody from GAO, to what degree have

we not covered the questions that we should have covered. And you

have just nailed one down, and I appreciate that.

Would GAO and the CIO Council, Chief Information Officer

Council, put their thinking caps on, and we would welcome taking

a look at that again. We need to update it. It has been over two

decades right now—or a decade and a half, I guess.

So are there any other questions any of you think—and you, Mr.

Brock, in particular—what else should we get on the record that

we haven’t put on?

Mr. BROCK. I think that my last response covered the one item,

and we are continuing to work with your staff on a number of computer security issues as well, particularly as they might relate to

e-commerce and other initiatives that are coming up. We are

pleased to have the opportunity today to discuss these items with

you.

Mr. HORN. Well, we are glad to do it. We certainly welcome the

comments of these witnesses, as well as the ones from our first

panel. They were a very excellent group. Thank you, Mr. Collier,

for coming.

Mr. Nelson.

Mr. NELSON. Yes, I would just like to maybe amend what I said

so perhaps Mr. Brock and I can agree. In addressing your question

on legal framework, I was responding from the standpoint of NASA

or an agency as to whether the current law gets in our way of

doing good things. But for an agency that does not wish to practice

good management, a legal encouragement might not be out of

order.

Mr. HORN. Well, that’s well said.

I would tell you that this chamber operates not by consensus, but

like a university does, and maybe NASA, but if we have 218 votes,

we can do almost anything. But obviously we also could lose 218

votes if we haven’t thought it through very well. So I thank you

all.

I want to thank the staff that worked on this hearing.

You have been excellent witnesses.

J. Russell George is in the doorway over there. Gosh, are you getting framed now over there or what? Staff director and chief counsel, and he works wonders. Matt Ryan to my left, your right, senior

policy director, and who is a GAO alumnus, as are a number of our

people; Bonnie Heald, director of communications, seated in the

back there; Bryan Sisk, our clerk; Ryan McKee, the staff assistant;

and for Mr. Turner’s staff, Trey Henderson as counsel, and Jean

84

Gosa, the minority clerk. And our court reporter today is one, and

that’s Mindi Colchico, and we didn’t have to wear you out and

bring another one in, I take it. So thank you for coming again.

With that, we are adjourned.

[Whereupon, at 12 noon, the subcommittee was adjourned.]

Æ