U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

27–511 PDF 2006

NO COMPUTER SYSTEM LEFT BEHIND: A REVIEW

OF THE 2005 FEDERAL COMPUTER SECURITY

SCORECARDS

HEARING

BEFORE THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED NINTH CONGRESS

SECOND SESSION

MARCH 16, 2006

Serial No. 109–139

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpoaccess.gov/congress/index.html

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

TOM DAVIS, Virginia, Chairman

CHRISTOPHER SHAYS, Connecticut

DAN BURTON, Indiana

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

JOHN L. MICA, Florida

GIL GUTKNECHT, Minnesota

MARK E. SOUDER, Indiana

STEVEN C. LATOURETTE, Ohio

TODD RUSSELL PLATTS, Pennsylvania

CHRIS CANNON, Utah

JOHN J. DUNCAN, JR., Tennessee

CANDICE S. MILLER, Michigan

MICHAEL R. TURNER, Ohio

DARRELL E. ISSA, California

JON C. PORTER, Nevada

KENNY MARCHANT, Texas

LYNN A. WESTMORELAND, Georgia

PATRICK T. MCHENRY, North Carolina

CHARLES W. DENT, Pennsylvania

VIRGINIA FOXX, North Carolina

JEAN SCHMIDT, Ohio

——— ———

HENRY A. WAXMAN, California

TOM LANTOS, California

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

DANNY K. DAVIS, Illinois

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

CHRIS VAN HOLLEN, Maryland

LINDA T. SANCHEZ, California

C.A. DUTCH RUPPERSBERGER, Maryland

BRIAN HIGGINS, New York

ELEANOR HOLMES NORTON, District of

Columbia

———

BERNARD SANDERS, Vermont

(Independent)

DAVID MARIN, Staff Director

TERESA AUSTIN, Chief Clerk

PHIL BARNETT, Minority Chief of Staff/Chief Counsel

(III)

C O N T E N T S

Page

Hearing held on March 16, 2006 ............................................................................ 1

Statement of:

Hughes, Thomas P., Chief Information Officer, U.S. Social Security Administration; Thomas Wiesner, Deputy Chief Information Officer, U.S.

Department of Labor; Robert F. Lentz, Director, Information Assurance, U.S. Department of Defense; and Scott Charbo, Chief Information

Officer, U.S. Department of Homeland Security ........................................ 53

Charbo, Scott ............................................................................................. 86

Hughes, Thomas P. ................................................................................... 53

Lentz, Robert F. ......................................................................................... 68

Wiesner, Thomas ....................................................................................... 62

Wilshusen, Gregory C., Director, Information Security Issues, U.S. Government Accountability Office; and Karen S. Evans, Administrator,

Office of Electronic Government and Information Technology, Office

of Management and Budget ......................................................................... 6

Evans, Karen S. ......................................................................................... 39

Wilshusen, Gregory C. .............................................................................. 6

Letters, statements, etc., submitted for the record by:

Charbo, Scott, Chief Information Officer, U.S. Department of Homeland

Security, prepared statement of .................................................................. 88

Davis, Chairman Tom, a Representative in Congress from the State of

Virginia, prepared statement of ................................................................... 4

Evans, Karen S., Administrator, Office of Electronic Government and

Information Technology, Office of Management and Budget, prepared

statement of ................................................................................................... 40

Hughes, Thomas P., Chief Information Officer, U.S. Social Security Administration, prepared statement of ........................................................... 55

Lentz, Robert F., Director, Information Assurance, U.S. Department of

Defense, prepared statement of ................................................................... 70

Waxman, Hon. Henry A., a Representative in Congress from the State

of California, prepared statement of ........................................................... 100

Wiesner, Thomas, Deputy Chief Information Officer, U.S. Department

of Labor, prepared statement of .................................................................. 64

Wilshusen, Gregory C., Director, Information Security Issues, U.S. Government Accountability Office, prepared statement of .............................. 8

(1)

NO COMPUTER SYSTEM LEFT BEHIND: A REVIEW OF THE 2005 FEDERAL COMPUTER SECURITY SCORECARDS

THURSDAY, MARCH 16, 2006

HOUSE OF REPRESENTATIVES,

COMMITTEE ON GOVERNMENT REFORM,

Washington, DC.

The committee met, pursuant to notice, at 12:16 p.m., in room

2154, Rayburn House Office Building, Hon. Tom Davis (chairman

of the committee) presiding.

Present: Representatives Tom Davis, Platts, Cummings, Clay,

and Watson.

Staff present: David Marin, staff director; Keith Ausbrook, chief

counsel; Chas Phillips, policy counsel; Rob White, press secretary;

Drew Crockett, deputy director of communication; Victoria Proctor,

senior professional staff member; Teresa Austin, chief clerk; Sarah

D’Orsie, deputy clerk; Leneal Scott, computer systems manager;

Michael McCarthy, minority counsel; Earley Green, minority chief

clerk; and Jean Gosa, minority assistant clerk.

Chairman TOM DAVIS. Good afternoon and welcome. The committee will come to order.

Today, the committee is releasing its Federal computer security

scorecards and will examine the status of agency compliance with

the Federal Information Security Management Act [FISMA].

Information technology and the Internet drive our economy and

help the Federal Government to operate with greater efficiency and

cost savings. E-commerce, information sharing, and Internet transactions, such as online tax filings, are so common that we take

them for granted. Not until an incident such as the potential

BlackBerry shutdown—which was recently settled—are we reminded of our dependence on IT and how difficult it is for us to

function without it.

In the past year or so, we have heard stories about identity theft,

security breaches in large commercial data bases, and phishing

scams such as those identified by the Internal Revenue Service this

tax season. We have also seen an increase in education and awareness campaigns for online safety spearheaded by the private and

public sectors. But in my experience, when it comes to Federal IT

policy and information security, it is still difficult to get people—

even Members of Congress—engaged. For most people this is an

abstract, inside-the-Beltway issue. And FISMA is still viewed by

some Federal agencies as a paperwork exercise. But these are

short-sighted observations. As a result of the Government’s aggresVerDate 11-MAY-2000 11:24 Jun 21, 2006 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 D:\DOCS\27511.TXT HGOVREF1 PsN: HGOVREF1
2

sive push to advance e-government, many Government information

systems hold personal information about citizens and employees, in

addition to other types of data. Maintaining the integrity, privacy,

and availability of all information in these systems is vital to our

national security, continuity of operations, and economy.

Furthermore, in order to successfully fight the war on terror, we

must be able to move information to the right people at the right

place at the right time. Information needs to move seamlessly, securely, and efficiently within agencies, across departments, and

across jurisdictions of Government as well.

Due to the nature of our cyber infrastructure, an attack could

originate anywhere at any time. We know that Government systems are prime targets for hackers, terrorists, hostile foreign governments, and identity thieves. Malicious or unintended security

threats come in varied forms: denial of service attacks, malware,

worms and viruses, phishing scams, and software weaknesses, to

just name a few. Any of these threats can compromise our information systems. The results can be costly, disruptive, and erode public

trust in Government.

One of the best ways to defend against attacks is to have a

strong, yet flexible, protection policy in place. We want agencies to

actively protect their systems instead of just reacting to the latest

threat with patches and other responses. FISMA accomplishes this

goal by requiring each agency to create a comprehensive risk-based

approach to agency-wide information security management. FISMA

strengthens Federal cyber preparedness, evaluation, and reporting

requirements. It is intended to make security management an integral part of an agency’s operations and to ensure that we are actively using best practices to secure our systems and prevent devastating damage.

The committee, with technical assistance from GAO, releases annual scorecards based on the FISMA reports submitted to us by

agency Chief Information Officers and Inspectors General. This

year, the Federal Government as a whole hardly improved, receiving a D+ yet again. Our analysis reveals that the scores for the Departments of Defense, Homeland Security, Justice, State—the

agencies on the front lines in the war on terror—remained unacceptably low or in some cases dropped precipitously. Meanwhile,

several agencies improved their information security or maintained

a consistently high level of security from previous years.

The 2005 FISMA grades indicate that agencies have made improvements in developing configuration management plans, employee security training, developing and maintaining an inventory,

certifying and accrediting systems, and annual testing. Despite

these advances, there are still some areas of concern to the committee, including implementation of configuration management policies, specialized security training for employees with significant security responsibilities, inconsistent incident reporting, inconsistencies in contingency plan testing, annual testing of security controls, and agency responsibility for contractor systems.

At today’s hearing, we will evaluate the results of the agencies’

2005 FISMA reports, identify strengths and weaknesses in Government information security, and learn whether FISMA provisions

and the OMB guidance are sufficient to help secure Government

3

information systems. Witnesses from GAO and OMB will help us

understand what obstacles impede the Government’s ability to

comply with FISMA. DOD and DHS witnesses will discuss the

challenges they face in their departments and their plans to improve FISMA compliance. We will also hear about best practices

and lessons learned from the Social Security Administration and

Department of Labor, two agencies that have demonstrated consistent improvements in their information security since the scorecard

process was initiated in 2001.

If FISMA was the No Child Left Behind Act, a lot of critical

agencies would be part of the list of low performers. None of us

would accept D+ grades on our children’s report cards. We can’t accept these either.

[The prepared statement of Chairman Tom Davis follows:]

4

5

6

Chairman TOM DAVIS. Are there any other Members who wish

to make opening statements? If not, I am going to note that Members will have 7 days to submit opening statements for the record.

We are going to recognize our first panel of distinguished witnesses. We have Mr. Gregory Wilshusen, the Director of Information Security Issues for the U.S. Government Accountability Office,

and the Honorable Karen Evans, the Administrator of the Office of

E-Government and Information Technology at the Office of Management and Budget. You know it is our policy we swear you in

before your testimony, so if you would just rise and raise your right

hands.

[Witnesses sworn.]

Chairman TOM DAVIS. Thank you. Let me thank you for your

perseverance on this.

Mr. Wilshusen, thank you for being with us.

STATEMENTS OF GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION SECURITY ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE; AND KAREN S. EVANS, ADMINISTRATOR,

OFFICE OF ELECTRONIC GOVERNMENT AND INFORMATION

TECHNOLOGY, OFFICE OF MANAGEMENT AND BUDGET

STATEMENT OF GREGORY WILSHUSEN

Mr. WILSHUSEN. Thank you, Mr. Chairman.

I am pleased to be here once again to discuss the efforts by Federal agencies to implement the requirements of FISMA. For many

years, we have reported that inadequate information security is a

widespread problem that could have devastating consequences.

Since 1997, we have identified information security as a government-wide high-risk issue.

Today, the Federal Government is facing increasingly sophisticated and complex threats to its sensitive information systems and

information. The need for agencies to implement the strong information security controls required by FISMA has never been greater.

My testimony is based, in part, on our analysis of the fiscal year

2005 FISMA reports by OMB and 24 major Federal agencies and

their Inspectors General.

Mr. Chairman, my bottom-line message is that progress made by

the agencies in implementing FISMA is mixed, at best. Agencies

have made progress in several areas but have slipped in others.

Today, I will note areas where agencies have made progress and

those areas where weaknesses remain. In addition, I will discuss

actions that agencies can take to improve their information security controls.

Before I do, I would like to recognize OMB for taking steps to

improve the quality of the FISMA reports. For example, OMB required agencies to report, for the first time, certain performance

measures by system risk level. This provides better information

about whether agencies are prioritizing their information security

efforts according to system risk.

Mr. Chairman, agency FISMA reports present a mixed picture of

FISMA implementation. The agencies generally reported an increasing number of systems meeting key security performance

7

measures, such as the percentage of systems certified and accredited, and the percentage of contingency plans tested.

Nevertheless, progress was uneven. For example, the percentage

of agency systems reviewed declined from 96 percent in 2004 to 84

percent in 2005, and the percentage of employees and contractors

receiving security awareness training also declined.

The reports indicated other challenges as well. Only 13 IGs reported that their agencies’ inventories of major systems were substantially complete. A complete inventory is a key element of managing the agency’s IT resources, including the security of those resources. Without complete inventories, the agencies, the administration, and the Congress cannot be fully assured of the agencies’

progress in implementing FISMA.

Eight IGs also assessed the quality of their agency’s certification

and accreditation processes as ‘‘poor.’’ As a result, agency-reported

performance data may not accurately reflect the status of the agency’s efforts to implement this requirement.

And 39 percent of Federal systems did not have a tested contingency plan. Without a tested plan, increased risk exists that agencies will not be able to recover mission-critical systems in a timely

manner if an interruption occurs.

Beyond assessing FISMA requirements, our audits of information

security at Federal agencies have found significant weaknesses related to access controls and other information security controls that

place a broad array of Federal operations and assets at risk of misuse and disruption.

However, agencies can take several actions to fully implement

their FISMA-mandated programs and improve security controls.

Such actions include completing and maintaining accurate inventories of major systems, prioritizing information security efforts

based on system risk levels, and strengthening controls that are to

prevent, limit, and detect access to its information and information

systems.

Mr. Chairman, this concludes my statement. I will be happy to

answer your questions.

[The prepared statement of Mr. Wilshusen follows:]

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

Chairman TOM DAVIS. Thank you.

Ms. Evans.

STATEMENT OF KAREN S. EVANS

Ms. EVANS. Good afternoon, Mr. Chairman. Thank you for inviting me to speak about the status of the Federal Government’s efforts to safeguard our information and our systems.

My comments today will focus on the progress we have made in

improving the security of the Government’s information technology

as well as our strategy for addressing continuing security challenges.

This is an extremely important issue for the administration, and

it is equally important to me both professionally and personally because some of the government-wide security performance metrics

that we use to evaluate the agencies are also included in my personal performance plan.

On March 1st, OMB issued our third annual report to Congress

on the implementation of the Federal Information Security Management Act [FISMA]. Much of the information I will be discussing

today is provided in more detail in our report. So based on that,

sir, I would be happy to answer any questions that you may have

about the report and the status and what we are doing going forward.

[The prepared statement of Ms. Evans follows:]

40

41

42

43

44

45

46

Chairman TOM DAVIS. Ms. Evans, let me start with you. Do you

plan to issue new or updated guidance regarding your Circular A–

130?

Ms. EVANS. We do not plan to issue updated guidance on A–130

because we believe that it is based on sound principles that are already reflected in FISMA. With NIST issuing new standards and

guidance, we really don’t think that we need to revise A–130 at

this time, but we will continue to review it.

Chairman TOM DAVIS. All right. In this year’s report, just like

last year’s report, you mentioned that reporting to US-CERT is sporadic and not complete. What steps are you and US-CERT taking

to ensure that agencies are more compliant in these incidents?

Ms. EVANS. In May 2005, we did issue a reporting concept of operations out to the agencies, and so what OMB and DHS are planning to do is followup specifically with the agencies that did not report any incidences to US-CERT to make sure that we all are operating from the same understanding so that we can go back and

double-check that an incident is an incident based on this concept

of operations that was approved by all the agencies as well.

Chairman TOM DAVIS. Now, although there has been improvement, there are still several agencies that don’t have complete inventories. These include some of the largest: DOD, USDA, Treasury, HHS, and VA.

You know, without accurate inventories, how can you be sure

that the agencies are making progress? And while C&As are an important component of security, knowing what systems you are running is even more essential. Have you emphasized or has OMB emphasized to the agencies the necessity of a complete inventory? And

what challenges have they reported to you in trying to create and

maintain an accurate inventory?

Ms. EVANS. Yes, sir, we have worked with the agencies, and in

the places where the agencies haven’t had a completed inventory

based on what the IGs have reported, we are meeting specifically

with those agencies to be able to address what issues are keeping

them from meeting the inventory. But, also, we have included this

in the President’s management agenda as one of the criteria and

that we do assess the agencies on a quarterly basis of their

progress on performance.

So once an agency makes green, in order to maintain green they

have to have a completed inventory.

Chairman TOM DAVIS. Thank you. Identity theft continues to be

a growing problem, especially with the loss of personal and sensitive information. Data breach laws at the State level which require companies to inform individuals when the organization suffers a breach that exposes their personal information have improved our understanding of this problem. Congress is considering

a national data breach notification standard. Currently, there is no

requirement for Federal agencies to notify citizens in case there is

a breach. I have a few questions along those lines.

One, do Federal agencies notify citizens when a breach of personally identifiable information occurs on Government data bases?

Ms. EVANS. In responding to that question, sir, we believe the

Privacy Act has provisions that address this. But what I would like

to do is be able to go back and do a more in-depth analysis and

47

be able to take this question for the record and give you a more

thoughtful response about how we should be responding to this.

Chairman TOM DAVIS. I appreciate that, because that is something that comes up time and time again.

What, if any, guidelines exist to determine if a breach requires

notification?

Ms. EVANS. Again, sir, I need to go back and further research

this based on what we have put in place with the Privacy Act, and

I would like to take this question for the record so that I can give

you a more thoughtful response.

Chairman TOM DAVIS. Let me ask you something on RFID technology, radiofrequency. RFID technology is being implemented by

DOD for tracking supplies. It is being implemented by the State

Department for immigration documents and passports. Other agencies may choose to use the technology to control access to physical

and logical assets to comply with Homeland Security Presidential

Directive 12. A May 2005 GAO report on the Federal Government’s

use of RFID highlighted FISMA security practices in the context of

security concerns with RFID technologies.

What agencies within the Federal Government are using RFID

technologies for applications that involve sensitive personal information?

Ms. EVANS. You have mentioned the State Department, Department of Defense, DHS. What we would like to do is go back and

look more completely at each of the agencies to see what their

plans are as it relates to the deployment of RFID beyond what we

already have planned.

Chairman TOM DAVIS. Do you think there is a need for a national standard for maintaining the security and privacy of personal information collected using RFID technology?

Ms. EVANS. We believe that if you currently implement the security policies and practices that are in place, if you implement them

adequately, those practices and policies would be able to protect

the information regardless of the technology, whether it was RFID

or any other new emerging technology that would come out.

Chairman TOM DAVIS. So how do you fine-tune FISMA regarding

the use of RFID technology given its increased adoption by Federal

agencies that are required to meet FISMA standards?

Ms. EVANS. Well, I would recommend at this point that FISMA

is about good security practices. It is about managing the risk associated with your security program and your information technology

and assets. And it is really not specifically about technologies but

about our ability to manage those technologies as we implement

them.

So in conjunction with working with NIST and having NIST

issue policies, guidelines, the standards that they do, I think

FISMA is adequate the way that it is, and it is up to us and then

the agencies to manage that risk as new technologies come out.

Chairman TOM DAVIS. OK. Mr. Wilshusen, let me just ask, it

seems that when we look over the grades, the largest agencies or

those agencies with diverse missions seem to be at the bottom of

the grading while the smaller of the major agencies or those with

single, well-defined missions seem to improve their grades. How do

48

you think the diverse mission and size play into the issue of information security?

Mr. WILSHUSEN. Well, I think certainly that size and the complexity of the organization influences the way an organization organizes, manages, and secures its information technologies. Large

Federal departments have multiple, sometimes semi-autonomous

operating bureaus and divisions that may have separate missions,

business processes, cultures, and technologies that support those

processes.

However, at some level those technologies interconnect with

other systems and networks with other bureaus, and consequently,

there might be vulnerabilities in one particular agency or bureau

that has an impact on others. Thus, there is really a need for

strong security management over that area. However, because

these bureaus may be somewhat semi-autonomous and have separate funding, they may not necessarily be conducive to implementing or ceding some of their authority for securing these systems.

It is going to take—and the departments might have a more

challenging role in trying to create and develop and implement an

agency-wide information security program. It is going to require

that agency top management and the management of the different

bureaus be held accountable and support and be committed to implementing an agency-wide information security program.

Chairman TOM DAVIS. I think there is a perception in some circles, it seems to me, that FISMA is largely a paperwork exercise.

What is your reaction to that?

Mr. WILSHUSEN. FISMA is designed to be a comprehensive

framework for ensuring the effectiveness of information security

controls over the information resources that support Federal operations and assets. It requires Federal agencies to develop, document, and implement an agency-wide information security program

that contains various elements. Each of these elements is based on

best industry practices. These include assessing the risk, developing risk-based policies and procedures that cost-effectively reduce

those risks to an acceptable level. It also requires that agencies

provide the training to their employees and contractors to inform

them of what these risks are and their responsibilities for practicing and implementing strong security throughout the organizations.

It also requires that agencies test and evaluate the effectiveness

of their controls over their systems on a periodic basis, and if there

are problems, if there are weaknesses, to take corrective actions.

These are just basic information security principles and practices

that should be implemented. If agencies are reducing FISMA implementation to a paperwork exercise, then they are not going to

enjoy the benefits offered by implementing them.

Chairman TOM DAVIS. Can you think of any incentives or penalties that should be added to improve the agency scorecard ratings?

Mr. WILSHUSEN. One might be looking at the funding. I believe

at one point in time there was discussion on whether agencies, you

know, should be looking at the funding, should they be adjusted,

should—for agencies that do well versus those that do not.

Chairman TOM DAVIS. How about the——

49

Mr. WILSHUSEN. But that is a double-edged sword.

Chairman TOM DAVIS. Of course it is. You are taking money from

the people who need it the most.

Ms. Evans, do you have any thought on that?

Ms. EVANS. When we do the analysis for the President’s budget

every year, one of the key priorities is the cyber security program

of each of the agencies. So we do continue to put a priority on that

and make sure that agencies that don’t have a good security program, that the priority for the funding going forward is spent on

that first and that—and we have broken out the budget this year

when we submitted the 2007 budget, broke out and showed the relationship of their overall IT budget to the percentage that they

spend on IT security as well, and continue to put the priority on

that.

The thought from the administration is that you should not layer

new things on top of bad things. And so you need to fix the cyber

security aspects of that based on all the issues that you brought up

already today about implementing new technologies and those

types of things.

So the incentive is the more efficient you are at getting it done,

not just generating the paperwork but really fixing the security

and mitigating the risk, then you can move forward and use the

funds that you had planned to use for those new activities within

your agency or department.

Chairman TOM DAVIS. And you think the budget reflects that to

some extent, is what you are saying?

Ms. EVANS. Yes, sir. Yes, sir.

Chairman TOM DAVIS. Ms. Watson.

Ms. WATSON. I missed most of the testimony. I want to thank the

chair for having this hearing. But what stands in our way from

preventing the hacking and the taking of information and putting

illegal information into the process in our computers? What stands

in our way from stopping that?

Mr. WILSHUSEN. One is making sure that the agencies have fully

implemented an information security program within that particular agency.

Ms. WATSON. Why haven’t they?

Mr. WILSHUSEN. Well, that is a good question and that is one

that we constantly seek the answer to. In our reviews we look,

when we conduct an information security audit at the Federal

agencies, we look at the type of controls that they have in place,

the effectiveness of those controls, and we have often found that

numerous vulnerabilities exist within their access controls that are

designed to prevent limit and detect access to their information resources. We also find other types of general controls related to their

physical security over their computing resources that also could

lead to the unauthorized disclosure, deletion, alteration of sensitive

information. And these types of weaknesses have been identified at

numerous agencies that we have done audits at.

Ms. WATSON. Well, is it that we don’t have the technology knowledge to do something? I mean, I know you are auditing, you are

looking. Is it lack of technology knowledge? Is it lack of setting a

priority? Is it lack of the funding? Did you—where would you put

your finger, if we were to correct this and do it in a hurry? Because

50

I flip on CNN or I flip on one of the morning programs and I find

that in our Federal computers people have pornography, etc. How

does that happen?

Mr. WILSHUSEN. Well, certainly there are technical controls that

need to be improved and in place to help protect that from happening. But first and foremost, we see information security as a management issue and that it receives sufficient attention and implementation throughout the organization, from top-level management

through all layers of the organization, because each and every person has responsibility for information security. But in terms of the

management, we do look at various different aspects in terms of is

the organization assessing the risk accordingly for the type of information that it collects and processes and maintains; are they developing those policies and controls that are needed to protect that information?

And what we often find is, yes, they do that to an extent, and

they may develop policies and procedures that are designed, at

least, to protect the information and implement strong controls, but

a lot of times they are not implementing it. And this often occurs

even though at the department level they might have strong

policies——

Ms. WATSON. Well, let me just stop you there. Does it go to incompetence? You know, I am reading here, each agency is also required to do an annual independent evaluation—let’s say of information security. Why would it not be done? And why could they

not address it?

You know, we are the policymakers here. You are in front of this

committee. Maybe you can give us some idea of what our next piece

of legislation needs to be.

Mr. WILSHUSEN. I would like to answer the first question you

had there first.

Ms. WATSON. OK.

Mr. WILSHUSEN. Certainly one of the reasons why there continue

to be information security weaknesses at the organizations that we

audit is that it is a complex and challenging job. Many of these

computing environments, particularly at the larger agencies, have

highly complex distributive information systems and networks that

are, because of their interconnectivity, vulnerabilities that exist on

one server can affect an entire network. And some of these agencies

have thousands of servers. And so it is a very dynamic environment in which new applications, new servers, new technologies are

being implemented. And if the agencies are not effectively assessing their risk and monitoring the implementation of these technologies on a regular basis, vulnerabilities crop up. And that is how

hackers, that is how individuals within the organization can exploit

those vulnerabilities for either personal or—gain.

Ms. WATSON. I heard the key words: effectively assessing.

Mr. WILSHUSEN. Yes.

Ms. WATSON. And, you know, we ought to be looking at systems

before we contract and bring them in to see if they would fit in.

Otherwise—you know, we need to plan and we need to assess and

evaluate that plan, and we need to have a report. I think that is

a requirement. And certainly, you know, new technology adds to

51

the complexities of these systems, but we have to have an overall

plan, a master plan.

Mr. WILSHUSEN. Right. And that is one of the benefits of FISMA,

of what it provides, is that it requires that agencies implement an

agency-wide information security program, and that includes addressing security throughout the entire life cycle of any new technologies or its applications or systems that are being introduced

into the department.

Ms. WATSON. Thank you very much. Appreciate it.

Chairman TOM DAVIS. Mr. Clay.

Mr. CLAY. Thank you, Mr. Chairman.

For Mr. Wilshusen, GAO recently completed a draft report for me

on the impact the National Information Assurance Partnership program is having on information security within classified programs.

Can you speak to the merits of extending NIAP product validation

out to those agencies in the non-national security community?

Mr. WILSHUSEN. Sure. All these results are—as you mentioned,

we do have a draft report out. It is presently out for comment with

the DOD and the agencies. We have not yet received their comment. We anticipate issuing that report later this month in final.

But let me just at least talk about the observations that we have

identified so far with that program. We identified that the NIAP

program does indeed provide and offer some benefits. One, it provides another set of eyes and ears to look and test the security features of information security or systems products that an agency is

considering procuring. It also, through the evaluation process, has

identified and uncovered flaws within those products. And what we

have found and based on our interviews with vendors, the participants in the program, is that the vendor is often correct in those

flaws that are identified.

And another benefit is that, after going through these processes,

some of the vendors decided that they—actually changed their development processes to accommodate the new strength and to mitigate any weaknesses that were identified as their products were

evaluated.

But at the same time, there are still a number of challenges associated with that program. These also include that, for one, the

product is not evaluated against a set of particular requirements.

It is more looked at the—it is evaluated based on the procedures

that are used to develop the product. Another vulnerability is—or

I should say another challenge deals with the cost and time that

is involved in processing and evaluating these products. We have

found that vendors thought it was too costly and took a long period

of time to do so.

Some of the agencies felt that they did not have a really full population or a pool of evaluated products to choose from. Sometimes,

because of the length of the evaluation process, new versions of the

product under evaluation were being issued, so they couldn’t necessarily get the latest and greatest version of the product.

So there are a couple of challenges associated with that program.

Mr. CLAY. On finding the weaknesses and coming back and correcting it, who gets the bill for that? Do the vendors eat the cost,

or do the taxpayers pay the cost?

52

Mr. WILSHUSEN. I don’t know if I can answer that. It is up to

the vendors. It depends on, I guess, the contractual requirements,

but it is up to the vendors to take the corrective actions on that.

Whether they subsequently pass the costs along to the procurers of

the product, I can’t answer that.

Mr. CLAY. Thank you. Thank you for your response.

Ms. Evans, perhaps you may be able to shed some light on that.

But let me ask you, you know, the number of annual risk assessments conducted last year declined when compared to fiscal year

2004 even though the number of systems online increased by nearly 20 percent. DHS—first, what were the factors contributing to

this problem at first? Talk to me about DHS, which once again—

well, go ahead.

Ms. EVANS. Well, as you stated, the risk assessments did go

down, but we did get an increase in the number of systems that

are out there. However, this is also the first year where we did ask

the agencies to also assess the systems that they had based on impact, like high, medium, and low impact of those systems. And the

agencies did focus their risk assessments on the high-impact systems. And 88 percent of those, I believe, were the ones where the

risk assessments going forward on that.

So we did ask them to make sure that their priority was done

the high-impact systems as they were doing the risk assessments,

going through and doing the certifications and accreditations, because that is one piece of the certification and accreditation that

the agencies do.

Mr. CLAY. OK, let me stop you there since——

Ms. EVANS. Sure.

Mr. CLAY. Real quickly, give me your impression of ineptitude at

DHS in this whole arena. Talk to me about that, as far as them

being the coordinator of key information-sharing responsibilities, or

a legacy system, are the 22 agencies proving to be too difficult to

bring into compliance, or are there other factors?

Ms. EVANS. Well, DHS is a challenging environment. By bringing

all the departments and agencies together there, this really does

exemplify the complexity of an environment of a large department

that would have to be managed to make sure that you have a good

program in place. So what DHS is doing is moving forward trying

to bring all that management in place to ensure that they have a

good cyber security program and that they can move forward and

protect that information and those assets.

It does take some time to really be able to demonstrate that

progress. And I would say that the things that DHS is doing we

may not necessarily see in all the metrics as we measure them in

FISMA. But you have brought up that the independent audit is

also an essential piece so that they can feed back the results of that

from their IG into their programming, to make sure that they are

improving that as they go forward.

Mr. CLAY. Yes. Thank you, but it sounds as though you are defending the incompetence of DHS. Thank you.

Chairman TOM DAVIS. Anything else you want to add?

We will dismiss this panel, take a 2 minute recess, and we will

come to the next one.

Thank you all very much.

53

[Recess.]

Chairman TOM DAVIS. Thank you all for your patience.

We are going to now recognize our second distinguished panel.

We have Mr. Thomas P. Hughes, Chief Information Officer, U.S.

Social Security Administration; we have Mr. Thomas Wiesner, the

Deputy Chief Information Officer, U.S. Department of Labor; Mr.

Robert Lentz, Information Assurance Director at the U.S. Department of Defense; and Mr. Scott Charbo, the Chief Information Officer at the U.S. Department of Homeland Security.

It is our policy we swear you in before your testimony, so if you

would just rise and raise your right hands.

[Witnesses sworn.]

Chairman TOM DAVIS. Thank you very much.

Well, you know our rules. We try to hold to 5 minutes. Your entire statement is in the record. We very much appreciate your

being with us today. I apologize for the delay with the floor votes,

but I think we will be able to move ahead fairly expeditiously here,

uninterrupted.

Mr. Hughes, we will start with you and we will work straight on

down the line. Thank you again for being with us.

STATEMENTS OF THOMAS P. HUGHES, CHIEF INFORMATION

OFFICER, U.S. SOCIAL SECURITY ADMINISTRATION; THOMAS

WIESNER, DEPUTY CHIEF INFORMATION OFFICER, U.S. DEPARTMENT OF LABOR; ROBERT F. LENTZ, DIRECTOR, INFORMATION ASSURANCE; U.S. DEPARTMENT OF DEFENSE;

AND SCOTT CHARBO, CHIEF INFORMATION OFFICER, U.S.

DEPARTMENT OF HOMELAND SECURITY

STATEMENT OF THOMAS HUGHES

Mr. HUGHES. Chairman Davis and members of the committee,

thank you for inviting me here today to discuss information security at the Social Security Administration. As Chief Information Officer for the agency, I appreciate the opportunity to discuss our implementation of FISMA, the Federal Information Security Management Act of 2002, and our agency’s accomplishments in securing

and protecting the information in the records we maintain.

SSA has always recognized the importance of protecting the security and privacy of the people we serve and ensuring the integrity

and accuracy of the records we maintain. The Social Security

Board’s first regulation, published in 1937, dealt with confidentiality of records. For more than 70 years we have honored our commitment to the American people to maintain the confidentiality of

these records. This longstanding emphasis on privacy has led to a

strong commitment in information security.

While we have always safeguarded our records, we also work

continuously to ensure that our information technology programs

remain responsive to evolving conditions, and we use a variety of

proactive security measures, plus independent testing and evaluation security controls, to protect these records. We take an agencywide approach to information technology security at SSA. SSA’s

deputy commissioners, along with the CIO, are accountable for the

certification of our major IT systems and help to ensure that our

IT assets are adequately secured.

54

Here are some of the major highlights of our FISMA 2005 report:

All 20 of SSA’s major IT systems were certified and accredited.

SSA had incorporated National Institute of Standards and Technology security controls into our System Development Life Cycle

process.

SSA provided IT security awareness to all of our employees, including contractors, and gave specialized in-depth training for

those with significant IT security responsibilities.

The Office of Inspector General’s independent evaluation of our

information security program for 2005 confirmed that SSA’s remediation, certification and accreditation, and inventory processes are

sound. The OIG made a number of recommendations for improvement that we are implementing.

For instance, first, we developed security documents for every enterprise architecture platform in the agency and expanded this initiative into the data base environment as well. In addition, we implemented a monitoring program for each system configuration

standard and risk model.

Second, we agreed with the IG recommendation that SSA should

regularly update our continuity of operations plan [COOP], with a

disaster recovery plan. SSA also has and will participate in disaster recovery exercises, which help validate key elements of our

COOP.

Finally, to respond to the recommendation regarding improving

how we monitor contract security awareness training, we are implementing a process where all contractors with systems access will

complete a security awareness training module that will allow us

to monitor the process.

You asked us to describe the way SSA identifies and tracks information technology security weaknesses. The answer is that SSA is

using an automated software tool that allows us to follow corrective

security actions all the way to completion. In addition, the system

generates detailed reports which then allow management to better

evaluate the security status of their systems.

You also asked about guidance—resources and/or procedures

agencies need to comply with FISMA. I believe that agencies need

to constantly challenge the traditional status quo if we are to maintain and enhance our security procedures and comply with FISMA.

This is critical in any security environment, but particularly important in today’s challenging information environment.

While we are proud of our accomplishments, Commissioner

Barnhart and all of us at SSA recognize that we must be vigilant

in every way to assure that the personal information SSA collects

remains secure, the taxpayer dollars are protected, and that public

confidence in the Social Security system is maintained.

Mr. Chairman, thank you for the opportunity to speak before this

committee. I will be pleased to answer any questions.

[The prepared statement of Mr. Hughes follows:]

55

56

57

58

59

60

61

62

Chairman TOM DAVIS. Mr. Hughes, thank you.

Mr. Wiesner, thanks for being with us.

STATEMENT OF THOMAS WIESNER

Mr. WIESNER. Good afternoon, Chairman Davis and members of

the committee. Thank you for inviting me here today to discuss the

Department of Labor’s implementation of the Federal Information

Security Management Act and the lessons learned over the past

several years.

Today I will first speak on the challenges the Department has

faced over the last few years in implementing its computer security

program. I will then expand on the current status of our program

and highlight many of the significant improvements. Last, I will

provide a snapshot of opportunities for improvement and labor

strategy to address those areas.

Labor’s organizational components, including the Office of the

CIO, had different viewpoints FISMA compliance. Additionally, we

were an organization of distinct agencies that in many cases operated independently and accomplished individual goals through various IT solutions. Labor agencies, the OIG, and the Office of the

CIO were all focused on different and sometimes conflicting priorities. We had to change this culture, including attention to IT security as a key part of everyday business. Under the CIO’s direction,

the Department arrived at a consensus and we have moved forward to ensure our compliance with FISMA.

To that end, the following actions were carried out: In 2001, a

security manager was hired and placed in the Office of the CIO to

manage the Department-wide security program.

In 2002, our IT security policies and procedures were updated to

incorporate current OMB and NIST guidance.

In 2003, the Department established a Technical Review Board

IT Committee subcommittee comprised of agency security managers. This board serves as the Department’s first tier of investment review for major IT investments and as a forum to identify

and resolve Department-wide IT-related issues, including computer

security.

In 2003, Secretary Elaine Chao institutionalized a culture of policy and strong computer security under a Secretary’s order issued

in May 2003. This order outlines the roles and responsibilities for

managing information technology at the Department, to include IT

security responsibilities.

In 2003, the Department developed an eGovernment Strategic

Plan that ties IT security to the Department’s mission.

In 2005, the Department updated its IT Strategic Plan, where IT

security goals and direction were incorporated.

At Labor our computer security program has progressed from a

grade of F in 2001 to a B- in 2004. Additionally, our computer security program was a significant contributor to the Department’s

achieving and maintaining a ‘‘Green’’ rating on Expanded Electronic Government on the President’s management agenda scorecard.

The successes we have achieved to date can be attributed to

strong oversight of Department-wide security issues, cooperation at

the IT senior management level, and continuous collaboration

63

through Department-wide reviews. The efforts of the Labor IT Security Subcommittee results in sound security practices that enable

consistent FISMA reporting from the CIO and the OIG. This is attributed to the following successes: A fully integrated computer security program with capital planning and enterprise architecture

programs. A revised system development life cycle management

manual to include security requirements at each phase. An OIGapproved plan of action and milestones program since 2003. Quarterly capital planning program reviews that ensures adequate IT

security expenditures and semiannual eGovernment reviews of all

DOL agencies modeled on the PMA scorecard and FISMA performance metrics.

Correspondingly, the Department has maintained a comprehensive Certification and Accreditation program, achieving authority to

operate for 100 percent of our major information systems, up from

97 percent in fiscal year 2004.

Despite this progress in securing our IT systems at DOL, we recognize that security is a constant challenge and a task that can

never be considered complete. We have identified three areas for

strengthening our computer security program: general and application security controls, patch management, and IT security manager

skill competencies.

The Department has developed a comprehensive work plan to address these issues, to include the implementation of NIST 800–53

and a Certified Information Systems Security Professional training

program and certification exam for DOL security managers.

In conclusion, computer security is a core element of our business

and culture at the Department of Labor. Secretary Chao, Deputy

Secretary Law, agency senior management, and the dedicated DOL

IT professionals are committed to the Department’s computer security program. As we face the evolution of FISMA compliance, we

will strive to maintain a balance of FISMA reporting requirements

and the implementation of sound security practices.

Mr. Chairman, thank you for the opportunity to provide this

brief outline. I would be happy to answer any questions. Thank

you.

[The prepared statement of Mr. Wiesner follows:]

64

65

66

67

68

Chairman TOM DAVIS. Thank you very much.

Mr. Lentz.

STATEMENT OF ROBERT LENTZ

Mr. LENTZ. Good afternoon, Mr. Chairman and members of the

committee. As Chief Information Assurance Officer for the Department of Defense, I appreciate this opportunity to highlight the posture of information security within the Department.

The Department leadership is fully engaged in the security efforts in support of FISMA. Secretary Rumsfeld considers information technology a critical strategic component in transforming

America’s armed forces for the 21st century warfare. Our recently

completed Quadrennial Defense Review stresses networks and information security as key areas of focus.

Collaboration between the CIO and the war-fighting community

is absolutely critical. The protection of the network is everybody’s

business. This can’t be overstated. We take specific actions to train,

license, qualify, and certify pilots and weapons systems. We must

consider no less a standard for the operation, security, integrity of

our information systems.

The DOD IA strategic plan has for 3 years been institutional

component driving strategic objectives for improving our security

posture. It also enables FISMA compliance. The Department of Defense uses FISMA as a critical management and assessment tool.

We continue to enhance our FISMA efforts.

The Department reviewed over 3,500 systems this past year, an

increase of more than 1,000 systems from 2004. The Department

increased its Authority to Operate rate from 58 percent in 2004 to

82 percent in 2005. In addition, our Total Accreditation rate was

at 93 percent.

Last year, more than 2 million of the approximate 2.6 million

DOD personnel who had access to DOD networks received IA security awareness training. This training was accomplished even while

larger members of the servicemembers were deployed to combat

theaters. In addition, more than 67,000 individuals with significant

security responsibilities received specialized security training.

I have identified in the full written testimony many initiatives

that DOD has undertaken to improve its Information Security Department. Let me highlight a few others.

The Department is aggressively pursuing an enterprise architecture and prioritized enterprise solutions through centralized funding.

The Department has comprehensive policies and process for system configurations, a very important area. One example is the distribution by the Air Force of Microsoft software with standard security configuration resulting in improved network security and management.

Departmental components are accelerating the use of public key

infrastructure, from network access and secure log-on, consistent

with HSPD–12. Over 3 million personnel are outfitted with common access cards, enabling PKI capabilities throughout the Department.

69

In 2005, the DOD published a comprehensive IA Workforce Improvement program, launching an aggressive effort to certify nearly

80,000 core network professionals.

As to identified security weaknesses in this year’s FISMA report,

we are pleased to advise you of the following remedies: Considering

the dynamic operational environment of DOD and the sheer number of systems deployed across the enterprise, we have made significant progress in the area of inventory of our IT systems. We believe that our inventory of major information systems is under control.

Regarding the challenges of instituting a process for managing

plans of actions and milestones, the Department has a PO&M process that was improved in 2005 from lessons learned and from IG

audits. We continue to improve that process by making this year’s

guidance more detailed and integrated into our C&A guidance as

well.

We are also developing an automated standardized capability

that will add greater visibility to PO&Ms.

We believe the Department certification and accreditation process is very solid and getting better. FISMA delegates authority to

the Secretary of Defense to develop security policy and guidelines

for all of its information systems. The DOD C&A process is consistent with NIST guidelines but designed to address classified national security systems and factor in unique operational challenges.

In the area of training in 2005, the DOD components reported a

total of 79,000 employees with significant IT security responsibilities. In such a large, dynamic, and changing organization that

number will always be in a state of flux.

In conclusion, the Department of Defense is committed to a

strong and comprehensive security program. Our commitment to

improve our FISMA compliance is an essential element of the Department’s information security strategy.

Again, I thank you for the opportunity to comment on this important topic.

[The prepared statement of Mr. Lentz follows:]

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

Chairman TOM DAVIS. Thank you very much.

Mr. Charbo.

STATEMENT OF SCOTT CHARBO

Mr. CHARBO. Thank you, Mr. Chairman and committee members.

My remarks will cover the current status of the Department’s implementation of FISMA.

The mission of the Department of Homeland Security’s information security program is to provide the Department with a secure

and trusted computing environment that enables the Department

to leverage information technology and effectively and securely

share information in support of its many and varied missions. Statutory compliance is a top priority, and the Department’s information security program is structured around compliance with FISMA

as well as OMB in this guidance.

In 2003 and 2004, the Department laid the necessary foundation

of effective security policies and architecture guidance. Policies are

now codified in a dedicated management directive and a systems

security architecture is fully integrated with the Department’s architecture.

Security policies and architectures are both updated on a regular

basis and compliance is enforced through the use of several mandatory security management tools that are now in use throughout the

Department. Building on those efforts, the Department completed

three major information security initiatives in 2005.

First, a comprehensive systems and applications inventory was

completed in August 2005. The inventory is based on a detailed

methodology for identifying systems and applications using standard Federal definitions. This inventory now provides clear accreditation boundaries for each and every operational IT system and assigns responsibilities for those controls to specific individuals,

thereby providing a baseline for measuring security compliance.

To ensure the inventory remains accurate, annual inventory reviews will continue each year, with a near-term focus on 2006 of

linking the inventory to the Department’s capital planning and investment control processes, thus allowing the Department to better

integrate effective security controls at the beginning of a system’s

life cycle.

In the Department’s fiscal year 2005 FISMA report, the Inspector

General acknowledged for the first time the completeness and accuracy of our FISMA inventory.

Second, an enterprise certification and accreditation tool was successfully fielded in April 2005, and that is now fully integrated

with a FISMA management tool fielded in 2004.

Third, a comprehensive and repeatable set of information security metrics significantly improved system owner accountability.

These metrics now measure and inform progress in completing the

accreditation of all operational systems. Monthly information security scorecards provide detailed status updates to Department leadership, and these scorecards are highly successful in improving the

accountability of system owners.

These three initiatives build on earlier milestones and have now

paved the way for real, measurable cyber security improvements.

The Department implemented an aggressive remediation project

87

for 2006 with a goal of 100 percent remediation by the end of this

year. Originally announced by Secretary Chertoff in his keynote address at the Department’s annual Security Conference last August,

the project moved into full swing in October 2005 and the Department is on its way to full remediation.

The Department’s FISMA inventory currently includes approximately 700 systems, and prior to the initiation of the remediation

project, the number of fully accredited systems was only 26 percent. By the end of February of this year, over 60 percent of those

systems are now fully accredited. In just 5 months, the Department

has more than doubled the number of accredited systems and it is

on track to make the goal of full remediation by the end of the

year. It is clear the project is positively affecting the security culture of the Department, and recent upward trends in remediation

metrics support the view.

The Department must also ensure those systems and applications are connected across a secure enterprise backbone providing

shared IT services. To accomplish this goal, an aggressive infrastructure transformation program called One Net was initiated for

2006 to bring all legacy information technology infrastructures

under a single enterprise. Benefits of One Net include network optimization and improved quality of service, both of which will significantly enhance information sharing initiatives.

Planning for One Net began with a comprehensive security

framework that is consistent with the detailed systems security architecture of the Department.

As part of the One Net effort, the Department is also fielding its

first enterprise-wide network operations and security center. The

center is responsible for managing the Department’s shared IT enterprise environment in real time, including the discovery and remediation of security incidents as they occur, and represents a significant improvement to our overall security posture.

I am confident that the DHS information security program is

moving in the right direction.

Thank you. I look forward to your questions.

[The prepared statement of Mr. Charbo follows:]

88

89

90

91

92

93

Chairman TOM DAVIS. Thank you, all.

Now, looking at the report card, we seem to have a reverse bell

curve, with agencies settling at either the high end or the low end.

For the two over here on my left, or on the right here, what are

the major steps your agency took to achieve it? You didn’t start off

with A’s, you worked steadily toward that. And I would say for

DOD and then DHS, what are the major challenges you feel prevent you from progressing? Your plan for addressing these challenges you alluded to in your comments, what would you like to see

your partners in this process do to help you? I am talking about

OMB, GAO, and the IG.

I will start with you, Mr. Hughes. You traced out the things you

did to get your A+ and maintain it.

Mr. HUGHES. Mr. Chairman, members of the committee, really,

at Social Security there is a strong emphasis on security. It has

been there for many years, as I have repeated. And with FISMA,

I can tell you we take it very seriously. We meet regularly, we constructively argue regularly, and we try to make corrections. So you

have to make that commitment to keep challenging, as executives,

the importance of security and that FISMA is a real exercise. And

so I don’t know if I can say that enough from a practical reality.

It is not a paper report, it is real security that we are trying to constantly be aware of. And that is what FISMA teaches us.

Chairman TOM DAVIS. Mr. Wiesner.

Mr. WIESNER. At the Department of Labor I would have to say

there are a few items that have led to our success. One is the

strong leadership and management commitment from the Secretary’s level through all the levels of management, including assistant secretaries, the various senior IT management staff within

the Department of Labor. And it starts at the top and management

supports us 100 percent in ensuring that we protect our departmental assets.

The second step we have done over the last few years is really

integrate IT security into our IT management processes, procedures, and governance models. We start looking at security at the

capital planning stage and enterprise architecture, during the systems development life cycle process, the entire life cycle. So we put

security integrating into every IT project that we undertake and

currently the ones that are under way.

And then the other thing we have worked on really hard is to

establish a strong relationship with the OIG, recognizing that they

have a strong compliance role and they have their views on how

they view us as being successful and the things that they discover

in their audits and what we should be focusing on, and we establish that relationship and try to form a partnership so we are heading in the right direction.

Chairman TOM DAVIS. Thank you.

Mr. Lentz, let me just ask you, I mean, if you had an A+ you

would feel your agency was more secure, wouldn’t you?

Mr. LENTZ. Of course, sir. I think the question you asked in your

earlier panel, sir, I think goes to the heart of one of the challenges

that we have, which, as you said earlier, a very large and a very

diverse, dynamic organization that is deployed worldwide and

things are changing all the time.

94

I think the discussions that I have had with my peers, other

chief security officers in the Department as well as private-sector

leaders in this area, I think the point that has to be emphasized

is that during the FISMA process, the act calls for an assessment,

not an audit. An assessment takes into account a lot of factors. In

a large organization like the Department of Defense—or Homeland

Security, for that matter—you have a changing environment.

Where an audit could in fact pick up one or two systems that may

not be accounted for or a certain number of personnel that may be

deployed that are achieving certain status, you know, I think

through that kind of dynamic environment, it makes it very difficult to, at some times, achieve the kind of scores that may be indicative through an auditive process.

I think by working closely with the IG, which is indicated by my

colleagues, I think that is a very important step in this process and

one that we are continuing to strive for.

Chairman TOM DAVIS. One of the things is, when we got our reports on DOD, we got like four different reports. We get the Army,

Navy, Air Force. I mean, it kind of made up just the way that your

organization is different from a lot of other agencies in terms of

how this is compiled and so on. I mean, is that an obstacle?

Mr. LENTZ. I think Secretary Rumsfeld through the QDR process

and our new CIO, Mr. Grimes, wants to remove any type of obstacle that may in fact be inferred by that kind of service-oriented environment that we live in. We are very much focused on an enterprise architecture, we are very much focused on an enterprise CIO

governance model. And I think we are already seeing improvements in that area already that I think are going to be reflected

very much so in next year’s report, sir.

Chairman TOM DAVIS. OK.

Mr. Charbo, I will ask you, I mean, obviously you come from a—

you had a number of dysfunctional agencies you are trying to put

together. You have had a steep climb over there to begin with. So

I concede that to you.

Mr. CHARBO. Thank you. I think the first thing that we have

done—and our numbers, I think, are supporting that we are moving in the right direction right now, in the last 5 months. We have

been able to move it more than it has moved in the last couple of

years.

But the first piece that we had our teams accept was where we

were was not where we wanted to remain. So we admitted that we

weren’t in the right posture that we wanted to have moving forward in terms of the security of our systems. So we asked Secretary Chertoff to lead that charge for us at our annual conference

and then place that accountability to those system owners in the

multiple components that we have.

We have seen very good response from the Coast Guard and Customs, ICE. Even FEMA has responded well in terms of the accountability for securing the systems.

Publishing the inventory was a major milestone for us. It put

that benchmark in the sand. Now we are focused on moving that

forward. And I guess I would just say, we use a term called ‘‘relentless’’ in the Department. You will get a lot of excuses on how hard

95

this is to do, but we accept that but we still need to move it forward. And that is what we are focused on.

Chairman TOM DAVIS. But GAO reported that there was a very

low level of security incident reporting in DHS. What is the problem? What is the deterrent here? Do we need to do anything to remove those barriers?

Mr. CHARBO. I think we have rallied that in here in the last 5

months. We have implemented policies, we have done some training with our systems security professionals that we have in the Department, and we have worked through those processes to assure

that we are getting reporting.

The other piece that I think will really improve that is how we

are going to be monitoring our systems. We have had multiple

wide-area networks. So you have different methodologies of reporting. That is now coming through a core NOC-SOC—network operations, security operations center—through our One Net. And they

will have a responsibility of moving that to the US-CERT.

Chairman TOM DAVIS. One of the problems you have at DHS is

you have taken all these disparate agencies, over 100 and some

1,000 employees, and put them together, and everybody expects immediate results. This is a work in progress. I mean, this takes

years, doesn’t it, as a practical matter?

Mr. CHARBO. We are going to take 1 year to certify the systems.

We will move those, a large milestone—as we say in our statement,

we were at 26 percent that we could document and we are now

about 60 percent. And it is on the right curve that we want to move

through the end of the year. At that point, we will look at the

POAMs that are generated, we will go back into those accreditations and do an IV&V, and we will reassess it. It will be an annual

routine that we will follow.

Chairman TOM DAVIS. Let me ask Mr. Hughes and Mr. Wiesner,

your agency systems have to connect with State systems that are

not covered by FISMA for information sharing purposes. How do

you ensure that your information systems are adequately protected

under those circumstances?

Mr. HUGHES. That is a good question. We have agreements with

States and different agencies. We have security procedures and

policies that they have to agree to. We have MOUs of these agreements. And we monitor these data exchanges that go between the

States and the Federal Government.

Chairman TOM DAVIS. All right.

Ms. Watson.

Ms. WATSON. I want to highly commend Mr. Hughes, U.S. Social

Security Administration, and Mr. Wiesner, U.S. Department of

Labor, for the fact that using the criteria that the committee used,

the number of points assigned to each response is proportional to

the extent the element has been implemented. You received an A+.

And you started from probably lower grades, but you showed your

ability to focus like a laser beam and to make the improvements

along the way.

Going to Mr. Lentz and Mr. Charbo, U.S. Department of Defense

defending our country, and U.S. Department of Homeland Security

securing our country, you started in year 2005 with an F grade

and, at the end of year 2005, you still have an F grade. Can either

96

one of you gentlemen explain to me why? And listening to your reports, it looks like you are just moving along and making progress.

But the criteria that the committee used was a methodology that

was standardized, and you came up, started with an F, and you are

still at an F.

Let me know why that is the case. Mr. Lentz, let me start with

you.

Mr. LENTZ. Well, ma’am, I agree that the challenges that we

have in this very large organization will sometimes make the process that we use in terms of assessing our operational status one

that creates the kind of assessments that one has to look very hard

at, and that is what our leadership is doing every single day. And

we take——

Ms. WATSON. Let me just stop you. Mr. Lentz, 5 years? Your

leadership? Five years and you don’t improve based on the methodology that is standardized? The way they judged every single—

and I can read off all the departments. Agency for International

Development, A+, starting from much lower grades before. Department of Labor, A+. Social Security, A+. Office of Personnel Management, A+. Environmental Protection Agency, A+. National

Science Foundation, A.

What is happening with the two most strategic and sensitive

agencies? What is it? Is there incompetence? Is there cronyism?

You know, I don’t feel comfortable with my Department of Defense,

based on what I see here. I don’t feel comfortable that my homeland is secure. And I can take a lesson from September 11th. The

perpetrators were sent—the flight school, as I understand, sent

them their authority to take flight lessons after September 11th.

Something went wrong along the way.

Now, if you had a department, a business that made nails, and

you put the metal in at the beginning of the process and, at the

end, the nails came out bent, you would stop the whole operation

and work backward to find out why those nails are being bent.

What is happening with the Department of Defense and Homeland

Security that in 5 years, based on the methodology used, you show

no improvement? You tell us that the report—I guess the preceding

5 months will look better, but I am wondering what happened in

those 5 years. Can you help me understand this?

Mr. LENTZ. Well, I think when we look at, when we open up our

report and look at it gradually—and, as indicated in my testimony,

I think we have shown some clear improvements in all the areas

that FISMA is asking for. And on top of that——

Ms. WATSON. As of when? Can you help me?

Mr. LENTZ. As of starting last year and the year before.

Ms. WATSON. Well, why is it—maybe the staff is incompetent, because they graded you. I did not. The committee staff. And maybe

I should ask this of the chair. You know, they score by a point. And

I probably need to give this to you. And, you know, if you score

within a certain range, they assign you a certain letter. And the

scores were so low with the Department of Defense and Homeland

Security that it resulted in an F. Now, maybe the math is all off.

I am trying to be fair. I am trying to understand what is going

on with my Department of Defense that you come and you ask us—

you know, we have a supplement on the floor asking us for billions

97

of dollars. And, you know, what are you securing, Iraq? Department of Homeland Security, what are you securing?

You know, and the grade is still coming out F. I need to understand this so when I go back to my 650,000 constituents that pay

taxes, and I—I didn’t vote for it, and I am not going to—I can tell

them, yeah, we need to vote for this because our Department of Defense says they need this so we can win the war 10,000 miles away.

We are not winning the war here. We can’t even pick up the rubble

down in New Orleans.

So you have to prove to me that you are doing something that

will secure us as a people and secure our country. And I don’t see

it. So I am asking for you to educate me, to enlighten me, so I can

go back and tell my constituents why I would vote to use their taxpayer dollars to defend against Iraq—which apparently is no threat

to us here, but certainly a threat to life and limb over there. Give

me some information, please, that there is some competence in this

organization that I can take back to my constituents.

Mr. LENTZ. In looking at the grading that we have recently seen,

there were two assessments that were done, one by the CIO and

one by the IG, in the assessment column. The Department of Defense got a score of 85 under the CIO column. And when you look

at that holistically and combine that with all the other security

measures that were undertaken, such as, as the chairman indicated earlier, identity protection and management using PKI and

other methods that we are, I would say that I think our security

posture has significantly improved. But at the same time, I must

admit, we always in this very dynamic environment that we live

in, we have to constantly seek for better improvement in these

areas.

Ms. WATSON. Let me address the chair. From the response I just

received, is there something wrong with this scoring? Because as

I look at the information provided to us on the assignment of

grades, it says 0 points for a response indicating the percentage

that falls below an acceptable threshold. And they give us an example: 50 percent or less known IT security weaknesses being incorporated in the plan of action. That means that you fell below the

50 percent level.

Now, if this is the methodology——

Chairman TOM DAVIS. Well, the methodology is very simple. The

CIO scores and the IG scores, and when you are in doubt, GAO

takes the IG score. CIO score is like when you are grading your

own paper, to some extent. So in those cases, the GAO, who really

gives us the numbers on which we base the grade, goes with the

IG score.

Ms. WATSON. So I still haven’t heard adequate response to my

concerns. And I just think there is something wrong in the process.

And I would advise the two of you to take the message back from

me individually that the Department of Defense, the Department

of Homeland Security needs to get about the business of improving

the process of securing our land and our people. From what I see,

and this is information that the staff gives us, I did not do the research and the evaluation and the assignment myself. You need to

know that. I can only go on the information that our professional

staff gives us.

98

I would hope the two of you, next time you come, not insult my

intelligence. Otherwise, I have to question the competence of staff.

But you can’t tell me it is working well and the staff gave you and

F, and for the last 5 years it has been F. So take that message back

to the Secretaries. And Mr. Chertoff has not returned my call.

When I was asking him to stop the evictions of 10,000 people, I

never got a return call. So he would get an F- from me in terms

of being effective just answering a call from a Congress person concerned about making—so I have no trust that it is going to get any

better. Now, that is my opinion. I am speaking for myself. And you

can take that message back.

Thank you, Mr. Chairman, for the time.

Chairman TOM DAVIS. Thank you very much. I would leave on

that high note here, but I think that I will just ask a couple of

other questions.

We asked the first panel, and I guess in fairness to DHS and

DOD, do you think there are issues that arise at the larger agencies that the smaller ones don’t have to contend with? I think that

has been—we talked about that in our opening statement and I

will give you an opportunity to comment on that again.

Mr. CHARBO. From DHS’s perspective, I think there is a complexity with dealing with lots of large agencies that we have components that we have. That still doesn’t change the fact when we

looked at our security posture coming into the Department, where

we were was not where we wanted to be in terms of our security

scores and our FISMA compliance. So we have launched an aggressive project. I see good response coming from those components

even though it is large, it is complex. Currently we have the data.

We have good progression moving—I see good response coming

from those large components, as difficult as it is.

I think the GAO had some good comments in the first panel dealing with direct appropriations, and it is difficult to get them to respond. But I would like to have a chance to execute our plan this

year. And the plan that we had last year isn’t the one we are currently working under.

Chairman TOM DAVIS. I mean, you are both large organizations

but you are very important organizations in terms of vulnerability

and where someone who has malice aforethought may be looking.

So that is why we focus in on you and I think that is why Ms. Watson is just saying to DOD and Homeland Security these are two

agencies that are showing up as more vulnerable than other agencies, and obviously we are alarmed. But we understand there is a

lot of complexity. I know in the case of DHS we have cobbled together these different units and you are as strong as your weakest

unit, to some extent, the way this works.

Mr. Lentz, would you—I will give you an opportunity to comment.

Mr. LENTZ. Yes, I completely agree that the complexity of the organization, the dynamics of moving forces—when you deploy ships

out to sea, you are changing the network configurations constantly,

you are deploying troops overseas, you are creating new network

on the fly in global environments and high-risk environments.

Clearly in a situation like that, it does represent a lot of new challenges and challenges that we take very seriously.

99

Chairman TOM DAVIS. OK. Anything you would like to add?

Mr. HUGHES. I would just say that we know our mission, so perhaps—we are a large organization, we have 120,000 work stations,

but our mission is clear in terms of our complexity. We know the

way we serve our citizens. So I don’t think we have absorbed the

complexity of an organization like DHS.

Chairman TOM DAVIS. OK.

Mr. WIESNER. I agree also. We have been an organization around

for many, many years, and perhaps that helps out a little bit in

terms of absorbing a lot of complexity in a large-scale organization

like DHS.

Chairman TOM DAVIS. Well, of course this committee wrote

FISMA. We don’t have all the enforcement mechanisms we like,

but you have heard Ms. Evans talk about that is something that

they take into account as they are putting their budgets together.

We are trying to coordinate appropriately with the Appropriations

Committee so it is taken into account as they put their budgets together. You can fight the resources department within your own

agencies. I am not asking you to come here and put you on the spot

and saying are you getting enough resources with your own agency.

But we understand. I mean, I understand the issues of this. And

we are going to continue to push to give you the resources you need

to get the job done.

I just want to congratulate those of you that have shown great

improvement. And for the others, we will keep trying. I know you

have plans to address this. We look forward to seeing you up here

again.

Thank you very much.

[Whereupon, at 1:41 p.m., the committee was adjourned.]

[The prepared statement of Hon. Henry A. Waxman and additional information submitted for the hearing record follow:]

100

101

102

103

104

105

106

107

108

109

110

Æ