DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

CONTENTS

iii

ONTENTS

roduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

berspace Threat and Vulnerabilities: A Case for Action . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

tional Policy and Guiding Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

ghlights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Level 1: Home User and Small Business . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Level 2: Large Enterprises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Level 3: Critical Sectors 

Federal Government . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23State and Local Government . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31Higher Education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Private Sector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Level 4: National Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Level 5: Global . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

mmary of Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

ronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

LETTER FROM THE CHAIR AND VICE CHAIR v PRESIDENT’S CRITICAL INFRASTRUCTURE PROTECTION BOARD SEPTEMBER 18, 2002 Subject: A National Strategy to Secure Cyberspace President Bush directed the development of a National Strategy to Secure Cyberspace to ensure that America has a clear road map to protect a part of its infrastructure so essential to our way of life. On the pages that follow is a draft of that road map, developed in close collaboration with key sectors of the economy that rely on cyberspace, State and local governments, colleges and universities, and concerned organizations. These public-private partnerships that formed in response to the President’s call have developed their own strategies to protect the parts of cyberspace on which they rely. They are made available online today. Other groups, representing other sectors, have recently formed, and have begun the process of developing strategies. Town hall meetings were held around the country, and fifty three clusters of key questions were published to spark public debate. Even more input is needed. This unique partnership and process is necessary because the majority of the country’s cyber resources are controlled by entities outside of government. For the Strategy to work, it must be a plan in which a broad cross-section of the country is both invested and committed. Eight more town hall meetings will be held around the country in the next few weeks to further solicit and receive the views of concerned citizens. Comments on the National Strategy to Secure Cyberspace may be sent via the feedback link at www.securecyberspace.gov by November 18, 2002. The National Infrastructure Advisory Committee, leaders from the concerned sectors of industry, academia, and State and local government will add their comments and advice to that received from the town hall meetings and web site. The President will review and approve the Strategy in the next several months. DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

Technology will continue to change rapidly. New vulnerabilities and threats will be uncovered. Elements of our present programs may be determined to be ineffective in the future. America’s cybersecurity strategy must be dynamic and continually refreshed to adapt to the changing environment. For the foreseeable future, two things will be true: America will rely upon cyberspace andthe Federal government will seek a continuing broad partnership to develop, implement,and refine a National Strategy to Secure Cyberspace. We invite you to closely review theproposed strategy and share your input and expertise. 

Richard A. Clarke Howard A. Schmidt

CHAIR VICE CHAIR

DRAFT
for Homeland Security

ging threat—terrorism in the

e framework for organizing

 organizations whose

onal security. Cyberspace is

onal security; its security and

ructures, and national

o Secure Cyberspace is an

the National Strategy for

Strategy of the United

rspace describes initiatives to

erate, malicious disruption

 This Strategy, together with

 Protection Strategy, provides

rts to protect its infrastruc

ying online material from the

the steps the United States

y networks and systems that

nse, and critical services to

ormation technology equip

gether, make up our

This Strategy is a place where many parts of our nation will describe whatthey plan to do, and what their strategy is to secure their part of cyberspace. In this Strategy, readers will see plans from and for a diverse groupof Americans: teachers, military officers, privacy experts, doctors, stockbrokers, police, civil servants, computer scientists, State government officials, corporate CEOs, and Federal officials. It is also a place where Americans can get advice, whether they are ahome user of the Internet, a small business person, the Chief InformationOfficer of a “small cap” enterprise, a city mayor, a State Governor, aChief Executive Officer of a Fortune 100 company, or a member of theboard of directors of a company of any size. 

Strategy as ProcessThis Strategy is not written in stone. The President’s Critical InfrastructureProtection Board (PCIPB) plans to periodically issue, online, new releasesof the Strategy as it evolves. The introduction to each release will highlight updates from the previous version. Component strategies were developed by stakeholders and customers ofcyberspace. Representatives of companies that own and operate criticalinfrastructures came together to draft how banking and finance, electricpower, railroads, and other sectors could secure their parts of cyberspace.Community colleges and major universities teamed to plan for securingcyberspace at academic institutions. Big city police and small town sheriffscollaborated on the cyberspace security needs of law enforcement.Congressional committees in both houses held hearings on cybersecurityand related topics. Dozens of national associations met and devoted thousands of hours in developing contributions to this Strategy. These groups have developed strategies for how they will help secure theportions of cyberspace that they own or operate, because each user ofcyberspace must play a role in securing it. That fact does not absolve theFederal government of its responsibilities, which are many and outlined inthe Strategy. It does, however, underline the reality that the Federal government alone cannot secure cyberspace. We must all do our part.We will be as successful as the sum of those efforts. 

N

NATIONAL STRATEGY TO SECURE CYBERSPACE

 Evolve

or securing parts of 

tailed and refined with

urity challenges and 

abilities and threats;

discussion in earlier 

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

INTRODUCTION

DRAFT 1
010100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

 the President’s Board solicited the

on what are the key issues and ques

he Strategy. The accumulated

 pages sponsored by a government

e organization. Many citizens offered

e Strategy proposes answers for most

n “Agenda Boxes” for continued

logue, the President’s Critical

ed public town meetings in the spring

of the Strategy. These meetings were

ment’s Critical Infrastructure Assurance

with State and local government 

ncluded national-level conferences

3, 2002, and Princeton, New Jersey, 

e initial release, additional town meet

as part of the effort to maintain

space.

ntry are possible and initial planning is

sted on the web site, www.secure

nfirmed.

y to Secure Cyberspace

trategies

erspace supplements the National

 the National Security Strategy of the

ples” section, together with President

des the Administration’s policy guid

Some sections of this Strategy are more detailed than others. However, asthe Strategy evolves in subsequent editions, it will attempt to address allof the major problems of cybersecurity in appropriate detail. The Strategyis a roadmap for the Administration, the Congress, State and localgovernments, sectors of the economy, higher education, and theAmerican Internet consumer. The recommendations are directed at many audiences, including theAdministration itself. The Strategy does not substitute for the normaldecision-making process about budgets and policies. While there aremany recommendations in the Strategy that do not require additionalresources, those that do will be considered in the normal processes. Manyof the recommendations will become the work of the President’s CriticalInfrastructure Protection Board and its interagency committees.Subsequent editions of the Strategy will reflect the decisions made in theFY04 budget process and the work of the Board and its committees, aswell as progress by individual departments and agencies.

Strategy for Cyberspace, in CyberspaceThe printed version of this release references places in cyberspace wherestrategies developed by various groups, as well as other useful material,may be found. Because of size limitations, the hard copy does not containthe text of all references. However, the online version contains hyperlinksto referenced materials. In this paper document, you will find these corecomponents of the Strategy:

• the Case for Action: Cyberspace Threats and Vulnerabilities; • the Policies and Principles Guiding the Strategy; • Highlights of the Strategy; and, • the Five Levels of the National Strategy (the home user, the large

enterprise, critical sectors, the nation, and the global community). 

Throughout the five levels in the online version, agenda boxes will highlight:In the paper document, “Recommendations and Programs andDiscussions” will be summarized at the end of each level. Over time,“Discussions” should either result in “Recommendations” or end with noaction. Similarly, “Recommendations” should evolve. In some instancesthey might become initiatives undertaken by individuals or private organizations. In other cases, they may become efforts or programs sustained bygovernment. Because of the changing nature of cyberspace some of therecommendations might be discarded if, on closer examination, they aredetermined not to be feasible or cost effective as programs. Subsequentreleases of the Strategy will update these outcomes.The Strategy is hyperlinked to documents and web pages owned andoperated by nongovernment organizations, trade associations, academicinstitutions, State and local governments, and corporations. Their contentis determined by them alone and their inclusion does not constitute automatic acceptance of their views by the Federal government. They areincluded because the National Strategy is not intended to be a Federal

government prescription, but rather a participatory process. Please join this process to help secure cyberspace, so that the UnitedStates can continue to reap the benefits of the Information TechnologyRevolution in education, health sciences, the economy, E-Government,and national defense. Only by securing cyberspace can the next level ofbenefit it offers be tapped to its full potential.

The President’s Critical 

Infrastructure Protection Board

After a review initiated at the outset of the Administration, PresidentBush signed Executive Order 13231 (Critical Infrastructure Protection inthe Information Age) in October, 2001 creating the President’s CriticalInfrastructure Protection Board. The Board is the central focus in theExecutive Branch for cyberspace security. It is composed of senior officials from more than 20 departments and agencies. The Presidentcreated a series of interagency committees that report to the Board on issues such as Education, Research, Incident Response, andInterdependencies.

Meetings Held:

• Chicago, Illinois • Atlanta, Georgia 

Meetings Planned For:

• Philadelphia, Pennsylvania• Pittsburgh, Pennsylvania• Phoenix, Arizona

LEVELS

R1 RECOMMENDATIONS Specific actions that government and

nongovernment entities can take to

promote cybersecurity.

P1 PROGRAMS Existing efforts in cybersecurity.D1 DISCUSSIONS Issues highlighted for continued 

analysis, debate, and discussion.

Table: i-1: Sample Agenda box

TO SECURE CYBERSPACE DRAFT
er 11, a less physically

was striking leading finan

World Trade Center site. Its

 caused, which was consid

we could face in the future.

ed backwards), and for a

ter networks, it was a

nd of a computer worm and

on with enormous speed

uter systems it invaded,

 nonexistent to nationwide

00 computers. NIMDA

ndustries, forcing firms

equiring some firms to

st of the NIMDA attack is

od to track such damage.

verall financial impact of

uld have been $13 billion in

Two months before NIMDA, a cyber attack called CodeRed had infected 150,000 computer systems in 14 hours,causing billions of dollars in losses. Such attacks demonstrate the growing sophistication and destructiveness ofcyber attacks. The volume of attacks is also up: CarnegieMellon University’s Computer Emergency ResponseTeam’s [CERT] Coordination Center reported 3,700attacks in 1998, and at current rates will report over110,000 in 2002. Other teams report similar, dramaticgrowth in cyber attacks. That trend is likely to continue.A Nation Now Fully Dependent on CyberspaceFor the United States, the Information TechnologyRevolution quietly changed the way business and government operate. Without a great deal of thought aboutsecurity, the nation shifted the control of essentialprocesses in manufacturing, utilities, banking, andcommunications to networked computers. As a result,the cost of doing business dropped and productivityskyrocketed. The trend towards greater use of networkedsystems continues. By 2002, our economy and national security are fullydependent upon information technology and the information infrastructure. A network of networks directlysupports the operation of all sectors of our economy—energy (electric power, oil and gas), transportation (rail,air, merchant marine), finance and banking, informationand telecommunications, public health, emergency services, water, chemical, defense industrial base, food, agriculture, and postal and shipping.The reach of these computer networks exceeds the bounds of cyberspace.They also control physical objects such as electrical transformers, trains,pipeline pumps, chemical vats, radars, and stock markets. At the core of the information infrastructure upon which we depend isthe Internet, a system originally designed to share unclassified researchamong scientists who were assumed to be uninterested in abusing thenetwork. It is that same Internet that today connects into millions of othercomputer networks, which, make most of the nation’s essential services

work. While the Internet has grown enormously and globally, it has alsogrown increasingly insecure. People in almost every country on the globecan access a network that, in turn, is ultimately connected to networksthat run critical functions in the United States. Cyber attacks on U.S. information networks occur regularly and can haveserious consequences such as disrupting critical operations, causing loss ofrevenue and intellectual property, or loss of life. Countering such attacksrequires the development of robust capabilities where they do not existtoday, if we are to reduce vulnerabilities and identify and deter those withthe capabilities and intent to harm national infrastructures.

THREATS AND 

TIES: A CASE FOR ACTION

NATIONAL STRATEGY TO SECURE CYBERSPACE

y Themes

ophistication, severity, 

dent on cyberspace; 

ncies and single points 

ery day. Infrastructure 

ying their cyber and 

e will reduce risk.

ber damage are accurate

appen.

ds on a public-private

yberspace.

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

0

20,000,00040,000,00060,000,00080,000,000

100,000,000120,000,000

140,000,000

160,000,000

180,000,000

Jan 91

Jan 94

July 96

Jan 98

Jan 99

Jan 00

July 00

Jan 01

July 01

Jan 02

July 02

Internet Domain Survey Host Count

Figure ii-1

CYBERSPACE THREATS AND VULNERABILITIES

DRAFT 3
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

 against the information infrastruc

” who download malicious software

uivalent of annoying graffiti attacks

y want to demonstrate their destruc

exploit their access to computer

 organizations that engage in fraud,

nd to terrorists and potential enemy

developing plans that would enable

 our economy and weaken or control

nited States needs to fight back. 

ttack provides an opportunity to not

stice (whether, for example, through

itary means in the case of acts of

n their skill sets and better focus

Reduce Vulnerabilities, in the Absence of Known ThreatsWhile the nation must deal with specific threats, waiting to fix any important vulnerability in the critical infrastructure until learning of animpending attack by an identified attacker is an unacceptably riskystrategy for potential victims. Both the Code Red and NIMDA cyberattacks of 2001 burst onto the nation’s networks with little or no warningand spread so fast that many victims did not have a chance to hear thealarms. Even if they had, many victims did not have time, knowledge, ortools to protect themselves. Creating defenses against these attackswould have taken days in some cases. A key lesson from these cyber attacks and others like them is that thosewho rely on networked computer systems need to identify and remedytheir vulnerabilities now, rather than wait for an attacker to be stopped oruntil alerted of an impending attack. No one has yet been arrested forlaunching the Code Red or NIMDA attacks. However, it is important tonote that computer attacks are serious felonies and perpetrators are beingcaught with increasing regularity.Identifying vulnerabilities by having a group of trained professionalscomplete an information technology security audit can take 2-3 months.Remedying the most serious vulnerabilities by creating a multi-layereddefense and a resilient network may take several additional months. Thenthe process must be regularly repeated. New Vulnerabilities Requiring Continuous Response The process of securing networks and systems must be continuousbecause new vulnerabilities are created or discovered regularly. CERT/CCnotes that not only are cyber incidents and the number of attacksincreasing at an alarming rate, so too are the number of vulnerabilitiesthat an attacker can utilize. Identified computer security vulnerabilities—problems with software and hardware that permit unauthorized entry ordamage to a network—more than doubled in the last year, with 1,090separate vulnerabilities reported in 2000, and 2,437 reported in 2001. Installing a network security device is not a substitute for a constant focuson keeping defenses up to date. In a recent survey by the ComputerSecurity Institute, 90 percent of respondents used anti-virus software, but85 percent had been damaged by a virus. In the same survey, 89 percenthad installed computer firewalls and 60 percent had intrusion detectionsystems, yet 90 percent reported security breaches had taken place and40 percent had their systems penetrated from outside their network. Themajority of security vulnerabilities can be mitigated with good securitypractices. As these survey numbers indicate, good security practicesinclude not just installing those devices, but operating them correctly andkeeping them current, including regular patching and virus updates.

Cybersecurity and Opportunity CostFor individual companies and for the national economy as a whole,improving computer security often requires investing attention, time, andmoney. President Bush requested that Congress increase funds to secureFederal computers by 64 percent in FY03. President Bush’s investment in securing Federal computer networks willeventually reduce expenditures through cost saving E-Government solutions, modern enterprise management, and by reducing opportunities forwaste and fraud. For the national economy and, in particular, for the information technology industry, the dearth of trusted, reliable, secure informationsystems is a barrier to future growth. Much of the promise and potentialof continued growth in the economy, as a result of the InformationTechnology Revolution, has yet to be realized. That unrealized opportunity,including e-commerce and business-to-business (B2B) activity, is in partdeterred by computer security risks. Vulnerability in cyberspace places

wing Scenario...

 one morning that they will

ectrical grid for six hours

. The same group then

e primary telecommunica

 East and West Coasts for a

our efforts to defend

to bring down the air traffic

k City, grounding all traffic

 then do so. Other threats

ed, demonstrating the

 critical infrastructure.

ommerce and credit card

 hundred thousand stolen

transactions, if their list of

ensuing public panic and

resting and alarming is that

] events have already

nor all by malicious intent.

pread out over time; some

ome during simple exer

yber attacks. All of them,

h remote cyber attack...

sident from 50 scientists,

igence officials.

Image courtesy UCSD/CAIDA (www.caida.org) © 2002 The Regents ofthe University of California. Figure ii-2

A Mapping of Code Red Penetration 

on a Portion of the Internet

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

e intellectual property, busi

nsumer trust. 

stly overhead. There is a

peatedly shown that:

mputer attack are likely to

ment in a cybersecurity

ormation systems architec

all operational costs by

s remote access and

 that could not occur in

ess of the issues, compa

f cybersecurity. Greater

mponents of this Strategy.

k Management 

from overseas terrorist 

mited. In one day that

cost to our economy from

cent over four years. While

could change abruptly. 

r a home computer user,

that, on an individual level,

 ingredients exist for that

vel, to the networks and

vailable; and, 

ems are many 

etely eliminate risk, but the

sibly and to minimize the

ting vulnerabilities. By

elling potential foes some

w. In 1997, a Presidential

ublic report. In 2000, the

published. In 2001,

ecutive order making cyber

to secure Federal networks.

nd strengthen Federal

Government Alone Cannot Secure CyberspaceYet despite this awareness and these measures, the risk continuesto our national information networks and the critical systems they manage. Reducing that risk requires an active, unprecedented, partnership among diverse components of our country and our global partners.The Federal government should not and, indeed, could not, secure thecomputer networks of privately owned banks, energy companies, transportation firms, or other parts of the private sector. The Federal government should not intrude into homes and small businesses, into universities, or local agencies and departments to create secure computer networks. Each American who depends on cyberspace, the network of informationnetworks, must secure that part that they own or for which they areresponsible.The Federal government can help to empower Americans to do just that, by:

• raising awareness; • sharing information about vulnerabilities and solutions; • fostering partnerships with and among private sector groups,

and others; 

• stimulating improvements in technology; • increasing the number of skilled personnel; • investigating and prosecuting cybercrime; • protecting Federal computers; and, • promoting increased security for the networks upon which the

economy and national security depend.

Ultimately, cyberspace security is not about “good ones and zeroesattacking bad ones and zeroes in the ether.” It is about whether whenone throws the switch the electricity comes on, or whether the moneyAmericans have invested and deposited is there, and whether this countryis secure. U.S. physical infrastructure has been protected since it emergedin the 19th century. For example, railroad police were created to mitigatethreats to the vast transportation networks.Those problems of physicalsecurity remain, but are now matched by the problems of cybersecurity.The two problem sets are related. A cybersecurity problem can renderphysical structures insecure and vice versa. Government and industry mustanalyze those interactions and interdependencies, but must also place aspecial focus on the unique and new vulnerabilities posed by reliance oncyberspace.

0

200400600800

100012001400160018002000220024002600

1995 1996 1997 1998 1999 2000 2001

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

5

Figure ii-3: Source CERT CC ©

0

10,00020,00030,00040,00050,00060,000

1988

1989

1990

1991

1992

1993

1994

1995

1996

1997

1998

1999

2000

2001

Figure ii-4 

Incidents Handled: 1988 - 2001

Vulnerabilities Reported: 1995-2001

DRAFT

Source: Internet Software Consortium (www.isc.org)
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
DRAFT

pplements the National

nal Security Strategy of the

ion, together with President

ministration’s policy guid

ents and recommendations

13231 and other relevant

nd nothing herein alters the

ernment officials under the

. 

gy to Secure Cyberspace.

power, and establish efforts

ng America to secure

that requires coordinated

 government, State and

American people. The

tional policy objectives and

y

anged the way business is

l defense is conducted.

dependent network of 

e. 

ms for critical infrastruc

unications, and the physical

o minimize disruption and

e ability to protect our

ents and intentional acts

f: 

ey homeland security and

ure the general public

ain order and to deliver

• the private sector to ensure the orderly functioning of the economy and the delivery of

essential infrastructure services.

This policy acknowledges that no security measures will be100 percent reliable. Nonetheless, it strives to ensure thatany interruptions or manipulations of these critical functions will be infrequent, brief, manageable, geographicallyisolated, and minimally detrimental to the welfare of theUnited States.Many of the nation’s critical infrastructures have historicallybeen physically and logically separate systems with littleinterdependence. Advances in information technology andthe necessity of improved efficiency, however, have precipitated a steadily and rapidly increasing amount ofautomation in, and interconnection among, these systems.The USA PATRIOT Act defines critical infrastructure asthose “systems and assets, whether physical or virtual, sovital to the United States that the incapacity or destructionof such systems and assets would have a debilitatingimpact on security, national economic security, nationalpublic health or safety, or any combination of those matters.” America’scritical infrastructures include energy (electric power, oil and gas), transportation (rail, air, merchant marine), finance and banking, informationand telecommunications, public health, emergency services, water, chemical, government, defense industrial base, food, agriculture, and postaland shipping. This Strategy also recognizes that maintaining the integrity of the nationaleconomic and social fabric over the long term requires attention, not onlyto the security of information systems, but also to the related societalstructures on which those systems depend. Accordingly, the Strategyincorporates affirmative measures designed to enhance and augmentthese supporting structures.Though the United States possesses both the world’s strongest militaryand largest national economy, these two aspects of the nation’s powerincreasingly rely upon certain critical infrastructures, which includecyber-based information systems. As witnessed on September 11,

enemies of the United States—nations, groups, and, indeed, even individuals—are prepared to strike in unconventional ways. These adversaries have explicitly stated the intention, not only to strike at U.S. citizens, but to attack the nation’s infrastructures and cyberspace—the pillars of the economy.

Guiding Policy PrinciplesIn January 2001, the Administration began a review of the role of information systems and cybersecurity. In October 2001, President Bush issuedExecutive Order 13231, which authorized a protection program consistingof continuous efforts to secure information systems for critical infrastructure, including emergency preparedness communications, and the physicalassets that support such systems. The protection of these cyber systems isessential to every sector of the economy. The development and implementation of this program directive has been guided by the followingorganizing principles:

LICIES 

 PRINCIPLES

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL POLICIES AND GUIDING PRINCIPLES 7
ps

es is necessarily a shared responsi

of the nation’s critical infrastructure

the private sector, and many critical

hese private facilities. 

 nation’s critical infrastructure would

onomy and those in the government,

ll require flexible, evolutionary

c and private sectors, and protect

rity interests. The private sector has

 coordinated effort with the Federal 

One important step taken by many

 information sharing and analysis

cation and the dissemination of 

on, various sectors have developed

ace, which complement this National

and intention that this productive

tinue.

ms for prevention and crisis manage

remediation of vulnerabilities,

t, alert and warning methodologies,

 support these efforts. To that end,

should be encouraged to provide

rastructures they control, and to

ormation necessary to assist them in

vernment, in working to safeguard its

ve to serve as a model to the private

ce is best achieved and shall, to the

procity to distribute the results of its

 fully, the Federal government recog

d operators in the private-public

ary. To encourage maximum partici

rtnership, the U.S. Government, to

oid outcomes that increase govern

d government mandates to the

government has relied on the incen

es as the first choice for addressing

nfrastructure protection, and would

nly in the face of a material failure

 protect the health, safety, or well

he American people.

Safeguard Civil Liberties and PrivacyThe interests of security and personal privacy need not be antithetical toone another. Indeed, to a large degree, by securing the integrity ofcommunications over the Internet, the measures advocated in thisStrategy seek to protect individual privacy and, thus, complement thoseinterests. Nevertheless, in crafting measures to increase the nation’s security, one must exercise caution to avoid undermining those fundamentalvalues and characteristics of free society that the nation is seeking toprotect in the first place. Accordingly, care must be taken to respectprivacy interests and other civil liberties. Consumers and operators musthave confidence that information will be handled accurately, confidentially, and reliably.Coordinate with CongressTo ensure that the approaches adopted to secure America’s cyberspacesystems enjoy broad support and consensus, the Executive branch willwork with Congress on approaches and programs to meet the goals ofour national policy. As appropriate, the Executive branch may askCongress to enact legislation to advance this Strategy. 

Cooperate with State and Local GovernmentsAmerican democracy is rooted in the precepts of federalism—a system ofgovernment in which State governments share power with Federal institutions. This structure of overlapping Federal, State, and local governance has more than 87,000 different jurisdictions and provides uniqueopportunity and challenges for cyberspace security efforts. State and localgovernments, like the Federal government, operate large, interconnectedinformation systems upon which critical government services depend.The opportunity comes from the expertise and commitment of local agencies and organizations involved in cybersecurity. The challenge is todevelop interconnected and complementary systems that are reinforcingrather than duplicative and that ensure essential requirements are met.Accordingly, all critical infrastructure and cyberspace protection plans andactions shall take into consideration the needs, activities, and responsibilities of State and local governments and first responders.

10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

CRITICAL INFRASTRUCTURE LEAD AGENCIES

LEAD AGENCY SECTORSDepartment of • Information and Telecommunications

Homeland Security • Transportation (aviation, rail, mass transit, waterborne commerce, pipelines, and highways 

(including trucking and intelligent transportation systems))

• Postal and Shipping• Emergency Services

• Continuity of Government

Treasury • Banking and Finance

Health and Human Services • Public Health (including prevention, surveillance, laboratory services, and personal health services)

• Food (all except for meat and poultry)

Energy • Energy (electric power, oil and gas production, and storage)

Environmental • Water

Protection Agency • Chemical Industry and Hazardous Materials 

Agriculture • Agriculture 

• Food (meat, and poultry)

Defense • Defense Industrial Base

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

9

g Agencies

mmunication between the

on which effective partner

 a “Lead Agency” for each

e to infrastructure attack.

 counterparts, are listed in

e Office of Science and

and development to

Office of Management and

ent and oversight of the

rinciples, standards, and

ecurity programs. The State

ernational outreach on

ce is responsible for

es networks and informa

he Federal Bureau of

nvestigating and 

nd the lead agencies assess

hysical attacks and recom

nt vulnerabilities. Because

e nation’s critical infrastruc

nd lead agencies should

nd threat environments of

tive measures and responses

with the partner relationship,

the government, including

ce and defense prepared

re that critical

ained.

the sum of the efforts of

nd the country. The end

sted, robust, reliable, and

conomy, national security,

ts diverse infrastructures,

cur over multiple paths

this network does not mean

ath is ever lost. Instead, it

 the face of disruption or

and that network elements

able. The security of indi

ontinued evolution with

Thus, to create a secure and resilient cyberspace,the nation must acknowledge and act accordinglyon to two strategic security principles: (1) that thesecurity of the entire infrastructure will depend onthe security of each component, and (2) thatthreats and vulnerabilities will evolve, and thatsecurity must evolve at an equal or higher rate. Secure the parts of cyberspace to achievesecurity of the wholeThe security of cyberspace rests on the security ofall of its components. In cyberspace, attackers canbe anywhere at the speed of light. No geographicsafety exists. Networks may prove vulnerable toattacks both from outside and inside the network.Components within an otherwise secure networkmay still be compromised by insiders, downloadedsoftware, or its compromised neighbors. Placing awall around the perimeter of a network is notadequate to achieve security. Once one computer or element in the network iscompromised, it can be used to compromiseothers. Similarly, unsecured sectors of the economyor government can and are being used as platforms to attack othersectors. Disruptions in one sector also have cascading effects that candisrupt multiple other parts of the infrastructure. To combat these vulnerabilities, the security of the infrastructure must not be dependent on asingle layer, group or focal point, but rather must be found in multiplelayers, distributed defenses, and the ability to recover quickly from anyattack.To improve cybersecurity, the nation must secure cyberspace at each levelof activity. Accordingly, each individual and sector must be aware of itsroles and responsibilities in securing its part in cyberspace. Each sectorand each individual depends on the others to make cyberspace secure.Therefore, the nation must secure cyberspace through awareness andinformation; identified roles and partnerships at all levels, and throughFederal leadership in securing Federal cyber systems. Such leadership alsoincludes preventing and deterring cybercrime, electronic espionage, andinformation warfare.

Rapidly evolve security measures to stay ahead of changing technology and vulnerabilitiesNew vulnerabilities in systems accrue at an alarming rate. Vulnerabilities arecreated as new software is developed and new technologies emerge. Theyare identified over time and through use. At the same time, new and evermore advanced tools are developed to exploit them. Security policies, practices, and technology must adapt. The nation must develop a securityinfrastructure that can evolve one step ahead of would be attackers.Only now are experts beginning to imagine what impact nanotechnologyand quantum computing will have on the current cyberspace. These innovations and others will introduce unforeseen changes in the way networksoperate and the way they can be made secure. The nation must invest ineducation and training, technology, and coordination of activity if it is tounderstand these changes and remain the world leader in the development and application of new technologies for cyberspace security.

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
work for the rest of the

important recommenda

all owners of the nation’s

e Federal government. Each

 to secure its own portion

power each person and

oadmap for how to achieve

ower all Americans to do so.

f each major component of

ans for securing their

lans are already developed

ll be added over time.

p between private sectors,

te, maintain, and update

o empower all

cyberspace. This strategic

ools for empowering people

ducate and create aware

erspace of the risks and

e means to mitigate 

new and more secure tech

ies more quickly, and

ore secure way.

p a large and well-qualified

needs of industry and

vance the nation’s security

4. Roles and Partnerships: Foster responsibility

of individuals, enterprises, and sectors for securityat all levels through the use of market forces,education and volunteer efforts, public-privatepartnerships, and, in the last resort, through regulation or legislation.

5. Federal Leadership: Improve Federal cybersecurity to make it a model for other sectors by

increasing accountability; implementing best practices; expanding the use of automated tools tocontinuously test, monitor, and update securitypractices; procuring secure and certified productsand services; implementing leading-edge trainingand workforce development; and deterring andpreventing cyber attacks.

6. Coordination and Crisis Management:

Develop early warning and efficient sharing ofinformation both within and between public andprivate sectors so that attacks are detected quicklyand responded to efficiently.

In each section of this Strategy, the reader will find some orall of these themes reflected in two ways. First, the introduction to each section lays out the strategic goals for thataudience or level of the Strategy. Second, each section highlights ongoingprograms, recommendations, and topics for discussion that will serve todevelop the strategic goals.In this section, these strategies and supporting actions are summarized. Inthis National Strategy, the reader will find new recommendations foractions, and numerous questions and topics for debate. It will be the goalof the Federal government to help facilitate the evolution of these discussions so that they become recommendations. Recommendations willevolve, in turn, and some will become initiatives of individuals, organizations, or government.

Summary of Recommendations by SectionThe National Strategy calls for actions at all levels and across all sectors.Some of the major strategic innovations called for in this document arehighlighted below. A detailed discussion of each of these innovations isincluded in the pages that follow.Awareness and InformationThe Strategy identifies the need for increased awareness about the vulnerability of America’s cyber infrastructure and provides information thateach person, company, organization, and agency can use to help makecyberspace more secure. It recommends:

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

11

HIGHLIGHTS

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

esses should recognize that they

ay in securing cyberspace, including

r systems, accessing the Internet in a

 on best practices that can be found

uding: www.StaySafeOnline.info,

w.crsc.nist.gov.

tructure Protection Board’s

d foster a public-private partnership

cybersecurity awareness materials,

c tools and resources for annual

 and private entities should identify

ng cyber awareness, literacy, training,

hical conduct in cyberspace, tailored

education.

ncreased cybersecurity-related

should, as a high priority, develop

nology to increase security of digital

pervisory control and data acquisition

 manufacturing, and other networks.

operators of pipelines and power

A systems should closely examine

ions and take appropriate actions,

e authentication within 24 months.

reliance on DCS/SCADA should

e Department of Energy’s recent

on on securing SCADA systems.

tructure Protection Board should

 of the Office of Science and

ram of Federal government research

near-term (1-3 years), mid-term (3-5

rs out and longer) IT security

ear-term IT security research and

beyond should include priority

 and the R&D Committee. Existing

hers, intrusion detection, internet

uding protocols e.g. BGP, DNS), appli

 of service, communications security

A system encryption and authentica

assurance systems and secure system

position.

• Public-private partnerships should identify cross-sectoral cyber

and physical interdependencies. They should develop plans toreduce related vulnerabilities, in conjunction with programsproposed in National Strategy for Homeland Security. It is within

the scope of the National Infrastructure Simulation and AnalysisCenter to assist with these efforts.

Training and EducationThe Strategy addresses the existing gap between the need for qualified ITprofessionals and America’s ability to train and develop these workers.Specific recommendations include:

• States should consider creating Cyber Corps scholarship-forservice programs at State universities, to fund the education of

undergraduate and graduate students specializing in IT securitywho are willing to repay their grants by working for the states.The existing Federal Cyber Corps scholarship-for-service programshould be assessed for possible expansion to additional universities, with both faculty development and scholarship funding. Theprogram could also add a faculty and program developmenteffort with community colleges.

• The CIO council and relevant Federal agencies should consider

establishing a “Cyberspace Academy,” linking Federal cybersecurity and computer forensics training programs.

• IT security professionals, associations, and other appropriate

organizations should explore approaches to and the feasibility ofa nationally recognized certification program, including a continuing education and retesting program. The Federal governmentcould assist in the establishment of such a program, and, if it iscreated, consider requiring that Federal IT security personnel beappropriately certified.

Roles and PartnershipsThe Strategy recognizes that all Americans have a role to play in cybersecurity, and identifies the market mechanisms for stimulating sustained actions to secure cyberspace. It recommends:

• CEOs should consider forming enterprisewide corporate security

councils to integrate cybersecurity, privacy, physical security, andoperational considerations.

• State and local governments should consider establishing IT security programs for their departments and agencies, including

awareness, audits, and standards. State, county, and municipalassociations could provide assistance, materials, and modelprograms.

• Internet service providers, beginning with major ISPs, should

consider adopting a “code of good conduct” governing theircybersecurity practices, including their security-related cooperation with one another.

• The Federal government should identify and remove barriers to

public-private information sharing and promote the timely twoway exchange of data to promote increased cyberspace security.

• Colleges and universities should consider establishing together:

(a) one or more information sharing and analysis centers (ISACs)to deal with cyber attacks and vulnerabilities; (b) model guidelines empowering Chief Information Officers (CIOs) to addresscybersecurity; (c) one or more sets of best practices for IT security; and (d) model user awareness programs and materials.

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

make Federal cyberspace

s:

 of more secure IT products,

 will complete a compre

 of the National Information

ne the extent to which NIAP

dentified security gap;

the gap, whether it is

 to which program improve

ppropriate and cost effective. 

to expand the use of auto

ment and security policy

y threat management tools

Federal government will

e necessary (e.g., through

mote the greater use of

cost effectiveness of a

ncy preparedness exercise

ess process. Should such

eaknesses shall be included

rmation Security Reform Act

ust be especially mindful of

hnologies. Federal agencies

t continuously check for

their networks. Agencies

T report on the use of wire

nt NIST recommendations

olicy and procedures should

onal risk reduction measures

n, bi-directional authentica

chnical security

ment, intrusion detection,

rity education and aware

security audits, agencies

vacy regulation compliance.

Coordination and Crisis ManagementThe Strategy identifies a pressing need for a comprehensive nationalanalysis and warning capability. It recommends:

• ISPs, hardware and software vendors, IT security-related companies, computer emergency response teams, and the ISACs,

together, should consider establishing a Cyberspace NetworkOperations Center (Cyberspace NOC), physical or virtual, to shareinformation and ensure coordination to support the health andreliability of Internet operations in the United States. Although itwould not be a government entity and would be managed bythe private sector, the Federal government should explore waysin which it could cooperate with the Cyberspace NOC.

• Industry should, in voluntary partnership with the Federal

government, complete and regularly update cybersecurity crisiscontingency plans, including a recovery plan for Internet functions.

• The law enforcement and national security community should

develop a system to detect a national cyber attack (cyber war)and a plan for immediate response. As part of this process, theappropriate entities should establish requirements and options.

• Owners and operators of information system networks and

network data centers should consider developing remediationand contingency plans to reduce the consequences of large-scalephysical damage to facilities supporting such networks. Whererequested, the Federal government could help coordinate suchefforts and provide technical assistance.

• The United States should work with individual nations and with

nongovernmental organizations (e.g., Forum of IncidentResponse and Security Teams (FIRST)), and international organizations (e.g., International Telecommunications Union (ITU)), topromote the establishment of national and international watchand warning networks that will be designed to detect andprevent cyber attacks as they emerge. In addition, such networkscould help support efforts to investigate and respond to attacks.

Six tools for empowerment discussedfor each level of audienceThe Strategy provides a roadmap to help Americansunderstand their part in securing cyberspace. To makethis roadmap easier to use, it is divided into audiencelevels: Level 1 for home users and small businesses, Level 2 for large enterprises, Level 3 for sectors including

government, private industry, and higher education, Level 4 for

national issues and efforts, and Level 5 for discussion of global

issues. Each of these levels and their sub-levels will have its ownstrategic goal. These goals will be supported by strategic actions thatthe nation will take to achieve the goals.The six tools for empowerment (see page 11) will help drive corresponding strategic actions at each level. Some or all of the six tools may beemployed at each level. For example, “Awareness and Information” willhelp empower the home user as well as private sector employees andFederal workers to secure their portion of cyberspace. Roles and partnerships will be identified and described at all levels. Not every tool will beappropriate for every level, but, taken together, these tools will underpinall of the nation’s efforts to secure cyberspace.

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

DRAFT 13
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
er and small

d prevent it

n be achieved

 home user and

 students;

mall businesses

re, software

gh activity by

e installation

 Internet

DSL, satellite

r to the users

ational courses.

seek to damage

tacks at major

ns. They think

he concern of

wner.

n the home

ely and, in

thers. See table

d does, happen.

nt in which

ategy are

ailable to auto

ser becomes

ect” uses

“dummy” systems attached to the Internet to measure actualcomputer attacks. According to the project’s most recentresults, a random computer on the Internet is scanned,meaning it is checked for its presence, setup or weaknesses,dozens of times a day. A common home user setup theproject created was hacked five times in four days. Homeusers or businesses with larger systems are also a target.Systems are subjected to certain scans across the Internet anaverage of 17 times a day. In some cases, insecure servershave been hacked 15 minutes after plugging into theInternet.Secure Internet UseUsing the Internet in a secure manner does not just happen.Rather it is the purposeful result of both awareness and theavailability of services and tools which facilitate secureInternet use. It is often difficult for home users and small businesses to access secure Internet services. For example, manyhome users and small businesses do not use firewalls toprotect their computers from unauthorized intrusions. “Always-on-connections” to the Internet, such as broadband,digital service line (DSL), wireless and satellite services, areincreasing in popularity. Such connections offer tremendousspeed and efficiency. However, they also present unique challenges, because many users are not aware of the securityimplications of an “always-on-connection.” For example,these connections generally mean that larger amounts of data can be sent at any time and the data can be sent continuously. These two factors can be exploited and used to attack other systems, possibly even resulting in nationally significant damage.Facilitating and promoting more secure use of the Internet byhome users and small business can be greatly advanced bythe entire product chain that prepares the consumer for theInternet. The Internet service providers, hardware manufacturers, software vendors, retailers, and providers of securityservices can all facilitate this effort by making products andservices available and easy to use.

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

15

LEVEL 1: THE HOME USER AND SMALL BUSINESS 

ER AND SMALL BUSINESS CYBER ATTACKS ON THE HOME USER AND SMALL BUSINESS What can happen What it means Hard Drive Crashing A common problem caused by computer viruses on home and small business computers has been exten- sive damage to files, software, and operating systems that can leave the user with a blank screen and costly repair bills. Often, more importantly, the small busi- ness owner or home user may lose irreplaceable data, such as customer records or personal correspondence. Identity Theft Information stored on a home computer may provide a hacker with enough personal data that the thief could apply for a credit card or identification in the user’s name. Credit Theft Rather than applying for a new credit card, a thief might just use credit card data on the hard drive of a home user or small business to buy products online and have them shipped to a drop site, such as a commercial “mail box” store. Tunneling When employees work at home and then transfer files to a computer at the office, there is a potential that someone could remotely gain access to the home PC and place a secret file in a document that ends up on the company system. Extortion For the small businesses, someone may access the customers names and credit card numbers and threaten to post that information on a Web site, unless the busi- ness owner pays up. Zombies Automatic programs search for systems that are connected to the Internet, but are unprotected, take them over without the owner’s knowledge, and use them for malicious purposes. Compromise of Private Information Some viruses send private or confidential files from a user’s hard drive to people in the user’s email address book. Table 1-1 DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

y

 parent, or small business person can

blems on the Internet. Before

elow, consider these five simple steps:

rs use software that is commonly

sswords and gain access to personal

ant to use a strong password and

passwords usually include: 

se letters; 

 numbers (not just numbers 

 

word at least once every six months,

daylight saving time and back to

Protection Program: New viruses

 the most frequent source of

ms that come installed on the

computer are quickly outof date, but they can bekept current by enrollingwith the antivirus companyfor an update program.Many update programsnow offer automatic notification of new data, so thatthe user does not need toremember to go to theantivirus site every week.3. Update Patches:Many commonly used software programs (operatingsystems, web browsers, e-mail readers, and others)are regularly discovered tohave security holes orflaws. The softwarecompanies issue the equivalent of “recall notices,”but unlike a similar notice

from a car company, it may not appear in the mail. Typically, a user has to goto the software company’s web page to discover the problem and the solution. The solution is usually a small amount of additional software that canbe downloaded over the Internet. These fixes, called “patches,” are recommended for most home users and small businesses running uncomplicatedsystems. (In larger systems, the patch must be analyzed first to see if it willcreate conflicts with other programs.)4. Filtering: Parents may want to consider managing their children‘sInternet use with software that allows them access to age-appropriatesites and materials. Many ISPs offer such software or filters, or they canbe obtained from private vendors. In addition to filtering inappropriatesites, a parent may wish to limit the people from whom their child canreceive e-mail. Most ISPs allow users to filter by listing the addresses fromwhich they are willing to receive e-mail on all e-mail accounts they maintain, or just on their children’s.5. If you Have a Cable Modem, Digital Subscriber Line (DSL),Satellite or Other High Speed Connection: A high-speed connectionthat is always connected to the Internet (or more often than with dial upmodems) makes the home user or small business an attractive target for the“bots” that search the Internet automatically for insecure connections. Evenwith updated virus software and current patches, smart “bots” can find away to get into a system without the user knowing it. To prevent such covertentries, those with broadband connections (e.g., DSL, cable, satellite or wireless) should have additional software, known as a “firewall.”Firewalls can be easily configured to close the many doors to the Internetthat all computers have, leaving open only the few that people typicallyuse (e.g., for e-mail and web browsing). A user can specify what Internetprograms are trusted to enter, and require all others to knock and begranted permission. Where to go for General Cybersecurity AdviceAn alliance of government agencies, corporations, and nongovernmentorganizations have joined to form the “National Cyber Security Alliance”to help home users, parents, and small businesses. Their web site is filledwith helpful information and links to other sites with additional data. Goto: www.StaySafeOnLine.info.For Small BusinessesSmall business persons may want to seek cybersecurity ideas from localprograms at nearby community colleges or chambers of commerce. Onthe national level, the Federal government’s Small Business Administration(www.sba.gov) and the not-for-profit National Federation of Small

Businesses (www.nfib.com) can also provide assistance.

In many larger cities, the National Infrastructure Protection Center partners with local businesses, the FBI, and academic experts in chapters of

“Infragard”, a grass roots public-private partnership for cybersecurity andagainst cybercrime, www.infragard.net.In some metropolitan areas, the U.S. Secret Service sponsors a publicprivate partnership for cybersecurity related to financial institutions, creditcards, and cell phone theft. These groups are called the “ElectronicCrimes Task Forces,” www.usss.gov/ectf.htm. In addition, the Computer Security Division of the National Institute ofStandards and Technology maintains a computer security resources webpage which provides helpful links to other centers of expertise whereusers can locate more alerts, software updates, and lists of the mostcommon security threats, www.csrc.nist.gov.

For Parents and TeachersIn addition to the web sites already noted above that provide filters andteaching ideas, there are additional resources online that can help plancurricula, provide children with good advice, and help parents to decidewhat is safe:The “CyberSmart School Program” is designed for teachers and provides lesson plans and professional development material. See www.cybersmart.org.“NetSmartz” is designed to teach children directly about what to watchout for when surfing the net. See www.netsmartz.org.

“Get NetWise” is a resource for families trying to decide what theyshould consider about their children’s web access. See www.getnetwise.org.The Information Technology Association Foundation sponsors“Cybercitizen Awareness,” which teaches teenagers about ethics onlineand the risks of cybercrime. Its site also provides material for teachers,parents, and smaller children. See www.cybercitizenship.org.

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

17

TIONS

vernment entities can take to

rity.*

grams scan the Internet for

ons to exploit, those home

ng to install a DSL or cable

g firewall software first. (Some

offer firewall software with DSL

ewall software is installed, it is

by going to the vendor’s web

e introduced every week, home

 regularly ensure that they are

 system.” (Some antivirus

 online. Some Internet service

l for viruses before the e-mail

s e-mail, home users should use

m unknown senders, particularly

e the number of unknown

er using software that controls

“spam.” (Some ISPs offer

s also offer to block all incoming

nd associates that the user

 update their personal

ch as Microsoft Windows,

ftware that browses the

harts, tables, etc.) for security

endors’ web sites. (Some soft

dates online.)

us software companies, and

tware developers should

easier for the home user and

software and updates automat

luding warning messages to

ew software patches.

PROGRAMS

Existing efforts in cybersecurity.

P1-1 Stay Safe Online web site: An alliance of government agencies,

corporations, and nongovernment organizations have cometogether to form the National Cyber Security Alliance to help homeusers, parents, and small businesses. Their web site is filled withhelpful information and links to other sites with additional data. Goto www.StaySafeOnline.info.

P1-2 FTC “Guide for E-Consumers,”

www.ftc.gov/bcp/conline/pubs/alerts/glblalrt.htm. 

P1-3 FTC “How to Be Web Ready,”

www.ftc.gov/bcp/conline/pubs/online/webready/index.htm.

P1-4 FTC “How to Protect Kids’ Privacy Online,” 

www.ftc.gov/bcp/conline/pubs/online/kidsprivacy.htm. 

P1-5 InfraGard: In many larger cities, the National Infrastructure

Protection Center partners with local businesses, the FBI, andacademic experts in chapters of InfraGard, a grass roots publicprivate partnership for cybersecurity and against cybercrimewww.Infragard.net.

P1-6 The Internet Fraud Complaint Center (IFCC) is a partnership between

the Federal Bureau of Investigation (FBI) and the National WhiteCollar Crime Center (NW3C) www1.ifccfbi.gov/index.asp. 

P1-7 American Library Association, “The Librarian’s Guide to Cyberspace

for Parents and Kids,” www.ala.org/parentspage/greatsites/guide.html. 

P1-8 The FTC, U.S. Secret Service, the FBI, and others have formed the

“Consumer Sentinel” to help consumers get the facts on frauds fromInternet cons, prize promotions, work-at-home schemes, and telemarketing scams to identity theft and make it easy to file fraudcomplaints so they can be shared with law enforcement officialsacross the nation www.consumer.gov/sentinel/.

P1-9 DOJs Computer Crime Web site: information regarding a wide

variety of computer crime and computer security issues, including achildren’s Cyberethics page and a link to invite DOJ experts to speakwww.cybercrime.gov.

DISCUSSIONS

Issues highlighted for continued analysis, 

debate, and discussion.

D1-1 The biggest business in America is small business. Working through the SBA, many small

businesses are able to obtain loans guaranteed by the Federal government. Increasingly,the cybersecurity of small business can impactits employees and the broader economy.Should SBA loans require an IT security checklist? 

D1-2 How can parents and children create a useful

dialogue about securing their families’ cyberspace? Cybersecurity is an area where parentsand children each bring their own experienceand expertise. By sharing these experiences,families can improve the cybersecurity of theirhousehold and contribute to an overallincrease in America’s cybersecurity.

AGENDA

LEVEL 1: The Home User and Small Business

recommendations will vary across

 their particular and changing 

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
er large enterprises to

eved through a range of

or cybersecurity, where

in the table, infra) and best

erless network, mainframe

technologies.

ture that supports the long

pends in large part on the

do not operate in isolation.

hat helps to drive the U.S.

ect, detect, respond, and

this essential economic

 be achieved through the

. 

eloping this resiliency by

t of their individual archi

nt. The massive networks

omy constitute both our

on businesses do more than

ny. Rather such events can

 research that can lead to

urity breaches can place

d trust in an enterprise and

tly damage large enter

e vulnerabilities can be

nterprise and even infra

enges facing large enter

lobal interconnections, and

Internet-based commerce complicate the provision and management ofenterprisewide security. Cybersecurity is a moving and dynamic target.There is no one-size-fits-all solution, or special technology, that will makean enterprise secure. In fact, 100 percent security is not a possibility intoday’s interconnected environment.Ultimately, addressing cybersecurity within an enterprise is more than atechnical problem, it is a management challenge. The scope of the riskspresented by cybersecurity can be effectively managed by engaging seniorleadership and by involving the corporate board of directors.Cybersecurity may warrant close attention from the board of directors.Considering security only after an incident has occurred places the business, the customers, and even the country at risk. In contrast, effectivegovernance of cybersecurity promotes growth, productivity, and shareholder confidence. Discussion of StrategyRaise the Level of ResponsibilityThe board of directors plays a vital role in the corporate system.Shareholders ultimately own corporations. Corporate boards are accountable to shareholders, and, in turn, managers are accountable to theboard. Raising the responsibility for cybersecurity to the level of the boardof directors can have significant enterprisewide results. The board canbetter understand its enterprise by asking a series of questions about the

Questions corporate boards, financial 

analysts and investors should ask:

1. What board members are responsible for IT security and risk

management oversight? Do these members provide an annualreport to the board?

2. Who is the senior most corporate official responsible for IT security

and to whom is he or she directly accountable?

3. How often do the CEO and COO review IT security and the overall

corporate risk management?

4. What internal IT security policies exist and do they involve annual

training of all employees?

5. Are the security controls of the company’s computer systems sufficient to prevent unauthorized access to files, alterations of data,

loss or theft of trade secrets and assets? NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

PRISES

LEVEL 2: LARGE ENTERPRISES

T 19
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

rity structure and controls. To better

ectiveness of enterprise cybersecurity,

e board committee, require periodic

es its Critical Infrastructure Assurance

er with the private sector to help

n security management and assurance

CIAO has been working with the

lp raise awareness about critical 

xt of a large enterprise. The IIA

n of Corporate Directors, the

 Accountants, and the Information

n to host a series of informative

ghly successful events heightened the

 top managers of their key role in

of the organizations they oversee. 

uncil

e new thinking and approaches. For

 want to consider creating a corpo

 members of the company with

orate officials with risk management

ould form the core of such a team.

• The Chief Operating Officer (COO);• The Chief Information Officer (CIO); • The Chief Technology Officer (CTO); • The Chief Information Security Officer (CISO)/

Chief Security Officer (CSO);

• The Chief Risk Officer (CRO); • The Privacy Officer; and, • The official responsible for physical security.

These officials can coordinate preparedness plans to ensure that cybersecurity is factored into the operations of the enterprise. Because a failure incybersecurity can compromise intellectual property, customer data, andbusiness operations, it is important that the key decision makers and technical officials are brought together. Furthermore, they can advise the CEOin a crisis and coordinate the execution of their contingency and continuity plans in response to cybersecurity incidents. The resiliency of largeenterprises contributes directly to resiliency of the macro economy, andultimately, the nation. A.C.T.I.O.N.S. and Best PracticesThere are a wide range of A.C.T.I.O.N.S. that can be undertaken tofacilitate the integrity, reliability, availability, and confidentiality of theenterprise. (Figure L2-1)

A.C.T.I.O.N.S. AND BEST PRACTICES

mplement processes and procedures to authenticate, or verify, the users of the network. This may include 

chniques such as PKI using smart cards, secure tokens, biometrics, or a combination of efforts.

an enterprise architecture and deployment with security in mind. Manage configurations to know exactly what hard

are, operating systems and software are in use, including specific versions and patches applied; create robust access and

oftware change controls, segregate responsibilities; implement best practices; and, do not use default security settings.

ain all employees on the need for IT security and ensure that security is factored into developing business 

perations. Foster an enterprise culture of safety and security.

evelop an enterprise capability for responding to incidents, mitigating damage, recovering systems, 

vestigating and capturing forensic evidence, and working with law enforcement. 

rganize enterprise security management, IT management, and risk management functions to promote 

fficient exchange of information and leverage corporate knowledge.

reate a regular process to assess, remediate, and monitor the vulnerabilities of the network; consider eveloping automated processes for vulnerability reporting, patching, and detecting insider threats. 

ternal and external IT security audits can also supplement these efforts.

nsure that security is embedded in the business operations and the systems that support them. mbedding security is easier than “bolting it on” after the fact.

Figure L2-1

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

21

prise security is the border

 networking and

ed the once well-defined

rises are so interconnected

hey may end up with virtual

ted to a network that the

tions are not recorded in

n result when a contractor

onnectivity is driving funda

e security management.

arch, tools, and

ant roles in large enter

 tend to focus on desktop

the Internet, and pervasive

rame computers.

ployed or recruited toward

hnology and connection to

abilities rendering existing

ete. Furthermore, the

dits have deteriorated to

ying these threats.

refresh their security

ly as elsewhere or risk

her point of vulnerability to

rams can by-pass firewalls

 unauthorized intruders,

 of enterprise systems.

ty polices to appropriately

.

on enterprise systems are

.” Insiders are trusted 

ise information systems 

se a significant threat to the

arise from the intentional

ly from the poor security

Whether the threat is 

the same—damage, 

disruption, and loss of data. Effectively mitigating theinsider threat requires policies, practices and continued training.Three common policy areas which can reduce insider threat include: (1) access controls, (2) segregation of duties, and (3) effective policyenforcement.

• Poor access controls enable an individual or group to inappropriately modify, destroy, or disclose sensitive data or computer

programs for purposes such as personal gain or sabotage.

• Segregation of duties is important in assuring the integrity of an

enterprise’s information system. No one person should havecomplete control of any system. Failing to properly segregate thecomputer duties of an organization’s staff can dramaticallyincrease the risk of errors or fraud. 

• Effective enforcement of an enterprise security policy can be

challenging and requires regular auditing. New automated software is beginning to emerge which can facilitate efficientenforcement of enterprise security. These programs allow theinput of policy in human terms, translation to machine code, andthen monitoring at the packet level of all data transactionswithin, and outbound from, the network. Such software candetect and stop inappropriate use of networks and cyber-basedresources.

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

PROGRAMS

Existing efforts in cybersecurity.

P2-1 CIAO and the Institute of Internal Auditors have

been working to train and raise awarenessabout the importance of understanding IT security in the context of the overall enterprisemission www.iia.org.

P2-2 The National Threat Assessment Center (NTAC)

with the CERT/Coordination Center is presentlyconducting a study on this critical topic. Usingtheir experience from previous studies—theExceptional Case Study Project and the SafeSchool Initiative—NTAC hopes to build a morecomplete understanding of this threat to enterprise IT security. For more information on this topic, look in detail at the full Strategy or view the NTAC web site atwww.survey.cert.org/Insider Threat to learnhow you can participate, anonymously, in thestudy. 

P2-3 The Internet Security Alliance has recently

issued a “Common Sense Guide for SeniorManagers,” which includes the organization’stop ten recommended information securitypractices www.isalliance.org.

P2-4 Many critical infrastructure industries have

formed information sharing and analysis centers(ISACs) in order to disseminate cybersecurityinformation to their respective sectors. 

P2-5 In many larger cities, the National Infrastructure

Protection Center partners with local businesses,the FBI, and academic experts in chapters ofInfraGard, a grass roots public-private partnership for cybersecurity and against cybercrimewww.infragard.net.

DISCUSSIONS

Issues highlighted for continued analysis, debate, and discussion.

D2-1 Cybersecurity is a constant process which requires regular

assessments and remediation. Accordingly, cybersecurity canbe enhanced with regular IT security audits. How oftenshould large enterprises have cybersecurity audits performedby outside auditors?

D2-2 Cybersecurity is an integral component of a company’s operations. When a company makes cybersecurity a management

issue, it can better protect its intellectual property and itsbusiness operations. What should financial analysts andinvestors ask companies about their security programs beforeinvesting?

D2-3 How can large enterprises facilitate the identification and

implementation of best practices for cybersecurity? 

D2-4 Should the National Security Telecommunications Advisory

Committee and the National Infrastructure Assurance Councilexamine the need and possible benefits of establishing anindependent organization, similar to the accounting profession, which would develop standards, guidance, and auditingprocedures for IT security enterprises?

AGENDA

LEVEL 2: Large Enterprises

OMMENDATIONS

t government and nongovernment 

ke to promote cybersecurity.*

ng enterprisewide corporate security councils to

acy, physical security, and operational considera

ar independent Information Technology (IT) security

ms, and reviews of best practices implementation.

nsider forming board committees on IT security and

mmendations of the chief information security offi

egularly reviewed by the CEO.

ns should be regularly reviewed and exercised and

ff alternatives. Consideration should be given to

ers as a way of mitigating risks.

er active involvement in industrywide programs to:

practices and procurement standards for like

ation on IT security through an appropriate infor

 center (ISAC); (c) raise cybersecurity awareness and

 work with the insurance industry on ways to

utilization of insurance for managing cyber risk. 

er joining in a public-private partnership to estab

those in industry making significant contributions

w mainframe security software and procedures to

ology and procedural measures are being utilized,

es employing mainframes servers should consider

 review and update best practices of mainframe IT

there continues to be an adequate trained cadre of

(3) IT security audits should include comprehensive

ectiveness of these recommendations will vary across

 take into account their particular and changing 

er to apply them.

DRAFT
gnificantly improve the

mation technology. To

d to create and implement

eve greater security:

nterprise architectures; 

ts and vulnerabilities, and

ncy operations and assets;

rols and remediation efforts

implementing the fore

ching structures and

ral government IT security

t (OMB); to hold 

 systems security;

ent acquisition and 

xecutive branch Information

fy, recommend, and coordi

urity Support Services

anage cyber incidents and

dependent security reviews

ther contractor certification

Issues and ChallengesThe security of the Federal government is the collective responsibility of itsdepartments and agencies. Accepting anything less than excellence inFederal computer security places the nation and the American people at risk.Historically, the Federal government did not consider information securitysystemically; instead, it often merely “tacked on” security as an afterthought—reacting to threats, vulnerabilities, and attacks as they arose,rather than anticipating and attempting to avoid problems.To overcome this deficiency, OMB established a governmentwide IT security program, as required by law, to set IT security policies and performoversight of Federal agency compliance with security requirements. Thisprogram is based on a cost-effective, risk-based approach. Agencies mustensure that security is integrated within every investment. This approach isdesigned to enable Federal government business operations, not tounnecessarily impede those functions. Federal Government IT Security Remediation ProcessA key step to ensure the security of Federal information technology is tounderstand the current state of the effectiveness of security and privacycontrols in individual systems. Once identified, it is equally important tomaintain that understanding through a continuing cycle of risk assessment. This approach has long been suggested by the General AccountingOffice, is reflected in OMB security policies, and is featured in theGovernment Information Security Reform Act of 2000 (GISRA).OMB is responsible for the development and oversight of the implementation of governmentwide policies, principles, standards, and guidelines forFederal government computer security programs. Within a statutoryframework, OMB issues security policies and ensures that security isappropriately integrated with capital planning and budget guidance.Oversight is achieved largely in the following ways: via the budget andcapital planning process, independent program reviews, annual agencyprogram reviews, independent Inspector General (IG) evaluations, agencyreports to OMB, agency security corrective action plans, and an annualOMB report to Congress.Through the implementation of GISRA, Federal agencies are required toconduct annual security reviews of all programs and systems, and IGs

perform annual independent evaluations of an agency’s security programand a subset of systems. These reviews and evaluations, along with otherapplicable security reviews, identify an agency’s security performancegaps. To ensure that those gaps are addressed, agencies are required todevelop corrective action plans for every system and program where aweakness was found. Corrective action plans for agency systems are tieddirectly to each agency’s funding request for the system—OMB fundingapproval for systems is contingent upon correction of outstanding securityweaknesses. Additionally, agencies must ensure that security has beenincorporated and security costs reported for every IT investment throughthe Federal capital planning process. OMB policy stipulates that specificlifecycle security costs be identified, built into, and funded as part of each

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

GOVERNMENT

ment section of this docu

ed in OMB guidance. 

LEVEL 3: THE FEDERAL GOVERNMENT

DRAFT 23
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

esults in disapproval of funding for

s, agencies report their progress in

ps. Annually, OMB reports the results

aluations to Congress.

ses and vulnerabilities and, for the

ment, there is a detailed under

aps. More importantly, through the

ction plans, the Federal government

ess in fixing those weaknesses.

anagement-level issues to ensure

 management function. OMB agrees

perts that a sound management

 important, but lower-level, technical

sed. Corrective action plans and

or Federal agencies to reflect the

c agency programs and systems.

an identification of all management,

eaknesses, the estimated resources

e projected timeline for corrective

on track. 

vernment information security reform

on governmentwide security

 new or surprising. OMB, along with

em to be problems for at least six

equirements of GISRA have given

unity to develop a comprehensive,

 IT security performance that has not

knesses include:

t attention.

ently establish and maintain control

rations and assets for which they are

gnizes, security is a management

braced by each Federal agency and

2. Lack of performance measurement.

Agencies must be able to evaluate the performance of officialscharged with implementing specific requirements of GISRA. Toevaluate agency actions, agencies must measure job and programperformance, i.e., how senior leaders evaluate whether responsible officials at all levels are doing their jobs. They must be ableto evaluate the performance of officials charged with securingagency operations and assets. Virtually every agency responseregarding performance implies that there is inadequate accountability for job and program performance related to IT security.

3. Poor security education and awareness. 

Agencies must improve security education and awareness.General users, IT professionals, and security professionals needto have the knowledge to do their jobs effectively before theycan be held accountable.

4. Failure to fully fund and integrate security into capital planning

and investment control. Security must be built into and funded within each system andprogram through effective capital planning and investment control.As OMB has done for the past two years in budget guidance,Federal agencies were instructed to report on security fundingto underscore this fundamental point. Systems that do not integrate security into their IT capital asset plans will not be funded.

5. Ensuring that contractor services are adequately secure.

Agencies must ensure that contractor services are adequatelysecure because most Federal IT projects are developed and manyoperated by contractors. Therefore, IT contracts, including thosefor telecommunications, need to include adequate securityrequirements. Many agencies reported no security controls incontracts or no verification that contractors fulfill any requirements that may be in place. Additionally, the OMB reportdiscusses pervasive security flaws found in many of today’scommercial software products. These flaws go well beyondsecurity to the very performance of the products themselves,and it is time to address this problem at a national level.

6. Failure to detect, report, and share information on vulnerabilities.

Far too many agencies have virtually no meaningful system totest or monitor system activity; therefore they are unable todetect intrusions, suspected intrusions, or virus infections. Thisplaces individual agency systems and operations at great risksince response depends on detection. Perhaps most significant isnot detecting and reporting IT security problems could causecascading harm. America’s vastly inter-networked environmentalso means shared risk with the best security being only asstrong as the weakest link.

Early warning for the entire Federal community starts first with detectionby individual agencies, not incident response centers at the FBI, GSA,DOD, or elsewhere. The latter can only know what is reported to them,reporting can only come from detection, and guidance for correctiveaction depends upon both. This need is thus not a technical one, but amanagement one. Additionally, it is critical that agencies and theircomponents report all incidents in a timely manner to GSA’s FederalComputer Incident Response Center and appropriate law enforcementauthorities, such as the FBI’s National Infrastructure Protection Center, asrequired by GISRA.Additional issues and challenges have also been identified:Authentication: Key to CybersecurityIntruders gaining access to systems by pretending to be the authorized usercan do immense harm. As described in NIST’s “Introduction to ComputerSecurity”—The NIST Handbook (located at www.csrc.nist.gov/), thereare three basic means to ensure the identification and authentication ofusers—applying something the user knows (password), applying somethingthe user has (token or smart card), and applying something the user is(biometric information). The weakest and most commonly used method ofidentification and authentication is applying something a user knows.Why is it the weakest? Because would-be intruders (and auditors) oftensuccessfully discern passwords through both pretext conversations withunsuspecting users and relatively simple technical means. If an intruder were to obtain the password of an agency employee, hewould gain the same trusted privileges as the employee and couldoperate behind the firewall, use and interfere with system resources, andgain real-time access to sensitive data. What is more, the intruder mightalso have access to other systems in the domain. If the victim employee had administrator or super-user privileges, theintruder would likewise acquire those privileges and could have unlimitedaccess to the entire network and the information on it. What is worse, theintruder could acquire valuable information and an understanding of systemweaknesses, escape without detection, perhaps share what they havelearned with others, and return another day to inflict even greater damage.Inconsistent Contingency PlanningAmong the lessons learned from security reviews following the events ofSeptember 11, was that Federal agencies had vastly inconsistent, and inmost cases incomplete, contingency capabilities for their communicationsand other systems. Contingency planning is a key element of cybersecurity. Without adequate contingency planning and training, agencies maynot be able to effectively handle disruptions in service and ensure business continuity. Continuity plans cannot simply be written and placed onthe shelf. These plans must be tested on a regular basis to ensure thatagency employees are fully aware of their roles and responsibilities. 

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

e Federal government must

ach to improving cyberse

fits-all” solution. However,

aining and maintaining

nt. These include:

se architectures;

nerabilities, and under

y operations and assets; and,

mediation efforts to reduce

nterprise Architectures.

identify and document their

n authoritative inventory of

ystems, critical business

her organizations. This will

urity needs. The Federal

ral CIO Council govern

 the Critical Infrastructure

ntegration is intended to

s-government core

nd areas where planned

g potential implications of

iness processes will also

ats and Vulnerabilities,

o Agency Operations

g and reporting mechanisms

of the security controls

sly understand risks to

cies have taken steps to

re agencies need to do so.

he greatly expanded use of

 conduct periodic vulnera

pt threats, and continuously

nology systems. (See recom

ols, the Federal government

solidated acquisition, oper

ossible approach, but

y deploy and manage them

ardize and automate

vulnerability identification and reporting—one of the six significant weaknesses identified in OMB’s February 2002 security report to Congress. Automated tools on agency networks could continuously assess systemvulnerabilities, collect and analyze firewall and intrusion detection auditlogs, audit configuration and security policy controls, and automaticallyreport the results to FedCIRC. Automated tools can be helpful inanalyzing data, providing forward-looking assessments, and alerting agencies of unacceptable risks to their operations. At the same time however, it is important that individual agencies andprogram officials within them continue to take responsibility and be heldaccountable for the security of the operations and assets under theircontrol. Separating responsibility and accountability sends the incorrectsignal that security is not their job—it is. Thus any centralization will becarefully considered before being adopted. (See recommendation R3-3)Step Three — Implement Security Controls And RemediationEfforts To Reduce or Manage Those Risks. The implementation ofsecurity controls that maintain risk at an acceptable level and test thecontrols to ensure that they continue to be effective can often be accomplished in a relatively brief amount of time. However, the remediation ofvulnerabilities is a much more complex challenge. Software is constantlychanging and each new upgrade can introduce new vulnerabilities. As aresult, vulnerabilities need to be assessed continuously. Remediation ofteninvolves “patching,” or installing pieces of software or code that are usedto update the main program. The remediation of Federal systems must beplanned in a consistent fashion. In addition, the Federal governmentshould explore more secure network protocols as they develop and assesshow their adoption and implementation could benefit agency operations.When it is shown that such secure protocols can have a cost-effectivebenefit on agency operations, the Federal government should lead inadopting and implementing them.Identifying and Authenticating Users and MaintainingAuthorization Through the electronic government e-Authentication initiative and othermeans, the Federal government is promoting a continuing chain of security for all Federal employees and processes, including the use whereappropriate of biometric smart cards for access to buildings andcomputers, and authentication from the moment of computer log on. Thebenefits of such an approach are clear. To establish and maintain securesystem operations, organizations must ensure that the people on thesystem are who they say they are and are doing only what they areauthorized to do. 

Identifying and authenticating each system user is the first link in thesystem security chain, and it must take place whenever system access isinitiated. Many authentication procedures used today are inadequate and,even correctly configured passwords can often be obtained from users.However, as GAO and others frequently report, passwords are not beingchanged from the system default, are often incorrectly configured, andare rarely updated. By promoting multi-layered identification and authentication—thecombined use of strong passwords, smart tokens, and biometrics—theFederal government will eliminate many significant security problems thatit has today. Through the ongoing e-Authentication initiative, the Federalgovernment will review the need for stronger access control and authentication; explore the extent to which all departments can employ the samephysical and logical access control tools and authentication mechanisms;and, consequently, further promote consistency and interoperability. 

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

DRAFT 25
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

ment

formation Systems Security

 architecture development activities,

reater uniformity of systems

nd to simplify and unify security

ffectiveness.

eral government will drive agency

 automated tools to assist them in

f their architectures and system

deral CIO Council’s “Practical Guide

onfiguration management is critical

am. See the CIO Council’s “Guide”

rchplus/ea_guide.doc. 

r periodic configuration audits as an

ed tools are now widely available

 Configuration control has incidental

e., controlling system configuration

and efficiently enforce policies and

tivirus definitions and other software

 system or network. 

Improved Security in Government Outsourcing and ProcurementThrough a joint effort of OMB’s Office of Federal Procurement Policy, theFederal Acquisition Regulations Council, and the Executive branchInformation Systems Security Committee, the Federal government is identifying ways to improve security in agency contracts and evaluating theoverall Federal procurement process as it relates to security. Agenciesmaintaining the security of outsourced operations was one of the keyweaknesses identified in OMB’s February 2002 security report to Congress.Additionally, the Federal government is conducting a comprehensivereview of the NIAP, to determine the extent to which it is adequatelyaddressing the continuing problem of security flaws in commercial software products. This review will include lessons-learned fromimplementation of the Department of Defense’s July 2002 policy requiringthe acquisition of products reviewed under the NIAP or similar evaluationprocesses. That policy stipulates that if an evaluated product of the typebeing sought is available for use, then the DOD component must procuresuch evaluated product. If no evaluated product is currently available, thecomponent must require prospective vendors to submit their product forevaluation to be further considered. Following this program review, the government will evaluate the costeffectiveness of expanding the program to cover all Federal agencies. Ifthis proves workable, it could both improve government security andleverage the government’s significant purchasing power to influence themarket and begin to improve the security of all consumer informationtechnology products. The Federal government recognizes that past effortssuch as this have failed, but believes that the heightened level of government and consumer concerns over significant flaws in informationtechnology products warrants renewed efforts. 

Framework for the Strategy Hold Agencies AccountableSince the beginning of his Administration, the President has called forbetter management of the Federal government. Beginning with hisBudget Blueprint in February 2001, continuing in the FY 2002 and 2003budgets, and in his Management Reform Agenda, the President hasrepeatedly spelled out a clear agenda for government reform. ThePresident has ordered the pursuit of five governmentwide initiatives thattogether will help government achieve better results. See www.whitehouse.gov/omb/budget/fy2002/mgmt.pdf. Because much of whatis required to develop and sustain an effective security program is a solidmanagement foundation, the Federal government is using the President’sManagement Agenda to build that foundation and drive the reform of itssecurity program.One of the management agenda’s initiatives—expanded E-Government—harnesses the power of information technology and the Internet to make

government more productive. The National Strategy to Secure Cyberspacecomplements these efforts by making sure that the E-Government initiative (“E-Gov”), and the infrastructure it relies upon, are secure. TheFederal government will then be better able actively to anticipate threatsand vulnerabilities, preempt them where possible, and survive them whenpreemption is not possible. In this way, the Federal government will set anexample for all owners and operators of the nation’s cyber infrastructure.To achieve this standard of performance, good intentions and goodbeginnings are not the measure of success. Rather, the government willrequire demonstrated performance and results. In order to ensureaccountability and measure performance in cyber security, theAdministration will do three things:

• Analyze Empirical Evidence of Agency Performance to Evaluate

Compliance. GISRA required the Federal agencies to perform anannual independent evaluation of their information security program and practices. The results of these evaluations arereported to OMB. These reports include an accounting of allsecurity weaknesses in agency systems and programs and adetailed corrective action plan with milestones and timelines.These reports are tied to the budget process and agency information technology funding requests to OMB must accountfor the lifecycle costs for security or they will not be approved.OMB uses this data to score the agencies’ security performance.The first round of security reporting is reflected in OMB’sFebruary 2002 security report to Congress. See www.whitehouse.gov/omb/inforeg/fy01securityactreport.pdf.

• Chart Agencies Progress Using the Management “Scorecard.” For

each of the President’s Management Agenda initiatives, OMB hasadopted an Executive branch management “scorecard”—a simple “traffic light” grading system common today in well-run businesses. Green indicates success, and yellow shows mixed results. Within the E-Gov “scorecard,” OMB measures agency performance with respect to security. Seewww.whitehouse.gov/omb/memoranda/m02-02.html.

• Base Agency Funding Decisions on Demonstrated Cybersecurity

Performance. Over the next three years the Federal governmentwill likely spend approximately $20 billion on IT security—including research and development. OMB will continue to useboth the “scorecard” and the GISRA security reporting to informbudget decisions for agency requests for information technology.OMB policy is clear: requests for information technology will notbe funded or resources will be reallocated if the agency hasshown poor security performance or if it has not included security requirements in the life-cycle costs for each investment. SeeOMB’s security investment policy, www.whitehouse.gov/omb/memoranda/m00-07.html.

n Assurance

designed to meet the secu

ent needs of both

s and consumers. NIAP is a

nstitute of Standards and

ecurity Agency (NSA) in

ties under the Computer

ombines the extensive

to promote the develop

quirements for IT products

 for evaluating those prod

 of NIAP is to help increase

their information systems

t-effective security testing,

s. NIAP continues to build

ment agencies and industry

rent and future IT security

cal information infrastruc

rship can be found at

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

agency does its part to

rnment security posture by

anagement foundation

 controls are built. This

ear and unambiguous

g officials accountable for

security requirements into

urity Support Services 

ds a central organization to

oreover, the increasing

is placing significant pres

ectively address their

, an office in the proposed

rm this operational support

 office could include

 the agencies, OMB, NIST,

bilities. (See recommenda

dent’s Critical Infrastructure

o the Federal Response

gov/rrr/frp/

s and structure for the

of Federal assistance to

er or emergency declared

d Emergency Assistance

e cyber annex will identify

rning Federal cyber

reat or attack. The annex

contingency plan detailing

ale cyber incidents. 

will be to evolve incident

and improved coordina

 capability is greatly

ing from a retrospective

vernment is also working

ontingency and disaster

s networks and informa

ess and contingency 

ng the use of a scenario

eat on a selected 

possibility could include

governmentwide cybersecurity exercises. This approach issimilar to that employed in 1998 by the Department of Defense in aneffort known as “Eligible Receiver” and would be developed with thecooperation of each participating agency. The exercise would includemost security disciplines—including physical, operations, information,and systems. Among other things, it would prove or disprove the notionthat today’s agency-specific exercises and isolated tests on individualsystems do little to reveal how low probability events result in highconsequences on interconnected systems and processes. Weaknessesdiscovered will be included in agency GISRA corrective action plans. (Seerecommendation R3-8.)Explore Creation of a Separate Federal Telecommunicationsand Information Systems Infrastructure Federal policy currently stipulates that each agency must plan and provide for the continuity of its operations including communications.Such planning and service provision should be consistent across the government, and departments considering creating new capabilitiesshould examine cross-agency sharing arrangements. The Federal government will continue to assess the technical viability andcost effectiveness of various options that provide for the continuity ofoperations during service outages such as VPNs, “private line networks,”and others. (See recommendation R3-6.)Consider Developing Specific Criteria for IndependentSecurity Reviews and Reviewers and CertificationWith the growing emphasis on security comes the corresponding needfor expert independent verification and validation of agency security programs and practices. GISRA and OMB’s implementing guidancerequire that agencies’ program officials and CIOs review at least annuallythe status of their programs. Few agencies have available personnelresources to conduct such reviews, and thus they frequently contract forsuch services. Agencies and OMB have found that contractor security expertise varieswidely from the truly expert to less than acceptable. Moreover, manyindependent verification and validation contractors are also in the business of providing security program implementation services; thus, theirprogram reviews may be biased towards their preferred way of implementing security. Indeed, last year, OMB learned that some securityservice providers were also contracted by the same agency to performannual GISRA program reviews. Even the perception of a conflict of interestshould be avoided when evaluating the security of an agency network.The Federal government will explore whether private sector securityservice providers to the Federal government should be certified asmeeting certain minimum capabilities including the extent to which theyare adequately independent. The national security community has begunsuch certifications for security service providers working in that sensitive

environment and lessons learned from their experience will be applied inconsidering the cost effectiveness of this approach for other areas of theFederal government.Among the possible elements of such an approach could be limitingcontract awards to service providers that meet specific published criteriathat address both the level of security expertise (including a thoroughunderstanding of all government requirements) and their relative independence. To ensure independence, agencies could be prohibited fromemploying their existing (or recent past) security services contractors astheir security program reviewer.None of the foregoing should be viewed as diminishing the role ofagency Inspectors General under GISRA. OMB continues to see the IGsas a linchpin to agency security performance improvement. In fact, thereare direct benefits to the IGs from implementing this plan—they would

DRAFT 27
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

dent and expert information upon

mmendation R3-2.)

oard’s Executive Branch

Committee

arlier, the OMB-chaired Committee is

 that will promote greater benefits

ons. To view the impact and effects

ms and business operations, this

oss a number of communities within

hief Information Officers, Chief

 Procurement Executives, small agen

usiness lines), human resources

 planned activities are a gap analysis

evaluation of the viability of a

ogy for grading risks, and a review of

 security practices or benchmarks for

s. The latter two efforts reflect our

es and Processes

ere are gaps in the coverage of

 and guidance for non-national secu

eeds of the departments and

detail and coverage and adequately

formance? The Committee is also

velopment processes are efficient,

vant agencies and organizations, and

Where improvement is needed the

ecommendations.

isk assessment practices of agencies

ermine whether a uniform scheme

s viable and desirable. The group has

methodology across the government

trics for identifying high, medium

ce complexity, simplify the use of

acilitate interoperability and informa

.

In reviewing this issue, the Committee is proving or disproving severalassumptions. First, all agency operations and assets require some level ofsecurity. Second, effective security demands an understanding of theacceptable level of risk. Third, the business requirements to share information within and across agencies, with industry, and with the public(especially in light of the September 11 terrorist attacks) has increased,and is complicated by differing approaches to grading risk. Fourth, auniform risk-grading process will assist agencies in applying correspondingsecurity controls. Fifth, a uniform risk-grading process will assist developing corresponding security requirements.Uniform Security Practices or Benchmarks for SimilarOperations, Assets, and SystemsThe Committee will examine the viability of developing, and the potentialbenefits derived from, uniform security practices that apply to high,medium, and basic risk applications as determined in the grading riskactivity described above. The group will explore whether implementing,maintaining, and monitoring security for operations that are similar acrossthe departments and agencies will reduce costs and improve the securityof such similar operations.Several assumptions will also be tested in this area. First, many agencyprograms and IT operations are essentially the same (e.g., e-mail and webservers, financial systems, general support systems or networks) and sotoo are the associated security requirements. Second, uniform securitypractices that consolidate in one place all applicable security policies andtechnical guidance would simplify and reduce costs for achieving theadequate level of security for similar activities. Third, uniform securitypractices are viable once uniform risk grading is in place.Cross-government StepsOne of the goals for many of these efforts is to unify and simplify securityprograms and processes and build security consistency across the government. This “build once, use many” approach for governmentwide securityis consistent with the approach used for E-Gov initiatives and OMB’s guidance to the agencies for preparing their FY 2004 budget requests. Thatguidance states that OMB “will give priority consideration to IT investments that leverage technology purchases across multiple entities.” Formore on OMB’s FY 2004 budget guidance, see www.whitehouse.gov/omb/circulars/a11/01toc.html.

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

 State and local govern

rmation technologies as

and detection of terrorism 

mation integration and

odels and business models

mation held outside the

Immediate Objectives• Lead the integration of information essential to homeland 

security across Federal agencies (horizontal integration)

• Drive the integration of information essential to homeland 

security among and between Federal, State, and local government, and the private sector (vertical integration)

• Guide the enablement of the National Strategy for Homeland

Security through appropriate use of information technologycapabilities, products, and services

Major Risks to be Addressed• Maintaining privacy while enhancing security• Aligning policy and laws with desired outcomes • Leveraging cultural beliefs and diversity to achieve collaborative

change

• Consolidating redundant or duplicative efforts • Overcoming political and cultural barriers• Ensuring appropriate security measures for new technology

Major Efforts in a Proposed Information IntegrationStrategy• Development of a business-driven Homeland Security Enterprise

Architecture

• Implementation of a National Homeland Security Portal (World

Wide Web site)

• Consolidation of Federal “Watch-out” lists• Multi-State Sharing of Law Enforcement Information• Establishment of a digital National Homeland Security

Information clearing-house

• Application of digital Intelligent Agents to the prevention and

detection of terrorism

29

 INTEGRATION AND  TECHNOLOGY FOR HOMELAND SECURITY

frastructure is to ensure

—addressing people,

es the integration of

terrorism among Federal,

s. We must put in place

formation to the right

nformation technology,

ut the United States will

ess of threats and vulner

 personnel and resources

fficials will receive the

 of government and the

pate threats and respond

on integration will

physical and cyber infra

rs, prevent biological or

ctive first response to a

To guide information integration, the President proposed theInformation Integration Program Office (IIPO) within the CriticalInfrastructure Assurance Office in the Department of Commerce.If created, this office would migrate to the proposedDepartment of Homeland Security. The office is intended tocoordinate the sharing of essential information nationwide. Themost important function of this office would be to design andhelp implement a national enterprise architecture to guideinvestment in and use of information technology. Such an architecture would define the information integration requirementsneeded to detect, prevent, monitor, and respond to terroristthreats and incidents within the nation and around the world,while improving both the time of response and the quality ofdecisions.

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

RECOMMENDATIONS

nt and nongovernment entities can take to promote cybersecurity.

e procurement of more secure IT products, the Federal government, by

 a comprehensive program performance review of the National

Program (NIAP) to determine the extent to which NIAP is cost effective

entified security gap; whether it has defined goals to close the gap;

those goals; and the extent to which program improvements, 

ion are appropriate and cost effective. 

nt, by 3Q FY03, will assess whether private sector security service

l government should be certified as meeting certain minimum 

nt, by 3Q FY03, using the E-Government model, will explore the benefits

ource pressures on small agencies) of greater cross-government acquisi

aintenance of security tools and services. 

-Authentication initiative, the Federal government, by 2Q FY03, will

hich all departments can employ the same physical and logical access

ntication mechanisms to further promote consistency and interoperability. 

ould continue to expand the use of automated, enterprisewide security

y policy enforcement tools and actively deploy threat management tools

2Q FY03, the Federal government will determine whether specific

.g., through the policy or budget processes) to promote the greater use

nt will continue to assess the technical viability and cost effectiveness of

ovide for the continuity of operations during service outages, such as

tworks, and others. 

nt should lead in the adoption of secure network protocols. The Federal

w new secure network protocols as they are published to determine

rity gap and whether their adoption would have a cost-effective impact

security of the Federal government. 

 the Federal government will consider the cost effectiveness of a

 and contingency preparedness exercise for a selected cross-government

d such an exercise take place any security weaknesses shall be included

RA corrective action plans. 

th the CIO council,will determine on a case by case basis whether to

oncept for governmentwide security measures. The alternatives will

NIST, the proposed Department of Homeland Security, and the

.

PROGRAMS

Existing efforts in cybersecurity.

P3-1 National Security Agency www.nsa.gov/isso/index.htmlP3-2 National Infrastructure Assurance Partnership www.niap.nist.gov/P3-3 OMB security program/budget process /GISRA reporting www.whitehouse.gov/omb/inforeg/infopoltech.htmlP3-4 E-Government initiative www.egov.gov/P3-5 Enterprise architecture Project Matrix www.ciao.gov/Federal/P3-6 NIST Computer Security Resource Center www.csrc.nist.gov/P3-7 Federal CIO Council www.cio.govP3-8 The General Services Administration’s PKI bridge and Federal

Telecommunications System security levels www.gsa.gov, Federal Computer Incident Response Center www.fedcirc.gov

DISCUSSIONS

Issues highlighted for continued analysis, debate, and discussion.

D3-1 Should Federal agencies be required to comply with a maximum time limit

for the implementation of patches for known vulnerabilities?

D3-2 Should the CIAO or CISO be different than the CIO?D3-3 How should civilian agencies expand use of PKIs for specific situations? 

AGENDA

LEVEL 3: CRITICAL SECTORS – The Federal Government

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

 goals for achieving and

mation infrastructures from

 significantly diminish State

der and to deliver essential

ic safety net” for millions

de essential social support

ns, such as law enforce

 also own and operate

power and transmission,

 catalytic role in bringing

r critical services within their

 recover from a crisis.

 and responsibilities within

 a critical infrastructure

States are inexorably tied to

pients, supporting law

 records, and operating

. Preventing cyber attacks

nsures that these 24/7

de important services that

ntial for bringing unprece

te governments for their

f these systems and the

ntial for expanded use and

Discussion of StrategyWith an increasing dependence on integrated systems, State, local, andFederal agencies have to collectively combat cyber attacks. Sharing information to protect systems is an important foundation for ensuringgovernment continuity. States have adopted several mechanisms thatassist in sharing information on cyber attacks and in reporting incidents.These mechanisms are continually being modified and improved as newpolicy emerges and as technological solutions become available. In addition, States are exploring options for improving information sharing bothinternally and externally. These options include enacting legislation thatprovides additional funding and training for cybersecurity and formingpartnerships across State, local, and Federal governments to managecyber threats. Some mechanisms that many States are using to address cyberspace security include:

• Governance Structure. Many States have an IT security governance structure that guides and enacts cybersecurity policy for

the State. Functions may include making policy recommendationsto the Governor or establishing a restoration priority list of agencies if multiple agencies are disabled concurrently. In many cases,the cybersecurity board includes all branches of government andaffected agencies. Additionally, some States are including localgovernments in the governance structure, recognizing that localand State systems may be interconnected.

• Establishment of the Roles of the State Chief Information Officer

(CIO) and Chief Information Security Officer (CISO). CIOs andCISOs oversee security policy and the implementation and maintenance of critical information systems. 

• State Homeland Security Initiatives. Homeland Security Directors

recognize that the States’ cyber systems are at high risk forterrorist threats. With this in mind, States are shoring up networkinfrastructure and implementing authentication and authorization processes for State information systems. State policymakersand technologists are making outreach efforts to the public toeducate them on how to protect their own information systemsat home. 

Law EnforcementState and local governments play an important role in the emergency lawenforcement sector. Emergency Law Enforcement Services (ELES), as a critical infrastructure sector, is included within the emergency services sector.The continued operation of the ELES sector during a time of crisis isessential to the rule of law, the protection of the general welfare, thepreservation of civil liberties and privacy rights, and consequence management.More than 18,000 Federal, State, and local agencies comprise the ELESsector. Responses from more than 1,500 of these agencies to a sectorcommissioned information systems vulnerability survey reveal that theseorganizations have become increasingly reliant on information andcommunications systems to perform their critical missions. The threatagainst such systems continues to grow. Sector agencies also depend onother critical infrastructures, such as energy and telecommunications,which are also vulnerable to both cyber and physical disruption.

31

OCAL GOVERNMENTS Gap Analysis

States representative groups have identified additional mechanismsneeded to foster intergovernmental and industry partnerships:• Create a State CIO advisory group to the President’s Critical

Infrastructure Protection Board.

• Initiate an intergovernmental, cross-disciplinary architecture design

guidance effort to support national information sharing.

• Increase information sharing efforts such as the Interstate ISAC.• Initiate an ongoing intergovernmental effort to develop and deliver

cybersecurity tools and training to State and local governments, incooperation with NIST.

• Implement a concerted outreach effort to both citizens 

and businesses in regions where access to cybersecurity knowledgeand tools is limited.

• Assure the inclusion of local government representation on State

cybersecurity boards so that local interests and needs are represented.

• Leverage learning from private industry security providers on best

practices, trends, lessons learned, and new technology.

• Find ways to bridge the information “stovepipes” at all 

levels of government.

• Address States information sharing concerns.

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

This ELES sector critical infrastructure protection planpresents the sector’s initial strategy for ensuring itscontinuing ability to perform critical emergency lawenforcement functions. The plan represents thecombined efforts of the National Infrastructure ProtectionCenter (NIPC), the designated lead agency for the ELESsector, and the ELES Forum, a group of senior lawenforcement executives from State, local, and non-FBIFederal agencies. The Forum was created to support thedevelopment of the ELES plan, to be national advocatesfor emergency law enforcement issues, and to conductliaison activities with the ELES community.The plan presents the sector’s framework for identifyingits most critical assets, assessing their vulnerability toattack, and developing remediation and mitigation plans.The plan also provides information on the NationalInfrastructure Protection Center’s (NIPC) threat alert andnotification system and on various infrastructure andinformation security-related training programs. Acompanion Guide for State and Local Law EnforcementAgencies provides tools that sector agencies can usewhen implementing the activities suggested in the plan.The guide serves as the sector baseline infrastructureprotection education and awareness program document.Each law enforcement agency operates independentlyand is responsible for its own critical infrastructureprotection. Therefore, the success of any sectorwideprogram depends on the voluntary efforts of each ofthese organizations to undertake the activities suggestedin the plan. At the national level, the ELES sector leadership will continue to serve as the sector representative incross-sector planning and implementation activities.

RECOMMENDATIONS

Specific actions that government and nongovernment 

entities can take to promote cybersecurity.*

R3-10 State and local governments should consider establishing IT security programs

for their departments and agencies, including awareness, audits, and standards. State, county, and city associations should consider providingassistance, materials, and model programs.

R3-11 State and local governments should consider participating in the established

information sharing and analysis centers (ISACs) with similar governments. 

R3-12 State and local governments should consider expanding training programs in

computer crime for law enforcement officials, including judges, prosecutors, andpolice. The Federal government could assist in coordinating such training andexplore whether funding assistance is feasible.

PROGRAMS

Existing efforts in cybersecurity.

P3-9 The National Association of State Chief Information Security Officers

www.nascio.org/. NASCIO published a report entitled, “Public-Sector

Information Security: A call to Action for Public Sector CIOs.”

P3-10 The National Governors Association www.nga.org/.P3-11 The National League of Cities www.nlc.org/nlc_org/site/.

DISCUSSIONS

Issues highlighted for continued analysis, debate, and discussion.

D3-4 How can Federal, State, and local governments enhance coordination and

crisis management for cybersecurity?

D3-5 What special legal or policy challenges might States face in developing an

interstate ISAC?

AGENDA

LEVEL 3: CRITICAL SECTORS — State and Local Governments

*Note: The feasibility and cost effectiveness of these recommendations will vary across

entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them.

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

sities, four-year colleges,

e set goals to adopt and

etwork security to protect

ms from being used for

ave identified the following

ducation;

improve the use of existing

nd education networks;

r education, industry, and

th the national effort to



y

g

IHEs systems can be penetrated and “hijacked” for the purpose oflaunching cyber attacks against third-party systems (the “zombie”phenomenon). They unwittingly place other sectors at risk.IHEs also hold much information for and about students and staff that iseither private or confidential. Sensitive information (such as patient information and medical records, student information, personnel records, andsensitive research data) is maintained within university system databases.Such information must be protected and kept private. Moreover, vulnerabilities in one trusted network create vulnerabilities in many networks.Accordingly, IHEs must consider the broader implications of their cybersecurity.While IHEs must maintain privacy of information and prevent malicioususe of their systems, they also must provide an environment in whichstudents can learn, and research can be conducted efficiently. These two

needs do not necessarily conflict, but mustboth be considered as IHEs identify theirstrategy for securing their part of cyberspace.

Discussion of StrategyIHEs’ Action Plan–Steps Completed andThose to be TakenThe higher education community, collectively,has been actively engaged in efforts toorganize its members and coordinate action toenhance cybersecurity on America’s campuses.Most notably, through EDUCAUSE, thecommunity has raised the issue of the NationalStrategy’s development with top leaders ofhigher education, including the AmericanCouncil on Education and the Higher EducationIT Alliance. Significantly, through this effort, topuniversity presidents have adopted a 5-pointFramework for Action that commits them togive IT security high priority and to adopt thepolicies and measures necessary to realizegreater system security. 

America’s colleges and universities have also adopted an agenda offurther activities to address the challenges of IT security and informationassurance. For example, along with the National Science Foundation(NSF), EDUCAUSE is organizing a series of four workshops. The first of these workshops will bring together leaders in higher education to establish principles for a security strategy that can also supporthigher education’s mission. Representatives from the university researchcommunity will also meet to identify the problems, issues, and solutionsassociated with securing faculty and student research activities.

33

ATION Task Force on Computer and 

Network Security

In July 2000, EDUCAUSE and Internet2 established the Task Forceon Computer and Network Security (www.educause.edu/security). The Task Force represents just one effort by the highereducation community to take an active role in identifyingvulnerabilities and the flaws that create them, and developingand implementing solutions on their campuses. By doing so, theTask Force seeks to reduce significantly the direct threat thathigher education systems confront and the indirect threat thatexists to others.The Task Force works with partner associations and well-knownsecurity specialists to develop short-term actions and intermediate and long-term projects to address these problems inhigher education. Among its recommendations are thefollowing:

• Near Term: All campus network and technology leaders

should find and fix the ten most common security holeson their campus by adopting the advice and methodology of the SANS Institute.

• Intermediate: The Task Force will seek out and publicize

improved procedures and policies to find, fix, andprevent security flaws on campus, as well as means tomeasure and compare progress.

• Long Term: Research next-generation security issues that

will help to engineer new services in a secure fashionand provide systemic remedies to some of today’s problems (e.g., Internet2 PKI labs and the Higher EducationPKI joint project of Internet2).

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

RECOMMENDATIONS

Specific actions that government and nongovernment entities can take to promote cybersecurity.*

R3-13 Each college and university should consider establishing a point-of-contact, reachable at all

times, to Internet service providers (ISPs) and law enforcement officials in the event that theschool’s IT systems are discovered to be launching cyber attacks. 

R3-14 Colleges and universities should consider establishing together: (a) one or more information

sharing and analysis centers (ISACs) to deal with cyber attacks and vulnerabilities; (b) modelguidelines empowering Chief Information Officers (CIOs) to address cybersecurity; (c) one ormore set of best practices for IT security; and, (d) model user awareness programs and materials.

PROGRAMS

Existing efforts in cybersecurity.

P3-12 EDUCAUSE and Internet2 established the Task Force on Computer and Network Security

www.educause.edu/security. 

P3-13 EDUCAUSE Workshop series with National Science Foundation.P3-14 EDUCAUSE Outreach and awareness program to leaders and associations in higher education.

DISCUSSIONS

Issues highlighted for continued analysis, debate, and discussion.

D3-6 What are the merits of adopting a model set of authorities for IHE CIOs, the academic institution, and the nation? (An example of such authorization can be found at www.indiana.edu.D3-7 Should consideration be given to tying State or Federal funding to IHEs to compliance with

certain cybersecurity benchmarks?

D3-8 Should an ISAC for the higher education community be established? If so, how? What other

steps could be taken to improve methods of information sharing among IHEs at all levels?

D3-9 Should IHEs adopt the NIST Information Technology Security Assessment Framework (“NIST 3”)

as a standard for information system security compliance?

AGENDA

LEVEL 3: CRITICAL SECTORS — Higher Education

*Note: The feasibility and cost effectiveness of these recommendations will vary across

entities. Individual entities should take into account their particular and changingcircumstances in choosing whether to apply them.

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

ng cyberspace because it

tion’s infrastructures and

ral critical infrastructure

coordinate the develop

g these processes, sectors

securing the critical infor

ate. The sector plans have

cope and character of the

The sector plans provide a specific overview of the challenges facing thedifferent industry sectors and the steps they are taking to meet thesechallenges. Moreover, the industry planning efforts advance cyberspacesecurity by creating a process where sectors can begin to identify theirunique security issues for resolution; and the planning efforts also facilitate the prioritization of infrastructure protection issues which may needto be addressed through a public-private partnership.Issues and ChallengesCyberspace security is a shared responsibility. No single industry is responsible for its security and no government entity can protect it. At the

request of the Bush Administration, Americaninfrastructure sectors have undertaken anunprecedented effort to develop infrastructureprotection plans that address cyber and physical security. The various sector strategiesdescribe the actions that each industry sector istaking to assure its critical operations will notbe disrupted or compromised by cyber attacksor physical incidents. The private sector plansare intended to foster greater infrastructuresecurity and complement Federal planningefforts. Together these plans lay a foundationfor a truly national strategy. The Partnership for Critical InfrastructureSecurity (PCIS), a nonprofit organization of critical infrastructure companies, was formed toaddress the complex set of issues related toinfrastructure protection. The Partnership is acollaborative effort of over 60 member companies and associations and 13 Federalgovernment agencies in 8 critical infrastructuresectors.The mission of the Partnership is to coordinatecross-sector initiatives and complement publicprivate efforts to promote the assurance ofreliable provisions of critical infrastructure 

services in the face of emerging risks toeconomic and national security. Accordingly,the Partnership focuses on issues that thesectors have in common.The PCIS and the CIAO have reviewed the sectorplans listed in the table to the left and summarized thecommon issues and concerns identified by the sectors. ThePCIS/CIAO analysis is available on the PCIS web site(www.pcis.org).The companies which own and operate the critical infrastructuresshare six common challenges which must be addressed to enhanceinfrastructure protection efforts. These challenges include a wide range ofissues such as infrastructure interdependencies, research and development, education and workforce development, information sharing andanalysis, public policy issues, and international challenges.Infrastructure InterdependenciesDuring the past decade American infrastructures have integrated information technology (IT) and cyberspace into almost every aspect of theiroperations.The rapid integration of IT has yielded profound efficiencies, promotedinnovation, and increased service reliability. Once distinct infrastructures,which were isolated by closed proprietary systems, are now tightly integrated with one another. This integration has created many new andcomplex interdependencies. In many cases, these interdependencies arenot well understood.Industry is working jointly with government to develop an understandingof the complex connections between organizations in a sector, amongsectors, and with the government. In particular, there is concern aboutcascading effects from one critical infrastructure sector to others.Developing tools and methodologies to perform cyber risk modeling isessential to both eliminating vulnerabilities and fostering the appropriaterisk-transfer mechanisms. Efforts are beginning in the insurance and reinsurance communities to support these endeavors (To read more aboutinsurance sector efforts see www.pcis.org or www.ciao.gov.) 

OR

American Banking Association, Securities IndustryAssociation, BITS, the Financial Services Information

haring and Analysis Center board, and the

ndependent Community Bankers of America

North American Electric Reliability Council 

National Petroleum Council 

The Association of Metropolitan Water Agencies, with

upport from the American Water Works Association,he National Association of Water Companies, and the

AWWA Research Foundation. 

Association of American Railroads

Cellular Telecommunications and Internet Association,

nformation Technology Association of America,

Telecommunications Industry Association, and United

tates Telecom Association 

Chemicals Sector Cyber-Security Information SharingForum

or www.ciao.gov

SECTOR 

COORDINATORS/

CONTRIBUTORS

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

DRAFT 35
ent (R&D) is another challenge

s there are specific technical R&D

hese unique challenges are explained

found in their respective sector

h more cross cutting and include

ts guidelines and best practices for

pment

ructures depends on people. Senior

nd the employees in general all play

ent develops an increased awareness

licy that promotes infrastructure

ent the management policy infra

ll-trained technical people. Accessing

rgely on educating and training.

 on the average employee complying

y policies. These three factors play a

y in all of the infrastructures.

g together to improve information

y, the independent critical sectors are

urity information among their

tinue to develop additional means

 vulnerability, countermeasure, and

eir individual industries, across

s

ctors have identified a variety of

gal challenges that may impede their

d cybersecurity. The PCIS provides a

ector concerns in its analysis.

International IssuesCyberspace security is an international challenge that is not bounded byany physical national boundary. The operations of multiple sectors crossinternational boundaries. As a result, global infrastructure sectors are initiating efforts to promote the availability, integrity, and reliability of theircommon information systems.Discussion of StrategyFostering a Stronger Public-Private PartnershipA successful public-private partnership requires trust. Trust cannot belegislated or mandated. Rather it is built over a period of time. TheFederal government will continue to explore a variety of efforts toenhance and expand its partnership with the critical infrastructure sectorsincluding improving coordination with the industry-led efforts for information sharing about cybersecurity.Information Sharing and Analysis CentersInformation sharing and analysis centers (ISACs) play an increasingly critical role in homeland and cybersecurity. An ISAC is typically anindustry-led mechanism for gathering, analyzing, sanitizing, and disseminating sector-specific security information. ISACs are designed by thevarious sectors to meet their respective needs and are financed by theirmembers. (The telecommunications ISAC located at the NationalCommunications System is funded by the government.) ISACs workclosely with the Federal government through the National InfrastructureProtection Center (NIPC) to exchange data about threats and vulnerabilities; and through the CIAO for coordination and planning efforts. ThePresident’s proposed Department of Homeland Security would combinethe NIPC, CIAO, and other Federal cyber centers to streamline informationsharing and enhance infrastructure analysis. Establishing an ISAC requires tremendous cooperation within the sectorand the establishment of a clear business model. While each ISAC isdifferent, new and established ISACs must overcome a variety of challenges. These challenges include improving business participation in theISAC; enhancing the timeliness and effectiveness of threat information;and overcoming information sharing challenges. Several of the criticalinfrastructure sectors have either created or are now planning the development of their industry-specific ISACs.

ISACs are developing and maturing across the various sectors includingtelecommunications, financial services, information technology, water,transportation, electric power, oil and gas, chemicals, food, State government, and more. Because they draw on the technical expertise of a givensector, the ISACs can facilitate the management and resolution of cybersecurity incidents. In order to respond to future challenges, ISACs may need to be linked togovernment warning-and-analysis centers. As a result there are effortsunderway to explore the benefits of linking ISACs to each other and tocritical government centers. This could facilitate the timely flow of criticalinfrastructure information and enhance crisis management efforts.As ISACs mature, so too will the national ability to respond and managecyber incidents and attacks. In addition, the Federal government andISACs could explore the challenges associated with infrastructure analysisand identify the methodologies and tools that might be needed to visualize and understand vulnerabilities, attacks, and remediation. If requested, the Federal government could, through the ISACs, providetechnical assistance to develop contingency and crisis management plansfor critical infrastructures. In addition, Federal, State, and local governments could examine ways to coordinate response and recovery activitiesfor significant disruptions that require actions beyond the capabilities orpurview of individual companies.

O SECURE CYBERSPACE

10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

37

RECOMMENDATIONS

Specific actions that government and nongovernment 

entities can take to promote cybersecurity.*

R3-15 Each sector group should consider establishing an information

sharing and analysis center (ISAC) that should cooperate withother ISACs. The Federal government will explore linking the ISACswith appropriate cybersecurity warning-and-analysis centers uponrequest, and could facilitate the provision of information relatedto critical infrastructure protection when necessary. 

R3-16 Each sector group should consider conducting a technology and

R&D gap analysis, in conjunction with OSTP efforts to prioritizeFederal cybersecurity research to address identified gaps. Thesectors and OSTP should coordinate on the conduct of suchresearch. 

R3-17 Each critical infrastructure sector group should consider developing

best practices for cybersecurity and, where appropriate, guidelinesfor the procurement of secure IT products and services.

R3-18 Each sector group should consider working together on sector

specific information security awareness campaigns.

R3-19 Each sector should consider establishing mutual assistance

programs for cybersecurity emergencies. The Department of Justiceand the Federal Trade Commission should work with the sectors inaddressing any barriers to such cooperation.

PROGRAMS

Existing efforts in cybersecurity.

P3-15 The Partnership for Critical Infrastructure Security, www.pcis.org.

AGENDA

LEVEL 3: CRITICAL SECTORS — Private Sectors

*Note: The feasibility and cost effectiveness of these recommendations will vary across

entities. Individual entities should take into account their particular and changingcircumstances in choosing whether to apply them.

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

ORITIES

national priorities is estab

he three foundations central

social framework; and, 

early defined set of efforts.

in the approaches that are

e Strategy. For example,

ure more secure or to

will benefit everyone, from

s section summarizes the

een areas critical to 

nd strategic steps that the

 issues are national in

will require efforts at all

Securing Shared SystemsMaking basic elements of cyberspace more secure and reliable will benefitusers at all levels. Ideally, the nation can find ways to make computing,and especially operating systems, more secure, to make networks thatconnect them secure, and to ensure that new additions are equallysecure. One improvement in security of common systems equates tomillions of improvements for individual users. Where vulnerabilities persist,efficient means must exist to correct them. The strategic goal of securingshared systems is to greatly enhance individual security by securing thesystems that affect users at all levels. Securing the Mechanisms of the Internet When the Internet was first developed, its creators did not imagine all ofthe commercial, national security, and emergency preparedness purposesit would eventually acquire. They did not realize how quickly and howmuch the Internet would grow over time. Thus, when the Internet wasbuilt, features like security, which are vital today, were not part of itsfoundation.

The Internet was built to be redundant and though security has beenadded on over time, security was never incorporated as a fundamentalfeature and gaps remain in its implementation. In addition, the methodsand rules that the Internet uses for communication, and the devices thatsupport the transfer of information, were not designed to support thegrowing volume of data that flows through the Internet.The development and implementation of the mechanisms for securing theInternet are responsibilities shared by its owners, operators and users. Thiseffort cannot be accomplished by any one entity or group. Rather,securing the mechanisms of the Internet will require a partnership. Privateindustry is leading the effort to ensure that the core functions of theInternet develop in a secure manner and, as appropriate, the Federalgovernment will continue to support these efforts.

ersecurity Areas of effort to develop foundation

Securing the mechanisms of the Internet

Supervisory control and data acquisition systemsResearch Highly secure and trustworthy computingSecuring emerging systems

Vulnerability remediation

al framework Awareness

Training and educationCertificationInformation sharingCybercrimeMarket forcesPrivacy

Analysis and warning 

Continuity of operations, reconstitution, and recoveryNational securityInterdependency and physical security 

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

LEVEL 4: NATIONAL PRIORITIES

DRAFT 39
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

echanisms of the Internet is to foster

st mechanisms that will enable the

s now and in the future. Securing

des:

esilience of key Internet protocols;

ards, practices, and criteria—“code

private partnership to identify and

tal technology needs for the Internet.

Supervisory Control and Data Acquisition (SCADA) SystemsMany industries in America have radically transformed the way theycontrol and monitor equipment over the last 20 years. In the past,workers controlled many systems manually, which required traveling tothe equipment site. Today, many of these same systems are controlledremotely over cyber networks. In many cases, this information is using theInternet to travel from one point to the other. The ability of companies to make these systems secure is limited in twoways. First, adding security requires investment that companies may notbe willing to make. Second, technological limitations exist. SCADAsystems are often small and self contained. They may have limited powersupplies. Moreover, they operate in real time. This means that securitymeasures that might slow down system performance, or require additionalpower to operate, could be difficult to implement. The strategic goal is to empower Digital Control System (DCS)/SupervisoryControl and Data Acquisition (SCADA) users to protect their cyberspaceand prevent it from being used to disrupt the nation’s critical infrastructure. The following will help to achieve this goal:

• raising the level of awareness among industry vendors and users

to the vulnerabilities in DCS/SCADA systems, and the consequences of exploitation of those vulnerabilities;

• developing and deploying training and certification programs on

topics such as: basic data security, DCS/SCADA-oriented security,secure software, secure hardware;

• promoting standards efforts, security policy creation, and means

of enforcement of these standards and security policies;

• providing a test bed environment to study security problems and

proposed solutions;

• performing research and development in the areas of extremely

low latency link encryptors/authenticators, key management, andnetwork status/state-of-health monitoring; and,

• developing a government/industry partnership to identify the

most critical DCS/SCADA-related sites and to develop a plan for short-term cybersecurity improvements to those sites.

ResearchAs the nation’s reliance on cyberspace continues to grow, Federal investment in research for the next generation of technologies to maintain andsecure cyberspace must keep pace with an increasing number of vulnerabilities. Flexibility and nimbleness are important in ensuring that theresearch and development process can keep pace with the revolutionarytechnology environment in the years ahead. The proper balance between

fiscal restraints and responsiveness to the vulnerabilities in the nation’scritical infrastructures may require greater levels of funding in the future.The nation will prioritize and provide resources as necessary to advancethe research to secure cyberspace.A new generation of enabling technologies will serve to “modernize” theInternet for rapidly growing traffic volumes, expanded e-commerce, andthe advanced applications that will be possible only when next-generationnetworks are widely available. As a result, national research efforts mustbe prioritized to support the transition of cyberspace into a secure, highspeed knowledge and communications infrastructure for the 21st century.Vital research is required for this effort. For example, new technologymust be developed that can create an encryption and authenticationcapability for digital control systems. The nation must prioritize its cyberspace security research efforts across all sectors and funding sources.The strategic goal of the national cyberspace security R&D agenda is tocoordinate the development of technologies to counter threats, reducevulnerabilities, and foster a resilient, secure cyberspace for the future. Thisgoal is accomplished by:

• developing an annual cyberspace security R&D agenda to meet

near-, medium-, and long-term objectives;

• leading a vigorous program of Federal R&D in cybersecurity that

rapidly identifies, develops, and facilitates the fielding of technologies and tools for countering threats and vulnerabilities;

• fostering a close partnership with the private sector, academia,

and the international community to ensure that no key technologies are missed, and new security technologies are quicklyadopted; and, 

• ensuring Federal cybersecurity R&D funding in FY04 is consistent

with the national R&D agenda priorities.

Highly Secure and Trustworthy ComputingOne day in the future, working with a computer, the Internet or any othercyber system may become as dependable as turning on the lights or thewater. It may become something that can be taken for granted and left inthe background. Today, however, it is common to have computers crashand to have systems be unavailable for long periods of time. Data is oftenlost or recovered only with great difficulty. Systems become overloaded orfail because a component has gone bad.The strategic goal is to ensure that future components of the cyber infrastructure are built to be inherently secure and dependable for their users.This goal is accomplished by:

• conducting additional research to develop highly secure and 

DRAFT
ices and quality assurance

cure and reliable products;

detecting malicious code in

ds to insist on security and

duce the potential for new

works are an example of

se systems, their implemen

hted some of their

round a city can log onto

f their owners. The intruder

hose systems if he or she

sms (such as password

on, or using a virtual

usceptible to attack. Too

due to complexity, cost, or

n is possible even when the

ed because the encryption

ket and become wide

r security is adequate.

nsequences for security. The

nt agents, as well as in the

notechnology and quantum

berspace and its security.

derstanding these technolo

hat emerging technologies

ow to eliminate, mitigate

ilities. Achieving this goal is

chnologies, such as 

 by increasing awareness

ration of secure wireless

urity issues related to 

 and, 

 security of emerging 

Vulnerability RemediationNew vulnerabilities emerge daily as use of software reveals flaws thatcriminals can exploit for malicious activity. Currently, approximately 3,500vulnerabilities are reported annually. Corrections are usually completed bythe manufacturer in the form of a patch and made available for distribution to fix the flaws.Many known flaws remain uncorrected for long periods of time. Forexample, the top ten known vulnerabilities may account for the majorityof the reported incidents of cyber attacks. This happens for multiplereasons. Many system administrators may lack adequate training or maynot have time to examine every new patch to see if it applies to theirsystem. The software to be patched may affect a complex set of interconnected systems that take a long time to test before a patch can beinstalled with confidence. If the systems are critical, it may be difficult toshut them down to install the patch.The strategic goal is to significantly improve the speed, coverage, andeffectiveness of remediation in the near term by improving tools and practices, and in the longer term by reducing vulnerabilities at the source. Thisgoal can be accomplished through the following strategic steps:

• identifying and promoting adoption of company and agency best

practices for vulnerability remediation;

• creating a neutral clearinghouse to promote faster identification

of the impact of patches on common applications, possiblyincluding test results;

• researching and encouraging improved disclosures of the impact

of patches to speed implementation;

• developing and implementing improved coding techniques and

quality assurance criteria to reduce the number of vulnerabilitiescreated; and, 

• increasing the percentage of software that is shipped in a secure

initial configuration.

Fostering a Reinforcing Economic and Social Framework To enhance and maintain the security of cyber systems, the laws andcustoms of the society in which those systems exist must reinforce security in a sustainable way. Mechanisms that help reinforce security are lawsaddressing cybercrime, rules and bodies facilitating the sharing of information, and organizations training and educating a security workforce.Adherence to fundamental principles, such as recognition of the role ofmarket forces and the importance and centrality of maintaining privacy,help sustain the other enforcing mechanisms. The Strategy aims to fostera social and economic framework that accepts and reinforces security in anatural and sustainable way.

AwarenessIn many cases, solutions to cybersecurity issuesexist, but the people that need them do not knowthey exist or do not know how or where to find them.In other cases, people may not even be aware of the needto make a network element secure. A small business, forexample, may not realize that the configuration of its web serveruses a default password that allows anyone to gain control of thesystem. Education and outreach play an important role in makingusers and operators of cyberspace sensitive to security needs. Theseactivities are an important part of the solution for almost all of theissues discussed in this Strategy, from securing digital control systems inindustry, to securing the cable modem at home.The strategic goal for awareness is to stimulate actions to secure cyberspace by creating an understanding at all audience levels of both cybersecurity issues and solutions. This can be accomplished by doing the following:

• building upon and expanding existing efforts to direct the attention of key corporate decision makers (e.g., CEOs and members

of boards of directors) to the business case for securing theircompanies information systems;

• implementing plans to focus key decision makers in State and

local governments (e.g., governors, State legislatures, mayors,city managers, county commissioners/boards of supervisors) tosupport investment in information systems security measures andadopt enforceable management policies and practices;

• educating the general public of home users, students, children, and

small businesses on basic cyberspace safety/security issues; and,

• elevating the exposure of cybersecurity issues and available

resources by communicating through, and partnering with, localorganizations, and primary and secondary schools.

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

DRAFT 41
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

the nation needs a talented and

ell trained. While the need for this

ansion of the Internet and the perva

d other cyber devices, the investment

sities are turning out fewer engi

r resources are dedicated to other

nces. Though computer networks are

d security issues surrounding them

ondary students are taught courses

nd must be reversed if the United

ber economy.

p and sustain a well-trained, highly

n technology (IT) security 

’s growing needs; and (2) to establish

on a basic proficiency in cybersecurity

ay be achieved through the following:

veloped by State and local govern

overing cyber awareness, literacy,

uding ethical conduct in cyberspace,

cation;

 to increase the number of four-year

h high-quality IT security programs

ities for skills training in IT security

ms, vocational schools, junior

utes;

ce academy which would link 

mputer forensics training programs;

T security career fields and sub

vernment and each of the sectors of

exist for continuing education and

rkplace to maintain high skills stan

novate. 

CertificationRelated to education and training is the need for certification of qualifiedpersons. Certification provides employers and consumers with greaterinformation about the capabilities of potential employees or securityconsultants. Currently, some certifications for cybersecurity workers exist;however, they vary greatly in the requirements they impose. For example,some programs emphasize broad knowledge verified by an extensivemultiple choice exam, while others verify in-depth practical knowledge ona particular cyber component. No one certification offers a level of assurance about a person’s practical and academic qualifications, similar tothose offered by the medical, legal, and accounting professions. The strategic goal is to develop a nationally recognized standard for certification of information technology security professionals that could ensureconsistent and competent assessment and maintenance of IT systems andnetworks. This may be accomplished by:

• enhancing existing programs and developing new capabilities,

where necessary, to create a peer certification standard for ITsecurity professionals similar to accounting, medical, and law certification processes. Certification could include advanceddegrees and a nationwide standards exam, administered by aprofessional organization, to certify IT consultants and to serve as a standard for those hired by private companies;

• developing an accrediting body to verify that the various certification programs meet a minimum standard for System

Administrator level and similar positions; and, 

• requiring such certification before the Federal government hires

certain levels of IT professionals and, over time, for currentemployees.

Information SharingThe nation must be able to detect and analyze cyber incidents andattacks in a timely manner. The voluntary sharing of information aboutsuch incidents or attacks is vital to cybersecurity. Real or perceived legalobstacles make some companies hesitant to share information aboutcyber incidents with the government or with each other. First, some fearthat shared data that is confidential, proprietary, or potentially embarrassing may become subject to public examination when shared with thegovernment. Second, concerns about competitive advantage may impedeinformation sharing between companies within an industry. Finally, insome cases, the mechanisms are simply not yet in place to allow efficientsharing of information.

The strategic goal is to increase the voluntary sharing of informationabout cybersecurity between public and private sector entities, as well asamong private sector entities. This goal may be accomplished by:

• enhancing existing mechanisms for information sharing to ensure

that they are sufficient and cover all necessary informationsources; and,

• creating a legal and political environment for the sharing of critical information that removes uncertainty around how shared

information might be used.

CybercrimeOnce incidents are detected, they must be addressed. A rapid responsecan stem the tide of an ongoing attack and lessen the harm that is ultimately caused. The nation currently has laws and mechanisms to ensurequick responses to large incidents. Response also includes analyzing anddisseminating practical information to owners and users affected by theincident. This is followed, ideally, by investigation, arrest, and prosecutionof the perpetrators, or, in the case of state-sponsored actions, by a diplomatic or military response. Unfortunately, some incidents are notreported, and, even when they are, cannot be responded to effectively bylocal authorities due to lack of training or experience. State and local lawenforcement capabilities vary significantly.The strategic goal is to prevent, deter, and significantly reduce cyberattacks by ensuring the identification of actual or attempted perpetratorsfollowed by an appropriate government response, which in the case ofcybercrime includes swift apprehension, and appropriately severe punishment. This can be accomplished by the following means: 

• improving information sharing and investigative coordination

within the Federal, State, and local law enforcement communityworking on critical infrastructure and cyberspace securitymatters, and with other agencies and the private sector;

• continuing to assess the adequacy of Federal sentencing guidelines penalties for cybercrime to ensure appropriate punishment

for cyber offenses; 

• empowering Federal, State, and local law enforcement by 

exploring means to provide sufficient investigative and forensicresources and training to facilitate expeditious investigation andresolution of critical infrastructure incidents;

• developing better data about victims of cybercrime and 

intrusions; and,

• working internationally to ensure that appropriate tools are 

available to respond to cyber incidents.

DRAFT
n of private and unregulated

has made the Internet and,

t infrastructure that it is

ortant component of the

ke it secure, reliable, and

uires additional investment

of elements of cyberspace. 

made is for the market to

uire it. In some instances,

courage private participa

nce of cybersecurity,

d procurement of govern

 Efforts should be made to

 be effective. Cybersecurity

ere is an overriding need to

e American people.

n the market while

oal may be accomplished by:

 industry standard setters to

nce industry to facilitate

ms for cybersecurity;

curity preparedness, and

ough self-regulating 

ges; and, 

ducts and services through

ctor.

the core values of its open

s expect government and

from abuse. This respect for

 accordingly, one of the

rity, reliability, availability,

protect the privacy and civil

n their personal information

al, the National Strategy

e section of the Strategy,

 toward solutions that both

iberties. 

The strategic goal is to achieve security in cyberspacewithout infringing on individual privacy and civil liberties. Thisgoal can be accomplished through the following steps:

• continuing government commitment to rigorous enforcement of

existing laws protecting privacy and civil liberties;

• consulting regularly with privacy advocates, industry experts, and

the public at large to ensure broad input into, and considerationof, privacy issues in implementing the National Strategy toachieve solutions that protect privacy while enhancing networkand host security;

• expanding current annual GISRA audits to incorporate a privacy

review for each Federal agency; 

• encouraging industry to voluntarily incorporate appropriate

privacy protections into their planning and products; 

• ensuring that the Federal government leads by example in implementing strong privacy policies and practices in the agencies; and, • educating end-users about privacy issues and policies, and

encourage them to make informed choices about privacy.

Developing National Plans and PolicyThe final category of national-level issues involves the nation’s planningand policies for addressing organized efforts to attack the cyber infrastructure, and for situations in which the infrastructure fails, whether dueto attack or a natural occurrence. The consequences of such a failuremust be thoroughly understood. Because critical infrastructures are highlyinterconnected, these consequences can be complex and complicated tomodel. Once understood, the nation must have a plan to respond tomajor incidents efficiently and effectively. A discussion of four importantaspects of the nation’s policies and plans follows.Analysis and WarningThe nation’s ability to respond to cyber outages or attacks depends, first,on its ability to detect incidents early. Today, multiple organizations, bothgovernment and private, collect information about events and newvulnerabilities that occur on the Internet and connected networks andinformation systems. Organizations are also in place to disseminate thisinformation to those who need it to help mitigate potential negativeimpacts. Some industry sectors have information sharing and analysiscenters (ISACs) to spread early-incident information to all companies inthat sector. ISACs and government share information on a two-way basis. 

Despite progress being made in detectionand information dissemination, some gapsremain. Internet service providers, (ISPs), and thenation as a whole, do not have a single collection anddissemination point for issuing warnings of incidents.There is no clearly defined, joint incident response procedureor team. Forward looking analysis capabilities are sparse andsuffer from lack of information. Moreover, incident information isoften source sensitive and may have national security implications.The strategic goal is to detect incidents at their earliest inception; torespond to them efficiently; and, to the extent possible, predict them inadvance. This goal can be accomplished by:

• exploring the development of a national cyberspace network

operations center;

• improving government data analysis capabilities including

increased use of data from agencies;

• encouraging expanded sharing and analysis of data by publicprivate entities; and, • facilitating the improvement and expansion of incident response

capabilities.

Continuity of Operations, Reconstitution and RecoveryThe nation could benefit from an integrated public-private plan forresponding to significant outages or disruptions in cyberspace. Manyorganizations have plans for how they will recover their cyber networkand capabilities in the event of a major outage or catastrophe. However,there is no mechanism for coordinating such plans across the private andpublic sectors.The strategic goal is to provide for a national plan for continuity of operations, recovery, and reconstitution of services during a widespread outageof information technology systems in one or more sectors. Accomplishingthis goal is possible through public-private efforts that will:

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE DRAFT 43
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

date the development of 

ans, including a plan for recovering

would warrant the implementation of

 Internet recovery plans; and,

nd recovery plans on a regular basis.

g foreign governments and terrorist

ks of national security concern. In

nduct espionage on our government,

te companies. They may also seek to

frontation by mapping U.S. informa

lacing our infrastructure with back

wartime or crisis, adversaries may

al leaders by attacking critical infra

ns or eroding public confidence in

ttempt to slow the U.S. military

e Department of Defense, the intelli

ment organizations as well as critical

ational security posture in cyber

s to pressure the United States and

d. The National Security Council,

ent of Justice, the intelligence

ments and agencies should:

local governments and the private

’s overall cybersecurity posture;

igence posture to counter cyber

 against the U.S. Government, and

 organizations;

o quickly attribute the source of

ns, seeking to develop the capability

ttacks occur;

cident response coordination to

ong law enforcement agencies,

nd defense agencies; and,

• continue to reserve the right to respond in an appropriate

manner when U.S. vital interests are threatened by attacksthrough cyberspace.

When a nation, terrorist group or other adversary attacks the UnitedStates through cyberspace, the U.S. response need not be limited to criminal prosecution or even to information warfare means. The United Statesreserves the right to respond in an appropriate manner when its vitalinterests are threatened by attacks through cyberspace, just as it wouldwith any other kind of aggression.Interdependency and Physical SecurityWhen damage occurs to one infrastructure, others are often affected.Events in cyberspace can impact systems in physical space, and vice versa.A train derailed in a Baltimore tunnel and the Internet slowed in Chicago.A campfire in New Mexico damaged a gas pipeline and IT-related production halted in Silicon Valley. A satellite spun out of control hundreds of milesabove the Earth and affected bank customers could not use their ATMs.Cyberspace also has physical manifestations: the buildings and conduitsthat support telecommunications and Internet networks. These physicalelements have been designed and built to create redundancy and avoidsingle points of failure. Nonetheless, the carriers and service providersshould independently and collectively continue to analyze their networksto strengthen reliability and intentional redundancy. The FCC, through itsNational Reliability and Interoperability Council (NRIC), and the Boardthrough the National Security Telecommunications Advisory Committee(NSTAC), can contribute to such efforts and should identify any governmental impediments to strengthening the national networks. The strategic goal for interdependency and physical protection of cyberspace is to mitigate the potential negative effects that the disruption ofone infrastructure might have on another. Attaining this goal may be accomplished through government and privateindustry efforts to:

• foster information sharing between owners of critical 

infrastructure, government, and private groups that are workingto model systems and develop solutions;

• develop a robust national modeling capability for critical 

infrastructure interdependencies; and, 

• create awareness among cyber infrastructure owners and 

operators of the potential impacts that the loss of the infrastructure might have on others, and steps to minimize negative effects.

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

45

AGENDA

LEVEL 4: National Priorities

ONS

nd nongovernment 

cybersecurity.*

efine and accelerate the

rder Gateway Protocol,

em, and others. 

perfect and accelerate the

nology and management,

 with Tier 1 companies or

er adopting a “code of good

ty practices, including their

e another.

entify and address fundamental

sibly making use of the existing

a fund for such activities.

as a high priority, develop

o increase security of digital

rol and data acquisition

turing, and other networks. 

 partnership, should determine

tes and develop a prioritized

rovements in those sites.

pting the Department of

ecurity of SCADA Networks.”

’s Critical Infrastructure

ertake a comprehensive

mechanisms for outreach, iden

ch and development among

 The committee will complete

tions on the need to reform,

s to the PCIPB in February

ate with the Director of OSTP

an annual basis to define a

arch and development

term (3-5 years), and later (5

arch. 

R4-9 Federally funded near-term IT security research and development

for FY04 and beyond should include priority programs identifiedby OSTP and the R&D Committee. Existing priorities include,among others, intrusion detection, Internet infrastructure security(including protocols such as BGP, DNS), application security, denialof service, communications security (including SCADA systemencryption and authentication), high assurance systems, andsecure system composition. 

R4-10 The private sector should consider including in near-term research

and development priorities, programs for highly secure and trustworthy operating systems. If such systems are developed andsuccessfully evaluated, the Federal government should accelerateprocurement of such systems.

R4-11 Federally and privately funded research and development should

include programs to examine the security implications of emergingtechnologies.

R4-12 Federal departments and agencies must be especially mindful of

security risks when using wireless technologies. Federal agenciesshould consider installing systems that continuously check forunauthorized connections to their networks. Agencies should carefully review the recent NIST report on the use of wirelesstechnologies and take into account NIST recommendations andfindings. In that regard, agency policy and procedures shouldreflect careful consideration of additional risk reduction measuresincluding the use of strong encryption, bi-directional authentication, shielding standards and other technical security considerations,configuration management, intrusion detection, incident handling,and computer security education and awareness programs. 

R4-13 Government and industry should actively promote awareness for

individuals, enterprises, and government of the security issuesinvolved in the adoption of wireless technologies, especially thoseutilizing the 802.11b standard and related standards. Industry andgovernment should work closely together to promote thecontinued development of improved standards and protocols forwireless LANs that have built-in, transparent security.

R4-14 A voluntary, industry-led, national effort should consider developing a clearinghouse for promoting more effective software

patch implementation. Such an effort may include increasedexchange of data about the impact that patches may have oncommonly used software systems, including, where practicable,the results of testing.

R4-15 The software industry should consider promoting more secure

“out-of-the-box” installation and implementation of their products, including increasing: (1) user awareness of the securityfeatures in products; (2) ease-of-use for security functions; and, (3)where feasible, promotion of industry guidelines and best practices that support such efforts.

R4-16 A national public-private effort should promulgate best practices

and methodologies that promote integrity, security and reliabilityin software code development, including processes and proceduresthat diminish the possibilities of erroneous code, malicious code,or trap doors that could be introduced during development. 

R4-17 The PCIPB’s Awareness Committee, in cooperation with lead agencies, should foster a public-private partnership to develop and

disseminate cybersecurity awareness materials, such as audiencespecific tools and resources for annual awareness training.

R4-18 The StaySafeOnline campaign should be expanded to include

national advertising aimed at several audience groups. It shouldalso develop materials for schools, and companies.

R4-19 States should consider creating Cyber Corps scholarship-for-service

programs at State universities, to fund the education of undergraduate and graduate students specializing in IT security andwilling to repay their grants by working for the States. Theexisting Cyber Corps scholarship-for-service program should beexpanded to additional universities, with both faculty development and scholarship funding. The program should also add afaculty and program development effort for community colleges.

R4-20 The CIO Council and Federal agencies with cybersecurity training

expertise should consider establishing a Cyberspace Academy,which would link Federal cybersecurity and computer forensicstraining programs.

R4-21 Public and private research labs across the nation should explore

the benefits of establishing programs like the Cyber DefendersProgram at the Department of Energy’s Sandia NationalLaboratory.

R4-22 The PCIPB’s Committee on Training should explore the potential

benefits of establishing a multi-department corps of IT and cybersecurity specialists taking maximum advantage of innovative,efficient, and flexible human resource programs.

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

AGENDA

LEVEL 4: National Priorities

anizations should consider developing

r primary and secondary school

ety, and security. 

d IT security associations and organiza

aches to, and the feasibility of,

ification program, including a contin

ng program. 

utive Branch should work together to

ormation sharing about cybersecurity

ilities between the public and private

es should develop a strategy to

porations to report incidents of cyber

authorized intrusions. In addition, this

mechanisms which facilitate such

hould continue to improve coordina

ybercrime investigations and consider

Forces.

g and investigative coordination within

l law enforcement community working

d cyberspace security matters, and with

vate sector. 

ould collect survey data regarding

businesses, organizations, and individ

blish a baseline understanding of the

re effectiveness.

ould review the level of training and

and local law enforcement for forensic

 address critical infrastructure incidents

ould continue to assess the Federal 

e if they are adequate for cybercrime.

king with OMB and in partnership with

e governments, should review Federal

laws that impede market forces from

ybersecurity.

R4-33 The PCIPB’s Financial and Banking Information Infrastructure

Committee (FBIIC), working with the insurance industry, shouldexplore the options for developing an effective risk-transfer mechanism for cybersecurity, including improving risk modeling andavailability of loss data. 

R4-34 Corporations should consider annually disclosing the identity of

their IT security audit firm and the general scope of its work, thecorporate and board governance system for IT security, companyadherence to IT security best practices or standards, and corporateparticipation in ISACs and other IT security programs.

R4-35 The President’s Board, working with the Institute of Internal

Auditors and Corporate Board Members Association and similargroups should continue and enhance the effectiveness ofprograms of awareness and best practices.

R4-36 The Executive branch should consult regularly with privacy advocates, industry representatives and other interested organizations

to facilitate consideration of privacy and civil liberties concerns inthe implementation of the National Strategy, and to achieve solutions that protect privacy while enhancing network and hostsecurity. 

R4-37 As part of the annual departmental IT security audits, agencies

should include a review of IT related privacy regulation compliance.

R4-38 The appropriate Federal agencies should consider reviews of the IT

security issues related to the implementation of the Gramm,Leach, Bliley Financial Modernization Act and the Health InsurancePortability and Accountability Act.

R4-39 ISPs, hardware and software vendors, IT security-related companies, computer emergency response teams, and the ISACs,

together, should consider establishing a Cyberspace NetworkOperations Center (Cyberspace NOC), physical or virtual, to shareinformation and ensure coordination to support the health andreliability of Internet operations in the United States. Although itwould not be a government entity and would be managed by aprivate board, the Federal government should explore the ways inwhich it could cooperate with the Cyberspace NOC.

R4-40 The Federal government should complete the installation of the

Cyber Warning Information Network (CWIN) to key governmentand nongovernment cybersecurity-related network operationcenters, to disseminate analysis and warning information andperform crisis coordination.

R4-41 Industry, in voluntary partnership with the Federal government,

should complete and regularly update cybersecurity crisis contingency plans, including a recovery plan for Internet functions.

R4-42 The Federal government should review emergency authorities and

determine if the existing authorities are sufficient to supportInternet recovery.

R4-43 The United States should establish a vigorous program to counter

cyber-based intelligence collection against U.S. government,industry, and university sites.

R4-44 The National Security Council should lead a study to improve

understanding of incident response coordination for significantcyber attacks among law enforcement agencies, national securityagencies, and defense agencies.

R4-45 The United States should continue to improve its ability to quickly

attribute the source of threatening attacks or actions, seeking todevelop the capability to suppress threats before attacks occur.

R4-46 The United States should continue to reserve the right to respond

in an appropriate manner when its vital interests are threatenedby nation-states or terrorist groups engaged in cyber attacks.

R4-47 Public-private partnerships should identify cross-sectoral interdependencies both cyber and physical. They should develop plans to

reduce related vulnerabilities, in conjunction with programsproposed in the National Strategy for Homeland Security. The

National Infrastructure Simulation and Analysis Center shouldsupport these efforts.

R4-48 Owners and operators of information system networks and

network data centers should consider developing remediation andcontingency plans to reduce the consequences of large-scale physical damage to facilities supporting such networks. Whererequested, the Federal government could help coordinate suchefforts and provide technical assistance.

R4-49 Owners and operators of information system networks should,

possibly working with the Federal government on a voluntarybasis, develop appropriate procedures for limiting access to criticalfacilities.

*Note: The feasibility and cost effectiveness of these recommendations will vary across

entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them.

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

TITLE AGENDA LEVEL 4: National Priorities

S

, debate, and discussion.

academia address issues

and operators of cyberspace

quate incentive to act?

t for routers be implemented

sts and benefits? 

reach programs to reach all

nity to increase awareness of

tigation measures? 

should such programs include 

skills necessary to improve

which existing knowledge,

der Federal R&D funding are

eeds, must be enhanced. The

r, the adoption of new secu

r, especially the vendor

f discussion for a private /

s could effectively be applied

g and emerging security tech

privacy implications of

ess LANS?

h emerging technology

re of the vulnerabilities associ

courage vendors to make

ge user?

iculum for software engineers

g practices? 

D4-9 Is there an appropriate way to define standard time limits for the

patching of systems?

D4-10 What metrics should be used to measure cybersecurity awareness

for various audiences and the effectiveness of cybersecurity warnings?

D4-11 What roles can private citizens play in raising awareness about

cybersecurity?

D4-12 How can government and private industry establish programs to

identify early students with a demonstrated interest in and/ortalent for IT security work, encourage and develop their interestand skills, and direct them into the workforce?

D4-13 How can government and industry identify national training and

education standards for cybersecurity professions that will meetthe demands of U.S. enterprises?

D4-14 Should an accrediting body be created that would set a baseline

standard for system administrator-level security knowledgerequirements?

D4-15 Should other levels of the IT security profession be considered for

peer certification or accreditation?

D4-16 Should the Federal government provide support to ISACs such as

funding, technical tools or facilities?

D4-17 How may victims rights groups aid in creating greater awareness

about the potential dangers of cybercrime?

D4-18 Is there a gap between Federal, State, and local laws on cybercrime? If so, what are the implications?D4-19 What lessons can be learned from the “Basel Accord” that might

drive cybersecurity improvements in other infrastructures?

D4-20 Should there be a review of State and Federal requirements for

disclosure of information which could help potential attackers;e.g., State filings?

D4-21 How can industry be encouraged to incorporate appropriate

privacy protections into their planning and products, using flexible, non-regulatory approaches? 

D4-22 How can government organizations work to facilitate harmonious

approaches in privacy across jurisdictional boundaries?

D4-23 How can the Federal government and the private sector develop

people with the ability to “deep dive” data and detect patterns of attack?

D4-24 It took over four decades to develop an indications and warning

capability for conventional and nuclear threats. How can theUnited States develop a similar “incidents and warning” architecture to protect against cyber threats that would be highly effective?

D4-25 Is there a need for a new authority, which is not anchored in war

mobilization and national defense, to manage priority delivery ofgoods and services for critical infrastructure purposes?

D4-26 Identifying the key infrastructure interdependencies requires an

active discussion between the public and private sectors. Whatprocesses should be established to help shape how the Federalgovernment prioritizes and funds interdependency and vulnerability studies?

D4-27 Because cyber attacks can be launched from anywhere in the

world, it is important to develop capabilities to rapidly determinethe origin of an attack or exploit in order to respond effectively.This capability, commonly referred to as “attribution,” is central todetermining if an attack is sponsored by a foreign power. How cangovernment and industry analysts enhance attribution capabilitiesin order to more rapidly identify the source of an attack?

D4-28 How can the national security community enhance the discipline

of counter intelligence analysis to better support cyberspace security?

DRAFT 47
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
onal community to ensure

ks that support critical U.S.

This goal can be achieved

es will:

national network to identify

 they begin;

te cybersecurity laws so that

and prosecute cybercrime

and its interests, whether it

ons to foster a “Culture of

ng-term security of the

, 

f common international

ure the security of global

tends well beyond its bor

res are directly linked with

erica. The nation’s economy

ions, military forces, and

ecure and reliable global

jority of cyber attacks origi

es several borders, and

 call to the national security

Solar Sunrise,” this incident

sault, with computer sys

t source. Unclassified logis

sential to the management

ated at a time that military

o its failure to comply with

e of weapons of mass

destruction. The timing of the attacks raised U.S. suspicionthat this was the first wave of a major cyber attack by ahostile nation.It was eventually learned that two California teenagersunder the guidance and direction of a sophisticated Israelihacker, himself a teenager, had orchestrated the attacksusing hacker tools readily available on the Internet. Theyhad attempted to hide their involvement by connectingthrough overseas computers. Even cybercrimes committedby Americans against U.S. computers often have an international component. Another event illustrated the threat to the global economyno less starkly. Early in February 2000, computer servershosting several of the largest commercial web sites on theInternet were flooded with connection requests, whichclogged systems and consumed server capacity. Ultimately,these distributed denial-of-service (DDoS) attacks paralyzed large parts of the Internet. Only through close cooperation between U.S. and Canadian law enforcementinvestigators was it discovered that a Canadian teenager,operating under the moniker of “Mafiaboy,” had been breaking intolegions of computers around the world for many months. Retaining control over these compromised servers, he created a “zombie army” whichon command would flood the servers of his next corporate victim. Theslowdowns and outages that occurred resulted in more than an estimatedbillion dollars in economic losses.Only a few months later, on the morning of May 4, 2000, the “I loveyou” virus began infecting computers around the globe. First detected inAsia, this virus quickly swept around the world in a wave of indiscriminateattacks on government and private sector networks. By the time thedestructive pace of the virus had been slowed, it had infected nearly 60million computers and caused billions of dollars in damage. Cooperationamong law enforcement authorities around the world led to the identification of the perpetrator, a computer science dropout in the Philippines.

He was neither charged nor punished for his deeds because, at the time,the Philippine criminal code did not explicitly outlaw such actions.Together, these incidents make clear that U.S. domestic efforts alone cannot deter or prevent this tide of attacks. We must work closely with ourinternational partners to put into place those cooperative mechanismsthat can help prevent the damage resulting from such attacks; and if prevention fails, have those instruments in place that can help us to investigate and prosecute such crimes.

Discussion of StrategyThe United States will promote a wide range of initiatives to enhancecyberspace security globally and will disseminate key policy messagesthrough the full array of bilateral, multilateral and international fora, asappropriate. These initiatives will: build real-time, “24/7” watch-andwarning networks to identify incidents and stop them; establish and link anetwork of cyberspace security coordinators in each nation; use international

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

LEVEL 5: GLOBAL

DRAFT 49
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

he principles and standards essential

space security; assist nations in devel

s to effectively investigate and prose

orders; and foster collaboration

n long-term solutions to cybersecurity. 

tional Coordination

t three years, the United States has

 on the issue of cyberspace security.

sure that international coordination in

s is institutionalized. We will encour

watch-and-warning network capable

he public, and other countries about

tate real-time sharing of the threat

United States will foster the estab

 capable of receiving, assessing, and

ly. Such a network will build on the

tutions such as the Forum of Incident

and such long-standing international

e International Telecommunication

ion is a member together with over

s

on to build on the common Y2K

 point-of-contact who can act as a

cybersecurity efforts. Establishing

nhance the international coordination

 issues.

rity

uring that North America will be a

ada and Mexico to identify best prac

 connected information networks that

 transportation, and banking and

od, public health, and water systems,

d solutions to ensure the integrity and

mericans way of life.

Working Through International OrganizationsCombating Cybercrime: The United States will actively foster international cooperation in investigating and prosecuting cybercrime. Ongoingmultilateral efforts, such as those in the G-8, Asia-Pacific EconomicCouncil (APEC), Organization of Economic Cooperation and development,and the Council of Europe, are important to success in this area. TheUnited States will work to implement agreed-upon recommendations andaction plans that are developed in these fora. Among these initiatives, theUnited States in particular will urge countries to join the 24-hour, hightech crime contact network begun within the G-8, and now expanded tothe Council of Europe membership, as well as other countries.The United States has signed and supports the recently concluded Councilof Europe Convention on Cybercrime, which requires countries to makecyber attacks a substantive criminal offense and to adopt procedural andmutual assistance measures to better combat cybercrime across international borders. The United States will encourage other nations to accedeto the Convention or, at a minimum, make their laws consonant withthese requirements. Efforts to Develop Secure Networks: To ensure the security ofinformation systems and to promote the sharing of important knowledge,the United States will engage in cooperative efforts to solve technical, scientific, and policy-related problems connected with assuring the integrityof information networks. Key initiatives will encourage the development

and adoption of international technical standards and facilitate collaboration and research among the world’s best scientists and researchers. The United States will also promote such efforts as the Organization for Economic Cooperation and Development (OECD), Guidelines for theSecurity of Information Systems and Networks, which strive to inculcate a “culture of security” across all participants in the new information society. Because most nations’ key information infrastructures reside in privatehands, the United States will seek the participation of U.S. industry toengage foreign counterparts in a peer-to-peer dialogue, with the twinobjectives of making an effective business case for cybersecurity, andexplaining successful means for partnering with government on cybersecurity.

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

51

government 

curity.

ion with the private

tions and with non

nizations to foster

ernational watch

prevent cyber

uch networks could

d respond to those

ations to accede to

on on Cybercrime,

dures are at least as

er with Canada andt practices for

h American infor

h international

 industry to facili

n foreign public

rastructure protec

e of security.” 

oint a national

he global science

aborative research

PROGRAMS

Existing efforts in cybersecurity.

P5-1 Involvement in Multi-lateral Organizations: The United

States has had great success promoting cybersecurity in conjunction with other nations through participation in multilateral organizations such as the G-8 and the Council ofEurope (COE), and such involvement will continue. 

P5-2 Support for COE Convention: The United States has, and

will continue to recruit countries to accede to theConvention or to enact procedural and substantive cybercrime laws at least as comprehensive as the Convention. 

P5-3 Bilateral Discussions: The United States has contributed to

significant improvements in the cybersecurity of othernations and the cooperation of those nations with U.S.law enforcement efforts, by conducting bilateral discussions that encourage countries to improve legal systemsand foster bilateral cooperation in cybercrime prevention,investigation, and prosecution. 

P5-4 Advisory and Educational Outreach: The United States has

advised countries developing procedural and substantivecybercrime laws and provided educational seminarsregarding the virtues and benefits of an adequate cybercrime legal regime. The United States also providestraining and technical assistance to foreign law enforcement to improve their capacity to cooperate in fightingcybercrime.

P5-5 International Watch-and-Warning Networks: The United

States participates in international networks, one ofwhich was established by the National InfrastructureProtection Center, to detect early and prevent cyberattacks that cross international borders. 

P5-6 International Law Enforcement Networks: The United States

participates in international networks, such as the “24-HourContacts for International High-Tech Crime” maintained bythe G-8, to investigate and prosecute the perpetrators ofcyber attacks that cross international borders. 

AGENDA

LEVEL 5: GLOBAL

DISCUSSIONS

Issues highlighted for continued analysis, debate, and discussion.

D5-1 What role should the private sector play to best 

assist developing countries in establishing a “culture of security?”

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT
LL BUSINESS 

scan the Internet for unpro

it, those home users and

SL or cable modem should

t. (Some Internet service

with DSL or cable modem

ed, it is important to regu

 web site. 

oduced every week, home

arly ensure that they are

m.” (Some antivirus vendors

nternet service providers

ore the e-mail gets to the

ail, home users should use

nown senders, particularly

number of unknown

ng software that controls

m.” (Some ISPs offer 

o offer to block all incoming

ssociates that the user

e their personal computer’s

indows, Macintosh, Linux)

browses the Internet or cre

 security enhancements by

software vendors offer auto

ware companies, and oper

opers should consider joint

user and small business to

utomatically and in a timely

o home users about updates

LEVEL 2:

LARGE ENTERPRISES

R2-1 CEOs should consider forming enterprisewide corporate security

councils to integrate cybersecurity, privacy, physical security, andoperational considerations.

R2-2 CEOs should consider regular independent Information Technology

(IT) security audits, remediation programs, and reviews of “bestpractices” implementation.

R2-3 Corporate boards should consider forming board committees on IT

security and should ensure that the recommendations of the chiefinformation security official in the corporation are regularlyreviewed by the CEO.

R2-4 Corporate IT continuity plans should be regularly reviewed 

and exercised and should consider site and staff alternatives.Consideration should be given to diversity in IT service providers as a way of mitigating risks.

R2-5 Corporations should consider active involvement in industrywide

programs to: (a) develop IT security best practices and procurementstandards for like companies; (b) share information on IT securitythrough an appropriate information sharing and analysis center(ISAC); (c) raise cybersecurity awareness and public policy issues;and, (d) work with the insurance industry on ways to expand theavailability and utilization of insurance for managing cyber risk. 

R2-6 Corporations should consider joining in a public-private partnership

to establish an awards program for those in industry making significant contributions to cybersecurity.

R2-7 (1) Enterprises should review mainframe security software and procedures to ensure that the latest effective technology and procedural measures are being utilized; (2) IT vendors and enterprises

employing mainframes should consider developing a partnership toreview and update best practices of mainframe IT security and toensure that there continues to be an adequate trained cadre ofmainframe specialists; and (3) IT security audits should include comprehensive evaluations of mainframes.

LEVEL 3: CRITICAL SECTORS THE FEDERAL GOVERNMENT

R3-1 In order to enhance the procurement of

more secure IT products, the Federal government, by 4Q FY03, will complete a comprehensive program performance review of the NationalInformation Assurance Program (NIAP), to determine the extent to which NIAP is cost effective andtargets a clearly identified security gap; whether it hasdefined goals to close the gap, whether it is achievingthose goals, and the extent to which program improvements, streamlining, or expansion are appropriate and costeffective. 

R3-2 The Federal government, by 3Q FY03, will assess whether private

sector security service providers to the Federal government shouldbe certified as meeting certain minimum capabilities.

R3-3 The Federal government, by 3Q FY03, using the E-Government

model, will explore the benefits (including reducing resource pressures on small agencies) of greater cross-government acquisition,operation, and maintenance of security tools and services. 

R3-4 Through the ongoing E-Authentication initiative, the Federal government, by 2Q FY03, will explore the extent to which all departments

can employ the same physical and logical access control tools andauthentication mechanisms to further promote consistency and interoperability. 

R3-5 Federal departments should continue to expand the use of automated, enterprise-wide security assessment and security policy

enforcement tools and actively deploy threat management tools topreempt attacks. By 2Q FY03, the Federal government will determine whether specific actions are necessary (e.g., through the policy or budget processes) to promote the greater use of these tools. 

R3-6 The Federal government will continue to assess the technical viability and cost effectiveness of various options that provide for the

continuity of operations during service outages such as VPNs, “private line” networks, and others. 

 RECOMMENDATIONS*

NATIONAL STRATEGY TO SECURE CYBERSPACE

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

53

SUMMARY OF RECOMMENDATIONS

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

d lead in the adoption of secure net

overnment will review new secure net

blished to determine whether they fill a

 adoption would have a cost-effective

security of the Federal government. 

ederal government will consider the

o-based security and contingency pre

ted cross-government business

se take place any security weaknesses

gencies’ GISRA corrective action plans. 

 CIO council,will determine on a case

oy a lead agency concept for govern

The alternatives will generally include

rtment of Homeland Security, and the

ICAL SECTORS

L GOVERNMENTS

should consider establishing IT security

nts and agencies, including awareness,

ounty, and city associations should

 materials, and model programs.

should consider participating in the

ng and analysis centers (ISACs) with

should consider expanding training

or law enforcement officials, includ

police. The Federal government could

ining and explore whether funding

ICAL SECTORS

DUCATION

ould consider establishing a point-of

s, to Internet service providers (ISPs)

 in the event that the school’s IT sys

nching cyber attacks. 

ld consider establishing together: (a)

ing and analysis centers (ISACs) to

ulnerabilities; (b) model guidelines

n Officers (CIOs) to address cybersecu

t practices for IT security; and, (d)

ams and materials.

LEVEL 3: CRITICAL SECTORS 

PRIVATE SECTORS

R3-15 Each sector group should consider establishing an information sharing and analysis center (ISAC) that should cooperate with other

ISACs. The Federal government will explore linking the ISACs withappropriate cybersecurity warning-and-analysis centers uponrequest, and could facilitate the provision of information related tocritical infrastructure protection when necessary. 

R3-16 Each sector group should consider conducting a technology and

R&D gap analysis, in conjunction with OSTP efforts to prioritizeFederal cybersecurity research to address identified gaps. The sectors and OSTP should coordinate on the conduct of such research. 

R3-17 Each critical infrastructure sector group should consider 

developing best practices for cybersecurity and, where appropriate,guidelines for the procurement of secure IT products and services.

R3-18 Each sector group should consider working together on sector specific information security awareness campaigns.R3-19 Each sector should consider establishing mutual assistance programs for cybersecurity emergencies. The Department of Justice

and the Federal Trade Commission should work with the sectors toaddress any barriers with such cooperation.

LEVEL 4: NATIONAL PRIORITIES 

SECURING THE MECHANISMS OF 

THE INTERNET

R4-1 A public-private partnership should refine and accelerate the 

adoption of improved security for Border Gateway Protocol,Internet Protocol, Domain Name System, and others. 

R4-2 A public-private partnership should perfect and accelerate the

adoption of more secure router technology and management,including out-of-band management.

R4-3 Internet service providers, beginning with Tier 1 companies or

major access providers, should consider adopting a “code of goodconduct” governing their cybersecurity practices, including theirsecurity-related cooperation with one another.

R4-4 A public-private partnership should identify and address fundamental technology needs for the Internet, possibly making use of the

existing programs and potentially establishing a fund for such activities.

LEVEL 4: NATIONAL PRIORITIES

DCS/SCADA

R4-5 A public-private partnership should, as a high priority, develop best

practices and new technology to increase security of digital controlsystems and supervisory control and data acquisition systems(SCADA) in utilities, manufacturing, and other networks. 

R4-6 Government and industry, working in partnership, should determine the most critical DCS/SCADA-related sites and develop a prioritized plan for short-term cybersecurity improvements in those sites.

DCS/SCADA users should consider adopting the Department ofEnergy’s “21 Steps to Improve Cybersecurity of SCADA Networks.”

LEVEL 4: NATIONAL PRIORITIES

RESEARCH AND DEVELOPMENT

R4-7 The R&D committee of the President’s Critical Infrastructure

Protection Board (PCIPB) should undertake a comprehensive reviewand gap analysis of existing mechanisms for outreach, identificationand coordination of research and development among academia,industry and government. The committee will complete its workand present its recommendations on the need to reform, expand,or establish such mechanisms to the PCIPB in February 2003.

R4-8 The President’s Critical Infrastructure Protection Board should coordinate with the Director of OSTP and the board’s R&D Committee

on an annual basis to define a program of Federal governmentresearch and development including near-term (1-3 years), midterm (3-5 years), and later (5 years out and longer) IT securityresearch. 

R4-9 Federally funded near-term IT security research and development for

FY04 and beyond should include priority programs identified by OSTPand the R&D Committee. Existing priorities include among others,intrusion detection, Internet infrastructure security (including protocols e.g. BGP, DNS), application security, denial of service, communications security including SCADA system encryption and authentication,high assurance systems, and secure system composition. 

R4-10 The private sector should consider including in near-term research

and development priorities, programs for highly secure and trustworthy operating systems. If such systems are developed and successfully evaluated, the Federal government should accelerate procurement of such systems.

R4-11 Federally and privately funded research and development should

include programs to examine the security implications of emergingtechnologies.

DRAFT
NATIONAL STRATEGY TO SECURE CYBERSPACE

ORITIES

YSTEMS

t be especially mindful of

ologies. Federal agencies

continuously check for unau

 Agencies should carefully

e of wireless technologies

ations and findings. In that

hould reflect careful consid

asures including the use of

ntication, shielding standards

ons, configuration manage

ling, and computer security

ly promote awareness for

nt of the security issues

chnologies, especially those

ted standards. Industry and

her to promote the contin

ds and protocols for wireless

urity.

ORITIES

DIATION

 should consider developing a

tive software patch imple

ncreased exchange of data

 on commonly used software

e results of testing.

promoting more secure

mentation of their products,

s of the security features in

nctions; and, (3) where fea

and best practices that sup

promulgate best practices

rity, security and reliability

ng processes and procedures

ous code, malicious code, or

ring development. 

LEVEL 4: NATIONAL PRIORITIES

AWARENESS

R4-17 The President’s Critical Infrastructure Protection Board’s Awareness

Committee, in cooperation with lead agencies, should foster a public-private partnership to develop and disseminate cybersecurityawareness materials, such as audience-specific tools and resourcesfor annual awareness training.

R4-18 The StaySafeOnline campaign should be expanded to include

national advertising aimed at several audience groups. It shouldalso develop materials for schools and companies.

LEVEL 4: NATIONAL PRIORITIES

TRAINING AND EDUCATION

R4-19 States should consider creating Cyber Corps scholarship-for-service

programs at State universities, to fund the education of undergraduate and graduate students specializing in IT security and willing torepay their grants by working for the States. The existing CyberCorps scholarship-for-service program should be expanded to additional universities, with both faculty development and scholarshipfunding. The program should also add a faculty and programdevelopment effort for community colleges.

R4-20 The CIO Council and Federal agencies with cybersecurity training

expertise should consider establishing a Cyberspace Academy,which would link Federal cybersecurity and computer forensicstraining programs.

R4-21 Public and private research labs across the nation should explore

the benefits of establishing programs like the Cyber DefendersProgram at the Department of Energy’s Sandia National Laboratory.

R4-22 The PCIPB’s Committee on Training should explore the potential

benefits of establishing a multi-department corps of IT and cybersecurity specialists taking maximum advantage of innovative, efficient, and flexible human resource programs.

R4-23 State, local and private organizations should consider developing

programs and guidelines for primary and secondary school studentsin cyber ethics, safety, and security. 

LEVEL 4: NATIONAL PRIORITIES

CERTIFICATION

R4-24 IT security professionals, and IT security associations and organizations, should explore approaches to, and the feasibility of, establishing a rigorous certification program, including a continuing

education and retesting program. 

LEVEL 4: NATIONAL PRIORITIES

INFORMATION SHARING

R4-25 The Congress and the Executive Branch should

work together to remove impediments to information sharing about cybersecurity and infrastructure vulnerabilities between the public and privatesectors.

LEVEL 4: NATIONAL PRIORITIES CYBERCRIME

R4-26 Appropriate Federal agencies should develop a strategy to encourage citizens and corporations to report incidents of cybercrime,

cyber attacks and unauthorized intrusions. In addition, this strategycould also explore mechanisms which facilitate such reporting.

R4-27 The FBI and Secret Service should continue to improve coordination

of their field offices’ cybercrime investigations and considerexpanding pilot Joint Task Forces.

R4-28 Improve information sharing and investigative coordination within

the Federal, State, and local law enforcement community workingon critical infrastructure and cyberspace security matters, and withother agencies and the private sector. 

R4-29 The Federal government should collect survey data regarding victims of cybercrime (i.e., businesses, organizations, and individuals)

in order to better establish a baseline understanding of the problem and measure future effectiveness.

R4-30 The Federal government should review the level of training and

funding for Federal, State and local law enforcement for forensicand investigative efforts to address critical infrastructure incidentsand cybercrime.

R4-31 The Federal government should continue to assess the Federal sentencing guidelines to see if they are adequate for cybercrime.

0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

DRAFT 55
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

NAL PRIORITIES

T FORCES

g with OMB and in partnership with

overnments, should review Federal

ws that impede market forces from

ersecurity.

king Information Infrastructure

ith the insurance industry, should

oping an effective risk-transfer mecha

ng improving risk modeling and avail

annually disclosing the identity of

d the general scope of its work, the

nce system for IT security, company

practices or standards, and corporate

er IT security programs.

ucture Protection Board, working with

rs and Corporate Board Members

 should continue and enhance the

wareness and best practices.

NAL PRIORITIES 

CIVIL LIBERTIES

onsult regularly with privacy advocates,

ther interested organizations to facili

nd civil liberties concerns in the imple

tegy, and to achieve solutions that pro

etwork and host security. 

mental IT security audits, agencies

related privacy regulation compliance.

cies should conduct reviews of the IT

mplementation of the Gramm, Leach,

n Act and the Health Insurance

 Act.

LEVEL 4: NATIONAL PRIORITIES 

CYBERSPACE ANALYSIS AND WARNING

R4-39 ISPs, hardware and software vendors, IT security-related companies,

computer emergency response teams, and the ISACs, together,should consider establishing a Cyberspace Network OperationsCenter (Cyberspace NOC), physical or virtual, to share informationand ensure coordination to support the health and reliability ofInternet operations in the United States. Although it would not bea government entity and would be managed by a private board,the Federal government should explore the ways in which it couldcooperate with the Cyberspace NOC.

R4-40 The Federal government should complete the installation of the

Cyber Warning Information Network (CWIN) to key governmentand nongovernment cybersecurity-related network operation centers, to disseminate analysis and warning information and performcrisis coordination.

LEVEL 4: NATIONAL PRIORITIES CONTINUITY OF 

OPERATIONS, RECOVERY, AND RECONSTITUTION

R4-41 Industry, in voluntary partnership with the Federal government,

should complete and regularly update cybersecurity crisis contingency plans, including a recovery plan for Internet functions.

R4-42 The Federal government should review emergency authorities and

determine if the existing authorities are sufficient to supportInternet recovery.

LEVEL 4: NATIONAL PRIORITIES 

NATIONAL SECURITY

R4-43 The United States should establish a vigorous program to counter

cyber-based intelligence collection against U.S. government, industry, and university sites.

R4-44 The National Security Council should lead a study to improve

understanding of incident response coordination for significantcyber attacks among law enforcement agencies, national securityagencies, and defense agencies.

R4-45 The United States should continue to improve its ability to quickly

attribute the source of threatening attacks or actions, seeking todevelop the capability to suppress threats before attacks occur.

R4-46 The United States should continue to reserve the right to respond

in an appropriate manner when its vital interests are threatened bynation-states or terrorist groups engaged in cyber attacks.

LEVEL 4: NATIONAL PRIORITIES

INTERDEPENDENCIES AND PHYSICAL SECURITY

R4-47 Public-private partnerships should identify cross-sectoral interdependencies both cyber and physical. They should develop plans to

reduce related vulnerabilities, in conjunction with programs proposed in the National Strategy for Homeland Security. The NationalInfrastructure Simulation and Analysis Center should support these efforts.

R4-48 Owners and operators of information system networks and network data centers should consider developing remediation and

contingency plans to reduce the consequences of large-scale physical damage to facilities supporting such networks. Where requested, the Federal government could help coordinate such efforts andprovide technical assistance.

R4-49 Owners and operators of information system networks should, possibly working with the Federal government on a voluntary basis, develop appropriate procedures for limiting access to critical facilities.

LEVEL 5: GLOBAL

R5-1 The Federal government, in coordination with the private sector,

should work with individual nations and with nongovernmentaland international organizations to foster the establishment ofnational and international watch-and-warning networks to detectand prevent cyber attacks as they emerge. In addition, such networks could help support efforts to investigate and respond tothose attacks.

R5-2 The United States should encourage nations to accede to the

Council of Europe (COE) Convention on Cybercrime or to ensurethat their laws and procedures are at least as comprehensive.

R5-3 The United States should work together with Canada and Mexico

to identify and implement best practices for securing the manyshared critical North American information infrastructures.

R5-4 The United States should work through international organizations

and in partnership with industry to facilitate dialogue and partnership between foreign public and private sectors on informationinfrastructure protection, and to promote a global “culture of security.” 

R5-5 Each country should be urged to appoint a national cyberspace

coordinator. 

R5-6 The United States should draw upon the global science and technology base by pursuing collaborative research and development in

cybersecurity.

*Note: The feasibility and cost effectiveness of these recommendations will vary across

entities. Individual entities should take into account their particular and changing circumstances in choosing whether to apply them.

DRAFT
0100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

NATIONAL STRATEGY TO SECURE CYBERSPACE

ACRONYMS

57

ublic Accountants 

Office 

r 

Systems 

Network 

ects Agency

ack

n Infrastructure Committee

sion

nse Capability

 Agency

Security Teams

y Reform Act of 2000

d Names and Numbers

 Center

ITU International Telecommunications UnionLAN Local Area NetworksNACD National Association of Corporate Directors NCS National Communications Systems NERC North American Electric Reliability Council NIAC National Infrastructure Assurance CouncilNIAP National Information Assurance PartnershipNIPC National Infrastructure Protection Center NISAC National Infrastructure Simulation and Analysis CenterNIST National Institute of Standards and TechnologyNS/EP National Security/Emergency PreparednessNSA National Security AgencyNSC National Security Council NSF National Science FoundationNSTAC National Security Telecommunications Advisory CommitteeOECD Organization for Economic Cooperation and Development OMB Office of Management and BudgetOSTP Office of Science and Technology Policy PCIS Partnership for Critical Infrastructure SecurityPCIPB President’s Critical Infrastructure Protection BoardR&D Research and DevelopmentSBA Small Business Administration SCADA Supervisory Control and Data AcquisitionSFS Scholarship for Service (NSF hosted)TCP/IP Transport Control Protocol / Internet ProtocolVPN Virtual Private NetworkWAN Wide Area NetworksWLAN Wireless Local Area Network 

DRAFT
10100011101101010101010000111010100000011011110100011011011001000111010100000011011110100011011011001

O SECURE CYBERSPACE

DRAFT