U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

65–549 PDF 2011

FEDERAL INFORMATION SECURITY: CURRENT

CHALLENGES AND FUTURE POLICY CONSIDERATIONS

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

ORGANIZATION, AND PROCUREMENT

OF THE

COMMITTEE ON OVERSIGHT

AND GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED ELEVENTH CONGRESS

SECOND SESSION

MARCH 24, 2010

Serial No. 111–145

Printed for the use of the Committee on Oversight and Government Reform

(

Available via the World Wide Web: http://www.fdsys.gov

http://www.house.gov/reform

(II)

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

EDOLPHUS TOWNS, New York, Chairman

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

JOHN F. TIERNEY, Massachusetts

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

JIM COOPER, Tennessee

GERALD E. CONNOLLY, Virginia

MIKE QUIGLEY, Illinois

MARCY KAPTUR, Ohio

ELEANOR HOLMES NORTON, District of

Columbia

PATRICK J. KENNEDY, Rhode Island

DANNY K. DAVIS, Illinois

CHRIS VAN HOLLEN, Maryland

HENRY CUELLAR, Texas

PAUL W. HODES, New Hampshire

CHRISTOPHER S. MURPHY, Connecticut

PETER WELCH, Vermont

BILL FOSTER, Illinois

JACKIE SPEIER, California

STEVE DRIEHAUS, Ohio

JUDY CHU, California

DARRELL E. ISSA, California

DAN BURTON, Indiana

JOHN L. MICA, Florida

MARK E. SOUDER, Indiana

JOHN J. DUNCAN, JR., Tennessee

MICHAEL R. TURNER, Ohio

LYNN A. WESTMORELAND, Georgia

PATRICK T. MCHENRY, North Carolina

BRIAN P. BILBRAY, California

JIM JORDAN, Ohio

JEFF FLAKE, Arizona

JEFF FORTENBERRY, Nebraska

JASON CHAFFETZ, Utah

AARON SCHOCK, Illinois

BLAINE LUETKEMEYER, Missouri

ANH ‘‘JOSEPH’’ CAO, Louisiana

RON STROMAN, Staff Director

MICHAEL MCCARTHY, Deputy Staff Director

CARLA HULTBERG, Chief Clerk

LARRY BRADY, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, ORGANIZATION, AND PROCUREMENT

DIANE E. WATSON, California, Chairman

PAUL E. KANJORSKI, Pennsylvania

JIM COOPER, Tennessee

GERALD E. CONNOLLY, Virginia

HENRY CUELLAR, Texas

JACKIE SPEIER, California

PAUL W. HODES, New Hampshire

CHRISTOPHER S. MURPHY, Connecticut

MIKE QUIGLEY, Illinois

BRIAN P. BILBRAY, California

AARON SCHOCK, Illinois

JOHN J. DUNCAN, JR., Tennessee

JEFF FLAKE, Arizona

BLAINE LUETKEMEYER, Missouri

BERT HAMMOND, Staff Director

(III)

C O N T E N T S

Page

Hearing held on March 24, 2010 ............................................................................ 1

Statement of:

Bond, Philip, president, TechAmerica; John Gilligan, president, the

Gilligan Group, Inc.; Alan Paller, director of research, Sans Institute;

and Christopher Fountain, president and CEO, Secureinfo Corp. ........... 72

Bond, Philip ............................................................................................... 72

Fountain, Christopher ............................................................................... 97

Gilligan, John ............................................................................................ 82

Paller, Alan ................................................................................................ 91

Kundra, Vivek, Chief Information Officer, Office of Management and

Budget; Gary ‘‘Gus’’ Guissanie, Acting Deputy Assistant Secretary of

Defense for Cyber, Identity, and Information Assurance, U.S. Department of Defense; John Streufert, Deputy Chief Information Officer

for Information Security, Bureau of Information Resources Management, U.S. Department of State; and Gregory Wilshusen, Director,

Information Security Issues, Government Accountability Office .............. 7

Guissanie, Gary ‘‘Gus’’ .............................................................................. 16

Kundra, Vivek ........................................................................................... 7

Streufert, John .......................................................................................... 29

Wilshusen, Gregory ................................................................................... 40

Letters, statements, etc., submitted for the record by:

Bond, Philip, president, TechAmerica, prepared statement of ..................... 74

Connolly, Hon. Gerald E., a Representative in Congress from the State

of Virginia, prepared statement of .............................................................. 5

Fountain, Christopher, president and CEO, Secureinfo Corp., prepared

statement of ................................................................................................... 100

Gilligan, John, president, the Gilligan Group, Inc., prepared statement

of ..................................................................................................................... 85

Guissanie, Gary ‘‘Gus’’, Acting Deputy Assistant Secretary of Defense

for Cyber, Identity, and Information Assurance, U.S. Department of

Defense, prepared statement of ................................................................... 18

Kundra, Vivek, Chief Information Officer, Office of Management and

Budget, prepared statement of .................................................................... 10

Paller, Alan, director of research, Sans Institute, prepared statement

of ..................................................................................................................... 92

Streufert, John, Deputy Chief Information Officer for Information Security, Bureau of Information Resources Management, U.S. Department

of State, prepared statement of ................................................................... 31

Wilshusen, Gregory, Director, Information Security Issues, Government

Accountability Office, prepared statement of ............................................. 42

(1)

FEDERAL INFORMATION SECURITY: CURRENT

CHALLENGES AND FUTURE POLICY CONSIDERATIONS

WEDNESDAY, MARCH 24, 2010

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

ORGANIZATION, AND PROCUREMENT,

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 2 p.m., in room

2154, Rayburn House Office Building, Hon. Diane E. Watson

(chairwoman of the subcommittee) presiding.

Present: Representatives Watson, Connolly, Bilbray, Duncan,

and Luetkemeyer.

Staff present: Bert Hammond, staff director; Valerie Van Buren,

clerk; Adam Bordes and Deborah Mack, professional staff members; Charles Phillips, minority chief counsel for policy; and John

Ohly, minority professional staff member.

Ms. WATSON. The Committee on Oversight and Government Reform will now come to order.

Today’s hearing will review the Federal Information Security Act

[FISMA] of 2002, and agency efforts to improve the security, integrity, and reliability of the Federal Government’s information systems.

In addition, today’s hearing will address legislation introduced by

me last week to amend FISMA, H.R. 4900, the Federal Information

Security Amendments Act of 2010.

I welcome all of our distinguished panelists and look forward to

your testimony, and apologize for being late; we were in a very important meeting.

So, without objection, the Chair and ranking minority member

will have 5 minutes to make opening statements, followed by opening statements not to exceed 3 minutes by any other Member who

seeks recognition.

Without objection, Members and witnesses may have 5 legislative days to submit a written statement or extraneous materials for

the record.

Now, I would like to wish everyone here a good afternoon and

welcome to the Government Management Subcommittee’s oversight

hearing on the state of Federal Information Security and agency efforts to comply with the Federal Information Security Management

Act, and we will also discuss proposed legislation I recently introduced to amend FISMA, the Federal Information Security AmendVerDate 11-MAY-2000 13:25 Jun 17, 2011 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 C:\KATIES\DOCS\65549.TXT KATIE PsN: KATIE
2

ments Act of 2010. I look to our witnesses and your testimony, and

we appreciate your presence here today.

Since enactment of FISMA legislation in 2002, this subcommittee

has held annual oversight hearings on agency efforts to meet the

standards and policies prescribed under the current FISMA framework. While some agencies have shown great success in harnessing

both technology and human capital to reduce their overall cyber

risk profiles, many others simply comply with the basic annual reviews and periodic assessments required under FISMA that reveal

only a fraction of the threats and the vulnerabilities facing them.

It is clear that the notion of being in compliance with current law

does not equal having adequate security across an agency’s IT infrastructure. Furthermore, the vast majority of Federal agencies

still have not met the basic cybersecurity requirements outlined in

the FISMA legislation. According to statistics from GAO’s testimony and OMB’s annual FISMA report to Congress, 23 out of 24

agencies have been identified as having weaknesses in their agency-wide information security programs.

Although these figures do not speak to the depths of problems

that agencies have, it tells us that many still view security as a

measure of efficiency or productivity, and not as a pillar of necessity or national security. It also indicates that OMB has not used

its enforcement authority and budget power to force agencies to

make effective information security a fundamental requirement in

their daily operations and strategic plans.

While some may view these problems as insurmountable, I believe there are managerial blueprints at some agencies that have

proved effective in reducing their exposure to cyber threats. For example, the State Department has utilized a number of mechanisms, including stronger baseline internal controls, newly developed performance metrics, and advanced system monitoring capabilities for reducing their risk exposure by nearly 90 percent.

These outcomes are by no means perfect. But they underscore

the ability of agencies to both prioritize the mitigation of their largest cyber vulnerabilities while working to meet the minimum security standards and policies prescribed for all of their IT assets.

So, as we move forward with policy goals for reforming FISMA,

we must try not to look for a silver bullet as a solution for information security deficiencies, but to develop a harmonized policy framework that addresses our current managerial, planning, technological, and leadership shortcomings across the Government.

It is in response to these challenges and deficiencies that I have

introduced H.R. 4900, the Federal Information Security Amendments Act of 2010. The bill before us is a combination of multiple

policy recommendations and legislative proposals, including those

from President Obama’s recent cyberspace policy review, the CSI

Commission on Cybersecurity for the 44th Presidency and the

GAO. It includes a combination of visions to strengthen our managerial, our technical, and our strategic planning objectives while

flexible enough for individual agencies to address their unique information security profiles.

The bill establishes a National Office for Cyberspace within the

Executive Office of the President. The Director of the National Office for Cyberspace, appointed by the President and subjected to

3

Senate conformation, will be charged with overseeing the

cybersecurity posture of the Federal Government. The Office’s mission will be to develop and manage through an interagency board

consisting of OMB, civilian, military, and other agencies that will

oversee the crafting of policies and guidance that are responsive to

combating the changing nature of cyber threats Government-wide.

I firmly believe the establishment of the National Office for

Cyberspace will provide both the Presidential leadership and policy

focus capabilities that are needed for addressing our cyber deficiencies Government-wide. The legislation also moves agencies

away from the current paper-intensive process used to monitor

agencies’ compliance with FISMA policies and procedures and, instead, will require agencies to utilize automated technologies and

outcome-based performance measures for determining their true

cyber risk profile.

By utilizing new monitoring and measuring capabilities, agencies

will have much more complete data at their disposal for mitigating

their most significant vulnerabilities and combating future cyber

threats.

Last, the bill requires OMB and agencies to inter-cooperate information security into their procurement decisions through secure acquisition requirements for commercial products and services, and

vulnerability assessments for major information technology investments. I believe those provisions offer us the best way forward to

ensure that information security is built into our agency systems

in a technology-neutral manner from the beginning of the procurement life cycle.

In closing, I believe reducing our exposure to current and future

cyber threats will require both managerial discipline and policy

flexibility. While the legislation I offer is not perfect, I believe it

provides us a way forward to reducing our cyber risks across the

Government, while instilling policy leadership on cybersecurity at

the highest levels of our Government.

Once again, I welcome our panelists today and I look forward to

their testimony and their feedback.

At this point, I would like now to yield to our distinguished ranking minority member, Mr. Bilbray of California.

Mr. BILBRAY. Thank you, Madam Chair. Madam Chair, your

opening statement was so well drafted and so comprehensive and

so well delivered that I just ask for unanimous consent that my

written statement be entered into the record.

Ms. WATSON. Without objection.

Mr. BILBRAY. And just quickly pointing out that this is quite an

appropriate step that we move forward here. We are seeing that

the cyber world is becoming not only a tool, but an essential foundation for the Federal Government’s ability to perform our constitutional responsibilities. Everything from, now, employment verification to we are looking at the taxation system, the IRS’s ability

to use it has just been a huge boom. The security at our ports of

entry to our military applications, to our health care service capability. All of these are going to expand extensively, and should, to

be able to make sure the Federal Government is as effective and

efficient and as cost-effective as possible.

4

Along with that great opportunity comes a huge threat, and I

think that we will find that what you are doing here today, if we

do this right and follow through with this appropriately, will not

only be defending those components that we see today, but be actually creating a vehicle that will protect the future expansion, which

will probably be tenfold of what we see today.

So, again, I appreciate the introduction of the bill. We will work

at trying to improve it. Nothing is perfect, but we will darn well

do our best to make sure that we create this defense shield as

strong as possible. And I yield back, Madam Chair.

Ms. WATSON. Thank you.

I now yield to Mr. Connolly.

Mr. CONNOLLY. Thank you, Madam Chairman. I would ask my

full statement be entered into the record.

Ms. WATSON. Without objection.

Mr. CONNOLLY. I thank the Chair.

If I could add one point, one of the concerns I have, among many,

is that we get the architecture, the managerial architecture of

cybersecurity and information technology in general in the Federal

Government right. The President, by Executive order, has created

a position of Chief Technology Office, which I applaud. I believe we

have to, however, create a statutory framework for that position

and the cybersecurity position as well. So making sure we understand, moving forward, in a statutory framework, beyond just an

administrative framework, what those pieces are and what those

responsibilities are, and how the org chart works I think is very

important, given the resources we are going to be putting into

these efforts.

So one of the things I certainly want to do—and I have introduced legislation, H.R. 1910—I have yet to hear from the administration on that bill, but I want to certainly incorporate elements of

that into whatever we do by way of reauthorization of FISMA, and

I intend to do just that.

Thank you, Madam Chairman.

[The prepared statement of Hon. Gerald E. Connolly follows:]

5

6

Ms. WATSON. Thank you.

We now yield to Mr. Duncan for an opening statement.

Mr. DUNCAN. Well, thank you very much, Madam Chairwoman.

Certainly, this is a very important topic. The statistics are almost

mind-boggling. In spite of all the money that is being spent on this

and all the efforts that are being made, the number of security incidents keeps going up.

Our committee memorandum tells us that there were roughly

90,000 breaches in 2008, and that figure went to the figure that we

have in our folder, 108,710, in 2009. It reminded me that several

years ago, as I was coming back from lunch in Knoxville 1 day, I

heard on the CBS radio national news in my car that the top secret

files at the Pentagon had been broken into. It was something approximately 250,000 times that year, or 200,000 times. And that

figure was matched a few months ago in this committee when we

had the head of a company that said, just to show that they could

do it, they downloaded 250,000 individual tax returns.

So, because of all these things, I have begun to wonder if there

really is such a thing as cybersecurity, or is it just something for

companies to make money off of. I would be very interested in the

testimony. Unfortunately, because of previously scheduled appointments, I was only going to be able to be here from 2 until 2:45, and

my 2:45 appointment is already here. So I apologize to the witnesses.

But I can assure you that I will read your testimony and your

responses to what I have just said with great interest, because I

am becoming more and more skeptical. It seems to me that something needs to be done, but are we pouring money down a rat hole?

You know, it seems to me that we started out controlling the computers, and now they control us. And I know that all the young

people worship their computers, but, this security business, I think

people need to realize that anything that they put into a computer

is just not secure at all, at least at this point.

Thank you.

Ms. WATSON. Thank you.

Now that we have no further opening statements, it is the policy

of the Committee on Oversight and Government Reform to swear

in all witnesses before they testify, and I would like to ask all of

you to stand and raise your right hands.

[Witnesses sworn.]

Ms. WATSON. Let the record reflect that the witnesses answered

in the affirmative.

I will now introduce our panelists.

Mr. Vivek Kundra is the Chief Information Officer at the Office

of Management and Budget. Mr. Kundra was appointed as the first

Federal CIO of the United States by President Obama in March

2009. In this capacity, he directs the policy and strategic planning

of Federal information technology investments and is responsible

for oversight of Federal technology spending. Prior to joining the

Obama administration, Mr. Kundra served in Mayor Fenty’s cabinet as the Chief Technological Officer for the District of Columbia

and Governor Kaine’s cabinet as Assistant Secretary of Commerce

and Technology for the Commonwealth of Virginia.

7

Mr. Gary ‘‘Gus’’ Guissanie is the Acting Deputy Assistant Secretary of Defense for Identity and Information Assurance at the

Department of Defense. There, he is charged with implementing

DOD programs that require planning, monitoring, coordinating,

and integration of information assurance across its component

agencies.

Mr. Streufert is the Deputy Chief Information Office for Information Security at the Department of State. He is responsible for providing oversight and guidance for information assurance activities,

including security policy development, risk management, systems

authorization, training and awareness, compliance reporting, and

performance measures. Prior to his tenure at State, he served in

various IT management roles at USAID, USDA, and the U.S.

Navy.

Mr. Gregory Wilshusen serves as the Director of Information Security Issues at GAO. His work involves examining Federal information security practices and trends at Federal agencies, and he

is the GAO’s leading expert on FISMA implementation.

I would like to ask all of you, and I ask that each of the witnesses now give a brief summary of their testimony, and we would

like to have you keep this summary under 5 minutes in duration

if you can, because your complete written statement will be included in the hearing record. And I would like to please start with

Mr. Kundra.

STATEMENTS OF VIVEK KUNDRA, CHIEF INFORMATION OFFICER, OFFICE OF MANAGEMENT AND BUDGET; GARY ‘‘GUS’’

GUISSANIE, ACTING DEPUTY ASSISTANT SECRETARY OF DEFENSE FOR CYBER, IDENTITY, AND INFORMATION ASSURANCE, U.S. DEPARTMENT OF DEFENSE; JOHN STREUFERT,

DEPUTY CHIEF INFORMATION OFFICER FOR INFORMATION

SECURITY, BUREAU OF INFORMATION RESOURCES MANAGEMENT, U.S. DEPARTMENT OF STATE; AND GREGORY

WILSHUSEN, DIRECTOR, INFORMATION SECURITY ISSUES,

GOVERNMENT ACCOUNTABILITY OFFICE

STATEMENT OF VIVEK KUNDRA

Mr. KUNDRA. Great. Good afternoon, Madam Chairwoman and

members of the subcommittee. Thank you for the opportunity to

testify on the state of Federal information security and the current

challenges we face.

Cybersecurity is a Presidential priority and across the administration we are working on this issue. I work closely with the President’s Cybersecurity Coordinator, Howard Schmidt, and the Federal Chief Technology Officer, Aneesh Chopra.

Eight years ago, when FISMA was enacted, the mobile computing revolution and the Internet were not as pervasive as they are

today. Agencies are leveraging technologies and business models

today that were not present at the time, from cloud computing to

mobile platforms. These new models increase efficiency, but also

leave agencies struggling with questions on how they apply

FISMA’s requirements in an environment where boundaries no

longer determine security points. Agencies have made significant

8

progress in complying with FISMA requirements; yet, the Federal

Government is still far from secure.

The annual FISMA measures have led agencies to focus on a culture of compliance. However, we cannot get to security through

compliance alone. Significant issues have hindered the Federal

Government’s effectiveness in cybersecurity, including a lack of coordination, a culture focused on compliance, a failure to take an enterprise approach, and a fragmented research and development

agenda.

To coordinate the many cybersecurity activities across the Government, the President appointed Howard Schmidt. Mr. Schmidt

serves as a key member of the President’s national security staff

while working in tandem with the private sector on cybersecurity.

Additionally, the Department of Homeland Security, in coordination with the White House and various stakeholders from Government and industry, is developing a National Cyber Incident Response Plan. This plan will focus on outlining key roles and responsibilities across the Nation, linking all levels of Government and

the private sector.

In 2009, we began shifting agencies to a culture that would focus

more on performance and less on compliance. Last October, OMB

launched CyberScope, a platform which collects performance

metrics enabling meaningful analysis of the agency’s security posture. Since metrics are policy statements that influence how agencies deploy resources, OMB established a task force to develop performance-based security metrics.

This work resulted in a three-tiered approach that will be implemented through CyberScope. Data feeds, security posture questions, and making sure that we are specifically focusing on the

risks at specific agencies, from Health and Human Services to the

Department of Defense to the State Department, which have very

different missions and risk profiles. This approach will provide essential information about agency security postures, activities, and

threats.

We should also drive agencies toward continuous monitoring of

security-related information across their organizations. It is necessary to take an enterprise approach to cybersecurity. That is why

we are leveraging governmentwide vehicles to enable agencies to

purchase security tools efficiently. To energize the Nation’s research and development efforts, the administration is encouraging

innovation in game-changing technologies to shift the advantage

from the attacker to the defender. These activities include efforts

such as National Cyber Leap Year and the National Research and

Development Summit we just did, the creation of a group designed

to look at the financial services sector and create a test bed where

we could model scenarios that we need to defend against and also

the establishment of an industry, academia, and government working group to explore cybersecurity insurance as a market force to

improve security across the board.

Security is a journey, not a destination. We are moving forward.

For example, the Government has won praise for their work done

to contained Conficker. A representative of the Conficker Working

Group, an independent group of private sector companies focused

on defeating the Conficker worm said, ‘‘For the first time the govVerDate 11-MAY-2000 13:25 Jun 17, 2011 Jkt 000000 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 C:\KATIES\DOCS\65549.TXT KATIE PsN: KATIE
9

ernment is taking the lead in a technical security issue, rather

than lagging.’’

This is where we want to be. Unfortunately, the State Depart- ment spent $133 million over the last 6 years on paperwork compliance. But under the leadership of John they have made significant

changes to how they approach this problem. But what we really

need to do is not file paperwork in metal cabinets. Instead, we

should shift to constantly testing for weaknesses. That is why the

President’s 2011 budget provides funding for red teams and blue

teams to conduct penetration testing on Federal systems.

A secure trusted computing environment in the Federal Government is the responsibility of everyone involved; agency heads, the

Federal work force, and contractors who support us. This will not

be easy, nor will it take place overnight. Together with the

Cybersecurity Coordinator, Howard Schmidt, and the Chief Technology Officer, Aneesh Chopra, we will continue to address challenges that face our Nation in cyberspace.

Thank you for the opportunity to testify. I look forward to your

questions.

[The prepared statement of Mr. Kundra follows:]

10

11

12

13

14

15

16

Ms. WATSON. Thank you, Mr. Kundra.

Now, Mr. Guissanie, you may proceed.

STATEMENT OF GARY ‘‘GUS’’ GUISSANIE

Mr. GUISSANIE. Good afternoon, Chairwoman Watson, Congressman Bilbray, and members of the Government Management, Organization, and Procurement Subcommittee. My name is Gus

Guissanie, and I represent the Office of the Assistant Secretary of

Defense for Networks and Information Integration and the Department of Defense Chief Information Officer. I want to thank you for

the opportunity to appear before the subcommittee to discuss

issues related to governmentwide information security, the Department’s efforts to comply with FISMA mandates, and initiatives to

enhance the Nation’s cybersecurity.

Cybersecurity is and has been a critical priority for the Department of Defense. Our information systems, which are globally distributed and connected to coalition and interagency partners, are

essential to our DOD missions; therefore, we must have a robust,

assured enterprise network.

In concert with the administration’s Government-wide information security objectives, we support a focus on continuous monitoring and the use of real-world penetration testing to ensure a robust

security posture. However, the DOD policy of conducting stringent

security testing prior to an authorization to operate remains a critical element of information assurance.

The Department has found FISMA in its current form to have

significant strengths in improving cybersecurity, and would point

out that any deficiencies in implementations are not, in and of

themselves, sufficient justification for major change or reform.

One construct that the Department believes is valuable in the

current statute and should be retained is the organizational relationship between the Agency Chief Information Officer [CISO], and

the Agency CIO. A CISO cannot effective function if separated organizationally from the CIO and the operational activity being protected.

I would now like to highlight some DOD initiatives taken to secure our systems within the framework of current FISMA legislation.

The Department has been working to develop information assurance metrics at the strategic and operational levels both within the

Department and the broader Federal community. As we seek

metrics which provide our leadership decisionmaking insight, we

are working toward the capability to accomplish risk scoring in

prioritized vulnerability remediation based on actual threat activity

to enable a more active and flexible defense.

The Department is also implement a series of initiatives aligned

to our DOD information assurance strategy with several accelerated in fiscal year 2009 by the Comprehensive National

Cybersecurity Initiative. For example, we are deploying a hostbased security solution for continuous monitoring and protection

against threats. We are hardening our unclassified network by improving censoring, filtering, and access control at our Internet access points or gateways, thus limiting exposure of critical information. By changing our access control technologies and methodoloVerDate 11-MAY-2000 13:25 Jun 17, 2011 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6633 C:\KATIES\DOCS\65549.TXT KATIE PsN: KATIE
17

gies to ensure that only our public-facing servers are accessible

from the Internet, we have reduced this attack surface by 96 percent.

We have expanded cooperation with hour defense industrial base

to protect unclassified defense-related research, development, and

procurement information, and we are also working with the Department of Homeland Security to develop a multi-pronged approach for managing supply chain risks arising from the

globalization of the information and communications technology

marketplace.

A skilled cyber work force is the most critical component of our

defense against cyber adversaries. Therefore, the Department is

continuing to raise the bar through our Workforce Improvement

Program, extend our IA range capability, and ensure quality training is available to our work force. Additionally, the 106 National

Centers of Academic Excellence in IA Education are producing

graduates with the right skills to become a world-class cyber work

force.

I would like to conclude by emphasizing that we continue to work

toward a resilient and dependable enterprise network for the Department and the Nation. We are accomplishing this through collaboration with other Federal agencies to resolve security issues

impacting Government-wide shared services and infrastructure.

The DOD CIO is managing a diverse portfolio to enable worldwide

operations supporting over 21⁄2 million users that is aggressively

working to get ahead of the daunting global security challenge.

I am happy to take your questions.

[The prepared statement of Mr. Guissanie follows:]

18

19

20

21

22

23

24

25

26

27

28

29

Ms. WATSON. Thank you.

Now, Mr. Streufert, you may proceed.

STATEMENT OF JOHN STREUFERT

Mr. STREUFERT. Good afternoon, Chairwoman Watson, Ranking

Member Bilbray, and distinguished members of the subcommittee.

I am pleased to have this opportunity to testify before the subcommittee regarding the Department of State’s capabilities for securing its global information and technology infrastructure. The

Department serves as the diplomatic front line in over 270 overseas

posts by serving its 70,000 users with the worldwide network and

mission-essential software applications.

The foreign policy mission makes an inviting target for attack by

highly skilled cyber adversaries. However, the Department’s layered approach to risk management allows multiple levels of protection. This protection is accomplished by implementing a matrix of

technical, operational, and management security controls designed

to thwart network threats, detect, and mitigate vulnerabilities, and

strengthen business operations.

In my role as the Chief Information Security Officer, I have become familiar with the benefits, shortcomings, and promising opportunities to buildupon the current Federal Information Security

Management Act of 2002. Our goal is to ensure system security for

diplomacy while continuously improving the return on investment

for each dollar spent on cybersecurity.

The passage of the FISMA Act in 2002 served as a game-changing event for the Federal agency community. FISMA applies to all

information used by or on behalf of the Federal department or

agency. In this respect, the establishment of a holistic information

security program and the responsibility of accounting to oversight

entities, including Congress, served as a valuable check in determining the health of an agency’s information security program.

The Federal cybersecurity landscape has changed over the past

5 years. The implementation of a Federal cybersecurity program

has typically been implemented in past years through manual processes and compliance checks which have competed with the need

to implement Web 2.0 technologies in a secure manner, just to

name one among many. Meanwhile, our cyber problems have dramatically escalated in severity and frequency. Since 2008, the number of security-related trouble tickets opened in our organization

has more than doubled, while malicious code attacks has increased

by 47 percent.

In October 2009, OMB launched CyberScope, a secure data collection platform for reporting and formed an interagency task force

charged with developing metrics for information security. Important to our efforts, the National Institute of Standards introduced

Special Publication 800–37 and an update to increase the emphasis

on continuous monitoring. Of special note, the Department of State

began supplementing FISMA compliance reports and studies with

a risk scoring program scanning every computer and server connected to its network not less than every 36 hours on eight factors

and twice a month for safe configurations of software.

The Risk Scoring Program utilizes best practices such as the

Consensus Audit Guidelines, which we have mapped against the

30

way the Department is being attacked. The Department utilizes

the Common Vulnerability Scoring System from NIST where scanning tools tag specific risks with point values between 0 and 10,

with 10 being the highest vulnerability. When the problem is resolved, risk points are deducted. To this point, the State Department Risk Scoring Program has implemented a subset of the Consensus Audit Guideline controls that are adaptable to automated

verification.

In the first year of site scoring ending July 2009, overall risk on

the Department’s key unclassified network measured by the Risk

Scoring Program was reduced by nearly 90 percent in overseas

sites and 89 percent in domestic sites. Scores have been relatively

stable since then. Notwithstanding this reduction to date, the Department has decided to make it three times more difficult to

achieve the same letter grades as part of an ongoing commitment

to continuous improvement of this kind in the future.

These methods, however limited, have allowed one critical piece

of the Department’s information security program to move from

snapshot in time previously available under FISMA to a program

that scans for weaknesses on servers and personal computers continuously, identifies weak configurations each 15 days, issues letter

grades monthly to senior managers tracking the progress for their

organization in closing against known vulnerabilities the last 30

days. It is the Department’s objective to expand automated verification to as many Consensus Audit Guideline control categories as

possible, to all infrastructure and applications as soon as possible,

limited only by available resources.

In short, the details of this program empower administrators of

our systems with targeted daily attention to conduct remediation

and the summaries empower executives to oversee the most serious

problems.

The balance of my statement references additional layers of control, including a 24/7 network watch program, close coordination

with incident management at US-CERT; implementation of EINSTEIN 2 for situational awareness; important emphasis on Cyber

Threat Analysis which we share with other members of the foreign

affairs community; a Global Security Scanning program, a

Cybersecurity Incident Program to assure that our employees do

not commit acts of cyber misuse or abuse; an awareness training

program that we conduct not only for ourselves, but for other members of the Federal Government under the information security line

of business.

I want to conclude by emphasizing the Department’s policy, technology, business processes, and partnerships in place continue to

evolve and meet the ongoing challenges of security threats in the

cyber environment.

I would like to thank the subcommittee members for this opportunity to speak before you today, and I would be pleased to respond

to any of your questions.

[The prepared statement of Mr. Streufert follows:]

31

32

33

34

35

36

37

38

39

40

Ms. WATSON. One of the things I wanted to followup with you before we got to questions, I understand that you are considering a

kind of Ambassador post within the Department to oversee this.

You might want to just speak on it for half a minute before we go

on.

Mr. STREUFERT. Yes, ma’am. My immediate responsibilities have

to do with the internal networks of the Department of State, but

I would be happy to forward any questions that you would have

about that legislation to those in our organization that deal with

foreign policy aspects of the cybersecurity.

Ms. WATSON. Why don’t you just give us a summary of what you

have already been considering? That would be information for us.

Mr. STREUFERT. I am sorry, I don’t have that information available.

Ms. WATSON. No, you can send it to us.

Mr. STREUFERT. Just send it to you?

Ms. WATSON. Yes.

Mr. STREUFERT. OK, very good. I would be happy to, ma’am.

Ms. WATSON. Thank you so much.

Mr. Wilshusen, we are going to take your testimony and then we

are going to recess for about 25 minutes to a half hour. We have

four to five votes on the floor. Thank you.

STATEMENT OF GREGORY WILSHUSEN

Mr. WILSHUSEN. Chairwoman Watson, Ranking Member Bilbray,

and members of the subcommittee, thank you for the opportunity

today to participate in today’s hearing on Federal information security.

As we have previously testified, cyber-based threats to Federal

systems and critical infrastructure are evolving and growing. Pervasive and sustained cyber attacks continue to pose a potentially

devastating threat to the systems and operations of the Federal

Government.

Over the past few years, agencies have experienced an increasing

number and a wide range of incidents involving data loss or theft,

computer intrusions, and privacy breaches, underscoring the need

for improved security practices and controls. While much progress

has been made in identifying and implementing these controls,

much work remains.

Madam Chair, today I will discuss Federal agencies’ efforts to secure their information systems and opportunities to enhance Federal cybersecurity.

For fiscal year 2009, agencies have reported mixed progress in

securing their systems and implementing key security activities.

For example, although agencies collectively reported providing security awareness training and specialized security training to an

increasing percentage of their personnel, they also reported testing

the security controls and contingency plans for a decreasing percentage of their systems.

In addition, Federal systems continue to be afflicted by persistent

control weaknesses. Most of the 24 major agencies in our review

had weaknesses in security safeguards that are intended to control

logical and physical access to IT resources, manage the secure configurations of those resources, and ensure the prompt recovery of

41

service and the continuity of operations should unexpected incidents occur. To illustrate, 21 of 24 major agencies noted inadequate

controls over their financial systems were either of significant deficiency or material weakness.

An underlying cause for these weaknesses is that agencies have

not yet fully or effectively implemented key elements of their information security programs as required by FISMA. As a result, they

remain vulnerable to the unauthorized disclosure and modification

of sensitive information and the disruption of mission-critical operations.

Fortunately, opportunities exist to enhance Federal

cybersecurity. Agencies can implement the hundreds of recommendations that GAO and agency IGs have made to resolve specific control deficiencies and program shortfalls. Agencies can also

expand use of automated tools to perform security functions and increase their efficiency in securing and monitoring networks. These

actions will help agencies to better manage the configuration of security features and to prevent, limit, and detect unauthorized access to networks and systems.

In addition, as we have previously recommended, OMB and the

workgroup it has convened should develop a balanced set of performance measures that focus on risk and produce better information to gage the status and effectiveness of security efforts. The effective implementation of several Government-wide initiatives can

also lead to improved cybersecurity. For example, addressing several challenges we have identified associated with implementing

the Comprehensive National Cybersecurity Initiative, which is a

collection of 12 projects intended to bolster security on Federal networks, will enhance its chances of success.

Another opportunity is implementing the trusted internet connections EINSTEIN and Federal Desktop Core Configuration Initiatives. These initiatives are intended to consolidate and secure

external access points, including those to the Internet; provide network intrusion detection capability; and establish secure configurations for Windows-based workstations. We have ongoing work that

addresses the status and implementation of these initiatives.

Finally, opportunities exist to strengthen Federal guidance and

the national strategy for cybersecurity. In panel discussions that

we hosted, cybersecurity experts identified 12 key improvements

that are essential in their view to improving the strategy in our national cybersecurity posture. Consistent with our prior work, implementing these improvements can bolster security of our Nation’s

most critical Federal and private sector cyber infrastructure.

In summary, Federal agencies continue to tread water in securing their systems and countering the growing and evolving cyber

threat. Nevertheless, opportunities exist to improve cybersecurity,

but they required a concerted response to ensure that Federal systems are sufficiently safeguarded.

Madam Chair, this concludes my statement. I would be happy to

answer any questions.

[The prepared statement of Mr. Wilshusen follows:]

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

Ms. WATSON. Thank you so very much, panel. We will recess now

until about 3:45, and we will see you back here for questions and

then panel two. Thank you so very much.

[Recess.]

Ms. WATSON. We shall resume the committee.

I was listening very intently to Mr. Kundra’s report, and you

mentioned Mr. Howard Schmidt, the new White House Cyber Coordinator, while you were testifying. Could you describe for us what

his role and responsibilities are in securing our Federal information infrastructure? As you know, my legislation calls for the codification of a National Office of Cyberspace and Grants, and its extensive authority for implementing and enforcing information and

security responsibilities. So we would like to know more about Mr.

Schmidt’s role. Thank you.

Mr. KUNDRA. Sure. Howard Schmidt, as the coordinator of

cybersecurity within the White House, works both at the National

Security Council and the National Economic Council, recognizing

that their vital interests in terms of being able to protect the Nation, at the same time making sure we are balancing that with economic decisions across the board.

Also, when you think about from a national security perspective,

the Comprehensive National Cyber Initiative, both of us work very,

very closely together to make sure that, as we look at equities,

whether it is the Department of Defense, Homeland Security, the

private sector, that we are coordinating our efforts and are moving

forward in a direction that makes us more secure, rather than

spending a tremendous amount of energy on the friction that results historically from a lack of coordination and who owns

cybersecurity in one area versus the other.

Ms. WATSON. One proposal in my bill requires OMB to incorporate secure product and service acquisition requirements into

agency contracting practices, as well as to require IT investments

to have vulnerability assessments completed before programs can

move forward. So can you tell us how these proposals are complementary to some programs already in place at GSA and what

you might consider to be technical barriers that we might be able

to remove?

Mr. KUNDRA. Part of what we need to be able to do across the

Federal Government is not bolt on security afterwards. A lot of

times what ends up happening is systems end up going live or they

evolve. Some of the systems may be 30 years old and everybody is

trying to bolt on security, and the challenges as addressed by the

panel, with a huge focus on generating a lot of reporting.

And if we looked at the FISMA report, one of the key findings

here is investments we are making when it comes to the human

capital side, making sure that employees who are focused on

cybersecurity across the public sector are not necessarily experts in

writing reports, but are actually people who are trained and understand how to not just configure and manage routers and switches

and servers and desktops and firewalls, but can make sure that as

we deploy these systems we build an architecture that doesn’t say,

you know what, we are going to move forward and certify this system, and come back 3 years from today and hope that it is as seVerDate 11-MAY-2000 13:25 Jun 17, 2011 Jkt 000000 PO 00000 Frm 00067 Fmt 6633 Sfmt 6633 C:\KATIES\DOCS\65549.TXT KATIE PsN: KATIE
64

cure, test it. What we are trying to shift everyone to is this notion

of a continuous monitoring.

But what we are also doing is we are making sure that across

the board, in terms of procurements, that we are creating schedules

where you have enterprise procurements, whether it is moving toward a networks contract or whether it is blanket purchase agreements for software, whether it is any virus or firewalls or data loss

prevention technologies, so that it is easier to procure these technologies and, from an OMB perspective, for us to be able to look

at where we are actually spending money. And, frankly, security

investments are best when they are actually baked into the systems that we are looking at and not where they are treated at discreet investments cross the board.

Ms. WATSON. Can you describe what actually is working? I think

we know that there are firewalls in some agencies that are lax, but

what is actually working today?

Mr. KUNDRA. What is working right now is—let’s look at Homeland Security Presidential Directive around HSPD–12, which is

smart cards, the issuance of these smart cards across the board.

What we have been able to do in this year alone, we have seen a

60-plus percent rise in the issuance of these smart cards because

we focused on it. We have had these accountability sessions that

we call text ed sessions——

Ms. WATSON. Now, the smart card you are talking about, who

has that card? How is it distributed? Where is it and where is it

given?

Mr. KUNDRA. The way these smart cards work, they are actually

designed to be able to be given to Federal employees and contractors who work on Government systems. And part of what we are

trying to do now is that the issuance of these cards has moved forward. In the Department of Defense, for example, these cards are

used to actually log into some of the systems. And what we are trying to do is make sure that across the Federal Government—here

is one of these smart cards——

Ms. WATSON. Wait a minute. Do you have a fingerprint on that

and a mug shot?

Mr. KUNDRA. As well as a photograph, there is a chip, there are

a couple of bar codes and there is some imagery.

Ms. WATSON. I mean, can someone really hack in and change

that and steal your identify through those?

Mr. KUNDRA. And that is why these smart cards are very, very

important, because one of the challenges we also face is making

sure that the very people who are accessing our systems, we know

who they are, we know when they are logging into the systems, we

know what information they are getting access to. So this initiative

is successful. Now what we need to do is sort of the second part

of this, which is hard work on making sure that every single agency across the Federal Government is not just issuing these cards,

but actually making sure that the systems are configured to be

able to use these cards.

DOD has done a good job in this area. A number of other agencies have moved forward in making sure they are integrating them.

But the vision here is to also make sure that we are using these

smart cards for physical access, which is getting in and out of

65

buildings, and logical access, which is getting in and out of systems

across the Federal Government.

Ms. WATSON. And using these cards and the information that we

have, what bothers me is that we still have a barrier in communicating. You know, I am still wrapped up in what happened on

Christmas Day and why our Secretary did not know that there was

someone getting on a plane in another country, entering our airspace and being a tremendous threat. Thank God they caught him,

but what happens there? Why isn’t that information communicated?

Mr. KUNDRA. Part of what is also happening within information

sharing environment is making sure that across the board, across

Federal systems that they are configured not just to share information from a technical perspective, but also from a management perspective, recognizing that this is not necessarily a technical problem; recognizing what are the important things that we need to

focus on, what is the information that is vital, and how do we simply so we recognize as we see these threats.

What is really interesting from a security perspective, as John

testified, from the State Department’s perspective, how they are

able to look at certain—create certain grades across the different

embassies and figure out where are they secure versus where are

they not secure so they can focus their attention, their energy, and

finite resources on the highest priority problems. The only way we

are going to be able to attack cybersecurity is by focusing—sort of

the 80/20 rule, focusing on 80 percent of the problems that we recognize are confronting us today as we think long-term about how

do we get to 100 percent.

The challenge we have is that our adversaries are constantly

evolving. The threat is a real-time threat and we are constantly

seeing the threat vectors change over time. That is why, when we

think about our research and development agenda, it is vital, as we

look at our R&D agenda, to make sure that we are making investments that are going to yield dividends down the line to shift the

advantage so that the defender has a greater opportunity rather

than the attacker, because the attacker has to get it right once.

Ms. WATSON. I am going to yield now to the ranking member,

Mr. Bilbray.

Mr. BILBRAY. Thank you, Madam Chair.

Mr. Kundra, while I have you before us, there is something that

just sort of came up, and that is this issue of information sharing,

whatever. I am sure you read the 9/11 Commission report about

the firewalls that created the opportunity for people to actually

move within the United States, and though information was available with one department, the other department didn’t have any

access in it; and that was actually probably more statutory than it

was a problem of the incapability of systems.

You are aware of the 9/11?

Mr. KUNDRA. Yes, sir.

Mr. BILBRAY. OK. Because one of the things that really ought to

be a lesson for us on this, as we bring this up, Madam Chair, is

a member of the 9/11 terrorists—not the 9/11 terrorists, but the

D.C. sniper, where you had a fingerprint that was detected at a

murder site in Alabama. Except for one little incident we never

66

would have been able to catch this individual because even though

we had all of his fingerprints, but the fact that one department was

not allowed to have access into another department, we had those

firewalls, and it is something the 9/11 really said we needed to

point to. And I just tell you that. Luckily, the 9/11 terrorists had

committed a misdemeanor which allowed his immigration fingerprints and biometrics to be brought over to the FBI, so then when

the Alabama officer asked to check the fingerprints, we were able

to have access.

The question is this: How many crimes and stuff are going on

right now because not just Homeland Security isn’t sharing it, but

a lot of other agencies may have information and data that can’t

be shared now? I just ask you to take a look at that. 9/11 has said

it. We haven’t done enough about that. But information sharing

and tearing down those firewalls are something we haven’t done

enough of, and I ask you to look at that.

The other question is again—and we brought it up, and maybe

it is overplayed and whatever, and that is the securing of not only

through different systems, but the biometrics are one thing we can

talk about.

One of the things that we had a hearing today about is legislation about telecommuting and this issue of computers being able to

be accessed through the internet. Can you talk to me about the

challenges you see there, like what happened to Snowmageddon

here, when we started having people working at home during that

period but using the Internet to access? We basically have to say

there are certain people that just cannot be allowed to work over

the Internet in this issue. Comments? Let me just open it up.

Mr. KUNDRA. Sure. A part of what we want to be able to do in

the broader context of deploying technology is make sure that, on

the one hand, we are leveraging innovation; whether that is mobile

technology in terms of cell phones and PDAs that allow you to have

access to real-time information or telecommuting, for that matter.

And as we think about the Federal Government and where we are

headed, whether the investments we are making in cloud computing or the shift toward where we want to be able to attract the best

and brightest people across the country, is recognizing that there

are inherent risks, but at the same time addressing and confronting those risks.

So if we look at telecommuting, for example, GSA had significant

number of employees who were telecommuting. The Patent and

Trademark Office, on a regular basis, has a significant number of

employees telecommuting. So does the GAO, which is one of the

leaders of the Government in terms of telecommuting.

But what we need to be able to do is make sure, like with the

smart card, being able to authenticate people across those systems;

and these artificial boundaries that we had before in the Federal

Government, where we believed you could build a citadel and walls

around a system, in the new computing paradigm, unfortunately,

security is going to have to be baked in at the data element layer,

protecting every piece of data. And part of what CIOS and Chief

Information Security Officers across the Federal Government are

dealing with is figuring out how do we, on the one hand, leverage

67

these technologies and, on the other hand, make sure that we are

providing the appropriate security controls.

And I am sure Gus and John can comment on this too, given that

they have missions that are not necessarily just within the United

States, but all over the world, and addressing security in the global

context.

Mr. BILBRAY. Comments, gentlemen?

Mr. GUISSANIE. Yes, sir. That is a very interesting example. The

issue with telecommuting back into an organization’s information

system is if you are using, for instance, a DOD laptop and you take

that home and you use your broadband connection to come back

into DOD, we can do that securely; we can establish a secure link

using your broadband connection. We trust the computer you have

because we gave it to you, and that makes to fairly safe for you

to essentially work from home. The trouble we have is people don’t

always have the resources to provide the laptop. In many places in

DOD the laptop has become the desktop, so it is pretty easy to use;

other places they haven’t.

The problem with using the home computer, which lots of folks

advocate—why can’t they just telecommute from their home computer—is the home computer probably isn’t very secure. Somebody

has been out on the internet doing things and visiting various sites

and they have picked up viruses and malware, and now they turn

around and try to get into the Department’s information system

and I have a problem.

So we have been looking at virtualization technology in the Department for a way to kind of get around that problem, and that

essentially means establishing a little virtual environment that is

safe and secure on a platform like your home computer that is isolated from the bad kind of malware that might be on that computer.

So in preparation for the pandemic that we all anticipated we

might encounter this year, the Department looked at how to do

that on a widespread basis. So we came up with a CD-ROM that

we called a boot disc, and it contained a mini operating system and

it would work on both an Apple computer and a Microsoft-based

computer, and you could take it home and it would load up onto

the RAM and create its own little virtual environment, and it could

only go to one place. It would understand what network it was supposed to connect to. It would allow me to securely authenticate

with my smart card into the network and then you could essentially run it just off remote desktop, just like it was on your office

computer. When you were finished, nothing was left, no residue

was left on the home computer, so there is nothing sensitive there

for anybody to find, and because you created that virtual environment, there wasn’t any way that somebody who was sitting on that

computer that shouldn’t be could get into the Department.

So we didn’t have a pandemic, but those discs were used, I understand, quite extensively during Snowmageddon, and we had

quite a success in people being able to telecommute because they

had the disc sitting there.

Mr. BILBRAY. I am glad to hear that. What I worry about when

we talk about the smart card, I look at the Pentagon and worry

that we are using the same pass card, access card that we did in

68

9/11, with no biometric confirmation. Are we looking at the smart

card utilizing biometric confirmation so not just somebody with the

card, but somebody with the right biometrics? In other words,

when you steal the card, you better steal the index finger too,

right?

Mr. GUISSANIE. Yes, sir. Currently, the smart cards we have are

two-factor authentication: the smart card itself, which has some

things in it, and then there is a PIN that you have to know to

make that work. The three-factor authentication would be something you are, for instance, a thumb print. So we have been looking

at that. Currently, the cost and the technology is a little bit prohibitive to make that work when I have to issue 4 million cards out,

but we are approaching that. So that way it is the PIN, your

thumb print makes it active, they know it is you, and then the

technology, the cryptography on the card allows that to establish

a secure connection.

Mr. BILBRAY. Do you realize since 1978 the California driver’s license has had the ability to use biometric confirmation?

Mr. GUISSANIE. No, sir, I was not aware of that.

Mr. BILBRAY. That is why every time we go in to get our license

renewed, they get one more fingerprint on us.

Thank you very much, Madam Chair.

Ms. WATSON. Yes. I would like to go to Mr. Streufert now and

ask about your risk scoring program. Can you summarize for us

the key technical administrative and physical controls or elements

of this program that have enabled State to have such a significant

reduction in its cyber risk profile? I am very concerned about the

decentralization nature of our embassies, our bureaus, and our consulates. How is State able to manage the implementation of the

FISMA security requirements? So if you could kind of expand on

that.

Mr. STREUFERT. Yes, Madam Chairwoman. We use the scanners

that we have had available for a number of years to turn out the

three-ring binder reports for the Federal Information Security

Management Act and we decided that the frequency of doing those

reports every 3 years was just not enough for us, along the lines

of my testimony that our number of malicious code attacks has increased by 47 percent. So we set about a task of trying to increase

that frequency and we found that we could physically go in and collect the things instead of once every 3 years, we could collect it

every 15 days.

And on another set of factors, eight of them, we could actually

do not less than every 36 hours to the far reaches of the planet,

let’s say to Colonia, the capital of Micronesia, where you were the

Ambassador. So by collecting that information—and I checked

again this morning—we can find any particular problem on any of

the workstations in the embassy that you used to watch and total

up what is the average risk for each of those personal computer devices and the server which helps the operations of the embassy.

And we can duplicate that across all 260 embassies and our some

100 locations in the domestic United States.

So that information comes back to a central point and we are

able to not only assess the risk for each location and how they

stack up against their counterparts, but also look at trends. So

69

when the recent attack that occurred, the so-called Google virus,

we knew where that was in our organization and we charged 40

points the first week when that wasn’t taken care of, and the second week we charged 80 points for it, the third week we did 120,

the following week we did 160. You can see the trend.

We are now up to 320 negative points for not getting on top and

fixing that virus as fast as we should. And we can tell you across

our entire organization where it has been done and not done, and

after a point, if they don’t take care of business, it turns like elementary school into a C, D, or F, and that report goes to the Ambassador, the assistant secretary, and that calls for a little closer

inspection on the part of the people that do security in our Department.

Ms. WATSON. Well, are we training our consular officers up on

all of this? Because my concern, when we put Homeland Security

together, you know, 750,000 employees under this umbrella, and I

felt that the consular corp should not go underneath it; it should

stand alone in the State Department, because they have a very

specialized set of skills. So I am wondering how is it working out

under Homeland Security and that particular set of skills. I mean,

are you training up your consular officers out in the embassies?

Mr. STREUFERT. Well, we try. The functions that I am most familiar with are the information systems support for software applications that might help in the managing of passports and visas.

Everyone in the organization, no matter what embassy they are,

have access to these reports and what their progress is, and we ran

statistical reports on whether it was a large embassy or a small

one like Colonia, and we found that really the most important factor was to get the critical security information in the hands of the

people that could make a difference.

So for those that work directly for the Department of State, we

are able to find out what the situation is, and we have not in fact

had serious training problems. In fact, what we found is that this

system uses the time more efficiently of our security professionals.

So whereas we used to have about 60 people who wrote certification and accreditation reports, by the time we implemented this

system, we estimate that there are 4,135 people with significant security responsibilities that are protecting our infrastructure.

Now, I have to say that at the moment we are concentrating on

servers and personal computers. There are many aspects of the

Consensus Audit Guidelines that we have not yet reached, like our

routers and firewalls and some of those other items. So the State

Department has a beginning on this, but I won’t say that there

aren’t quite a few things that we yet need to work on.

Ms. WATSON. I am really pleased that we are having this hearing

today, and I want Mr. Bilbray to really know that we are trying

to improve on our cyber management, and I am pleased to hear

what the State Department is doing, because I do know that out

there in these remote embassies you don’t necessarily get updated

on what is available to you, and the training is not always available to these people. And I thought, oh, my goodness, putting them

under Homeland Security will just complicate. So I am glad you

are aware and that you are actually doing something about it.

70

Let me go very quickly to Mr. Greg Wilshusen. Your testimony

states that for fiscal year 2009, 36 percent of all cyber incidents reported to US-CERT at DHS are still under investigation. Can you

summarize what the largest categories of incidents reported were

and what the statistics tell us about future or emerging threats?

Mr. WILSHUSEN. Yes, I would be glad to. Based upon our analysis

of the information that agencies are required to report to the USCERT, this year, for fiscal year 2009, the number of incidents increased tremendously, from about 16,800 in fiscal year 2008 to just

about 30,000 for fiscal year 2009. Of those, four key categories of

these incidents include unauthorized access in which an individual

was able to gain unauthorized access to an information or to a system; improper usage, that is when the acceptable use policies of

that system or network was inappropriately used; and malicious

code, and that is a key one, too.

That was comprised of about 23 percent of all of the incidents

and events reported to US-CERT, and that is when a Trojan or malicious software was actually installed on a computer. And then the

biggest area had to do with those incidents that are still under investigation, and those are ones in which it is suspected that an incident or an event has occurred, but the extent of it or the character of that incident had not yet been fully determined. So agencies were required to go ahead and report that and they are still

under investigation by those agencies.

Ms. WATSON. OK, I would like now to ask our ranking member

if he has a question.

Mr. BILBRAY. Yes. I just want to make sure that I don’t pass the

representative from the State Department. You know, we talk

about a lot of things, but I think one of the great successes is the

VISIT system. Huge data acquired. I mean, it is astonishing how

much data has gone through there. If publicly you can talk about

it, have we had any problems with unauthorized access into that

system as being a major problem, or have we had a major problem

with people being able to access that information when you needed

it?

Mr. STREUFERT. Well, of course, the information that we draw

upon to protect the borders comes from a combination of systems,

including those that originate from the consular officers and our

embassies and consulates and domestic locations, and that information is——

Mr. BILBRAY. Let me interrupt you and just tell you, as somebody

who crosses the border probably more than most would prefer and

coming in port of entries, the system from the immigrant’s point

of view is absolutely fantastic.

In fact, I really think, Madam Chair, we ought to be talking

about allowing Americans to voluntarily go into that system of

using the biometrics, whatever, because you have American citizens lining up, waiting to be interviewed, but you have a great system where foreign nationals, because they are pre-cleared, the biometrics are there, they whip right through.

So I just have to tell you, from observation, it really seems to be

very much appreciated by the foreign nationals.

Mr. STREUFERT. Thank you, sir. Of course, we endeavor to make

it as customer-friendly as we possibly can balanced against the seVerDate 11-MAY-2000 13:25 Jun 17, 2011 Jkt 000000 PO 00000 Frm 00074 Fmt 6633 Sfmt 6633 C:\KATIES\DOCS\65549.TXT KATIE PsN: KATIE
71

curity needs of protecting the border. The US-VISIT system is one

that is actually hosted and managed by one of the elements of the

Department of Homeland Security. But to your specific point, there

are data exchanges between the Department of Homeland Security

and the State Department, and one of the things that we try to do

is to make sure that all of the systems that maintain our part of

that potential handoff to Homeland Security are as well protected

as possible.

Mr. BILBRAY. Because if you don’t do it right, when they fly into

the airport, that system is going to have a problem.

Mr. STREUFERT. Exactly.

Mr. BILBRAY. Thank you very much.

I yield back, Madam Chair.

Ms. WATSON. Thank you.

I will yield to Mr. Luetkemeyer, if he might have questions.

Mr. LUETKEMEYER. Thank you, Madam Chair. I don’t have any

questions at this time.

Ms. WATSON. This is still our first panel.

Mr. LUETKEMEYER. That is very good. Thank you.

Ms. WATSON. Thank you.

All right, I want to thank all of the panelists. Thank you for indulging us and waiting around and your patience. We appreciate

it. So we will not dismiss this panel and we will call up panel No.

2. Thank you so very much for your testimony.

Panel No. 2. If you will stand, please. It is the policy of the Committee on Oversight and Government Reform to swear in all witnesses before they testify, and I would like to ask all of you to

stand and raise your right hands.

[Witnesses sworn.]

Ms. WATSON. Let the record reflect that the witnesses answered

in the affirmative.

Now I will take a moment to introduce our distinguished panelists. I would first like to start with Mr. Philip Bond, who is the

president of TechAmerica. Mr. Bond is also president of the World

Information Technology Services Alliance [WITSA], a network of

industry associations representing 70 high-tech trade groups

around the world. Previously, Mr. Bond served as Under Secretary

of the U.S. Department of Commerce for Technology, and from

2002 to 2003 served concurrently as Chief of Staff to the Commerce

Secretary, Donald Evans.

Mr. Gilligan is the president of the Gilligan Group and has, for

over 25 years, been in managerial services in leading large information technological organizations. Prior to joining the private sector, Mr. Gilligan served as the Chief Information Officer of both the

U.S. Air Force and the Department of Energy. He also serves as

a member of several boards and advisory groups, including Software Engineering Institute and the Commission on Cybersecurity

for the 44th Presidency.

Mr. Alan Paller is the director of research at the SANS Institute,

where he is responsible for overseeing all research programs. His

work at SANS includes overseeing the Internet Storm Center and

an industry-early warning system, the publication NewsBites, and

participation in other collaborative efforts to identify and mitigate

new and emerging cyber threats.

72

Mr. Christopher Fountain is the president and CEO of

SecureInfo Corp., which provides information assurance solutions

to both civilian and military customers across the Government. He

has a successful track record of leading and growing companies,

with over 22 years of experience in the information technology industry field.

I welcome all of you and I ask that each one of our witnesses now

give a brief summary of their testimony and please try and keep

your summary under 5 minutes in duration, if you can, because

your complete written statement will be included in the hearing

record. So, Mr. Bond, would you please proceed? And thank you for

being here.

STATEMENTS OF PHILIP BOND, PRESIDENT, TECHAMERICA;

JOHN GILLIGAN, PRESIDENT, THE GILLIGAN GROUP, INC.;

ALAN PALLER, DIRECTOR OF RESEARCH, SANS INSTITUTE;

AND CHRISTOPHER FOUNTAIN, PRESIDENT AND CEO,

SECUREINFO CORP.

STATEMENT OF PHILIP BOND

Mr. BOND. Thank you, Chairwoman Watson and Ranking Member Bilbray. Thank you very much. I was privileged to testify before you in 2007 on this subject, to say that it was time to focus

on results rather than compliance, and thrilled to hear that is exactly the focus of your draft legislation. Two and a half years after

that, with some more consultation in the meantime, we are very

much looking forward to FISMA 2.0.

Today, I want to offer an updated version of the recommendations I made 21⁄2 years ago, because we think they are still pertinent. But first I want to acknowledge the new era that we are in,

unprecedented attention at the White House, from Federal CIOS,

and here on Capitol Hill; the White House, of course, with the new

Cybersecurity Coordinator. TechAmerica, yesterday, released its

20th survey of Federal CIOS. Their No. 1 strategic issue:

cybersecurity. And here on Capitol Hill, more than 12 active

cybersecurity bills under consideration right now.

I am proud to say, on behalf of our members, the industry has

responded with companies coming forward with new solutions, new

technologies faster than ever before, and with their clients addressing the needs to manage risk and enhance collaboration with industry partners. Examples would be Lockheed Martin’s new Cyber

Security Technology Alliance, Microsoft’s leadership in taking down

the Waledac Botnet, and the private sector’s quick response on the

Conficker worm, exhibiting exactly the kind of nimbleness that

they offer to their partners in the Federal Government.

So we commend the Chair in taking this important step and focusing again on actual security, not just compliance.

Let me mention the six reforms that we have updated and think

are still relevant.

One is to reform the agency information security approval process, that is, the way they work with private sector partners to

make sure that it is as uniform as it can be.

Second, to remove barriers to innovation. This is what Vivek

Kundra referred to as the culture of compliance, which makes a

73

culture which is not welcoming to new approaches, because if they

can use a time-tested one and check the box, that complies, but it

doesn’t necessarily embrace the new innovative solutions.

Third, we would say increase accountability and authority for the

CIOS and Chief Information Security Officers, CISOs, and to provide a forum where they can collaborate regularly.

Fourth, we agree with the need to enhance Federal cyber risk

management. You heard a great example from the State Department. This would mean, by the way, more security clearances for

information security professionals, more agencies with real-time access to some of the classified information, because you don’t know

what you don’t know.

Fifth, we need to harmonize and enhance the audit and oversight

methods used, thinking primarily of IGs here. You need to make

those processes as uniform as you can so that it is not terribly different; and then, of course, that they are informed on what is a

very technical subject, as they are doing their reviews.

Sixth, we would urge expanding Federal cyber response capabilities, and that would mean codifying and improving the standing of

US-CERT and helping to pave the way for what we think, from the

industry side, is very important: co-located, meaning working sideby-side, the best of the private sector and the best in the public sector, to address this national challenge.

In closing, I would just note that FISMA is now almost 8 years

old. The reform has been in discussion for a number of years. And

while the ideal is always a comprehensive bill addressing all aspects of cybersecurity, that can be a great legislative challenge. So

we would just observe and acknowledge that we don’t want the perfect to be the enemy of the good, and if we get late in the session,

we would urge that FISMA reform not wait. And we believe, to use

Mr. Bilbray’s terminology, with a little more perfection, the tiers

bill would be great progress. Thank you.

[The prepared statement of Mr. Bond follows:]

74

75

76

77

78

79

80

81

82

Ms. WATSON. Thank you so much, Mr. Bond.

We will proceed to Mr. Gilligan.

STATEMENT OF JOHN GILLIGAN

Mr. GILLIGAN. Good afternoon, Chairwoman Watson and Congressman Bilbray and members of the subcommittee. I would like

to thank you for this opportunity to address the committee and

congratulate you, Chairwoman Watson, for the Federal Information

Security Amendments Act of 2010. I believe it is an important step

in the Nation’s efforts to provide the secure and reliable information technology enterprise that we need.

Like many of you, I have a personal sense of urgency for making

dramatic improvements in cybersecurity in the Federal Government. This sense of urgency is informed by the growing threat to

our way of life, resulting from fundamental weaknesses in the computers and networks that have become the foundation of our Nation’s prosperity. I have watched over the past decades as our cyber

threat has grown steadily and the pace of our ability to protect

against these threats has continued to be slowed by a lack of attention and, in many cases, poorly focused efforts. I believe the subcommittee’s proposed legislation contains the key focus areas needed to make rapid progress against the growing threat. Before I describe these elements, I would like to characterize some of the aspects of the current cybersecurity problem as background.

First, I would acknowledge that the Federal Information Security

Management Act of 2002 was a positive step in improving Government security. The law established the imperative for Federal managers to put strong emphasis on cybersecurity and highlighted the

need to use a risk-based approach to identify and implement minimum security controls.

While the FISMA had many positive elements, the implementation of FISMA has been less than fully effective. For example, rather than focusing on minimum controls as required by the law, OMB

policy guidance to Federal agencies has been to implement the entire catalog of controls, over 300 separate controls, published by the

National Institutes of Standards and Technology. This is not possible for any Government agency of any size, and has resulted in

a scattershot approach to improving security.

Moreover, the strong desire to measure and to assign grades to

Federal agencies has resulted in placing emphasis on characteristics that can be easily measured, rather than on controls and activities that best reflect effective security. As a result, in general,

the required FISMA metrics were manually generated, had little

correlation to actual security, and were costly to produce. In addition, the areas emphasized in the metrics did not encourage investments or improvements that would have long-lasting improvement

and security, such as improved used of automated controls.

Unfortunately, the implementation of FISMA has been like getting on a treadmill as a means to get to a destination. A treadmill

is great if all you want is exercise, but it is not a good way to reach

a destination. To continue the metaphor, in the implementation of

FISMA, the Federal Government has certainly burned a lot of calories, but we are a long way to go from reaching our destination

of dramatically improving security of our Federal systems.

83

While total security is beyond our current reach for the foreseeable future, there are many things that we can and should do to

dramatically reduce our vulnerability to attacks, especially from

those attackers who are relatively unsophisticated. Studies have

shown that the relatively unsophisticated attacker group constitutes the majority of current attacks, roughly 80 percent as assessed by the National Security Agency. Unfortunately, our current

cybersecurity defense mechanisms in the Government today are

configured so fragmented and weak that a malicious individual

with virtually no computer skill can download a canned attack

from the World Wide Web and can cause significant harm to cyber

systems. Recent collaborative efforts among the Government and

the private sector have resulted in guidance for organizations to

help focus on the top security control areas and to make effective

use of automation. In essence, this effort is focused on addressing

the 80 percent problem of the cyber threat.

Specifically, a little over a year ago, a group of security experts

from the National Security Agency and other defense organizations, the Department of Homeland Security, Department of Justice, and the National Laboratories, along with colleagues in the

private sector, collaborated on the identification of the most common attack patterns against cyber systems. They subsequently

identified corresponding security controls along with automated

means to implement these controls. Automation is the only practical way to deal with this complex problem.

The consensus effort among these security experts produced a

guideline entitled 20 Critical Controls for Effective Cyber Defense:

Consensus Audit Guidelines, and John Streufert referred to them

as Consensus Audit Guidelines. This document describes the 20

most critical cyber attacks and the controls that are needed to protect against these attacks. In effect, these so-called 20 critical controls reflect the highest priority security necessary to ensure a core

foundation of security for information technology infrastructure.

During the past 18 months, the U.S. Department of State has implemented the 20 Critical Controls guideline and has achieved significant progress in improving effectiveness of cybersecurity.

While the 20 Critical Controls are not intended to provide absolute security, implementation of them has proven to dramatically

improve the ability of complex systems to withstand the majority

of attacks. Implementing good hygiene security controls such as

those identified in the 20 Critical Controls or CAG has additional

benefits beyond security. Specifically, these benefits include reduced help desk calls, improved operational availability and

reduced——

Ms. WATSON. Mr. Gilligan, can you conclude and we will hear the

other two witnesses? Because we do have your statement.

Mr. GILLIGAN. OK.

Ms. WATSON. Thank you.

Mr. GILLIGAN. The key point here is that through this focused

approach you can actually improve security at reduced cost, reduce

operational cost, which is what, in my former CIO parlance I call

sort of a no-brainer for CIOS. The key impediments to achieving

that no-brainer implementation are two: one is the need for clear

policy guidance that actually focuses on the right areas and, secVerDate 11-MAY-2000 13:25 Jun 17, 2011 Jkt 000000 PO 00000 Frm 00087 Fmt 6633 Sfmt 6633 C:\KATIES\DOCS\65549.TXT KATIE PsN: KATIE
84

ond, to address the cultural resistance that must be overcome in

order to be able to implement effective controls at an enterprise

level.

In closing, I would say, as I look at the proposed legislation, I

view it addresses the right areas and will be an effective means of

helping us improve cybersecurity. Thank you.

[The prepared statement of Mr. Gilligan follows:]

85

86

87

88

89

90

91

Ms. WATSON. Thank you so much.

Mr. Paller.

STATEMENT OF ALAN PALLER

Mr. PALLER. Well, this is a good day in cybersecurity, so thank

you for inviting us. I wanted to tell you about something separate

from this that is going on in California this weekend related to

cybersecurity, and then we will do the other. The Governator and

Senator Feinstein announced in October something called the California Cyber Challenge, which was an attempt to find the very talented hackers who can be part of the defense.

Just last week the CNO, the Chief of Naval Operations, announced that he was going to have five scholarships for the kids,

full scholarships, full ride for the kids who did best in these competitions; and there is going to be an announcement this weekend

that there will also be, in honor of you, the Watson Prize, which

is for the kid who comes from Los Angeles County who does best

on the whole statewide competition; and they said they would continue it as long as you were able to give it. So I hope you will.

You heard a lot of testimony about what is wrong and where we

are going. I want to be very specific because you can’t fix this in

the general case; you have to fix it in the specific case. The law

that was written probably wasn’t a bad law, but it had enough bad

elements in it that it enabled four terrible institutions to be created

in its name. And what I mean by terrible is that whatever you do

in legislation, you want to enable the defenders to be able to act

at least as quickly as the offense, because if you hobble them, then

we just don’t have a chance. And the old law actually created four

processes that hobbled them, and we actually now have proof.

You heard Mr. Gilligan talk about these 20 Critical Controls at

NSA and DHS, who really know the attacks, said those are the

ones you have to have. We mapped them against each of the four

processes that were instituted in the aftermath of FISMA and none

of them look for it. Including the FISCAM, which is the thing that

the GAO and the IGs use. They all look for things that were important 10 or 12 years ago and miss the current attacks. So I don’t

need to take a lot of time to say your bill really makes a difference.

I would be happy to answer your questions.

[The prepared statement of Mr. Paller follows:]

92

93

94

95

96

97

Ms. WATSON. Thank you so much.

Mr. Fountain.

STATEMENT OF CHRISTOPHER FOUNTAIN

Mr. FOUNTAIN. Thank you, Chair Watson, Ranking Member

Bilbray, and members of the committee. First, I appreciate the opportunity to address the committee and look forward to answering

questions at the conclusion.

I guess by way of background everybody has said repeatedly that

the threat landscape has changed, there are more threats to our infrastructure than ever before, and that is occurring at the same

time that we are more interconnected than ever before. So that is

a given. So I would like to move quickly to what is strong about

the current FISMA legislation.

While I agree it needs to be improved—and I will talk about the

legislation under consideration specifically after my comments

about the current FISMA law—I think it is important to recognize

the strengths of FISMA and any effort to amend FISMA not do

away with things that have been quite effective. First, the level of

awareness has been dramatically increased as a result of this legislation, and the 107th Congress is to be commended for taking these

steps well before the general public had any awareness of what

cyber even meant or what cybersecurity was all about.

It also established a framework for accountability that is a critical component today and established more strength behind a security officer inside agencies. The most important point is that it established a framework for developing and maintaining guidance to

be used by agencies in their effort to defend IT assets, and that

guidance was really handed for the civilian government to the National Institute of Standards and Technology. And I have to commend NIST for the great work that they have done. The key point

is NIST established a very comprehensive framework and at the

same time they have allowed that framework to live. So the Consensus Audit Guidelines that have been commented upon, those

are mapped now to the latest version of controls that are advocated

or outlined in NIST guidance under 853.

There is one quote that I would like to attribute to Ron Ross,

who is the doctor or the computer scientist at NIST who oversees

this effort. He says, ‘‘There continues to be a notion that FISMA

is all about paperwork and compliance. Rather, FISMA is about

trying to improve the quality of information security.’’ And I think

the important point here is that FISMA is not about paperwork, it

is about taking very deliberate, well thought-out measures to provide for better defense.

Now, with those things said, there certainly are areas for improvement, and I think the legislation under consideration provides

some very good foundations for that. And I don’t interpret the current legislation that is under consideration as a wholesale rewrite

of FISMA; I see that as an enhancement to FISMA in its current

form, which I again think is a good thing.

First, the one thing about current FISMA is it does not have real

teeth. So the law today provides for reporting to Congress and to

GAO, but there are no real consequences for failure to comply with

FISMA. The legislation under consideration provides for enhanced

98

management and oversight and provides for a statutory means of

achieving that, which I applaud in this legislation.

I do believe that the FISMA report card did lead to a paperwork

train, but that was the reporting element, not the aspect of guidelines and standards that are robust and comprehensive.

Also in the proposed legislation, the creation of a National Office

for Cyberspace is a very, very sound idea and a very logical step

forward, and I congratulate you on that move and wish you luck

in trying to move that through the legislative process. As outlined

in the draft, the legislation does require or should require statutory

authority in that office and, in my view, I would suggest that the

committee consider placing that office within the Department of

Homeland Security. And I will comment more about why that is.

In the Department of Homeland Security, that office should report to the President, to the Secretary of Homeland Security, and

to the Congress directly, because this should be a function that

cuts across all of Government and certainly is a Presidential issue.

In my written testimony, there is a lot of detail about how I

would enhance the FISMA reporting to move it to a more metricsbased environment, as Mr. Kundra had suggested earlier this afternoon. I won’t focus on that today. I would rather focus on the statutory office of cybersecurity.

Why DHS? I know in the current draft it is advocated to put that

inside the White House. I would suggest at least consideration for

Department of Homeland Security because, in my view, defending

cyberspace is critical to defending the homeland. They are so tightly intertwined. Every mission across government requires reliable

computers and networks to perform their mission. And even beyond

the boundaries of government, the critical infrastructure that is

managed by private sector companies, they rely very heavily on information assets.

Currently within DHS there is established today an office for

Cyber Security and Communications, CS&C, and within CS&C is

the National Cyber Security Division. There is a high degree of

synergy between the mission sets in those organizations and the

mission for the proposed office of the National Office for

Cybersecurity.

I will read, just for reference, the NCSD mission, which is the

National Cyber Security Division mission. ‘‘The National Cyber Security Division works collaboratively with public, private, and

international entities to secure cyberspace and America’s cyber assets.’’ By definition, they are working across government or across,

really, the private sector and the government to some extent, although with the government it is not their core focus today.

In my view, a National Office for Cyberspace working in concert

with CS&C would provide for a very robust mechanism and set of

processes to look across the entire technology landscape in America, the Government as well as the private sector, and all other elements of our infrastructure, academic and so on.

In summary, I think it is critical that there be recognition that

core elements of FISMA as it exists today are very sound and it

needs to be improved. I believe that the legislation under consideration is timely and necessary. I believe that the key to the new legislation is the statutory authority being placed in this office that

99

is being proposed and that along with statutory authority there

needs to be a budget to allow that office to work effectively. And,

again, in terms of Department of Homeland Security, in my view,

protecting the homeland requires protection of our cyber infrastructure, and that is why I, again, would ask you to consider placing

this function inside the Department of Homeland Security.

I thank you for the opportunity to present my views.

[The prepared statement of Mr. Fountain follows:]

100

101

102

103

104

105

106

Ms. WATSON. Thank you so much.

I am now going to defer to our ranking member for a final question or comment.

Mr. BILBRAY. Yes, a question for Mr. Fountain. What should the

role be from here forward of NIST?

Mr. FOUNTAIN. I think if you look at what NIST has done—there

are a couple of things about NIST that make it a real special entity, in my view. And we don’t do business with NIST. I know what

Ron Ross does because obviously what he does has a big effect on

the things we do for Government. They need to play a very prominent role, in my view. They work very collaboratively across not

only Government, but I know there is legislation under consideration in another committee in the House to have NIST work with

international partners on establishing an international framework

for cybersecurity, because, again, cyber is not a U.S. issue; it is a

global issue, because everything is interconnected, it is not just inside the United States.

And NIST has a track record of being collaborative. I know they

have worked and they are highly complimentary of the Consensus

Audit Guidelines. They do believe that more needs to be done beyond that because addressing the top 20 vulnerabilities won’t necessarily address every vulnerability, and you want to have a framework that addresses the entire landscape. But using the CAG, or

the Consensus Audit Guideline as a good first step is critical.

So, in my view, they should be prominent across this issue,

whether it is in the Office of National Cybersecurity or the National Office for Cybersecurity or the current CS&C, and then with

international partners.

Mr. BILBRAY. Thank you, Madam Chair.

Ms. WATSON. I want to just end with this thought and then ask

you to followup. What we are trying to do is to promote the notion

of harmonizing security frameworks across civilian and national security systems, and lessons that you have learned in business in

and outside of Government we would like to know about.

So if you could give us your further suggestions, and we hope

that they relate to the bill that I have out there. We will welcome

anything that you see will help us improve, and remember we are

looking globally, we are looking across all agencies, and we want

to improve our communication. As we improve our cyberspace technology, we want to be able to have a profile how we can make it

safe. So I invite all of you to contribute. And remember this is an

ongoing process; every day there is a new development, a new technology. So whatever ideas we need them so we can put them into

our base. And remember we make policy, but that policy has to

change to keep up with the changing times.

So I want to thank all the witnesses and Members who attended

this hearing. Without objection, the committee will be adjourned.

[Whereupon, at 4:56 p.m., the subcommittee was adjourned.]

Æ