U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

86–343 PDF 2003

H.R. 3844, THE FEDERAL INFORMATION SECURITY

MANAGEMENT ACT OF 2002

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY,

FINANCIAL MANAGEMENT AND

INTERGOVERNMENTAL RELATIONS

OF THE

COMMITTEE ON GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SEVENTH CONGRESS

SECOND SESSION

ON

H.R. 3844

TO STRENGTHEN FEDERAL GOVERNMENT INFORMATION SECURITY, INCLUDING THROUGH THE REQUIREMENT FOR THE DEVELOPMENT OF

MANDATORY INFORMATION SECURITY RISK MANAGEMENT STANDARDS

MAY 2, 2002

Serial No. 107–190

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

MARK E. SOUDER, Indiana

STEVEN C. LATOURETTE, Ohio

BOB BARR, Georgia

DAN MILLER, Florida

DOUG OSE, California

RON LEWIS, Kentucky

JO ANN DAVIS, Virginia

TODD RUSSELL PLATTS, Pennsylvania

DAVE WELDON, Florida

CHRIS CANNON, Utah

ADAM H. PUTNAM, Florida

C.L. ‘‘BUTCH’’ OTTER, Idaho

EDWARD L. SCHROCK, Virginia

JOHN J. DUNCAN, JR., Tennessee

——— ———

HENRY A. WAXMAN, California

TOM LANTOS, California

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

JANICE D. SCHAKOWSKY, Illinois

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

JAMES C. WILSON, Chief Counsel

ROBERT A. BRIGGS, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT EFFICIENCY, FINANCIAL MANAGEMENT AND

INTERGOVERNMENTAL RELATIONS

STEPHEN HORN, California, Chairman

RON LEWIS, Kentucky

DAN MILLER, Florida

DOUG OSE, California

ADAM H. PUTNAM, Florida

JANICE D. SCHAKOWSKY, Illinois

MAJOR R. OWENS, New York

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

EARL PIERCE, Professional Staff Member

JUSTIN PAULHAMUS, Clerk

MARK STEPHENSON, Minority Professional Staff Member

(III)

C O N T E N T S

Page

Hearing held on May 2, 2002 ................................................................................. 1

Text of H.R. 3844 .............................................................................................. 3

Statement of:

Dacey, Robert F., Director, Information Security, U.S. General Accounting

Office; Mark A. Forman, Associate Director, Information Technology

and E-Government, Office of Management and Budget; Daniel G. Wolf,

Director, Information Assurance Directorate, National Security Agency;

Benjamin H. Wu, Deputy Under Secretary, Commerce for Technology

Administration, Department of Commerce; Ronald E. Miller, Chief Information Officer, Federal Emergency Management Agency; David C.

Williams, Treasury Inspector General, Tax Administration; and James

X. Dempsey, deputy director, Center for Democracy and Technology ...... 46

Letters, statements, etc., submitted for the record by:

Dacey, Robert F., Director, Information Security, U.S. General Accounting

Office, prepared statement of ....................................................................... 48

Davis, Hon. Tom, a Representative in Congress from the State of Virginia, prepared statement of ........................................................................ 44

Dempsey, James X., deputy director, Center for Democracy and Technology, prepared statement of ...................................................................... 124

Forman, Mark A., Associate Director, Information Technology and EGovernment, Office of Management and Budget, prepared statement

of ..................................................................................................................... 74

Miller, Ronald E., Chief Information Officer, Federal Emergency Management Agency, prepared statement of .......................................................... 110

Schakowsky, Hon. Janice D., a Representative in Congress from the

State of Illinois, prepared statement of ...................................................... 143

Turner, Hon. Jim, a Representative in Congress from the State of Texas,

prepared statement of ................................................................................... 40

Williams, David C., Treasury Inspector General, Tax Administration, prepared statement of ........................................................................................ 118

Wolf, Daniel G., Director, Information Assurance Directorate, National

Security Agency, prepared statement of ..................................................... 87

Wu, Benjamin H., Deputy Under Secretary, Commerce for Technology

Administration, Department of Commerce, prepared statement of ......... 101

(1)

H.R. 3844, THE FEDERAL INFORMATION

SECURITY MANAGEMENT ACT OF 2002

THURSDAY, MAY 2, 2002

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON GOVERNMENT EFFICIENCY, FINANCIAL

MANAGEMENT AND INTERGOVERNMENTAL RELATIONS, COMMITTEE ON GOVERNMENT REFORM, Washington, DC.

The subcommittee met, pursuant to notice, at 10:02 a.m., in room

2154, Rayburn House Office Building, Hon. Stephen Horn (chairman of the subcommittee) presiding.

Present: Representatives Horn, Davis, Schakowsky, and Turner.

Staff present: J. Russell George, staff director and chief counsel;

Bonnie Heald, deputy staff director and communications director;

Earl Pierce, professional staff member; Henry Wray, senior counsel; Justin Paulhamus and Teddy Kidd, clerks; Chip Nottingham,

counsel; David McMillen and Mark Stephenson, minority professional staff members; and Jean Gosa, minority assistant clerk.

Mr. HORN. A quorum being present, the Subcommittee on Government Efficiency, Financial Management and Intergovernmental

Relations will come to order.

I am very pleased that we are holding this joint hearing with

Chairman Davis and his Subcommittee on Technology and Procurement Policy on H.R. 3844, the Federal Information Security Management Act of 2002.

It is clear from recent hearings held by our subcommittee that

agency valuations that the work started in 2000 must be continued.

Agencies have not yet developed security plans that balance protection and cost. Few agencies have implemented security controls

that are adequate to protect against violations of privacy, data loss,

corruption or cyber attacks. The current reporting requirements

imposed by the Government Information Security Reform Act have

brought the scope and magnitude of security weaknesses into sharp

focus in both Congress and the executive branch. This focus is the

first crucial step in eliminating security weaknesses.

H.R. 3844 incorporates the key provisions of the Government Information Security Reform Act, including the requirements for riskbased security management, independent evaluations, and reporting of agency security programs. The bill also clarifies some of the

language in the original act; it eliminates the sunset provision of

the act and adds new provisions to reflect lessons learned during

the implementation of the 2000 act.

The purpose of today’s hearing is to consider the merits of the

legislation and any potential improvements to it. I welcome today’s

2

witnesses and I look forward to working with each of you to ensure

the security of the Government’s information technology resources.

We are delighted to have the gentleman from Texas, Mr. Turner.

He comes from Mr. Davis’ committee. We lost him out of our committee and we miss you. Mr. Turner.

[The text of H.R. 3844 follows:]

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

Mr. TURNER. Thank you, Mr. Chairman. It is good to be at a

hearing with you again because it was a pleasure to serve with you

on your committee during the last Congress.

I understand your committee has had a number of hearings on

the issue of computer security. You have done some very hard work

on the issue and I commend you for the attention you have paid

to this very important matter. I thank you for scheduling a joint

hearing with our committee.

This legislation, the Federal Information Security Management

Act was introduced by the chairman of our subcommittee, Tom

Davis. I want to thank Mr. Davis for his efforts and his work with

the minority in working on the various provisions of the bill. This

legislation, as we know, will permanently authorize the information security program evaluation and reporting requirements of the

Government Information Security Reform Act that became law

about 18 months ago and will expire at the end of November.

This law has proved to be very useful in focusing agencies’ attention to the critical issue of computer security by requiring annual

reports to the Office of Management and Budget. The bill would

make a number of changes designed to strengthen information security across the Federal Government including the development of

minimum information security standards by the National Institute

of Standards and Technology, creation of a Federal Information Security Incident Center, and clarification of the definition of national

security systems. Most importantly, it would require that the reports under this bill would go not only to OMB but to the Comptroller General of the General Accounting Office to facilitate better

congressional oversight of computer security.

Again, Chairman Horn, I commend you on your leadership on

this issue and I commend Chairman Davis for his sponsorship of

the legislation.

I yield back. Thank you, Mr. Chairman.

[The prepared statement of Hon. Jim Turner follows:]

40

41

42

Mr. HORN. Thank you.

I am delighted now to greet our Co-Chairman, the gentleman

from Virginia.

Mr. DAVIS. Good morning.

I want to thank you for holding this hearing in a joint format

and for your many years of leadership on the issues of information

security and improved government management.

I would also like to thank the distinguished group of witnesses

who have joined us today to share their expertise on the issue of

government information security, as well as for your specific comments on H.R. 3844.

Government information security is not a new issue to this committee and it is certainly not a new issue to our witnesses today.

Billions of dollars have been spent over the years, numerous legislative administrative initiatives have been implemented and some

of the best thinking and most respected expertise on information

security has been cultivated by our Federal Government in an ongoing effort to protect our information technology systems from intrusion and tampering.

Overall, I believe that our Federal workers and managers deserve enormous credit for adopting to the complex and fast-moving

changes that have been thrust upon our government by the information technology revolution. Similarly, I believe we are on the

right track in strengthening our management information security.

Clearly this administration, represented by several talented leaders

here today, is taking this issue seriously and is working harder

than ever to better secure our Federal Government’s information

assets.

While today’s discussion focuses on just one bill that will extend

and hopefully improve the existing information security management process, it was first codified 2 years ago with the enactment

of GISRA. We should not lose sight of the big picture, the fact that

our Nation is facing a growing and very real threat from those who

seek to harm us by targeting our information systems in an effort

to disrupt and disable the effective operation of our government.

Every day we learn of new attacks on our information systems and

every day IT experts, managers and procurement officers are working to stay one step ahead of the threat.

That is why it is critically important for Congress to lend a hand

in providing direction that brings coordination, increased management attention and real accountability to the Federal information

security sector. I believe it would be a mistake for Congress to

micromanage the executive branch’s efforts in this area and we

need to avoid the temptation to prescribe a rigid, one-size fits all

standard that is likely to become outdated quickly as technology

and know-how evolve.

At the same time, I am not satisfied with our Federal Government’s overall performance in securing our information infrastructure. The bottom line is, we are still too vulnerable. Record IT security expenditures and unprecedented attention to IT security, while

important indicators of level of effort, are not the benchmarks we

should use to determine success. Instead, we need to focus on developing strong, risk-based, agency-wide security management programs that cover all operations and assets of our Federal agencies.

43

In addition, new legislative guidance is needed to require the development, promulgation and compliance with mandatory management controls for securing information systems and managing risks

as determined by agencies.

I think H.R. 3844 clarifies and strengthens the existing Government Information Security Reform Act of 2000 in four major ways.

Under FISMA, we included a number of provisions that require the

development, promulgation and compliance with minimum mandatory management controls for securing information. For example,

NIST would be required to develop mandatory information security

standards for all agencies. Second, agencies would be required to

submit an annual report featuring the results of agency evaluations of information security to both OMB and the Comptroller

General. Third, the treatment of national security systems would

be clarified by removing the term ‘‘mission critical system’’ and replacing it with ‘‘national security system.’’ This means that only

truly national security and intelligence related information systems

would be exempt from information security risk management requirements. Fourth, OMB would oversee the establishment of a

central Federal Information Security Incident Center that would

inform agencies about information security, threats and

vulnerabilities and provide technical assistance to agencies.

In future years, all of us involved with setting and implementing

security policy during these challenging times will be faced with

the question did we do enough to safeguard our critical information

structure. I believe that FISMA will go a long way toward allowing

us to honestly answer that question in the affirmative.

I look forward to our hearing today, to improving this legislation

if needed, and to ultimately bringing it forward to enactment.

Thank you.

[The prepared of Hon. Tom Davis follows:]

44

45

46

Mr. HORN. We will begin with panel one. Our first witness, and

not a stranger to these committees, is Robert F. Dacey, Director,

Information Security, U.S. General Accounting Office, headed by

the Comptroller General of the United States. We appreciate all

the work the GAO does. We will announce one of their books as

we end this particular hearing.

STATEMENTS OF ROBERT F. DACEY, DIRECTOR, INFORMATION SECURITY, U.S. GENERAL ACCOUNTING OFFICE; MARK

A. FORMAN, ASSOCIATE DIRECTOR, INFORMATION TECHNOLOGY AND E-GOVERNMENT, OFFICE OF MANAGEMENT

AND BUDGET; DANIEL G. WOLF, DIRECTOR, INFORMATION

ASSURANCE DIRECTORATE, NATIONAL SECURITY AGENCY;

BENJAMIN H. WU, DEPUTY UNDER SECRETARY, COMMERCE

FOR TECHNOLOGY ADMINISTRATION, DEPARTMENT OF

COMMERCE; RONALD E. MILLER, CHIEF INFORMATION OFFICER, FEDERAL EMERGENCY MANAGEMENT AGENCY; DAVID

C. WILLIAMS, TREASURY INSPECTOR GENERAL, TAX ADMINISTRATION; AND JAMES X. DEMPSEY, DEPUTY DIRECTOR,

CENTER FOR DEMOCRACY AND TECHNOLOGY

Mr. DACEY. I am pleased to be here today to discuss the proposed

Federal Information Security Management Act of 2002, FISMA. As

you requested, I will briefly summarize my written statement.

Since September 1996, we have reported that poor information

security is a widespread Federal problem with potentially devastating consequences. Although agencies have taken steps to redesign

and strengthen their information security programs, our analyses

of information security at major agencies have shown that Federal

systems were not being adequately protected from computer-based

threats, even though these systems process, store and transmit

enormous amounts of sensitive data and are indispensable to many

Federal operations.

Concerned with these reports, Congress passed into law the Government Information Security Reform provisions commonly referred to as GISRA to reduce these risks and provide more effective

oversight of Federal information security. First year implementation of GISRA represented a significant step in improving Federal

agency information security programs and addressing longstanding

weaknesses.

For example, agencies have noted benefits from GISRA such as

increased management attention to and accountability for information security and have stated that as a result of implementing

GISRA, they are taking significant steps to improve their information security programs. Agency IGs also view GISRA as a positive

step toward improving information security, also noting the increased management attention.

In addition, the administration has taken important actions to

address information security such as plans to integrate information

security into the President’s management agenda scorecard. Such

benefits and planned actions demonstrate the importance of

GISRA’s requirements and the significant impact they have had on

information security in the Federal Government.

FISMA would permanently authorize and strengthen the information security program, evaluation and reporting requirements

47

established by GISRA which is to expire in November of this year.

We believe the continued authorization of such important information security legislation is essential to sustaining agency efforts to

identify and correct significant weaknesses.

Further, this authorization would reinforce the Federal Government’s commitment to establishing information security as an integral part of its operations and help ensure that the administration

and Congress continue to receive the information they need to effectively manage and oversee Federal information security.

FISMA continues several important GISRA provisions, including

requiring agency program managers and CIOs to implement a riskbased security management program covering all operations of the

agency; second, requiring an independent annual evaluation of

each agency’s information security program; third, taking a governmentwide approach to information security by accommodating a

wide range of information security needs and applying requirements to all agencies, including those involved in national security;

and fourth, through annual reporting requirements, providing a

means for both OMB and the Congress to oversee the effectiveness

of agency and governmentwide information security, measure

progress in improving information security, and consider information security in budget deliberations.

FISMA also proposes a number of changes and clarifications to

strengthen information security, some of which address issues

noted in the first year implementation of GISRA. In particular, the

bill requires the development, promulgation and compliance with

minimum mandatory management controls for securing information and information systems, creates the requirement for annual

agency reporting to both OMB and the Comptroller General, and

clarifies the definition of and evaluation of responsibilities for national security systems. In addition, the bill proposes other changes

that would require Federal agencies to strengthen their information security programs, update the information and security responsibilities missed, and clarify other otherwise streamline definitions and legislative language.

In addition to reauthorizing information security legislation,

there are a number of other important steps the administration

and agencies should take to ensure information security receives

appropriate attention and resources and that known deficiencies

are addressed. These include delineating the roles and responsibilities of the numerous entities involved in Federal information security and related aspects of critical infrastructure protection; obtaining adequate technical expertise to select, implement, and maintain

controls to protect information systems and allocating sufficient

agency resources for information security.

As the chairman noted, later today the committee will be releasing a report which summarizes our testimony on March 6 and

makes certain recommendations for improving GISRA and its implementation.

Mr. Chairman, this concludes my statement. I would be pleased

to answer any questions that you or the Members may have.

[The prepared statement of Mr. Dacey follows:]

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

Mr. HORN. Thank you very much. As usual, the GAO comes

through.

Now we have a new person with a rich background, Mark A.

Forman, Associate Director, Information and Technology and EGovernment, Office of Management and Budget. He knows more

about any of these problems I think than all the rest of us put together. He created and lead the IBM Americas Public Sector EBusiness Consultant Services, was senior professional staff member

of our Senate portion of the other body, Senate Governmental Affairs Committee. He has been deeply involved in both the Congress

and the executive branch. We are glad to have you here.

Mr. FORMAN. Thank you. I am glad to be here and I appreciate

you inviting me to discuss the Federal Information Security Management Act and the administration’s views.

I also want to thank your committee and Chairman Davis’ committee for the continued vigilance on government computer security. I have been in my job now for 10 months and we have had

three hearings on this. It is becoming almost quarterly and I actually think that is good that we have that continued oversight.

We at OMB and other administration officials have discussed

components of the Federal Information Security Management Act

with your staff and we are still developing an administration position on the bill. As you will hear from my agency colleagues today,

there are many divergent views on various provisions. We look forward to working with you and Chairman Davis to make the bill

successful as it moves through the legislative process.

As you know, the President has given a high priority to the security of government assets as well as improving the overall management performance of Executive agencies. These priorities are interrelated. As I discussed this March before the committee, our review

of agency security programs found that most security issues in the

government are fundamentally management issues. We are tracking progress on both issues through use of the executive branch

score card for the President’s management agenda. If an agency

does not meet the IT security criteria, it will not achieve a green

score, regardless of their performance under the other e-government criteria.

OMB reported in our February 13 Security Benchmark Report to

Congress on Government Information Security that as is, the current state of security across the Federal enterprise is poor. We reported on six fundamental governmentwide weaknesses as well as

agency-specific gaps. We find those weaknesses are pervasive and

many exist across the Federal community, including the national

security community. We found that agencies must greatly increase

their degree of senior management attention, measure performance

of officials charged with security responsibility and improve security education and awareness, fully integrate security into their

capital planning investment and control process and enterprise architecture, ensure that contractor services are adequately secured,

and improve the ability to detect, report and share information on

incidents and vulnerabilities.

As we look at the future or what we call the ‘‘to be’’ state of Federal security, we believe it is one of the active measures that will

continue to anticipate and respond to future needs. The future viVerDate 11-MAY-2000 12:23 May 01, 2003 Jkt 000000 PO 00000 Frm 00075 Fmt 6633 Sfmt 6633 D:\DOCS\86343.TXT HGOVREF1 PsN: HGOVREF1
72

sion of Federal security incorporates active measures and we have

to be able to both prepare and defend against attacks where preemption is not possible so that we know how our own information

systems survive attacks when defenses fail.

Such a state is somewhere off in the future, however, and such

a number of fundamental management and program reforms are

needed to support it. Particularly, we need to complete the development of governmentwide and agency-specific architectures within

which business processes have been unified and simplified, and get

rid of unnecessary duplication so we not only promote common

ways to conduct government business, it will permit common protection regimes and simplified security approaches.

The ‘‘to be’’ state also requires much in the way of using automated security tools that reduce the need for human intervention

and reduce human error and resource requirements. The ‘‘to be’’

state of anticipating threats will also require something that is

woefully lacking today, rapid and in-depth threat analysis. Today’s

analysis products largely consist of consolidated reports of what is

happening or what has already occurred. That is not good enough.

We must improve the development, quality and wide distribution

of effective threat analysis and response regimes.

OMB is pursuing a five part approach to improved government

security which includes items such as business cases, capital planning, project matrix analysis, which I have spoken about before,

annual agency security reports and corrective action plans that reflect priorities. All efforts must come together to clear us clear

audit trails that link the needs, corrective action plans and spending priorities including business cases. More detail on that is in my

prepared statement.

Through this five part approach, we are building toward a ‘‘to be’’

state and believe within 18 months we will have demonstrably improved performance and results in agency security programs. We

give some of the details of that in my prepared statement. That includes using security performance measures that identify the gaps

and set priorities within each agency and form agency and OMB

budget decisions and assist in preparing the President’s budget.

We are also identifying opportunities to reduce or eliminate unnecessary duplication of security effort among agencies making certain practices more uniform and consolidating programs and operations to increase performance while reducing costs. Among the

candidates for consolidating greater uniformity are consolidating

the security curriculum as well as the actual conduct of training

and education and awareness for Federal employees; improving incident handling, information sharing, software patch identification

and distribution; improving methods for grading or designating the

level of risk, assigning core security requirements for operations,

assets and the same risk level, unifying and simplifying requirements for and implementation of contingency planning and continuity of operations, improving security and the acquisition of

products and services, very similar to some of the concepts outlined

in Congressman Davis’ bill.

While many security requirements within the Government are

similar, many are distinctly different. Therefore we must be careful

and resist overly simplistic attempts to standardize management,

73

operational and technical security controls. Security controls must

be built to the specifications of the programs, not programs built

to security initiatives.

NIST continues to play a critical role in supporting OMB and assisting agencies in improving their security performance and there

are details in my prepared testimony.

I want to finish up by talking about the specific stats associated

with the OMB chaired executive branch Information Systems Security Committee which is one of the components of the President’s

Critical Infrastructure Board. I mentioned this in my statement at

the March hearing.

Last month, we held our first meeting of the committee and have

begun work on the following four issues, and details are in my prepared testimony: grading risks; uniform security practices, including acquisition of products and services; review of current policy

standards and guidance.

Future security reporting will drive the performance improvements not simply tallying numbers. As GAO, OMB and others recognize, today’s information security world demands each agency

employ a continuing process of risk-management that keeps pace

with rapidly evolving threats and vulnerabilities. So too, OMB’s

oversight process must keep up with the changes in status. A conventional view is the comparison should show security weaknesses

have been reduced and no new ones have cropped up. That, we believe, is the old way of thinking.

Identifying more weaknesses is not necessarily a reflection of

performance. Reaching the ‘‘to be’’ state I described earlier demands more deeply and more often into programs and systems to

find problems as the vulnerabilities arise and before they can be

exploited. The more you look, the more you find.

In conclusion, we have developed a strategy to measure program

performance and drive improvements by an order of magnitude.

Some of what is needed involves technology, much more involves

integrating security into project development and management decisionmaking. At this point in time, new standards and technology,

while impacting little in improving security performance, must be

first addressed and correct management weaknesses.

We look forward to working with the committee and Congressman Davis as the bill moves forward through the process.

[The prepared statement of Mr. Forman follows:]

74

75

76

77

78

79

80

81

82

83

84

85

Mr. HORN. We thank you for that and we will have a number of

questions when we finish the panel.

We next have Daniel G. Wolf, Director, Information Assurance

Directorate, National Security Agency. He has had responsibility

for the various information situations and strategies to protect the

defense information infrastructure and as appropriate, the national

information infrastructure. He spent about 33 years in this type of

analytic work and has received numerous awards for his many contributions in defense intelligence communities. We are delighted to

have you here. We have had great cooperation from the National

Security Agency and we appreciate the tough job he has and they

have. We are glad to have you here. Mr. Wolf.

Mr. WOLF. My name is Dan Wolf and I am NSA’s Information

Assurance Director. I appreciate the opportunity to be here today

to talk about information technology security as your subcommittee

considers H.R. 3844.

My organization is responsible for providing IA technologies,

services, processes and policies that protect national security information systems throughout DOD, the intelligence community and

related law enforcement agencies. While some may suggest that

NSA’s perspective is too narrow because we focus on national security systems, I would like to note NSA has been in the business of

protecting information systems from attack and exploitation since

1953.

During NSA’s nearly 50 years of producing not only policy but

also in the hard work of developing security products and services

to implement these policies, we have learned, and I believe we

agree with many members of this committee that successful information security demands aggressive management oversight, extensive sharing of best practices and a bedrock foundation of proven

security standards.

While I am not in a position to express the administration’s view

of H.R. 3844, I thought it might be helpful if I shared NSA’s technical experience in these matters with you. There are a number of

areas in H.R. 3844 where we believe improvements can be made

based on our experience. My written testimony goes into much

more detail but I would like to briefly highlight four areas.

The first area is defining and identifying national security and

mission critical systems. We suggest that the proposed definition

for identifying national security systems in H.R. 3844 might add

more confusion to an already complex process. We have also

learned by analysis of dependence between computer systems during the Y2K crisis, that there are many similarities found in identifying and protecting mission critical systems and national security

systems. Therefore, we suggest that you consider keeping the original GISRA definition of national security systems.

In a related matter, the provision that directs NIST to develop

guidelines for identifying an information system as a national security system is unnecessary because the national security system is

already defined in the existing laws.

The second area is risk assessments and system engineer connection management processes. There are many references to a risk

assessment process in H.R. 3844. It has been our experience that

useful risk assessments are extremely difficult to complete and

86

maintain. This problem gets especially dangerous when you consider that although these systems are assessed for risk independently, they soon become interconnected. We have consistently found

one organization’s risk calculations and assumptions will be very

different from another unless the process of performing the risk assessment is exceptionally well specified and managed.

We suggest that a standard method for performing risk assessments be developed for use throughout the Federal Government. It

must describe not only the assessment process but also define

standard methods for characterizing threats, defining potential

mission failures and include a process for ensuring that these baseline risk assessments are periodically reevaluated, especially as

changes are made in connectivity. The quality of risk assessments

for our interconnected systems must not be left to chance or independent decisions. Otherwise, the weakest link in the chain will

fail.

Third, coordinating incident detection and consequence management, the defense of Federal and DOD networks against cyber attacks requires a robust and time sensitive defense in-depth approach. NSA’s National Security Incidence Response Center provides real-time reporting of cyber attack incidences. Through

around the clock, 7-day-a-week operation, NSIRC provides DOD,

the intelligence community and the Federal law offices with information valuable in identifying and encountering cyber attacks.

NSA has established a trusted relationship with the Fed CIRC.

Moreover, we have similar relations with the National Infrastructure Protection Center and the NIPC and the Department of Defense’s Incidence Center, the DODCERT. We believe that adding a

new Federal Incident Management Center as described in the proposed legislation would add unnecessary redundancy and decrease

both the efficiency and effectiveness of our existing processes.

Fourth, sharing vulnerability information, the technology we

used today throughout the Government and the private sector is a

veritable monoculture. For example, this means that knowledge of

vulnerability discovered in a system at the Labor Department could

be used by an adversary to attack the computer in the Defense Department. While we agree it is extremely important for all Federal

departments to share vulnerability information, we also believe

this information must be disseminated only through consideration

regarding the consequences, not just to an organization’s internal

systems but the consequences to all Government systems is vulnerability becomes widely known.

I would like to thank the members of both subcommittees for

your consistently strong interest and attention to this vital area.

Your leadership is providing a public service by raising the issue

of the serious security challenges we are all facing in the age of

interconnected and interdependent networks.

This concludes my testimony. I would be happy to answer any

questions.

[The prepared statement of Mr. Wolf follows:]

87

88

89

90

91

92

93

94

95

96

97

98

Mr. HORN. Thank you.

Next is a person well known to this subcommittee and the Congress, Mr. Benjamin Wu, Deputy Under Secretary of Commerce for

Technology Administration, Department of Commerce. He was very

helpful to us in our Y2K computer problems and worked very closely with Representative Morella of Maryland in her role on the

Science Committee as well as in Government Reform. Nice to see

you again.

Mr. WU. Thank you, Chairman Horn, and good morning. Good

morning to you, Mr. Davis and also Ranking Member Schakowsky.

On behalf of the Department of Commerce’s Technology Administration and its National Institute of Standards and Technology, I

want to share with you our views on Congressman Davis’ bill, H.R.

3844.

Let me first commend you, Mr. Chairman, and the entire subcommittee for continuing to focus on the critical issue of cyber security in the Federal Government. Today’s hearing will once again remind Federal agencies that cyber security must be addressed in a

comprehensive manner and on a continuing basis.

As you mentioned, I had the privilege and the pleasure of working with you, Chairman Horn, and also Chairman Davis, as we

successfully battled the Y2K computer problem which some have

drawn parallels to the issue of computer security. With Y2K as you

well know, we knew who the enemy was, we knew how it was

going to strike, we knew when it was going to attack. We don’t

have that luxury with computer security. That is why it is important that we continue to focus on Federal efforts on computer security and I am very proud that NIST plays an important cyber security role for our Nation.

We have specific statutory responsibilities for Federal agencies

under the Computer Security Act of 1987 and also its follow on legislation, including GISA. NIST has been tasked by Congress to develop standards and guidelines to assist the Federal Government

in protection of sensitive, unclassified systems. These responsibilities supplement NIST’s broader mission of strengthening the U.S.

economy, including proving the competitiveness of America’s information technology industry.

In support of this mission, NIST conducts standards and technology work to help industry produce more secure, yet cost effective

products which we believe will enhance competitiveness in the

marketplace. Having more secure products available in the marketplace will also benefit Federal agencies because they principally

use commercial products that construct and secure their systems.

The Computer Security Division in our Information Technology

Laboratory is the focal point of our cyber security program. The

Computer Security Division focuses on a few key areas: photography standards and applications, security research, security management, and security testing. In previous testimony before this

committee on March 6, the Director of NIST, Arden Bement, provided you with a broad review of current NIST activities undertaken to fulfill our important cyber security responsibilities, so it

is not necessary to repeat to you what NIST is doing now but I do

want to discuss with you what NIST would be asked to do if H.R.

3844 was enacted, as introduced, and offer some comments.

99

Under FISMA, NIST would be tasked with a number of responsibilities ranging from developing IT standards and guidelines, developing security standards and guidelines, consulting with other

Federal agencies, providing assistance to agencies, submitting proposed standards and guidelines to OMB for promulgation, conducting security research, developing security performance indicators,

evaluating private sector information, security policies and also reporting annually to OMB among others.

Additionally germane to NIST’s key security responsibilities,

H.R. 3844 would establish an Office for Information Security Programs at NIST which the director would be responsible for administering. NIST information security responsibilities, under FISMA,

authorize a $20 million level funding for NIST’s security program,

rename the computer security system and Privacy Advisory Board

as the Information Security Board with new responsibilities, as

well as eliminating the existing process under limited and specified

circumstances for agencies to waive the use of mandatory and binding security standards.

The Department believes that overall, the drafters of the bill are

to be commended for taking a sound and practical approach to information security, one that will serve the Nation well in the years

ahead. The bill appropriately maintains existing separation of responsibilities for security and sensitive systems, which is a major

concern for the IT industry.

Current NIST activities are well aligned with the majority of the

bill’s provisions and additional activities, specific assignments and

also the envisioned growth of NIST in the cyber security program

will further strengthen the security of all Federal security agency

systems. Moreover, the bill will promote the consistencies in the

protection accorded to similar systems and information across the

entire Government.

Let me respectfully offer, however, the Department’s specific concerns on the bill for the committee’s consideration. I am mindful of

the time constraints I have so let me just run over them in general.

I would be happy to respond to them at a later point in the questions.

One is proposed transfer authority to issue standards and guidelines from the Secretary of Commerce to the Director of OMB. We

believe that should be reconsidered because the Secretary represents industry and that is an inherent function of the Secretary.

In the bill there are also a number of references to the standards

development role of OMB. We believe that OMB develops and

issues broad security policy and guidance and this should be clarified vis-a-vis what NIST does in collaboration with OMB.

The third concern has to do with the agency’s current limited

ability to waive mandatory and binding standards.

Finally, the bill would also require that NIST provide OMB with

an annual report regarding major deficiencies in information security at Federal agencies and since NIST’s responsibilities do not extend to providing day-to-day operational security for Federal systems and Federal agencies, any such report we believe would be

woefully incomplete.

I want to close by emphasizing that our national commitment to

improving cyber security must be increased in Federal agencies

100

and elsewhere. As Congressman Davis’ bill reemphasizes, there is

much more to be done as we address cyber security in the Federal

Government. The NIST cyber security program has a proven track

record of success and stands ready to work with you, the committee

and other Federal agencies in the enhanced role envisioned in

FISMA.

Thank you very much.

[The prepared statement of Mr. Wu follows:]

101

102

103

104

105

106

107

108

Mr. HORN. We appreciate your testimony and we will get into

that in the question period shortly.

Our next witness is Ronald E. Miller, Chief Information Officer

and Assistant Director, Information Technology Services Director,

Federal Emergency Management Agency, FEMA. That is a very

fine agency. Over the last 10 years, they have really put their act

together and with all the problems that have come forth with tornadoes, floods, you name it, they have done great work with all of

us in the Congress.

Mr. Miller, you have a very fine record in the military. We are

glad to see you here.

Mr. MILLER. Thank you, Chairman Horn, Chairman Davis and

members of the committee.

I would like to take the opportunity to thank you for addressing

this very important issue and while I cannot present the administration’s view, I would like to share both FEMA’s position on information security and my perspective as the security liaison for the

CIO Council.

Very briefly I want to spend a few moments talking about

FEMA’s approach to IT security. It is fairly straightforward. As a

Federal agency, we are required to deliver mandated products and

services and we must do so in full compliance with laws of the

land. That includes the security requirements put forth in public

laws, executive branch directives, Federal standards and agencyspecific policies. We view those requirements as being the minimum set of security standards that we must comply with in the development of our systems, so that in that regard we want to include a certain set of steps to take for every system we implement.

Those steps include formally certified system security plan, formal

accreditation and approval to operate by the appropriate management official, tested contingency plans, implemented incident handling capabilities, security education awareness program and a capital plan for funding security across the systems life cycle.

Our approach is to use a well disciplined capital planning and investment process and ensure security costs are incorporated into

the system development life cycle. Our capital planning process is

strongly linked to the agency’s performance plan and goals. Using

this approach, we have created a framework whereby IT solutions

are implemented to support prioritized agency mission requirements and security is made a part of the IT solution itself. In this

manner, we are also able to determine that the resources we apply

to our IT security activities are directly aligned with the agency’s

performance goals.

With regard to GISRA, there are noticeable improvements in the

area of IT security because of the enactment of that legislation because it helped put management focus on this important problem.

We still have need for additional progress and believe that FISMA

is sound and will help.

The CIO community overall views GISRA as a very positive step

forward because it codified many of the requirements put forth in

OMB Circular 30. The codification of those requirements signaled

a heightened awareness on the part of the legislative branch concerning the importance of implementing adequate IT security. It

also helped to clarify the role of the Chief Information Officer as

109

being responsible for implementing an adequate IT security program across the agencies. It required that a senior official be designated to head IT security and that official would report directly

to the CIO.

We find the annual report requirement to be particularly useful

because it allows us to not only gain a full perspective on the state

of our security programs, but it also ensures that the state of IT

security is well documented and understood by senior agency managers. In general, we see FISMA as similar to GISRA in most regards and we are confident in our abilities to implement if enacted.

There are areas where we believe the bill needs improvement

and we would like to see it address the following. First, we would

like to see a stronger link between IT security requirements and

the capital planning process, stronger emphasis on resources for IT

security training, the retention of IT security professionals, support

for day to day security efforts and individual accountability for security.

We need to ensure that capital planning investments include consideration for security which is a powerful incentive for program officials. We believe we need a work force that is well trained and

prepared to address the complex issues found in IT security and an

emphasis should be placed on providing resources that provide

training to employees responsible for implementing these standards.

We also believe we need to look to retaining the work force once

we have recruited and trained folks that are skilled in IT security.

We support the administration’s Managerial Flexibility Act which

would allow Federal agencies the flexibility to provide hiring and

retention incentives to potential employees, including IT security

professionals.

There needs to be overarching support for the day to day security

efforts across the Federal Government such as CERT, the

FedCIRC, incident support, patch distribution service is just beginning at GSA, training and guidelines and soon. We need to hold

Federal Government officials individually responsible in their performance plans for the implementation of security within their programs. OMB has certainly taken a step in the right direction with

the balanced score card.

The world has changed in many ways since September 11th and

I believe that with the concept of electronic government, the security requirements are more prevalent now than ever before. I am

looking forward to working with the committee and each one of you

in helping the Federal Government address needed improvements

in Federal IT security.

Thank you for this opportunity. I look forward to questions at the

end of the testimony.

[The prepared statement of Mr. Miller follows:]

110

111

112

113

114

115

116

Mr. HORN. Thank you.

Next is David C. Williams, Inspector General of quite a few agencies. He started out, I suspect, being a Special Agent in both the

U.S. Secret Service but also in U.S. military intelligence. He is a

recipient of a U.S. Bronze Star and the Vietnamese Medal of

Honor. We are delighted to have you here.

I had one question on the Inspector General role with the Tax

Administration. Was that to deal with the 100,000 people that are

in IRS or the clients they deal with?

Mr. WILLIAMS. I believe we have a very strong commitment toward their clients, the taxpayers and certainly as represented

through the House and Senate committees. Our coverage involves

the activities of the Tax Administration, which is both the IRS and

some policy units inside main Treasury.

Mr. HORN. Great. Go ahead with your summary.

Mr. WILLIAMS. I appreciate the opportunity to appear today to

provide an Inspector General’s perspective.

Government agencies continue to struggle with the appropriate

balance between IT security and computing capacity, too often with

an overwhelming bias toward speed and ease of operations. The

Government Information Security Reform Act has served as an essential beacon urging agencies toward a more balanced course.

During fiscal year 2001, the GISRA assessments identified substantial vulnerabilities across government that could threaten the

security of information systems. These included formal security

training and awareness programs for all employees were frequently

ineffective or nonexistent.

In the IRS for instance, 70 of 100 employees were willing to compromise their passwords during pretext telephone calls by IG auditors. No matter how strong other controls may be, employees can

often be the most vulnerable component of an agency’s IT security

program.

Specific performance measures were often absent such as the effectiveness of efforts to reduce the impact of computer viruses.

Oversight of contractors was not sufficient and many had not received the necessary background clearances. An unacceptable number of systems and applications critical to the agency missions were

not security certified or accredited. System intrusion incidents were

not consistently reported and shared throughout the Government

to assist agencies to proactively identify and combat hacking. Security controls often seem to be an after thought in IT budget investment decisions and senior managers often assumed little responsibility for IT security within their programs, deferring entirely to

small security offices.

To increase the likelihood of success, agencies need to be held accountable for their security programs. Some agencies appear to

view the GISRA annual reporting process as a pro forma exercise.

To assure GISRA effectiveness funding requests for IT initiatives

should be contingent on the integration of adequate security controls. To assist agencies in adhering to GISRA and H.R. 3844 provisions, we offer the following suggestions to improve the consistency

in conducting and reporting information security assessments and

investigations.

117

Certain terminology should be clarified to avoid confusion in reporting. Terms such as programs, systems, networks, mission critical and mission essential are subject to varying interpretations.

Agency officials should be required to use the NIST IT security assessment framework. Agency and IG reporting requirements should

be integrated to reduce duplication of effort. The OMB should provide implementation and guidance at the beginning of each reporting year. Annual submissions should contain a conclusions section

on agency compliance with the law and its overall information security posture.

The IG should be required to evaluate whether agencies have a

process that incorporates information security into their enterprise

architectures. Reporting intrusion incidents to Fed CIRC should

not be limited to national security incidents but should also include

threats to critical infrastructure as was the case during the Y2K

initiative.

Importantly, agencies should identify the IG or another law enforcement agency that will investigate intrusions and refer them

for prosecution.

In conclusion, while it is still early in the GISRA implementation

process, we are optimistic that if enforced, GISRA and its successor

legislation will ultimately succeed in strengthening information security throughout the government.

I would be happy to answer questions at the appropriate time.

[The prepared statement of Mr. Williams follows:]

118

119

120

121

122

Mr. HORN. Thank you.

Our last presenter before the questioning is James Dempsey,

Deputy Director, Center for Democracy and Technology. You have

a very rich background and I note here that with a Professor David

Cole. What university was he with?

Mr. DEMPSEY. Georgetown University.

Mr. HORN. You did this book on ‘‘Terrorism and the Constitution,

Sacrificing Civil Liberties in the Name of National Security.’’ The

second edition is out, so you are a well designed author with a second edition in 2002 as well as journal articles, and a background

of Yale and Harvard Law School.

When I was at Harvard, we used to say there was a great operation at Yale but they would come to Harvard for an education. So

you covered both, you and the Bush family have covered all of

them.

You are a member of the District of Columbia Bar. Tell us a bit

about the Center for Democracy and Technology.

Mr. DEMPSEY. Good morning, Mr. Chairman, Chairman Davis

and Congresswoman. Thank you very much for inviting us to testify this morning on the important issue of the security of Federal

Government computer systems.

The Center for Democracy and Technology is a non-profit, public

interest organization. Our goals include enhancing privacy protections for individuals and preserving and promoting the democratic

potential of the Internet. We work closely with industry and with

policymakers to develop balanced policy solutions to the information technology issues that face both the Government and the private sector. We focus much of our attention on the Internet because

we believe that, more than any other medium, it has characteristics that are uniquely supportive of democratic values. The Internet

has the power to enhance the delivery of Government services, to

provide cost efficiencies for government, businesses and individuals, and to facilitate interaction between the Government and its

citizens.

Hanging over that and potentially threatening that potential is

the vulnerability of computer networks, which also affects fundamental government operations and the private sector, and the

economy as well.

Unlike the gentlemen who testified before me who are very much

in the trenches dealing with this issue, I am going to take, if I

could, a somewhat broader perspective, looking at the issue of government information system security in a somewhat broader context.

I want to congratulate you, Chairman Horn, and Chairman

Davis, for your leadership in addressing this issue in a comprehensive and serious way. I commend you for bringing forward H.R.

3844 to build on the important progress of GISRA.

My basic message today is that, in developing and implementing

policy solutions for the security deficiencies that exist in government computer systems, it is imperative to recognize and preserve

the open, innovative, and interactive nature of the medium and to

use that to promote the government objectives that all of these

agencies are so nobly trying to advance.

123

In creating a standard, setting policy for government computer

systems, we urge you to draw upon the expertise of the private sector. Chairman Davis referred to the importance of having flexibility

and to recognize the speed with which this technology is developing, and to buildupon developments within the private sector where

systems designers and managers are grappling with these same

issues of balancing security, efficiency, privacy and openness.

On the point of privacy particularly,k we believe that it needs to

be a part of the equation of computer security. If you look at any

of the legislation and the fair information principles going back to

the 1970’s, privacy and security always went hand in hand.

I have four basic suggestions or comments on the legislation

today. One is to focus on government computer systems not information per se. The question of management of government information generally, its security, disclosure, privacy, is a very complicated subject. With lots of legislation, while clearly what we are

talking about today is the unique challenges, threats and difficulties posed by networked computer systems. Yet if you look at the

legislation, it refers to information and information systems. I

think all of the focus here at the table is on information systems

which pose these unique, documented vulnerabilities and the need

for some top down leadership within the Government to get the

Government’s security house in order. That should be the focus and

I think unintentionally perhaps the legislation is a little misleading

in that regard.

Second, is to recognize and promote a balanced approach. Security needs to be dealt with in tandem with privacy, openness and

efficiency, which are the four interests I think the goal is to balance. In looking at the legislation as it is drafted, I don’t think that

balancing point comes through clearly enough.

Third, it is necessary, particularly at this time, to preserve and

enhance within the executive branch a privacy advisory function.

The bill would amend the charter of the Computer Systems Security and Privacy Advisory Board as I read it to remove privacy

from the jurisdiction of that body and at this time, I think it is very

important to have within and available to the Federal Government

an advisory function that looks at the privacy implications of computer system design and other information issues facing the Government.

Fourth, just to repeat the point about working with, and consulting with a broad range of interests within the private sector where

there is obviously a tremendous amount of energy and attention

being given to these computer security issues. These are the people

designing the systems. Some of the same problems and

vulnerabilities that the Government is grappling with are recognized in the private sector as well.

We would look forward to working with you. I look forward to answering your questions. Thank you again for inviting COT to testify today.

[The prepared statement of Mr. Dempsey follows:]

124

125

126

127

Mr. HORN. Thank you.

We now yield 10 minutes to the gentleman from Virginia to

begin the questioning.

Mr. DAVIS. My intent for the Incident Center was not to create

multiple centers or to duplicate existing centers, but to ensure that

there be at least one governmentwide center and that it have a

strong statutory mandate to provide effective instant response and

assistance to all agencies.

The bill makes it very clear that it is up to OMB to ensure that

such a center is established. Does anyone have a problem with the

Federal Government having a strong central information security

incident response?

Mr. WILLIAMS. Not only do I not have a problem, I think it is a

very good idea. At this point, we don’t have a very mature process

for identifying the kinds of incidents to be forwarded, we are still

feeling our way through dissemination and with regard to dissemination of the information once we gather and analyze it. There is

not necessarily a strong, consistent way of dealing with the incidents once we identify them. We don’t want them just to pass, we

want to aggressively move against them where the intrusion has

been illegal.

We need something like this. This is pointed in the right direction, it is a void and I am for it.

Mr. FORMAN. I think clearly as indicated in my testimony, that

is the direction we have been moving within the executive branch

in how we have been using FedCIRC and the capabilities they have

been building. The corollary to creating the organization is the

process and that is what is really lacking. We need to not just

think about the annual reporting and risk management process.

When you deal at the incident level, you deal basically within 24

hours as a cycle of time. That means we have to have a very

streamlined, fast and responsive process to the vulnerabilities and

the threats. It is a 3 x 3 matrix of potential risks, vulnerabilities,

and responses the agencies have to look at.

This is clearly one of the areas where we definitely agree. Things

need to be done and I would go so far as to say, not just in the

organization itself, but in the type of streamlining process, reporting response requirements. There should be some guidance.

Mr. WOLF. In my testimony, I stated that we have several centers set up and we interact with them on a routine basis. I think

it is important that you emphasize in terms of what gets reported

and the processes of how all that gets put together.

Mr. DEMPSEY. Just one comment. I think the prior administration stubbed its toe on this issue to some extent when it talked

about the FIDNET intrusion detection monitoring system and put

that forward without adequately considering the privacy issues

that posed. I think that is a classic example of how privacy should

be built into decisionmaking and development processes because I

think while there is tremendous merit to a centralized information

security incident center, some of the issues of intrusion detection

do raise obvious privacy issues that need to be addressed or otherwise the thing is going to run into criticism and potential problems

again.

128

Mr. MILLER. From the perspective of an agency, my hope is that

we have a center of excellence to support what we are trying to do

in the area of IT security. It may be more of a process issue than

an organizational issue, but the bottom line for us is that we need

help in getting that kind of support. If we can bring the resources

of the Federal Government together in such a way that they can

provide us with that center of excellence we can report to, that we

can get advice and counsel from in security matters, and that we

can get some form of assistance when we have a critical incident,

then that is always helpful for us. We don’t have enough resources

to do it on our own.

Mr. DAVIS. Mr. Wu, will NIST be able to quickly develop the

standards and guidelines called for in the bill? Some skeptics have

shared concern that NIST is just not up to the task. What do you

think?

Mr. WU. NIST is prepared and willing to take on any responsibilities that would be delineated if H.R. 3844 were to be enacted. We

would be working in conjunction with OMB but also we would be

working with industry.

One concern, however, is the NIST resources. I think you are correct in stating that the current NIST resources may be overtaxed

with some of the responsibilities under FISMA, but given the importance of the computer security issue, we would hope that Congress would be kind and look forward to an appropriation that

would be a sufficient amount for NIST to take on other responsibilities. But the technical expertise, the energy, and the enthusiasm

to take on these responsibilities is there at NIST.

Mr. DAVIS. You understand we are not looking for a specific technical standard that could be quickly outdated and obsolete. We are

looking for more specific guidelines and benchmarks to take some

of the subjectivity and guesswork out of the process of determining

whether an agency has truly done a good job addressing these information security risks.

Mr. WU. NIST is very engaged in the voluntary consensus standards organization process. NIST has worked very closely with industry to make sure that industry concerns are represented and

NIST also works with the general public as well and will continue

to work with those stakeholders, OMB, and the other Federal agencies.

Mr. DAVIS. Mr. Dacey, one of the significant differences between

FISMA and GISRA can be found in the way that FISMA proposes

to define national security systems. As you know, GISRA added a

third category to the traditional two-part formulation of national

security systems and called it debilitating impact systems. GISRA

then includes this third category in an exemption in allowing these

systems to be excluded from GISRA’s information security risk

management requirements. Could you expand on this and discuss

some of the history and policies involved?

Mr. DACEY. The issues related to, that have to do with that, require you look at the FISMA bill in its entirety. One of the provisions in there is the requirement for establishment of risk levels

and minimum standards at those various risk levels. FISMA would

include all non-national security systems in the consideration of

129

that area. So those would be considered at various risk levels and

appropriate minimum standards.

One of the concerns that had been expressed during the GISRA

implementation was how do you define debilitating impact systems

and how will they be treated in the process. They were excluded,

as you said, from some of the other areas of GISRA and the provisions of GISRA. This would basically put into place the requirements over those systems that were formerly debilitating impact

but also would allow those to be considered in terms of risk assessment and various specified levels of risk.

Mr. DAVIS. I am also interested in the distinctions between national security and non-national security systems. In his prepared

statement, Mr. Wolf said there is very little diversity in the underlying technology and therefore, the security vulnerabilities found in

national security systems as compared with other Federal systems.

It sounds to me like the steps needed to protect national security

systems are the same as for non-national security systems. Would

you agree with that?

Mr. DACEY. I would agree with the observations that the technologies that are used in both systems have converged and are essentially the same types of technologies. Certainly in the national

security systems, they are fairly hardened and strengthened in

terms of the level of security placed on them. However, we have a

lot of sensitive information, too, in the Federal Government that

may require similar levels of protection in the system.

I think in terms of standards, ideally, there would be a coordination between national security and non-national security systems.

I think some of the same types of technologies and controls would

be relevant to both and in considering the different risk levels for

non-national security systems, particularly at the top end with the

more secure needs, those could be very consistent with national security requirements.

Mr. WOLF. If I could add one comment, the technologies are very

similar. The one thing I would add is that with national security

systems, you do have a higher level encryption, stronger encryption

than you are dealing with in some of the diplomatic and military

activities. So there is a difference there.

Mr. DAVIS. Mr. Dempsey, let me ask you a question. I think we

are all concerned with protecting privacy, trying to strike the right

balance between national security, critical information security and

privacy interests of citizens. Would you agree one of the biggest

threats to privacy interest today is the fact that hackers and other

unauthorized individuals can break into government information

systems and access this personal, sensitive information?

Mr. DEMPSEY. I think that is an important piece of the privacy

problem. I think that goes to the complementarity between privacy

and security.

Mr. DAVIS. We put walls around a lot of that information so that

no one should see it who shouldn’t get it and yet a hacker breaks

in.

Mr. DEMPSEY. Exactly, and I agree with that. I think some of the

interests at stake also in terms of privacy involve the right of individuals under the Privacy Act to access personally identifiable information that is in the hands of the Government. On the one

130

hand, the goal of privacy is to preserve confidentiality but also

under the rubric of privacy we have a broader set of fair information principles, which include the concept of access. That is part of

the balance that I was talking about.

I agree with you entirely that one of the goals here is not only

to protect government operations but also to protect the huge

amount of personal information the government has.

Mr. DAVIS. Mr. Williams, with your extensive experience in law

enforcement and IRS, can you share some of your concerns about

the seriousness and the threat our Government is facing in the information security area without disclosing too much, the types of

problems? That is what we are trying to get at with this.

Mr. WILLIAMS. The threat is serious. We also have the difficulty

of this emerging area being one in which we are constantly sort of

preparing for the last war, the last attack, rather than being able

to look at a completely mature industry and begin to do some dynamic forward looking things. The things that concern us and

things we have encountered involve the destruction of information.

We recently caught a contractor who was being discharged who

planted a logic bomb inside three of our servers. We were able to

halt that but had that gone through, an enormous amount of information would have been lost.

Mr. DAVIS. Does the contractor get debarred for that, are they

being appropriately sanctioned?

Mr. WILLIAMS. The person received 3 years in prison.

Mr. DAVIS. How about the contractor?

Mr. WILLIAMS. The contractor was unaware of the incident. We

did an extensive lessons learned with the contractor but they appeared to have been as much victimized.

Mr. DAVIS. Can you explain what a logic bomb is?

Mr. WILLIAMS. It was a device triggered when the computer

reached a certain capacity which would allow the person time to escape and distance himself from the event. At that point through a

system of algorithms, shutdowns and destruction would automatically begin in a remote fashion while the person was separated. I

am sure there are some other people who are really good at it but

I think that is about how it works.

In addition to the destruction of material, which is more visible,

is the theft of material. I am not sure without our shields being up,

we really even know how many times we are being raided and sensitive information is being taken. Just at the IRS, and there is the

full spectrum of agencies, we have the private financial data of 128

million Americans, there is market sensitive data on there, proprietary data. Those are things of value.

Another type of crime is altering the data in order to gain something of value, in order to have benefits brought to someone that

either doesn’t exist or doesn’t deserve it, or forgiveness of an IRS

obligation, manipulating it to wipe out the debt.

Those are some of the different flavors of vulnerability that we

have.

Mr. DAVIS. Mr. Chairman, I think my time is up.

Mr. HORN. We are glad to extend the time. It is your bill, we are

just trying to get it moving.

Mr. DAVIS. I am satisfied for now.

131

Mr. HORN. Let us ask the whole panel then, what do you see as

the primary challenges to developing and implementing the minimum security standards required by the bill? When we discussed

this in the last few days with the staff, I was particularly interested in the Commerce and NIST bit on various standards. I would

like Mr. Wu to give me an idea of typical standards we ought to

be thinking about.

Mr. WU. There are a number of standards, encryption standards,

interoperability standards, all very critical to maintaining an effective computer security infrastructure.

Mr. HORN. What else?

Mr. WU. Our NIST technical and cyber security team have been

working with those in industry to identify the remaining standards

and other standards that exist and other issues, trying to be forward thinking to try to be able to find out or figure out what

vulnerabilities there may be in advance and what we should be

looking forward to.

Mr. HORN. And you have a role in that and we need to know

what are the levels of the standards, what is the impact in terms

of security? Or is it just reacting to some particular case.

Mr. WU. No, it seems clear that when we have major information

technology glitches, such as Love Bug and other viruses, that impact not just our Nation but the world, that we need to be much

more forward thinking and that we are too reactive. It is important

for NIST, as well as the industry, to work together to try to be as

responsive, to look at the vulnerabilities, to intercept them in advance. We work with the other Federal agencies to do that as well.

Mr. DAVIS. Mr. Wolf, what is your thinking on this, on the standards and are they needed and in what direction should they be developed?

Mr. WOLF. I think standards are very, very important. We need

to make sure we cover the waterfront in terms of all the areas that

need the standards and I think my partner on the committee here

mentioned some of those. We need to make sure they get implemented. I think that is probably one of the toughest things in

terms of standards out there, do people actually make use of it?

And it goes along with the assessment that you have in your bill

where you talk about the assessments, where you are actually

doing security assessment. If you have a set of standards, how do

you make sure people are actually implementing them? How do you

do an assessment to see that is happening? And how do you do the

reporting to make sure that happens?

We look at various hacking incidents we see in FedCIRC and in

many cases, it is because people haven’t implemented standards,

haven’t implemented patches, things like that.

Mr. HORN. It was mentioned earlier that the encryption would

require greater standards than others. What would be the difference between a domestic agency and an intelligence foreign affairs agency, would it make much difference in terms of what NIST

is going to undertake which is various types of standards, could

that be used to cross areas? How many simple standards are there

that go across the whole executive branch?

Mr. WOLF. I would say there are certainly things NIST is doing

that apply across the Government. There are probably some addiVerDate 11-MAY-2000 12:23 May 01, 2003 Jkt 000000 PO 00000 Frm 00135 Fmt 6633 Sfmt 6633 D:\DOCS\86343.TXT HGOVREF1 PsN: HGOVREF1
132

tional things you would want to do in the national security arena

that are probably a little stricter, because of the nature of the data

being handled, the Internet connections, the internetting, things

like that.

Mr. HORN. That makes some common sense. Do you believe we

should continue to manage national security systems separately

from the Federal information systems?

Mr. WOLF. I think you need to set a set of standards, I think

they need to be comprehensive but in some cases, when you are

talking national security, there may be reasons why they cannot be

implemented because of the national security environment in terms

of what we are doing. So I think there are some distinctions there.

Standards are important, they need to be comprehensive but not

necessarily dictating they are always used. There needs to be that

case, where because of national security, there is a reason you are

not going to implement them and maybe you propose an alternate

set of standards for the national security which may be stricter or

may have some differences because of national security environment.

Mr. HORN. What interests me is can we keep this going with

OMB having the responsibility on behalf of the President and we

are not looking for jobs up here on Capitol Hill, we have plenty to

do. The question will be how do we know and how do inspectors

general, in particular, know when they are being sandbagged within a particular agency because nobody can talk to them?

Mr. WOLF. I am afraid I am not qualified to answer that question. In terms of the role NSA has in terms of defining what are

good security practices across the board, we are very active with

NIST in those. In terms of enforcing those in various government

agencies, we are not able to do that. We certainly can define what

they should be.

Mr. HORN. Mr. Forman, is the best way to see if the CIA is going

along with the type of security situation and to take a look at it

of either leaving it to the Inspector General at CIA or you are going

to do it? Or do you just turn NSA loose on them to see they really

have done what OMB would want so you don’t have another Ames

or whatever? There ought to have been a lot of things that they

haven’t done.

Mr. FORMAN. While I am always loathe to recommend more bureaucracy, I think this is an area where we want to make sure we

are taking a good, cost-effective approach, but we ought to err on

the side of risk-diversity. We are forever hearing terms about

standards in areas where, technically, they don’t mean the same

thing as a standard.

We recently produced, last November, the advanced encryption

standard, which is a product of NIST but really a product as much

as any of the standards we have, leading edge, a function of where

industry is going, the national security community, and civilian

agencies. It is a fine standard, a technology standard.

I differentiate that from saying what is our standard for middle

ware or what is our standard for a Web applications server. Those

are more what I would consider to be components. The nexus that

we have there, the process that we are rolling out, combines the

CIO Architecture Committee, which I think you will see, have an

133

increasingly important role in terms of understanding and agreeing

to the architecture components, and there is now in circulation a

framework for doing that.

I think Ron’s role as the CIO Council Security Liaison, integrating within the Cyber Board executive branch committee which NSA

also sits as a member, is another critical part of that puzzle, pulling together the key issues to focus.

So we know we will have that focusing, we will get that more

rapid approach to different types of standards as well as the architecture components. The next step then is how do you police that?

We will do some by the budget process, and I think that is key, but

there is a set of analytical capabilities as Ron mentioned, that center for excellence, that also has to focus the audit work, inform and

accelerate that standard setting process.

I think as you heard before, there is some good language in

FISMA, and I think the suggestions in the testimony and answers

to the questions will focus that a bit more. At the end of the day,

I think you are looking at a couple of key elements here, how fast

can we make this process work and some end results. Not only are

we seeing increased vulnerabilities because those are going to increase just because we are detecting more, but are you seeing people taking advantage or hackers taking advantage of those both

within, the internal threat, and the external threat in a way that

causes mission critical problems, loss of privacy.

I think the bill should lay out very clearly what are the criteria,

what are the results that will measure? Is it loss of privacy? I think

that is a fine one, it is in some of the legislation already and it

would be good to focus it in FISMA. Is there loss of mission critical

capability or downtime? If you lay out the guidance and the measures I think that will help us in focusing the oversight and the

standard setting process through components.

Mr. HORN. Mr. Dacey, what does the General Accounting Office

think about the various standards that might be put forth under

this bill? The question is, does it help with doing it or if it isn’t,

why even have it?

Mr. DACEY. We think standards are important. I think one of the

challenges to your original question is to provide some level of

standardization but yet build in sufficient flexibility to make sure

we don’t make bad decisions and put in things we don’t really need.

I think that will be the challenge in implementing it.

I think there are a couple of things I would like to focus on here.

In FISMA, it sets up a requirement which is general good practice,

that you should assess your risk and develop security controls commensurate with that risk. As part of that process, FISMA then goes

on to establish a requirement for risk levels and standards for

those various risk levels. Let me talk briefly about risk levels and

standards.

In terms of the risk levels, it is clear and it has been said on the

panel here, we really need to have an effective and efficient process

for assessing risk. It is a very important aspect because if we don’t

do that properly, we are not going to have the right controls in

place to protect our systems.

It is also important to consider how you go about doing that.

FISMA comes up with levels of risk. That could be a very feasible

134

approach I think to categorizing the types of risks and systems and

the various ways you could build that around. I think that would

be part of the deliberative process to consider how those would best

be established.

I think they are important too when we talk about connectivity

because we are talking about right now pretty broad spread

connectivity within agencies, between agencies, between the Federal Government and State and local and with the private sector.

I think ultimately we need to be considering what is the level of

risk in those systems and do we want to have them connected together. That would be one way which this could go through the

process.

You wouldn’t want to be connecting openly a high risk system

with a low risk system because a low risk system would have less

safeguards and those safeguards could potentially be breached and

gain access to the more sensitive system and that is typically what

we do when we do our work in trying to get into Federal systems

with the agency’s knowledge. We get into systems that are simple

to get into and use that ability to advance our privileges and gain

access to some very sensitive information.

In terms of standards, I think there may be some definitional

issues. One of the concerns is the word standard oftentimes evokes

a certain amount of rigidity or inflexibility. I don’t think that

should be the intent of standards under FISMA. I have been doing

auditing for about 25 years and we use auditing standards. I audited small shops, I have audited the Federal Government with its

$2 trillion of revenue. We use the same standards, not the same

procedures but the same standards nonetheless and it has worked

pretty well and it is generally applicable. That is the kind of standard I think I would refer to.

I think they are important for several reasons. I think they clarify expectations. I think they are a good criteria to measure how

effective security is, as well as to manage performance or measure

performance over time. I think it provides a certain consistency if

we have standard levels of risk, that we have some nomenclature

to share within the Federal Government as well as those we choose

to hook up to our systems as to what level of risk we want them

to respond to. In fact, in some of our more secure systems, there

are requirements before you hook up to the systems. You have to

meet certain minimum security requirements or you don’t play the

game. I think there are some examples already where that is being

used to say we need certain standards to deal with that.

GAO’s approach has to address all these. When we do our audits,

there aren’t universal, governmentwide standards necessarily and

that is a challenge to us. But what we find oftentimes is that there

is a core set of standards or requirements that are pretty universally agreed upon. I don’t think we have found anyone who said if

you are going to have passwords, you probably ought to say fault

passwords should be removed because everybody knows what they

are and if they get in the system, they can break right in.

Also, you could argue that maybe you shouldn’t have passwords

if you are going to use passwords to say ‘‘Redskins’’ or ‘‘password’’

as the password. Those are the types of things in which I think

there is a lot of agreement. There are probably some other standVerDate 11-MAY-2000 12:23 May 01, 2003 Jkt 000000 PO 00000 Frm 00138 Fmt 6633 Sfmt 6633 D:\DOCS\86343.TXT HGOVREF1 PsN: HGOVREF1
135

ards that there is some reasonable difference between knowledgeable people as to whether it should be a requirement or not. I think

that could be considered again in the structure of a standard-setting process.

I think there are some other side-benefits to standards. I think

if we are going to have some consistent training across the Federal

Government, which I think is one of the goals of the administration, I think it is a very important goal to the extent you have some

standards to build that around. To be training people on the same

thing would be very important.

We also have a lot of people running these systems that have

worked very hard and to the extent you can provide them some information rather than have them independently try to determine

what level of security they should employ would be beneficial.

Last, in terms of tools, I think that is another important area,

we need better automated tools. Many of those tools currently look

for certain things in the systems. I think if you agree upon what

those things are you want to look at, tools can be built rather readily to test for those types of conditions in those systems.

Mr. HORN. We look on the General Accounting Office to be the

sort of umpire on behalf of Congress. What are the benefits and

disadvantages of shifting responsibility for promulgating standards

and moving it from the Secretary of Commerce to the Director of

Office of Management and Budget? How do you feel about that

one?

Mr. DACEY. If you go back in terms of prior legislation, there certainly has been the involvement of both NIST and OMB in development of standards and oversight of responsibilities for those standards’ I think starting with the Computer Security Act and going on.

What FISMA would do would be to align those responsibilities with

OMB, who is directly responsible for the oversight and coordination

of the agency information security. That is where it would place

that. I think that is a good matter for discussion. Obviously we

have some differing views and I think that ought to be considered

in any final legislation.

Mr. WU. As I mentioned in my opening statement, we believe

that should be a matter for reconsideration. The Director of OMB

issues broad information security policy and guidelines to agencies

complemented by detailed security standards and guidelines which

NIST develops.

The proposed process presents an opportunity for delay as additional senior managerial approvals are going to be required up the

bureaucracy. As we fight the war on terrorism, we believe we

should be thinking about how to streamline the development and

issuance of new security standards while still maintaining the important process of public review and comment. Since NIST activities are more directly linked to industry and the Secretary of Commerce represents business and industry and commerce, we believe

it is more appropriate for that role to remain with the Secretary

and not with OMB.

Mr. HORN. What criteria would you use to determine if a standard is mandatory or non-mandatory? How would you go about that?

Mr. WU. Quite frankly, I am not sure how we are going to make

that determination but we would have a plan in place. I don’t think

136

it is necessarily going to be a uniform determination but done more

on an ad hoc basis, in consultation with the experts and our cyber

security team.

Mr. FORMAN. Mr. Chairman, the process we have laid out in my

prepared statement with the cyber boards, executive branch committee, lays it out, a cost-benefit, risk-based approach, very similar

to how one might say you should insure yourself because that is

in essence what we are trying to achieve here. So cost-benefits,

risks, specifics of that situation, I think is what is going to drive

that determination, certainly the guidance that cyber board will

provide to NIST and NIST supporting us on that board.

Mr. HORN. Can you provide, Mr. Wu, an example of a minimum

standard the National Institute of Standards and Technology

would make mandatory?

Mr. WU. As I said, I am not clear as to the determination on

what would be defined as mandatory. We can get back to you on

that in consultation with our cyber security team.

Mr. HORN. One would be the password to get at the basic machine or the software or whatever. Then the question, what kind

of watching does the control authority, OMB and you, partially in

that, and that would be it seems to me one of the obvious.

Mr. WU. That would be one but I don’t have a definitive list for

you. We can try to provide that for you if you like and to the committee.

Mr. HORN. I understand that NIST has developed mandatory

standards in the area of cryptography. What has been your experience in implementing those standards within the Federal agency?

Have you developed mandatory standards in other areas or just in

the ones with encryption?

Mr. WU. Right now, my understanding is that it is only with

encryption. We have had a lot of success working with OMB and

the other agencies with AES, advanced encryption standard. We

look forward to continuing with that collaboration under that

framework and structure.

Mr. HORN. Is the 1988 Secretary of Commerce delegation of authority to waive Federal information processing standards to the

agency still in effect?

Mr. WU. I personally don’t know that answer but we can get

back to you.

Mr. HORN. We will put it in the record at this point.

Mr. WU. I have been told the answer is yes.

Mr. HORN. That it has waived Federal information processing

standards to the agency heads and that is still in effect. OK.

The problem often comes up over time, like 100 years, that it is

very difficult for a member of the Cabinet to work with his other

members of the Cabinet and they will listen to OMB and might not

listen to good old Joe or Susie who are doing something. That is

one of the things we look at and wonder who will do what.

Mr. Forman, what type of standards and guidelines has the CIO

Council developed?

Mr. FORMAN. Let me differentiate standards versus guidelines.

The CIO Council was established by Executive Order, it is not created in statute. The Executive Order has OMB as the Chair of the

council and directs the council to provide recommendations and adVerDate 11-MAY-2000 12:23 May 01, 2003 Jkt 000000 PO 00000 Frm 00140 Fmt 6633 Sfmt 6633 D:\DOCS\86343.TXT HGOVREF1 PsN: HGOVREF1
137

vice to OMB on IT issues and that the members share best practices across the agencies. It really has had no policy guidance or

standard setting authority.

In that regard, one of the changes I put in place being the Director of the Council is to actually get them focused on some standardized processes or procedures or approaches. Let me give you some

examples and then I will talk about security. Let us refer to these

as guidelines to make it clear.

One is the Enterprise Architecture Management System, a tool

that was developed for tracking and leveraging the component

based framework we have been deploying.

The second is the Federal Enterprise Architecture Framework.

Basically, this is the way now that we back up with a scorecard

and the budgeting process to get agencies to clearly identify the

linkage between their IT investment and the mission of the agencies driving through to business cases.

There is a corollary tool to that, ITIPS, the IT Investment Portfolio System. Now each agency is supposed to use and put in place

a capital planning process. This is a tool and between those two

tools that are the guidelines laid out by the CIO Council, we are

now able to get the information in and start to analyze the architecture we have built in the Federal Government. We are not to the

point where we can define it yet.

The Federal Enterprise Architecture Framework document is

getting to that point. We have laid in terms of a governance structure with that is a role for the Architecture Committee. They will

come to agreement on components, this approach is essentially the

CIO’s all coming agreement and they are doing it for a number of

reasons, not the least of which is money, leveraging their investments to get more out of industry by moving those component

points, to be able to take advantage of Web services and some of

those are emerging in the security arena.

The fourth area I would say we have a decent example of a

guideline is in the work force training arena. Security is a key component of that. I think the CIO Council training components and

the framework laid out for CIO University Center is widely regarded even in industry. We see more industry take up of that

agenda than government employees.

Those are the types of things that are appropriate. We are

leveraging NIST very highly in the security arena. For example,

taking the benchmarking or the analytical guidelines, I wouldn’t

quite call those standards that were developed over the last year,

and that serves—and everybody has agreed to use that—as the

basis for the GISRA work. It allows us a standardized approach if

you will, but not the same as the Federal information processing

standards which are technical standards.

Mr. HORN. What types of standards and guidelines has the Chief

Information Officer Council developed and if so, do they go through

OMB primarily to get those functions across or do they have any

authority to spread the guidelines, if you will?

Mr. FORMAN. They do refer them to OMB and we work, like in

those four examples, by incorporating those into two basic OMB

circulars. We can obviously issue other guidance, but the predominant way you will see this is through the A–11 Circular and the

138

A–130 Circular. Again, that is what I would consider guidance or

guidelines as opposed to standards.

I think you will see this get integrated much quicker by the CIOs

agreeing to those architecture components and going back and putting that into their architecture. We will see that through their IT

investments and the architecture results they have to submit to

OMB but at the end of the day, this is about managing change.

What we are seeing, I believe, is formalizing the Clinger-Cohen approach on the roles and responsibility of the CIOs.

I will give you an example of what I am talking about. As you

know, we have an issue in the Justice Department on leveraging

the technology to make the management changes. Recently they

hired a very well qualified CIO and made that person a direct report to the Attorney General with the full fledged authorities, architecture included, laid out under the Clinger-Cohen Act.

So coming to agreement using the technology insight from both

NSA and NIST, the results coming out of the Cyber Board Executive Committee, firming up those agreements by that Architecture

Committee, and then we provide the oversight to make sure when

we review the architecture and the business cases that indeed they

are complying to those guidelines.

Mr. HORN. The current bill removes OMB specific authority to

approve agency security plans. Do you believe that authority

should be restored?

Mr. FORMAN. I think, as I understand the bill and what is currently in GISRA, is the approval of the security programs and we

have to differentiate between the security programs and the plan

of actions and milestones. There, I think, is actually where the Director of OMB should focus. We know and are getting terrific insight from the IGs, from the reviews GAO is doing and our strong

relationship there, and indeed from some of the CIOs’ risk assessments.

To have us prove the fact that there was a problem, I don’t think

gets us anywhere. The focus on approving the plans of action and

milestones is the appropriate approach and I think that is what is

laid out in the bill.

Mr. HORN. With GISRA, with expiring in November of this year,

and the OMB estimating that the fiscal year 2003 funding for the

information security will be $4.2 billion, is it reasonable to expect

the Congress to wait until September or later to learn whether

agencies are taking the appropriate corrective actions to address

their information security weaknesses?

Mr. FORMAN. I think it is really a question of the oversight and

governance structure you have. I think what we are moving to with

your subcommittee is a quarterly review of our progress. That is

certainly the approach we have moved to in OMB. The approach

I am going to adhere to is a quarterly review of agency progress.

Mr. HORN. That is when we went through the Y2K bit, that is

exactly where we got and went to. It started out with almost once

a year and then to two times a year and then Dr. Raines in particular understood all this and we got to quarterly. I think that

makes sense so everybody knows we want to look in that quarterly

operation because Congress might look at it.

139

How does the committee, Mr. Wolf, the Committee on National

Security Systems which has set minimum standards for the protection of national security systems and if so, what is your experience

in implementing these requirements?

Mr. WOLF. I think the committee has been very active since it

was formed. It replaces one of the earlier committees that started

in 1990. There are over about 100 policies that have been issued;

some of those include some standards. The standards I think are

fairly rigorously enforced in the national security environment, so

I think it has been very effective. I think it has addressed many

areas where standards are needed, been very active. So I think it

has been very successful.

In terms of looking at some of the policies, the rest of the Federal

Government might look at some of those policies as at least a start

in terms of policies in some areas where they might not have been

addressed so far.

Mr. HORN. Has the National Security Agency developed a standard for risk assessments and management that is used for national

security systems?

Mr. WOLF. We have some templates. I am not sure to the detail

that we have those developed but we have some templates that we

use. There is I believe a DOD standard also.

Mr. HORN. How did NSA approach the evaluations of national security systems under the Government Information Security Reform

Act? How has it gone?

Mr. WOLF. I am not sure I can answer that question. We will

have to get back to you on that one. Again, our role is sort of an

advisor in the agency. We are not the actual agency that does that

evaluation.

Mr. HORN. OK. What guidance did NSA provide to agencies with

national security systems? Did NSA work with the Director of Central Intelligence to coordinate evaluations or guidance for the evaluation of intelligence systems?

Mr. WOLF. We certainly are given input, yet, again, as an advisor.

Mr. HORN. It is the Director of CIO that has that authority?

Mr. WOLF. Yes.

Mr. HORN. Let me ask you, Mr. Miller, about FEMA. You recommend that the bill be revised to strengthen the link between IT

security requirements and the capital planning process. What specific revisions to the bill would you recommend to strengthen the

link between them?

Mr. MILLER. First of all, OMB has taken some steps to ensure

that when we do our funding documents, our 300-Bs, that there is

a security tie to it. I think tying the approval of IT spending to a

demonstrable security plan, not just saying we are going to spend

money on security but actually having a plan you can demonstrate

you have processes and procedures in place, would be a powerful

incentive because from the CIO perspective, we have to persuade

our program officials, the folks actually benefiting from these systems, that there is a reason why security should be factored into

their equations.

Within FEMA, we are trying to implement a process by which we

don’t spend a dime or allocate a person or time to a project until

140

they have addressed the security issue among others. That process

has caused a lot of interesting responses but we believe it is the

right thing to do.

The key there is to make sure that people just don’t pay lip service to security and the 300-Bs, that they can actually demonstrate

there is someone thing behind it when they say they are addressing security.

Mr. HORN. Mr. Williams, in your role as an Inspector General,

what challenges do the IGs face in integrating an annual independent evaluation into their audit workload?

Mr. WILLIAMS. As with anything, the prototype consumed about

three or four times the amount it will on an annual basis. I don’t

know that it was a great difficulty for the IGs. It was certainly

something that we were pleased to see come and we appreciated

the role that we played.

It is very important that we stay in touch with the advances and

challenges on the security side. This is a role that allows us to do

that without being overly intrusive. It is an important part of the

entire process in GISRA. I think it is one we embrace. Where there

is need for advanced or temporary skills, we can get that through

contractors as the department does as well.

Beyond that, I don’t know that it represents any sort of formidable challenge. I think it has been something we have appreciated.

Mr. HORN. Mr. Dempsey, you suggest as an interim measure

that agencies should adopt a widely accepted set of standards developed by the private sector. Can you provide some examples of

those?

Mr. DEMPSEY. It takes me a little bit outside my direct area of

expertise, I have to admit. I know that there is the so-called common criteria standards which have been developed that address

computer security issues. I think that there are others in industry

who are much more familiar with those than I. I can certainly flesh

that out for you and give you some examples of work that has been

done in the private sector that would contribute to the Government’s efforts.

Mr. HORN. We would welcome those.

Mr. Dempsey. We have to do so.

Mr. HORN. I want to put in the statement of the ranking member, Ms. Schakowsky at the opening and we will put that after Mr.

Davis’ opening.

She has two points here that I think are very important. She

says, ‘‘There does seem to be one significant hole in this legislation.

As we learned in confronting the Y2K problem, we cannot be sure

all of the systems are fixed until we know where they all are. The

first thing most agencies had to do to prepare for the turn of the

millennium was to create an inventory of all computer systems and

then assess the risk posed by the failure of each of those systems.

It is a commentary on computer security that no such inventory existed.’’ Is that correct?

Mr. FORMAN. That is the corollary on why the CIO Council was

adopted the enterprise architecture management system to build

that inventory.

Mr. HORN. She says, ‘‘When we mark up the bill’’—Mr. Davis

might want to listen to this—‘‘I intend to offer an amendment that

141

would first require all agencies to maintain a current inventory of

systems. Second, I will require that agencies develop and include

in the security report a plan that establishes a system whereby

every system will be tested over a 5-year period. With a current inventory and scheduled testing, we will be closer to security being

a routine and not a unique government function.’’ I think those are

pretty good comments.

Let us go right down the line with your thinking about that.

Mr. WOLF. I would add one comment. It is not only the inventory

of all those systems, but it is how they are interconnected and

whether or not they have implemented the standards and what

standards they have implemented so you know what you are really

talking to.

We have a very active red team and you rattle the windows of

a house and you only have to find one window that is open and

that is the one place where they haven’t implemented the standard

or put in the patch. It is not only an inventory of all systems, but

how they are interconnected and what they have done in terms of

standards.

Mr. WILLIAMS. Probably an emerging area that ought to also be

considered is a corollary, the establishment of new gateways. We

are discovering that some of the gateways are not to expand the

e-government and other kinds of good initiatives. They are not always apprising the CIO of the existence of the gateway and the

gateways aren’t always being tested for intrusions and

vulnerabilities.

I think the point the Congresswoman makes is a good one but

I would add that to it as well. That is probably the one where we

have seen most recent vulnerabilities emerging.

Mr. MILLER. I want to second what he said because I think it is

very important. Awareness is where we begin in the area of security and just as an example, in our agency we discovered during

a vulnerability assessment that we had over 500 servers in an

agency of 2,500 people. We weren’t aware of them, so right away

we have all these potential entry points to our network that we

didn’t know about.

We have initiated an audit of all FEMAs IT assets and that

starts this month and goes until we find everything. Key to that

is having our Director’s full support which he has given us, so we

won’t have people trying to hide things under their desks. We will

find them and once we know where they are, we can start the process of holding people accountable for them in the area of security.

Mr. WU. As you alluded, the success of Y2K wasn’t just that we

battled back the Millennium Bug but also that we were able to engage in the first ever exercise in which we had a Federal inventory

of our IT infrastructure. This was also being replicated in the private sector as well.

The inventory is only the first step of trying to assess what our

critical needs are and what the demands are. I think the inventory

could prove to be very useful.

Mr. HORN. I agree with you completely. The fact was we asked

that the hardware and the software be inventoried if you are going

to come up to the Congress for money and you deserve to have it

in a lot of those agencies. I would think that would be worth doing.

142

We did have a list that was put together by a lot of the CIOs and

when Mr. Gingrich was here as Speaker, he was quite interested

in this sort of thing, so we were able to give the appropriators the

‘‘go’’ signal which is green up here as opposed to some systems I

have seen where the Xerox just doesn’t give a nice color to it. I

think that is what we need if we are going to solve some of this

problem. It is going to take money and hopefully we will get that

going.

I now yield to the gentleman from northern Virginia and the

world across the Potomac. He has a great bill here. Any questions

you to ask?

Mr. DAVIS. No, I think I am OK. I really appreciate the panel

coming today and sharing your observations. I hope we can make

it a better bill and I think between Chairman Horn, myself and the

leadership, we intend to move this pretty quickly. We would look

forward to any additional input you can offer.

Mr. HORN. I want to thank the subcommittees involved in this.

In back of me is J. Russell George, staff director and chief counsel

for our subcommittee. He is a nominee of the President of the

United States to be a fellow IG, you might see him, but first we

have to get him confirmed. He has been a great leader in this for

years now.

Also, Bonnie Heald, deputy staff director and communications director. On my left is a very able person, Claire, who is our professional staff on loan from the American Political Science Association, and has done a wonderful job. Henry Wray, I think most of

you know, our senior counsel, worked with the Senate and we tied

him up, got him across the Rotunda and he now works for us, and

he is doing a great job. Then Earl Pierce, professional staff, and

Justin Paulhamus is the majority clerk.

We thank today the court reporters, Mary Ross, and with Mr.

Davis, you have Chip Nottingham and Teddy Kidd from the Subcommittee on Technology and Procurement Policy.

We thank them all.

Gentlemen, I appreciate what you put on the record today. Keep

at it.

[Whereupon, at 12 p.m., the subcommittee was adjourned, to reconvene at the call of the Chair.]

[The prepared statement of Hon. Janice D. Schakowsky and additional information submitted for the hearing record follows:]

143

144

145

146

147

148

149

150

151

152

153

154

155

Æ