U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

73–391 PDF 2012

CYBERSECURITY: AN OVERVIEW OF RISKS TO 

CRITICAL INFRASTRUCTURE 

HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT AND 

INVESTIGATIONS 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

JULY 26, 2011 

Serial No. 112–80 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

COMMITTEE ON ENERGY AND COMMERCE 

FRED UPTON, Michigan 

Chairman 

JOE BARTON, Texas 

Chairman Emeritus 

CLIFF STEARNS, Florida 

ED WHITFIELD, Kentucky 

JOHN SHIMKUS, Illinois 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

Vice Chairman 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

BRIAN P. BILBRAY, California 

CHARLES F. BASS, New Hampshire 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BILL CASSIDY, Louisiana 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

CORY GARDNER, Colorado 

MIKE POMPEO, Kansas 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

HENRY A. WAXMAN, California 

Ranking Member 

JOHN D. DINGELL, Michigan 

Chairman Emeritus 

EDWARD J. MARKEY, Massachusetts 

EDOLPHUS TOWNS, New York 

FRANK PALLONE, JR., New Jersey 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

LOIS CAPPS, California 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

CHARLES A. GONZALEZ, Texas 

JAY INSLEE, Washington 

TAMMY BALDWIN, Wisconsin 

MIKE ROSS, Arkansas 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

DONNA M. CHRISTENSEN, Virgin Islands 

KATHY CASTOR, Florida 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

CLIFF STEARNS, Florida 

Chairman 

LEE TERRY, Nebraska 

SUE WILKINS MYRICK, North Carolina 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

BRIAN P. BILBRAY, California 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

CORY GARDNER, Colorado 

H. MORGAN GRIFFITH, Virginia 

JOE BARTON, Texas 

FRED UPTON, Michigan (ex officio) 

DIANA DEGETTE, Colorado 

Ranking Member 

JANICE D. SCHAKOWSKY, Illinois 

MIKE ROSS, Arkansas 

KATHY CASTOR, Florida 

EDWARD J. MARKEY, Massachusetts 

GENE GREEN, Texas 

DONNA M. CHRISTENSEN, Virgin Islands 

JOHN D. DINGELL, Michigan 

HENRY A. WAXMAN, California (ex officio) 

(II) 

(III) 

C O N T E N T S 

Page 

Hon. Cliff Stearns, a Representative in Congress from the State of Florida, 

opening statement ................................................................................................ 1 

Prepared statement .......................................................................................... 4 

Hon. Diana DeGette, a Representative in Congress from the State of Colorado, opening statement ...................................................................................... 7 

Prepared statement .......................................................................................... 9 

Hon. Michael C. Burgess, a Representative in Congress from the State of 

Texas, opening statement .................................................................................... 11 

Hon. Marsha Blackburn, a Representative in Congress from the State of 

Tennessee, opening statement ............................................................................ 11 

Prepared statement .......................................................................................... 13 

Hon. Donna M. Christensen, a Representative in Congress from the Virgin 

Islands, opening statement ................................................................................. 14 

Hon. Henry A. Waxman, a Representative in Congress from the State of 

California, prepared statement ........................................................................... 75 

Hon. Fred Upton, a Representative in Congress from the State of Michigan, 

prepared statement .............................................................................................. 77 

WITNESSES

Roberta Stempfley, Acting Assistant Secretary, Office of Cybersecurity and 

Communications, National Protection and Programs Directorate, Department of Homeland Security ................................................................................. 15 

Prepared statement 1 ........................................................................................

Sean P. McGurk, Director, National Cybersecurity and Communications Integration Center, Office of Cybersecurity and Communications, National Protection and Programs Directorate, Department of Homeland Security ........... 16 

Prepared statement .......................................................................................... 19 

Gregory C. Wilshusen, Director, Information Security Issues, Government 

Accountability Office ............................................................................................ 31 

Prepared statement .......................................................................................... 33 

1Ms. Stempfley issued a joint statement with Mr. McGurk for the record. 

(1) 

CYBERSECURITY: AN OVERVIEW OF RISKS TO 

CRITICAL INFRASTRUCTURE 

TUESDAY, JULY 26, 2011 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS, COMMITTEE ON ENERGY AND COMMERCE, Washington, DC. 

The subcommittee met, pursuant to call, at 11:00 a.m., in room 

2322 of the Rayburn House Office Building, Hon. Cliff Stearns 

(chairman of the subcommittee) presiding. 

Members present: Representatives Stearns, Murphy, Burgess, 

Blackburn, Scalise, Griffith, DeGette, Schakowsky, Castor, Green, 

Christensen, and Waxman (ex officio). 

Staff present: Carl Anderson, Counsel, Oversight and Investigations; Todd Harrison, Chief Counsel, Oversight and Investigations; 

Karen Christian, Counsel, Oversight and Investigations; Alan 

Slobodin, Deputy Chief Counsel, Oversight and Investigations; 

Peter Spencer, Professional Staff Member, Oversight and Investigations; Carly McWilliams, Legislative Clerk; Andrew Powaleny, 

Press Assistant; Sean Bonyun, Deputy Communications Director; 

Kristin Amerling, Democratic Chief Counsel and Oversight Staff 

Director; Tiffany Benjamin, Democratic Investigative Counsel; 

Karen Lightfoot; Democratic Communications Director and Senior 

Policy Advisor; and Ali Neubauer, Democratic Investigator. 

Mr. STEARNS. Good morning, everybody. And the subcommittee 

will come to order. And I will start with my opening statement. 

OPENING STATEMENT OF HON. CLIFF STEARNS, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF FLORIDA 

I have called to order this subcommittee’s first hearing on 

cybersecurity and critical infrastructure protection. Over the last 

15 years, our Federal Government has wrestled with the question 

of how best to protect our Nation’s critical infrastructures from 

cyber attacks. Since September 11, our infrastructure systems have 

become even more automated and more reliant on information systems and computer networks to operate. This has allowed our systems to become more efficient, but it has also opened the door to 

cyber threats and cyber attacks. 

Recent reports and news articles have highlighted how threats 

and risks to cybersecurity have created vulnerabilities in our Nation’s critical infrastructures and information systems. For example, just last week, the Department of Homeland Security sent out 

a bulletin about potential insider threats to utilities. That bulletin 

stated that outsiders have attempted to obtain information about 

2 

the utilities’ infrastructure to use in coordinating and conducting a 

cyber attack. 

In March 2011, the computer systems of RSA were breached. 

RSA manufactures tokens for secure access to computer networks. 

Sensitive information about these tokens was stolen and later used 

to hack into the network of Lockheed Martin, a Department of Defense contractor. 

Last summer, the Stuxnet attack was identified. Stuxnet targets 

vulnerabilities in industrial control systems such as nuclear and 

energy to gain access to the systems and then manipulate the control process. This kind of attack has the potential to bring down or 

severely interrupt the functions of an electricity or even a nuclear 

plant. 

The issues surrounding critical infrastructure protection and security are complex. Our systems are interconnected and depend on 

one other to operate. A vulnerability in one critical infrastructure 

naturally exposes other critical infrastructures to the same threats 

and risks, either because they are linked together through information systems or because one infrastructure depends on another to 

operate. In addition, much of the country’s critical infrastructures 

are privately owned, as much as 80 or 90 percent. They therefore 

have different operations, components, control systems, and computer networks—as well as vastly different resources available to 

address problems like cybersecurity and infrastructure protection. 

My colleagues, we must identify and protect the very systems 

that make our country run: energy, water, healthcare, manufacturing, and communications. Pursuant to the Homeland Security 

Act of 2002, DHS has led the coordination of infrastructure protection efforts with the private and public sectors and numerous federal agencies. One way DHS does this is to coordinate working 

groups and information sharing and analysis centers or ISACs in 

the individual critical infrastructure sectors and in cross-sector 

working groups. 

DHS is primarily responsible for conducting threat analysis and 

issuing warnings about cyber threats so that other federal agencies 

and the owners and operators of critical infrastructure can simply 

protect their systems. DHS’ efforts to protect our critical infrastructure have been the subject of some criticism. 

Since 2003, the Government Accountability Office has designated 

‘‘protecting the Federal Government’s information systems and the 

Nation’s cyber critical infrastructures’’ as a ‘‘high risk’’ area. In 

particular, in a report issued last July, GAO found that public- and 

private-sector owners and operators of critical infrastructure were 

not satisfied with the kind of cyber threat information they were 

getting from DHS. GAO has also expressed some concern that the 

sector-specific plans for dealing with cybersecurity need to be updated. In light of growing and more sophisticated cyber attacks, 

this is obviously a critical issue. 

As I mentioned previously, this is the subcommittee’s first hearing in this Congress on critical infrastructure protection and 

cybersecurity. The purpose of this hearing in particular is to get an 

overview of DHS’ role and responsibilities and how it coordinates 

with the sector-specific federal departments and agencies, many of 

which are subject to this committee’s jurisdiction. Once we have a 

3 

better understanding of DHS’ role, it is my intention to call additional hearings to understand the issues that are presented in protecting the individual sectors, such as energy and information systems and communications. 

Many ideas have been presented about how to improve critical 

infrastructure protection and cybersecurity. I believe the Oversight 

and Investigations Subcommittee has an important role to play in 

examining and bringing to light what is working now, and what 

can be done better. 

I should note that this subcommittee’s inquiry into this matter 

began with a bipartisan letter to the Department of Homeland Security asking for a briefing about its efforts to protect critical infrastructure. I appreciate the support of Ranking Member, Ms. 

DeGette, and the minority in this investigation. As Members of 

Congress, one of our foremost responsibilities is protecting our Nation’s security and the safety of its citizens. 

With that I yield opening statement to the ranking member, Ms. 

DeGette. 

[The prepared statement of Mr. Stearns follows:] 

4 


73391.001
5 


73391.002
6 


73391.003
7 

OPENING STATEMENT OF HON. DIANA DEGETTE, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF COLORADO 

Ms. DEGETTE. Thank you very much, Mr. Chairman. And like 

you, this is a matter of great urgency. I am glad we are having this 

overview hearing and I am also happy to work with the majority 

on additional hearings in the particular issues of cybersecurity. 

Just today, in the Washington Post it talked about a GAO report 

on significant breaches of classified computer networks in the Department of Defense. And while that is not in the jurisdiction of 

this committee, it just points out how vulnerable this country can 

be and why it is so important to keep our information systems safe. 

The chairman referred to the cyber attack on RSA, which compromises the Department of Energy systems that necessitated 

shutting down internet connectivity for several days and breaches 

of Citibank data belonging to hundreds of thousands of customers. 

Anecdotally, at least, it seems like these breaches are becoming 

more and more frequent. The incidents remind us of the need for 

vigilance regarding efforts to prevent cybersecurity breaches and 

respond effectively when they occur and the importance of congressional oversight in these areas. 

As the chairman mentioned, I asked him earlier this Congress to 

look into these issues, and I am really glad that we are going to 

have a rigorous review of all of the cybersecurity issues. As the 

chairman mentioned, we have jurisdiction over a number of key 

components of our Nation’s critical infrastructure, including the 

electrical grid, drinking water system, chemical plants, healthcare 

system, and telecommunications activities. In the last Congress, we 

saw progress in this committee regarding addressing cybersecurity 

issues in a number of these areas. The committee developed and 

passed on a bipartisan basis legislation to promote security and resiliency in the electrical power grid by providing the Federal Energy Regulatory Commission new authorities and providing for Department of Energy assistance to industry to protect the grid 

against cyber threats and other vulnerabilities. The committee also 

developed and passed legislation regarding chemical and drinking 

water facilities to meet the risk-based cybersecurity performance 

standards. 

Cybersecurity issues are complex and evolving and deserve continuing and focused attention. One major question is how to best 

ensure an effective public-private partnership to address 

cybersecurity threats. The majority of our Nation’s critical infrastructure is owned or operated by the private sector. While there 

are incentives for private-sector entities to protect the security of 

their information networks, national security priorities may not always align with priorities and capabilities of the private sector. 

I know that the Department of Homeland Security witnesses before us today are helping lead the administration’s efforts to foster 

private- and public-sector cooperation in promoting cybersecurity 

and I look forward to hearing their insights on progress that is 

being made and obstacles that may still exist. 

Another question we have to ask is how to best ensure that the 

Federal Government is drawing on its own expertise and experience to ensure cybersecurity measures are appropriately tailored to 

8 

address specific needs in different critical infrastructure sectors. I 

look forward to hearing from GAO about these challenges. But 

even with a maximally effective partnership of federal agencies, 

state and local governments, and the private sectors in our country 

on cybersecurity protection, we must still address issues raised by 

the fact that information networks do not have national boundaries. Many reports suggested that the cyber attacks have started 

outside of American borders, raising serious questions about how 

we ensure international cooperation to protect against threats that 

cross borders. And in this DOD example, in the GAO report today, 

apparently the cyber attack came from a portable computer, a 

laptop computer that was somehow tapped into. 

And so I look forward to the insights of today’s witnesses on 

these and other issues. I hope that we will build on this hearing 

with additional hearings on cybersecurity. It is one of the few bastions of bipartisanship left around here this week and I am happy 

to be part of it. 

I yield back. 

[The prepared statement of Ms. DeGette follows:] 

9 


73391.004
10 


73391.005
11 

Mr. STEARNS. I thank the gentlelady and recognize the gentleman from Texas, Dr. Burgess, for 2 minutes. 

OPENING STATEMENT OF HON. MICHAEL C. BURGESS, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. BURGESS. I thank the chair. 

To say that this committee has been working diligently for years 

is kind of an oxymoron but it does seem through several terms on 

this subcommittee we have indeed delved into this issue. I am anxious that we bring this to a legislative conclusion and institute 

those things that will provide the protection that I think we all feel 

that we need. There are critical urgent things that need to be done 

to protect our transmission grid, our power plants from attacks 

from those who wish to do us harm. The threats are real. It is time 

to move the legislation forward. 

We do have to be careful that we don’t unduly shift the balance 

of responsibility that has been properly maintained between the 

government and the private sector for decades. It is important that 

we be careful; it is important that we be prudent in providing the 

Federal Government any additional authority. If indeed any is necessary, it must be done in a way that cannot be abused and will 

not result in significantly higher cost to consumers and businesses 

at a time when the economy is so fragile. And it must not result 

in the loss of any personal freedoms that people now have. 

The testimony we will hear today will help this committee in perfecting legislation that was considered last year. I certainly look 

forward to working with members on both sides of the dais to ensure that the legislation is mindful of both the real threats that we 

face and the burdens that granting new powers to the Federal Government can create. Ensuring this balance can and should be done. 

Thank you, Mr. Chairman, for the recognition. I will yield back 

my time. 

Mr. STEARNS. The gentleman yields back and the gentlelady from 

Tennessee, Ms. Blackburn, is recognized for 2 minutes. 

OPENING STATEMENT OF HON. MARSHA BLACKBURN, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF TENNESSEE 

Mrs. BLACKBURN. Thank you, Mr. Chairman. And I want to welcome our witnesses. We appreciate that you would take the time 

and come over here to the Hill. We all do know and do agree that 

cybersecurity is an important issue and we know that there are 

those who are, as we speak, waging war if you will on our vital infrastructure. 

Last month, Wall Street Journal reported that the IMF was investigating a recent cyber attack. Not surprisingly, this attack 

came just 1 month after a group called Anonymous indicated its 

hackers would target the IMF Web site in response to the strict 

austerity measures in its financial package of Greece. 

Closer to home, in my State of Tennessee, presides our Nation’s 

largest public power utility, the Tennessee Valley Authority. TVA’s 

power networks stretch across 80,000 square miles in the Southeastern U.S. and provide electricity to more than 8.7 million Americans. Under Homeland Security Presidential Directive number 7, 

12 

TVA is considered a National Critical Infrastructure and must take 

great steps to protect and to safeguard its essential cyber assets. 

A power grid disruption or other threat on TVA operations or any 

other public utility in our country would cause a cascading effect 

impacting our economy, safety, and daily lives. 

In fact, this concern was reaffirmed last month as former CIA director and current Secretary of Defense Panetta appeared before 

the Senate Armed Services Committee and declared that the next 

Pearl Harbor our Nation confronts could very well be a cyber attack that cripples our power systems, the grid, our security systems, our financial systems, and our governmental systems. 

With all that in mind, I thank the chairman for the hearing. I 

thank you all for your participation as we discuss what steps DHS 

is taking to avoid what would be the unimaginable, a Pearl Harbor 

attack on our Nation’s vital infrastructure. 

And I yield back. 

[The prepared statement of Mrs. Blackburn follows:] 

13 


73391.006
14 

Mr. STEARNS. The gentlelady yields back and I recognize Ms. 

Christensen from the Virgin Islands for 5 minutes. 

OPENING STATEMENT OF HON. DONNA CHRISTENSEN, A 

REPRESENTATIVE IN CONGRESS FROM THE VIRGIN ISLANDS 

Mrs. CHRISTENSEN. Thank you, Chairman Stearns, and thank 

you, Ranking Member DeGette, for holding this hearing to discuss 

cybersecurity risks, threats, and challenges to our Nation’s critical 

infrastructure. Many of today’s battles are in cyberspace where terrorism and hackers help attack our cell phones, computer grids, 

and have the potential to destroy sensitive information in 18 of our 

Nation’s most critical sectors. 

Since 9/11, we have known to expect that we would experience 

terrorist attacks that would be cyber attacks. As a former member 

of the Homeland Security Committee, I have taken part in many 

hearings and worked on legislation addressing this issue. As our 

witnesses who we welcome here today will testify, a lot has been 

done to create entities to coordinate and oversee efforts to address 

and prevent cybersecurity threats. But there are still challenges to 

protecting our Nation’s infrastructure from these threats and we 

must continue to examine how we can overcome these challenges. 

In doing so, it is important that we pass legislation to protect our 

Nation’s electric grid. All of these long-term initiatives require a 

national electric grid that is reliable and secure. The electrical grid 

serves more than 143 million American customers, has to operate 

without interruption, and is a key foundation of our national security. Designing and operating an electrical system that prevents 

cybersecurity events from having a catastrophic impact is a challenge we must all address. And I want to add that the healthcare 

sector is not immune to these attacks either. 

So I would like to thank DHS and GAO and commend both 

Agencies for their efforts to address imminent cybersecurity 

threats. And with that, I will yield back the balance of my time. 

Mr. STEARNS. The gentlelady yields back. 

And at this time, we will move to our first panel, our witnesses. 

Let me address you folks. 

You are aware that the committee is holding an investigative 

hearing and when doing so has had the practice of taking testimony under oath. Do you have any objections to taking testimony 

under oath? All right. No. 

The chair then advises you that under the rules of the House and 

the rules of the committee you are entitled to be advised by counsel. Do you desire to be advised by counsel during your testimony 

today? All right. 

In that case, if you will please rise and raise your right hand, 

I will swear you in. 

[Witnesses sworn.] 

Mr. STEARNS. You are now under oath and subject to the penalties set forth in Title XVIII, Section 1001, of the United States 

Code. 

We welcome the three of you for your 5-minute summary statement. And we have Ms. Bobbie Stempfley, Acting Secretary of the 

DHS Office of Cybersecurity and Communications, welcome; and 

Mr. Sean P. McGurk, Director, National Cybersecurity and ComVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00018 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
15 

munications Integration Center in the Office of Cybersecurity and 

Communications at DHS; and lastly, Mr. Gregory Wilshusen, Government Accountability Office Director of Information Security 

Issues. Thank you. 

And Ms. Stempfley, we welcome your opening statement. Just 

turn the mike on if you don’t mind. Just move it close to you so 

we can hear you. That would be super. Thanks. 

STATEMENTS OF ROBERTA STEMPFLEY, ACTING ASSISTANT 

SECRETARY, OFFICE OF CYBERSECURITY AND COMMUNICATIONS, NATIONAL PROTECTION AND PROGRAMS DIRECTORATE, DEPARTMENT OF HOMELAND SECURITY; SEAN P. 

MCGURK, DIRECTOR, NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER, OFFICE OF 

CYBERSECURITY AND COMMUNICATIONS, NATIONAL PROTECTION AND PROGRAMS DIRECTORATE, DEPARTMENT OF 

HOMELAND SECURITY; AND GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION SECURITY ISSUES, GOVERNMENT 

ACCOUNTABILITY OFFICE 

STATEMENT OF ROBERTA STEMPFLEY 

Ms. STEMPFLEY. OK. Thank you very much. So thank you very 

much, Chairman Stearns, Ranking Member DeGette, and other 

members of the subcommittee. 

As you heard, my name is Bobbie Stempfley, and I am the Acting 

Assistant Secretary in the Office of Cybersecurity and Communications at the Department of Homeland Security, and it is definitely 

my privilege to be here to speak to you today with my colleagues 

from across government to talk about cybersecurity, which is an 

area of great passion for all of us. 

The opening comments did such a wonderful job describing the 

threat landscape that we operate in today. It certainly is one we 

have increasing sophistication, increasing severity, and an environment where no one is immune from individuals to private-sector 

companies, and one where we see it slightly untenable where the 

threat actors have to make one right choice in an environment 

where only a single wrong implementation in the networks that are 

being defended enables access. And so it is an environment where 

we spend a great deal of time bringing together private-sector partners and others. 

We have identified 38,000 vulnerabilities over a period of time in 

critical infrastructures and provide warning notification and awareness products around those vulnerabilities to private-sector individuals. It is an environment, as the chairman pointed out, of significant interdependence, both between critical infrastructure sectors, 

between corporations, between environments. Several examples 

that you provided do a wonderful job illuminating that interdependence across the board. And that means that it requires an 

interdependent and integrative approach in order to provide protective, preventative, and restoral and defensive measures both across 

government and within the private sector. 

It is the job of the National Protection and Programs Directorate; 

it is our mission responsibility to secure the federal executive civilian branch—that is the federal departments and agencies—to proVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00019 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
16 

vide technical support to private-sector individuals, owners, and operators to help them with risk assessment, with mitigation, with 

restoral and response activities. It is also our mission to provide 

general awareness to the broad public. And finally, as Mr. McGurk 

will discuss, to provide national coordination and response across 

the board. 

It is, as I said, not an environment where a single solution works 

or a single organization provides all of the answers. It is an environment where much progress has been made and it is a team 

sport for us all. Cooperation between law enforcement, between intelligence agencies, between the Homeland Security, between, as I 

said, government and private sector is a significant part of how we 

need to move forward of the successes we have had to date. 

Examples such as you pointed out, the compromise in RSA really 

helps demonstrate the progress that has been made in government. 

The response that we had in that worked across a set of responsibilities defined in the National Cybersecurity Instant Response 

Plan where law enforcement has responsibility for pursuit and for 

investigation, where intelligence has warning responsibilities and 

attribution responsibilities, and where Homeland Security’s responsibilities are in protection, prevention, restoral, and response. And 

that partnership across government is so important for us as we 

work through each of the events that occur. 

We have in a proactive manner responded to 100 requests from 

critical infrastructure partnerships, largely across water, oil, and 

gas and power to help identify vulnerabilities in their environment 

and help them improve the capabilities that they have for protection and for response. It is through that partnership that we continue to work to enhance our prevention activities because, as we 

said, we are in that untenable environment today. 

What we have also put a great deal of effort in is to increase visibility and information sharing across environments. Again, I look 

forward to the comments of Mr. McGurk in our operations center. 

But it is information sharing not only in operations and in response, but information sharing at large that is important across 

the board. 

And so in conclusion, I look forward to further questions from the 

committee to discuss what we have done. And it, again, is my 

pleasure to be here today. 

[The joint prepared statement of Ms. Stempfley and Mr. McGurk 

appears after Mr. McGurk’s testimony.] 

Mr. STEARNS. Thank you. 

Mr. McGurk, you are welcome for your opening statement. 

STATEMENT OF SEAN P. MCGURK 

Mr. MCGURK. Thank you, Chairman Stearns, Ranking Member 

DeGette, and distinguished members of the subcommittee. My 

name is Sean McGurk. I am the director of the National 

Cybersecurity and Communications Integration Center, also known 

as the NCCIC. Thank you for inviting me here today along with 

my distinguished colleagues to discuss the overall cyber-risk to critical infrastructure. The Department greatly appreciates the committee’s support for our central mission and looks forward to working with the committee to establish the necessary plans and proVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00020 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
17 

grams moving forward to address risks to the critical infrastructure. 

The cyber environment is not homogenous under a single department or agency nor under the private sector. Each of the 18 critical 

infrastructure and key resource sectors are completely different— 

energy, water, nuclear, transportation, they all have their unique 

challenges and their unique environments. In fact, within a particular company, two plants may not have the same operating environment. We rely on this continuous availability of a vast, interconnected, critical infrastructure to sustain our way of life. A successful cyber attack could potentially result in physical damage and 

even loss of life. We face a significant challenge moving forward— 

strong and rapidly expanding adversary capabilities and a lack of 

comprehensive threat and vulnerability awareness. 

Support of these efforts from our private-sector partners is key 

to securing these critical infrastructures. The government does not 

have all the answers, so we must work with the private sector to 

establish those guidelines. There is no one-size-fits-all solution in 

a cyber environment. There is no cyber Maginot Line. We must leverage our expertise and our access to information, along with industry-specific needs, capabilities and timelines. Each partner has 

a role and a unique capability, as demonstrated by the diversity of 

this panel. 

Two-factor authentication was mentioned earlier, the RSA example. In that particular example, within a 24-hour period, the Department, working along with law enforcement and with the intelligence community, responded to a request from the private industry partner to provide a mitigation, identification, and assessment 

team in support of their mitigation efforts. The Department continuously works with our private-sector partners and the financialservices sector, energy sector, communications, IT, and others to 

prepare, prevent, respond, recover, and restore. 

Coordinating the national response of domestic cyber emergencies is the focus of the National Cyber Incident Response Plan 

and indeed the NCCIC. The what and the how on the cyber attack 

is the focus and the intent of our mitigation activities. The who and 

the why usually come later. 

The NCCIC works closely with the government at all levels and 

private sector to coordinate and integrate a unified cyber response. 

Sponsoring security clearances for our partners enable them to participate fully in our watch-center environment. To date, we have 

physical representation from the communications sector and its Information Sharing and Analysis Center and also with companies 

such as AT&T, Verizon, and Sprint. The information technology 

sector is represented physically on the watch floor along with the 

financial-services sector, NERC, representing the North American 

Energy Reliability Corporation; representing the energy sector, Information Sharing and Analysis Center; and most recently, we 

have begun to coordination and share information with the National Electric Sector Cybersecurity Organization, or NESCO. 

We have virtual connections as well as physical connections with 

these organizations and we share data in near-real time. Additionally, we have a physical representative from the Multi-State ISAC, 

enabling us to provide actionable intelligence to state, local, tribal, 

18 

and territorial governments and their representatives. Each of 

these partners bring a unique perspective and a unique capability 

to the watch environment. 

Currently, within our legal authorities, we continue to engage, 

collaborate with our partners and provide analysis, vulnerability, 

and mitigation assistance to the private sector. We have experience 

and expertise in dealing with the private sector in planning steadystate and crisis scenarios. We have deployed numerous incident-response teams and assessment teams that enable us to prevent and 

to respond, recover, and restore to cyber impacts. 

Finally, we work closely with the private sector and our interagency partners and law enforcement and intelligence to provide 

the full complement of capabilities from the federal standpoint in 

preparation for and response to significant cyber incidents. 

Chairman Stearns, Ranking Member DeGette, and distinguished 

members of the subcommittee, let me conclude by reiterating that 

I look forward to exploring opportunities to advance the mission 

and collaboration with the subcommittee and my colleagues in the 

public and private sector. Thank you again for this opportunity to 

testify and would be happy to answer your questions. 

[The joint prepared statement of Ms. Stempfley and Mr. McGurk 

follows:] 

19 


73391.007
20 


73391.008
21 


73391.009
22 


73391.010
23 


73391.011
24 


73391.012
25 


73391.013
26 


73391.014
27 


73391.015
28 


73391.016
29 


73391.017
30 


73391.018
31 

Mr. STEARNS. Thank you. Mr. Wilshusen? 

STATEMENT OF GREGORY C. WILSHUSEN 

Mr. WILSHUSEN. Chairman Stearns, Ranking Member DeGette, 

and members of the subcommittee, thank you for the opportunity 

to testify in today’s hearing on the cybersecurity risks to the Nation’s critical infrastructure. But before I begin, if I may, Mr. 

Chairman, I would like to recognize Mike Gilmore, Tammy 

Carvette, and Lee McCracken, who is sitting behind me, and also 

Brad Becker from our Denver office, who are responsible for the 

significant contributions in reviewing this area and helping me prepare this testimony today. 

Mr. STEARNS. I am glad you did. Thank you. 

Mr. WILSHUSEN. Critical infrastructures are systems and assets, 

whether physical or virtual, so vital to our Nation that their incapacity or destruction would have a debilitating effect on our national security, economic wellbeing and public health and safety. 

They include, among other things, banking and financial institutions, telecommunications networks, and energy production transmission facilities, most of which are owned by the private sector. 

These infrastructures have become increasingly interconnected and 

dependent on interconnected networks and systems. And while the 

benefits of this interconnectivity have been enormous, they can also 

pose significant risk to the networks and systems, and more importantly, to the critical operations and services they support. 

In my testimony today, I will describe the cyber threats confronting critical infrastructures, recent actions by the Federal Government to identify and protect these infrastructures and ongoing 

challenges to protecting them. 

Mr. Chairman, our Nation’s critical infrastructures face a proliferation of cyber threats. These threats can be intentional or unintentional. Unintentional threats can be caused by equipment failures, software upgrades, or maintenance procedures that inadvertently disrupt the systems. Intentional threats include both targeted 

and non-targeted attacks from a variety of sources, including criminal groups, hackers, insiders, and foreign nations engaged in intelligence gathering and espionage. 

First, recent reports of cyber attacks incidents involving cyber-reliant critical infrastructure underscore the risks and illustrate that 

they can be used to disrupt industrial control systems and operations, commit fraud, steal intellectual property and personally 

identifiable information, and gather intelligence for future attacks. 

Over the past 2 years, the Federal Government has taken a number of steps aimed at addressing cyber threats and better protecting critical infrastructures. 

For example, a cyberspace policy review identified 24 recommendations to address the organizational and policy changes 

needed to approve the current U.S. approach to cybersecurity. DHS 

updated the National Infrastructure Protection Plan in part to provide a greater focus on cyber issues and issued an interim version 

of the National Cyber Incident Response Plan. It also conducted 

Cyber Storm III, a cyber attack simulation exercise intended to test 

elements of the National Response Plan. 

32 

In addition, DHS, as you know, created the National 

Cybersecurity and Communications Integration Center, or NCCIC, 

to coordinate national response efforts, as well as work directly 

with other private- and public-sector partners. 

Despite these threats, more needs to be done to address a number of remaining challenges. For example, implementing the recommendations made by the President’s Cybersecurity Policy Review, updating the national strategy for securing the information 

and communications infrastructure, strengthening the public-private partnerships for securing cyber-reliant critical infrastructures, 

enhancing cyber analysis and warning capabilities, and securing 

the modernized electricity grid. 

In summary, the threats to information systems are evolving and 

growing and systems supporting our Nation’s critical infrastructures are not yet sufficiently protected to consistently thwart the 

threats. While actions have been taken, federal agencies and partnership with the private sector need to act to improve our Nation’s 

cybersecurity posture, including enhancing cyber analysis and 

warning capabilities and strengthening the public-private partnerships. Until these actions are taken, our Nation’s critical infrastructure will remain vulnerable. 

Mr. Chairman, this concludes my statement. I would be happy 

to answer any questions for you or other members of the subcommittee. 

[The prepared statement of Mr. Wilshusen follows:] 

33 


73391.019
34 


73391.020
35 


73391.021
36 


73391.022
37 


73391.023
38 


73391.024
39 


73391.025
40 


73391.026
41 


73391.027
42 


73391.028
43 


73391.029
44 


73391.030
45 


73391.031
46 


73391.032
47 


73391.033
48 


73391.034
49 


73391.035
50 


73391.036
51 


73391.037
52 


73391.038
53 

Mr. STEARNS. I thank the gentleman. 

Let me ask you a question. I have your opening statement here 

in which you mention various cybersecurity attacks. They are putting software viruses into the network. Is that primarily what it is? 

Mr. WILSHUSEN. It could be a number of different attacks. In 

terms of one to include computer intrusions in which individuals 

are able to gain access through the installation of malicious software. For example, if a user inadvertently plugged a USB into his 

computer that was corrupted, it could install some malicious software, which might facilitate an attack. 

Mr. STEARNS. Now, when an attack occurs—— 

Mr. WILSHUSEN. Um-hum. 

Mr. STEARNS [continuing]. Generally, what does that attack look 

like? They are coming in to steal information, or are they coming 

to put in a replicating software that will destroy it, or is it just putting in there to observe? What of those three? 

Mr. WILSHUSEN. It could be any of the combinations. 

Mr. STEARNS. Any of those three combinations? 

Mr. WILSHUSEN. Right. One, in terms of either to sabotage his 

particular system or gain information for future attacks perhaps or 

as well to—— 

Mr. STEARNS. Depending upon their motivation. 

Mr. WILSHUSEN. Depending upon their motivation. 

Mr. STEARNS. Mr. McGurk, what do you think? 

Mr. MCGURK. Yes, sir. I would also echo my colleague’s statements that the vast array of capability we see demonstrated with 

the malicious code is such that it encompasses all of those things. 

Mr. Chairman, you had mentioned Stuxnet earlier. That is a 

great example of a particular piece of malicious code that demonstrated very unique capabilities. It not only exploited what we 

call zero-day vulnerabilities, which are vulnerabilities that are not 

known in the public environment, but also it used advanced communication capability. It did advanced reconnaissance, so it was 

gathering information. And subsequently, it left behind that malicious code that was able to have a physical impact. 

Mr. STEARNS. Now, are we in the United States, you know, we 

have jurisdiction over energy, water, information technology, communication, nuclear plants—are we vulnerable to Stuxnet in your 

opinion? 

Mr. MCGURK. Sir, because of the ubiquitous nature of information technology in the critical infrastructure, the exploitation may 

occur in one sector and it could actually migrate into another sector. 

Mr. STEARNS. So yes or no? Do you think we are vulnerable? 

Mr. MCGURK. I would say the vulnerabilities exist and the capability to exploit those vulnerabilities exist. 

Mr. STEARNS. OK. So the big question is that the American people want to know what has the United States Government done 

about that to make sure we don’t have that attack? 

Mr. MCGURK. Much of the Department’s focus over the past several years has been on mitigating the vulnerabilities associated 

with those critical infrastructure systems. 

54 

Mr. STEARNS. Do you do it by having innocuous or something 

that inoculates us from this software or do you do it to make sure 

you don’t put the USB port or how are you doing this? 

Mr. MCGURK. So it is a multifaceted approach, sir. Much of it is 

through an education program, so we work with the private sector 

to develop standards required to educate the community on good 

practices and uses of equipment and technology. We actually conduct—— 

Mr. STEARNS. You think education alone would do it? 

Mr. MCGURK. No, sir. We also conduct vulnerability analyses of 

products in our laboratories in conjunction with the national laboratory community where we actually take vendors products and 

do a complete vulnerability assessment of those products. We also 

develop practices for owners and operators because in some cases, 

especially in the power companies, it is not a matter of replacing 

the technology, so you have to be able to put practices in place that 

mitigate the risk. And they are also working with the security communities to actually provide an enclaving capability so that we can 

secure the environments around which they operate. 

So by taking this multifaceted approach, we can identify not necessarily the threat actors and focus on the threats which are coming from many areas, but the vulnerabilities themselves and mitigating the risks associated with those vulnerabilities. 

Mr. STEARNS. Let me ask you a question but with this Stuxnet. 

What have we done to protect those specific vulnerabilities in 

Seimens’ product? In other words, has DHS issued a guidance on 

this? 

Mr. MCGURK. Yes, sir. The Department, when we started analyzing Stuxnet back in July of last year, we identified the capabilities of the particular piece of mal code. We understood its capabilities and subsequently we put mitigation plans in place working 

with the specific sectors to identify the mitigation strategies associated with that. But since that particular piece of mal code was 

looking for a very unique combination of hardware and software, 

it was easy to identify what the mitigation strategies would be. 

Mr. STEARNS. OK. Ms. Stempfley, just last Friday, the head of 

US–CERT resigned. US–CERT is the group charged with collaborating with state and local governments and private industry on 

cyber attacks. There have been a number of recent attacks on government systems, the Senate, FBI, CIA, and even a Gmail hacking 

aimed at top government officials. Have all of these recent attacks 

caused any change in the direction or change in the operation in 

US–CERT? 

Ms. STEMPFLEY. No, sir. The US–CERT’s set of responsibilities 

stays the same. And as we commented in the opening statements 

and your opening statements as well, this is a very sophisticated 

environment and it is constantly evolving. And as a part of that 

evolution, we understand that we have to have a bench and a 

mechanism for growth of individuals as we go forward. And so 

Randy’s departure was a decision that he made and we have a continued direction and focus in prevention, preparedness, and 

restoral responsibilities across the board. 

55 

Mr. STEARNS. What were the vulnerabilities that allowed these 

systems to be infiltrated, and do these same kind of vulnerabilities 

exist in the private sector and on control systems? 

Ms. STEMPFLEY. I am sorry, sir. Could you repeat the question? 

Mr. STEARNS. With regard to the Senate, FBI, and CIA and even 

the Gmail hacking aimed at top government officials, what were 

the vulnerabilities that allowed these systems to be infiltrated? 

Ms. STEMPFLEY. There were a number of vulnerabilities that 

were associated with these kinds of events that occurred, and to respond to where are other members of the private sector potentially 

vulnerable, I believe that is a true statement. As we commented 

earlier, there are a great deal of vulnerabilities that exist in the 

environment, and you will see that through the production of warning products and awareness notifications, we provide mitigations 

and indicators for private-sector owners and operators to put in 

place in their infrastructure. It is a shared responsibility between 

us and the private sector in order to implement the restorative and 

preventative measures. 

Mr. STEARNS. Thank you. My time has expired. The gentlelady 

from Colorado. 

Ms. DEGETTE. Thank you very much, Mr. Chairman. 

I want to go a little bit more in depth into some of the issues 

that we face trying to work on interoperability between our governmental agencies and privately owned endeavors. In particular with 

our communications infrastructure, which is of course an essential 

part of our critical infrastructure, one of the things I am concerned 

about 90 percent of our communications networks are privately 

owned by commercial carriers. So traditionally, the FCC has 

worked with commercial carriers to ensure the reliability of the 

communications networks, and under current FCC rules, carriers 

have to report regarding outages on legacy telecommunications system. Now, the FCC in turn uses this data to help industry standards groups to improve on the best practices. 

So I am wondering, Ms. Stempfley and Mr. McGurk, if you can 

talk to me a minute given FCC’s historical involvement with the 

communications infrastructure and the relationship with commercial carriers, don’t you think that they can take an important role 

in helping drive greater awareness of cyber threats? 

Ms. STEMPFLEY. So reporting is always good and the ability to 

get information about what is going on is an important part of how 

we can frame that national picture of what is happening and the 

response activities. So we have a history of working both with private industry directly and with other members of government in 

order to increase the awareness and the response actions that are 

necessary. I think the same would be true here. 

Ms. DEGETTE. Mr. McGurk? 

Mr. MCGURK. In addition, ma’am, what I would like to add is 

that in response to the reporting that is conducted, part of the capability that exists within the NCCIC is our National Center for 

Coordination for Communications. And they receive those direct reports. So from a situational-awareness standpoint, the watch center 

receives real-time reporting from not only the telecommunication 

industry itself but also from other federal departments and agencies so that we get a better understanding from a holistic view on 

56 

the impacts to communications because as we recognize that many 

of the critical infrastructures are relying on communications for 

controlling issues, for communications issues, and for flowing of 

data. 

In addition, we have the physical carriers themselves located 

within the watch environment so that they can provide up-to-date 

and actionable intelligence so that we can take the necessary steps 

and make proper recommendations. 

Ms. DEGETTE. Now, the office of Homeland Security coordinates 

those efforts on cyber threats. And so I guess my question to you 

following up is if there is a breach in the communications network, 

then how do DHS and FCC respond? How do they interact together 

to respond? 

Mr. MCGURK. Part of the National Cyber Incident Response Plan 

includes the development and coordination of a cyber-unified coordination group or cyber UCG. This is a steady state body of 

emergency response and incident handlers at working level, at the 

operational level, and then also at the senior decision-making level. 

For our cyber UCG seniors, it encompasses individuals from the departments and agencies that are at the assistant secretarial level 

or higher. So these are the actual decision-makers in the Federal 

Government. And then we have a staff which encompasses not only 

private sector but representatives from the federal departments 

and agencies that coordinate on a daily basis and share real-time 

information whether it comes from the communications sector, the 

energy sector, or one of the other 18 critical infrastructures. So 

that enables us to have that constant flow of data and provide that 

actionable intelligence so that private-sector companies can take 

the necessary steps to mitigate risk. 

Ms. DEGETTE. OK. Now, as I understand it, the FCC has proposed to rule this spring to extend reporting requirements about 

network shortages to the broadband network and they are taking 

public comments on that issue. And so, Mr. Wilshusen, I was going 

to ask you do you think that collecting data on broadband outages 

would help gain a better understanding of when hackers have gotten into our systems? 

Mr. WILSHUSEN. We haven’t examined that issue, but I would 

imagine collecting information can only be helpful in making such 

a determination. 

Ms. DEGETTE. OK. And for the other two witnesses, do you have 

any thoughts on the potential for reporting broadband network outages to contribute to situational awareness like after there is a 

major emergency, something like that? 

Mr. MCGURK. Yes, ma’am. I believe as Ms. Stempfley had mentioned earlier, reporting is good and more reporting is even better. 

So the more information that enables us to develop that common 

operation picture that takes all of the data that we are receiving 

and then fuses that together. So the more information we receive 

in the NCCIC the better situational awareness we can provide not 

only to the secretary of Homeland Security and the other executive 

secretaries, but also to the President for decision-making capability. 

Ms. DEGETTE. And just one last question relating to my opening 

statement about our communications networks is there is a lot of 

57 

issues around supply chains for equipment and components that 

have been manufactured abroad for use in the U.S. So I am wondering if these two witnesses on the end, Ms. Stempfley and Mr. 

McGurk, can talk about this publicly. Can you talk about how DHS 

is working with other federal agencies to address that issue of supply chain that part of it is foreign? 

Ms. STEMPFLEY. So as you pointed out, the telecommunications 

supply chain activities are an interagency response within the Federal Government. It would be more than happy to bring another 

agency body back to discuss that in detail? 

Ms. DEGETTE. Thank you. 

Thank you very much, Mr. Chairman. 

Mr. STEARNS. I thank the gentlelady. 

The gentleman from Texas, Dr. Burgess, recognized for 5 minutes. 

Mr. BURGESS. Thank you, Mr. Chairman. 

Now, if I understand things correctly, there is an authority that 

exists within the executive branch to take some control of transmission grid operations in the event of a national emergency, is 

that correct? Either of DHS witnesses. 

Mr. MCGURK. Yes, sir. The Secretary for the Department of Energy has that authority. 

Mr. BURGESS. And is it necessary to place any limits on that authority? 

Mr. MCGURK. Sir, I have the luxury of being a simple sailor and 

an operator and I don’t normally identify or make recommendations on policy or operational requirements. I can say that within 

the guidelines that we currently have and the authorities that we 

currently have, we are able to execute our mission both efficiently 

and effectively. So I will leave that to other members of the Department to comment as far as additional requirements. 

Mr. BURGESS. Ms. Stempfley, do you have any thoughts on that? 

Ms. STEMPFLEY. Respectfully, sir, I believe that would be most 

appropriate for DHS not to comment on the legal authorities of another department. 

Mr. BURGESS. Well, let me ask you this. Should such an authority be necessary? Should such an occurrence happen that the authority was necessary? How long would you expect that presidential emergency authority to be exercised over a continuous time 

period? 

Ms. STEMPFLEY. Regrettably, sir, I am not in the position to answer that question. 

Mr. BURGESS. Well, let me ask you this. It seems like—and I 

think it was referenced by either the chairman or the ranking 

member in their opening statements—is that we are hearing more 

and more about this. Does this just reflect the situational awareness that these types of threats and these types of attacks can 

occur or is, in fact, this a real phenomenon with the rapidity with 

which these attacks are coming is increasing? 

Ms. STEMPFLEY. So I believe it is all of those things, sir. There 

is certainly more awareness within the community of the importance of cybersecurity and the overall activity. That is increasing 

both the detection actions that are occurring and the reporting acVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00061 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
58 

tions that exist. Based on that awareness and what we are seeing 

is that increase across the board. 

We are also, as we all indicated in our opening statement, seeing 

an increase in sophistication of the attacks as they occurred as 

well. So I believe it is a phenomenon of all things, sir. 

Mr. BURGESS. Mr. McGurk, do you have any thoughts on that? 

Mr. MCGURK. Not in addition, sir. The only thing I would add 

was that because of the adoption of information technology capabilities into the critical infrastructure, we are also exposing a greater landscape of vulnerabilities to areas that were in the past specifically closed off and proprietary in nature. So by adopting that 

technology, we also advance the vulnerability landscape associated 

with those critical infrastructure operations. 

Mr. BURGESS. Well, one of the hazards in this is you are always 

fighting the last attack. What sort of forward-looking policies and 

procedures are being implemented by DHS? Are you looking into 

for wherever the perpetrator is, what is the value that they are deriving from these and are there ways that we can perhaps preempt 

some of these attacks before they happen rather than just simply 

reacting to them? 

Mr. MCGURK. Sir, part of what the National Cyber Incident Response Plan focuses on is moving from the left end of the continuum where we are primarily focusing on response and recovery, 

which to your point, sir, is accurate. We are always fighting that 

last event or that last battle. 

What we are looking forward to working with the private sector 

is moving to the right and putting the preparedness, the protective, 

and the preventative measures in place. And we are taking, again, 

a multifaceted approach through advanced technology, working 

with the owners and operators, and also with the vendor community to establish criteria for new systems and new operational parameters. 

The Department produces a procurement guideline for owners 

and operators which talks about security requirements for new systems and new operating procedures. And we also work closely with 

the integration community so that we are identifying how to install 

and how to manage these systems as they are being updated in the 

critical infrastructure. So we are looking at it as a continuum shifting more from the left, the responsive part, over to the right where 

we are being preventative and predictive. 

Mr. BURGESS. Now, a vast majority of this critical infrastructure 

is in private hands, is that correct? 

Mr. MCGURK. That is correct, sir. 

Mr. BURGESS. So is there any type of analysis as to the cost that 

may be incurred by the private sector to keep up with what you 

just articulated. 

Mr. MCGURK. Yes, sir. In fact, the Department identifies and describes risk as an equation of threats, vulnerabilities, and consequences. When we work with the private sector, we understand 

that the denominator there is also cost. So the procurement standards that I had mentioned earlier takes that into account. Not everything can be a gold standard. We are not saying that you have 

to have absolute security across the board. It is a risk-based approach so we take that same levelized approach and build the busiVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00062 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
59 

ness case to identify what we need to implement in what areas. So 

if we are going to spend a dollar to mitigate risk, should we focus 

on the threats or should we focus on mitigating the risks and the 

vulnerabilities? And then what are the subsequent consequences 

associated with that? That is really one of the approaches that we 

are taking in addressing this issue. 

Mr. BURGESS. And do you solicit and accept input from the private sector, the owners of the critical infrastructure as to that pricing consideration? 

Mr. MCGURK. Yes, sir. In fact, as the chairman had mentioned 

earlier, one of the things that we focus on is a number of working 

groups. And in the industrial control systems area, we actually 

sponsor a joint public-private working group, the Industrial Controls System Joint Working Group, ICSJWG, which looks at not 

only mitigating risks but also product development, implementation, education, and a whole host of issues. And that is a complete 

joint environment with both public and private members represented. 

Mr. BURGESS. Thank you, Mr. Chairman. I will yield back. 

Mr. STEARNS. I thank the gentleman. 

Dr. Christensen is recognized for 5 minutes. 

Mrs. CHRISTENSEN. Thank you, Mr. Chairman. 

Again, welcome to our panel. 

Under Homeland Security Presidential Directive 7, healthcare 

and public health are identified as critical infrastructure sectors, 

and of course the healthcare sector plays a significant role in response and recovery in the event of a disaster. So I would like to 

talk with all of our witnesses about the efforts to protect this sector 

against cyber threats. 

Beginning with Ms. Stempfley and Mr. McGurk, what do you see 

as the major challenges to ensuring cybersecurity in the healthcare 

sector? 

Ms. STEMPFLEY. Ma’am, I will begin with some of the kinds of 

policy challenges we have been working through in the Federal 

Government associated with this. And so, for example, we are 

working to deploy technological solutions that enable detection and 

prevention measures in place. Those technological solutions oftentimes require a very detailed analysis of the kinds of privacy and 

protection requirements that need to be put in place that we all 

feel so strongly about as well and we need to work through some 

of those key policy nexuses between the two so that we can provide 

that kind of support and prevention support while still being very 

true to the protection measures that we feel so strongly about in 

terms of privacy and other areas. 

Those kinds of infrastructure systems are very important to us 

and we agree with that. Once we get past the policy questions, it 

is a matter of how we employ those solutions, best practices across 

the board and handle the equally important integrative systems 

that exist in healthcare and have that nexus between IT and embedded systems as well. 

Mr. MCGURK. Yes, ma’am. I would also mention that one of the 

Department’s focuses is also on not just protecting the information 

in accordance with a number of regulations and requirements but 

also the equipment itself. When we look at the vulnerabilities assoVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00063 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
60 

ciated with the other sectors, the healthcare industry also has an 

equal number of vulnerabilities associated with embedded medical 

devices or with advanced technology that could potentially be exploited because of the inherent communications capability of those 

devices. 

So again, the Department is taking not just a data-in-motion, 

data-at-rest approach, but a holistic approach to the healthcare industry, working with the private sector, working with the manufacturers of these pieces of equipment, and also with the necessarily 

federal departments and agencies so that we understand the risks 

associated with healthcare industry and provide actionable steps 

that will better improve not only the quality of service but the 

quality of life. 

Mrs. CHRISTENSEN. Thank you. And those focuses estimates are 

great. I am assuming you are working with the Department of 

Health and Human Services as well as with the private sector. 

Ms. STEMPFLEY. With any of the particular sectors, ma’am, we 

work very strongly with the sector-specific agency in helping 

Human Services specifically in the situation. 

Mr. MCGURK. In fact, ma’am, we have the National Health Information Sharing and Analysis Center coming to visit and tour the 

NCCIC tomorrow and part of our development process to get them 

physically located on board. So they will be actually visiting us tomorrow so that we can identify those connections. 

Mrs. CHRISTENSEN. Great. Great. 

Mr. Wilshusen, I am also interested in hearing more about 

GAO’s work on cybersecurity issues that affect health and public 

health. As providers use more computer-based mechanisms and 

programs to help them treat patients, and I guess this sort of follows up on what you were saying, Mr. McGurk, do you agree that 

it poses additional risk to the personal health information could be 

released to the public? 

Mr. WILSHUSEN. Certainly. In fact, we have a couple of engagements that we have ongoing or will start soon. One was mandated 

by the High-Tech Act in which GAO is responsible for reviewing 

the security and privacy protections over information that is transferred and exchanged through the Electronic Prescription System 

or E–Prescribing. 

Mrs. CHRISTENSEN. Um-hum. 

Mr. WILSHUSEN. We anticipate starting that engagement in September with the report release date on September 2012. 

In addition, we have another engagement that we are currently 

working on to look at the security controls and risks associated 

with embedded or implantable medical devices such as insulin 

pumps, pacemakers and that that can be accessed through wireless 

technologies and may have chips in place. So we are also examining the report of security risk associated with that, as well as 

FDA’s premarket and post-market review processes to address 

those particular risks. 

Mrs. CHRISTENSEN. Well, thank you. My time is running out. I 

appreciate the information because the ever-increasing use of technology in our healthcare system obviously holds a lot of promise 

and many benefits. But also as we increase our reliance on techVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00064 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
61 

nology, there is also—as you have pointed out very clearly—the opportunity to hack in and interfere with that. 

So thank you, Mr. Chairman. I am out of time. 

Mr. STEARNS. I thank the gentlelady. Gentlelady from Tennessee, 

Mrs. Blackburn, recognized for 5 minutes. 

Mrs. BLACKBURN. Thank you, Mr. Chairman. 

Ms. Stempfley, I wanted to come with you. I was just meeting 

with one of my airports, and I wanted to know—TSA. What does 

the DHS and TSA do with the body images that they collect from 

the scanners at the airports? How long are they stored and do you 

protect these images? Do you share them with any other agency? 

And what action would you take in case you had a breach? 

Ms. STEMPFLEY. Ma’am, the Office of Cybersecurity and Communications is responsible for setting standards that the Federal Government has to comply with to include TSA. I am not familiar with 

their specific—— 

Mrs. BLACKBURN. Would you get back to me on this? 

Ms. STEMPFLEY. I certainly would. 

Mrs. BLACKBURN. OK. I know that it is a part of what we are 

talking about and it also pertains to the privacy work that we are 

doing in our CMT Committee. And I think as we work with some 

of the issues we are having with TSA, I would love to have the answer if you could do that. 

I have got another question. This would be for you and Mr. 

McGurk. And I mentioned TVA in my opening comments and the 

amount of coverage that we have with the power security. I want 

to see what your interface is with the state and local governments 

and the infrastructure by facilitating the information sharing of the 

cyber threats and the incidents and through the ISACs. So there 

are 16 of those ISACs, right? OK. And very briefly if you would just 

go through how it works, what kind of information that is shared, 

what is your process how you protect the data that you get and 

what your expectation is, the state and local governments, that 

they are going to protect that data and then what your response 

would be if you had a breach? 

Mr. MCGURK. Thank you, ma’am. I would just like to start off 

by saying that we have a very close working relationship with the 

Tennessee Valley Authority. In fact, we visited many times and we 

share real-time information through a number of sensor programs 

that we operate so that we have a better understanding of the actual threats and impacts and associated with those operational environments. 

What we do and how we share that information from the standpoint at the national level is much of the data that is voluntarily 

submitted through the NCCIC comes from either the ISACs themselves—the Information Sharing and Analysis Centers, including 

the Multi-State—or it comes from the private-sector companies 

themselves. Much of that data is submitted under the secretary’s 

authority for the protection of critical infrastructure information or 

PCII. That protects that information from being released even to 

a regulator, for instance if it is a power company and they submit 

the information to us. 

We then take that and we work directly with that company to 

develop a mitigation strategy that is a) company-specific and then 

62 

b) we anonymize it to the point where it becomes a sector-specific 

mitigation strategy. The RSA data breach was a great example of 

how, within a short period of time, less than 24 hours of notification of the breach, we had more than 50 companies and federal departments and agencies represented under the Cyber Unified Coordination Group developing sector-specific mitigation plans. So 

those individuals—not only from a physical environment but also 

a data-sharing environment—collaborate to generate those mitigation plans. 

Mrs. BLACKBURN. OK. And at what point do you pull state or 

local government into that to participate? 

Mr. MCGURK. Continuously. So they actually have a representative on the floor of the Multi-State ISAC. 

Mrs. BLACKBURN. OK. OK. 

Mr. MCGURK. So they are there in real time. 

Mrs. BLACKBURN. All right. 

Ms. STEMPFLEY. And ma’am, to continue on in that discussion, 

we have worked with the 50 states to provide clearances to the 

chief security officers in each of the states and then share classified 

information through their fusion centers so that that provides not 

just their representation on floor in real time around an event but 

also gives us an ability post-date it to them in their states as well. 

Mrs. BLACKBURN. And then do you do any coeducation and training with local law enforcement back into your protocols? 

Ms. STEMPFLEY. The training activity that we provide—all of our 

training is provided on an open basis so that state representatives 

can come and participate. I can’t speak to which states have chosen 

to come in with particular law enforcement individuals, but we 

make it available to them in order for them to take it up. 

Mrs. BLACKBURN. Excellent. Thank you, Mr. Chairman. Yield 

back. 

Mr. STEARNS. The gentlelady from Florida, Ms. Castor, is recognized for 5 minutes. 

Ms. CASTOR. Thank you, Mr. Chairman. Thank you to the witnesses for your insight today. 

It is apparent that an effective partnership between the Federal 

Government and the private sector is necessary to ensure the security of all of our networks, whether those networks manage critical 

infrastructure or simply handle the day-to-day data of the Federal 

Government and communications. 

Mr. Wilshusen, in your testimony you noted that the private sector has expressed concerns that DHS is not meeting their expectations in terms of information sharing. What concerns does private 

industry have about DHS’ willingness to provide information? 

Mr. WILSHUSEN. Yes, ma’am. We did a review in which we surveyed 56 individuals from the private sector from five private-sector councils. And we found that they identified a number of key activities that they thought were critical or important for the publicprivate partnership to include the provision of timely and actionable threat and alert information, having a secure mechanism for 

collecting information or sharing information with the public sector. And they indicated only 27 percent of those respondents indicated that they felt that their public-sector partners were actually 

meeting those expectations to a great or moderate extent. And so 

63 

there are a number of concerns about being able, on the part of the 

private sector, to collect timely information from the public-sector 

partners. 

Ms. CASTOR. Were there any particular sectors that stood out 

that appeared to be problematic? 

Mr. WILSHUSEN. Well, from the private-sector side, it was pretty 

much across the board. The five sectors that were included in our 

study included the banking and finance sector, the IT sector, the 

communications, energy, and the defense industrial base sectors. 

And it was pretty much across the board. As I mentioned, only 27 

percent out of the 56 respondents actually felt that they were receiving support to a great or moderate extent. 

Ms. CASTOR. So Mr. McGurk, what is DHS doing to address 

these concerns and to ensure that you all are working collaboratively with the private sector? 

Mr. MCGURK. Ma’am, I would like to start off by saying, you 

know, can we do better? Absolutely. We have modified much of the 

structures by actually standing up and creating the NCCIC that 

met some of the requirements moving forward, by actually having 

the private sector participate and not only receiving the information but developing the information. By having them physically 

present in the environment really assists us in putting the information in a language that is necessary to reach our constituents. 

A great example is in the past when we would produce information, we would produce it in a language that we understood, and 

then we would send that out and that may or may not meet the 

needs of our private-sector partners. By having power engineers 

and financial services specialists and IT specialists physically sitting there working with us and collaboratively developing the 

knowledge necessary to distribute, we are able to provide actionable intelligence. 

Just last year we received a report in an intelligence communication of a particularly malicious piece of mal code that had a subject 

line on an email called ‘‘here you have.’’ Within a few hours of that 

appearing in a classified report, the US–CERT produced an early 

warning and notice that went out to the broad private sector because we took that data, declassified it, and provided actionable intelligence for our private-sector partners. But by having them there 

and participating really enables us to provide better products for 

our partners and also speeds up the time necessary to generate 

that product. 

Ms. CASTOR. Well, how about the flip side? I am also curious 

about how well the private sector is communicating with DHS 

when they suffer a cyber attack or a breach, Mr. McGurk, are private companies required to report cyber attacks or coordinate their 

responses to those attacks with DHS? 

Mr. MCGURK. So there is no requirement to report the information directly to the Department, but I think what has happened 

over the development of the partnership over the past several years 

is the stigma associated with cyber breaches has started to be removed and companies are volunteering the information because 

they understand that it not only benefits their ability to maintain 

goods and services but it will also assist the broader community because they recognize that when they share with the Department, 

64 

we are not going to publish company-specific information. We are 

going to anonymize that and produce mitigation strategies and 

plans that help the broad sectors. And they have been working 

very closely with us in developing that. 

Ms. CASTOR. Are there instances where DHS has become aware 

of a cyber attack or a breach in a particular company and then you 

contacted that company to assist and they declined your offers to 

work with them, declined assistance? 

Mr. MCGURK. Yes, ma’am. 

Ms. CASTOR. What can we do about that? How do we improve the 

collaboration in working together? 

Mr. MCGURK. Part of that is an awareness and an understanding. From the private-sector standpoint, I understand that we 

have to demonstrate value and they have to see how working with 

DHS and partnering with DHS adds value to their capability. In 

some cases, those particular companies had a very advanced capability. We gave them the early-warning notice that they needed to 

take the necessary steps to protect their networks. So subsequently, additional response from DHS wasn’t required. And in the 

extreme case, we received declination for support but recognition of 

the awareness or the alert. 

Ms. CASTOR. Thank you very much. 

Mr. MCGURK. Thank you, ma’am. 

Mr. STEARNS. The gentleman from Virginia is recognized for 5 

minutes, Mr. Griffith. 

Mr. GRIFFITH. I am just curious, Mr. McGurk, under what circumstances, if any, would the DHS NCCIC withhold cyber threat 

information that it has encountered from owners or operators of 

critical infrastructure? 

Mr. MCGURK. Sir, we do not withhold threat information, but 

subsequently, we don’t develop threat information. Under the authorities of the Department, we focus primarily on mitigation of 

risk, and that is where we focus our activities. Threat information 

is really developed by the intelligence community and we rely on 

that partnership with the intelligence community to identify threat 

actors. 

Mr. GRIFFITH. All right. Do you have any indication that they 

may be sometimes withholding information? 

Mr. MCGURK. No, sir. In many cases, what is germane to mitigation is not necessarily associated with the actor. It is the activity. 

So it is the exploitation of the vulnerability which is necessary to 

share to protect the networks, not who is actually doing it. 

Mr. GRIFFITH. Mr. Wilshusen, the GAO reported in October of 

2010 that only 2 of 24 recommendations by the President 

Cybersecurity Policy Review had been implemented and the rest 

had only been partially implemented. What can you tell us about 

whether any additional progress has been made? 

Mr. WILSHUSEN. Well, one of the reasons we found that the partial implementation occurred was because many of the agencies 

were not taking effect because they were not given specific roles 

and responsibilities to implement some of those recommendations, 

and that kind of delayed actions to implementing that. We will be 

following up as part of our annual review follow-up on our recommendations to see what extent those recommendations are now 

65 

being met. But since we just issued that in October, we have not 

gone back to follow up on our prior recommendations and to do a 

reassessment. 

Mr. GRIFFITH. Should we expect an updated report this coming 

October? 

Mr. WILSHUSEN. We will be updating the status of our recommendations, and if you request us to do it, we will certainly do 

it. 

Mr. GRIFFITH. I would be curious since only 2 of the 24—— 

Mr. WILSHUSEN. Right. 

Mr. GRIFFITH [continuing]. Were implemented as of last year, 

and I am just wondering should we be concerned that so few of the 

recommendations had been fully implemented at that time? 

Mr. WILSHUSEN. Well, there are 10 near-term recommendations 

coming out of that policy review, 14 mid-term recommendations. 

Several of the mid-term recommendations are actions of such a nature that it is going to take multiple years to fully implement 

those. But the near-term recommendations are very important and 

they should be implemented as soon as possible. 

Mr. GRIFFITH. All right. I thank you. Yield back my time. 

Mr. STEARNS. The gentleman yields back. 

Yes? 

Mr. BURGESS. Would you yield to me for follow-up questions? 

Mr. GRIFFITH. I yield for follow-up. 

Mr. BURGESS. Dr. Christensen asked some very good questions 

on the healthcare aspects of the critical infrastructure and going 

along with what the gentleman was just asking as far as those forward-looking threats, it seems like we have created some problems 

for ourselves in the High-Tech Act and some of the things we have 

done with the information technology infrastructure as applied to 

health. Star Clause, for example, which prohibit hospitals from 

putting wire in a doctor’s office if the doctor is not directly affiliated with the hospital. So pushing a lot of these vertically integrated systems to go on the internet in order to have the abilities 

or the ease of transfer of the data, which then renders them vulnerable to attacks on the internet. Have you looked at that, whether perhaps there is something that could be done on the policy side 

to lessen the impact of the vulnerability if we were to make some 

changes on the regulatory side? A closed loop if you would between 

the hospital and a group of doctors, even though they are not all 

part of the same business model might be one way to do that. Have 

you explored that at all? 

Ms. STEMPFLEY. So your example is a wonderful example of furthering the independence between the infrastructures as they go 

forward. 

Mr. BURGESS. No, it is an example of how we make things harder 

than they need to be in the first place and then we have got to do 

a whole bunch more stuff to make it workable in the real world. 

But continue. 

Ms. STEMPFLEY. Thank you, sir. The specific reviews, technical 

reviews of proposals is not something that we certainly do. What 

we work towards are best practices for the kinds of separation and 

containment that might be necessary in order to understand the 

environment. Each of the owners and operators has a better underVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00069 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
66 

standing of the risks in their particular environment in the business models that best serve them in each of these cases. And so the 

set of best practices are an important part of how we do this. 

Mr. BURGESS. But do we look at the regulations that we, the 

Federal Government, have put in place that make it harder for 

people to do the right thing in the real world? 

Ms. STEMPFLEY. So I am not sure I can say that specific regulation was reviewed prior to in order to understand the potential implications across the board, but we do look at regulations and procedures as they come up. 

Mr. BURGESS. I appreciate the gentleman for yielding. My time 

has expired. Let us look at that going forward. I yield back. 

Mr. STEARNS. I thank the gentleman. 

Ms. Schakowsky is recognized for 5 minutes. 

Ms. SCHAKOWSKY. Thank you. 

Have any of you, the three of you, read Stieg Larsson’s book, the 

Girl with the Dragon Tattoo, et cetera? 

Mr. WILSHUSEN. Yes. 

Ms. SCHAKOWSKY. You have. If you haven’t, people who are into 

cybersecurity would not only enjoy them but probably be a little 

worried about it. The pretty flawed heroine, Lisbeth Salander, 

there is no firewall too high or wide or low that she can’t get 

through. And I think she is the heroine, sort of the good guy, but 

the notion of individual actors out there who have this tremendous 

capacity to infiltrate I think is a real concern. I sit also on the Intelligence Committee, and we think about that a lot. 

So here is what I wanted to ask. Do we employ sort of old-school 

kinds of techniques like redundancy to make sure—I remember sitting in a hotel room watching a rolling blackout in Ohio a number 

of years ago, which turned out to be a failure of the grid and not 

some sort of attack—this was post-9/11—but felt like it might have 

been. So do we build in things like we do in aircraft or whatever, 

just redundancies so we are not as vulnerable? Can someone answer? 

Mr. MCGURK. Yes, ma’am. I do agree that one of the salient 

points of the book was that they were focusing on perimeter defense as a method of ensuring their security, and as you quite adequately pointed out that there was no wall too high or too thick 

that she couldn’t get through in the process, and subsequently, that 

is why the Department doesn’t look at only a perimeter-defense 

strategy as part of enabling a sound cybersecurity profile. We look 

at a defense-in-depth strategy so that there is layers upon layers 

of security implemented. In addition, we want to focus on the practices and procedures to address the various risk associated with operating those networks. Whether it is from insider activity, whether it is from nation-state-sponsored, whether it is criminal activity, 

we treat the act separate from the actors so that we can understand what they are trying to exploit as far as the vulnerabilities. 

So that is the approach that the Department takes, and we do 

work very closely with the intelligence community, law enforcement community, and the private sector to develop those necessary 

strategies so that we can have a better and more secure defense 

posture. 

67 

Ms. SCHAKOWSKY. Let me ask another question. There is a lot of 

talk and even advertising about how we can centralize data management and storage and concentration and that you can access 

that without individual servers and all kinds of things to make 

business more efficient, et cetera. I am wondering if this creates a 

new layer, then, of vulnerability if everything is sort of outsourced 

to one place. 

Ms. STEMPFLEY. The what I call re-architecting moments that 

are going on in the environment, things like the movement to cloud 

computing and mobility are intelligent and opportunity at the same 

time. So there certainly are vulnerabilities that exist in that environment that must be addressed as we architect to move things 

there. But it isn’t generally a lump sum, just pick up and move. 

There are design considerations that must be taken into account as 

you move. And so they are these opportunities for individuals to 

look at how they both handle their data procedurally and how they 

protect it through this defense-in-depth approach across the board. 

Mr. WILSHUSEN. And if I may add we did a review over the 

clouds computing security and identified a number of both positive 

as well as negative security implications of going to the cloud computing. Particularly of the negative sort is just agencies lose control 

over the access to their data, who has access to it, as well as the 

ability of agencies who are still responsible for the protection of 

that information to assure themselves through independent testing 

or other evaluations that the cloud service provider is actually implementing security effectively over their environment and the information. And those are still issues that are still being worked 

out. The Federal Government, through GSA—I am not sure if DHS 

is involved in this—OMB and others are studying up different procedures through FedRAMP and some other programs to try to address some of those areas. 

Ms. SCHAKOWSKY. I started by talking about this rolling blackout 

that I saw. I wondered if we can talk about how secure our power 

grid really is. I don’t know if you addressed that earlier. There was 

a project that showed the effect of hacking into a power plant’s control station via computers and digital devices, so I am just wondering how that came out and if there are vulnerabilities that we 

are correcting? 

Mr. MCGURK. Yes, ma’am. The purpose behind the Aurora evaluation and experiment that was conducted by the Department in 

conjunction with the Idaho National Lab back in 2007 was essentially identifying the interdependencies between the critical infrastructures. That is how it started out. We wanted to see if we could 

have a negative impact in an environment by attacking the capabilities or the equipment of another environment. For instance, if 

I destroyed the generation capability, could I then have an adverse 

impact on a data-storage center or an airport or some other physical infrastructure? So subsequently, we took a look at the interconnected nature of these devices and we conducted a series of experiments that identified the capability by modifying settings and 

accessing control networks to actually take a digital protective circuit and turn it into a digital destructive circuit. 

A simple explanation of what we did with Aurora it is like you 

are driving down the road at 60 miles an hour and you throw your 

68 

transmission in reverse, it is going to have a negative impact on 

that car to operate. 

Ms. SCHAKOWSKY. Yes. 

Mr. MCGURK. So that is really what we were trying to demonstrate. And then subsequently, once we identify the 

vulnerabilities, how do we put those protective measures in place, 

whether it is through equipment design and modification or in 

many cases it is just through procedural changes? So we look at 

low-cost or no-cost approach. From that point forward, the Department has conducted numerous equipment vulnerability assessments to not only identify inherent vulnerabilities in devices but to 

work with industry to develop those mitigation strategies and in 

some cases working with the manufacturers to physically modify 

the equipment so it is more secure. 

Ms. SCHAKOWSKY. Thank you. My time has well expired. Thank 

you. 

Mr. STEARNS. The gentleman from Louisiana, Mr. Scalise, recognized for 5 minutes. 

Mr. SCALISE. Thank you, Mr. Chairman. If I could ask all the 

panelists first, I just want to get your opinion on if our critical networks are more vulnerable today than they were 5 years ago? 

Ms. STEMPFLEY. So my opinion is they are not necessarily more 

vulnerable than they were 5 years ago. A great deal has happened 

over the last 5 years in terms of coordination, collaboration across 

the board. What I believe is that we are much more aware now 

than we were 5 years ago both of the role that they play in the environment. We are certainly more dependent on cybersecurity solutions and interdependent today, more aware of that, and there is 

a higher sophistication in the threat that exists today than did 

some time ago. 

Mr. SCALISE. Mr. McGurk? 

Mr. MCGURK. Thank you, sir. I would also agree that I believe 

it has been an evolutionary period. Perhaps in the past we were 

focusing more on information assurance as a method of achieving 

cybersecurity, but since then, we have recognized that since the 

physical and the virtual are all interconnected, we are taking a 

more direct approach towards cybersecurity. So there may be more 

reporting but there is more awareness as well. 

Mr. WILSHUSEN. And I would also say that the threats to cyber 

critical infrastructures are increasing. They are evolving and growing and becoming more sophisticated. So those two raise the overall 

risk to those infrastructures. Our reviews have shown that where 

we have evaluated the security over specific systems that they are 

vulnerable and that numerous vulnerabilities exist because appropriate information security controls, which are well known, have 

not been implemented on a consistent basis throughout. So while 

there is greater awareness, there is also a greater threat I believe 

and also the vulnerabilities still remain. 

Mr. SCALISE. Mr. Wilshusen, in your testimony, the GAO—and 

you listed here some GAO recommendations to enhance the protection of cyber-reliant critical infrastructure. Regarding these recommendations that you laid out, do you see that other agencies are 

looking at these or open to these and specifically with members of 

DHS that are here and, you know, I would like to get their take, 

69 

too, but what has been the reaction you have seen from the GAO 

report of these specific recommendations? 

Mr. WILSHUSEN. Well, for most of our reports in this area, we 

have received largely concurrences with our recommendations, particularly from DHS. They have taken a number of actions to implement our recommendations and we will be following up with them 

to ensure that they are effectively implemented over time. In some 

cases, even when DHS non-concurred for the purposes of our report 

with the recommendation, they ultimately reversed themselves and 

decided to implement the recommendations. So I think there is 

awareness and concurrence for the most part of the agencies to implement our recommendations. 

Mr. SCALISE. I will ask the same, Mr. McGurk and Ms. 

Stempfley, just both of those recommendations but also other tools 

that you think should be available. 

Mr. MCGURK. I would like to add that in addition to the recommendations of GAO—and we do evaluate them not only from a 

technical standpoint but also from an implementation standpoint, 

and that is part of the challenge that we identified. In the critical 

infrastructure, the networks are so—in some cases—unique that 

you can’t apply a particular standard or requirement that is identified by a recommendation and you may actually cause an interoperability challenge. So we do look at that from a technical standpoint and then we work with other standards-settings bodies such 

as NIST to identify those best practices and those requirements 

and then work with the private sector to ensure that we can actually implement that without causing an adverse impact or additional cost. 

Mr. SCALISE. Ms. Stempfley? 

Ms. STEMPFLEY. So we agree that the recommendations in the 

GAO report are ones that we focus a great deal of attention on and 

recognize that cyber is one of the high-risk items that GAO executes. We have a regular interaction with them around this particular activity, particularly given the consequences. We talked a 

great deal about consequences of malicious activity in this particular environment. We watch very closely that. And as we work 

through issues both in terms of owners and operators, execution 

and implementation of practices in their environment and come out 

as we are requested to come out and provide voluntary review of 

information and infrastructures and the owner/operators we are 

also able to identify how they are doing in terms of implementation 

and get information about what is generally accepted practices 

across the board. 

Mr. SCALISE. Real quickly one final question before my time runs 

out. The Department of Defense’s director of intelligence and counterintelligence has talked about supply chain integrity and, you 

know, they suggest that some equipment that we buy, hardware 

that we buy could be corrupted both hardware and software. And 

there are some things that they are looking at in that regard, and 

I wanted to get your take from Homeland Security or if GAO wants 

to chime in. Is that something that you all have looked at as well? 

Have you seen any problems there? 

Ms. STEMPFLEY. So I believe I made an offer earlier to bring back 

an interagency review around supply chain. We appreciate that it 

70 

is important for us to look across the entire lifecycle of both equipment and of software development as well so that we can make 

sure that we have good practices in each of the steps of the 

lifecycle. 

Mr. WILSHUSEN. And if I may chime in, we are currently evaluating the supply chain risk process at several agencies including 

DOD, DHS, Justice, Energy as part of our review over the supply 

chain risks for IT. We are assessing also the agencies’ efforts to employ a risk-based approach to assessing supply chain risks. 

Mr. SCALISE. Thank you, Mr. Chairman. I yield back. 

Mr. STEARNS. Thank you. 

The gentleman from Texas, Mr. Green, is recognized for 5 minutes. 

Mr. GREEN. Thank you, Mr. Chairman. 

And following up our colleague from Tennessee, Ms. Blackburn, 

you know, our committee has jurisdiction both over cybersecurity 

and healthcare, and so when we go through those screenings, could 

we at least maybe in our jurisdiction have a radiologist look at 

those so we can do those full body scans and it maybe save us on 

our imaging cost. 

But I want to welcome our panel here. It has been a long hearing 

for you all and I thought we ought to laugh a little bit. 

The GAO has long identified protecting the Federal Government’s information system and Nation’s cyber-critical structures. 

And Mr. Wilshusen, when did the GAO first identify cybersecurity 

as part of our high-risk series? 

Mr. WILSHUSEN. That was back in 2003. 

Mr. GREEN. OK. And you did your first major review of DHS 

cybersecurity efforts in 2005? 

Mr. WILSHUSEN. That is right. That is when we assessed the Department’s performance and actually implementing some 13 roles 

and responsibilities that it was responsible for. 

Mr. GREEN. Have you seen improvements in the way that the 

Federal Government prepares for and addresses cyber threats since 

you have been reviewing DHS’ program? 

Mr. WILSHUSEN. We have seen progress at DHS in the way that 

it is addressing some of these areas. We also recognize that there 

is more that needs to be done, particularly with some of the sector’s 

specific planning efforts, its cyber analysis and warning capabilities, as well as just as I mentioned earlier related to its privatepublic partnerships. 

Mr. GREEN. OK. I understand in 2009 DHS launched the 24-hour 

DHS-led coordinated watch and warning system known as the National Cybersecurity Communications Integrations System. Mr. 

McGurk, what private-sector entities have current access to the resources of this facility? 

Mr. MCGURK. Certainly, sir. Currently, we have a direct partnership with each of the 18 critical infrastructure and key resource 

sectors. Physically located on the watch floor today we have representatives from the energy sector, the financial services sector, 

the communications sector, IT sector, Multi-State ISAC. We are 

also finalizing agreements with chemical and others so they can be 

physically present on the watch floor. In addition, we recognize the 

unique capabilities of some of our other partners in the manufacVerDate Nov 24 2008 15:34 Mar 30, 2012 Jkt 037690 PO 00000 Frm 00074 Fmt 6633 Sfmt 6633 C:\PROGRAM FILES\WS_FTP\73391.TXT WAYNE
71 

turing and antivirus environment. And we are working with them 

to develop cooperative research and development agreements so 

that they can be physically present so that we can share data in 

real time. 

Mr. GREEN. Last week there were reports emerged about a Department of Homeland Security report insider threat to utilities, 

and when you mentioned utilities were involved in it, do you have 

pretty well unanimous support or working relationship with our 

utilities in our country from investor-owned, municipal-owned coops like the TVA even? Is that pretty well uniform throughout the 

country? 

Mr. MCGURK. Yes, sir. We have very direct connections with 

many of our private-sector partners. We have spent a lot of time 

developing cooperative agreements with—for instance, there is an 

organization that is made up of the 18 largest utilities in the 

United States and they have a Chief Information Security Officer 

Panel, which we interface with directly. I have personally briefed 

them on a number of occasions and provided input into those organizations so that they have a better cyber awareness. 

Mr. GREEN. OK. I know the report was not released to the public 

and in the news story we talked about, we have a high confidence 

in our judgment that insiders and their actions pose a significant 

threat to infrastructure and information systems of U.S. facilities, 

and I understand, like I said, the report is not made public. I would 

like to ask some questions about insider threats to our utilities. 

Ms. Stempfley, could utility facilities be targets for terrorists on 

the cyber side? We know physical targets. 

Ms. STEMPFLEY. So I think you will find that the vulnerabilities 

that exist and are possible to be exploited exist in many places to 

include utilities across the board. That is one of the reasons why, 

as we have reiterated, we try to look at this from a common approach across the environment. 

Mr. GREEN. I am aware in Texas and Houston we have mostly 

investor-owned utilities, our service provider center point, and I 

know they are doing some really great things, but does access to 

these sensitive facilities—mostly owned by the private companies— 

need to be closer guarded and carefully monitored to protect these 

threats? 

Ms. STEMPFLEY. So best practice activities in the cyber security 

systems are ones of multiple layers of defense, which would include 

not just perimeter defense but internal architecture approaches 

that separate sensitive data from each other, rely on identity and 

other services. Those kinds of best practices, which are widely 

available, should be employed across the board. 

Mr. GREEN. I know a news story last week described an insider 

sabotage in April in a water treatment plant in Arizona where a 

disgruntled employee took control of the control room to create a 

methane gas explosion. What is DHS doing to ensure that these 

type of insider sabotage, again, whether they are just one person 

or a plan, what is DHS doing to try and limit some of these insider 

cyber sabotage? 

Ms. STEMPFLEY. As we have identified, we continue to provide 

the kinds of warning products, indicators of activities that might 

be necessary and the kinds of best practice guides for owners and 

72 

operators to employ. In your example, it would be up to that particular owner and operator to employ those practices. 

Mr. GREEN. And Mr. Chairman, I would just like to ask one last 

thing. 

And do you get pretty good cooperation throughout the country 

with the utilities? 

Mr. MCGURK. Yes, sir, absolutely. We get a very close working 

relationship with utilities. 

Mr. GREEN. Thank you, Mr. Chairman. 

Mr. STEARNS. I thank the gentleman. We will quickly go for a 

second round. We don’t have votes and so I welcome my colleagues 

if they wish to have a second round. 

I would like to return to the Stuxnet issue if you don’t mind, Mr. 

McGurk. If you can, just answer yes or no. 

Do you know how many operators in the industrial controls infrastructure actually implemented DHS guidance on Stuxnet? 

Mr. MCGURK. No, sir. 

Mr. STEARNS. OK. How many U.S. companies use a type of Siemens industrial-controlled products that were the target of Stuxnet 

attacks? 

Mr. MCGURK. A total number of companies? It is very difficult 

to quantify, sir, because we don’t have this ability into all of their 

networks, but there were approximately 300 companies that had 

some combination of hardware and software. 

Mr. STEARNS. So 300 U.S. companies? 

Mr. MCGURK. Yes, sir. 

Mr. STEARNS. Approximately. Good. Do you believe that if the 

U.S. companies implemented the DHS guidance on Stuxnet, they 

will be able to fend off a future attack from this software? 

Mr. MCGURK. Yes, sir, from this particular piece of mal code. 

Mr. STEARNS. In addition to this software, we have heard that 

there are other vulnerabilities identified in industrial-controlled 

systems, including a Beresford vulnerability or exploit. Does that 

ring a bell? 

Mr. MCGURK. Yes, sir. 

Mr. STEARNS. Um-hum. Given that Stuxnet’s impact and the 

other vulnerabilities that exist, are you comfortable that our country’s industrial control systems are secure from cyber attacks? 

Mr. MCGURK. I think it is an evolving threat, sir, so we have to 

continue to move forward and not focus on the previous attacks. 

Mr. STEARNS. Wasn’t the Beresford attack developed by one researcher in about 2–1/2 months? That is our background. And what 

does that say about the safety of our system if someone could work 

with his laptop computer in 2–1/2 months, develop something that 

is vulnerable, and be used? Would you care to comment? 

Mr. MCGURK. Yes, sir. What that really highlights is the fact 

that it is not necessarily attributed to the actor itself but it is the 

action and the vulnerabilities that we need to focus on. Because as 

you had mentioned in your opening statement and again when focusing on Stuxnet, it is not the capability of the actor that necessarily brings about the consequence. It is the actual vulnerability 

associated that is being exploited, and that is really where the Department is focusing much of its efforts. 

73 

Mr. STEARNS. OK. What step has DHS taken to prepare and defend against a Beresford type of attack to industrial control system 

and has this guidance or other direction been issued to the industry of the private sector? And I will ask you later. Go ahead, Mr. 

McGurk. 

Mr. MCGURK. Sir, the Department has produced a number of 

specific actions and guidance associated with various types of cyber 

risk and cyber threats but again, not focusing on the actor or the 

activity but focusing on the vulnerability and the necessary methods to secure the networks. We actually will not only address that 

issue but maybe the next-generation issue that could occur. 

Mr. STEARNS. Do you actually talk to these U.S. companies to see 

how they are implementing and doing this? 

Mr. MCGURK. Yes, sir. In many cases, we are invited to actually 

do an onsite assessment associated with the vulnerabilities to see 

how they implement the mitigation plans. 

Mr. STEARNS. Well, just approximately how many do you think 

you have assessed? 

Mr. MCGURK. We have assessed approximately—this past year 

we did 53. The year before we did about 40. These are voluntary 

assessments. The year prior to that, another 30. So we have done 

over 100 voluntary assessments and incident response activities 

over the past 3 years. 

Mr. STEARNS. Now, was that oriented towards the Stuxnet or 

was it also involved with the Beresford? 

Mr. MCGURK. It is involved with all types of vulnerabilities, not 

just those two particular instances. 

Mr. STEARNS. Mr. Wilshusen, do you mind commenting? 

Mr. WILSHUSEN. Well, in our reviews we often also focus on the 

vulnerabilities of systems because that is what the agencies or the 

operators can control. They can’t always control the threats that 

come their way, but they can control how well they protect their 

systems and protect against known vulnerabilities. And so that is 

one thing that we often look at. And at the systems that we examine at a detailed level, we typically find that they are vulnerable. 

Mr. STEARNS. Ms. Stempfley, you had indicated in a question 5 

years ago are we more vulnerable today than we were 5 years indicate, you seemed to indicate you didn’t think so. And I guess the 

question is based upon what I have just given you some examples 

how a man in just 2–1/2 months could come up with something 

that can make our system vulnerable, I guess the question for each 

panelist, can you explain how the cyber threats you are seeing now 

are different from 2 or 3 or 5 years ago? And I will start with you, 

Ms. Stempfley? 

Ms. STEMPFLEY. So the cyber threats now are certainly more sophisticated than they were several years ago. The threats are focused more on individuals and very specific activities. An example 

I have used is spear fishing is very targeted to an individual. I received an email not too long ago that appeared to be from my husband as a situation and it was about a topic about college payment 

activities, and that was identified and sent to me. And had I 

clicked on it, it may have been something that was malicious. That 

is an example of increased sophistication and increased focus that 

exists. 

74 

The number of vulnerabilities that have existed and the kind of 

model that you presented where a researcher identified a vulnerability and something that is already in existence, that vulnerability had been there from the beginning. It was just recently 

identified. And so the specific vulnerabilities have not increased in 

that scenario. We are just more aware of it now and more able to 

respond. 

Our protective measures and protective guidance are about building these infrastructures in a way that reduces the exposure of 

those vulnerabilities and makes it less likely for threat actors to be 

able to be successful. 

Mr. STEARNS. And Mr. McGurk? 

Mr. MCGURK. Yes, sir. I would also agree that, you know, it is 

a matter of awareness and understanding the interconnected nature of the—— 

Mr. STEARNS. But you don’t see the cybersecurity increasing in 

the last 5 years? 

Mr. MCGURK. Do I see cybersecurity risk? 

Mr. STEARNS. Threats increasing. 

Mr. MCGURK. Threats, yes, sir, as a result of exploiting those 

vulnerabilities because of the sophistication and also the targeted 

nature. In the past we were talking about just basic data ex-filtration from a very broad audience. Now, we are seeing—in the RSA 

example that was mentioned earlier—very specific, targeted attacks against these aggregation centers. 

Mr. WILSHUSEN. And I agree, and I think you will continue to 

see more blended types of attacks that exploit a number of different vulnerabilities in order to gain access to its target. 

Mr. STEARNS. So you would agree that the cyber threats are 

more now than they were 5 years ago? 

Mr. WILSHUSEN. And more sophisticated. 

Mr. STEARNS. Let me just close by this question. I am not quite 

clear myself what this Beresford software does or did. Can you describe, Mr. McGurk, what it does? Do you know anything about it? 

Mr. MCGURK. I don’t have those specific details of the analysis 

in front of me today, sir, so I couldn’t really comment on that. 

Mr. STEARNS. Anybody? 

Mr. WILSHUSEN. No. 

Mr. STEARNS. OK. All right. My time has expired. 

The gentlelady from Colorado. 

Ms. DEGETTE. Thank you very much, Mr. Chairman. 

First of all, I would like to ask unanimous consent to put Mr. 

Waxman’s opening statement in the record. 

Mr. STEARNS. By unanimous consent, so ordered. 

[The prepared statement of Mr. Waxman follows:] 

75 


73391.039
76 

Ms. DEGETTE. Thank you. 

So this is the perfect segue actually to just one question I had 

of clarification. We are all throwing around the words threat, vulnerability, and risk quite a bit today. And Mr. Wilshusen, I am 

wondering as we prepare for our subsequent hearings on these topics, you can just basically describe for us whether there is a difference between those three words and what the technical descriptions are. 

Mr. WILSHUSEN. Sure. Yes. And there is a difference. A threat 

is basically any circumstance or event that can potentially cause 

harm to an organization’s operations, assets, personnel, or whatever. A vulnerability is a weakness in the security controls that are 

over a system or network. There is actually a fourth component 

here before we get to risk, and that is impact. What is the impact 

that could occur should a threat, either a threat actor or an event 

occur, exploit a vulnerability? What is the impact that it could 

have? And then those three of those kind of equate to what risk 

is. 

Ms. DEGETTE. Thank you. And are they all three things we 

should be concerned about? 

Mr. WILSHUSEN. Yes, indeed. Absolutely. Threats are what you 

try to guard against. The vulnerabilities are what you try to prevent and minimize by taking corrective actions and implementing 

appropriate security controls. And you do that in such a manner 

that you minimize the impact should such a security incident 

occur. And so, yes, it is important to think of all of them. 

Ms. DEGETTE. So you have heard both me and the chairman and 

other members of this subcommittee talk about this committee’s jurisdiction. I am wondering if there is any particular sectors of our 

jurisdiction that you think we should look more closely at in subsequent hearings? 

Mr. WILSHUSEN. I think in terms of from a cyber perspective, I 

think probably the key sectors would be energy, electricity, both 

nuclear and other just because of the interdependencies that they 

have with other sectors, IT, finance and banking, and also communications would be I think the four that are the most important 

just because of the interdependencies that they have with the other 

critical sectors. 

Ms. DEGETTE. Great. Thank you. 

Thank you very much, Mr. Chairman. I yield back. 

Mr. STEARNS. I thank the gentlelady. I want to thank the witnesses for their participation, their coming here this morning. 

The committee rules provide that members have 10 days to submit additional questions for the record, the witnesses. And with 

that, the subcommittee is adjourned. 

[Whereupon, at 12:41 p.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

77 

Æ 


73391.040