Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

Commission	on	Enhancing National
 

Cybersecurity
 

Established by Executive Order 13718, Commission on
 

Enhancing National Cybersecurity
 

Meeting Minutes
 

November	21,	2016
 

Public	Call In:	1-888-323-9794
 

Attendees:

Please refer to the attendee listing attached to these minutes for the complete list of attendees.

Opening 

Kiersten Todt, Executive	Director, Commission on Enhancing National Cybersecurity

Ms. Todt opened the meeting at 9:07 a.m., Eastern Time.

Tom Donilon, Chair,	Commission	on	Enhancing	National	Cybersecurity

Mr. Donilon welcomed the commission members and members of the public to the call.	He noted

public participation	over the course of the commission's time has been	a significant contribution	

to its work. The commissioners have also	represented	a broad	range of expertise	that has also	

contributed to the content	and scope of the report.	Kiersten	and	staff	have	also	contributed.	

Sam Palmisano, Vice Chair, Commission on Enhancing National Cybersecurity

Mr. Palmisano also thanked the commission publically for its work over the course of	the time the

commission has convened.

Approval of Minutes 

The minutes from the public meeting held at the University of Minnesota in	Minneapolis on	
 

August 23, 2016 were brought before the commission for approval.	The	motion	was	made	and
 

seconded to approve the minutes. The minutes were approved.
 

The minutes from the public meeting held at American	University in	Washington, D.C. on	
 

September 19, 2016	were brought before the commission	for approval. The motion	was	made
 

and seconded to	approve the minutes. The minutes were approved.
 

September 20, 2016 Working Group Meeting Readout 

Maggie Wilderotter, Commissioner, National Commission on Enhancing Cybersecurity

The September 20th meeting was the first	of three work group meetings. It	covered governance

and discussions on transforming the government	into a leader in cybersecurity,	and	clarifying

specific responsibilities, action roles	and authorities	for	the federal government;	addressing	

capacity shortfalls in workforce, and	elevating the importance of risk	management for

government.	

1
 
	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 		

	 	 	 	 		

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 		

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

Discussions on potential recommendations included an over-arching	government strategy,

finishing the National Cybersecurity Incident	Response Plan (NCIRP);	establishing a special

assistant to the President focusing on cybersecurity; centralizing services for agencies; and

cybersecurity for smaller	agencies. It	also focused on the internet of	things;	device security and

safety and liability. It	focused on education, including apprenticeships; the NICE presentation to

Congress, working with	younger children	on	raising awareness and interest in future careers.	

Critical infrastructure focused on America's aging	infrastructure and additional topics.	The

commission will be reviewing topics for	inclusion in the final report,	and	receiving	additional

feedback from the commission on appropriate areas to discuss further.	There were no additional

comments from the commissioners on the September 20th meeting.

October 19, 2016 Meeting Readout 

Pat Gallagher, Commissioner, National Commission on Enhancing Cybersecurity

The October 19th meeting built on	previously discussed topics and how to best present

recommendations in the final report. Topics discussed	included the internet of	things, the

convergence of the traditional internet and the internet of things, improved standards for privacy

and security, harmonization of standards, a	labeling system to provide transparency and a

standard of care, the increasing use of botnets utilizing internet of things devices, and	emerging

standards	of tort liability for	internet of things	devices.

Critical infrastructure topics included clarifying authorities and actions for public	and private

sector	stakeholders, expanding use	of the NIST framework across	all sectors, and developing a	

public-private consortium in	the first 100 days of the new administration to advise the President.

Discussion on the international aspects of cybersecurity included options to clarify application of

international law to cybersecurity, the Mutual Legal Assistance Treaty (MLAT) process, and

continued US thought	leadership in cybersecurity and the internet.

Consumer awareness discussions included	ways to raise consumer awareness, and a	consumer

bill of rights.	Identity management discussions included discussions of an identity management

clearing house, trusted identities, blockchain technologies, and a trusted identity ecosystem.

Insurance discussions included the topic of assisting	the growing cyber insurance market with

anonymous incident data sharing. Finally, the commission discussed	how to	group ideas into	

relevant buckets. There was also a process discussion	on	how to provide comments. There were

no additional comments from the commissioners regarding the October 19th meeting.

November 8, 2016 Meeting Readout 

Steve Chabinsky, Commissioner, National Commission on Enhancing	Cybersecurity

The commission	discussed the content and structure of the final report. It	discussed possible

imperatives, recommendations,	and	action items. The imperatives are intended to present key

priorities, and discussed ordering them to provide the right message. The commission	examined

recommendations	and action items	within those imperatives, in order	to convey specific steps	to

achieving	key	goals. Several major recommendations were	discussed that required resolution by	

the commission. The commission discussed conflicts and challenges, including protecting the

2
 
	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	

	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 		 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 				

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

digital economy, while also	protecting the Nation. There was focus on	recommending regulations

and the relationship to	market forces, and incentives to encourage market forces. Identity

management was also	discussed as well as reaching the goal of strong authentication. There is a

technological and global convergence that	threads throughout	everything	the	commission is

doing.

The commission	examined federal government organization	and discussed whether the Executive

Office of the President,	or	the	agencies	themselves should have more control of cybersecurity at

the agency level.	Those governance issues were subject to some discussion. The commission

looked at the right tools for securing the internet of	things. Critical	infrastructure was discussed in

today's context	and what	it	means in terms of convergence.

The idea of	removing cybersecurity from end users,	and	movement	toward	common	solutions	was

discussed, and the commission discussed the need to	continue to educate	and inform consumers.	

The next steps were for commissioners to review feedback,	and	update the final report. There

were no additional comments on the November 8th meeting.

Deliberation 

Mr. Chabinsky presented six imperatives for the commission to address in the report to the

President:
 

- Better equip government to function effectively and securely in the digital age;
 

- Protect today's internet by better managing cyber risk	in	the public and private sectors;
 

- Shaping	the internet of tomorrow through innovation;
 

- Preparing consumers to thrive in	the digital age;
 

- Building cybersecurity workforce capabilities, and,
 

- Competing and	functioning more effectively in the global economy.
 

Discussion 

Key issues to address relating to the imperatives in the report:
 

- How to secure the digital economy;
 

- Ensure research and development aligns with future needs;
 

- What is the role of the consumer in contributing to security and	resilience of the

interconnected economy;

- Advance security considerations as connected devices are designed, manufactured, and

deployed;

- Ensure the workforce is able to grow and evolve to keep	up	with requirements of the

digital economy, and,

- Define the role of the US government and the private sector in international standard

setting.

There was no additional input on	the imperatives or key issues presented here. Mr. Chabinsky

asked for a	commission vote on the imperatives. Is there	agreement on the six imperatives given

here? There is agreement on	these six, and	the commission	concluded the Federal Advisory

Commission Act (FACA) requirements portion and	proceeded	to	the public comment portion of

the call.

3
 
	 	 	 	 	 	 	 	

		

	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

Public Comment 

David	Leigh, Rofori Defcon	Cyber

Mr. Leigh thanked the commission for its work. His company has a real time metric dashboard	for

cybersecurity that	allows you to know where your organization stands at	a moment’s notice.	

Cybersecurity forms the foundation of	trust. What will it take and when	will improvement

happen? It	will happen when everyone	measures what is actually	being achieved in real time, then

there will be trust. What	outcome based metrics are being used? There have been	no answers

from government agencies to date.	We	need a	holistic	picture	to	bring	high	levels	of	security	into a

comprehensive whole. There must be an approach to measure what works. We have been

collecting data about what doesn't work.

Charles Tupitza,	Global Forum to Advance Cyber Resilience

Mr. Tupitza appreciated the mention of public and private collaboration. It	is important	

collaboration continues. We are attempting to secure businesses and to make everyone better.

Mark Rockwell,	Federal	Computer	Week

Mr. Rockwell requested the list	of imperatives be repeated. Ms. Todt	re-read the imperatives.	

Shaun Waterman, Scoop News Group 

Mr. Waterman requested details on the logistics of	the final report delivery. The report will be

delivered on December 1st.	It	is not	currently known	if the report will be made public on that	day.

The President has 45 days to	comment. Ms. Todt offered to follow up	when	the information	is

available.

Blake Sobczak,	E&E	News

Mr. Sobczak requested an elaboration on steps for adopting incentives and the	framework. What

steps	are being taken? Ms. Todt noted that the commission	has	been examining incentives	and will

be address them in the report. Mr. Alexander noted the commissioners felt in general that offering

incentives, as opposed to regulation is the	way to address problems.

Paul Merrion,	CQ	Roll	Call

Mr. Merrion asked how large will	the report be. Ms. Todt noted the report is still in formation and

the language will	be easily readable. The page count is an	estimate, but should be 60-70	pages.

The report will have big ideas, and actionable recommendations, some immediate and some

longer term.

Closing	 

- Mr. Donilon noted the report will reflect the commission	view on	key principles. The goal

is to present concrete actions to be taken.

- Report Availability: The commission	will be working with the White House to determine

when it can be released. Mr. Donilon would like to have the commissioners available to

answer questions from the public and the media when the report is released.	The	report

will be released in full following submission to the White House.	

- Mr. Donilon and Ms. Todt both thanked the	commission for its hard	work.

4
 
	 	 	 	 	 	 	 	

	 	 	 	 	

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

The meeting adjourned at 9:44 a.m.	Eastern	Time.
 

5
 
	 	 	 	 	 	 	 	

 

 

 

 

 

 

 

 

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

List	of	Attendees
 

ATTENDEE LIST 

COMMISSIONERS 

1 Keith Alexander 

2 Annie Anton 

3 Steven Chabinsky 

4 Tom Donilon 

5 Patrick Gallagher 

6 Peter Lee 

7 Herb Lin 

8 Heather Murren 

9 Sam Palmisano 

10 Maggie Wilderotter 

EXECUTIVE 

DIRECTOR 

11 Kiersten Todt 

PARTICIPANTS Company Name 

12 Sara Kerman NIST 

13 Sana Ali ITI 

14 Stacey Barrack Internet Security Alliance 

15 David Batz Edison Electric Institute 

16 Mark Boggis Cyber Security Policy Solutions 

17 Jon Boyens NIST 

18 Missye Brickell US Senate Commerce Committee 

19 Jamie Brown CA Technologies 

20 Adam Cohn Splunk 

21 Jennifer Combs Accenture 

22 Kathryn Condello CenturyLink 

23 Andrew Crofton Sprint 

24 David Dandar The Mitre Corporation 

25 Michael DeCarlo BlueCross BlueShield Assoc 

26 Paul Diamond Century Link Telecommunications 

27 Maureen Fabbri Eascorp 

28 Alice Falk Commission Staff 

29 Ashton Garriott MITRE Corporation 

30 Angela Gleason American Insurance Assoc 

6
 
	 	 	 	 	 	 	 	

 

 

 

 

 

 

 

 

 

 

 

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

ATTENDEE LIST 

31 Judith Hafner Vantage Point Strategies 

32 Tara Hairston Kaspersky Lab 

33 Matthew Hayduk Federal Reserve Board 

34 Matthew Heyman National Institute of Standards & 

Technology 

35 Fred Hintermister NERC 

36 Carl Hoecker Securities & Exchange Commission 

37 Ira Hunt Accenture 

38 Katie Ignaszewski IBM 

39 Neil Jenkins DHS 

40 Logen Johnson SAE International 

41 Michael Kans Williams & Jensen LLC 

42 Lee Kim HIMSS 

43 Heather King Commission Staff 

44 Robert Knake Orkestrel 

45 Ryan Lasalle Accenture 

46 Katherine Ledesma DHS 

47 David Leigh Rofori Defcon Cyber 

48 Jim Linn American Gas Assoc 

49 Julie Lucarelli American Express 

50 Amy Mahn Dept Of Homeland Security 

51 Joseph Marks Nextgov (Media) 

52 Robert Mayer US Telecomm 

53 Melissa Mejias IADC 

54 Chris Merida American Express 

55 Paul Merrion CQ Roll Call (Media) 

56 Daniel Miller Entergy 

57 Sean Morgan Palo Alto Networks 

58 Kevin O'Brien Accenture 

59 Veronica O'connell Accenture 

60 Chris Olson Media Trust 

61 Anne Palfrey Deutsche Bank 

62 Cherilyn Pascoe US Senate Commerce Committee 

63 David Perera Internet Security Alliance 

64 Matt Piscitello CRA 

65 Suzanne Potter DHS 

66 Kimberley Raleigh Commission Staff 

67 Kyla Reslock ITAP 

68 Kevin Richards Accenture 

69 Mark Rockwell Federal Computer Week (Media) 

7
 
	 	 	 	 	 	 	 	

 

 

 

 

 

 

 

 

Commission on Enhancing	National Cybersecurity Meeting Minutes November 21, 2016

ATTENDEE LIST 

70 Diego Rosero Treasury Dept 

71 Al Saikali Shook, Hardy, & Bacon 

72 Andras Scakal IBM 

73 Karen Scarfone Scarfone Cyber Security 

74 Dianne Smith NCTA 

75 Angela Smith GSA 

76 Blake Sobczak E&E News (Media) 

77 Dan Taylor AIG 

78 Christian Troncoso BSA 

79 Charles Tupitza Global Forum for Advance Cyber Resilience 

80 Joe Vines Charter Communications 

81 Shaun Waterman Scoop News Group (Media) 

82 Rick Weber Inside Cyber Security (Media) 

83 Chani Wiggins Twin Logic Strategies 

84 Jon Woodard American Express 

85 Shinichi Yokohama NTT 

86 Wesley Yurgaites EOP Group 

87 Jamie Crooks O'Melveny and Myers 

88 JP Chalpin Commission Staff 

89 Robin Drake Commission Staff 

90 Mark Barrett Commission Staff 

8