Commission	on	Enhancing National Cybersecurity	 November 1, 2016

Meeting Minutes
 

Attendees
 

Commissioners: Maggie Wilderotter, Heather Murren, Ajay Banga, Pat Gallagher, Annie Anton

Others: Kiersten Todt,	Kevin Stine, Kimberley Raleigh, Alice	Falk, Jaime	Crooks, Robin Drake,	Matt

Barrett, Amy Mahn

Agenda

I. Identity Management Recommendation Discussion Led by Kevin Stine

II. Workforce Recommendation Discussion Led by Kevin Stine

III. Next Steps/Wrap-up

Discussion

I.	 Identity Management Recommendation Discussion led by Kevin Stine

a.	 Identity management	proposed recommendations	and action items	have evolved.

We will look at possible action items	for	identity management.

i.	 Weak identity management is the root cause of many identity attacks. It can

be an	aggressive and measurable recommendation that can be presented

with a definitive	timeline.

1.	 Suggest a	public-private sector team to work	toward eliminating

identity as an attack vector.

2.	 Targeted to agencies with heavy interaction	with citizens and

consumers. A wide array of top retailers, media organizations and

others.

3.	 It	would be	helpful to get commitments early	in the	next

administration from all potential participants.

ii.	 Reaction from the sommission –

1.	 Is it	a	sufficiently bold and a meaningful recommendation?

a.	 Mr. Gallagher: Possibly. There is the National Strategy for

Trusted Identities in	Cyberspace (NSTIC),	which	formed a

steering committee. It needs	to be very clear	about	what	is

different about this.

b.	 Mr. Gallagher: It	should not look	like we are repeating

NSTIC. Also, we must be careful about the wording.	

Removing "threat	vector"	can make people think of multi

factor authentication (MFA),	and others. If those methods are

not used, the threat	vector remains.

2.	 Mr. Banga: It	should be worded such that, "the vision we	have	for

the digital economy will not	happen without	these things"...

simplicity of use being as	critical as	security. It gets	to Pat's	points	

1
	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	

	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

Commission	on	Enhancing National Cybersecurity	 November 1, 2016

3.
 

4.

5.

more directly. Awareness on this area may still need to be raised. It

may be why NSTIC did not have a great impact. We may	need to	

think more about	what's needed to make it	work.

Mr. Stine: The challenge in	the past has been	there are a lot of

technologies today. We need that	perspective of public-private to

make the right choices.

a.	 NSTIC would be involved in this with other organizations,	the

FIDO alliance and	others.

b.	 Mr. Banga	(to Mr. Stine): Should write about importance of

inter-operable credentials. (Mr. Stine will take for	action)

c.	 Mr. Gallagher: There is a developing ecosystem with interoperable approaches. Does it make sense to	incorporate

those standards into the NIST	framework? It makes sense to

a	certain extent. Perhaps it makes sense at a	higher level.

Transparency is needed in	this area as well so that

consumers understand exactly how the security is working.

d.	 NSTIC did not have a market at the time it came out. We need	

to identify these spaces now. The government	did not	adopt	

it due to shifting focuses. The President called for it and

released a strategy, but it was	not followed.

e.	 Mr. Banga: Credibility through	scale of adoption – If we use

the framework, it	will improve things for everyone.

i. Ms. Wilderotter: The framework is a trusted

foundation. It is a good way to look at it.

f.	 Corporate America has a lot to	gain with	trusted	access. All

companies can participate in making sure their employees

have updated	identities. It creates a good habit.

Proposed	action	item: In the first 100 days recommend to establish

clear rules for trusted identification. The government should then

use those solutions that are developed with citizens.

a.	 Directs GSA	to work with citizen facing agencies and industry

to develop those solutions.

b.	 That action	item developed	from Mr. Sullivan being a leader

in adoption. Good suggestion – Adopting, using as default,

and promoting	for citizen interaction.

Proposed	action	item: Government serves as attribute provider for

identity decisions.

a.	 The attributes provide the pieces needed to make decisions

and transactions.

b.	 The government can	provides these key pieces.

c.	 Privacy and	security must be central and	visible.

d.	 How will identity proofing capability be described? It needs

to be included in what	is written in the report. It	may go back

2
	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 		

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

Commission	on	Enhancing National Cybersecurity	 November 1, 2016

to AI	1 and the public-private partnership, and developing

attributes.

e.	 Mr. Gallagher: The government is not providing

information, but is offering a validation	service. In	other

words, people submit data, and receive a matching score.

i.	 Government data offers different proofing attributes.

ii.	 Identity under internet	of things action –

1.	 Initiating a basic campaign on the internet	of

things. Suggested based on recent events.

Changing default user names and	passwords,

etc.

f.	 Mr. Stine:	Would appreciate any additional feedback. These

suggestions will be included in tomorrow's draft for

discussion	next week.

II.	 Workforce Recommendation Discussion Led by	Kevin Stine

a.	 We are attempting to be more specific in terms of outcomes, numbers of workers,

etc. There	is a need for a surge	capacity	in workforce. Automation will play	an

increasing role. The language covers short and long term, and tries to achieve	a

balance in	ideas.

b.	 Suggestion of workforce recommendations in continuum with awareness. Basic

consumer awareness in cybersecurity must come first. Job training and education

will then follow. This sequence in the report makes a lot of sense.

c.	 The overarching proposed workforce recommendation in the near term – Building

workforces. It has six potential action items:

i.	 An apprenticeship program to	develop a 100 thousand jobs in cybersecurity

by 2020.

1.	 Where does the job number come from? Is it statistically based? It	

needs be if it is not. Also, the number should be bold whatever it

ends up being. Kevin will analyze	data and arrive	at a more	bold

number

ii.	 Prepare students with	cybersecurity awareness education	at all grade levels.

1.	 Workforce should possibly follow out of consumer as it seems to

flow better.

iii.	 Federal,	SLTT	governments create an exchange program to provide as many

opportunities as possible.

1.	 Do we want to call out contracting challenges that prevent people

from being hired?

2.	 May want to consider virtual work exchanges as well.

iv.	 OPM will form a Presidential	Fellows Program for civilian agencies with a	

cybersecurity focus.

1.	 Will need to solve clearance bottle necks to get people hired quickly.

The process can	be streamlined. Can	highlight	it	as a challenge.

3
	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	

		

	 	 	

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 		 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	

		 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

Commission	on	Enhancing National Cybersecurity	 November 1, 2016

v.	 Jointly sponsor a nationwide network of	cyber boot camps. Increases supply

in the immediate term. Can be oriented to under employed, or unemployed.

Can reach	under-represented populations. Veterans	transitioning, women

and others. Targeted recruitment and training efforts can be	developed.

1.	 Ms. Wilderotter: Are there specific organizations that can assist?

There are some organizations that	do boot	camps, etc. There are an

inventory that can be highlighted. We can also use the National

Guard. There is a National Guard recommendation, we will want to

look at this further.

vi. NICE, NSF, NSA, ED	– Develop curricula in cybersecurity.

1.	 Ms. Anton: Should work with Accreditation Board	for Engineering

and Technology	(ABET).	If	we	want	to	get a	curriculum going, we

need	to partner with	them. Annie will provide contact information	

for ABET	to Kevin.

2.	 Ms. Anton: If there are specific examples of initiatives, please share

with Kevin. Scholarship for Service (SFS) pays for two of a	four-year

program for cyber. The students return the same number	of years of

service to the government. Lots of people get degrees and	come back

into government in jobs that don’t match their background which

frustrates them. Don’t want that to be the status quo; should try to

ensure	people	are	placed in jobs where	their skills are	leveraged.

3.	 MC hires graduating officers out of West Point. Mr. Banga will try to

find and provide information.

4.	 We need to make sure SFS graduates get in jobs that use the skills

they learned in school.

III.	 Next Steps/Wrap-Up

a.	 Ms. Todt: Everyone will receive a revised draft tomorrow by early afternoon.	We

ask for the full document to	be reviewed and provide edits. There will be another

draft next week. Email or comments can	be sent to	me.	

4