COMMISSION ON ENHANCING 

NATIONAL CYBERSECURITY 

Meeting of the Commission on Enhancing National 

Cybersecurity 

 

PANELIST STATEMENTS 

 

New York University – School of Law

40 Washington Square South, New York, NY

May 16, 2016
Commission on Enhancing National Cybersecurity Panelist Statements Page i

Table of Contents 

Panelist Statements.......................................................................................................................................1

Phil Venables.............................................................................................................................................1

Greg Rattray ..............................................................................................................................................4

Lee Garvin .................................................................................................................................................6

Peter Beshar..............................................................................................................................................8

Randal Milch............................................................................................................................................12

Irving Wladawsky-Berger.........................................................................................................................16

Alex Pentland ..........................................................................................................................................19

Jerry Cuomo ............................................................................................................................................21

Greg Baxter .............................................................................................................................................23
Commission on Enhancing National Cybersecurity Panelist Statements Page 1

Panelist Statements

Phil Venables

Good Morning Chairman Donilon, Vice-Chairman Palmisano and Distinguished Members of the 

Commission, I’m Phil Venables and while here today as a Managing Director at Goldman Sachs, the 

views I’m representing are my own based on over 20 years of working in the cyber- security 

industry. 

I would like to thank you for the opportunity to address the Commission today. 

It is my view that the management of technology risks, in particular cyber-security, has become 

critical to our increasingly digitized and connected society. It is imperative for national and 

international security and will continue to be ever more a foundational requirement for security 

in other domains. 

It is important to emphasize that cyber-security is not the only technology or information risk. 

There are many risks in digital business or society, for example, systems and software reliability, 

predictability, resilience, and capacity. However, cyber-security is and should continue to be our 

main concern given the potential impact of failure, the increasing number and sophistication of 

threats and its supporting and supported role in managing all these risks. 

I would like to put forth 5 recommendations to create and sustain national cyber-security risk 

mitigation: 

The first would be to integrate cyber security into the fabric of organizations:

• Risk must be integrated. It’s imperative to ensure that cyber-security risk management is 

embedded into the main risk management and strategic processes of organizations from the 

Board, to risk committees, to the wider processes of strategy formulation, product 

development, investments and acquisitions; both within the organization and across its 

extended supply chain 

• Technology must also be integrated. My experience and observation is that good technology 

management / hygiene promotes solid cyber-security and that for a controlled technology 

environment to be also agile and cost-effective it has to have risk mitigation be designed in 

– ambient controls 

• Resilience and recovery must also be integrated. However, no matter how well risks are 

managed something may still go wrong, a misidentified risk, a break of a control, a new 

adversarial technique, an unforeseen circumstance or an insider threat; so it’s important to 

build the muscle memory of effective detection, containment / response, and recovery 

through continuous scenario planning, drills and exercises. 

The second would be that public / private partnerships must be sustained and improved. 

• There has been immense progress in establishing and coordinating national cyber- security 

measures from the sharing of threat intelligence to the coordination of capabilities needed 

to respond to particular events and incidents 

• However, we should recognize that threat sharing alone is not enough and it is important to 

share, in a suitably anonymized and protected way, actual incident data and the 

vulnerabilities or other factors that led to those incidents so that everyone can benefit from 

that experience 
Commission on Enhancing National Cybersecurity Panelist Statements Page 2

• Information sharing with the private sector requires in some cases the handling of classified 

material necessitating the holding of security clearances, but rather than solely increase the 

number of cleared individuals within the private sector the bias should be to declassify / 

desensitize information as much as possible so we can utilize it more readily 

• We also need improvements in international as well as cross-sector coordination. While 

cyber-security is a clear imperative for our national security we should remember that 

many of our businesses are internationally connected and exposed to multiple threats in the 

physical and digital world that extends beyond our national borders.

The third recommendation would be to harmonize rules and guidance

• There is a multiplicity of frameworks, standards and guidelines for cyber-security, many of 

which are effective and practical, but for organizations it can be difficult to decide which to 

utilize 

• We would recommend that we continue to emphasize the NIST Cyber Security Framework 

and in particular the development of associated profiles subject to appropriate certification 

schemes 

• We should further raise awareness of the need for organizations to more firmly adopt a 

strong set of baseline of controls, for example the Center for Internet Security’s Controls for 

Effective Cyber-Defense 

Fourth, we must improve capabilities amongst people, process and technology 

• There needs to be continued emphasis on the embedding of controls into all available 

technology products and services, as opposed to after the fact embedding of control late in 

the design or development cycle which is often ineffective and uneconomic : we need secure 

products not just security products 

• Similarly, we should recognize that cyber-security risk mitigation is not solely the 

responsibility of designated cyber-security professionals but is, perhaps more importantly, 

in the domain of leadership, risk managers and engineers at all levels of organizations. I 

would support a national program to embed cyber-security training into all academic and 

professional training and qualifications: we need more security-minded people not just 

more security people 

• I fully endorse all efforts to deal with the shortage of trained cyber-security professionals to 

help manage these risks, but I also note that there is a wider issue that is the productivity of 

the cyber-security professionals we already have and more needs to be done by 

Government and industry to improve tools, processes and the orchestration of defense 

across multiple platforms to get the most out of the people we have 

And the final recommendation would be to design for defensibility 

• Our goal should be to design our technology and information processing environments to 

be more inherently defendable: able to deflect, be adaptive in response to, and to continue 

operation and prove resilient in the face of attacks 

• Such defensibility includes not only currently available technology, but much active 

research and development that needs to be brought to market faster with Government help 

or other incentives 
Commission on Enhancing National Cybersecurity Panelist Statements Page 3

• Additionally much work is needed to assist organizations in transitioning from complex 

legacy environments to simpler and more defendable environments that are more 

comprehensively enclaved and less susceptible to one successful attack causing wider 

compromise; and, finally, it is worth remembering that despite the advantages of mass and 

constant interconnectedness there may be some things so critical that they should remain 

isolated under different and higher assurance of control 

Thank you again Mr. Chairman for allowing me to provide this input into this important process 

and I remain committed to assisting further as needed. I’m happy to answer any questions you or 

the other members may have at this time.
Commission on Enhancing National Cybersecurity Panelist Statements Page 4

Greg Rattray

JPMC sees providing cybersecurity as a fundamental concern for the firm and its clients. The 

firm’s overall strategic priorities include strengthening cybersecurity. In 2016, we plan to spend 

over $600 million and we have over 2000 people working on cybersecurity.

We work closely with our industry partners in organizations like the Financial Sector 

Coordinating Council and the Financial Services ISAC to enhance our defenses and collaborate in 

strengthening the financial system as a whole. We are also taking a leadership role across 

industry to examine detection, response, and recovery actions related to significant cyber induced 

disruptions to sector payment platforms.

We work closely with government partners in Treasury, DHS and FBI among others and 

participate fully in full range of public – private partnerships.

We fully participate in events like the Hamilton cyber exercise series co-sponsored by Treasury 

and the private sector to improve our ability to jointly respond to cyber events. We seek to deepen 

these activities going forward.

We find that while the government has highlighted cybersecurity as a major challenge and 

established broad programs to engage in partnership with the private sector, these programs do 

not meet the needs of firm’s like ours in terms of enhancing our cyber defense. 

We seek to build on the strong partnership we have developed and hope for a prioritized focus on 

dedicated government support capabilities to large firms like ours that have more resources and 

have already implemented robust cyber defense programs. We understand the strategic 

importance of cyber security and are fully invested in continuously improving our cyber defense 

posture. 

Our top priorities are:

1. Information Sharing – producing predictive, actionable cyber threat intelligence driven in 

part from our requirements and including access to dedicated government classified 

reporting and services on par with that offered to the Defense Industrial Base through 

organizations such as the Defense Cyber Crime Center and other sectors such as through the 

Industrial Controls Systems Computer Emergency Response Team ICS-CERT

2. Intelligence and Disruptive Operations – national-level efforts to provide intelligence and 

conduct disruptive operations against organized crime in addition to efforts against 

potential nation-state adversaries. Criminal attacks against financial services companies 

and associated utilities can have wider ranging national impacts and must be countered

3. Crisis Response and Contingency Planning – improving crisis response capabilities via 

increased investments in sector exercise programs, establishing joint crisis response 

protocols, and conducting joint contingency planning for destructive or large scale attacks. 

We believe systemically important institutions must receive dedicated support in these 

efforts.

4. Improved Protection of Core Financial Utilities and Infrastructure – improving 

cybersecurity and fraud prevention integration with core financial utilities (such as 

Fedwire) 

5. Prioritize Improvement of the Cyber Environment - Drive efforts with Internet 

infrastructure and ecosystem providers (such as email providers, ICANN and Domain 

Registrars) to reduce malicious activity and improve the environment for clients and 

customers. 
Commission on Enhancing National Cybersecurity Panelist Statements Page 5

6. Limiting financial sector stress due to a cyber event – ensuring Government resources and 

leadership attention are devoted to understanding, and addressing as applicable, potential 

impacts to public and market confidence with clear liquidity guidelines, settlement and cash 

distribution procedures, updated regulatory guidance and a communications strategy in 

cases of systemic cyber attacks on financial sector

7. Efficient access to government resources for assistance during disaster response -- expected 

to result in more effective response and recovery 

For these priorities to be effectively implemented, the US Government should make clear across 

all departments and agencies that prioritized and enhanced support to systemically important 

firms is authorized and required to protect our nation’s critical infrastructure.
Commission on Enhancing National Cybersecurity Panelist Statements Page 6

Lee Garvin

Officially stated, my personal definition, strategy and role: 

Definition of Risk Management: Risk Management is the process of actively and economically 

applying resources to identify, assess, communicate and manage the risks facing an organization, 

in order to minimize the impact of foreseen and unforeseen events 

Strategies of Risk Management: The strategies that we utilize to manage our risks include; 

transference to another party, avoidance, reduction, and accepting some or all of the 

consequences of the risk. These strategies enable the company to better understand exposures 

that could potentially cause us to miss our objectives 

The Role of Risk Management: The department will strive to align the corporate philosophy and 

day-to-day decision making. This needs to be done without adding unnecessary bureaucracy or 

inhibiting the ability of the company to make decisions and move quickly 

How I see the practical application... 

The above can seem a lot to take in. If find that simply stated, you can sum my risk management 

philosophy up with 2 words – Asset Protection. We look to protect everything that is owned, 

managed, operated and the employees that do so for the company. This is my department’s daily 

goal. Anything that comes into the conversation relates to the specific endeavor’s circumstances 

and how we are going to protect the assets. 

With each specific circumstance, we need to learn the facts of the endeavor. What is the goal? How 

are we going to achieve the goal? Who internally and externally is involved? 

All of this is usually accomplished through a combination of conversations, research, emails, 

contract reviews and applying what I like to call “the radical application of common sense”. 

Once we have identified the risk to the assets then we go about mitigating the risk. We use all of 

the tools typical to any risk manager (reduction, transfer, acceptance and avoidance). My personal 

opinion is that there is another more powerful tool at our disposal. Education, we have the ability 

to educate others in our process. For example, if we can properly educate the project leaders on 

the risks, they will likely act as an extension of my department. When this occurs, corporately we 

will have an easier time minimizing our exposures. 

Philosophically, “no - we can’t do that” should not come out of our department. If it has then we 

would have failed in our communication and education process. It is the work group’s job to make 

educated decisions we need to let them run the business. It is our job to educate them. When all 

else is done we evaluate the activities at hand and conduct the cost benefit of insuring it. 

The education extends well past the project leaders. It extends to the brokers and insurers who 

issue the policies. These are business partners that are extending a large amount of coverage for 

our premiums. I want to make sure that we are well beyond a commodity pricing exchange. My 

position is that we need to educate our brokers, and insurers, as to what our risks are. Most 

underwriters really want to create and provide solutions to their clients. It helps them provide 

value. It is incumbent on us to be open and clear so we can “help them help us”. During this 

process we will be evaluating price and coverage in an effort to close down as many holes as we 

can, provided it is for the right price. I find for the best results, these external relationships need 

to be just as much of a partnership as it is with our internal business units. 

Finally, another aspect of our department hinges on our ease of use. Our department must be 

quick and easy to work with. If my department is not easy to interact with, or delivers messages in 

a combative nature, we will have done more harm for the company than missing a “bad” 
Commission on Enhancing National Cybersecurity Panelist Statements Page 7

contractual provision. We need to be solution orientated. My largest fear is to not know what 

projects or goals we are engaging in. I’d rather take the time to work with and educate an entire 

company of “risk managers”, than create a situation where contracts are signed, and activities are 

conducted, without our review, just because we are “too difficult” to work with.
Commission on Enhancing National Cybersecurity Panelist Statements Page 8

Peter Beshar

Good morning Chairman Donilon, Vice Chairman Palmisano, and members of the Commission. I 

am Peter Beshar, the Executive Vice President and General Counsel of Marsh & McLennan 

Companies. I am grateful for the opportunity to participate in this important hearing about 

enhancing our national cybersecurity.

Marsh & McLennan operates through four market-leading brands — Marsh, Guy Carpenter, 

Mercer and Oliver Wyman. Our 60,000 employees provide advice to clients across an array of 

industries in the areas of risk, strategy and human capital. As the leading insurance broker in the 

world, Marsh has a unique perspective on the cyber insurance market.

I would like to focus my remarks this morning on three core points. First, what role can cyber 

insurance play in enhancing our nation’s cyber resilience? Second, how can big data strategies be 

utilized to assess and mitigate cyber risk? Third, what specific strategies can be deployed by the 

business community to mitigate cyber risk against critical infrastructure?

The Need for a Public-Private Partnership

As cyber attacks in both the public and private sectors have shown, neither government nor 

business can solve this problem alone. Much of the focus in the past two years has been on data 

breaches involving credit cards at large retailers and social security numbers from health care 

companies.

As events earlier this year in Ukraine and elsewhere have shown, however, we are now 

confronting a stark new reality of threats against physical assets - including electric grids, dams, 

telecommunications networks, transportation systems and civilian nuclear facilities. Ubiquitous 

connections to the Internet have increased vulnerability in the industrial systems that control 

these physical assets. As the vast majority of critical infrastructure in this country is owned and 

operated by the private sector, it is vital that government and industry lock arms in confronting 

this risk.

We need a mindset that we are all in this together and that we are engaged in a race without a 

finish line.

Why is Cyber Insurance Important?

Throughout our nation’s history, the insurance industry has played an important role in 

developing strategies to mitigate emerging risks. The underwriting process, by identifying a set of 

best practices across industries, creates important incentives that drive behavioral change in the 

marketplace.

A brief historical analogy. In 1730, a disastrous fire swept through the city of Philadelphia. 

Benjamin Franklin stepped into the fray and made it his mission to devise strategies to mitigate 

the risk posed by fire. Incredibly, Franklin introduced the first all-volunteer fire brigade and

invented both the “Franklin” stove and, of course, the lightning rod.

Franklin then took another critical step that is less widely known. He founded the first insurance 

company in the colonies - the Philadelphia Contributorship. Anyone wishing to become a

“subscriber” for insurance coverage had to embrace a specific set of best practices. An example 

was having an access point from the attic to the roof to reduce the risk of the roof catching on fire. 

For the first time, premium rates, rather than being uniform, were set relative to the risk posed by 

each property.

This combination of technological innovation and a defined set of best practices worked. Unlike 

other major cities of the era, Philadelphia did not suffer another catastrophic fire after 1730. 
Commission on Enhancing National Cybersecurity Panelist Statements Page 9

Franklin had engaged in a textbook example of what we would today call “enterprise risk 

management.”

So, what role can cyber insurance play to mitigate cyber risk? Broadly stated, there are three core 

types of cyber insurance.

The most basic coverage provides protection for out-of-pocket expenses that a company incurs 

directly in the wake of a cyber incident. Most commonly, these expenses include the cost to 

respond to a data breach, including notifying individuals, setting up call centers and providing 

credit monitoring. This may also include the cost of restoring data or paying “ransomware” 

demands that have recently plagued the healthcare industry.

Next, “business interruption” coverage protects a company if its computer network is disrupted 

for a defined period of time, typically at least 8 hours. With this coverage, a company can recover 

the actual harm it suffers in the form of lost profits or extra expenses. These first two forms of 

coverage are called first-party coverage.

The final form of coverage is for liability that could result if a third party, a client for example, is 

economically damaged as a result of the company’s breach. This is called third-party coverage.

Why Does Cyber Insurance Matter?

If all that cyber insurance did was pass the risk of harm from one party to another, that would be 

helpful as a financial matter, but not significant as a policy matter.

Fortunately, the underwriting process creates a powerful set of economic incentives that drive 

behavioral change in the marketplace. That is the potential that cyber insurance offers.

First, the act of applying for insurance prompts the policyholder to take a number of constructive 

actions. Companies typically conduct a benchmarking analysis against an established industry 

standard, whether the NIST Framework, an ISO standard like 27001 or another proprietary 

system such as Marsh’s Information Security and Privacy Self-Assessment.

The policyholder and oftentimes broker assess the company’s cyber protocols. Has the enterprise 

identified its high value assets? Has it implemented two-factor authentication for remote access 

by employees and vendors? How robust are its software patch management protocols? Does the 

company have, and has it tested, its incident response plan?

Naturally, the market will differentiate sharply among applicants depending on how the company 

approaches the people, processes and technology that affect cybersecurity. That differentiation 

comes in the form of premium dollars. Pricing pressures drive insureds to adopt best practices.

Once a policy has been placed with an insurer, further incentives are created. The insurer is now 

motivated to help its policyholders either avoid entirely or, at least mitigate, the risk of a cyber 

breach. Accordingly, insurance companies provide access to experts and a suite of services that 

include monitoring for anomalous behavior and rapid response capabilities. These services 

include technical advice from on-call consultants, vulnerability detection to examine network 

servers, and assistance developing incident response plans.

Given the barrage of cyber breaches in the headlines, these incentives are driving strong economic 

forces in the market. According to the Betterley Report, the total amount of annual gross written 

premium in the cyber market reached $2.75 billion in 2015. Experts have estimated that the 

market could grow to $10 billion in global premium by 2020.

The number of Marsh clients purchasing stand-alone cyber insurance increased by 27% in 2015 

after an increase of more than 30% in 2014. In addition, companies are purchasing higher limits. 

Coverages, which formerly were in the tens of millions, are now climbing up to $500 million for 
Commission on Enhancing National Cybersecurity Panelist Statements Page 10

companies in particularly vulnerable industries. Indeed, the average limit placed for large 

communications, media, and technology organizations is approaching $100 million.

Utilizing Big Data Strategies to Mitigate Cyber Risks

The insurance industry is data-driven. For long-standing risks, actuaries rely on decades of claim 

data to set premium rates and reserves. For emerging risks like cyber, insurers need to develop 

new approaches and techniques to guide their underwriting practices.

In a recent report entitled “Cyber Resilience in the Fourth Industrial Revolution” that Marsh & 

McLennan issued together with FireEye and Hewlett-Packard, we identified two core approaches 

that insurers are utilizing.

The first is the more common “inside-out” approach that involves hiring a forensic investigations 

firm to conduct an on-site assessment of a company’s policies, practices and potential 

vulnerabilities. Experts conduct “penetration” tests and compromise assessments to probe the 

resilience of a company’s security protocols.

An alternative and emerging strategy is an “outside-in” approach that relies on big data 

methodologies. Without stepping foot inside of a company’s offices, the cyber resilience of a 

company can be assessed by analyzing hundreds of externally available data points. For example, 

are employees accessing the Internet using an outdated web browser that is more vulnerable to 

spyware, malware and viruses? Does the company share web-hosting platforms and cloud storage 

with other companies? What information can be gleaned about a company’s IT operating systems 

from help wanted postings when a company is looking to fill a position in its IT department? Does 

any data from the company, including stolen passwords, appear in the “dark web”? How does the 

company’s ranking of employee satisfaction on Glassdoor correlate to the risk that a disaffected 

insider will compromise its data security? How strong is the motivation of a potential hacker to 

breach a particular company’s network?

None of these data points is dispositive. Utilizing algorithms to analyze hundreds of these data 

points, however, can yield important insights about the relative vulnerability of an organization in 

comparison to other firms in particular industries.

So, data is critical.

We urge the Commission to recommend that the government engage the finest minds in the tech 

community to expand the use of big data strategies. In addition, the vision articulated in the 

Cybersecurity Act of 2015 to create a real-time information sharing platform of cyber threat 

indicators needs to be made operational.

The Emerging Threat Against Critical Infrastructure

The escalation in the sophistication and potential severity of cyber threats has been stunning. 

Data breaches relating to credit cards, social security numbers and personal health records have 

proven to be only the tip of the iceberg. The emerging, and far more troubling, threat is that posed 

to our nation’s critical infrastructure.

The members of this Commission will be all too familiar with recent attacks on critical 

infrastructure including the German iron plant and the Bowman dam in New York. The attack on 

the Ukrainian power grid earlier this year represents a significant escalation in that threat. Lloyd’s 

of London conducted an important review of the potential vulnerability of the power grid in the 

US and concluded that a significant attack on the northeast grid could cause up to $1 trillion in 

damages. As a measure of comparison, the tsunami in Japan caused approximately $350 billion in 

economic damages.
Commission on Enhancing National Cybersecurity Panelist Statements Page 11

We are growing increasingly concerned about the risk that cyber presents to the operations of 

large corporations across the US and urge this Commission to make protecting our nation’s 

critical infrastructure a key priority.

Given this threat landscape, we recommend that the Commission improve national cyber 

resilience by facilitating broader use of the SAFETY Act. Adopted in the wake of the attacks on 

9/11, the SAFETY Act has played an important role in encouraging companies to develop 

innovative anti-terrorism technologies. Under the SAFETY Act, a company submits a specific 

technology, either a product or service, designed for anti-terrorism purposes to DHS. Upon finding 

that the product has the potential to be effective, DHS grants SAFETY Act protection which limits 

the legal damages that may result from a failure of the technology. This process encourages 

innovation while also shielding an organization from catastrophic liability.

Our country now confronts a growing threat of cyber terrorism. In its current form, the SAFETY 

Act can help companies manage their cyber risk. Power and water utilities, chemical plants and 

telecommunications providers can mitigate their exposure by submitting their information 

security protocols and controls for SAFETY Act approval. The SAFETY Act offers particular 

promise in the area of new technologies for network monitoring.

At present, application of the Act can only be triggered by a declaration by the Secretary of DHS 

that an act of terrorism has occurred. As there are political ramifications of any declaration of an 

act of terrorism as well as policy implications under the Terrorism Risk Insurance Act, this 

requirement might prove unduly limiting in practice. Moreover, particularly in the realm of cyber 

terrorism, the issue of attribution can be exceedingly complex. Accordingly, we recommend that 

the Commission consider mechanisms to broaden the application of the SAFETY Act where there 

is widespread damage to critical infrastructure.

If necessary, a congressional amendment to the SAFETY Act would expand application, subject to 

legislatively set thresholds, for cyber attacks that threaten material harm to the US economy or 

national security.

This type of action would likely foster greater collaboration between government and industry. 

Those industries that own and operate critical infrastructure would have a financial interest in 

collaborating with security experts on what controls are expected. In turn, government would 

have greater visibility into an arena where it relies on voluntary collaboration because regulatory 

authority is more limited.

Here again, the insurance industry could potentially play a constructive role. The SAFETY Act 

requires DHS to set the limit of liability for each applicant based on the amount of insurance 

available and the burden to purchase coverage up to that limit. Modeling and analysis performed 

within the insurance industry can help guide these determinations.

As a whole, the process could lead to companies implementing stronger controls while 

establishing greater financial certainty in the face of catastrophic risk. Both serve the ultimate goal 

of building cyber resilience in the private sector.

Conclusion

The federal government has taken a leading role in cybersecurity. The NIST Cybersecurity 

Framework in early 2014, the Cybersecurity Act of 2015 and now this Commission point to the 

Administration’s commitment to bolster our country’s cyber resilience.

Cyber insurance in particular and the insurance industry in general have the potential, in our 

judgment, to serve as important contributors to enhancing our cyber resilience.

I look forward to answering any questions you might have.
Commission on Enhancing National Cybersecurity Panelist Statements Page 12

Randal Milch

My name is Randal S. Milch. I am a Distinguished Fellow at the New York University School of Law 

Center on Law and Security and its Center for Cybersecurity. At NYU I have devoted considerable 

time to exploring the potential role of cybersecurity insurance in reducing cyber risk. I also 

previously served as Executive Vice President, Public Policy and General Counsel of Verizon 

Communications Inc., where I chaired Verizon’s Executive Security Council, the body responsible 

for information security across all Verizon entities. The views I am honored to provide you today 

are my own. 

I want to commend the Commission for investigating the role of cyber insurance as part of its 

effort to enhance national cybersecurity. Cyber insurance falls squarely within the Commission’s 

objectives and scope of work as laid out in Executive Order 13718 and reflected in the 

Commission’s Charter. A robust cyber insurance market should both “manage and reduce the 

economic impacts of cyber risk” and “improve access to the knowledge needed to make informed 

cyber risk management decisions.” 

Indeed, a well-functioning insurance market is characterized by precisely these two beneficial 

characteristics. First, insurance (including re-insurance) spreads losses arising from covered 

risks. Enabling companies to distribute the cost of business risk through insurance is a longstanding and necessary aspect of modern society. Second, the insurance underwriting process can 

help mitigate risk. As an insurer underwrites a company’s risk, it gathers and evaluates pertinent 

risk information and can provide feedback to the potential insured to help lower its risk profile. 

Companies have a pressing need to both spread and mitigate cyber risk and fulfilling these goals 

will yield a positive impact on our national economy. Yet I believe there are several barriers that 

currently impede the cyber insurance industry from meeting its potential in these areas. I hope 

the views below assist the Commission as it considers recommendations addressing the cyber 

insurance market. 

A Well-Functioning Cyber Insurance Industry Could Help Reduce Cyber Risk 

A robust cyber insurance industry could materially improve overall cybersecurity in at least two 

ways. First, cyber insurers have an incentive to provide insureds with information that will raise 

the level of basic cyber preparedness across corporate America. The yearly comprehensive 

reviews of cyber incidents – such as Verizon’s Data Breach Incident Report – consistently reveal 

that most cyber breaches capitalize on preventable lapses in basic cyber hygiene, including 

failures to patch known software defects or to implement appropriate password or other 

authentication regimes; susceptibility to phishing attacks; and insufficient least- access regimes. A 

well-functioning commercial cyber insurance industry could start and sustain a widespread and 

steady improvement in these basic cybersecurity measures through its underwriting practices. 

Second, cyber insurers are well suited to play a critical role gathering and analyzing information 

about successful cyber attacks and then disseminating useful information to companies at risk. 

Insurers have a long history of gathering large amounts of risk and loss data for the very purpose 

of lowering insureds’ risks and the potential for insurance payouts. The insurance industry could 

thus be a powerful force, in sector after sector, in the effort to identify, analyze and eliminate 

successful cyber risk vectors, including through the development of cyber standards. 

At bottom, a strong insurance industry role in cyber security comes down to incentives. The steps 

that potential corporate cyber-victims take to protect themselves are lodged in cost centers, not 

profit centers. Most businesses find it hard to establish competitive advantage by touting their 

cyber security. And while the burgeoning cyber-defense industry in many instances provides real 
Commission on Enhancing National Cybersecurity Panelist Statements Page 13

assistance through consulting or technical solutions, a defense firm’s business drops as the threat 

drops. If cyber insurance becomes the norm, however, the insurance industry’s incentives over 

the long run should be well aligned with those of the insured in reducing risk. Importantly, 

ubiquitous cyber insurance could bring these benefits to smaller businesses not likely to have 

sophisticated internal cyber teams. 

Some Current Barriers to a Well-Functioning Cyber Insurance Market 

I believe there are a number of barriers keeping the cyber insurance industry from fulfilling its 

potential to raise cybersecurity standards and reduce cyber risk. 

The first concerns the ability to access and to properly analyze pertinent information. An insurer’s 

ability to provide insurance depends critically on information, both about an individual insured’s 

cyber risk profile and about cyber risk generally. An insurer develops the parameters its 

insurance product – the range of coverage it will offer and the premiums for that coverage – based 

on as much information as it can gather about the subject risk. The more risk and loss data an 

insurer can gather and analyze, the better it can determine which risks it will cover and the price 

of that coverage. 

The insurer also needs specific information about an insured to determine as precisely as possible 

where on the risk profile that insured lands, and therefore what coverage it will offer in return for 

a specified premium. Theoretically, the better an insurer can understand the insured’s risk profile, 

the more precisely the insurer can provide correctly priced coverage. Equally, the better an 

insurer understands a company’s risk profile, the more accurately it can provide the insured 

information that might lower risk. In a well-functioning insurance market the signals also flow the 

other way, with the price of insuring against residual risk helping a company quantify that risk. 

Currently there are impediments to the sharing of important and relevant information at both of 

these levels. At the insured-specific level, insurers complain of too little time with an insured to 

gain a comprehensive understanding of the company’s risk profile. The three-way relationship 

among insured, the broker representing the insured, and one or more insurance companies 

potentially writing policies places significant time limitations on precise risk assessment. 

The pace at which the cyber threat landscape changes also limits comprehensive insured risk 

analysis. Insurance renewal efforts frequently begin 120 days before coverage lapses and may 

involve only a single meeting among insured, broker and insurers. During this time, however, new 

cyber attacks or newly prevalent attacks can dramatically change the set of inquiries an insurer 

might have. For instance, until recently a primary cybersecurity concern was point of sale attacks. 

But the recent surge in ransomware attacks has made that vulnerability a key concern for many 

companies and their advisors. Thus the mechanics of selling commercial insurance today seem 

incompatible with getting full cyber risk information about an insured. 

The other significant information challenge concerns obtaining detailed information about 

successful cyber attacks. I am not referring here to the growth of increasingly efficient 

information exchanges for cyber threat indicators, which are vital as a matter of real-time cyber 

defense. But common sense dictates that information about how a threat turns into a successful 

breach is at least as important. What defenses were deployed and failed? What systems –

hardware, software and their configuration – turned out to be particularly susceptible to a threat? 

In many instances, after-breach reports exist in the form of forensic studies commissioned by the 

victim company. Usually these reports are created at the behest of the victim’s counsel and – these 

days – with the well-founded fear that litigation or regulatory action is not far off. The forensic 

reports are thus covered by the attorney-work product privilege. Although there is a good 
Commission on Enhancing National Cybersecurity Panelist Statements Page 14

argument that sharing these reports with a company’s insurer does not necessarily waive the 

privilege, the standard advice of outside counsel is that doing so exposes the company to 

unnecessary risk. 

One response to this problem would be to lower the litigation and regulatory risk breached 

companies face. Current trends, however, are precisely the opposite. On the private litigation front 

the risk of damages increased with the decision last year in Remijas v. Neiman Marcus. Prior to 

Remijas, the prevalent view was that an individual whose private information had been stolen in a 

breach but not yet misused did not have standing to sue the breached company. In Remijas, the 

Seventh Circuit reached the opposite conclusion, finding that a fear of future use of stolen 

information provides Article III standing. On the regulatory front 2015 and 2016 have seen a 

dramatic increase in federal agency efforts to exact large fines as a way to push companies toward 

better cybersecurity. 

Another response would be to adopt privilege rules that encourage sharing the details of 

successful cyber attacks. The medical field provides an example. In response to malpractice 

concerns, hospitals and other medical providers decades ago adopted peer review reporting as a 

way to reduce medical error. Although many states passed laws to encourage this effort by 

deeming peer review reports confidential and exempt from discovery, a growing number of 

exceptions to and limitations on that privilege resulted in the (nearly unanimous) passage in 2005 

of the federal Patient Safety and Quality Improvement Act. PSQIA creates a category of privileged 

information – Patient Safety Work Product – as well as a system of third party organizations –

Patient Safety Organizations – designed to collect and analyze that protected data. A federal 

statutory privilege for after-action cyber investigations could free up valuable information to 

insurers and others that could raise the general level of cyber protection. 

Another issue inhibiting the development of a well-functioning cyber insurance industry is the 

absence of detailed standards or codes describing highly secure cyber systems. The NIST 

Framework was a great step forward in providing companies with tools to assess and increase 

their own cybersecurity, but it is by design a high-level construct. To see the importance of codes 

for a well-functioning insurance business one can look at the commercial property insurance 

business, which is structured around the existence of very detailed building and safety codes. In 

the property market the insured pays the insurer to send an engineer to covered structures, 

closely inspect them for safety and code issues and produce a report pointing out any 

improvements that should be made. Insureds welcome these reports and use them to lessen their 

risks. 

It may well be that comprehensive “cyber codes” are beyond reach given the very structure and 

ubiquity of the Internet. But efforts could be made to develop detailed best practice “codes” for 

emerging areas of activity. The Internet of Things, for instance, remains a relatively new area of 

endeavor, and could be constructed with security as a first thought, rather than an after-thought. 

Many security professionals and firms are of course already working along these lines, but there is 

no common understanding of how these “building codes for building code” will be agreed on, 

implemented and enforced, and how or whether the government should be involved in these 

efforts. 

An additional approach could be insurance-backed cyber “safety standards.” We are all familiar 

with the Insurance Institute for Highway Safety, established in 1959 by three large auto insurance 

associations, and now an independent research organization that, among other things, provides 

widely embraced vehicle safety ratings. An independent “rating” institute could be of significant 

assistance to companies, particularly in assessing risks in the parts of the cyber eco-system where 

providers often markedly limit their own liability through contract, such as with software and 
Commission on Enhancing National Cybersecurity Panelist Statements Page 15

cloud services. A cyber safety rating for these products would allow companies to gauge the risk 

associated with these foundational parts of their IT infrastructures. 

A final issue confronting the cyber insurance industry is grimmer: whether cyber risk successfully 

can be insured at all. The question arises because cyber insurance is insurance against criminal 

behavior, and properly modeling the risks associated with criminal ingenuity in cyberspace is 

potentially too complex to allow the insurance industry profitably to insure cyber risk over the 

long run. A standard response is that the insurance industry has been providing “crime” policies 

for years. But there is something very different about the risk a typical crime policy covers – the 

thieving employee, the bank robber or kidnapper – and the risk of cybercrime. The bank robber, 

for example, typically pulls off one job at time, infrequently, and is at great personal risk of getting 

caught. Cyber crime is dramatically different. Cyber criminals stalk many corporate victims at 

once, persistently and usually from a foreign country and so run only a minimal risk of 

identification, let alone capture and punishment. And the potential scale of loss in a cyber attack 

certainly puts cyber risk in an entirely different category. Thus while insurers’ sales and 

marketing departments are bullish on cyber products, it may be that the actuaries in the back 

room will eventually take a much more dismal view of this line of business. 

In conclusion, I again commend the Commission for looking into the role cyber insurance can play 

in mitigating cyber risk. Harnessing every potential source of help in this fight only makes sense 

given the current state of cyber intrusions. The insurance industry could be a powerful ally in 

spreading risk and ubiquitously improving corporate cybersecurity, and the Commission may 

deem it appropriate to make recommendations to strengthen that possibility. I hope my 

comments today are of some assistance to that end. 
Commission on Enhancing National Cybersecurity Panelist Statements Page 16

Irving Wladawsky-Berger 

The Fact Sheet accompanying the President’s Executive Order that established the Commission on 

Enhancing National Security clearly articulated the challenges we face: 

“From buying products to running businesses to finding directions to communicating with the 

people we love, an online world has fundamentally reshaped our daily lives. But just as the 

continually evolving digital age presents boundless opportunities for our economy, our 

businesses, and our people, it also presents a new generation of threats that we must adapt to 

meet. Criminals, terrorists, and countries who wish to do us harm have all realized that attacking 

us online is often easier than attacking us in person. As more and more sensitive data is stored 

online, the consequences of those attacks grow more significant each year. Identity theft is now 

the fastest growing crime in America. Our innovators and entrepreneurs have reinforced our 

global leadership and grown our economy, but with each new story of a high-profile company 

hacked or a neighbor defrauded, more Americans are left to wonder whether technology’s 

benefits could risk being outpaced by its costs.” 

“The President believes that meeting these new threats is necessary and within our grasp. But it 

requires a bold reassessment of the way we approach security in the digital age. If we’re going to 

be connected, we need to be protected. We need to join together—Government, businesses, and 

individuals—to sustain the spirit that has always made America great.” 

Arguably, nowhere is this challenge greater than in the financial industries. As the famous song 

from Cabaret succinctly puts it “Money makes the world go round” and it’s been doing so from 

time immemorial. Through the ages, money has been one of the most critical human innovations, 

facilitating transactions, trade and commerce. It’s hard to think of a human innovation that’s 

played such a central role in human affairs through the ages. 

By analyzing the earliest recorded transactions, researchers believe that writing evolved in 

ancient Mesopotamia thousands of years ago, as an innovation to keep track of financial records. 

Money was later invented as a store of value and a medium of exchange to make trade and 

commerce more efficient. One of the world’s first gold coins, now in the British Museum as part of 

its money exhibit, was produced over 2,500 years ago in Lydia, Western Turkey, whose last king, 

Croesus, was immortalized in the saying “as rich as Croesus.” For a long time, money was 

embodied in precious metals like gold and silver, but with the introduction of banknotes, - most 

likely around 1000 AD in China, - money started to decouple from physical objects with intrinsic 

value. 

Today, money is mostly intangible. Digital funds dominate the vast majority of the money supply, 

flowing over our digital networks as payments for our increasingly digital economic transactions. 

Over the past several decades, the world’s financial community has developed a very 

sophisticated global financial ecosystem, including the global payment infrastructures, the 

management of personal identities and personal financial data, the global financial flows among 

institutions and between institutions and individuals, the government regulatory regimes, and so 

on. 

Our existing financial infrastructures has served us well so far, but they’re rather complicated, 

inefficient and inflexible, and we rightfully worry that they’re not up to the scalability, security 

and privacy requirements of our 21st century digital economy, especially when you include an 

additional few billion people around the world conducting financial transactions over their 

smartphones, let alone 10s-100s billions of IoT devices of all sorts whose transactions have to be 

carefully validated given their potential impact on our health and safety.
Commission on Enhancing National Cybersecurity Panelist Statements Page 17

The financial industry has long been one of the major users of IT, - among the first to automate its 

back-end and front-office processes and to later embrace the Internet and smartphones. However, 

banking, and finance in general, has been relatively less disrupted by digital transformations than 

other industries like IT, media and retail. In particular, change has come rather slowly to the 

world’s financial infrastructure 

Transforming this highly complex global ecosystem has proved to be very difficult. It requires the 

close collaboration of its various stakeholders, including a large variety of financial institutions, 

merchants of all sizes, government regulators in just about every country, and huge numbers of 

individuals around the world. All these stakeholders must somehow be incented to work together 

in developing and embracing new payment innovations. Not surprisingly, change comes slowly to 

such a complex ecosystem. 

This was the case in the industry where I’ve worked for most of my professional career, - the IT 

industry. In the early years of the IT industry, different vendors brought to market their own 

proprietary networking systems, such as IBM’s Systems Network Architecture and Digital’s 

DECnet. These worked quite well as long as all communications were within the same company 

using the same vendor’s architecture. But, going across companies and vendors was quite 

cumbersome. Just sending an e-mail using an IBM application to another user in a different 

institution using another vendor’s application was quite cumbersome. 

The Internet changed all that. Once the Internet was widely embraced in the 1990s, it became no 

harder to send an e-mail between companies as within a company. Everyone was using the same 

standards, including open source implementations of key protocols. Rather than developing their 

own proprietary networks and struggling to interconnect with those of others, institutions now 

collaborated on developing the common Internet architecture, - and Internet based applications 

like e-mail and the Web, - that they all now used. 

Much of the success of the Internet and Web are due to the international organizations created to 

oversee their evolution, - IETF, the Internet Engineering Task Force, and W3C, the World Wide 

Web Consortium, founded in 1989 and 1994 respectively. This is also the case with Linux, which 

emerged in the 1990s as a UNIX-like operating system that over time was embraced by just about 

everyone. The collaborative governance of Linux, - overseen by the Linux Foundation, - has helped 

it succeed where similar previous efforts failed. In addition to developing standards and 

organizing promotional activities, these various organizations make available open source 

implementations of their software releases, thus encouraging collaborative, open innovation. 

Let me remind you that the Internet started out in the late 1960s as a DARPA sponsored project 

aimed at developing a robust, fault-tolerant computer network. And the Web was first developed 

by Tim Berners-Lee at CERN in the late 1980s to facilitate the sharing of information among 

researchers around the world. But, transformational innovations don’t always play out as 

originally envisioned. Once in the marketplace, they seem to acquire a life of their own. 

The blockchain first came to light around 2008 as the architecture underpinning bitcoin, the best 

known and most widely held digital currency. But, as with the Internet, the Web, and other major 

technologies, the blockchain has now transcended its original objective. 

Over the years, blockchain has developed a following of its own as a distributed data base 

architecture with the ability to handle trust-less transactions where no parties need to know nor 

trust each other for transactions to complete. Blockchain holds the promise to revolutionize the 

finance industry and other aspects of the digital economy by bringing one of the most important 

and oldest concepts, the ledger, to the Internet age. 

Ledgers constitute a permanent record of all the economic transactions an institution handles, 
Commission on Enhancing National Cybersecurity Panelist Statements Page 18

whether it’s a bank managing deposits, loans and payments; a brokerage house keeping track of 

stocks and bonds; or a government office recording births and deaths, the ownership and sale of 

land and houses, or legal identity documents like passports and diver licenses. Over the years, 

institutions have automated their original paper-based ledgers with sophisticated IT applications 

and data bases. 

But while most ledgers are now digital, their underlying structure has not changed. Each 

institution continues to own and manage its own ledger, synchronizing its records with those of 

other institutions as appropriate, - a cumbersome process that often takes days. 

A 2014 report by the Bank of England argues that the time might well have now come for the 

ledger to now follow the collaborative, distributed, standards-based approach of those earlier 

innovations. The classic ledger, - “a process that has not changed since the 16th century,” - may 

now be evolving toward a blockchain-based distributed ledger, a major technological innovation 

not only for payment systems but for the finance industry as a whole. 

Sometimes, the emergence of an innovative disruptive technology can help propel change 

forward. The Internet proved to be such a catalyst in the transformation of global supply chain 

ecosystems. Could blockchain technologies now become the needed catalyst for the evolution of 

the global financial ecosystems? Could it prove to be a kind of Next Big Thing? 

Much, much work remains to be done. Blockchain is still at the bleeding edge, lacking the 

robustness of legacy payment systems. Distributed ledger systems have only been around for less 

than a decade, and are thus quite immature compared to the existing, decades-old financial 

infrastructures. The evolution of our complex, global financial infrastructures will be a tough and 

lengthy undertaking, no matter how innovative and exciting the new technologies might be. 

It’s too early to know if the blockchain will join the pantheon of Next Big Things and become a 

major transformational innovation. As we’ve seen with other such successful innovations, - e.g., 

the Internet, the Web, Linux, - collaborations between universities, research labs, companies and 

government agencies are absolutely essential. So are close collaborations among technology 

developers and users in order to get the architecture right, agree on open standards, develop open 

source platforms and set up governance processes embraced by all. 

In a short number of years, blockchain technologies have made a lot of progress. It will be 

fascinating to see how it all plays out in the years to come.
Commission on Enhancing National Cybersecurity Panelist Statements Page 19

Alex Pentland

Today’s “data ecology” is transforming due to the exponential growth of mobile and ubiquitous 

computing, together with big data analysis. These shifts are having a dramatic impact on people’s 

personal data sharing awareness, sensitivities and on their cybersecurity. Recently have reached 

critical mass in privacy concerns and awareness on the use of personal data, partially due to 

media exposure of cybersecurity breaches and intelligence scandals. The surge of mobile 

transactions, micropayments, and connected sensors in both private and public spaces is expected 

to further exacerbate this tension. 

We need a “new deal on data” where security concerns are matched with transparency, control 

and privacy, and are designed into the core of any data-driven service [1]. In order to 

demonstrate that such a sustainable data ecology is possible we have developed Enigma, a 

decentralized computation platform enabling different parties to jointly store and run 

computations on data while keeping the data completely private [2]. Enigma enables a 

sustainable data ecology by supporting the requirements that data be always encrypted, with 

computation happening on encrypted data only, by allowing owners of the data to control access 

to their data precisely, absolutely, and auditably, and by reliably enabling payment to data owners 

for use of their data. 

From the user’s perspective, Enigma is a cloud that ensures both privacy and integrity of their

data. The system also allows any type of computation to be outsourced to the cloud while

guaranteeing the privacy of the underlying data and the correctness of the result. A core feature in 

the system is that it allows the data owners to define and control who can query it, thus ensuring 

that the approved parties only learn the output. Moreover, no other data leaks in the process to 

any other party.

The Enigma cloud itself is comprised of a network of computers that store and execute queries.

Using secure multi-party computation (sMPC or MPC), each computer only sees random pieces of 

the data, a fact that prevents information leaks. Furthermore, queries carry a micro-payment for 

the computing resources as well as to those users whose data is queried, thus providing the

foundation for the rise of a sustainable, secure data market.

To illustrate how the Enigma platform works, consider the following example: a group of data 

analysts of an insurance company wishes to test a model that leverages people’s mobile phone 

data. Instead of sharing their raw data with the data analysts in the insurance company, the users 

can securely store their data in Enigma, and only provide the data analysts with a permission to 

execute their study. The data analysts are thus able to execute their code and obtain the results, 

but nothing else. In the process, the users are compensated for having given access to their data 

and the computers in the network are paid for their computing resources.

Three types of entities are defined in Enigma, and each can play multiple roles (see Figure 1).

Owners are those sharing their data into the system and controlling who can query it; services, if

approved, can query the data without learning anything else beyond the answer to their query;

and parties (or computing parties) are the nodes that provide computational and storage

resources, but only ever see encrypted or random bits of information. In addition, all entities are

connected to a blockchain as described below.
Commission on Enhancing National Cybersecurity Panelist Statements Page 20

Figure 1. Overview of Enigma’s decentralized platform.

When owners share data, the data is split into several random pieces called shares. Shares are

created in a process of secret-sharing18 and perfectly hide the underlying data while maintaining

some necessary properties allowing them to later be queried in this masked form. Since users in

Enigma are owners of their data, we use the blockchain as a decentralized secure database that is 

not owned by any party. This also allows an owner to designate which services can access its 

data and under what conditions, and so parties can query the blockchain and ensure that it holds 

the appropriate permissions. In addition to being a secure and distributed public database, the 

blockchain is also used to facilitate payments from services to computing parties and owners, 

while enforcing correct permissions and verifying that queries execute correctly. 

In summary, a sustainable data ecology requires that data be always encrypted, and that 

computation happen on encrypted data only. It also requires that owners of the data control 

access to their data and use of their data precisely, absolutely, and auditably. Finally, it requires 

that data owners are reliably paid for use of their data. Enigma accomplishes these requirements, 

providing an existence proof that a sustainable, secure data ecology is possible. The major 

question about this ecology is one of policy: what the trade-off between user security and access 

by law enforcement and intelligence services? In the current Enigma system this trade-off is 

handled by leaving metadata encrypted but visible. Other trade-offs are possible, including full 

anonymization or building in the ability for court-ordered investigators to penetrate anonymity 

though zero-knowledge proofs (which Is different than back-door approaches). 

For additional information see http://trust.mit.edu

[1] Pentland, A. Reality mining of mobile communications: Toward a new deal on data. World

Economic Forum Global IT Report 2008, Chapter 1.6, (2008), 75-80.

[2] Zyskind, G., Nathan, O., and Pentland, A. (2015). Decentralizing privacy: Using blockchain to 

protect personal data. In Proceedings of IEEE Symposium on Security and Privacy Workshops, 

180-184.
Commission on Enhancing National Cybersecurity Panelist Statements Page 21

Jerry Cuomo

Eighty years ago, IBM helped the United States government create the Social Security system, 

which, at the time, was the most complex financial system ever developed. Today, as financial 

transactions become increasingly digital and networked, government and industry must once 

again combine forces to make the financial systems of the future more efficient, effective and 

secure than those of the past.

And, just as an individual’s Social Security number became the key to proving identity and 

accessing that system for generations of Americans, today’s institutions must collaborate to create 

new methods for establishing identity and managing other aspects of digital transactions.

At IBM, we believe that blockchain technology is becoming an essential tool as business and 

society navigate this shift--with the potential for transforming commerce and the interactions 

between governments and individuals. Blockchain has inherent qualities that provide trust and 

security, but, to fulfill its promise, the core technology must be further developed using an open 

source governance model to make it deployable on a grand scale. 

There’s a critical role for government here—both to enhance national competitiveness and 

national security. The federal government must invest in scientific research to accelerate 

progress. The National Institute of Standards and Technology can help shape standards for 

interoperability, privacy and security. And government agencies can become early adopters of 

blockchain applications. In addition, government has a key role to play in certifying the identities 

of participants in blockchain-based systems. 

Blockchain came to prominence because it’s the core technology underlying the infamous Bitcoin 

cryptocurrency, but, while Bitcoin is an anonymous network, industries and government agencies 

are exploring the use of blockchain in networks where the participants are known. We call this a 

“permissioned blockchain.”

Here’s how it works: A blockchain is a distributed ledger shared via a peer-to-peer network that 

maintains an ever-expanding list of data records. Each participant has an exact copy of the 

ledger’s data, and additions to the chain are propagated throughout the network. Therefore, all 

participants in an interaction have an up-to-date ledger that reflects the most recent transactions. 

Once a transaction is entered in the ledger it can’t be changed. Cryptography and digital 

signatures are used to prove identity, authenticity and enforce access to the shared ledger. 

Blockchain makes applications fast, efficient and inherently secure.

IBM is playing a central role in the development of a permissioned blockchain. We’re a founding 

member of the Linux Foundation’s open-source HyperLedger Project, where we’re helping to 

build the foundational elements of business-ready blockchain architecture; with a focus on 

privacy, confidentiality and auditability. We have joined consortia that are developing industryspecific blockchain implementations. And we’re pioneering the use of blockchain in our own 

operations.

Blockchain has tremendous potential to help transform business and society, but it’s so strikingly 

different from what people are used to that many business and government leaders are adopting a 

wait-and-see attitude. We applaud judicious caution, but, at the same time, we believe that 

organizations and institutions that don’t quickly assess the potential of blockchain and begin 

experimenting with it risk falling behind as the world undergoes what we see as a tectonic shift. 

There are four areas where we believe government, technology companies and industries should 

work together to advance blockchain to enhance national security:

Proof of Identity. The Social Security number has been a mainstay of our society for decades, but 
Commission on Enhancing National Cybersecurity Panelist Statements Page 22

it’s not secure and certifiable enough to serve as the building block of identity in a blockchain 

ecosystem. So we believe a new identity management system must be created. For guidance, we 

might study the Unique Identification Authority of India, which is in the process of issuing 12-digit 

identity numbers to all 1.2 billion Indian residents. An individual’s “Aadhaar” number is linked to 

biometric and demographic information and can be used for everything from setting up a bank 

account to accessing government services. 

Data provenance: To make organizations and individuals comfortable exposing their data through 

the use of blockchain applications, the systems must automatically track every change that is made 

to data, so it’s auditable and completely trustworthy. Just as an identity-management system 

certifies individuals and organizations that participate in a blockchain, the data provenance 

mechanism provides a fingerprint for the data itself—complete with time stamps and annotations. 

A participant can rest assured that what they see is accurate, up to date, and untampered with. The 

same goes for government regulators or law enforcement.

Secure transaction processing: While the parties in a transaction managed using blockchain are 

known to other participants in the system, the actual details of the transaction should be visible 

only to those involved (or others who are granted permission). So we have to enable the entities 

that monitor blockchain transactions to verify that contracts are being fulfilled but without 

revealing confidential information to them. This will require the use of techniques that fall under 

the heading of multi-party computation. One of the most intriguing of them, called full 

homomorphic encryption, makes it possible to verify information without having to de-encrypt it—

which would leave it vulnerable to tampering, theft or prying eyes. The technique is still several 

years from being practical, but it’s on the way.

Sharing intelligence. Amid a rising tide of cyber-crime and fears of cyber-terrorism, the White 

Hats of the world are under pressure to change the game. Blockchain has the potential to do just 

that. Not only is it inherently more secure than other types of networks and financial management 

systems, but blockchain has the potential to be used by multiple parties to share cyber-threat 

intelligence. Today, for fear of being exposed, many financial services firms are reluctant to share 

information about cyber-attacks. However, with blockchain, they could confidentially share 

information in real time that, when combined with data from other companies, could be used to 

spot patterns and quickly develop countermeasures.

While government should not seek to control these new financial systems, it has an important role 

to play in helping them to take off and in safeguarding them. Think of this as a new social compact, 

where business, with input from government, architects the future of financial services. At IBM, we 

look forward to working with our partners in government, industry and academia to get this done.
Commission on Enhancing National Cybersecurity Panelist Statements Page 23

Greg Baxter

The global finance system is a critical infrastructure built on trust, and integral to the effective and 

progressive functioning of society. A structural breach of that trust would have severe economic 

and social implications. As a bank, our highest priority is to maintain that trust: by protecting our 

client’s assets, both money and data, and by protecting the integrity of the global financial system. 

In an increasingly digital and global world, the ways in which we serve and protect our clients is 

changing significantly, but the underlying need for trust and integrity remains absolute.

The digital revolution is transforming financial services. With it, comes significant opportunities to 

provide access to financial tools and products that can facilitate individual and collective progress 

and prosperity. Our research with Imperial College London concluded that a 10% increase in the 

use of digital money, that is electronic transfer of fiat currency rather than paper based, can lead to 

220 million people coming into the formal financial sector globally, resulting in $1TN in new flows 

for the formal economy, $100BN in increased tax collections, and significant efficiency and security 

benefits for all stakeholders. However, the migration to digital also brings new, sophisticated and 

rapidly growing cyber risks.

The migration of financial services to digital is well underway. The vast majority of corporate 

banking flows are already digital, and, with the significant efforts of the Fintech industry, the 

digitization of many consumer flows is gaining momentum. Investments in financial technology 

have grown exponentially, rising from $1.8 billion in 2010 to $19 billion in 2015 — with over 70% 

of this investment focusing on the "last mile" of user experience in the consumer space. The US 

leads this investment, followed by China, the UK and Sweden. Most of the focus has been on 

payments and lending. While the U.S. and Europe are still at an early stage of disruption, China is 

already past the tipping point and we see India as the next big disruption opportunity. We project 

that for North America, retail banking disruption will grow from 1% of industry revenues today, to 

affect ~10% of revenues by 2020 and ~17% by 2023. While most investment has focused on 

improving the client experience, without changing the underlying financial product or platform, we 

are now starting to see more innovation occurring in the core product and underlying financial 

“rails”.

As innovation changes experiences, journeys, products and platforms, there is a shift in financial 

services from vertical products to horizontal services, integrated into open, digital ecosystems. 

While banks may have traditionally operated and protected “core” platforms and saw “edge” 

devices as channels, with distinct cybersecurity implications, the new reality is a much broader 

ecosystem with many more points for digital access and cyber threats.

To protect people and their assets requires new ways of identifying and authenticating customers 

and devices, new approaches to managing and using payment credentials and more sophisticated 

monitoring capabilities.

Advances in biometric technologies, emerging behavioral analytics and adaptive techniques that 

merge these new capabilities are promising in terms of increasing authentication without 

substantially deteriorating client experience.

Tokenization of payment credentials, so we no longer store or transmit static payment details, but 

instead create dynamic, single use payment tokens, bound by time, location and value should 

radically reduce the risk of stolen credentials. It should also eliminate the need to store payment 

details in the rapidly growing number of places and things where payments are made.
Commission on Enhancing National Cybersecurity Panelist Statements Page 24

Static tokenization is already being deployed in new mobile payment products, and marks an 

important first step. Importantly, in a world where privacy and security are often argued to be 

incompatible, tokenization is a great example of a technology that enhances both security and 

privacy.

While the proliferation of payment nodes creates additional points of vulnerability, it also creates 

millions of information points. Every node in the network needs to become an intelligent node 

and be aware of up-stream and down-stream threats in a heterogeneous digital ecosystem. The 

use of big-data along with advanced analytics provides the potential to collect this data across the 

entire network and to respond in real time to new threats. Security becomes a collective 

responsibility, inclusive of every node on the network, inclusive of every player in an ecosystem. 

In a more open and inclusive ecosystem, collaboration and collective accountability will be critical 

to solving cyber issues. There can be no free riders.

Beyond protecting the assets and transactions of clients, there is a more systemic threat that we 

need to tackle. An attack on the national or global payments system represents a far greater threat 

to the economy and society. Sophisticated actors who do not want to steal assets, but to attack 

companies or destroy the underlying system. Defending against such a broad and sophisticated 

set of actors, with significantly different objectives and incentives, requires an extremely 

sophisticated defensive capability, and one where many businesses will be ill- equipped to 

respond.

There are three areas where the Government may be able to provide additional support to the 

private sector:

1. Intelligence sharing – increasing the speed and quality of two-way information flows, 

which is essential for developing an intelligence led approach to cyber protection, and 

mounting a holistic defense

2. Research and development – We need to dramatically increase the speed and scale of 

cyber innovation in both the private and public sector. This will require increased 

investments in research and development, which may require increased financial incentives 

and capability support.

3. Workforce development – One of the most critical issues facing corporations is a shortage 

of cyber trained personnel. We need to increase and maintain the available workforce, 

which may require greater educational capacity and incentives.

While not included in the above list, the potential role of the Government to provide a pro-active 

defense for critical companies that come under cyber attack should also be evaluated. We may 

need to look to real-time threat intelligence and response across public, private and governmental 

agencies accompanied by a legal framework required to implement such programs. And given the 

global nature of the internet, and the borderless nature of cyberspace, our solutions and 

partnerships need to stretch beyond the USA.

In a world of exponential technological change, we need a commensurate commitment and 

investment to stay ahead of the security frontier. New threats will emerge, some we can already 

imagine, such as the impact of quantum computing on current cryptographic algorithms, and 

some we cannot. Solving these will require coordinated cyber resilience undertaken as a 

public/private partnership in coordination with governments, to build national, institutional and 

individual capabilities.