[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]
COMPUTER SECURITY: ARE WE PREPARED FOR CYBERWAR?
=======================================================================
HEARING
before the
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
INFORMATION, AND TECHNOLOGY
of the
COMMITTEE ON
GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
MARCH 9, 2000
__________
Serial No. 106-160
__________
Printed for the use of the Committee on Government Reform
Available via the World Wide Web: http://www.gpo.gov/congress/house
http://www.house.gov/reform
______
U.S. GOVERNMENT PRINTING OFFICE
67-018 CC WASHINGTON : 2000
COMMITTEE ON GOVERNMENT REFORM
DAN BURTON, Indiana, Chairman
BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
CONSTANCE A. MORELLA, Maryland TOM LANTOS, California
CHRISTOPHER SHAYS, Connecticut ROBERT E. WISE, Jr., West Virginia
ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York
JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York
STEPHEN HORN, California PAUL E. KANJORSKI, Pennsylvania
JOHN L. MICA, Florida PATSY T. MINK, Hawaii
THOMAS M. DAVIS, Virginia CAROLYN B. MALONEY, New York
DAVID M. McINTOSH, Indiana ELEANOR HOLMES NORTON, Washington,
MARK E. SOUDER, Indiana DC
JOE SCARBOROUGH, Florida CHAKA FATTAH, Pennsylvania
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
MARSHALL ``MARK'' SANFORD, South DENNIS J. KUCINICH, Ohio
Carolina ROD R. BLAGOJEVICH, Illinois
BOB BARR, Georgia DANNY K. DAVIS, Illinois
DAN MILLER, Florida JOHN F. TIERNEY, Massachusetts
ASA HUTCHINSON, Arkansas JIM TURNER, Texas
LEE TERRY, Nebraska THOMAS H. ALLEN, Maine
JUDY BIGGERT, Illinois HAROLD E. FORD, Jr., Tennessee
GREG WALDEN, Oregon JANICE D. SCHAKOWSKY, Illinois
DOUG OSE, California ------
PAUL RYAN, Wisconsin BERNARD SANDERS, Vermont
HELEN CHENOWETH-HAGE, Idaho (Independent)
DAVID VITTER, Louisiana
Kevin Binger, Staff Director
Daniel R. Moll, Deputy Staff Director
David A. Kass, Deputy Counsel and Parliamentarian
Lisa Smith Arafune, Chief Clerk
Phil Schiliro, Minority Staff Director
------
Subcommittee on Government Management, Information, and Technology
STEPHEN HORN, California, Chairman
JUDY BIGGERT, Illinois JIM TURNER, Texas
THOMAS M. DAVIS, Virginia PAUL E. KANJORSKI, Pennsylvania
GREG WALDEN, Oregon MAJOR R. OWENS, New York
DOUG OSE, California PATSY T. MINK, Hawaii
PAUL RYAN, Wisconsin CAROLYN B. MALONEY, New York
Ex Officio
DAN BURTON, Indiana HENRY A. WAXMAN, California
J. Russell George, Staff Director and Chief Counsel
Bonnie Heald, Director of Communications
Bryan Sisk, Clerk
Trey Henderson, Minority Professional Staff Member
C O N T E N T S
----------
Page
Hearing held on March 9, 2000.................................... 1
Statement of:
Gerretson, Jim, director of operations, Information
Assurance, ACS Defense, Inc.; Mark Rasch, senior vice
president and legal counsel, Global Integrity Corp.; and
James Adams, chief executive officer, iDEFENSE............. 161
Tritak, John, Director, Critical Infrastructure Assurance
Office, Department of Commerce; John Gilligan, Chief
Information Officer, Department of Energy, and co-chair,
Security, Privacy, and Critical Infrastructure Committee,
CIO Council; Karen Brown, Deputy Director, National
Institute of Standards and Technology, Department of
Commerce; and Rich Pethia, director, Computer Emergency
Response Team Coordination Centers, Software Engineering
Institute, Carnegie Mellon University...................... 5
Letters, statements, et cetera, submitted for the record by:
Adams, James, chief executive officer, iDEFENSE, prepared
statement of............................................... 186
Biggert, Hon. Judy, a Representative in Congress from the
State of Illinois, chart on computer security management
key players................................................ 196
Brown, Karen, Deputy Director, National Institute of
Standards and Technology, Department of Commerce, prepared
statement of............................................... 38
Gerretson, Jim, director of operations, Information
Assurance, ACS Defense, Inc., prepared statement of........ 165
Gilligan, John, Chief Information Officer, Department of
Energy, and co-chair, Security, Privacy, and Critical
Infrastructure Committee, CIO Council:
Information concerning initiatives and activities........ 22
Prepared statement of.................................... 26
Horn, Hon. Stephen, a Representative in Congress from the
State of California:
Followup questions and responses......................... 159
Prepared statement of.................................... 3
Pethia, Rich, director, Computer Emergency Response Team
Coordination Centers, Software Engineering Institute,
Carnegie Mellon University, prepared statement of.......... 46
Rasch, Mark, senior vice president and legal counsel, Global
Integrity Corp., prepared statement of..................... 173
Tritak, John, Director, Critical Infrastructure Assurance
Office, Department of Commerce, prepared statement of...... 9
Turner, Hon. Jim, a Representative in Congress from the State
of Texas, prepared statement of............................ 152
COMPUTER SECURITY: ARE WE PREPARED FOR CYBERWAR?
----------
THURSDAY, MARCH 9, 2000
House of Representatives,
Subcommittee on Government Management, Information,
and Technology,
Committee on Government Reform,
Washington, DC.
The subcommittee met, pursuant to notice, at 10 a.m., in
room 2247, Rayburn House Office Building, Steve Horn (chairman
of the subcommittee) presiding.
Present: Representatives Biggert, Walden, and Turner.
Staff present: J. Russell George, staff director and chief
clerk; Matt Ryan, senior policy administrator; Bonnie Heald,
director of communications; Bryan Sisk, clerk; Ryan McKee,
staff assistant; Trey Henderson, minority professional staff
member; and Jean Gosa, minority staff assistant.
Mr. Horn. The hearing of the House Subcommittee on
Government Management, Information, and Technology will come to
order. Earlier this year, the Nation successfully met its first
technological challenge of the new millennium, Y2K. Although
the time, labor, and $100 billion cost for this effort, private
and public, we learned much from this experience. Those lessons
will be especially important now as we turn to the second
technological challenge of the new year, computer security.
We are here today to learn. In April 1996, this
subcommittee held a similar information hearing on the year
2000 computer problem. Our questions will be many of the same
questions we asked in that hearing 4 years ago. We want to know
the dimension and scope of these cyber attacks. We want to know
what efforts are being undertaken toward solving the problem,
and we want to know what the Federal Government is doing to
address this problem.
Since the early 1990's, the worldwide use of computers and
computer networks has skyrocketed. The Internet has
revolutionized the way governments, nations, and individuals
communicate, and the way to conduct business. The Internet and
electronic mail are now available 24 hours a day to anyone with
a desktop computer, a modem, and a telephone line. Yet, without
rigorous efforts to protect the sensitive information contained
in these computer systems, many of the Nation's essential
services, telecommunications, power distribution, national
defense, and so on down the line are vulnerable to cyber
attacks.
Over the last few weeks, several of the Nation's most
viable Internet websites have fallen prey to ``denial-of-
service computer attacks.'' Although these attacks disrupt
essential business services, they only scratch the surface of
cyber attacks that may be taking place in other highly
integrated computer networks.
Our first panel of witnesses today will discuss the
vulnerability of the Nation's vital computer systems and the
Government's efforts to protect them. Our second panel, from
the private sector, will demonstrate how easy it is to invade
or hack a computer system, and what organizations can do to
protect these systems. We welcome each of you and we look
forward to your testimony.
If you will stand and raise your right hands, we will swear
you in.
[Witnesses sworn.]
Mr. Horn. The clerk will note that all four witnesses
affirmed the oath. We will start with Mr. Tritak, Director of
Critical Infrastructure Assurance Office, Department of
Commerce. Mr. Tritak. I might say, the way we work here, once I
announce you, your full statement is automatically put in the
record.
The staff has read it and when we have had a chance, we
read it. We then want you, if you could, to summarize it in 5
minutes. Do not read it, whatever you do, but give us from your
heart what this problem is. That is what we are interested.
When you are all done, we will then have questions, 5 minutes
on each side when those Members come here. We will try to get a
rounding out of what the testimony is.
So, Mr. Tritak, you are first.
[The prepared statement of Hon. Stephen Horn follows:]
[GRAPHIC] [TIFF OMITTED] T7018.001
[GRAPHIC] [TIFF OMITTED] T7018.002
STATEMENT OF JOHN TRITAK, DIRECTOR, CRITICAL INFRASTRUCTURE
ASSURANCE OFFICE, DEPARTMENT OF COMMERCE; JOHN GILLIGAN, CHIEF
INFORMATION OFFICER, DEPARTMENT OF ENERGY, AND CO-CHAIR,
SECURITY, PRIVACY, AND CRITICAL INFRASTRUCTURE COMMITTEE, CIO
COUNCIL; KAREN BROWN, DEPUTY DIRECTOR, NATIONAL INSTITUTE OF
STANDARDS AND TECHNOLOGY, DEPARTMENT OF COMMERCE; AND RICH
PETHIA, DIRECTOR, COMPUTER EMERGENCY RESPONSE TEAM COORDINATION
CENTERS, SOFTWARE ENGINEERING INSTITUTE, CARNEGIE MELLON
UNIVERSITY
Mr. Tritak. Thank you very much, Mr. Chairman.
I am grateful for this opportunity to appear before you
today to begin a dialog with you and your committee on the
issues relating to critical infrastructure assurance and
computer security. In the way of talking about infrastructure,
one of them I want to mention is that my slides just showed up.
If you do not mind, I would like to just put them up before
you.
Mr. Horn. Sure. Keep talking. They can put them up.
Mr. Tritak. In any event, Mr. Chairman, Americans have long
depended on delivery of essential services over the Nation's
critical infrastructures. The need to assure the delivery of
these services against significant disruptions has been a
concern of infrastructures, owners, and operators for as long
as there have been electric power plants, telecommunications
systems, airlines, railroads, banking, and financial services.
In other words, critical infrastructure assurance itself is not
new.
What is new is the increasing reliance on information
technology and computer networks to operate those
infrastructures. This growing reliance introduces new
complexities, interdependencies, and potentially
vulnerabilities. The threat that individuals, groups, and
nation states are seeking to identify and exploit these
vulnerabilities is real and growing.
[Chart shown.]
Mr. Tritak. In recognition of this, President Clinton
issued PDD-63 establishing the protection of the Nation's
infrastructures as a national security priority. As you can see
from the chart, Mr. Chairman, PDD-63 sets forth an ambitious
goal. It calls for a national capability by 2003 to protect our
critical infrastructure from intentional attacks that could
significantly diminish the Federal Government's ability to
perform essential national security missions and to ensure
general public health and safety, State and local government's
ability to maintain order, and to deliver minimal essential
services to the public.
Three, the private sector's ability to ensure the orderly
functioning of the economy and the delivery of essential
telecommunications, energy, financial, and transportation
services. The important conclusion of PDD-63 is that critical
infrastructure assurance is a shared responsibility. With 90
percent of the Nation's infrastructures being privately owned
and operated, the Federal Government alone cannot guarantee its
protection.
In response to the issuance of PDD-63, the Federal
Government had to organize itself in order to meet the
challenges posed by this unique national security challenge. A
national coordinator for security, infrastructure protection,
and counter-terrorism was created to oversee national policy
development and implementation, as well as to advise the
President and national security advisor on the same.
My Office of Critical Infrastructure Assurance Office was
created to coordinate policy development for the national plan,
to assist agencies in analyzing their critical infrastructure
dependencies, and to coordinate national education and
awareness efforts. The National Infrastructure Protection
Center was created at the FBI to serve as a threat assessment
center, focusing on threat warnings, vulnerabilities, and law
enforcement.
For each infrastructure sector that could be a target for
infrastructure cyber or physical attacks, a single government
department or agency was established as a lead agency for
working directly with representatives from private industry.
[Chart shown.]
Mr. Tritak. Earlier this year, President Clinton issued the
first version of the national plan. Displayed before you is the
cover. It says a lot about what the plan is and is not. First,
the plan focuses on the cyber dimensions for securing critical
infrastructures and underscore the new challenges posed by the
information age. That is not to say that physical
infrastructure protection is no longer important. It is.
Future versions of the plan will reflect that importance.
In fact, the plan is designated 1.0 and subtitled, An
Invitation to a Dialogue For a Good Reason. It is very much a
work in progress. It concentrates on the Federal Government's
efforts in infrastructure protection. The plan acknowledges
that this is not enough. We must work closely with industry and
include them in the national planning process.
We must also deal with the fact that there is an
international dimension to national information assurance, as
well as a domestic one. Of course, we must work closely with
you in the Congress to ensure that your concerns, ideas, and
interests are reflected in subsequent versions of the plan.
[Chart shown.]
Mr. Tritak. To meet the goal of PDD-63, the national plan
establishes 10 programs for achieving three broad objectives.
First, steps must be taken to identify the key elements and
systems that constitute our critical infrastructures. Their
vulnerability to attack must be assessed and plans must be
developed to address those vulnerabilities.
In so preparing, we hope to prevent attacks from reaching
their target in the first place. Next, should such attacks
occur, we must develop a means to identify, assess, and warn
about them in a timely manner. The attacks must then be
contained. Disrupted services must be restored and affected
systems must be reconstituted.
Finally, we must lay a strong foundation upon which to
create and support the Nation's commitment to achieving the
first two objectives. These include coordinated research and
development, training, and employing information security
experts, raising awareness, and, where appropriate, identify
potential legal or legislative reforms.
[Chart shown.]
Mr. Tritak. The President requested $2 billion for critical
infrastructure protection in his fiscal year 2001 budget
request. This represents a 15 percent increase over fiscal year
2000 funding. Of this, 85 percent supports protection of agency
infrastructures; 72 percent goes to supporting critical
infrastructure efforts within the national security agencies.
Our President proposes a number of key initiatives in his
budget request. I will just highlight a few. The Federal Cyber
Service Initiative seeks to redress the shortage of information
security expertise in the Federal Government. This shortfall
reflects the scarcity of college-level programs in information
security. It also reflects the inability of the Government to
compete for highly skilled workers in this area.
Our goal is to recruit, train, and retain a cadre of IT
specialists for Federal service. The Federal Intrusion
Detection Network will serve as a centralized burglar alarm
system for critical computer systems within civilian government
agencies. Intrusion Detection Systems will be installed and
operated by the civilian agencies. Alarm data indicating
anomalous computer activity will be sent through the agency, by
the agency to the GSA for further analysis.
Only if there is evidence of criminal behavior will data be
sent to the NIPC and law enforcement. FIDNet will not monitor
any private network traffic. It will comply with all existing
privacy laws. The Partnership for Critical Infrastructure
Security attempts to build on the efforts already underway
between government and industry.
It seeks to bring the individual sectors together to
encourage a cross-sectoral dialog as a common concern, such as
the growing interdependencies among the infrastructure owners
and operators. The Partnership also provides a form for
infrastructure owners and operators to engage other interested
stakeholders, including the audit community, insurance
community, Wall Street, and the investment community, and of
course mainstream businesses who are the ultimate consumers of
infrastructure services.
Now, the partnership is dedicated to the belief that once
industry recognizes a business case for action, economic self-
interest in the market can go a long way toward addressing the
challenges of infrastructure assurance. That is not to say that
self-interest in the market alone can solve these problems,
because they cannot. Where they cannot, and what national
security interests of their country requires, the Federal
Government must step in to address any gaps and vulnerabilities
that may exist.
Last month, over 200 representatives of more than 120
companies began to organize their participation in this
Partnership. I think the Partnership represents a good step in
not only addressing issues of common concern, but also for
industry to take a lead in addressing the problems that
confront us today. When you have good partnership between
industry and government, we are better able to identify and
define our respective roles so that where there
are gaps, where the market cannot address a problem of concern
to the Nation, we can fill that gap.
Given the limited time, Mr. Chairman, I am going to
conclude my remarks here and I look forward to your questions.
[The prepared statement of Mr. Tritak follows:]
[GRAPHIC] [TIFF OMITTED] T7018.003
[GRAPHIC] [TIFF OMITTED] T7018.004
[GRAPHIC] [TIFF OMITTED] T7018.005
[GRAPHIC] [TIFF OMITTED] T7018.006
[GRAPHIC] [TIFF OMITTED] T7018.007
[GRAPHIC] [TIFF OMITTED] T7018.008
[GRAPHIC] [TIFF OMITTED] T7018.009
[GRAPHIC] [TIFF OMITTED] T7018.010
[GRAPHIC] [TIFF OMITTED] T7018.011
[GRAPHIC] [TIFF OMITTED] T7018.012
[GRAPHIC] [TIFF OMITTED] T7018.013
Mr. Horn. Thank you very much. I would appreciate it at
this point in the record if you would submit the national plan
for the record. So, without objection, it will be put right
after this point.
We now go the next gentleman who is very familiar to this
committee. You are doing a fine job. Mr. John Gilligan, Chief
Information Officer, Department of Energy, and Co-Chair,
Security, Privacy, and Critical Infrastructure Committee of the
Chief Information Officer Council. Mr. Gilligan.
Mr. Gilligan. Thank you, Chairman Horn.
As you noted, I come before the committee speaking in both
my role as Chief Information Officer of the Department of
Energy and as well the Co-Chair of the Federal CIO Council
Security, Privacy, and Critical Infrastructure Committee. As I
prepared for this testimony, I gave a lot of thought to what I
viewed were the two critical issues that I face as a Federal
CIO. I would like to spend a moment addressing these issues for
you.
Up-front, let me tell you that my biggest issues are not
technology challenges. The primary challenge is educating and
convincing line management that computers and networks, as well
as the information they possess and process, should be treated
and managed as mission-essential and strategic organization
resources. Let me illustrate my point with an example.
Last summer, at one of the Department of Energy
laboratories we conducted a security audit. The laboratory was
evidenced as having the best firewall within the Department,
very good security policies, and adequate protection of our
classified systems. However, that same organization had a
number of instances of what I refer to as no-brainer security
weaknesses. For example, there were a number of computer
systems that had software configurations that were years out of
date.
In this case, they were not taking advantage of dozens of
patches that had fielded to upgrade the security of those
systems over the years. In addition, there were a number of
systems where their passwords, including system administrator
passwords were easily guessed, or in some cases even used the
term ``password.'' These and other weaknesses provided relative
ease of a potential hacker to break into the laboratory's
unclassified computer system.
As I evaluated this apparent paradox, the same organization
having both the best and the worst security practices, the root
issue became clear to me. The organization was not focusing on
information technology as an overall laboratory resource,
rather only sub-sets of the systems and networks were being
pro-actively managed. Most of the unclassified computers were
procured and operated as work center or personal resources.
I have found similar dichotomy at a number of other daily
sites. The problem at this lab was not the absence of sound
security policies or lack of security technology knowledge, but
the fact that management of computers had become highly
decentralized and, in many cases, was a personal task. I found
that the number of system administrators approached the number
of laboratory employees.
The security audit findings highlighted to the laboratory
director and senior management that they had fundamental
problems with information technology management. The solution
required a fundamental change in how computers, networks were
purchased, installed, and operated. I firmly believe that this
is the most significant and pervasive problem facing Federal
agency CIOs.
A second challenge I face is working with Federal managers
in the Department of Energy in determining how much security is
enough. That is, how much is adequate? In the past, primary
security focus was on the protection of national security
information, classified systems, and more easily controlled
mainframe computers. Adequate security was defined by security
gurus, in most cases, with much input from line management, and
defined, in most cases, in absolute terms.
Today, we use computers for a wide variety of missions
where it is not cost effective or appropriate to apply the same
protection mechanism or security policies in all cases. We have
information relating to national security. Personnel data and
business operations must be protected to ensure
confidentiality. On the other hand, we have public websites
where we want to protect the integrity of the information. In
addition, there are mission impact and perception factors which
influence what is adequate, as well as rapidly changing
threats, missions, and technologies.
Federal security policies require an assessment of risk to
guide management decisions on what is adequate. Sounds easy. I
would submit that it is not. The Federal Government is also
held to a very high standard and one that continues to change
and become more stringent over time. In my testimony, I have
included some status updates within the Department of Energy on
our recent security activities. I will not detail them here.
I would like to, however, turn for a few minutes to the
work of the CIO Security, Privacy, and Critical Infrastructure
Protection Committee, which I co-chair with Roger Baker, CIO of
the Department of Commerce, and Fernando Robano, CIO of the
Department of State. Our committee is developing a set of
products that we believe will augment and accelerate
improvements in implementing adequate levels of protection in
assuring appropriate privacy of Federal information and
systems.
I would like to submit for the record a brief summary of
our committee activities.
[The information referred to follows:]
[GRAPHIC] [TIFF OMITTED] T7018.014
[GRAPHIC] [TIFF OMITTED] T7018.015
Mr. Gilligan. I would also like to highlight a few of the
committee's efforts. Our project to develop and Information
Technology Security Maturity Framework is intended to help
guide agencies and senior government officials in establishing
and maturing an effective cyber security program. Following the
example of the successful Software Capability Maturity
Framework developed by Carnegie Mellon University, the
Information Technology Security Maturity Framework recommends
the building block approach to security.
Emphasis is placed at lower levels on critical foundation
activities, such as documented policy, and clearly defined
assigned responsibilities, as well as robust training and
security assessment of progress. I have brought a display that
summarizes the six levels of security maturity described in the
draft framework. The Security Committee believes that all
agencies should be working toward achievement of level 2 in the
near term.
This level describes what is called a documented security
program. It is based on policy and guidance from the General
Accounting Office, the Office of Management and Budget, and the
National Institute for Standards and Technology. The committee
is working to develop specific evaluation criteria, a checklist
guide that could be used for level 2, as well as further
definition of level 3.
We have invited the Software Engineering Institute and the
General Accounting Office to participate in the refinement of
the framework. The committee also has initiatives in the
development of a tool that will allow us to identify and make
available the Federal agency's best security practices. We are
developing sample agency policies and guidelines dealing with
security and privacy.
We are working to accelerate the use of so-called public
key encryption. We are working with the Information Technology
Association of America in the development of security solution
benchmarks, linked to common electronic services such as
financial track statues with the public, benefit inquiries over
the web, and electronic submission of contractor pricing
proposals.
I would like to conclude my remarks with some
recommendations from my perspective as co-chair of the
Security, Privacy, Critical Infrastructure Committee. The first
two recommendations deal with funding for security. First, I
recommend that organizations specifically identify and analyze
their expenditures in cyber security. In this regard, I suggest
that we work with the government and industry to establish and
refine benchmarks against which line managers can assess
whether their investment is comparable to similar
organizations.
Work by the Gardner Group suggests that a reasonable range
for cyber security spending is somewhere between 1 and 5
percent of an organization's spending for information
technology. Second, I would recommend consideration of
increased funding for a set of governmentwide security
initiatives that are focused not on multi-year research or
product development, but on short-term immediate operational
benefits for Federal agencies.
I note that most of our CIO Council cyber security efforts
are focused toward ongoing operational support. Furthermore, I
recommend that we continue to tightly tie our cyber security
efforts with other initiatives to improve overall management of
information technology resources from an enterprise
perspective.
Finally, I suggest that we continue to focus our education
efforts toward government managers. I believe managers need to
know how to make risk tradeoffs. What they need is greater
awareness of their responsibility in managing information
technology as a strategic resource, as well as simple
benchmarks and metrics, such as funding levels and a maturity
framework, against which they can evaluate organization-
specific risks, as well as the progress of their cyber security
programs.
This concludes my testimony. I look forward to your
questions.
[The prepared statement of Mr. Gilligan follows:]
[GRAPHIC] [TIFF OMITTED] T7018.016
[GRAPHIC] [TIFF OMITTED] T7018.017
[GRAPHIC] [TIFF OMITTED] T7018.018
[GRAPHIC] [TIFF OMITTED] T7018.019
[GRAPHIC] [TIFF OMITTED] T7018.020
[GRAPHIC] [TIFF OMITTED] T7018.021
[GRAPHIC] [TIFF OMITTED] T7018.022
[GRAPHIC] [TIFF OMITTED] T7018.023
[GRAPHIC] [TIFF OMITTED] T7018.024
Mr. Horn. Thank you very much, Mr. Gilligan.
Our next witness is Ms. Karen Brown, the Deputy Director,
National Institute of Standards and Technology, otherwise known
as NIST. With the Weather Bureau there, I wonder why we cannot
be MIST? Anyhow, the Department of Commerce. Thank you for
coming.
Ms. Brown. Thank you.
Thank you Mr. Chairman and members of this subcommittee for
the invitation to speak to you today about computer security
issues. Computer security continues to be an ongoing and
challenging problem that demands the attention of the Congress,
the executive branch, industry, academia, and the public.
Computer security is not a narrow technical concern.
The explosive growth in electronic commerce highlights the
Nation's ever-increasing dependence upon the secure and
reliable operation of our computer systems. Computer security
has a vital influence on our economic health and our Nation's
security, and we commend the committee for your focus on this
security. Today, I would like to address NIST computer security
activities that contribute to improving computer security for
the Federal Government and the private sector.
I would also like to briefly describe for you our proposed
new program activities for next year. Under NIST statutory
responsibilities, we develop standards and guidelines for
agencies to help protect their sensitive, unclassified
information systems. In meeting the needs of our customers in
both the public and private sector, we work closely with
industry, Federal agencies, testing organizations, standards
groups, academia, and private sector users.
As awareness of the need for security grows, more secure
products will be demanded in the marketplace. Addressing
security will also help ensure that electronic commerce growth
is not limited because of security concern. What does NIST do
specifically? To meet these responsibilities in customer needs,
we first work to improve the awareness of the need for computer
security, which is an ongoing effort.
Additionally, we research new technologies and their
security implications. We work to develop security standards
and specifications to help users specify security needs, and
establish minimum security requirements for Federal systems. We
develop and manage security testing programs in cooperation
with the private sector to enable users to have confidence that
a product meets a security specification.
We also produce security guidance to promote security
planning and secured system operations in administration. I
will briefly discuss the need and benefits of each. First,
there is a need for timely, relevant, and easily assessable
information to raise awareness about risk, vulnerabilities, and
requirements for protection of information systems. This is
particularly true for new and rapidly emerging technologies
which are being delivered with such speed in the Internet age.
We host and sponsor information sharing among security
educators, the Federal Security Program Managers' Forum, and
industry. We seek advice from our external advisory board of
computer experts. We meet regularly with members of the Federal
computer security community, including the Chief Information
Officer of the Security Committee, and the Critical Information
Assurance Office.
We actively support information sharing through our
conferences, workshops, webpages, publications, and bulletins.
A second need is for research on information technology
vulnerabilities and cost effective security. When we identify
new technologies that could potentially influence our customer
security practices, we research these technologies and their
potential vulnerabilities.
We also work to find ways to apply new technologies in a
secure manner. The solutions we develop are made available to
both public and private users. Research helps us to find more
cost effective ways to implement and address security
requirements. The third is the need for standards and for ways
to test that standards are properly implemented on products.
For example, cryptographic algorithms and techniques are
essential for protecting sensitive data and electronic
transition.
NIST has long been active in developing Federal
Cryptographic Standards and working in cooperation with private
sector voluntary standards organizations in this area. We are
currently leading a public program to develop the Advanced
Encryption Standard [AES], which will serve 21st Century
Security needs. Another aspect of our standards activity
concerns public key and key management infrastructures.
We have been actively involved in working with industry and
the Federal Government to promote the security and inter-
operability of such infrastructures. Standards help users to
know what security specifications may be appropriate for their
needs. Testing complements this by helping users have
confidence that security standards and specifications are
correctly implemented in the products they buy.
Testing also helps reduce the potential vulnerabilities
that products contain that could be used to attack systems. For
over 5 years, we have led the Cryptographic Module Validation
Program, which has now validated about 90 modules, with another
50 expected this year. This successful program utilizes private
sector accredited laboratories to conduct security conformance
testing of cryptographic modules against the Federal standard
we developed and maintain. Many of these activities are being
done in cooperation with the Defense Department's National
Security Agency in our National Information Assurance
Partnership.
The goal is to enable product developers to get their
products tested easily and voluntarily, and for users to have
access to information about test products. Under this program,
we have also led the development of an international mutual
recognition arrangement, whereby the results of testing in the
United States are recognized by our international partners,
thus reducing costs to the industry.
Advice and technical assistance for both government
organizations and private sector is the fourth need. While I
have given you a few examples of NIST work, I obviously have
not covered everything. I want to emphasize there is still much
more to be done.
Please keep in mind that approximately $6 million of direct
congressional funding supports both our Federal and industry
computer security responsibilities. This is plainly not enough.
Thank you.
[The prepared statement of Ms. Brown follows:]
[GRAPHIC] [TIFF OMITTED] T7018.025
[GRAPHIC] [TIFF OMITTED] T7018.026
[GRAPHIC] [TIFF OMITTED] T7018.027
[GRAPHIC] [TIFF OMITTED] T7018.028
[GRAPHIC] [TIFF OMITTED] T7018.029
Mr. Horn. Thank you very much. That was very helpful
testimony. We now go to our last witness on this panel. I must
say, Mr. Pethia, everywhere I talked and saw people in the last
3 weeks putting this panel together, the first magic word was
Carnegie Mellon. So, we are glad to have you come here. We hope
to visit your campus sometime. You can show us around.
Mr. Rich Pethia is the director, Computer Emergency
Response Team Coordination Centers, Software Engineering
Institute at Carnegie Mellon University in Pittsburgh.
Mr. Pethia. Mr. Chairman and members of the subcommittee, I
would like to thank you for the opportunity to come and talk to
you today about computer security. Today, I would like to
describe a number of the trends that impact security on the
Internet. I will illustrate the results of those trends and
then outline some steps that I think will help us all
effectively manage the increasing risk of damage from cyber
attacks.
My perspective comes from the work that we do with the CERT
Coordination Center. The Center is charted to respond to
security emergencies on the Internet, and to work with both
technology producers and technology users to facilitate
response to major security problems. Since 1988, we have
handled over 24,000 separate security incidents, and analyzed
more than 1,500 separate computer vulnerabilities.
The current state of Internet security is cause for
concern. The vulnerabilities associated with technology used on
the Internet put government, business, and individuals at risk.
Security is influenced by many factors. An organization that
wishes to improve its security has to deal with a lot of
issues. First of all, the Internet itself is growing at an
amazing rate.
As the technology is being distributed, so is the
management of that technology. System administration and
management often fall upon people who do not have the training,
skills, resources, or interest needed to operate their system
securely. This problem is about to get worse. Now that we have
direct Internet connection to homes, schools, libraries, and
other venues that do not have training and security staff.
These always-on rarely protected systems will allow
attackers to continue to add new systems to their arsenal of
captured weapons. Intruder tools are becoming increasingly
sophisticated and also becoming increasingly user-friendly and
widely available. This technology is evolving like any other.
Sophisticated developers of intruder programs package their
tools in user-friendly forms and make them widely available. As
a result, even unsophisticated intruders can use them.
On the technology side, when vendors release patches or
upgrades to solve security problems, organizations' systems
often are not upgraded. The job may be too time consuming, too
complex, or just too low a priority for the system
administration or staff to handle. There is little evidence of
improvement in the security features of most products. Today,
we continue to receive new vulnerability reports in second
generation and third generation products.
Developers are not devoting sufficient effort to apply
lessons learned about the sources of vulnerabilities and doing
the engineering work necessary to remove them. Finally,
engineering for ease of use is not being matched by engineering
for ease of secure administration. Today, we would all find it
ludicrous to safely operate and drive an automobile, a person
would have to be a master mechanic.
Yet, today we expect our computer users and novice system
administrators to have detailed technical knowledge of all the
intricacies and nuances of the technology. We are simply
developing technology that is not fit for use in today's
environment. Because of these and other factors, organizations
and individuals who are using the Internet become vulnerable to
various kinds of cyber attack, including the denial-of-service
attacks that were widely publicized in February.
The key point about this attack, this attack type, is that
although an organization may be able to harden its own systems
to help prevent having its systems used as a part of a
distributed attack vehicle, there is essentially nothing a site
can do with currently available technology to prevent becoming
a victim of these coordinated denial-of-service attacks.
The best an organization can do today is get ready to
respond and have its response capabilities in place, should it
ever become the victim of one of these attacks. These attacks
work by having intruders compromise vulnerable systems. They
collect these vulnerable systems into aggregated attack
networks. These networks act in unison to attack a single
victim.
The network can be activated remotely at a later site by a
master computer. Communication between the master and the
networks is encrypted, often making it difficult to locate the
master. Once activated, these tools proceed on their own. They
are rapidly evolving. Individual nodes in the attack network
can be automatically reprogrammed to change the type of attack
so that it becomes increasingly difficult to build defenses
against this technology.
Clearly, we have entered a new era in the Internet, where
the power of the Internet itself is now being used to attack
people who are connected to it. At the CERT, we constantly
monitor trends and watch for new attacks and tools. We became
aware of this new form of denial-of-service attack in late
August, early September 1999. Denial-of-service attacks are not
new.
These kinds of attacks have been around since 1994, with
significant increases in 1996 and 1998. By the end of
September, it was evident that this was a new form of attack.
It was something we had never seen before. We called together a
workshop of 30 international experts who came together for 2
days in Pittsburgh and produced a paper that explains the
threat posed by these intruder tools, as well as guidance to
organizations about how to protect themselves and be prepared,
and how to be ready to respond.
This paper, along with other advisories, were issued to the
community in December. We have had a series of communications
out to the Internet community. The problem is serious. It is
complex. A combination of approaches must be used to reduce the
risks associated with this ever-increasing dependence on the
Internet. First of all, we need better ability to collect,
analyze, and disseminate information on assurance issues.
A lot of what we do today is reactive. We see a problem. We
analyze it. We understand what just happened. That is no longer
adequate. New forms of attack are now happening at Internet
speed, both automated attacks, like these distributed denial-
of-service attacks, as well as new forms of viruses, such as
Melissa that showed up in March of this year.
Today, we need to find analysis methods that build a
predictive early warning capability. We need to be able to
understand what is going to happen before it happens, which
means we need new ways of analysis. In addition, better
attention paid to collecting information. There has been a lot
of discussion and debate about instrumenting networks to
collect data to watch the traffic on the network to anticipate
what the problems might be.
Certainly, there is a need to be concerned about privacy,
but we have to find some way to balance our need to collect
information about the operation of networks with our need to
keep individual transactions and user's activities private.
Until we get a better view into what is happening on our
networks, we are going to have a very difficult time defending
against new forms of attack.
Third, we need to invest in better education and training
to raise the level of security and security awareness. In
particular, we need to focus on bringing the understanding of
security issues to senior and middle management in government,
as well as in industry. Until there is management commitment,
and management commitment of resource to solve this problem,
little is going to happen. Part of that includes encouraging
the development of comprehensive security programs with well-
defined responsibilities for managers, users, and system
administrators.
Finally, all of this is only going to help us mitigate the
problem, stem the flow of quality that we are having. It will
not solve the problem. In order to get ahead of this problem,
we need to support research and development activities that
will lead to a new generation of technology on the Internet and
other broad-scale networks. Systems that are easier to secure,
systems that do not require so much constant attention, systems
that do not repeat the vulnerabilities of the past, the long-
term solution is better technology.
That is going to take years. Until we get there, we need
better management approaches. Thank you.
[The prepared statement of Mr. Pethia follows:]
[GRAPHIC] [TIFF OMITTED] T7018.030
[GRAPHIC] [TIFF OMITTED] T7018.031
[GRAPHIC] [TIFF OMITTED] T7018.032
[GRAPHIC] [TIFF OMITTED] T7018.033
[GRAPHIC] [TIFF OMITTED] T7018.034
[GRAPHIC] [TIFF OMITTED] T7018.035
[GRAPHIC] [TIFF OMITTED] T7018.036
[GRAPHIC] [TIFF OMITTED] T7018.037
[GRAPHIC] [TIFF OMITTED] T7018.038
[GRAPHIC] [TIFF OMITTED] T7018.039
[GRAPHIC] [TIFF OMITTED] T7018.040
[GRAPHIC] [TIFF OMITTED] T7018.041
[GRAPHIC] [TIFF OMITTED] T7018.042
[GRAPHIC] [TIFF OMITTED] T7018.043
[GRAPHIC] [TIFF OMITTED] T7018.044
[GRAPHIC] [TIFF OMITTED] T7018.045
[GRAPHIC] [TIFF OMITTED] T7018.046
[GRAPHIC] [TIFF OMITTED] T7018.047
[GRAPHIC] [TIFF OMITTED] T7018.048
[GRAPHIC] [TIFF OMITTED] T7018.049
[GRAPHIC] [TIFF OMITTED] T7018.050
[GRAPHIC] [TIFF OMITTED] T7018.051
[GRAPHIC] [TIFF OMITTED] T7018.052
[GRAPHIC] [TIFF OMITTED] T7018.053
[GRAPHIC] [TIFF OMITTED] T7018.054
[GRAPHIC] [TIFF OMITTED] T7018.055
[GRAPHIC] [TIFF OMITTED] T7018.056
[GRAPHIC] [TIFF OMITTED] T7018.057
[GRAPHIC] [TIFF OMITTED] T7018.058
[GRAPHIC] [TIFF OMITTED] T7018.059
[GRAPHIC] [TIFF OMITTED] T7018.060
[GRAPHIC] [TIFF OMITTED] T7018.061
[GRAPHIC] [TIFF OMITTED] T7018.062
[GRAPHIC] [TIFF OMITTED] T7018.063
[GRAPHIC] [TIFF OMITTED] T7018.064
[GRAPHIC] [TIFF OMITTED] T7018.065
[GRAPHIC] [TIFF OMITTED] T7018.066
[GRAPHIC] [TIFF OMITTED] T7018.067
[GRAPHIC] [TIFF OMITTED] T7018.068
[GRAPHIC] [TIFF OMITTED] T7018.069
[GRAPHIC] [TIFF OMITTED] T7018.070
[GRAPHIC] [TIFF OMITTED] T7018.071
[GRAPHIC] [TIFF OMITTED] T7018.072
[GRAPHIC] [TIFF OMITTED] T7018.073
[GRAPHIC] [TIFF OMITTED] T7018.074
[GRAPHIC] [TIFF OMITTED] T7018.075
[GRAPHIC] [TIFF OMITTED] T7018.076
[GRAPHIC] [TIFF OMITTED] T7018.077
[GRAPHIC] [TIFF OMITTED] T7018.078
[GRAPHIC] [TIFF OMITTED] T7018.079
[GRAPHIC] [TIFF OMITTED] T7018.080
[GRAPHIC] [TIFF OMITTED] T7018.081
[GRAPHIC] [TIFF OMITTED] T7018.082
[GRAPHIC] [TIFF OMITTED] T7018.083
[GRAPHIC] [TIFF OMITTED] T7018.084
[GRAPHIC] [TIFF OMITTED] T7018.085
[GRAPHIC] [TIFF OMITTED] T7018.086
[GRAPHIC] [TIFF OMITTED] T7018.087
[GRAPHIC] [TIFF OMITTED] T7018.088
[GRAPHIC] [TIFF OMITTED] T7018.089
[GRAPHIC] [TIFF OMITTED] T7018.090
[GRAPHIC] [TIFF OMITTED] T7018.091
[GRAPHIC] [TIFF OMITTED] T7018.092
[GRAPHIC] [TIFF OMITTED] T7018.093
[GRAPHIC] [TIFF OMITTED] T7018.094
[GRAPHIC] [TIFF OMITTED] T7018.095
[GRAPHIC] [TIFF OMITTED] T7018.096
[GRAPHIC] [TIFF OMITTED] T7018.097
[GRAPHIC] [TIFF OMITTED] T7018.098
[GRAPHIC] [TIFF OMITTED] T7018.099
[GRAPHIC] [TIFF OMITTED] T7018.100
[GRAPHIC] [TIFF OMITTED] T7018.101
[GRAPHIC] [TIFF OMITTED] T7018.102
[GRAPHIC] [TIFF OMITTED] T7018.103
[GRAPHIC] [TIFF OMITTED] T7018.104
[GRAPHIC] [TIFF OMITTED] T7018.105
[GRAPHIC] [TIFF OMITTED] T7018.106
[GRAPHIC] [TIFF OMITTED] T7018.107
[GRAPHIC] [TIFF OMITTED] T7018.108
[GRAPHIC] [TIFF OMITTED] T7018.109
[GRAPHIC] [TIFF OMITTED] T7018.110
[GRAPHIC] [TIFF OMITTED] T7018.111
[GRAPHIC] [TIFF OMITTED] T7018.112
[GRAPHIC] [TIFF OMITTED] T7018.113
[GRAPHIC] [TIFF OMITTED] T7018.114
[GRAPHIC] [TIFF OMITTED] T7018.115
[GRAPHIC] [TIFF OMITTED] T7018.116
[GRAPHIC] [TIFF OMITTED] T7018.117
[GRAPHIC] [TIFF OMITTED] T7018.118
[GRAPHIC] [TIFF OMITTED] T7018.119
[GRAPHIC] [TIFF OMITTED] T7018.120
[GRAPHIC] [TIFF OMITTED] T7018.121
[GRAPHIC] [TIFF OMITTED] T7018.122
[GRAPHIC] [TIFF OMITTED] T7018.123
[GRAPHIC] [TIFF OMITTED] T7018.124
[GRAPHIC] [TIFF OMITTED] T7018.125
[GRAPHIC] [TIFF OMITTED] T7018.126
[GRAPHIC] [TIFF OMITTED] T7018.127
[GRAPHIC] [TIFF OMITTED] T7018.128
[GRAPHIC] [TIFF OMITTED] T7018.129
[GRAPHIC] [TIFF OMITTED] T7018.130
Mr. Horn. Thank you very much.
We will now go to questioning. It will be 5 minutes to a
side. We will get everybody in here in three rounds, if you
need them.
[Pause.]
Mr. Horn. This looks like a vote.
What I want to do is start on one issue. Then I will yield
to Mr. Turner. As I listened to the comment about maybe we need
a tzar in this area, usually my spinal column starts wiggling.
As a student of Russian history, I keep wondering what happened
to a lot of tzars and who is Rasputin in this operation? So, I
guess I would ask, is the Koskinen model a good one for this?
Now, with the Koskinen model, then when Mrs. Maloney and I
wrote the President, then talked to him and said, look, you
have got to get somebody to coordinate this effort. Some were
waving the flag for a tzar. I was not. The way it worked out,
one, the President picked a person that he had known before he
was President and had trust in.
No. 2, we made him assistant to the President, which is the
highest rank you can have in the White House hierarchy. No. 3,
he was not in OMB. He was housed near there. The President had
him and the President spread the word to the Cabinet that this
is serious business, when they finally got around to it.
No. 4, they called on each of the Deputy Secretaries that
really run departments and obviously involved the Chief
Information Officers, who are the people we ought to be
spending the time to be the managers they are supposed to be of
communications and information in their particular agencies.
So, I guess I would simply like to get the feeling of you as to
whether that was a successful model that we could also apply to
computer security and not have some tzar in OMB.
Of course, as you know, I am trying to split the management
part out of OMB. It might well roost there, but the fact is the
model I think worked the way it did. I do not know if any of
you want to take that and say, hey, there is another way to
look at this. Go ahead. Mr. Gilligan.
Mr. Gilligan. Sir, let me give you some perspectives. I
think the model with the particular individual, John Koskinen,
worked extremely well. I think there were a number of factors
that made it work well, one of which was the personal
characteristics and strength of John Koskinen. I think there
were also some other factors that made it effective. That was
the urgency and the immediacy of Y2K heightened the interest
across the board.
There was a need and a willing acceptance of someone to
help lead the effort across government and across really the
country. It is not clear to me that an exact parallel to that
would work as effectively in computer security. I know that
there has been some frustration, and there continues to be at
all levels, with our difficulty of pulling together across-
government activities in this area.
So, it is clear that we need to emphasize and we need to
work in that area. Obviously it is something the CIO Council is
trying to address, and yet we realize that we have limited
abilities as well. So, while I would not specifically endorse
the exact model, I think we need to continue to look for some
way to better leverage our across-government efforts in this
area as a part of our solution.
Mr. Horn. Any other thoughts on this? Mr. Tritak.
Mr. Tritak. I would agree with those comments.
Mr. Horn. So, you would like that model?
Mr. Tritak. I think what is intriguing about the Koskinen
and the Y2K effort generally is, in many respects, the Y2K was
your first critical infrastructure challenge to the United
States. It had a lot of things going for it. First of all,
there was a recognition. In fact, industry actually led the
way. The government took a little while to get onboard.
There was an acknowledgment of what the challenge was.
There was a known problem. The people rallied for it. I think
that when you look at the Koskinen model, it is important to
look at what the factors of success were. You have identified
quite a few of them. He was viewed as having the authority. He
worked very closely with the Cabinet. The Cabinet knew that
when he walked into the room, who he was, and what he stood
for.
We certainly cannot under-emphasize the importance of a
leadership and view it as someone who is speaking with
authority on behalf of the President; especially when you are
talking about across-agency issues, which critical
infrastructure really is all about. If you look at the way this
has evolved, there was a time probably when the Computer
Security Act was actually passed where you could talk about a
computer system within an agency. It was that agency's system.
Now, you are looking more at an interconnected set of
systems. You have to ensure, in terms of the government as a
whole providing a service to the Nation, that you have strong
links across government agencies, as well as within them, so
that you do not create weak links in the chain. Now, with that
said, I think that we have to look very closely about how the
challenges, as ongoing, differ from the Y2K experience before
you talk about institutionalizing a new position.
I think certainly some of the ingredients that you
indicated bear close scrutiny and attention on that. In fact,
you could make the case that, that kind of leadership becomes
even more essential in some regards when the known threats are
not as immediate, but you know they are out there and they
could happen at any time as opposed to a date-specific.
Mr. Horn. Any other comments on this?
I will yield 5 minutes to the gentleman from Texas. If you
would like, we could recess now to go vote, and then come back,
and then start with your 5 minutes. Is that OK with you?
Mr. Turner. That is fine.
Mr. Horn. OK. We are going to be in recess then for 20
minutes so we can get these two votes.
[Recess.]
Mr. Horn. This subcommittee will be in order. We will
proceed with the questioning. It is 5 minutes for Mr. Turner,
the ranking member from Texas.
Mr. Turner. Thank you, Mr. Chairman.
I appreciated your comments. I really get the impression
that what you were saying to us is that there is a lot of work
that has got to be done in the area of new technology before we
will ever have any hope of really having a secure Internet. I
guess I was kind of curious as to what types of things you are
talking about? We made the comparison a minute ago to the Y2K
problem.
To me, what we are talking about today dwarfs the Y2K
problem. In that arena, we had a date certain we were working
toward. We knew if we made it past that date, we had succeeded.
The government was able to provide a coordinating role for both
the public and the private sector. This challenge seems to be
so much greater. When you say we need better technologies, what
kinds of things are we talking about?
Mr. Pethia. First of all, the driving factor behind my
belief is that more and more devices attached to Internet are
going to become consumer items. I think we are already there
with personal computers. We are almost there, even with some
devices like routers and fire walls, when you think about
having these things installed in libraries, in doctors'
offices, and in places where you would not expect to find
someone with a degree in computer science.
That is going to continue. We are going to have all kinds
of devices at home. We are going to have hand-held portable
units. We are going to have cell phones connected, as we
already do, into the Internet. So, from one perspective what we
need to do is to make security much simpler than it is today.
You can configure a very secure personal computer, be it a Unix
box or a Microsoft Windows box.
All of the mechanics are there to do that, but it is not
easy. It takes a lot of understanding and a lot of knowledge.
Not only do you have to get it right the first time, you have
to keep it that way over time as you add new applications into
your personal computer. So, if you think back to the 1960's
when all computers were hard to use in all kinds of ways, the
industry responded very well with a lot of research and
development in easy-to-use, in fact ease of use was the buzz
word for the industry back then.
We need the same effort today, in terms of security
controls and security mechanisms. Bring those controls and
mechanisms to the point where the average user could use them.
I think that is sort of a near-term, by ``near-term'' I mean a
2- to 3-year effort that could show some results, significant
results, major results in that period of time.
Mr. Turner. I forget the name of the group or company that
is certifying whether something is secure or not. I read about
it somewhere. Is that the kind of thing that would motivate the
private sector to be sure they develop their products in a way
that they can be secure?
Mr. Pethia. I think that kind of thing will certainly help.
I think the tension is going to be between the length of time
it takes to do the evaluations and the market forces that keep
driving new products. Very often, the situation of doing an
exhaustive evaluation takes time. By the time you are through
with that evaluation, the marketplace has already moved on to
the next generation of products. I think we have to struggle
with that issue.
Mr. Turner. That seems to be one of my greater concerns
because this field moves so fast. It is always the private
sector that is moving forward. We had some government effort
over there, though it is not in one place right now. It seems
that the government effort, even if we consolidate it, is
always going to be a step behind what is really going on in the
private sector.
So, it is forcing you to try to think of private sector
incentives to try to make this all happen. I cannot get it in
my mind that the government is going to be able to keep up with
it.
Mr. Pethia. I think the private sector interest is rising.
I think as more and more damage happens on the Internet, people
are going to begin to understand that investing in security is
something they are going to need to do in order to keep their
businesses operational. So, I think that is happening. I see a
big increase in private sector interest today, over just a year
ago. That trend has been going on for several years.
I think the marketplace, in my opinion, has become
complacent. The marketplace is currently accepting whatever the
vendors produce. I think an awareness campaign and an
understanding that technology can be changed; technology does
not have to be the way it is today is something that would help
move, first of all, the consumer to a better understanding of
the kind of quality the consumer should expect from a product.
Then finally, the technology producers, as they begin to
see a marketplace for that new product, to begin to produce.
There is a place where I think government campaigns focused on
broad-scale awareness, understanding, helping the consumer,
both in government and outside government, understand that
technology possibilities exist beyond what we have available to
us today, I think, would go a long way to spur that kind of
effort.
Mr. Turner. Is it a reasonable suggestion to think in terms
of a second Internet? After all, we are even getting to the
point where much of what takes place can even be done in a
wireless mode. Is there a reason to consider that there could
be more than one Internet? That there are secure Internets so
that we can solve some of our national security type problems
and others in a way that we know that we are protected?
Me. Pethia. Certainly, I think there are some needs for
high security in some applications where those networks and
systems will remain isolated and should remain isolated from
the broad Internet. I think the last 10 years of history has
told us that the Internet is going to continue to evolve. It is
going to continue to lure people because of the broad
connectivity that is available over the Internet, and also
because of the dramatic lower cost of operating on this huge
network where everybody shares the expense.
I think the economics are going to continue to push most
organizations toward the Internet. I think the challenge as to
rather than trying to isolate from the Internet, the question
is how do we go about fixing the Internet so that we can all
enjoy the level of security that we need?
Mr. Turner. Your effort at Carnegie Mellon, through the
Computer Emergency Response Team, seems to me to be an
excellent private sector initiative. Do you think government is
capable of duplicating that or will it be best left to efforts
like yours?
Mr. Pethia. I think it is going to take a combination of
efforts. There are within the government a number of computer
emergency response teams in the DOD, in the Department of
Energy, and in some of the other agencies. There is the FedCIRC
activity which we actually participate in. So, I think there is
a large government effort there. One of the advantages that I
think we have is that in addition to the reactive work that we
do, we are also housed in a research university.
So, in the private sector where you can have these kinds of
reactive capabilities to help us understand what the problem
is, but also marry with that a research and development
capability we can move toward solution. That, I think, is a
good combination. So, there perhaps is a way where government
can team with organizations in the private sector, with the
government doing some of the response reactive work, ensuring
that they have close working relationships with technology
researchers so that the researchers really understand what the
real problems are.
Mr. Turner. Thank you, Mr. Chairman.
[The prepared statement of Hon. Jim Turner follows:]
[GRAPHIC] [TIFF OMITTED] T7018.131
[GRAPHIC] [TIFF OMITTED] T7018.132
[GRAPHIC] [TIFF OMITTED] T7018.133
[GRAPHIC] [TIFF OMITTED] T7018.134
Mr. Horn. I thank the gentleman.
Now, I yield to the gentlewoman, the vice chairman from
Illinois, Mrs. Biggert to question the witnesses for 5 minutes.
Mrs. Biggert. Thank you, Mr. Chairman.
If I could ask unanimous consent to include my opening
statement.
Mr. Horn. Without objection, it will be so ordered as read
at the beginning, after Mr. Turner's opening remarks.
Mrs. Biggert. Thank you.
This is a question for all of you. What is the real threat
from cyber terrorists to the Federal agencies' mission critical
systems? I know that is a broad question, but how does the
administration's recently released National Plan for
Information Systems Protection address the plans to mitigate
these terrorist threats? I think when we were talking about
Y2K, we had our mission critical systems. I think that was what
was really addressed there. First of all, is there a threat
from the terrorists?
Mr. Tritak. Well, I think the national plan makes clear
that the threats posed by cyber terrorists as well as nation
states is growing. I would urge you, if you have not already,
to get a briefing by Mr. Michael Vaddis at the National
Infrastructure Protection Center who could give you a lot more
detail, an appropriate level of detail than I can get into. One
of the reasons for PDD-63 stemmed from a Presidential
commission which asked the question, what are the new threats
to the Nation? The cold war is over. It is unlikely that anyone
would be foolish enough again to take on the United States with
armed forces. So, what are they?
That question was initially prompted, of course, by a
number of events that were happening in the mid-1990's, the
Towers' bombing, Oklahoma City. What is going on here? The
recommendation of that commission was to say that the critical
infrastructure of this country are increasingly becoming
vulnerable to types of attacks that could be delivered over the
information super highway.
Why? Because as was indicated earlier, traditional
infrastructures are increasingly relying on computer networks,
not only to receive e-mail, but actually perform operational
functions of their business. As you move further and further
into deregulation, the need to cut your costs to make the
margins up, you are going to be relying more and more on
information technologies to perform functions which
traditionally may have been performed by manual labor for
example.
Also, in the past, if a computer operational system went
down, say in the electric power industry, they have ways of
shifting over to manual type responses in order to keep the
flow of services going. Now, over the long-term, more and more
of those primary functions are performed by information
technology, and if those systems are then networked either
through the Internet or some wide area network systems, the
potential for someone being able to get in and cause damage
increases.
Now, I am glad you also mentioned the critical systems
because this is a very important thing about critical
infrastructure assurance. What we are concerned about are those
systems within our critical infrastructures which, if
disrupted, could cause immediate and significant harm to the
Nation's security, its economy, or the health and welfare of
its people. If someone means to do harm, they are going to want
to leverage their efforts to find weak links in the chain.
So, one of the purposes of the effort that is outlined in
the national plan is to begin to raise this issue with industry
to make clear that this is more than just a hacking problem.
Frankly, they deal with that now. They know that they are being
hacked. Their websites are being looked at. The idea that if
more and more of their business relies on information
technology, for example, banking and finance, e-commerce, where
the very nature of the revenue stream turns on information
technologies. This is a different problem.
The same thing within the Federal Government. There was a
time when you could talk about a computer system within the
Federal Government and it was the agency's system. It was
insular. It was self-contained. Now, like everywhere else, you
are getting inter-connectivity between agencies. They are
depending on different services, both within government as well
as outside of government.
This inter-dependency is one of the newer challenges. An
agency can get their security concerns right, but if they are
dependent upon systems which do not have their security right,
that is where the vulnerability lies. Your types of attacks
which, again, Mr. Vaddis will be in a better position to talk
to you about this, they are looking for the weak links. They
are not simply going to willy-nilly take on any piece of the
information infrastructure. They are going to look for where
the highest value payoff is going to come from.
Mr. Gilligan. I think Mr. Tritak has done a good job of
summarizing the significance of the threat and many of the
characteristics that contribute to it. I would only add a
couple of thoughts. One, I think it is not just linkages
between agencies, but linkages within sites and within agencies
where you find I think unknowingly our interconnection.
We are just about intermeshed in our network connectivity
among systems that we have the same vulnerabilities. I think
second, we really, in my view, have kind of two tiers of
threat. Unfortunately, a lot of our emphasis and visibility is
on what I will call the lower tier, which is a very
unsophisticated, but today, because of the vulnerabilities, is
ineffective and gets a lot of visibility.
Now, I think there is one that is much more sophisticated.
We only get glimpses of it. In many cases, that is something we
do not share a lot of insight. It is almost masked. That is, we
are seeing some of these lower sophistication threats. That is
what we are focusing a lot of attention. I think we need to
because you need to dampen those out of the system before you
can really start to focus and then get the protection that you
need to address the more sophisticated attack.
Ms. Brown. Well, I think both gentlemen have done a really
good job. I would only add that I think one of the key
challenges is not just today's problem, but the ongoing
problem. There is new software every month. There are new
systems every month. So, there is not a single fix, as in the
Y2K, as Mr. Turner and everyone has talked about. There was a
single crisis. There was a single thing that we had to fix.
This is going to be an ongoing problem, and ever more
difficult in many ways to stay on top of as we become more and
more global. So, we need to look at what can we do today, but
also on the more fundamental things to make our systems
fundamentally secure. How do we design the systems and how do
we design the software so it is not up to the user to fix and
put the patches, which will always be there? Somehow, how do we
fundamentally make the system more robust?
Mr. Pethia. I am building briefly on Mr. Gilligan's
remarks; this idea of two tiers of threat. At the lowest level,
and one of my big concerns, and the reason that I am advocating
for increased emphasis on analysis, capability, and data
collection is that the low-level threat, the amount of noise
generated by that threat is now so huge. We literally get 50
new incidents reported to us every day. We are only 1 of 90
emergency response teams, as well as a number of government
agencies who focus on this issue.
There is so much activity out on the network today. It is
very difficult to pull out from all of that noise the one or
two key things that you really need to pay attention to. In
order to stay ahead of this problem, I think we are going to
need to become much more sophisticated in the way we collect
and analyze incidents data. So we can look for those key
indicators that there is something really significant going.
Mrs. Biggert. Thank you. Thank you, Mr. Chairman.
Mr. Horn. Thank you. May I suggest that if we have some
additional questions, that we have a time problem here. A
number of us are involved in things that just go every 15
minutes, starting at around 12:05 p.m. So, if you do not mind,
we would like to submit some of these questions, I know that I
have, to you. Take your time, but we would love to have them in
the record at this point, your best thoughts, if that is OK
with you.
[The information referred to follows:]
[GRAPHIC] [TIFF OMITTED] T7018.135
[GRAPHIC] [TIFF OMITTED] T7018.136
Ms. Brown. Thank you very much for the opportunity.
Mr. Horn. Well, we thank you. The chart here I particularly
want your comments. That is our question 5, for the majority. I
think you have it. Now, this was prepared by counsel, Mr. Ryan.
He is 100 percent Irish. I am only 50 percent Irish. It is not
even St. Patrick's Day. I look at that. I looked for Jesse
Jackson on the floor. It looks like the Rainbow Coalition. He
is serious about this and we are.
So, we would like your best shot at it, in terms of all of
these organizations and how they can work on computer security
issues. The key question still remains on who is coordinating
this operation? Are there various ways, given the private
sector, the Federal sector, the State sector, the local sector,
the non-profit sector? So, if you would struggle a little with
that, we would appreciate it.
Well, thank you very much for coming. We will now swear in
the next panel.
Mr. Horn. We have Mr. Jim Gerretson, Director of
Operations, Information, Assurance, ACS Defense, Inc.; Mr. Mark
Rasch, senior vice president and legal counsel, Global
Integrity Corp.; and Mr. James Adams, chief executive officer,
iDEFENSE.
Gentlemen if you will just stand and raise your right-
hands.
[Witnesses sworn.]
Mr. Horn. The clerk will note all three witnesses affirmed.
We will begin, Mr. Gerretson with you. It will be 5 minutes for
a summary. We are going to have to stick to that. We all have
your papers. If you were not in the room, they automatically go
in at this point in full. If you can give us a summary, and
then we would like to have some questions before noon. Then we
are going to have to break.
So, Mr. Gerretson, it is all yours.
STATEMENTS OF JIM GERRETSON, DIRECTOR OF OPERATIONS,
INFORMATION ASSURANCE, ACS DEFENSE, INC.; MARK RASCH, SENIOR
VICE PRESIDENT AND LEGAL COUNSEL, GLOBAL INTEGRITY CORP.; AND
JAMES ADAMS, CHIEF EXECUTIVE OFFICER, iDEFENSE
Mr. Gerretson. Mr. Chairman and members of the committee,
thank you for giving me the honor of testifying today. I am
here today to give you a brief presentation on hacking. We
believe that in order to start to fix your systems and
networks, that you have to understand the enemy, and hackers
really are the enemy. The following presentation will take you
briefly through what we call the hacker protocol and
demonstrate just some of the tools and techniques used by
hackers to gain access to your systems.
All of the tools that you are going to see today are freely
available on the Internet or you can go to a local computer
show on a weekend and, for $10 per CD, buy a full CD of
different types of hacks. The current data base that we have
contains over 3 gigabytes of data. What you see on the screen
before you is what we call the hacker protocol. Different
people may use different terms, but professional hackers in
nation states that implement hacking as warfare do follow the
same concepts.
The thing that is important to recognize here is this is
highly structured in its approach and in its planning. A good
hack, for better or for worse, is invariably a well-thought-
out, well-executed operation.
Mr. Horn. I might add on that very useful chart that, that
will be placed in the record at this point, without objection.
All other charts will be put in appropriately where they have
been used by the witness or the staff. So, all of those charts
will go in the final hearing report.
Mr. Gerretson. Thank you, sir.
[Slide shown.]
Mr. Gerretson. The first phase of the hacking protocol is
intelligence gathering. This is primarily an espionage
operation. There are many facets to it. Social engineering is a
large part. I may act as a user calling up a help desk and say
I have forgotten my password. Help desks are setup to be very
helpful. They will frequently say, the default password is, or
your network is. So, I get a lot of information that way.
Open source materials such as newspapers, prospectuses, and
library magazine articles are also a wonderful way of getting
information. You hear the term a lot, but ``dumpster diving''
is also a very popular way of getting information on your
system.
[Slide shown.]
Mr. Gerretson. Once we have done the intelligence
gathering, the next step is to do reconnaissance. Again, to
define the target. Your domain host is the name of your
computer system on the network. I want to know what I have got,
see if I can attack it, and how I can attack it. This is what
we are going to show you. It is a freely available program
called NMAP. We are going to take that information that we have
gathered and scan your network to determine what is there. The
program that we are using is called Ping Sweep.
[Slide shown.]
Mr. Gerretson. In simple terms, my computer is going out to
your network and saying, hello, are you there? Your computers
are coming back and saying, yes, I am. What you see here, with
these being listed, are computer targets that have come back
and said, I am here. What we have now done is identified a
target set. We are not wasting our time.
[Slide shown.]
Mr. Gerretson. The next slide, we are going to take one of
those targets that we have identified and go and look for
additional information. What we are trying to do is find out
what services are open, as you see, I am pointing out. These
are all considered services on a computer. This one, for
example, is finger, which we will talk about in a second.
What we are doing is finding a means to attack your system.
We are also going to go out to try to find out the operating
system that your computer is running which is again identified.
Once we have this information, we can now go and do specific
probes. What we are going to do is take that information and
look for a way to get into your system.
[Slide shown.]
Mr. Gerretson. This presentation that we are going to show
you now is one of the tools called Finger. It is an information
gathering tool, you are seeing it used in a way it was never
intended to be used. In order to attack and control the system,
you need three things. You need a valid user name. You need a
valid password, and you need a host address from the computer
system that is allowed to talk to you.
If you look across here, as I am highlighting ``student
one,'' I now have a valid ID and I now have a valid computer
system that I am talking from. I have two of the three items
that I need to attack this system.
[Slide shown.]
Mr. Gerretson. This next scan, web servers as we are all
aware, are a wonderful target for attack. It used to be that in
order to do the attack, I had to know all of the systems and
all of the vulnerabilities. Now, I have a tool that will run it
for me automatically. It requires very little work on my part.
It identifies the server type that is running and will simply
go out and scan all of the CGI weaknesses on this web system. I
do not even have to know what these systems are now.
I do not have to know what these vulnerabilities are. It
just tells me it finds one. I go out to my tool kit, pull in
this particular attack and away I go. Once we do that, we are
trying to get a toehold on the system. This is basically I just
get into your box any way I can. I cannot control the data. I
do not need it, but I am on it and it gives me the next step.
[Slide shown.]
Mr. Gerretson. The next step is to go from just being a
user into what we call the root or administrator level of the
system then we really do own this box. I am going to skip this
example.
[Slide shown.]
Mr. Gerretson. We are going to go and actually break into
this system and take it over. It acts as a user system. What
this program does is it shows us actually going in and doing an
attack on the system that in a matter of about 15 seconds turns
us into the root administrator of the box, simply from being a
user. Once we have gotten control of the system, there are a
lot things we can do.
We could kill this box. We could take the information. But
what we do want to do is use it again later. So, we are going
to hide our track. We do not want people to know we are there.
We can do that by deleting files or modifying log files. We are
going to show you a quick example of how we just simply modify
a log file.
[Slide shown.]
Mr. Gerretson. This is a program called Wipe. We have a
user account. We are called ``Reacher.'' We get into the
system. If the system administrator were to check his logs, he
would say, why is this guy here. But we have gone and wiped it.
We are no longer there. We are now invisible to the person that
runs this machine.
[Slide shown.]
Mr. Gerretson. We can put Trojans on the system. A Trojan
is a program that will look like something that is a valid
program that is supposed to be there, but in effect it is a
program that does a lot of bad things. In this brief example,
listen. We can record every keystroke you type on the system.
We can turn on your sound system. So, if you have a microphone,
we can record everything that is said in the area, and you will
never know what happened.
[Slide shown.]
Mr. Gerretson. Now, sounds bad and it gets worse. I will
make a bold statement that if you are connected to the network,
and if I have enough time and want to make the effort, I can
hack you. The only sure fire way to protect your system is to
disconnect it from the network. Take out your floppy. Take out
your CD and then lock it up in a secure room. Anything short of
that, eventually it can be had.
It sounds pretty bad, but there is hope. It is not all bad;
just mostly bad. The first thing is you have to have a
vulnerability assessment. You have to know what your security
posture is. Second, we believe in the defense-in-depth
approach. It is vital. There is no single solution to make your
system secure. You have to have layered approachs that
complement each other.
The next thing, training is the key. As the earlier
witnesses said, there are good people out there, but they just
do not understand security. One of the key things to recognize
is the solution that works today may not work in 6 months. You
will never have a final solution. You are constantly
reassessing.
Thank you for your time.
[The prepared statement of Mr. Gerretson follows:]
[GRAPHIC] [TIFF OMITTED] T7018.137
[GRAPHIC] [TIFF OMITTED] T7018.138
[GRAPHIC] [TIFF OMITTED] T7018.139
[GRAPHIC] [TIFF OMITTED] T7018.140
[GRAPHIC] [TIFF OMITTED] T7018.141
[GRAPHIC] [TIFF OMITTED] T7018.142
Mr. Horn. Thank you very much.
We now have our second witness, Mr. Mark Rasch, who is the
senior vice president and Legal Counsel for the Global
Integrity Corp. Perhaps you would like to tell us a little bit
about the corporation.
Mr. Rasch. Yes, thank you, Mr. Chairman.
I work for Global Integrity Corp. It is a company that does
information security consulting work for the private sector.
So, our clients tend to be things like banks, insurance
companies, Fortune 100 companies that take the problem of
information protection. Notice I used the term ``information
protection'' and not computer security. They take that problem
seriously.
What we are trying to protect here is not the computers
themselves, but the information that is contained on those
computers. So, the perspective that I bring is what the private
sector sees as the problem and what the private sector is
trying to do itself to try to solve the problem. One of the
things we noticed is that the Commerce Department issued a
report in the last couple of days that indicates that U.S.
retail e-commerce sales for the fourth quarter of 1999, that is
October through December, was about $5.3 billion.
What has happened is this Internet that we created 20 years
ago is being asked to do something that it was never designed
to do. That is to support a national economy; to support a
national infrastructure that it was never designed to do. So,
what happens is we have this distributed computer network,
which was essentially unsecured. All of the security to that
network is essentially added afterwards.
That is being designed now and being asked to protect the
critical infrastructure. The attacks that we saw a few weeks
ago against Yahoo, Ebay, and others also demonstrated another
problem. As a lawyer, this is one that concerns me much more
than what concerned me about the year 2000 bug problem, from a
litigation standpoint. That is that we are only as secure as
everybody else on the Internet.
As the previous panel discussed, these are targets of
opportunity. People attack systems because they can get in.
They attack the ones that they feel that they can get into.
Also, the fact that even if you have done stuff to harden your
system, people will break into other people's systems and use
those to attack you. So, what we have is a serious looming
litigation problem, or what we would call downstream liability.
If you are attacked by somebody and the attack is coming
from another corporation that did not secure the systems, and
you go to your lawyer and ask, can we sue, which is always the
dumbest question to ask a lawyer because the answer is always
yes. The question is who are you going to sue, the 17- or 18-
year-old hacker, if they are ever identified, or the
corporation from whom you are attacked?
So, the idea of a worldwide web that is dependent upon the
security of everybody else creates targets of opportunities,
not just for hackers, but for lawyers as well. One of the
problems also that we have seen is a massive increase, not only
in the use of the Internet and the use of the Internet for
electronic commerce, but of these types of criminal activity.
For example, from 1998 to 1999, theft of intellectual
property increased from 15 percent. Unauthorized access by
hackers from inside is up 28 percent. Insider abuse to the
Internet is up 17 percent. System penetration by external
parties increased 32 percent. Why is this happening? The first
reason is that attack technologies are becoming very easy to
use. So, as Mr. Gerretson just showed, you can go to any hacker
convention, pick up a copy of this disk, put it in your
machine, and knowing no more than a lawyer, which is a fairly
low standard I would say, put this in your machine and launch
an attack on any computer on the Internet.
You do not need to know a lot. It is point and click and
you are in. So, the tools are getting easier to use. They are
becoming more widely available. In addition, with the growth of
the Internet, you have tens of thousands and probably of
millions of insecure computers out there that are used as
targets of opportunity and methods of attack. The software is
becoming increasingly complex and much more difficult to
secure.
Software manufactures who are building this software are
trying to design it to be functional. If you are coming out
with a new word processing program or you are trying to come
out with a new operating system, and you are under competitive
pressures to get it out to market, you want to make sure that
it is functional. Until companies demand security and the
government demands security as an integral part of
functionality, I do not think the manufacturers are going to
ship these things as being at least more secure.
So, these are some of the problems. What is the private
sector doing? Well, speaking just for Global integrity, we are
doing two things working with the financial services industry,
which I think is a model for both the government and for other
private sector enterprises. One of them is something called the
BITS Laboratory that we are working with the Banking Industry
Technology Secretariat and a consortium of banks.
What they are doing is they are developing a series of
security standards. We at Global, are testing computer
products, hardware, software, and other types of products,
against the security criteria. The idea is that the marketplace
then will say, for example, banks will say unless your software
had been tested against these criteria, we will not buy it.
Unless it is pre-configured to be in a secured manner, we will
not buy it.
So, we are using the marketplace as a method of trying to
ensure security. The second thing is the Financial Services
Information Sharing and Analysis Center [FSISA]. This is
something that we are doing. Financial services industries,
banks, insurance companies, and the like have a secure method
of sharing information amongst themselves about attacks and
vulnerabilities.
Let us face it, they do not want to tell people that they
have been attacked, but they are happy to share information
among themselves, if that will lead to more security. These are
some of the models that are currently in place. We need to do
more in the private sector and in the government sector to help
secure the infrastructure.
Thank you.
[The prepared statement of Mr. Rasch follows:]
[GRAPHIC] [TIFF OMITTED] T7018.143
[GRAPHIC] [TIFF OMITTED] T7018.144
[GRAPHIC] [TIFF OMITTED] T7018.145
[GRAPHIC] [TIFF OMITTED] T7018.146
[GRAPHIC] [TIFF OMITTED] T7018.147
[GRAPHIC] [TIFF OMITTED] T7018.148
[GRAPHIC] [TIFF OMITTED] T7018.149
[GRAPHIC] [TIFF OMITTED] T7018.150
[GRAPHIC] [TIFF OMITTED] T7018.151
[GRAPHIC] [TIFF OMITTED] T7018.152
[GRAPHIC] [TIFF OMITTED] T7018.153
Mr. Horn. Thank you very much.
Our next witness and the last one on this panel is Mr.
James Adams, chief executive officer of iDEFENSE.
Mr. Adams. Chairman Horn and members of the committee, I
want to thank you very much for inviting me here today. Few
revolutions are accomplished without bloodshed. Already as we
plunge headlong into the knowledge age, we are beginning to
receive the initial casualty reports from the front lines of
the technology revolution.
From the headlines, you would think that the recent denial-
of-service attacks were the beginning of the end of cyber world
as we know it. Nothing could be further from the truth. These
were mere in-breaks on the audio-V commerce. Consider instead
that some 30 countries have aggressive, offensive information
warfare programs. All of them have America firmly in their
sights.
Consider too that if you buy a piece of hardware or
software from several countries, among them, some of our
allies, there is real concern that you will be buying doctored
equipment. It will syphon copies of all material that passes
across that hardware or software back to the country of
manufacture.
The hacker today is not just the stereo-typical computer
geek with a grudge against the world. The serious hacker today
is much more likely to be in the employ of government, big
business, or organized crime. Consider the band of Russian
hackers who, over the past 2 years, have syphoned off an
enormous amount of research and development secrets from United
States corporate and government entities in an operation code
named Moonlight Mays television.
I would like to focus on this nexus between the public and
private sectors, and on the government's efforts to respond to
the growing threat. A couple of illustrations to begin; 20
years ago, some 70 percent of all technology development was
funded by the public sector. Today, that figure is under 5
percent. In other words, in the course of one generation, every
government agency should have changed how it does business.
Has that happened? No. Looking ahead for that same 20-year
period, we will see the following. The ordinary computer that
you have on your desk will have the computing capacity of the
human brain. At the same time, research offers the possibility
of our ability to manufacture perfectly the human body. So, in
the course of a generation, our view of life, death, family,
society, and culture, the bed rocks of our way of life down
this century will have changed forever.
Is government or the private sector thinking and planning
for such fundamental change? No. One further point; the pace of
the revolution is accelerating rapidly. Yet, the pace of change
within government seems to be exactly the same today as it was
10 years ago. How has the government responded so far? Well,
there has been the usual President's Commission and then the
Principal's Working Group, then the bureaucratic compromise
that nobody really wanted, and then the national plan which
arrived 7 months late and was not a plan at all, but an
invitation to further discussion.
[Chart shown.]
Mr. Adams. These two charts that I brought today illustrate
the current chaos. What you see is a totally disorganized
organization chart. One that, if it were in the private sector,
would be a sign of eminent bankruptcy. You see no clear
leadership. You see duplication of efforts; the waste of
billions of dollars of taxpayers' money, and the struggle by
stovepipe agencies to retain power, influence, and money.
In other words, there is no coherent strategy and the
tactics are not about winning a war, but about preserving turf.
There are, of course, some notable exceptions to this. You have
heard from one of them today, John Tritak. What is needed today
is an outside entity with real power to implement drastic
change in the way government approaches technology and the
underlying security of its systems.
What is needed most is a personal entity that would draw on
skill sets in many areas that will overlap those of the CIO,
CFO, or CSO, and most of the other officers or entities in any
organization. Let us give this new person the title of chief of
business assurance. He or she would be in charge of the Office
of Business Assurance. Business assurance is more than
security, more than technology, and more than a combination of
the two.
It is an understanding of the whole environment and what
that means for a business or a public sector operation. The
CBA's task would be to continuously gather and synthesize
infrastructure-related trends and events to intelligently
evaluate the technological context within which the
organization operates, to identify and assess potential
threats, and then to suggest defense action.
Viewed from the positive side, to assess the technological
revolutions' opportunities and propose effective offensive
strategies. The Office of Business Assurance must be a totally
independent organization with real teeth and real power within
government. There is much in common between government and
industry when it comes to the challenges and the opportunities
that the technology revolution poses.
Both sectors face a common threat. Both sectors share
common goals. Both employ technologies that are, in essence,
identical. Both must work together to protect each other. I
will leave you with this thought. You will employee total
transformations of the way business and government is conducted
internally and externally going forward. We have heard a great
deal in recent months about the potential of a digital divide
that is developing between the computer-haves and the computer-
have-nots.
I believe there is another digital divide that is growing
between the American Government and its citizens. If this
committee's efforts do not move forward in changing this
culture inertia, there is real danger that the digital divide
that exist between the government and the private sector will
only widen. We cannot afford a situation where the governed
feel that their government is out of touch and increasingly
irrelevant to their lives.
Thank you.
[The prepared statement of Mr. Adams follows:]
[GRAPHIC] [TIFF OMITTED] T7018.154
[GRAPHIC] [TIFF OMITTED] T7018.155
[GRAPHIC] [TIFF OMITTED] T7018.156
[GRAPHIC] [TIFF OMITTED] T7018.157
[GRAPHIC] [TIFF OMITTED] T7018.158
Mr. Horn. Thank you. All three of you have made some really
excellent suggestions. Let me start some of this query. Let me
note that, Mr. Rasch, you were very active before you took your
current job. You were a trial attorney with the Fraud Section
of the Criminal Division of the U.S. Department of Justice. You
left the Department in 1991. You were the sole attorney in the
Computer Crime Unit. That was on a part-time basis.
The Computer Crime and Intellectual Property Section of the
Department of Justice today consist of 18 attorneys. The
Internet consisted of perhaps 60,000 computers. Then you have
made some very thoughtful things. Let me pursue this. I turned
to Mr. Ryan, the counsel to the subcommittee, when you were
testifying. I said, let us draft a bill that would make this
simply illegal.
Now, how does the Justice Department, what does it use to
be able to get after hackers now? What laws? Do you need new
legislation which would ban them and get those out of here?
Mr. Rasch, the principal statute that exist to prosecute
Federal computer crimes is 18 U.S.C. Section 1030, which is the
Federal computer crimes statute. That focuses on activities.
For example, intentionally accessing a computer without
authorization or disrupting authorized access to a computer.
So, for example, the recent attacks and the denial-of-service
attacks squarely come within the ambit of that statute and are
being aggressively investigated and could be prosecuted under
that.
Mr. Horn. Is there any first amendment concerns on this?
Mr. Rasch. Probably not. This is action and not speech.
Although just as burning down a building may be an expression,
it is certainly is not a protected expression. There are some
first amendment concerns in the area of encryption and some
legislation. There is some case law on the question of whether
or not software itself acts as a form of expression. That
relates to these type of hacker tools.
The dissemination of hacker tools themselves; whether or
not that type of dissemination is criminal. There are really
two separate statutes that could be used there. One is the
Digital Millennium Copyright Act which passed last year, which
is right now being used in a civil lawsuit against the people
who attempted to reverse-engineer the DVD codes to allow them
to pirate software and things like that.
So far, it has withstood a challenge on Constitutional
grounds. The second one would be 18 U.S.C. Section 1029 which
makes it illegal to disseminate what are called access devices,
which could be such things as passwords and things like that.
Mr. Horn. Any comments on those?
Mr. Adams. I think you raise an interesting, Chairman. I
would just make this in addition to what Mark was saying. There
has been a great deal of focus on law enforcement. Of course,
law enforcement has a prominent role to play in this. The speed
of the revolution is such that, that is very much after the
fact, obviously. An event has occurred. We failed and therefore
we have to do something about it.
By the time somebody is caught and prosecuted, the
revolution has moved several steps forward. So, we need to
think about what does the prevention look like in the globally
virtual environment in which we find ourselves. Then if that
fails, of course you need something to follow that up. The
first step has to be a much more comprehensive approach to
prevention, warning, intentions, good intelligence, and so on.
Mr. Horn. At this point, I am going to turn the Chair over
to the vice chairwoman, Mrs. Biggert, the gentle woman from
Illinois. I, unfortunately, have other commitments that I have
got to do. I want Mr. Turner and Mrs. Biggert to get all of the
questions out that they can. So, thank you particularly for
functioning and coming here.
Mrs. Biggert [presiding]. Mr. Turner, you are recognized
for questions.
Mr. Turner. Mr. Adams, you were showing us your two charts
here, which I guess were designed to display the multitude of
efforts within various Federal agencies to deal with
information system security. Rather than look at that as a
failed effort, I guess it shows that every agency is struggling
to try to keep up with the problem.
There are obviously some things that we ought to do to
consolidate the effort. This battle is so dependent upon
technical expertise. One of the battlefields where we should be
fighting on is to figure out how to train people to work for
the good guys. There are probably people within these Federal
agencies that are noted to be outstanding technical experts
that do good work in trying to find solutions and trying to
make the systems secure.
Are we going to be constantly behind the curve in terms of
what government does? I think it is probably difficult to
attract the best and the brightest to the public sector. I am
sure that Global Integrity and others of the world are going to
be reaching out and trying to pay the salaries necessary to
attract the people who could really create the defensive
mechanisms you need.
Mr. Adams. I think those are very good points. We clearly
face a very difficult dilemma. The government is at the front
line here, as is the private sector. The private sector, my
largest number of recruits come from government agencies. The
private sector is hiring the best and the brightest and moving
forward very quickly. Clearly, there needs to be a relationship
between the public and private sector. Look, for example, at
what the CIA is doing to try and keep itself up to speed with
the pace of technology change.
It is doing that by establishing essentially a venture
capital arm that is the interface between the public and
private sector. So, you have that on the one hand; different
ways of doing it. On the other hand, something that the Federal
Government can do dramatically different is push education into
the system, so that what we are doing is seeding the next
generation and the generation after that to keep itself up to
speed.
The Federal Government is going to be an enabler. It is not
going to be able to mandate very much. This revolution is
occurring outside of its orbit. So, it can do a lot of things
to influence it. It needs to, I think, do that more creatively
so that it is seeding the population. We have tremendous
shortages of skills at the moment in the whole area of
computers, and computer security, information security, and so
on.
So, how to tackle that more creatively and aggressively is
going to be a very important issue which is partly where it all
comes back to leadership. You need to have a more creative and
push-through process than we have at the moment.
Mr. Turner. If you were to have a free hand at creating an
entity that would do that, what would it look like?
Mr. Adams. Well, I think what the lesson we have learned in
this revolution from the private sector is that if you take an
old economy company and you try and transition it to the new
economy, this will largely fail. What you have to do is do the
Apple Computer model. You setup a new building, different
people, and put a pirate flag on the roof. They developed a
culture and they forced something else into the system, which
is why this idea of a Business Assurance, some sort of entity
that sits outside of the Federal Government that is able to
communicate effectively with the private sector and with the
public sector and force through change.
What those charts illustrate is, as you rightly say, lots
of people try to fix it. These are people of good will, by and
large. They are unable to move collectively aggressively
enough. They are falling further and further behind in the
revolution, which is this disconnect. It is very dangerous in a
democracy. So, if you can have a way of driving through change,
something with real power, the Koskinen model, but with muscle,
not just please will you all sit around the table.
If you do not do this, you will be held accountable for
failure. That is something where there is an opportunity
perhaps because it is the private sector that has the expertise
and the energy. That is going to continue to be the case. That
is just going to be a fact of life. So, much better to try and
figure out a way to bridge that gulf, rather than say, well, we
can actually fix it all ourselves. It is all about a
partnership between the private and the public sector, making
that work and then driving it into the public sector.
That is the trick for you all to try and come up with a way
of creating something very muscular that will force change,
rather than saying, well, let us get around to it in another
couple of years. Too late.
Mr. Turner. Although we obviously have to let the CIA do
their own thing, would that kind of model work for the rest of
government?
Mr. Adams. I think it is too early to say at the agency.
Clearly, what we know is that they are bringing some
interesting technology back into the system. The problem comes
then is this is a voluntary exercise. We found this really cool
stuff. We think you should use it. Can the culture be forced to
change? The CIA is a very inert bureaucracy like a lot of
government agencies. Will that drive it through?
I think it is an interesting model in creating the place
for dialog, but it is a difficult challenge. For example, there
is a government agency that is currently revising its ways of
procuring things, trying to keep on the front of technology. It
feels that it is making a big step forward by doing changes in
2 years; design and implementation in a couple of years. My
company is not into design and implementation in 90 days. I
cannot afford to do it because I am losing market share.
So, how do you change that culture to a place which is much
more reflective of what is happening in the private sector? It
is a very difficult challenge. It has to, I think, have
somebody. You are talking about very big picture stuff here;
billions, and billions, and billions of dollars, where you have
a single entity that says you do this my way or it is not going
to happen; so forcing it.
This is very counter-culture to the way governments
traditionally work. One of the great strengths of democracy and
the great strength of government entities is that they slowly
evolve. They move forward to match a pace. Well, in a
revolution that is very hard because you cannot afford to
evolve in the same way. You have to either become a
revolutionary or you get swept away. We have seen examples of
that throughout history.
That is why this is both a dangerous and a very challenging
time; dangerous because it can threaten the institutions that
provide stability, but a tremendous opportunity for America as
the leading Nation in the world to move with the revolution,
embrace it, and drive it forward. The government and the
private sector have to come together somehow to make that so.
Mr. Turner. Thank you.
Mrs. Biggert. Thank you. Mr. Gerretson and probably Mr.
Rasch, how vulnerable are home computer users? You mentioned
that the whole Internet is only as secure as the most
vulnerable link. Then after that, if after they surf the web
and turn off their modems, are there still risks to the system?
Mr. Gerretson. I will take the first shot at that. The
first answer is if you are on a dial-up modem, you are
vulnerable while you are connected. Cable modems and DSL are
widely becoming available now. They are always on. I run a
private network at my house. I have a firewall. Every night I
have probably six to eight of what I call drive by shootings
where somebody comes and just tries out my system to see if
they can get a hold of it.
The answer is they are very vulnerable. There is very
little protection on them because it sits on there. Without
that firewall, I probably would have been one of what they call
the zombie machines attacking Yahoo and would have never known
it. As the cable modems and the DSLs get more and more
ubiquitously available, it is a huge problem.
Mr. Rasch. I would mirror that. We did a study at Global
where we left a cable modem on at a home PC and simply tested
it to see how many times, without a firewall deliberately, to
test to see how many times it was attempted to be attacked. We
found that in 1 month, almost 6,000 attempted attacks on a home
PC.
What was interesting about that study, however, was the
fact that these attacks were coming from Eastern Europe, from
Africa, from Asia, as well as from the United States. So, these
are coordinated concerted attacks on any computer that they can
find on the Internet. That would include home PCs in the
always-on mode; particularly, those on DSL connections or cable
models.
Mrs. Biggert. So, in theory, these really then could lead
you into, let us say, a Federal agency through those computers?
Mr. Rasch. Absolutely.
Mr. Gerretson. That is right.
Mrs. Biggert. OK. Then we talked in the first hearing about
this chart with the yellow bubbles at the top and sides
representing the executive branch, and then those organizations
that also have a stake-hold in the Federal computer security.
[The information referred to follows:]
[GRAPHIC] [TIFF OMITTED] T7018.159
Mrs. Biggert. So, to me, it looks very similar to your
chart, Mr. Adams. The problem is that we have kind of a blank
in the middle. So, would you all agree that we need an outside
coordinator to be in control of this to coordinate all of our
efforts?
Mr. Gerretson. Well, ma'am, I would say that my first
question when I saw this chart and I was talking to Mr. Ryan
about this is, who is coordinating the coordinators? It seems
to be somewhat disorganized. I would like to make one little
statement about that. The one advantage that the Federal
Government has is that they know they are screwed up. We do a
lot of commercial work.
If you get outside of the IA Groups, they do not even know
they are in trouble. So, yes, you are lagging behind, in some
cases, but, at least you know you are lagging behind. That is
kind of contrary in view, but there are advantages to what you
are doing. This is a problem.
Mr. Rasch. What I see as the problem is a definition of
function. What we really need somebody to do is to say, not so
much just coordinate the efforts, but say, alright, testing.
That is NIST. For developing new technologies, that is somebody
else. Basically, not so much coordinating, but defining who has
what roles. One of the things that happened with the
development of the Computer Emergency Response Team at Carnegie
Mellon, the CERT Team, it was a wonderful idea, and remains a
wonderful idea, and works very well.
Now, we have dozens, and dozens, and dozens of computer
emergency response teams. The problem with that is it is like
living in a town that has 20 different 911 numbers. So, you run
into a problem of who are you going to call. So, you need to
really define the functions first and then decide who is going
to coordinate between and among those functions.
Mrs. Biggert. This has been very interesting. Obviously,
you have heard the bells. We have another vote. So, I think
that we will have to adjourn at this time. We will be having
several more hearings. I know that we will be pursuing this
more in-depth. I agree with you that we are behind and we need
to look at this problem. I think that this has been a great
start for this committee. So, I really appreciate you all
participating and look forward to asking more questions of you,
I am sure, in the future when we get into this.
So, without more, this committee hearing is adjourned.
[Whereupon, at 12:05 p.m., the subcommittee was adjourned.]
-