[House Hearing, 110 Congress]
[From the U.S. Government Publishing Office]
FEDERAL IT SECURITY: A REVIEW OF H.R. 4791
=======================================================================
JOINT HEARING
before the
SUBCOMMITTEE ON INFORMATION POLICY,
CENSUS, AND NATIONAL ARCHIVES
and the
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
ORGANIZATION, AND PROCUREMENT
of the
COMMITTEE ON OVERSIGHT
AND GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED TENTH CONGRESS
SECOND SESSION
ON
H.R. 4791
TO AMEND TITLE 44, UNITED STATES CODE, TO STRENGTHEN REQUIREMENTS FOR
ENSURING THE EFFECTIVENESS OF INFORMATION SECURITY CONTROLS OVER
INFORMATION RESOURCES THAT SUPPORT FEDERAL OPERATIONS AND ASSETS, AND
FOR OTHER PURPOSES
__________
FEBRUARY 14, 2008
__________
Serial No. 110-72
__________
Printed for the use of the Committee on Oversight and Government Reform
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
http://www.oversight.house.gov
U.S. GOVERNMENT PRINTING OFFICE
44-178 PDF WASHINGTON DC: 2008
---------------------------------------------------------------------
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092104 Mail: Stop IDCC, Washington, DC 20402�090001
COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM
HENRY A. WAXMAN, California, Chairman
EDOLPHUS TOWNS, New York TOM DAVIS, Virginia
PAUL E. KANJORSKI, Pennsylvania DAN BURTON, Indiana
CAROLYN B. MALONEY, New York CHRISTOPHER SHAYS, Connecticut
ELIJAH E. CUMMINGS, Maryland JOHN M. McHUGH, New York
DENNIS J. KUCINICH, Ohio JOHN L. MICA, Florida
DANNY K. DAVIS, Illinois MARK E. SOUDER, Indiana
JOHN F. TIERNEY, Massachusetts TODD RUSSELL PLATTS, Pennsylvania
WM. LACY CLAY, Missouri CHRIS CANNON, Utah
DIANE E. WATSON, California JOHN J. DUNCAN, Jr., Tennessee
STEPHEN F. LYNCH, Massachusetts MICHAEL R. TURNER, Ohio
BRIAN HIGGINS, New York DARRELL E. ISSA, California
JOHN A. YARMUTH, Kentucky KENNY MARCHANT, Texas
BRUCE L. BRALEY, Iowa LYNN A. WESTMORELAND, Georgia
ELEANOR HOLMES NORTON, District of PATRICK T. McHENRY, North Carolina
Columbia VIRGINIA FOXX, North Carolina
BETTY McCOLLUM, Minnesota BRIAN P. BILBRAY, California
JIM COOPER, Tennessee BILL SALI, Idaho
CHRIS VAN HOLLEN, Maryland JIM JORDAN, Ohio
PAUL W. HODES, New Hampshire
CHRISTOPHER S. MURPHY, Connecticut
JOHN P. SARBANES, Maryland
PETER WELCH, Vermont
------ ------
Phil Schiliro, Chief of Staff
Phil Barnett, Staff Director
Earley Green, Chief Clerk
David Marin, Minority Staff Director
Subcommittee on Information Policy, Census, and National Archives
WM. LACY CLAY, Missouri, Chairman
PAUL E. KANJORSKI, Pennsylvania MICHAEL R. TURNER, Ohio
CAROLYN B. MALONEY, New York CHRIS CANNON, Utah
JOHN A. YARMUTH, Kentucky BILL SALI, Idaho
PAUL W. HODES, New Hampshire
Tony Haywood, Staff Director
Subcommittee on Government Management, Organization, and Procurement
EDOLPHUS TOWNS, New York, Chairman
PAUL E. KANJORSKI, Pennsylvania BRIAN P. BILBRAY, California
CHRISTOPHER S. MURPHY, Connecticut TODD RUSSELL PLATTS, Pennsylvania,
PETER WELCH, Vermont JOHN J. DUNCAN, Jr., Tennessee
CAROLYN B. MALONEY, New York
Michael McCarthy, Staff Director
C O N T E N T S
----------
Page
Hearing held on February 14, 2008................................ 1
Text of H.R. 4791................................................ 5
Statement of:
Evans, Karen S., Administrator for Electronic Government and
Information Technology, Office of Management and Budget;
Gregory C. Wilshusen, Director, Information Security
Issues, Government Accountability Office; Alan Paller,
director of research, the Sans Institute; Bruce W.
McConnell, president, McConnell International, LLC; and Tim
Bennett, president, Cyber Security Industry Alliance....... 23
Bennett, Tim............................................. 93
Evans, Karen S........................................... 23
McConnell, Bruce W....................................... 82
Paller, Alan............................................. 65
Wilshusen, Gregory C..................................... 33
Letters, statements, etc., submitted for the record by:
Bennett, Tim, president, Cyber Security Industry Alliance,
prepared statement of...................................... 96
Clay, Hon. Wm. Lacy, a Representative in Congress from the
State of Missouri, prepared statement of................... 3
Davis, Hon. Tom, a Representative in Congress from the State
of Virginia:
Letter dated July 27, 2007............................... 104
Prepared statement of.................................... 108
Evans, Karen S., Administrator for Electronic Government and
Information Technology, Office of Management and Budget,
prepared statement of...................................... 26
McConnell, Bruce W., president, McConnell International, LLC,
prepared statement of...................................... 84
Paller, Alan, director of research, the Sans Institute,
prepared statement of...................................... 67
Wilshusen, Gregory C., Director, Information Security Issues,
Government Accountability Office, prepared statement of.... 35
FEDERAL IT SECURITY: A REVIEW OF H.R. 4791
----------
THURSDAY, FEBRUARY 14, 2008
House of Representatives, Subcommittee on
Information Policy, Census, and National
Archives, joint with the Subcommittee on
Government Management, Organization, and
Procurement, Committee on Oversight and
Government Reform,
Washington, DC.
The subcommittees met, pursuant to notice, at 11:30 a.m.,
in room 2154, Rayburn House Office Building, Hon. Wm. Lacy Clay
(chairman of the Subcommittee on Information Policy, Census,
and National Archives) presiding.
Present: Representatives Clay, Davis of Virginia, and
Platts.
Staff present from the Information Policy, Census, and
National Archives Subcommittee: Darryl Piggee, staff director/
counsel; Jean Gosa, clerk; and Adam Bordes, professional staff
member.
Staff present from the Government Management, Organization,
and Procurement Subcommittee: Mike McCarthy, staff director;
Velvet Johnson, counsel; Bill Jusino, professional staff
member; and Kwane Drabo, clerk.
Mr. Clay. Good morning. This hearing of the Oversight and
Government Reform Committee is being held this morning by the
Information Policy, Census, and National Archives Subcommittee,
which I chair, and the Subcommittee on Government Management,
Organization, and Procurement, chaired by Congressman Ed Towns
of New York, who is under the weather this week and is not in
town. But we will proceed without Mr. Towns.
This hearing will now come to order. Today's hearing will
examine the important topic of Federal information security.
Our subcommittees are holding this hearing because security is
both a management and technology challenge.
Without objection, the Chair and ranking minority member
will have 5 minutes to make opening statements, followed by
opening statements not to exceed 3 minutes by other Members who
wish to seek recognition.
Without objection, Members and witnesses may have 5
legislative days to submit a written statement or extraneous
materials for the record.
Briefly, I would like to discuss some of the challenges
that I see, and then I will yield to anyone else that shows up
for comments.
Let me say that today's joint subcommittee hearing on the
Current State of Federal Information Security and Legislation
to Strengthen the Federal Information Security Management Act,
I am especially pleased to be teaming up with the Subcommittee
on Government Management, Organization, and Procurement,
chaired by Mr. Towns, for this critical issue.
For fiscal year 2009, the President's budget proposes
spending of roughly $70 billion on information technology
products alone. Yet according to OMB's 2006 FISMA report to
Congress, agency efforts to implement effective information
security programs are inconsistent throughout Government. These
problems go beyond isolated data breaches and have exposed
systemic information security vulnerabilities that have gone
unmitigated by our agencies and the IT contracting community
that serves them.
Having experienced 5 years of detailed OMB reporting
through the FISMA process, I am certain that some real progress
has been made in securing our agencies' IT assets. What I am
unsure of, however, is whether our current requirements and OMB
policies under FISMA are providing us enough tools to effective
identify the inherent vulnerabilities in our systems, now or in
the future.
With this in mind, I, along with Chairman Towns and
Chairman Waxman, have put forward a bill that would move us
toward more rigid security requirements for agency systems
while staying with in the current FISMA framework. Furthermore,
our bill will add consistency and robustness to the current
program performance evaluation process by requiring an annual
audit of agency programs. Last, this legislation begins to
recognize the duty of care responsibilities that must be shared
between both Federal agencies and the contracts providing
services to them.
As technology evolves and the perimeters of IT enterprises
expand, we must have a flexible security framework to harness
such advances while ensuring that our networks remain secure. I
am hopeful that our witnesses today will be ale to address
these issues through the context of their experiences, and I
look forward to their testimony.
[The prepared statement of Hon. Wm. Lacy Clay and the text
of H.R. 4791 follow:]
[GRAPHIC] [TIFF OMITTED] T4178.001
[GRAPHIC] [TIFF OMITTED] T4178.002
[GRAPHIC] [TIFF OMITTED] T4178.003
[GRAPHIC] [TIFF OMITTED] T4178.004
[GRAPHIC] [TIFF OMITTED] T4178.005
[GRAPHIC] [TIFF OMITTED] T4178.006
[GRAPHIC] [TIFF OMITTED] T4178.007
[GRAPHIC] [TIFF OMITTED] T4178.008
[GRAPHIC] [TIFF OMITTED] T4178.009
[GRAPHIC] [TIFF OMITTED] T4178.010
[GRAPHIC] [TIFF OMITTED] T4178.011
[GRAPHIC] [TIFF OMITTED] T4178.012
[GRAPHIC] [TIFF OMITTED] T4178.013
[GRAPHIC] [TIFF OMITTED] T4178.014
[GRAPHIC] [TIFF OMITTED] T4178.015
[GRAPHIC] [TIFF OMITTED] T4178.016
[GRAPHIC] [TIFF OMITTED] T4178.017
[GRAPHIC] [TIFF OMITTED] T4178.018
[GRAPHIC] [TIFF OMITTED] T4178.019
[GRAPHIC] [TIFF OMITTED] T4178.020
Mr. Clay. We will now receive testimony from the witnesses
before us today. On today's panel, the subcommittees are
pleased to have the following witnesses: Karen Evans,
Administrator for the Office of E-Government and Information
Technology. Ms. Evans is an experienced IT professional and
leads the administration's programs on information security.
Welcome back to the committee, Ms. Evans.
We also have Greg Wilshusen, Director for Information
Security Issues at the Government Accountability Office. Mr.
Wilshusen is also a long-time expert and has testified on this
topic before the Information Policy Subcommittee several times.
Thank you for being here.
Alan Paller is the director of research at the SANS
Institute and is responsible for overseeing all research
projects. Mr. Paller founded the CIO Institute and earned
degrees in computer science and engineering from Cornell and
MIT. Welcome to the committee hearing.
Bruce McConnell, the president and founder of McConnell
International. Prior to his current position, Mr. McConnell was
chief of information and technology policy at the White House
Office of Management and Budget, where he led several IT and
security initiatives. Thank you for being here, too, Mr.
McConnell.
Rounding us out is Tim Bennett, president of Cyber Security
Industry Alliance. Mr. Bennett served as the vice VP of the
American Electronics Association and worked in senior roles
within the Office of the U.S. Trade. Thank you also, Mr.
Bennett, for coming today.
I thank all of you for appearing before the subcommittee.
It is the policy of the committee to swear in all witnesses
before they testify, so I will ask you to please rise and raise
your right hands.
[Witnesses sworn.]
Mr. Clay. Thank you, and let the record reflect that the
witnesses answered in the affirmative.
I ask that each witness now give a brief summary of their
testimony and to keep the summary under 5 minutes in duration.
Bear in mind your complete written statement will be included
in the hearing record. I will let you know if you go over the
5. We will start with Ms. Evans. You may proceed.
STATEMENTS OF KAREN S. EVANS, ADMINISTRATOR FOR ELECTRONIC
GOVERNMENT AND INFORMATION TECHNOLOGY, OFFICE OF MANAGEMENT AND
BUDGET; GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION SECURITY
ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE; ALAN PALLER, DIRECTOR
OF RESEARCH, THE SANS INSTITUTE; BRUCE W. MCCONNELL, PRESIDENT,
MCCONNELL INTERNATIONAL, LLC; AND TIM BENNETT, PRESIDENT, CYBER
SECURITY INDUSTRY ALLIANCE
STATEMENT OF KAREN S. EVANS
Ms. Evans. Good morning, Chairman Clay. Thank you for
inviting me to speak about the status of the Federal
Government's efforts to safeguard our information and systems.
My remarks today will highlight a few of the initiatives
underway to manage the risk associated with our Government
services in this ever-changing IT environment. The details are
included in my written statement. I will conclude with our
thoughts on your proposed bill, H.R. 4791.
Information security and privacy are extremely important
issues for the administration. On March 1st, the Office of
Management and Budget [OMB], will provide our fifth annual
report to Congress on the implementation of the Federal
Information Security Management Act [FISMA], which will detail
our improvements and remaining weaknesses for both security and
privacy.
Over the past year, departments and agencies continue to
improve their security programs, manage their risks and become
more fully compliant with FISMA. To enhance information
security programs, OMB continues to use the oversight
mechanisms to improve performance, including the President's
management agenda score card and the agencies' capital planning
processes. We are also engaging agencies in a variety of
information security and privacy initiatives to close any
remaining performance gaps.
Over the past year, in collaboration with the National
Institute for Standards and Technology [NIST], the Department
of Defense, the National Security Agency, and Microsoft, we
have developed a set of information security controls to be
implemented on all Federal desktops, which are running
Microsoft Windows XP or Vista, known as the Federal Desktop
Core Configuration [FDCC]. By implementing a common
configuration, we are gaining better control of our Federal
desktops, allowing for closer monitoring and correction of
potential vulnerabilities. We are also working with the vendor
community to make their applications safer.
NIST has developed testing tools for use both by the
Federal agencies and the vendors and three independent
laboratories have been accredited by NIST's National Voluntary
Laboratory Accreditation Program, to provide the validation
testing. We are very optimistic this program will greatly
enhance the security of our Federal desktops and applications.
To help agency procurement officers with the validation
requirement, we are working with the Federal Acquisition
Council to incorporate language into the Federal Acquisition
Register. Agencies connect to the internet to develop timely
information and to deliver services to the public. However, our
Government systems are continuously operating under increasing
levels of risk. Through the Trusted Internet Connections
Initiative, we are working with agencies to reduce the overall
number of external Federal connections to manage risk in a more
cost-effective and efficient manner, while providing better
awareness of our environment. Agencies turned in plans of
action and milestones to fully optimize agency connections with
a target completion date of June 2008.
Recently, we provided the opportunity for all departments
and agencies to review the proposed legislation, H.R. 4791. The
bill contains several provisions which aim to enhance the
protection of Federal information and personally identifiable
information, as well as several provisions that propose changes
to FISMA. While we strongly support enhancing protections for
such information, we share several concerns expressed across
the Federal agencies about the effect of this legislation.
The administration believes the foundation and the
framework established by FISMA is sound and also believes there
is still much we can accomplish to improve the security and
manage the risk associated with our information and information
services. Nonetheless, we are concerned with the unintended
consequences of the proposed change which would seriously
impact established agency security and privacy practices, while
not necessarily achieving the outcomes of improved privacy or
security.
While we understand technologies which are improperly
implemented introduce increased risk, we recommend any
potential changes to the statute be technology-neutral. We
recognize that the IT landscape is ever-changing. As we deploy
common, Government-wide solutions, departments and agencies
increasingly are requiring services instead of procuring
infrastructure.
We welcome the opportunity to further discuss potential
gaps which may need to be addressed through future FISMA
enhancements if appropriate. We look forward to discussing our
ongoing information security and privacy activities in greater
detail. We feel our current activities and initiatives as
included in my written statement already are beginning to close
performance gaps H.R. 4791 attempts to address.
I would be happy to answer questions at the appropriate
time.
[The prepared statement of Ms. Evans follows:]
[GRAPHIC] [TIFF OMITTED] T4178.021
[GRAPHIC] [TIFF OMITTED] T4178.022
[GRAPHIC] [TIFF OMITTED] T4178.023
[GRAPHIC] [TIFF OMITTED] T4178.024
[GRAPHIC] [TIFF OMITTED] T4178.025
[GRAPHIC] [TIFF OMITTED] T4178.026
[GRAPHIC] [TIFF OMITTED] T4178.027
Mr. Clay. Thank you, Ms. Evans.
Mr. Wilshusen, you may proceed.
STATEMENT OF GREGORY C. WILSHUSEN
Mr. Wilshusen. Mr. Chairman, I am pleased to be here today
to testify on FISMA and the state of Federal information
security. Rarely has the need for the Federal Government to
implement effective controls over its information systems and
information been more important. Virtually all Federal
operations are supported by automated systems and electronic
information, and agencies would find it difficult, if not
impossible, to carry out their missions and account for their
resources without them.
At the same time, Federal systems and critical
infrastructures are increasingly being targeted for
exploitation by a growing array of adversaries, including
criminal groups, foreign nation states, hackers, terrorists and
disgruntled insiders. Thus, it is imperative that agencies
safeguard their systems to protect against such risks as loss
or theft to resources, disclosure or modification of sensitive
information, including national security, law enforcement,
proprietary business and personally identifiable information
and disruption of critical operations.
Today, I will summarize agency progress in performing key
information security control activities, the effectiveness of
information security at Federal agencies, and opportunities to
strengthen security. In fiscal year 2007, the Federal
Government reported improved security performance relative to
key performance metrics established by OMB for FISMA reporting.
For example, the percentage of certified and accredited systems
Government-wide reportedly increased from 88 percent to 92
percent. These gains continue a historical trend that we
reported on last year.
Despite reported progress, 20 of 24 major Federal agencies
continue to experience significant information security control
deficiencies. Most agencies did not implement controls to
sufficiently prevent, limit or detect access to computer
networks, systems or information. Moreover, agencies do not
always configure network devices to prevent unauthorized access
and ensure system integrity, patch key servers and workstations
in a timely manner, and maintain complete continuity of
operations plans for key information systems.
An underlying cause for these weaknesses is that agencies
have not fully or effectively implemented the agency-wide
information security programs required by FISMA. As a result,
Federal systems and information are at increased risk of
unauthorized access to and disclosure, modification or
destruction of sensitive information as well as the inadvertent
or deliberate disruption of system operations and services.
Such risks are illustrated in part by an increasing number of
security incidents reported by Federal agencies.
Nevertheless, opportunities exist to bolster information
security. Federal agencies could implement the hundreds of
recommendations made by GAO and agency IGs to resolve
previously reported control deficiencies and information
security program shortfalls.
In addition, OMB and other Federal agencies have initiated
several Government-wide initiatives that are intended to
improve security over Federal systems and information. For
example, OMB has established an information systems security
line of business to share common processes and functions for
managing information system security across Federal agencies,
and it has directed agencies to adopt the security
configurations developed by NIST, DOD and DHS for certain
Windows operating systems. Consideration could also be given to
enhancing policies and practices related to security control
testing and evaluation, FISMA reporting and the independent
annual evaluations of agency information security programs
required by FISMA.
In summary, although Federal agencies report performing key
control activities on an increasing percentage of their
systems, persistent weaknesses in agency information security
continues to threaten the confidentiality, integrity and
availability of Federal systems and information. Until Federal
agencies resolve their significant deficiencies and implement
effective security programs, their systems and information will
remain at undue and unnecessary risk.
Mr. Chairman, this concludes my statement. I would be happy
to answer your questions.
[The prepared statement of Mr. Wilshusen follows:]
[GRAPHIC] [TIFF OMITTED] T4178.028
[GRAPHIC] [TIFF OMITTED] T4178.029
[GRAPHIC] [TIFF OMITTED] T4178.030
[GRAPHIC] [TIFF OMITTED] T4178.031
[GRAPHIC] [TIFF OMITTED] T4178.032
[GRAPHIC] [TIFF OMITTED] T4178.033
[GRAPHIC] [TIFF OMITTED] T4178.034
[GRAPHIC] [TIFF OMITTED] T4178.035
[GRAPHIC] [TIFF OMITTED] T4178.036
[GRAPHIC] [TIFF OMITTED] T4178.037
[GRAPHIC] [TIFF OMITTED] T4178.038
[GRAPHIC] [TIFF OMITTED] T4178.039
[GRAPHIC] [TIFF OMITTED] T4178.040
[GRAPHIC] [TIFF OMITTED] T4178.041
[GRAPHIC] [TIFF OMITTED] T4178.042
[GRAPHIC] [TIFF OMITTED] T4178.043
[GRAPHIC] [TIFF OMITTED] T4178.044
[GRAPHIC] [TIFF OMITTED] T4178.045
[GRAPHIC] [TIFF OMITTED] T4178.046
[GRAPHIC] [TIFF OMITTED] T4178.047
[GRAPHIC] [TIFF OMITTED] T4178.048
[GRAPHIC] [TIFF OMITTED] T4178.049
[GRAPHIC] [TIFF OMITTED] T4178.050
[GRAPHIC] [TIFF OMITTED] T4178.051
[GRAPHIC] [TIFF OMITTED] T4178.052
[GRAPHIC] [TIFF OMITTED] T4178.053
[GRAPHIC] [TIFF OMITTED] T4178.054
[GRAPHIC] [TIFF OMITTED] T4178.055
[GRAPHIC] [TIFF OMITTED] T4178.056
[GRAPHIC] [TIFF OMITTED] T4178.057
Mr. Clay. Thank you so much, Mr. Wilshusen.
Mr. Paller.
STATEMENT OF ALAN PALLER
Mr. Paller. Thank you, and thank you for having me.
I have been to St. Louis a bunch of times, first with
McDonnell Douglas and later with Boeing. It is a wonderful,
high-tech city.
Mr. Clay. Thank you so much.
Mr. Paller. It is very impressive. Actually, what we are
talking about today directly affects Boeing, too, so it is not
just a Federal discussion because of the change that our other
witnesses mentioned.
I am just going to tell you a couple of stories. First of
all, I am the research director at SANS, so we have about
68,000 people who are alumni who actually run security at most
large organizations. Their job is almost completely impossible.
It just isn't out in the public, but we are losing this war
against cyber-crime at an accelerating rate, meaning we are
falling farther behind every week.
What we are talking about today actually will make a
difference. It is not something nice to do for Federal
agencies, it actually is a major war, it is involving
espionage, it is involving a lot of things that deserve to be
treated with more attention. I am here actually with the hope
that you can do that by making the Federal Government lead by
example. So where the Federal Government uses its procurement,
you mentioned in your opening statement $70 billion, that is
enough to do an amazing amount of good in security. You don't
actually spend the money on security, you use the leverage of
the Federal procurement to make the change.
Just to clarify how FISMA became a compliance exercise
instead of a security exercise, it wasn't the way the law was
intended. It actually was a mistake that was made in GISRA
before it became FISMA, the original law that got changed, it
was written in the Senate and got changed into FISMA. What
happened was that NIST wrote a catalog of things that every
agency had to do. They don't even call it a road map or a blue
print. They wrote a catalog. And then the IGs and others said,
well, now you have to do everything in the catalog. And the
problem is, if you had a catalog of things your kids had to do,
and one of them was finish their homework and another one was
check on the dog, but they were graded on how many things they
did, they are going to do all the check on the dogs quick,
because the do your homework is hard. And that is what happened
with FISMA, because they got graded on how many things they did
instead of the important things.
So the leaders are smart, you guys, between Karen and the
Hill, you guys made it impossible for them not to do
everything. They got Fs on all their report cards. And because
of that, they are smart enough to know, they have to get you
off their back. So the CIO said, I don't care what you need to
do for security, you have to get those reports done, because I
have to go see Clay Johnson in the White House and he is going
to--well, what they said isn't public. But he will do bad
things to me if I don't get all my systems certified.
So the key change, it is a very small change, I have
provided your staff with some language that might be better, it
will be made better by your people. But the key change is to
prioritize. If homework is more important than checking on the
dog, don't say you are going to do these 500 things, say, do
your homework. Then if you get your homework done, then do
these other things and we will give you bonuses for the other
things. But let's make sure we prioritize the actions.
That is what the companies that do security well do. It is
all attack-based. They find out where the attacks are coming
in, then make sure their defenses can stop those attacks. We
don't do that in the Federal Government. So I put all that in
the statement.
I want to tell you one more story, because it is a ``Karen
is a hero'' story, and it is really quite a good story. It is
the other half of what you can do. John Gilligan was the CIO at
the Air Force, he got up in front of 200 people and said, we
can't secure our Windows boxes. In fact, we spend more money to
clean up after the mess than we do to buy this stuff in the
first place, and I am going to change that. He took $500
million over 7 years, so it is not much per year. That is
relative to your $70 billion you are talking about. This is the
example of how your money makes a difference, $500 million over
7 years.
He said to Microsoft, hey, we want you to configure the
system securely when you sell it to us instead of selling it to
us open and making every one of our people try to do it after
we buy it. And he got it done. Over 400,000 systems now are out
of the box secure. The key is, they just reported this, they
cut the patching time from 7 weeks to 3 days. And all the
attacks come out in the first few days. So if you don't get it
done fast, you might as well not patch at all. And they saved
tens of millions of dollars. It is the only example where you
save money and you improve security. It is what you can do with
the leverage you have in your money.
So I am happy to answer questions about any of this. Thank
you for letting me come.
[The prepared statement of Mr. Paller follows:]
[GRAPHIC] [TIFF OMITTED] T4178.058
[GRAPHIC] [TIFF OMITTED] T4178.059
[GRAPHIC] [TIFF OMITTED] T4178.060
[GRAPHIC] [TIFF OMITTED] T4178.061
[GRAPHIC] [TIFF OMITTED] T4178.062
[GRAPHIC] [TIFF OMITTED] T4178.063
[GRAPHIC] [TIFF OMITTED] T4178.064
[GRAPHIC] [TIFF OMITTED] T4178.065
[GRAPHIC] [TIFF OMITTED] T4178.066
[GRAPHIC] [TIFF OMITTED] T4178.067
[GRAPHIC] [TIFF OMITTED] T4178.068
[GRAPHIC] [TIFF OMITTED] T4178.069
[GRAPHIC] [TIFF OMITTED] T4178.070
[GRAPHIC] [TIFF OMITTED] T4178.071
[GRAPHIC] [TIFF OMITTED] T4178.072
Mr. Clay. Thank you so much for that enlightening report.
Mr. McConnell.
STATEMENT OF BRUCE W. MCCONNELL
Mr. McConnell. Thank you, Mr. Chairman and members of the
subcommittees for the privilege and opportunity to testify
today on Federal information security.
The jurisdiction of this committee is so broad and its work
is so important to the critical functioning of our Federal
Government, it is a real pleasure.
I am here today bringing you the perspective of 20 years of
work in information policy and technology, including 15 years
at OMB, serving 3 Presidents. I am also on a commission for
cyber security for the 44th Presidency, which has been co-
chaired by Congressman Jim Langevin and Congressman Michael
McCaul. I am not speaking on behalf of that commission.
You asked in your invitation that I provide policy
recommendations for potential legislative consideration and to
comment on the state of FISMA compliance and the provisions of
H.R. 4791. I have done that in my written statement.
But in my oral remarks, I wish to focus in on what I
consider to be the most significant development in Federal
information security in many years. My analysis is based solely
on information that is in the public domain.
On January 8th, President Bush issued a new National
Security Homeland Security directive. This order establishes a
comprehensive national cyber-security initiative. The issuance
of this national security order shows that information security
is receiving serious attention at the highest levels of the
executive branch. I believe this is good news.
The so-called Cyber Initiative recognizes the serious
threats to the Nation's information infrastructure coming from
State and non-State actors, including sophisticated criminals.
It lays out the need to take proactive measures in cyberspace
to detect and prevent intrusions from whatever source in real
time before they can do significant damage. These tenets are
important, and while the details are not yet public, they
clearly include an increased role for the intelligence
community, in particular the National Security Agency [NSA], in
protecting Federal systems.
Let me explain why I believe this expanded NSA role is
germane to this committee's work. The Cyber Initiative relates
directly to two statutes under your jurisdiction: FISMA and the
Privacy Act. When this committee wrote FISMA's predecessor, the
Computer Security Act of 1987, you vested the National
Institute of Standards and Technology [NIST], with primary
authority in the security of civilian agency information
systems. You also explicitly limited the role of NSA with
respect to civilian agency systems. There were several reasons
for this differentiation of responsibilities.
Foremost in the mind of Congress was the potential chilling
effect on the free flow of information between Government and
the public, including the information technology industry, if a
military agency became too closely involved with civilian
agency systems. As the committee's report in 1987 notes,
``Since it is a natural tendency of DOD to restrict access to
information through the classification process, it would be
almost impossible for the Department to strike an objective
balance between the need to safeguard information and the need
to maintain the free exchange of information.''
Civilian agency missions, such as those at the Census
Bureau, the Internal Revenue Service and the Centers for
Medicare and Medicaid Services, depend on the trust of the
American people to operate successfully. These missions require
the free and efficient flow of information to and from the
public in order to deliver important public benefits and
programs.
In addition to the potential chilling effect on information
flows, the statute also reflected potential concerns about
privacy and civil liberties. This statutory framework
separating civilian and military systems has been confirmed and
strengthened three times in the last two decades.
Now, Mr. Chairman, it may be that the world has changed so
much that this historic distinction between civilian agency
systems and national security systems no longer serves the
Nation's interest. Certainly the current computer security
regime in Government is not working adequately. There is a big
gap between what the agencies need and what they are getting.
The gap extends beyond Government systems to the U.S.
information infrastructure.
Therefore, there is a substantial argument that you need to
put resources from the intelligence community against this
problem, because that is where the most resources are on the
Federal side. Of course, there is also substantial resources in
the private sector in this area.
So what is really needed is a partnership of trust between
the Government and the private sector to address the Nation's
information security needs. Many of the information security
professionals I talk to suggest that this trust is at a
relatively low point in our history and it needs to be
strengthened if we are going to be able to address this
critical issue. We need to determine who in the Government can
most effectively foster trust and cooperation with industry and
with the American people.
So I encourage the committee to look at these roles and
responsibilities in the context of FISMA and the Privacy Act.
Thank you, sir.
[The prepared statement of Mr. McConnell follows:]
[GRAPHIC] [TIFF OMITTED] T4178.073
[GRAPHIC] [TIFF OMITTED] T4178.074
[GRAPHIC] [TIFF OMITTED] T4178.075
[GRAPHIC] [TIFF OMITTED] T4178.076
[GRAPHIC] [TIFF OMITTED] T4178.077
[GRAPHIC] [TIFF OMITTED] T4178.078
[GRAPHIC] [TIFF OMITTED] T4178.079
[GRAPHIC] [TIFF OMITTED] T4178.080
[GRAPHIC] [TIFF OMITTED] T4178.081
Mr. Clay. Thank you so much, Mr. McConnell. Our final
witness will be Mr. Bennett. Mr. Bennett, you may proceed.
STATEMENT OF TIM BENNETT
Mr. Bennett. Thank you, Mr. Chairman, Congressman Davis.
Thank you for the opportunity to share the views of the Cyber
Security Industry Alliance on improvements in FISMA.
CSIA is a group of leading security technology vendors that
are dedicated to ensuring the privacy, reliability and
integrity of information systems through public policy,
technology, education and awareness. It is our belief that a
comprehensive approach for enhancing the security and
resilience of information systems is fundamental to economic
security.
Mr. Clay. Excuse me, Mr. Bennett, is your microphone on?
Mr. Bennett. Allow me to commend this subcommittee and its
parent committee for the sustained attention that has been
given in recent years to the critical objective of
strengthening information security within the Federal
Government. As we have painfully learned and heard from a
couple of the other witnesses this morning, Federal systems are
frequently vulnerable to cyber attacks, and the oversight of
this subcommittee and full committee are an important element
in holding Federal agencies accountable for improved
information security as well as highlighting ongoing challenges
and vulnerabilities.
The 110th Congress now has an important opportunity to
amend FISMA to improve the information security climate at our
Federal Government agencies. Even though the last few years
have yielded a number of successes, there are certain
weaknesses in our Government's critical infrastructure which
still urgently need to be addressed.
It has become clear that the infiltration of Federal
Government networks and the possible theft and/or exploitation
of information are among the most critical issues confronting
our Federal Government. While progress has been made, much work
remains to be done in order to truly secure our Government's IT
infrastructure.
FISMA has been fairly successful at getting agencies in
general to pay closer attention to their information security
obligations. Before FISMA, information security was not a top
priority at Federal agencies. FISMA has been successful in
raising awareness of information security in the agencies and
also in Congress.
However, Federal agencies scored an average grade of C
minus in 2007's Information Security Report Card. Some argue
that FISMA does not adequate measure information security. A
high FISMA grade doesn't mean the agency is secure and vice
versa. That is because FISMA grades reflect compliance with
mandated processes. They do not measure how much these
processes have actually increased information security.
In particular, the selection of information security
controls is subjective and not consistent across Federal
agencies. Agencies determine on their own what level of risk is
acceptable for a given system. They can then implement the
corresponding controls, certify and accredit them and thus be
compliant and receive a high grade regardless of the level of
risk they have deemed acceptable.
Certainly we want to avoid a check the box mentality and
don't want FISMA to be reduced to a largely paperwork drill
among the departments and agencies, consuming an inordinate
amount of resources for reporting progress while yielding few
genuine security improvements. Unfortunately, in some cases,
that is what it has become.
Some Federal agency chief information security officers are
measured on their compliance scores with FISMA, not on whether
they have adequately assessed risk in their respective agency
or prevented breaches of sensitive information. Instead, we
want agencies to actively protect their systems instead of just
reacting to the latest threat with patches and other responses.
With the benefit of 5 years' experience under FISMA and several
insightful reports by the U.S. Government Accountability
Office, it is now possible to identify possible improvements
that can address those weaknesses in FISMA implementation that
have now become apparent.
With global attacks on data networks increasing at an
alarming rate and in a more organized and sophisticated manner,
there is precious little time to lose. Faced with this urgent
need, we applaud the bill that you have introduced, H.R. 4791.
We strongly support this bill. It would undertake the important
step of codifying many of the recommended steps that OMB took
in a series of memos to Federal agencies after a series of
significant data breaches in recent years. The legislation
provides much-needed common sense obligations to require
agencies to develop policies and plans to identify and protect
personal information, develop requirements for reporting data
breaches and report to Congress a summary of information
security breaches reported by Federal agencies.
We recommend that the proposed legislation also include
language requiring that data breaches of information systems
maintained by contractors and other sources working on Federal
projects be promptly notified to the Secretary and the CIO of
the contracting agency. Federal contractors are responsible for
many of the data breaches that agencies reported. CSIA believes
that it is important to reaffirm that FISMA applies to Federal
contractors.
We also commend the chairman for having the insight to
incorporate language into this legislation requiring that
Federal Government agencies encrypt or make unusable and
unreadable personal data and to establish minimum requirements
for protection of information or mobile devices. H.R. 4791 also
prudently establishes security requirements for peer-to-peer
networks. We believe that agencies should be required to
develop a plan to protect against the risks of peer-to-peer
networks and provide detailed technology and the policy
procedures they should take.
To assist further consideration of this bill, we offer
additional recommendations. One, align responsibilities and
authorities to vest the CIO and CISO with specific power over
information security. The current authority of agency CIOs to
ensure should be the power to enforce cost effective measures
of security.
Two, require improvements to assessment, continuous
monitoring and remediation in order to develop a comprehensive
approach to information systems security. Three, mandate
preparation of the complete inventory of all Federal agency IT
assets by a certain date. Four, improvement performance
measurement and provide incentives to agencies that give
information security a high priority. Five, institutionalize
security within Federal agency culture. Six, increase Federal
agency IT security funding. Seven, reaffirm objective
assessments of commercially available information technologies.
And eight, narrow the scope of the privacy definition provided
for in the proposed legislation.
In closing, I commend the subcommittee for highlighting the
importance of information security, for examining how we can
improve FISMA and Federal agency information security practices
going forward. The overriding objective should be to move
Federal agencies to act in a manner that equates strong
information security practices with overall mission
accomplishment. We all know what is at stake.
Thank you, Mr. Chairman.
[The prepared statement of Mr. Bennett follows:]
[GRAPHIC] [TIFF OMITTED] T4178.082
[GRAPHIC] [TIFF OMITTED] T4178.083
[GRAPHIC] [TIFF OMITTED] T4178.084
[GRAPHIC] [TIFF OMITTED] T4178.085
[GRAPHIC] [TIFF OMITTED] T4178.086
[GRAPHIC] [TIFF OMITTED] T4178.087
Mr. Clay. Thank you, Mr. Bennett. I thank the entire panel
for their testimony today.
Now we will proceed under the 5-minute rule to questions
for the panel. I will recognize the ranking minority member of
the full committee, from Virginia, my good friend, Tom Davis.
Mr. Davis.
Mr. Davis of Virginia. Thank you, Chairman Clay. I want to
thank you for holding this important hearing.
We are here to talk about information security from the
Federal perspective. But these are issues and challenges we
face at all levels of Government and even as individuals.
Secure information is the lifeblood of effective Government
policymaking, good program management and a thriving economy.
Protecting that information has to be a priority, not an after-
thought.
The evolving nature of cyber threats requires constant
vigilance. The Federal Government's information security
program should be proactive, not reactive. If we keep chasing
yesterday's problems, we will never be able to stop tomorrow's
sophisticated challenges.
When it comes to information security, all it takes is one
weak link to break the data chain. One successful cyber attack
could strike a stunning blow to an agency's operations and
damage citizens' trust in electronic Government initiatives.
Continued vulnerability puts personal information at risk.
The loss of Blackberry service a few days ago reminded us of
our dependence on IT, how difficult it is for us to function
without it, and how fragile some key systems remain.
One of the best ways to defend against attacks is to have a
strong and yet a very flexible protection policy in place, not
overly prescriptive. We want agencies to active protect their
systems, instead of simply reacting to the latest threat with
patches and other responses.
On the Government Reform Committee, I focused on
Government-wide information management and security for many
years. The Privacy Act and the E-Government Act of 2002
outlined the parameters for the protection of personal
information and the Federal Information Security Management Act
[FISMA], requires each agency to create a comprehensive risk-
based approach to agency-wide information security management
through preparedness, evaluation and reporting requirements. It
is intended to make security management an integral part of an
agency's operation and to ensure that we are actively using
best practices to secure our systems.
Certainly, FISMA has its critics. We have heard from some
of them today. But I think we also will hear that it still
provides the necessary tools to secure our information, and has
made information security a priority mention at agencies. We
want to avoid that check the box mentality that has been
criticized, and we need to incentivize strong information
protection policies. We need to pursue a goal of security
rather than compliance.
Nearly 5 years after FISMA was enacted, there is always the
risk of complacency. The basic FISMA concept and process
remains sound. But we should ask if we can make it better. I
think we can.
As a start, I introduced legislation requiring timely
notice be provided to individuals whose sensitive personal
information could be compromised by a breach of data security
at a Federal agency. Despite the volume of sensitive
information held by agencies, there is no current requirement
for citizens to be notified if their information is
compromised. This legislation passed the House during the 109th
Congress. I continue to urge Chairman Waxman to make it a
priority this year. I would ask that the two letters I have
sent to Chairman Waxman be included in the record, Mr.
Chairman.
Mr. Clay. Without objection, so ordered.
[The information referred to follows:]
[GRAPHIC] [TIFF OMITTED] T4178.088
[GRAPHIC] [TIFF OMITTED] T4178.089
[GRAPHIC] [TIFF OMITTED] T4178.090
Mr. Davis of Virginia. Each year, I have released Federal
Agencies Information Security score cards. Despite some
improvements, scores for many departments remain unacceptably
low. By the way, a lot of the scoring is done by GAO and OMB.
It is not just done by our whim.
The Federal Government overall received a C minus, a slight
improvement over prior years. I know some don't like to be
graded. I have actually had Cabinet secretaries call me to
lobby about their grades. And others don't see the value.
But I think most of us agree 5 years later that information
security should be a priority at Federal agencies. This is how
it should be. The Federal Government has sensitive personal
information on every citizen, from health records to tax
returns to military records. We need to ensure that the public
knows when its sensitive personal information has been lost or
compromised. Public confidence in Government in this area is
essential.
As we discuss Federal information security, we should focus
on the most pressing issues and threats, remain technology-
neutral and take care not to disrupt the progress we have made
or the progress already underway. Not being technology-neutral,
I think, siphons a lot of innovation from this area. That is a
major concern with being overly prescriptive, something we have
to balance.
In the end, the public demands effective Government and the
future of effective Government and security information depends
more than ever on a successful future for FISMA.
Thank you, Mr. Chairman.
[The prepared statement of Hon. Tom Davis follows:]
[GRAPHIC] [TIFF OMITTED] T4178.091
[GRAPHIC] [TIFF OMITTED] T4178.092
[GRAPHIC] [TIFF OMITTED] T4178.093
[GRAPHIC] [TIFF OMITTED] T4178.094
[GRAPHIC] [TIFF OMITTED] T4178.095
Mr. Clay. Thank you, and would the ranking member care to
ask questions?
Mr. Davis of Virginia. Ms. Evans, let me ask you, the
administration has focused unprecedented attention on the
mundane but the very essential tasks of improving Federal
management practices, including a focus on expanding electronic
Government. The President's management agenda rates agencies'
efforts on E-Gov initiatives, OMB requires quarterly reports,
yet we still have a long way to go before things are secure.
Do you have any advice or recommendations for the next
administration of things they should prioritize?
Ms. Evans. I have a lot of advice. But in particular, I
think that the areas that we focused on and the specific
processes are good foundational activities that I think any
administration would want to continue. For example, on the
score card, one of the things that we look at, and on a
quarterly basis as required by the guidance that has been
outlined in FISMA, is the plan of actions and milestones which
really is the constant assessment of risk.
If an agency is in the check the box mentality, then we are
going to get the results that the other panelists, my
colleagues, have talked about. But if the agency head and the
CIO are really evaluating the new technologies, the services
that they have, that process, that monthly looking at things,
the daily looking at things and then making sure that you have
an adequate way to then address it I think is a good practice
to carry forward. We call it certification and accreditation
overall, we call the quarterly reports, plan of actions and
milestones, but what it really is is getting to the culture of
managing the risk.
Mr. Davis of Virginia. Have you found any agencies that
just check the box and literally don't have the substance
behind checking it?
Ms. Evans. I think that there are mixed results, as we have
said in our reports in the past. I work very closely with all
the agencies, especially through the CIO council. I do and am
concerned that we balance the compliance aspect of this
legislation and any legislation that we have against achieving
the actual results. So I would say there are mixed results and
it depends on the leadership and the CIO in particular of how
they are managing that information security program within the
department.
Mr. Davis of Virginia. The report cards are not perfect,
but right now, nobody else is keeping track, at least up here,
over what is happening. If you don't give a report card or at
least give some public embarrassment, there is no
appropriations penalty to be paid or anything else. Ultimately
it has to be directed from OMB. The executive branch doesn't
need us involved in a perfect world. We have to make this a
priority.
But managers down below, given limited funds, generally
want to accomplish their mission first. Many of them would just
as soon take the risk of a data breach to be able to accomplish
things, and if something happens, hopefully it won't happen on
their watch. That is one of our concerns.
Ms. Evans. And I would agree with you and I think that is
what we have done through the criteria that we manage and look
at on a quarterly basis through the E-Government Score Card on
the President's management agenda. It is looking at all and
everything that takes into consideration for a good information
technology program in a department. If you master those
management skills, then you have the foundation to go forward
to support any program.
All of this is about getting good program results and
making sure that you have public confidence in your services.
So you have to do many things in order to do that in this
environment. The way to provide those services is through the
use of information technology.
Mr. Davis of Virginia. Mr. Paller, part of your testimony
approaches Federal IT from an international perspective. How do
we rank when you compare us with government IT security in
other countries?
Mr. Paller. First, the breach bill that you talked about,
this is going to do a lot of good. Because people respond when
they have to make something public in ways they don't even
think about.
Mr. Davis of Virginia. No question. The tendency is to
sweep it under a rug, fully investigate, make sure you get your
spin on it. That is just natural. We do the same, by the way,
we are no different than the executive agencies.
Mr. Paller. In almost all areas, we are stronger than other
governments. The one place we fall way behind is in information
sharing. The British figured out how to do that. They actually
copied something we had called the NSIE, and spread it and we
didn't copy what we had and we built this thing called ISACS
that just don't work. So they are way ahead on information
sharing.
But in terms of actually securing Government systems, we
are not way behind anyone.
Mr. Davis of Virginia. We are also more of a target than
most government systems, aren't we?
Mr. Paller. We are getting hurt more, the British equally,
the Australians, too. These nation-state attacks are enormous.
the head of MI-5 actually just did a letter that it is all
spreading to businesses now. If you do business in China, you
are being just destroyed with cyber attacks.
Mr. Davis of Virginia. I hope we can sit down and work some
language out that and can all agree on this. Because a cyber
Pearl Harbor or something of that nature would just be awful.
And at that point, you would say, where have we all been on
this. And a lot of us have been working on this for a long
time. It is not easy.
Can I just ask one other question? Mr. Wilshusen, some have
suggested that standardizing IG audits, their practices in the
area of information security, would help reduce the discrepancy
between the agency grades, their compliance with the act and
their information security practices. Is it feasible to
standardize audit practices? Do you agree with that proposal?
Mr. Wilshusen. I think audits and in particular, with the
independent IG evaluations, we have noted in the pst that they
have been inconsistent, the scope and methodology of their
evaluations vary across agencies. And the form and content of
the reports differs significantly from just repeating or
presenting the information on the FISMA template that OMB has
established to coming up with real conclusions and findings and
issues on these security deficiencies at those agencies.
So by having these evaluations of performance in accordance
with Government auditing standards, for example, that could
elevate and raise consistency in the content of those
evaluations.
Mr. Davis of Virginia. Thank you.
Mr. Clay. Thank you, Mr. Davis.
Mr. Paller, I am very interested in your testimony's
support of prioritizing the testing and evaluation activities
that are carried out by agencies on a regular basis. Thus, I
have a few practical questions on how would you get there. Does
current guidance from NIST, such as S.P. 853, provide a blue
print for adequate security and should this guidance simply be
made mandatory and binding on agencies?
Mr. Paller. No, and hell, no. It is a catalog of everything
anybody ever thought of that might help security, 853. Not even
the audit guide, this is it. There is a parallel in the
commercial world that is what you actually have to do to secure
all the credit cards. Because the credit card industry says, we
are going to stop losing it. This looks smaller. And this one,
in all of this, firewalls are a really important part of
security, lock the door, firewalls the door. In all of this,
one-200th of it talks about firewalls. In the real one, one
eighth. So 12\1/2\ percent talks about it.
If you know security, you actually know security, not know
about writing about security, but actually doing it, no, 853 is
silly.
Mr. Clay. How can new guidance or security controls be
added in a real-time environment?
Mr. Paller. I think again, the payment card industry does
it. These are updated regularly. There is a massive new attack
on Web applications. They used to go against Windows and the
other things. Now they are going against every Web site.
Well, this has nothing, it tells you nothing about doing
that. But this one is updated very regularly, almost quarterly.
It is not hard. All you do is you set up a council of the
people who actually have to protect systems, say, what are you
doing and then get them to agree, 10 or 12 of them, they agree
and you write it up. It really isn't impossible. It is not
easy, but it isn't impossible.
Mr. Clay. You also referred to the Air Force contracting
which had required vendors to deliver minimum security
configurations for a system. Should a contractual mandate along
these lines, with requirements defined by OMB and the Federal
Acquisition Council be required under FISMA?
Mr. Paller. That is actually Karen's, she has done a lot of
wonderful things. Taking what the Air Force did and making it a
Federal mandate is the biggest, single biggest thing in
improving security we have ever done as a country.
Mr. Clay. Is that what Ms. Evans is pushing?
Mr. Paller. Yes, what Ms. Evans has done.
Mr. Clay. Would we have the problem of technology moving
ahead too quickly for regulations to keep up?
Mr. Paller. No. The Air Force, for example, has this
absolute mandate. You have to do it this way. And if you
compare the Air Force's new computers with every other agency,
they are ahead of the other agencies. So you can't say they are
behind technologically when they actually have the most
advanced technology and yet they are meeting the standard. It
is because they do it together that they get all the advanced
technologies.
Mr. Clay. Thank you for that response.
Let me ask Mr. McConnell, can you tell us how laws like
FISMA and Clinger-Cohen have altered the information security
landscape over the past decade, and if there areas in which we
should try to harmonize the provisions in order to improve
security?
Mr. McConnell. Yes, sir. I think there have been three
beneficial effects of FISMA and Clinger-Cohen. They have
increased the level of attention that is paid to information
security, they create a management structure that can be used
to manage it, and they have encouraged integrating security
into the overall program management. So you have a well-managed
program that includes good security.
I think what is needed at this point is for the executive
branch to take full advantage of the authorities and structure
that you have provided. I have seen that work in the past
across administrations. The Clinger-Cohen bill set out
authorities in a management structure that was passed during
the Clinton administration. And now the current administration
has really exercised those authorities in a significant way.
I think as far as harmonization, the law that is probably
the most in need of harmonization and updating that is under
this committee's jurisdiction is the Privacy Act. That is the
Privacy Act of 1974. And that as you can imagine, there is much
that could be done to harmonize that with other things that
have happened.
Mr. Clay. Can you explain in further detail why an
independent audit would hinder agency efforts to root out
security vulnerabilities? Isn't one of the problems with FISMA
related to the current evaluations having little consistency or
applicability across agencies, making it a paperwork exercise?
Mr. McConnell. I would agree that the current evaluations
are inconsistent and that they often focus on paperwork. But I
don't think those two aspects are necessarily connected. You
have inconsistency because you have inconsistent evaluation
criteria and processes. Whereas the paperwork is looking at a
compliance, box checking, rather than on operational security,
as Mr. Paller was saying, let's just get the stuff done.
So you could have consistent processes, but still have the
paperwork focus. The concern that I have about the mandatory
audit is that you just exacerbate the compliance mentality.
Everybody at that point is in a CYA thing, trying to make the
audit right. So I think you need to have consistent evaluation
criteria, independent evaluation criteria, but I don't
recommend making it an audit.
Mr. Wilshusen. Mr. Chairman, may I please comment?
Mr. Clay. Sure.
Mr. Wilshusen. One thing, and i Just want to make sure that
we are clear on if we are talking about the annual independent
IG evaluation or audit, if that is the change in H.R. 4791,
versus the testing that may be done by the agencies. One thing
that is important, if we go to an audit by the IG as part of
the annual evaluation, is to make sure that the audit focuses
on and the auditors conclude on the effectiveness of the
information security controls, rather than making it merely
compliance with the provisions of the act.
And so it is important to direct the focus of the audit
toward evaluating effectiveness as the IGs and auditors do as
part of the consolidated financial statement or the audits of
the agencies' financial statements. And that is why you have a
disparity between why certain agencies are reporting increased
performance versus the various metrics established by OMB for
FISMA reporting versus those audit results of the effectiveness
of controls.
So there is a distinction there to try to make the annual
IG evaluation by making it in accordance with audit standards
and assuring that the auditors conclude on the effectiveness of
controls, not merely compliance with the act.
Mr. Clay. And these should be independent audits?
Mr. Wilshusen. Absolutely.
Mr. Clay. Yes.
Mr. Wilshusen. And that is separate from the agencies that
are also required under FISMA to test and evaluate the
effectiveness of their controls. And that would be all their
controls, management, operational, technical controls, on a
frequency based on risk. We have found problems with that
process being implemented by the agencies. But those are two
separate issues, once performed independently by the IG or
other auditors, others. The security tests and evaluations
required as part of an agency information security program is
performed by agency personnel or their contractors.
Mr. Clay. Thank you for that response.
Mr. Bennett, a critical element of FISMA is for agencies to
develop a risk assessment of their systems in order to develop
or integrate effective security policies and applications for
them. With this in mind, please characterize the vendors' roles
and responsibilities in developing and implementing secure
networks and applications throughout an agency.
Mr. Bennett. Yes, Mr. Chairman. The vendor should be
responsible for understanding the agency's enterprise
architecture and the operating environment to assure that their
solutions will not disconnect or break the systems that are
currently in place. While Government and their contractor
personnel, support personnel are ultimately responsible for the
support and operation of the infrastructure, only the vendors
of these enterprise solutions really understand the protocols
and underlying infrastructure requirements that will allow
these products to work securely and as designed.
This means that implementation, testing and integration of
cyber security and risk in the mission achievement is the
responsibility of the vendor in the larger context of the
agency framework and budget.
Mr. Clay. Is the mitigation of risk a shared duty or
responsibility between both agency personnel and the vendor
community?
Mr. Bennett. Yes, absolutely it is a shared responsibility,
to the extent that the vendors' products should work as
advertised. The agency is solely responsible for the
determination of how much risk they are willing to take and
NIST guidelines do provide some guidance in this area.
But once mitigation plan has been decide, the agency should
have every expectation that the solutions that have been
purchased performed as advertised.
Mr. Clay. In actuality, and anybody on the panel can answer
this, how does it actually work between vendor community and
agency? Is it pretty seamless? Is it a turf war? What have you
found? Ms. Evans, you can start.
Ms. Evans. I would like to take the opportunity to first
talk about that. I applaud the answer of my colleague at the
other end of the table. But when it ultimately comes down to
it, the agency head is ultimately responsible for the services
that they procure and the contracts that they let. So it is the
responsibility of the CIO, which is outlined in the statute, to
ensure that we manage that risk appropriately.
So you have to have very clear and open communications. You
have to make sure that the contact is very clear as to what the
roles and responsibilities are. But when it is said and done,
the American people hold us, the executive branch, accountable
for our actions and for our services. So I believe that what
the administration has done with our policies and the actions
that we are taking is trying to make that very clear and using
the tools that we have in place to leverage our buying power,
so that it is clear to us and clear to those who choose to
provide the services for us what those expectations are, what
the risks are and how those products need to work in our
environment.
Mr. Clay. Thank you.
Mr. Wilshusen.
Mr. Wilshusen. I would just like to add, FISMA requires
that the agency is responsible for the security over the
systems that are operated on its behalf by third parties and
contractors. It should be an integral part of the agency's
information security program.
However, we have found in our report that we issued back
in, I think it was April 2005, that many of the agencies did
not have adequate policies or actually monitoring the
effectiveness of security over systems operated by contractors.
So Ms. Evans is absolutely correct, it is important that
contracts be, or that the requirements for information security
be specified in the contracts, so that the contractors know
what to do. But there is also that other side of the agency
taking responsibility to assure that the contractors are
upholding their end of the bargain and implementing the
security in accordance with the contract requirements and
Federal requirements.
Mr. Clay. Thank you.
Mr. Paller.
Mr. Paller. We train 14,000 people a year. Lots of them are
Federal people, lots of them are contractors, lots of them are
Boeing people. They can't figure this out on the fly. What Ms.
Evans is talking about, contracting for what you want, the fact
that we don't do that today is one of the two biggest flaws in
all of our Federal security. What we do is we throw it over the
wall to these contractors. And then when we find out there was
something extra we needed to do for security, they say, well,
that is another $100 million. Then we have to make choices
between spending the extra money or not.
We have to change the way we buy products, to buy it with
security baked in, rather than getting caught. That happens
with our third party, our software. Right now, if somebody does
a software development for us and we find a major security flaw
in it, we have to pay them to now go and we have to negotiate
with them and now they are busy and they have something else to
do. The whole contracting mechanism is, give it away and then,
oh, shoot, security, we should have asked you for that. So what
Ms. Evans is talking about is not a lightweight thing. It
actually matters.
Mr. Clay. Do you think in the President's proposed $70
billion budget for IT, do you think there are some built-in
protections for that, for that security element?
Mr. Paller. No, the contracting officers don't like this
topic. So when the guys want to put it into contacts, am I
being bad?
Ms. Evans. No, you go ahead. [Laughter.]
Mr. Clay. You are doing fine. Please proceed.
Mr. Paller. The contracting officers don't like it and so
when the technical person who knows what he wants goes to the
contracting officer and says, can we put that in, he says,
well, you are not being specific enough. And then it is gone.
Ms. Evans. But I have good news. I bring good news, which
is, we have, as I stated in my testimony, we have been working
with the Federal Acquisition Council to make modifications to
the FAR to do things like what we have done with the Federal
Desktop Core Configuration. So the FAR will be amended to then
include the common security configurations, which makes it a
mandatory clause. That clause, that language is to be published
in the Federal Register no later than Tuesday.
So we understand where the performance gaps are. We know we
have to follow through in our contracts to ensure that we can
hold ourselves as well as the contractors accountable. So if
you follow this example through, we gave agencies guidance last
year, last June. All new contracts were to have this language
in it if you were providing these types of operating systems or
you were going to provide products that were going to operate
on these operating systems.
What we are following through now is making sure that we
will be successful in spite of ourselves, because this will be
in the FAR. It will go forward that way. So a lot of these
things are now coming into place where the vendors now are
like, OK, so what does this mean that I have to provide
certification? That is the point of what NIST has done by
having this program out which is dealing with--the acronym is
S-CAP, but in essence what it does is validate that those
security settings stay set when you bring them into your
environment.
So a vendor, when you bring in new tooling to your
environment or a new application or anything, you run this
tool. And it is going to tell you, against those 700 settings,
what changes and what didn't. It gives you a percentage. We are
talking 100 percent right now. We told the agencies that they
had to comply with this. There is no, like, give me 80 percent
or so. It is zero or 100.
Then we thought, OK, from that perspective, how would that
really go forward. We have agencies that can tell you exactly
how many desktop have these operating environments and out of
the 700, 5 are problematic and they know exactly now what
applications that affects.
We couldn't do that before. So now when you know what that
is, you can now put in compensating controls. These lay the
good foundations for an information management program. But the
key was to ensure that the procurement cycle, and as these
products and applications come into our environments, that they
too are aware and that they are certifying against that
environment.
Mr. Clay. Will you provide us with the language?
Ms. Evans. Absolutely.
Mr. Clay. Thank you so much.
Mr. McConnell, did yo have anything to add?
Mr. McConnell. I think this has been pretty well discussed,
sir.
Mr. Clay. Mr. Bennett, one final question. You mentioned
incentives for agency security performance in your testimony. I
would like to explore that idea of a carrot and stick approach.
Would incentives such as permitting agencies that receive an
unqualified or clean independent audit to be audited only every
other year be appropriate, and conversely, would penalties for
an agency such as losing procurement funding until deficiencies
are remedied be an effective tool?
Mr. Bennett. Yes, Mr. Chairman. I think that might work and
should be given serious consideration and should be counter-
balanced by the concept that if there is inadequate
performance, that the frequency of audits should be increased
so that it works both ways and truly becomes a carrot with also
a stick.
Mr. Clay. Thank you so much.
Do any other panelists have anything to add?
Mr. Paller. I just wanted to connect the dots to Boeing.
Everything we are talking about, about compliance, spending all
this money, not doing security, I am getting calls all the
time, they are just discovering it, does this really mean us,
too? So everything we are talking about, about cleaning it up,
is about to come back across the entire Defense industrial
base, because a few months ago, they found out that the Chinese
had gotten deeply into most of their computers as well. So they
are now part of the game, and they are subject to all of this
and people saying, well, let's make the FISMA-compliant, and
all this discussion about paperwork and money wasted, it is all
about what we are going to do to the contractors.
Mr. Clay. So they are watching with a keen eye?
Mr. Paller. They are going to scream when it hurts.
Mr. Clay. They are going to scream when it hurts.
Thank you so much, Mr. Paller. Ms. Evans.
Ms. Evans. On the evaluations or audits, or whatever we end
up calling it, I do think that it is important, again, that it
is a balance of what we are looking at and the carrot and stick
approach. This is something that in my own position that I am
sure you guys manage with, as I do, is that we need to be
careful about the compliance versus the actual results that we
are trying to achieve. Putting timeframes on these things also
could drive certain behavior that we may not necessarily want
either.
I really believe it gets down to, it is a culture of
constantly evaluating the risks associated with the information
that you have. And you know, to take away procurement authority
or to take away money in some cases you might have to add money
in order to fix these types of activities, because it is so
pervasive.
I really believe the way the administration puts together
the budget, how we evaluate the capital planing, how we send
this stuff forward, really allows the agencies to focus on
managing that on a daily basis. It is not a time, it is not a
quarter, it is not a year, it is not biannually. Agencies have
to do this on a daily basis. It has to be a culture of managing
risk on a daily basis.
Mr. Clay. Thank you so much for that response, Ms. Evans.
Let me thank the entire panel for today's hearing and your
testimony. We certainly appreciate your participation in this
hearing.
That concludes this hearing. Hearing adjourned.
[Whereupon, at 12:40 p.m., the subcommittees were
adjourned.]