    [House Hearing, 106 Congress]
    [From the U.S. Government Publishing Office]

               ENHANCING COMPUTER SECURITY: WHAT TOOLS WORK BEST

    =======================================================================

                                    HEARING

                                   before the

                     SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
                          INFORMATION, AND TECHNOLOGY

                                     of the

                                  COMMITTEE ON
                               GOVERNMENT REFORM

                            HOUSE OF REPRESENTATIVES

                           ONE HUNDRED SIXTH CONGRESS

                                 SECOND SESSION

                                   __________

                                 MARCH 29, 2000

                                   __________

                               Serial No. 106-181

                                   __________

           Printed for the use of the Committee on Government Reform

      Available via the World Wide Web: http://www.gpo.gov/congress/house
                          http://www.house.gov/reform

                                     ______

                        U.S. GOVERNMENT PRINTING OFFICE
    69-819 DTP                  WASHINGTON : 2001

    _______________________________________________________________________
     For sale by the Superintendent of Documents, U.S. Government Printing
                                     Office
    Internet: bookstore.gpo.gov  Phone: (202) 512-1800  Fax: (202) 512-2250
                   Mail: Stop SSOP, Washington, DC 20402-0001

                         COMMITTEE ON GOVERNMENT REFORM

                         DAN BURTON, Indiana, Chairman
    BENJAMIN A. GILMAN, New York         HENRY A. WAXMAN, California
    CONSTANCE A. MORELLA, Maryland       TOM LANTOS, California
    CHRISTOPHER SHAYS, Connecticut       ROBERT E. WISE, Jr., West Virginia
    ILEANA ROS-LEHTINEN, Florida         MAJOR R. OWENS, New York
    JOHN M. McHUGH, New York             EDOLPHUS TOWNS, New York
    STEPHEN HORN, California             PAUL E. KANJORSKI, Pennsylvania
    JOHN L. MICA, Florida                PATSY T. MINK, Hawaii
    THOMAS M. DAVIS, Virginia            CAROLYN B. MALONEY, New York
    DAVID M. McINTOSH, Indiana           ELEANOR HOLMES NORTON, Washington,
    MARK E. SOUDER, Indiana                  DC
    JOE SCARBOROUGH, Florida             CHAKA FATTAH, Pennsylvania
    STEVEN C. LaTOURETTE, Ohio           ELIJAH E. CUMMINGS, Maryland
    MARSHALL ``MARK'' SANFORD, South     DENNIS J. KUCINICH, Ohio
        Carolina                         ROD R. BLAGOJEVICH, Illinois
    BOB BARR, Georgia                    DANNY K. DAVIS, Illinois
    DAN MILLER, Florida                  JOHN F. TIERNEY, Massachusetts
    ASA HUTCHINSON, Arkansas             JIM TURNER, Texas
    LEE TERRY, Nebraska                  THOMAS H. ALLEN, Maine
    JUDY BIGGERT, Illinois               HAROLD E. FORD, Jr., Tennessee
    GREG WALDEN, Oregon                  JANICE D. SCHAKOWSKY, Illinois
    DOUG OSE, California                             ------
    PAUL RYAN, Wisconsin                 BERNARD SANDERS, Vermont
    HELEN CHENOWETH-HAGE, Idaho              (Independent)
    DAVID VITTER, Louisiana

                          Kevin Binger, Staff Director
                     Daniel R. Moll, Deputy Staff Director
               David A. Kass, Deputy Counsel and Parliamentarian
                        Lisa Smith Arafune, Chief Clerk
                     Phil Schiliro, Minority Staff Director
                                     ------

       Subcommittee on Government Management, Information, and Technology

                       STEPHEN HORN, California, Chairman
    JUDY BIGGERT, Illinois               JIM TURNER, Texas
    THOMAS M. DAVIS, Virginia            PAUL E. KANJORSKI, Pennsylvania
    GREG WALDEN, Oregon                  MAJOR R. OWENS, New York
    DOUG OSE, California                 PATSY T. MINK, Hawaii
    PAUL RYAN, Wisconsin                 CAROLYN B. MALONEY, New York

                                   Ex Officio

    DAN BURTON, Indiana                  HENRY A. WAXMAN, California
              J. Russell George, Staff Director and Chief Counsel
                       Matt Ryan, Senior Policy Director
                               Bryan Sisk, Clerk
                        Trey Henderson, Minority Counsel

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on March 29, 2000...................................     1
    Statement of:
        Brock, Jack L., Jr., Director, Governmentwide and Defense
          Information Systems, U.S. General Accounting Office,
          accompanied by Jean Boltz, U.S. General Accounting Office..     7
        Collier, Paul, division general manager, Identix, Inc........    39
        Nelson, Dave, Deputy Chief Information Officer, National
          Aeronautics and Space Administration.......................    27
    Letters, statements, et cetera, submitted for the record by:
        Brock, Jack L., Jr., Director, Governmentwide and Defense
          Information Systems, U.S. General Accounting Office,
          prepared statement of......................................    13
        Collier, Paul, division general manager, Identix, Inc,
          prepared statement of......................................    42
        Horn, Hon. Stephen, a Representative in Congress from the
          State of California, prepared statement of.................     3
        Nelson, Dave, Deputy Chief Information Officer, National
          Aeronautics and Space Administration, prepared statement of    30
        Turner, Hon. Jim, a Representative in Congress from the State
          of Texas, prepared statement of............................     5

               ENHANCING COMPUTER SECURITY: WHAT TOOLS WORK BEST

                                  ----------

                           WEDNESDAY, MARCH 29, 2000

                      House of Representatives,
    Subcommittee on Government Management, Information,
                                        and Technology,
                                Committee on Government Reform,
                                                        Washington, DC.
        The subcommittee met, pursuant to notice, at 10 a.m., in
    room 2154, Rayburn House Office Building, Hon. Stephen Horn
    (chairman of the subcommittee) presiding.
        Present: Representatives Horn and Turner.
        Staff present: J. Russell George, staff director and chief
    counsel; Matt Ryan, senior policy director; Bonnie Heald,
    director of communications; Bryan Sisk, clerk; Ryan McKee,
    staff assistant; Trey Henderson, minority counsel; and Jean
    Gosa, minority assistant clerk.
        Mr. Horn. A quorum being present, the Subcommittee on
    Government Management, Information, and Technology will come to
    order.
        This is the second in a series of hearings to examine
    computer security concerns in the Federal Government. The
    subcommittee's first hearing 3 weeks ago shed light on two
    important topics, awareness of the increasing number of
    computer threats against Federal and private computer systems,
    and the need for a coordinated Federal effort to meet this
    challenge.
        History is full of claims of developing the ultimate
    weapon, whether it was a battleship, a supersonic fighter jet,
    or a weapon capable of massive destruction. Today's computer
    systems and networks provide the newest frontier, the weaponry
    of knowledge. With only a few keystrokes, computers provide
    massive amounts of information, information that only a decade
    ago would have taken months or years to compile. It is, of
    course, imperative that these computers and the wealth of
    information they contain be protected.
        Nearly all computer networks are vulnerable to attack at
    some level, but steps can be taken to prevent or reduce those
    intrusions. Organizations must focus on two areas, physical
    security and information security. No one would buy an
    expensive house, furnish it, then walk away leaving the doors
    wide open. Physical assets must be protected. Yet many
    organizations fail to take basic precautions to protect either
    their facilities or their computer systems.
        Electronic government and electronic commerce trends should
    continue to dictate the way important data are exchanged. From
    tax refunds and health records to credit card purchases and
    Social Security numbers, organizations must demonstrate that
    the information flowing into their computers is secure. Tools
    are available to help organizations and citizens protect their
    computers against unwanted and unruly intruders. However, they
    must be carefully used to ensure that they lead to meaningful
    improvement. Today our witnesses will talk about some of these
    tools that can enhance computer security at little or no cost.
    We welcome our panel of witnesses. We look forward to their
    testimony.
        [The prepared statement of Hon. Stephen Horn follows:]
        [GRAPHIC] [TIFF OMITTED] T9819.001

        Mr. Horn. It is now my pleasure to call on the ranking
    member of the subcommittee, Mr. Turner of Texas, for an opening
    statement.
        Mr. Turner. Thank you, Mr. Chairman. This is the second in
    a series of hearings that the chairman has designated to
    discuss the issue of computer security in the Federal
    Government, and it is apparent to all of us that we have become
    increasingly dependent upon computer systems and the Internet.
    It represents one of our greatest strengths, but perhaps also
    one of our greatest weaknesses and vulnerabilities.
        While we rely extensively on electronic data, we have
    become increasingly vulnerable. The General Accounting Office
    has stated that our computer security system is not where it
    needs to be to protect ourselves from cyberinvaders. We lack an
    overall comprehensive program in the Federal Government to
    protect our computer system, and billions of dollars in Federal
    assets and large amounts of sensitive data are at risk to the
    threat of hackers, both foreign and domestic.
        I am pleased that the chairman has chosen to focus upon
    this issue of computer security, and I look forward to hearing
    from each of our witnesses today.
        Mr. Horn. I thank the gentleman.
        [The prepared statement of Hon. Jim Turner follows:]
        [GRAPHIC] [TIFF OMITTED] T9819.002

        [GRAPHIC] [TIFF OMITTED] T9819.003

        Mr. Horn. Let me tell you the procedure here. Some of you
    have testified here before, but when we introduce you, and we
    will go in the order it is on the agenda, your statement, as
    written, is fully in the record. What we would like you to do
    is spend 5 minutes and at the most 8 or 10 to summarize your
    statement, not read it to us. We can read. Then we have more
    time for dialog between the three of you and dialog with the
    Members here today.
        So we, as you know, swear in all witnesses before these
    subcommittees of government reform, and if you will stand,
    raise your right hand, we will swear you in.
        Anybody that is going to give you advice, swear them in,
    too.
        [Witnesses sworn.]
        Mr. Horn. The record will note that three witnesses and one
    helper affirmed the oath.
        So we will now start with Mr. Brock of the U.S. General
    Accounting Office, part of the legislative branch of Congress,
    who does a wonderful job on both programmatic and fiscal
    matters.
        Mr. Jack Brock is no stranger to this subcommittee. He is
    Director of Governmentwide and Defense Information Systems for
    the U.S. General Accounting Office, otherwise known as GAO.
        Mr. Brock.

     STATEMENT OF JACK L. BROCK, JR., DIRECTOR, GOVERNMENTWIDE AND
     DEFENSE INFORMATION SYSTEMS, U.S. GENERAL ACCOUNTING OFFICE,
       ACCOMPANIED BY JEAN BOLTZ, U.S. GENERAL ACCOUNTING OFFICE

        Mr. Brock. Thank you very much, Mr. Chairman. Good morning
    to you. Good morning, Mr. Turner.
        I would like to note that my license plates say Native
    Texan.
        I would also like to introduce Ms. Jean Boltz. Ms. Boltz is
    a senior manager in my group and actually directs a great deal
    of our computer security work.
        Mr. Horn. That's B-O-W-L-T-Z.
        Mr. Brock. B-O-L-T-Z.
        Mr. Horn. I am glad I asked.
        Mr. Brock. I know you have had a prior hearing on computer
    security, and in that hearing you discussed the importance of
    good security, but good computer security is important to every
    facet of government operations. It assures the integrity and
    the confidentiality of information and key processes. It is
    important to national security. It is important to other
    critical operations. It is important in assuring the integrity
    of transactions between the government and its citizens; and as
    e-commerce and e-government become more prevalent, it is the
    cornerstone of making sure that those services actually achieve
    the objectives of better government, more efficient government,
    more productive government.
        What we found, though, in our work, as you have noted, is
    that at virtually every major agency that we go to computer
    security, the computer security practices within those agencies
    doesn't match the importance of the topic. We or other
    independent auditors whose work we reviewed have found serious
    computer security weaknesses in virtually every major Federal
    agency, and these weaknesses threaten or potentially threaten
    the ability of these agencies to protect the confidentiality of
    key data, to perform critical operations, and assure the
    integrity of important financial and data transactions. I have
    identified several examples in my testimony, but I would just
    like to quote here what we found at EPA, which is our most
    recent report.
        We found serious and pervasive problems that essentially
    render EPA's agencywide information security program
    ineffective. We found that the current security program
    planning and management is largely a paper exercise that has
    done little to substantially identify, evaluate, and mitigate
    risk to the agency's data and systems.
        What we found essentially, Mr. Chairman, that EPA has a
    central network, and most of EPA's business functions operate
    off that network. We were able to penetrate the firewall, which
    was largely ineffective, penetrate limited access controls, and
    essentially could have had access to most of the information
    and processes that ran throughout the entire agency. So the
    entire agency in this case was vulnerable.
        EPA is not alone. Recent reports at DOD, at NASA--Mr.
    Nelson will be talking about that in a moment--the State
    Department, the National Finance Center, the Veterans
    Administration all had serious weaknesses. I would, at the risk
    of preempting Mr. Nelson, say that they have made substantial
    strides in improving their program, and our limited followup
    work has substantiated those improvements.
        I would like to spend just a moment, if I could, going over
    the common problems that we find at agencies, and we have a
    chart that I would refer you to. Mr. Mike Gilmore is up there
    handling the charts.
        First of all, computer security programs have to support
    the organizational mission and goals of the agency. They can't
    be divorced from what the agency does, or they are not
    relevant.
        Running across the agency is an entitywide security program
    planning and management. This is what assures the relevancy of
    your computer security program to what you are trying to
    achieve at the agency. And then under that we have found a
    series of problems that are present in most of our reviews.
    First of all, many agencies do not have relevant security
    program planning and management, and we are going to talk about
    that in a little bit, but that's the root of the problem. When
    you look at access controls--access controls, you were talking
    about a house, access controls represent the fence around the
    house. They represent the lock on the door. They are not in
    place.
        Here we are talking mainly about processes that provide
    authentication that you are who you say you are and, second,
    that limit your rights to material that's relevant to you.
        Software development and change controls. We are actually
    doing an assignment for you right now and we are meeting with
    your staff next week to go over the results of that. That means
    that when you change software, when you make changes in code,
    or when new software is introduced, that is tested to make sure
    that you are not maliciously--you are inadvertently introducing
    new weaknesses into your application, we find that to be a
    common problem in many agencies, where that testing is not
    done, and weaknesses are then inserted into an application that
    was previously strong.
        The next one is on service continuity controls, there you
    want to maintain the ability to recover from disaster, or if
    the worst happens, that you are able to take strides to recover
    your operations and to move forward. Many agencies that we have
    gone to do not have good service continuity controls, would not
    be able to reconstruct their principal systems, and would have
    difficulty bringing--coming back up to speed in an acceptable
    amount of time.
        System software controls, these are really sort of the
    heart and brains of many systems. These are the basic operating
    systems, the utilities, that if you don't have good controls
    over these, a hacker or an intruder can go in and assume
    control over the entire network by becoming a systems
    administrator and assuming higher powers than he or she should.
        And then finally segregation of duties, if you don't
    separate the duties from the person who writes the code, the
    person who inserts the code, the person who tests, the various
    people who have some element of authorities over the computer
    security, then you run the risk of empowering one person or a
    small number of people with too much authorities. It is much
    like someone who might have authorities over receiving funds,
    recording those funds, disbursing those funds, and then doing
    the final accounting. The more you place those duties in the
    hands of one or a very small number of people, you run the risk
    of malfeasance.
        These are the problems, and you requested that we prepare
    for you a listing of things that you could do to fix the
    problems. This really falls into two categories: Is what can
    you do right now, and what do you need to do on a long-term to
    have more permanency? Again, I am going to go back to your
    house example.
        Ideally, in a house you have some sort of an alarm system,
    a fire suppressant system, or whatever. In this case, the house
    is on fire. Building a fire suppressant system isn't going to
    do you much good. You have to throw a pail of water on it right
    now. So we have identified a number of actions that an agency
    can do now.
        Any agency could start on this this afternoon and work on
    it. So, again, I would refer you to the next table up there,
    and we have identified a number of things in our work that can
    be done. The diagram there is designed so that if you take
    these actions, you will, in fact, be compressing risk and
    minimizing risk. The first thing you need to do is to increase
    awareness at all levels, and at the management levels managers
    need to be aware that this is their information, these are
    their programs, that poor computer security endangers their
    activities that they have accountability and responsibility
    for.
        At the user level, you need to make users aware that
    actions they take in terms of poor password control, sharing
    passwords, not following agency procedures and processes may,
    in fact, endanger the system, and at the technical level system
    administrators need to be aware that if they don't take their
    actions seriously, if they don't have the right kind of
    training, if they don't institute software patches or whatever,
    they are also endangering the system. So there needs to be a
    much higher level of awareness in most agencies.
        Second, you have to make sure that the controls you have
    work. I know there are going to be tools demonstrated here
    today. Every agency has tools, and when we go into agencies, we
    frequently find that those tools aren't working. They are not
    turned on. They are not monitored. So agencies are spending
    money for tools, but they are not using the tools. It is very
    similar to the set of tools I have in my garage that my father
    gave me when I moved here from Texas 27 years ago. He said, you
    will need these tools, and I am sure I do need the tools, but
    they are still in the tool box.
        The same thing with many agencies. Tools are present, but
    they are not turned on, they are not monitored. You are really
    not sure that they are working or not.
        Third, is implementing software patches. The Carnegie
    Mellon CERT-CC has said in most of the intrusions they get,
    most of the incidents that are reported to that organization
    exploit known vulnerabilities, and for most known
    vulnerabilities there are existing patches that could be
    implemented. Many agencies are aware of the patches. They don't
    follow the advisories that are coming up from the vendors, they
    don't follow the advisories that are coming out from the CERT,
    or they don't follow the advisories that come out of their own
    agencies. By not patching software with known holes, they are
    leaving in place known vulnerabilities that offer a hacker or
    an intruder an opportunity to enter into their system.
        Next, is to identify and propagate pockets of excellence.
    Almost every agency we go to, regardless of their overall
    program and whether it is good or bad, have individual centers
    or individual programs that work really well. Unfortunately,
    they are working in concert with other programs that don't work
    so well, and so sometimes the good effect there is mitigated.
    But if agencies would identify those pockets of excellence, use
    those as best practices within the agency, where the agency
    culture to some degree has already accepted these practices,
    propagate those across the agency, there would be opportunities
    for immediate improvements.
        Finally, to focus on the most common vulnerabilities first,
    when we go into agencies, we find throughout the agency that
    there are a few set of problems that come up time and time
    again, and surprisingly enough, when we go from one system
    administrator to the other, they are frequently not aware of
    the problems that their compatriot down the hall is facing.
    These need to be shared within the agency. Those need to be
    addressed first.
        Further, we are finding that many of these common problems
    also exist across agencies, and, again, there is very little
    sharing of that information across the agency.
        If we could turn to the next chart, please.
        And these are things agencies can do now. However, computer
    security is very dynamic. The technology is changing in a
    hurry. The tools are changing. The techniques that intruders
    might be using are changing. So the program really has to have
    a sense of structure in order to make sure that the computer
    security program is dynamic and, in fact, changes as the threat
    and risk changes.
        About 2 years ago we did a study of leading organizations
    that had good computer security, and we found a common set of
    practices in these agencies that we believe are appropriate for
    Federal agencies to use. In fact, the Federal CIO Council
    endorsed these practices, and several agencies have included
    them within their own policy and structure.
        The S. 1993, the computer security bill introduced by
    Senators Thompson and Lieberman earlier this year, also
    incorporates these practices, they start off with a central
    focal point for computer security. Regardless of whether the
    agency is decentralized or centralized, the central focal
    point--there was always a central focal point. I think this is
    true at NASA, where NASA is highly decentralized, and yet Mr.
    Nelson is the central focal point for security.
        The real cornerstone of that, though, is that agencies need
    to assess the risk and determine needs. Without risk
    assessment, you can't move to that next box and have effective
    controls and policies. Your controls and policies need to be
    built on your risk assessment. They need to be appropriate for
    the risks that you are facing and, from that, promote
    awareness. Again, you can increase awareness at all levels on a
    general level, but at some point the awareness needs to be
    focused on your exact controls that you are using, how to use
    them, and on the risks that you are facing so that people
    throughout the organization can take appropriate action; and
    then, finally, monitor, and evaluate.
        There are two parts to that. First, managers need to do
    their own self-evaluation so that they can continually assess
    where the agency is; and second, there needs to be an
    independent evaluation, something that we might do or the NASA
    IG might do that would allow both the agency and the oversight
    agencies or committees such as yourself to take a look at what
    is going on within the agency. We feel that if this framework
    was adopted, truly adopted, by agencies, it would go a long
    ways toward correcting the common problems that we see.
        By establishing a framework, we think that an agency can
    fulfill several key tasks: One, that agency actions are
    appropriately controlled and coordinated; that the testing
    tools are appropriately selected and tested; that personnel
    involved in using the tools are trained; that good practices
    and lessons learned are shared on an agencywide basis; that
    controls are systematically tested to ensure that they are
    effective; and that appropriate risk management decisions are
    made regarding the best way to address and identify problems.
        I would just like to highlight that a little bit. If you do
    not assess the risk, the controls that you have implemented may
    or may not be appropriate. You may well be spending too much
    money. You may not be spending enough money. But almost
    certainly you will have the wrong kind of control in place, and
    you really won't address your company'S problems.
        In conclusion, we also believe, Mr. Chairman, there needs
    to be some reconsideration of the current legislative
    framework. The Computer Security Act and A-130, which provides
    the regulations for the Computer Security Act, really is a
    system-based piece of legislation. It is based on making every
    system good and that the accumulation of those good systems
    will, in fact, represent a good agency program. I don't think
    that works. It hasn't worked. Legislation needs to be
    considered that would, in fact, provide a management framework
    and a management perspective.
        Also CSA has two categories of information. It is
    classified or nonclassified, sensitive or nonsensitive.
    Actually, information is graduated. Some systems are at a very
    low level of risk. Some are at a high level of risk, and
    policies need to be implemented that really reflect that
    gradation. It doesn't recognize the need for an independent
    audit, and second--or third, it doesn't recognize the need for
    more prescriptive guidance that would give agencies more of a
    framework.
        Finally, there is no call for central leadership, somebody
    that can stir the pot, somebody that can make sure that things
    are being done, someone that can provide leadership across the
    government.
        That completes the summary of my statement, Mr. Chairman.
        Mr. Horn. Thank you very much, Mr. Brock. That's a most
    helpful summary.
        [The prepared statement of Mr. Brock follows:]
        [GRAPHIC] [TIFF OMITTED] T9819.004

        [GRAPHIC] [TIFF OMITTED] T9819.005

        [GRAPHIC] [TIFF OMITTED] T9819.006

        [GRAPHIC] [TIFF OMITTED] T9819.007

        [GRAPHIC] [TIFF OMITTED] T9819.008

        [GRAPHIC] [TIFF OMITTED] T9819.009

        [GRAPHIC] [TIFF OMITTED] T9819.010

        [GRAPHIC] [TIFF OMITTED] T9819.011

        [GRAPHIC] [TIFF OMITTED] T9819.012

        [GRAPHIC] [TIFF OMITTED] T9819.013

        [GRAPHIC] [TIFF OMITTED] T9819.014

        [GRAPHIC] [TIFF OMITTED] T9819.015

        [GRAPHIC] [TIFF OMITTED] T9819.016

        [GRAPHIC] [TIFF OMITTED] T9819.017

        Mr. Horn. I might add, I mentioned that all of your texts
    will be in when we introduce you. So will your resumes.
        The next gentleman, the next two, have very rich resumes.
    Dr. David Nelson in particular has certainly been through the
    whole computer community, I can see, in terms of committees and
    responsibilities you have had.
        Currently, he is Deputy Chief Information Officer at the
    National Aeronautics and Space Administration.
        Mr. Nelson.

      STATEMENT OF DAVE NELSON, DEPUTY CHIEF INFORMATION OFFICER,
             NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

        Mr. Nelson. Thank you, Mr. Chairman. Members of the
    subcommittee, I am pleased to appear before you today to
    discuss NASA's views on the security of our information
    technology environment. I have submitted my written statement
    for the record. My oral summary will be quite consistent with
    that of Mr. Brock.
        I would like to emphasize three points. My first point is
    the importance of a sound management framework for information
    technology security. Two years ago, NASA did not have a
    satisfactory framework. Since then we have worked hard to align
    our policy, organization, funding and objectives for effective
    security.
        This began with senior management attention and support,
    including the recognition that information technology security
    is required for safety of lives and property. In an internal
    study, we benchmarked ourselves against good organizations and
    copied the best of what we found. We accepted the
    recommendations of the General Accounting Office review of NASA
    security that Mr. Brock referred to.
        Our actions included issuing up-to-date policy,
    establishing a senior Council to set strategic directions,
    clarifying management responsibilities, budgeting for key tasks
    and collecting metrics of progress.
        NASA places operational responsibility for information
    technology security on line management, complemented by a cadre
    of computer security professionals who provide technical
    assistance and oversight.
        I have mentioned budgets and metrics. If I could have the
    chart, please.
        This chart shows one of our metrics. Plotted is the number
    of serious incidents. Those are things like destruction of
    data, theft of passwords, or damage to software, versus on the
    X axis the percent of the information technology budget that is
    spent on security. Each point is a specific center, and the
    data is real. Notice the trend line. As you start from the
    left, as the percentage of budget increases to about 2 percent,
    the number of incidents levels off. This suggests that spending
    about 2 percent of information technology budget on security
    gives a good return on information. Spending less increases
    risk, as shown by the trend line. Spending more may not add
    much return. We have compared notes on this metric with leading
    companies. They see the same sort of trend and the same sort of
    sweet spot.
        Now, this metric isn't perfect, but it gives us a place to
    start. Metrics like this are our headlights. They guide our
    actions and indicate where we need to work harder.
        My second point is the importance of training. NASA is a
    highly technical organization. We create and modify leading-
    edge information systems to serve our missions. Security risk
    evolves as threats and, as a result, vulnerabilities change, so
    our personnel must understand the principles of effective
    security and apply them to changing situations. Program and
    project managers must be trained to evaluate risks and
    vulnerabilities in designing and maintaining systems entrusted
    to them. System administrators must be trained to properly
    configure and upgrade their systems, to recognize attacks and
    to respond to them. Users must be trained to practice good
    security, to recognize certain types of attack, and to know how
    to get help.
        Over the last 2 years, NASA has developed or acquired new
    training material for managers, system administrators, and
    users. This training is now mandatory for all civil servants,
    and we are gathering metrics on its delivery. In addition, NASA
    has requested comments on a draft regulation that would require
    NASA contractors to adhere to the same standards of training
    that apply to civil servants.
        My last point is the importance of appropriate tools.
    Security tools, which are a combination of computer hardware
    and software programs, help to protect systems and defend
    against attacks.
        The technical details of a particular attack may be very
    complicated, but once the attack is understood, defense against
    it can be incorporated into a tool that is easy to use by a
    trained person.
        Organizations with modest funding, but substantial
    technical skills can obtain free, reputable tools from the
    Internet that offer good capability. However, they may not be
    well-documented or supported and may be somewhat difficult to
    use. NASA tends to purchase key commercial tools and augment
    them with free tools. Obviously, purchased commercial tools
    have a higher initial cost. However, they are often easier to
    use and may have a lower sustaining labor cost.
        Most successful attacks are enabled by a relatively small
    number of weaknesses, as Mr. Brock has observed. These include
    lack of virus detection software; trivial passwords that can
    easily be cracked, that means decrypted; failures to install
    patches for well-known software vulnerabilities; and poorly
    configured computers with open vulnerability holes. Tools help
    us to deal with each of these classes of problems. In my
    written statement, I have described a number of these and the
    practices that NASA uses.
        New problems keep appearing, along with new defenses. Thus,
    the tools and their use must evolve. There is no substitute for
    good proactive management that can respond quickly and
    effectively. Unfortunately, easy-to-use tools for attacking
    systems are also available on the Internet, and they are
    constantly getting better. This means it takes less skill to
    mount a sophisticated attack than it used to. The ecologists
    would call this a classic predator-prey situation in which both
    predator and prey evolve quickly to secure competitive
    advantage.
        In conclusion, NASA is facing the challenge of the evolving
    security universe by marshalling effective management,
    effective training, and effective technology. We are in an
    environment of increasingly numerous and serious threats, along
    with systems whose vulnerabilities tend to increase as they
    become more complicated.
        Fortunately, our tools and process allow us to make
    progress in dealing with this environment, but it is a never-
    ending process. We take response--we take seriously our
    responsibility as stewards of the public's space and
    aeronautics information and systems. We are committed to
    working with other agencies of the executive branch and with
    the Congress to ensure that we maintain the proper balance
    between accessibility of research results and protection of our
    information technology investment.
        Thank you for the opportunity to testify before you today.
    I look forward to answering your questions.
        Mr. Horn. Well, thank you very much.
        [The prepared statement of Mr. Nelson follows:]
        [GRAPHIC] [TIFF OMITTED] T9819.018

        [GRAPHIC] [TIFF OMITTED] T9819.019

        [GRAPHIC] [TIFF OMITTED] T9819.020

        [GRAPHIC] [TIFF OMITTED] T9819.021

        [GRAPHIC] [TIFF OMITTED] T9819.022

        [GRAPHIC] [TIFF OMITTED] T9819.023

        [GRAPHIC] [TIFF OMITTED] T9819.024

        [GRAPHIC] [TIFF OMITTED] T9819.025

        [GRAPHIC] [TIFF OMITTED] T9819.026

        Mr. Horn. Those bells show that there is a vote on the
    floor, so we are going to have to go into recess for 20 minutes
    before we will take up Mr. Collier and then the questions. So
    relax.
        [Recess.]
        Mr. Horn. The subcommittee will now end the recess for the
    voting on the floor, and we will begin with Mr. Paul Collier,
    division general manager of Identix Solutions.
        You might want to tell us a little about Identix Solutions.
    Put in a plug so I can understand it.
        Go ahead, Mr. Collier.

     STATEMENT OF PAUL COLLIER, DIVISION GENERAL MANAGER, IDENTIX,
                                  INC.

        Mr. Collier. Thank you, Mr. Chairman. Thank you for
    inviting me to be a part of this distinguished panel today. My
    testimony will focus on technology available that offers a
    significant advance in the protection of computer networks and
    critical data systems.
        The greatest challenge we face in controlling access to
    computers and information is positive user authentication.
    Recent events show that the proliferation of the Internet, our
    increased reliance on computer-based information and the rapid
    growth of mobile computing has far outpaced our ability to
    secure these systems.
        Traditionally the use of passwords has been our best
    defense. Recent advances in password cracking software and
    increased computer processor speeds have required passwords to
    become more complex and changed more frequently.
        The human element in this new equation has been pushed to
    the limit. We now see more passwords written on the back of
    mouse pads, on desk leaves, and even on Post-It notes affixed
    to monitors. In addition, users tend to leave work stations
    logged on and unattended because of the added inconvenience.
        It should be noted that there is no single technology that
    can serve as a panacea for positive user authentication.
    However, a combination of available technologies, working in
    concert, can provide a significant advance in addressing this
    need. The positive user authentication model consists of three
    elements, something you have, something you know, and something
    you are: Something you have, such as a smart card with a
    digital certificate embedded in the microprocessor; something
    you know, a simple PIN, as few as four digits; and something
    you are, one or more biometrics.
        Someone can give an unauthorized individual their smart
    card or token and tell them their PIN number or password. The
    biometric is the only nontransferable element in this model.
    Briefly, a biometric is a quantitative measurement of a unique
    human attribute or behavioral characteristic, such as
    fingerprints, face, voice, iris pattern, etc.
        Using fingerprints as an example in this model, a finger is
    placed on a sensor and then scanned. The image of the
    fingerprint is then processed by a series of algorithms which
    convert it into a binary representation or template. This
    template is then compared to a reference template stored either
    on a computer or a card-based data storage medium. Like most
    biometrics, you cannot reverse-engineer this binary
    representation and recreate the fingerprint image.
        Fingerprint biometrics have been used in many civil and
    government programs for over 10 years. They have been very
    effective in reducing fraud, eliminating multiple identities,
    and securing access to sensitive areas.
        These wide-scale deployments have served as real-world
    proving grounds for this technology and involve many millions
    of people. Knowledge gained from these programs and applied to
    improvements and cost reductions help produce much of the
    commercial products available today.
        The Federal Government, in partnership with industry, has
    made a significant contribution to the evolution of biometric
    technology. Biometrics would not have advanced to their present
    level without the help of such agencies as the Department of
    Defense, the National Security Agency, the Departments of
    Justice, Energy, Treasury and the National Institute for
    Standards and Technology.
        Like many technologies, biometrics have become faster,
    better, and cheaper. An example, only a few years ago the cost
    to integrate fingerprint biometric technology was approximately
    $3,000 per computer. Recent advances have reduced the cost to
    less than $100 per computer. History has shown the ephemeral
    nature of benchmarks in information technology, and in the near
    future we can anticipate still further reduction in costs and
    improved performance.
        Commercial Off-The-Shelf products are entering the
    government market via GSA schedule and other procurement
    vehicles. The recent Smart Access/Common ID procurement by the
    General Services Administration represents a 10-year, $1.5
    billion governmentwide contract that includes provisions for
    biometrics used for both physical and logical access.
        Mr. Chairman, with your permission, I would like to
    demonstrate two of the products available today. The first is
    configured to demonstrate the positive user authentication
    model that I discussed earlier. The computer work station that
    you see here is in a locked mode. Attached to it is a keyboard
    with an integrated smart card reader and fingerprint scanner.
    These are commercially available, and the government has really
    taken to this particular one. The user takes his or her smart
    card, which, as you can see, has the smart card chip on the
    back, and inserts it into the work station. The log-on prompts
    the user to choose their log-on ID, enter the four-digit PIN
    number, which is the something-you-know portion--it is telling
    me I haven't put my finger on the scanner--and then place my
    finger on the scanner to complete the log-in process.
        If the user removes the smart card from the computer
    keyboard, the system locks.
        The second product, which is available commercially, many
    of the components of which were developed in conjunction with
    the National Security Agency, is a PC card which has a built-in
    fingerprint scanner. This is a simple replacement for password
    configuration that you see here. The user need only go up to
    the computer, place their finger on the scanner, and the log-on
    process is complete, nothing to remember.
        In 1998, several key companies founded the International
    Biometrics Industry Association. The charter is a nonprofit
    trade association to promote competition, establish an industry
    code of ethics, represent industry concerns, and serve as a
    single voice on major issues such as privacy, computer
    security, e-commerce, and legislative issues.
        I would like to thank the chairman for the opportunity to
    appear here today and demonstrate these products to you. Thank
    you, Mr. Chairman.
        Mr. Horn. Well, we thank you and your other two colleagues
    there.
        [The prepared statement of Mr. Collier follows:]
        [GRAPHIC] [TIFF OMITTED] T9819.027

        [GRAPHIC] [TIFF OMITTED] T9819.028

        [GRAPHIC] [TIFF OMITTED] T9819.029

        [GRAPHIC] [TIFF OMITTED] T9819.030

        [GRAPHIC] [TIFF OMITTED] T9819.031

        [GRAPHIC] [TIFF OMITTED] T9819.032

        [GRAPHIC] [TIFF OMITTED] T9819.033

        [GRAPHIC] [TIFF OMITTED] T9819.034

        [GRAPHIC] [TIFF OMITTED] T9819.035

        [GRAPHIC] [TIFF OMITTED] T9819.036

        [GRAPHIC] [TIFF OMITTED] T9819.037

        [GRAPHIC] [TIFF OMITTED] T9819.038

        [GRAPHIC] [TIFF OMITTED] T9819.039

        [GRAPHIC] [TIFF OMITTED] T9819.040

        [GRAPHIC] [TIFF OMITTED] T9819.041

        [GRAPHIC] [TIFF OMITTED] T9819.042

        [GRAPHIC] [TIFF OMITTED] T9819.043

        [GRAPHIC] [TIFF OMITTED] T9819.044

        [GRAPHIC] [TIFF OMITTED] T9819.045

        [GRAPHIC] [TIFF OMITTED] T9819.046

        [GRAPHIC] [TIFF OMITTED] T9819.047

        [GRAPHIC] [TIFF OMITTED] T9819.048

        [GRAPHIC] [TIFF OMITTED] T9819.049

        [GRAPHIC] [TIFF OMITTED] T9819.050

        [GRAPHIC] [TIFF OMITTED] T9819.051

        Mr. Horn. Let me just ask you about the biometric
    technology chart. While going over to vote and coming back, I
    talked with Mr. Tauzin, who is very interested in this, and he
    is going to have a meeting of the Internet group here on May
    19th and 20th. So we hope what will come out of this testimony
    of yours and the previous panel a couple of weeks ago will be
    helpful.
        One of these patterns is rather interesting to me. A few
    years ago, the Immigration and Naturalization Service put on a
    demonstration in a room in the Capitol, various things they
    could do to identify people. I was fascinated by the one where
    you put your hand in.
        Is that on your chart, the vein patterns, paren, hand? Is
    that the one, or is that separate from that?
        Mr. Collier. They are different technologies, though they
    are essentially similar.
        Mr. Horn. Looking at the spread of your fingers, and they
    claimed it was better than fingerprints.
        Mr. Collier. Well, we all have claims, I guess. The hand
    geometry system used by the Immigration and Naturalization
    Service, I think, were deployed in their INS-Pass Program and
    are still working to this day. Hand geometry is a viable
    technology. Fingerprints appear to be what the government has
    embraced because of the long experience with them.
        Mr. Horn. Yes. So is there any sort of works on this that
    will give us an idea as to which is the better of the two
    between fingerprints and the hand pattern? Anybody research
    that?
        Mr. Collier. I believe they both have their place. There
    are about 15 different biometric disciplines. There is no one
    discipline that fits all scenarios. The real issue comes down
    to cost per seat, per deployment. Some of the biometrics
    available are extremely effective, but may cost $100,000 per
    unit to deploy. It is never going to see widespread deployment
    at that cost.
        There are studies that have been done by the National
    Security Agency that are available. There are studies done by
    the National Biometric Test Center at San Jose State
    University, and Sandia Laboratories did some studies several
    years ago for the Department of Energy.
        Mr. Horn. This is a question really for all of you, and
    that's based on the testimony. It appears many computer
    security tools are free or at little cost, and I guess the
    question is this: Why aren't more agencies taking advantage of
    all the security tools readily available to them? What is your
    experience on that?
        Mr. Brock. Well, I think that many tools are free, are
    readily available. Many of the tools you can actually download
    from the Internet or are made available from vendors free or
    low charge.
        What we have seen is that agencies inconsistently use the
    tools, or they don't provide the appropriate training to
    understand how to use the tools, or they don't even know how to
    turn the tools on. So while the tools are available, they are
    just not used properly. That seems to be the biggest problem
    that we have found.
        Mr. Nelson. I would agree and would add there is motivation
    and resources involved. As I said in my testimony, nothing is
    free because there is a labor cost. Many system administrators
    were sort of pressed into the job. They weren't well-trained.
    It is a new field, and many of them are overloaded because
    management doesn't appreciate the importance of security, so
    that even if they know in principle the tools are available,
    finding the time to acquire them, to understand them, and to
    deploy them and to then take action based on them is a pretty
    big load.
        As I indicated in my testimony, at NASA we have deployed
    uniform suites of commercially acquired tools because our
    study--I won't say it was a thorough study, but we looked at
    the cost of labor and the ease of use, and we found that the
    commercial tools were a better buy for us, but then augmented
    by selected free tools. No tool is perfect.
        Mr. Horn. I was interested in your testimony where you put
    the stress on training and supervision, and you remind me now
    on management we put a measure through here, and it is, I
    think, almost law, or it is still in the Senate, and that would
    be to give the new President, whoever that is, a chance to
    relate to the top management that he would bring in.
    Ordinarily, between the Cabinet, the independent agencies,
    that's about 30. Then you have got about 300 Commissioners and
    Under Secretaries, so forth.
        I think we definitely ought to get on that agenda, then,
    their understanding of this type of security management. If it
    goes up that high, and they don't understand it, I think it
    will--and staff will note this, and we will put it in maybe
    even as two words or something in what is coming out of the
    Senate.
        Mr. Nelson. What we did at NASA at the Administrator's
    direction, the Chief Information Officer and I--I am Deputy
    Chief Information Officer--visited each of our 10 centers and
    headquarters and gave hands-on training briefings to the center
    senior and middle managers.
        Now, that wasn't a lot of time, but it emphasized that we
    meant business, and we talked about metrics. We talked about
    actions we were taking. We talked about their responsibilities.
    It seems to be working. So I would commend the administration
    to think of something like that.
        Mr. Horn. Yes, I agree. The way we got leadership finally
    on the Y2K thing in the executive branch was when Mr. Koskinen
    was picked and went around and sat down with all the Deputy
    Secretaries of each department to get them to understand that
    this was serious business.
        Any other comments on that? Mr. Collier.
        Mr. Collier. The tools that are available at little or no
    cost need only the person's desire to implement them. We
    constantly see Windows basic tools for securing systems totally
    inactive. It is a tradeoff between security and convenience.
    Biometrics, we feel, brings both to the party in the sense that
    it does give you the speed. It is not something else to flip on
    and flip off. It is not something else lengthy to remember. If
    we look at what we have done at passwords to overcome this
    ability for people to break into our systems by finding out
    what our passwords are, it is not the dog's name anymore; it is
    not a simple thing that you can keep for a year, or your wife's
    maiden name. It is an upper/lower case, full eight-character
    ASCII 2 set. It is extremely difficult for anyone to remember
    that. Change it every 30 to 60 days, and give them three or
    four to remember, it can bring about a problem.
        So I think the real issue is utilizing the tools that are
    available and making the operators understand that the security
    is important at the risk of what little inconvenience it is
    going to cause.
        Mr. Horn. Well, with reference to this subject, where on
    the Internet can organizations and citizens find these tools?
    Is it there?
        Mr. Nelson. Let me speak to that. In my testimony I
    indicated two sites. One, is our own NASIRC site,
    www.nasirc.gov. The second, that I indicated was the Carnegie
    Mellon CERT that I think Jack also mentioned. They have a good
    set of tools.
        With search engines and other news groups, it is probably a
    half-hour to get started. I mean, this is very easy to do. This
    is probably the easiest step. There is the step of, well, what
    is good and what is not so good; what is easy to use, what is
    not so good--what is not so easy to use. But access is the easy
    part.
        Mr. Brock. I would agree with that.
        Mr. Horn. Intrusion detection tools can either be manual or
    labor-intensive. Is there a better way to monitor potential
    intruders?
        Mr. Brock. Intrusion detection tools are a necessity. What
    is difficult about intrusion detection tools is actually
    following up. I mean, if you--you have an intrusion detection
    tool, and you are logging in intrusions, you need to followup.
    The issue that we found at many agencies is if they have
    intrusion detection tools, and they are logging them in,
    frequently they are not following up on the incidents to take
    corrective action or to do something to stop the intruder.
    That's why they are labor-intensive. You have to look at each
    one individually.
        I can't recall any intruder detection tool that would
    automatically fix the problem or stop the intrusion. At some
    point somebody has to intervene.
        Mr. Nelson. Let me speak to that. Right now, and I agree
    with what Mr. Brock said, right now it is manual, it is labor-
    intensive. At NASA we require that every incident be reported
    to the IT security manager at the center, and then to our
    NASIRC, which we use as a coordination means.
        So we send out encrypted alerts to our security people at
    all centers based on the incidents reported by each center.
    Many of those incidents are detected by the intrusion detection
    tools. The securities managers followup with the system
    administrators to get things fixed. Again, that's quite manual.
        What we are looking at and what I would encourage the
    industry to work harder on is automated, if you will,
    artificial intelligence means to identify intrusions and
    identify a recommended course of action. One of the things we
    are looking at doing, we have not done it yet, is to gather
    from each center--see, we are using the same tool--into a
    centralized analysis location what those tools are reporting
    and apply the artificial intelligence to the set of reports. We
    find that if one NASA is--one NASA center is being attacked,
    often several others are. These are coordinated attacks. But I
    repeat, the artificial intelligence tools for analysis do not
    appear to exist yet. It is an area that NASA is tracking
    carefully, and we hope that in the next year or two we will see
    something we can start to deploy.
        Mr. Brock. If I could just add to that, Mr. Chairman,
    that's true. The intrusion detection tools are very immature at
    this point, and they are evolving. Again, another risk is that
    as--is once an agency or an individual buys a tool, that tool
    is changing rapidly, and the intrusion detection tools, they
    are changing very rapidly, and they are not at a stage of
    maturity now where they are going to provide the final answer.
        Mr. Horn. Is there any way you can tell with the intrusion
    that the--the type of computer is doing that, or is it just
    hopeless? Because I am looking at individuals have one capacity
    generally; foreign governments do have another capacity. If any
    of them have something such as a Cray computer in terms of what
    they can spin around and test things against to break through
    particular firewalls, I am just curious about that.
        Mr. Nelson. Usually we can tell what is called the source
    Internet protocol address, and that identifies the location of
    the attacker fairly well. Occasionally those addresses can be
    what they call spoofed, which means they are faked, but
    typically we can identify that.
        Now, your discussion about the difference between an
    individual and a foreign country, I wouldn't make too much of
    that because groups of individuals are acting together, and the
    power of modern, even personal computers and certainly work
    stations is fully adequate to mount an attack that is very
    serious.
        So we pay a lot of attention to individuals. Obviously when
    we sense that it is a better organized group, all the way up to
    a government, we pay particular attention to it, but we
    wouldn't want to make too fine a point on that distinction.
        Mr. Horn. Any other thoughts on that?
        OK. Mr. Brock, you mentioned in your statement that poor
    security planning and management is, ``the rule rather than the
    exception.'' So why is this posture the rule and not an
    exception?
        Mr. Brock. I wish there was a real simple answer to that
    and that it would be easy to fix. It is, unfortunately, like a
    lot of other issues, and very similar to the Y2K issue, is that
    it--the actual computer security break-ins, the failings there
    are technical. The correction is a management issue. There have
    to be resources devoted to it. There have to be dollars, and
    there has to be training, and the people that own the
    processes, that own the information, that are accountable for
    that need to be accountable for computer security. That is not
    the case, and until that ownership occurs, I don't think you
    will see widespread, systematic repair of the poor computer
    security problems.
        I think that happened in Y2K, in large part because of the
    intensive oversight in Congress, in large part because of Mr.
    Koskinen coming on board, in large part because Federal
    managers were made aware there was a crisis. Those three
    elements have not yet been put in place for computer security.
        Mr. Horn. Well, you have put them very well, and that's
    what I was leading to, in the sense that when Mr. Koskinen came
    on board as assistant to the President, he worked with the
    Chief Information Officer's Council and got the best out of
    them. And I guess I would ask, does the Federal Government need
    one organization or one high-ranking information technology
    officer to coordinate security planning and management? Do we
    need to continue a sort of Koskinen situation and relate it to
    security?
        Mr. Brock. That's an excellent question. I guess when you
    start off saying that's an excellent question, that means you
    are going to be wondering about my answer.
        Mr. Horn. Is there an excellent answer?
        Mr. Brock. I hope so.
        Mr. Horn. We are college professors. We ask questions. We
    don't answer them.
        Mr. Brock. Well, I will go ahead with the answer now.
        The--I believe there needs to be a Federal CIO. I think
    very strongly that the information management issues, the
    information technology issues that run across agencies are
    serious. It is not just in computer security, but it is in
    terms of how you control your investment dollar. It is do you
    have an architecture that will support your business needs and
    your technical needs. There are a series of issues that need to
    be addressed on a consistent basis.
        I think the CIO Council has done a reasonable job of
    looking at some of these, but they are not in power. They don't
    have budget. They don't have staff. They are volunteers on
    this. There needs to be someone who is providing more
    direction, more leadership.
        Now, in terms of--and I believe that in this case a Federal
    CIO would also be responsible for computer security.
        Similarly, if you decided that computer security was an
    important issue in terms of critical infrastructure protection,
    where you were also involving the private sector and you were
    involving physical security as well, I could easily see a role
    for a national coordinator for critical infrastructure
    protection that might be separate from a Federal CIO who would
    be dealing primarily with agency responsibilities.
        Mr. Horn. I have one reservation here, having been in the
    largest educational system in the country, which is California
    State University system. When you put somebody in the system
    headquarters, everybody sort of says, oh, that's their problem,
    and pretty soon they forget that it is their problem. They are
    the campus administrators; that's where it happens. It doesn't
    happen in headquarters. They never educated a student in their
    life. A university does, and so do our departments. They are
    mission-oriented, and they are producing things. I worry if,
    say--to say, well, that isn't my business, let those people
    over in OMB; or if we can separate it into the Office of
    Management or the Office of Budget, and that's what worries me.
    Doesn't that really sort of let up the heat on the individual,
    the independent agencies, Cabinet departments?
        Mr. Brock. If I could go back to the Y2K experience, I
    think that even though there was a national coordinator with
    Mr. Koskinen, he clearly held agencies accountable for their
    actions, as did the President. I was here for several hearings,
    and you were holding those agencies accountable.
        I think you can keep the heat on the agencies. That's where
    the responsibility lies for good computer security.
        Mr. Horn. Right.
        Mr. Brock. But the focal point, the Federal CIO, could
    assist in that. I do not think that the Federal focal point
    should become the stopgap; that this will solve the problems.
    That still has to occur at the agencies, but certainly a CIO at
    the national level could propagate good practices, could
    leverage resources that were available to that individual and
    serve a role, frankly, very similar to the one that Mr.
    Koskinen served.
        Mr. Horn. Yes. We had a specific time period that wasn't
    going to be for 10, 20, or 100 years. It was just going to be a
    few months, and that's really what it boiled down to. And the
    job was very well done obviously, but that's--I need that
    balance, I think.
        Mr. Brock. Yes.
        Mr. Horn. So you don't have people say, hey, it isn't my
    problem, they do that over there, and wash their hands of it. I
    don't think that will help us at all.
        Mr. Brock. No, it would not.
        Mr. Horn. Yes. But we certainly ought to have somebody that
    had the right skills, people skills, so they aren't some czar.
    The czar makes my spine shudder. But so that they are a
    coordinator in getting people in the various systems that
    overlap to work together, that's the way I would view that
    coordinator role.
        Mr. Brock. I would agree. I think that the success of any
    coordinator or official like that does depend very much on that
    individual's personal skills in terms of working with a very
    diverse group of organizations who have different needs and
    different objectives. That's a difficult job, very hard job.
        Mr. Horn. That's right.
        Mr. Nelson, any thoughts on that?
        Mr. Nelson. Yes. Just to add a bit to Mr. Brock, I agree up
    to possibly whether a CIO, Federal CIO, is warranted. As you
    know, that's being debated within the administration, and I
    won't take a position on that.
        I agree with him that one does not want to separate the
    computer security aspects from other aspects of management. We
    are focusing on computer security today because, indeed, it is
    a new problem. I am an optimist, and I think we are going to
    get this problem under control, and if we have a legacy of a
    fragmented management approach, it is going to take on a life
    of its own.
        A number of years ago, I worked on environmental protection
    and on OSHA problems, and one of the things that I pushed on
    was to reintegrate those functions. I called them the OSHA
    Mafia, back with management, because management was abdicating
    its responsibility, and, frankly, the Mafia in some cases were
    running rampant with things that didn't make sense. Now, that's
    a very personal observation. It's not NASA's observation. But
    my experience in this area tells me that you want to integrate,
    you want to set high standards, you want to measure, you want
    to train, but you put the responsibility on the people who have
    to make the tradeoffs and get the job done.
        Mr. Horn. I agree with you completely on that. You say it
    very well.
        Mr. Collier, any further thoughts on this?
        Mr. Collier. Mr. Brock and Mr. Nelson both mentioned that
    communication between different agencies and even within a
    particular agency is a critical element here. Within the
    government, of course, the Critical Information Assurance
    Office paper that came out this past year points to that. The
    CIOs do have several venues in which they talk to each other.
    The Government Information Technology Services Board, I think,
    has done a good job in at least keeping the communication
    flowing between agencies.
        But I would tend to agree with you that to establish an
    individual to take on this responsibility may not be the proper
    way. The proper way to do this would be probably to continue
    the communications, the lines of discussions, between agencies.
        Mr. Horn. In your statement, Mr. Brock, you mentioned that
    your audits have shown that Governmentwide computer security is
    generally weak because current policies and controls are not
    operating effectively. You also stated that the General
    Accounting Office audits frequently find the same
    vulnerabilities over and over and over again.
        In your opinion, what would you specifically suggest that
    agencies do to strengthen existing policy or to create stronger
    policies? What is your thinking on that?
        Mr. Brock. The--you are correct. Our reports have found the
    same problem over and over again.
        A couple of observations. First of all, many of the
    policies have no relationship or a limited relationship to the
    problems that we are finding. They are not specific to the
    issues and problems that are within an agency. We believe that
    policies and procedures need to be based on the risk that the
    agencies are facing, and if you do a good risk assessment, you
    can then, in fact, determine policies and procedures that will
    minimize or mitigate those risks.
        Second, most agencies aren't testing their controls. They
    rely on GAO or IG to come in and do the test, so there is too
    limited information within the agency, one, about what the
    risks are and whether the policies would be reflective of
    reducing that risk, and second, are the controls in place
    working, are they being tested? Those are the things that we
    would do to, one, develop policies that are appropriate, and,
    second, to strengthen existing policies to make them more
    responsive.
        Mr. Horn. You also suggested that agencies develop and
    distribute lists of vulnerabilities. To whom would these lists
    be distributed?
        Mr. Brock. Well, first of all----
        Mr. Horn. Should it be GAO; should it be OMB; what, CIO
    Council?
        Mr. Brock. Everyone.
        Mr. Horn. All of the above?
        Mr. Brock. First of all, let's start within the agency. I
    believe I mentioned earlier within some agencies we would go
    to, they do not distribute such lists within the agency so that
    people that are literally down the hall are not getting these
    lists. So, first of all, you need to start within the agency.
        Second, there are other organizations, such as the CERT-CC,
    the Carnegie Mellon, the Fed CERT, the GSA runs, organizations
    that do have distribution mechanisms that are appropriate as
    well.
        Mr. Horn. Yet Dilbert and the cubicle is broken down?
        Mr. Brock. Yes.
        Mr. Horn. Mr. Brock, you stated that establishing a
    framework for managing security is important. What specific
    elements of the framework are missing at most agencies?
        Mr. Brock. If I could indulge Mr. Gilmore to put up the
    circular chart, the wheel.
        The risk management cycle, we believe, is the framework. I
    will go back to an answer I just gave you, that the framework
    has to start with a central focal point, the accountability.
    From there, determine what the risks are, develop controls
    based on that risk, promote awareness, and then continuously
    monitor and evaluate. That's the framework.
        Certainly there are things that you can do independent of
    that framework, or you don't have to implement everything in
    that exact cycle, but it is dynamic. It is continuous. The
    threat is growing. The threat changes. The technology grows.
    The technology changes. The services that an agency provides
    change. So the risk management cycle has to roll on a
    continuous basis.
        Mr. Horn. So it is interactive in many ways?
        Mr. Brock. Yes, sir.
        Mr. Horn. Gentleman, Mr. Nelson, Mr. Collier, what do you
    think about that approach there, just as one vision?
        Mr. Nelson. Yes. I agree with Mr. Brock. I would like to
    give you some examples of what we are doing at NASA along these
    lines.
        I said before that it starts with management. We have
    identified what we call special management attention systems.
    These are important computer systems for NASA's missions, and
    we are requiring 100 percent completion of security plans for
    those systems by this year, and we have asked our Inspector
    General to audit that, including the involvement of management
    in those plans and management signature on the readiness of
    those systems to operate.
        But we have had to operate in parallel because the risk is
    too great. So at the same time we have identified what we call
    the top 50 vulnerabilities in NASA, and we have distributed
    that list to every center. It was done by consensus, not
    somebody in a closet, but using the tools that I described, all
    of our systems are being audited for the presence of those
    vulnerabilities. When those vulnerabilities are detected,
    management is informed of them and asked to correct them, and
    then those systems are rescanned.
        Now, management, if in its interest it believes that some
    of those vulnerabilities must maintain because the risk is
    tolerable and the loss to mission is too great, they can do a
    waiver. But this forces them to act even before some of their
    plans are completed, because we think that it is too much of a
    crisis.
        Mr. Horn. OK. Any other comments on that question?
        Mr. Collier. I would agree that it is a management and
    policy issue. When the Department of Defense began its studies
    of biometrics back in the late 1980's, early 1990's, there was
    as much emphasis placed on the people interface to biometrics
    as there was on the technology side.
        I found that a very refreshing model. I mean, the human
    element is really what is the issue here. Technology pretty
    much does what we make it to do, and it keeps on doing it. In
    the area of security, however, the Department of Defense
    studies, especially of the National Security Agency, involved
    the study of time, motion, and the people's acceptance of a new
    way of doing things, and labor was definitely a part of the
    decisionmaking process.
        I think that's a critical element in moving forward, to
    remain dynamic enough to meet the threats as they continue to
    improve on a day-to-day basis.
        Mr. Horn. Mr. Nelson, any further comment on that question?
        Mr. Nelson. No, thank you.
        Mr. Horn. Mr. Turner has joined us. I am delighted to yield
    such time as he may need for questioning.
        Mr. Turner.
        Mr. Turner. Mr. Nelson, I wanted to ask you if you could
    describe for us the kind of computer intrusions and attacks
    that you have experienced. We talk about this all the time, and
    I don't really have a good grasp on the scope of the problem.
    So can you quantify that and maybe give us some specific
    examples of how some hacker has invaded your system, what the
    consequences have been?
        Mr. Nelson. Yes.
        Mr. Turner. I know that we always read this is a widespread
    problem.
        Mr. Nelson. Yes.
        Mr. Turner. I don't think we have a real feel for how
    widespread it really is.
        Mr. Nelson. First of all, NASA experiences a lot of
    attacks, hundreds to thousands per month.
        Mr. Turner. You say hundreds to thousands?
        Mr. Nelson. Hundreds to thousands--of serious--to thousands
    per month of serious attacks.
        Mr. Turner. Hundreds to thousands?
        Mr. Nelson. Yes. And we are not unusual, although we may be
    are slightly favored.
        Let me give an example of an attack which has several of
    the elements we have been talking about in our testimony.
        I am not going to describe the center, but in this
    particular instance a system administrator observed that
    someone from a foreign country had logged into the computer and
    had no reason to think why that person should have--should be
    able to log into the computer. He did this by examining records
    logs, so he was doing the right thing.
        Now, he found by looking at the log that the person had
    used a well-known vulnerability to take over that computer; in
    other words, to achieve what is called root access. That's like
    god of the computer. You can do anything with the computer if
    you are root.
        Then the person used that vulnerability and his godlike
    powers to install what is called a password sniffer. This is
    software that observes the network traffic flowing by and looks
    for packets that have passwords in them. And he was able, the
    intruder, to grab a number of passwords, some of which were for
    accounts at another center. So using those passwords and then
    the ability to log on as a user, the attacker went to another
    center and attacked several other computers.
        Now, the sad part about this was that the initial
    vulnerability should have been fixed. The system administrator
    thought he had fixed it. He installed what is called a patch.
    It is a thing like a Band-Aid; it is like a patch that changes
    a software to get rid of the vulnerability, but the patch
    didn't take. It was a defective installation process, and the
    system administrator didn't know it. So he was hit twice with
    the same vulnerability.
        Now, we have had other attacks, and we keep track of how
    much they cost, that have had a direct cleanup cost in time and
    resources approaching half a million dollars, one attack. Of
    course, it affected a lot of computers.
        Mr. Turner. You say one attack cost half a million dollars?
        Mr. Nelson. Approached half a million, a little under. The
    numbers are not, of course, audit quality, but these are
    expensive attacks. It took--in the case that I am referring to
    of almost half a million dollars, it took about a month to put
    all of these computers back together again. It was a major
    problem.
        We have had centers actually take themselves off the
    Internet, in other words totally sever connections with the
    outside for a brief period of time, because they felt that they
    were being attacked, the risk was too high, they needed that
    time to fix things up.
        Now, the incidents that I am describing now are a year or
    two old, and we don't have such bad problems now, but we still
    get significant attacks.
        Does this help? Does this give you a sense of--oh, one area
    that I didn't describe is theft of data. We had an incident not
    too long ago where substantial number of documents were stolen
    by an Internet attack.
        Mr. Turner. And what--were those sensitive documents?
        Mr. Nelson. No, fortunately not. They were copyrighted.
    They had commercial value. They were not sensitive. And these
    particular documents were not resident on a NASA computer. It
    was a NASA account that was used, and there was a serious
    weakness in the vendor's security. But that's an example of an
    attack that NASA was peripherally involved with.
        Mr. Turner. So you say there are hundreds to even maybe
    1,000 attacks per month?
        Mr. Nelson. Correct.
        Mr. Turner. Now, have you been able to successfully
    determine the source of any of these attacks? Or do these
    things just go on daily, and you try to prevent them, but you
    don't know who did it?
        Mr. Nelson. We can determine the source of most of them, at
    least within the country, and maybe the organization. And we
    work closely with our Inspector General and then with the FBI,
    and several of these have been prosecuted and the perpetrator
    convicted. In a--on a regular basis, if we see an attack, we
    inform the organization that the attack is coming from, and
    often the attack is from someone not connected with that
    organization, but someone who has seized a computer, seized
    meaning this root access, god powers within the organization.
    The organization may not know it. That could be a government
    organization or a private organization in this country or
    abroad.
        So one wants to be careful saying we are being attacked
    from a certain country; they must be hostile. Maybe they are
    the victim.
        Mr. Turner. So there have been some convictions that have
    resulted from your investigation?
        Mr. Nelson. Yes, sir. Yes, sir.
        Mr. Turner. Would it be fair to say that the vast majority
    of the attacks, that the source of them are--that you never
    quite figure out who did it?
        Mr. Nelson. Yes.
        Mr. Turner. Or where they are from?
        Mr. Nelson. Yes. Not in who the individual was or what
    their motives were, that's correct. And attack isn't
    necessarily successful. I want to make it clear that when I
    talk about hundreds to thousands of attacks, I am including all
    of the incidents that we gather metrics on. The successful
    attacks would be a lot smaller, and increasingly we ward off
    those attacks. We use another metric of what is the success
    rate of incidents, and we are seeing the numbers turn over. It
    is sort of a nice payoff for the hard work we have gone through
    in the last couple of years that our numbers are getting
    better. The attack rates are going up. The successful attack
    rates are going down.
        Mr. Turner. Tell me the examples of intrusions from foreign
    governments or agencies of foreign governments.
        Mr. Nelson. I don't have data on that that I would be
    confident in saying, even in a conversation. So I am sorry, I
    do not have any data on attacks by foreign governments that I
    would have any confidence in reporting.
        You know, it is hard to know, when you have an attack from
    an IP address, even if that is located within an agency of a
    foreign government, is that the activity of a foreign
    government. To the best of my knowledge, we have no evidence of
    NASA attacks by agents of foreign governments, but I do not
    have high confidence in that statement because we do not have
    good data.
        Mr. Turner. The convictions that have resulted from the
    efforts, what kind of individuals are we talking about that
    have actually been convicted of a crime?
        Mr. Nelson. Our Inspector General would be a lot more
    authoritative on this, but I believe they have tended to be
    fairly young males working either alone or with others of like
    mind, but at least my knowledge is that they do not appear to
    be part of what one might call organized either crime or
    terrorism in the conventional sense. Their prime aim, as I
    recall--but I think if you would like we could submit for the
    record a response from our Inspector General, I could request
    it--but as I recall, they have not been industrial espionage
    cases or the like.
        Mr. Turner. I do think it would be helpful, with the
    chairman's permission, to ask you to at least give us some
    indication maybe for the last 2 or 3 years of the number of
    attacks, how they have been resolved, and whatever information
    you can provide us about the source of them, because at least
    by looking at it as a whole, we would get some picture for us
    to look at of how serious this problem really is.
        Is that possible to put that kind of data together to give
    us an overview?
        Mr. Nelson. Indeed, it would. If you will give us just a
    little leeway.
        We try to not advertise the successful attacks. Our
    experience is that one of the motivations for attackers is the
    recognition, if you will, the thrill. We are very leery of
    playing to that.
        Mr. Turner. I suspect that your reticence on that point is
    shared by many people in various agencies of the government,
    and I think one of the difficulties that we have as a committee
    in trying to address this problem is trying to get some data
    together to indicate how serious this problem really is.
        Mr. Nelson. We would be eager to work with you on getting
    data that is helpful to you.
        Mr. Turner. When you deal with these kind of intrusions, do
    you rely upon NASA employees, or do you rely on contractors to
    help you resolve them?
        Mr. Nelson. Both. Many of NASA's services are now operated
    by contractors, and so we have integrated those contractors
    into our operations. In our testimony--in my testimony, I
    mentioned that we have a draft regulation out for comment that
    would require the same training standards for our contractors
    as for ourselves. NASA has not outsourced or not contracted out
    our security responsibilities. So where we have contractors
    operating systems within our centers, or otherwise directly
    attached to NASA, we retain the responsibility and the
    capability for detecting and responding to attacks.
        Now, that response may be asking the contractor to do
    something. Since they are well-integrated now into our
    planning, they are eager to do that.
        I think the system is working fairly well, but it has added
    a complication of crossing these contract boundaries.
        Mr. Turner. Is it possible for an intruder to compromise
    the success of any of our missions? I know you have had a
    tremendous problem recently with success in some of the Mars
    missions. Is it possible that a problem could be created of
    that nature by an intruder into our computer systems?
        Mr. Nelson. We take pretty strong security precautions for
    mission-critical systems. Having said that, there is always a
    possibility. We are into risk management. Risk avoidance is
    very difficult. We do, though, take, as I said, very strong
    precautions, including in some cases simply severing the
    critical system, planned severing from any outside
    communication to minimize that risk, but we are talking about
    risk management, not risk avoidance.
        Mr. Turner. Thank you, Mr. Chairman.
        Mr. Horn. Well, we thank you. That was a very useful
    interchange, questions and answers.
        Let me go back, Mr. Nelson. Has your top 50 list of
    vulnerabilities been distributed outside of NASA?
        Mr. Nelson. Not to my knowledge. It was a list that we
    arrived at working among ourselves, and it is a list that we
    have programmed into our auditing tools. So it is, in effect,
    automated now. But I am not aware that we have distributed it
    outside the agency. There are other agencies that are doing
    similar lists, and I think the overlap would be pretty large.
        Mr. Horn. Well, would it be helpful if in a report from
    this subcommittee that we use some of that information if there
    are ones beyond NASA that differ, and then the question would
    be does that encourage hacking or doesn't it? But how we deal
    with it, I think we have to get the word out.
        Mr. Nelson. We wouldn't want it known what number 51 is,
    and 50 was a good round number, and that 50 will change. It is
    partly getting well. We have had to beat on this one, as I
    indicated earlier, to get managements attention, but we expect
    that next year's top 50 will be a different list, and it may
    not even be 50. But, yes, with appropriate precautions we would
    be willing to share that list, certainly, with responsible
    people in other agencies.
        Mr. Horn. On Mr. Turner's point, I just suggested to Mr.
    Ryan that we find from Justice how many have been jailed and
    where are they. I know a few are in the Atlanta prison, but I
    think it is good to get at least some of them. We don't have to
    make heroes out of them. We can say Mr. Blank and Ms. Blank or
    whatever, because I don't want to have this be the award system
    for hackers.
        Let me ask you, again, Mr. Nelson, another thing. You gave
    a very interesting chart when you said you are spending roughly
    2 percent of the funding for information technology on security
    provided adequate protection. Two percent seems like a very
    modest amount to spend on security, so I guess do you think
    that's pretty low, and should we invest more?
        Mr. Nelson. I can only speak for NASA, and we do gather
    budget data on our actual costs. Our information technology
    budget as a whole is about $2.1 billion, and our fiscal year
    2000 expenditure on information technology security is about
    $46 million, which is a little bit over 2 percent.
        Now, we don't know that that is optimally allocated. So I
    would say at first, my initial reaction is that NASA--and that
    increased quite a bit, by the way, from 1999 to 2000. But NASA
    is now spending about the right amount, and it is a case of
    efficient allocation so that we hit the most important things.
        Mr. Horn. So you think you are at the right level of
    spending on this then?
        Mr. Nelson. Approximately.
        Mr. Horn. OK.
        Mr. Nelson. Yes. Now, Mr. Collier, in your written
    statement, you explained that the prevalence of computer
    passwords written on the back of computer mouse pads, on desk
    leaves, and even on paper attached to computer monitors do
    exist. I know what you mean. I think it is all around Capitol
    Hill, too.
        In addition, you stated that remembering a PIN, the
    personal identification number, is a key piece of computer
    security. In your opinion, what can individuals do to better
    recall passwords?
        Mr. Collier. Aside from memory exercises, if we are going
    into this 8 character password with, again, a full keyboard set
    of characters, I think the idea is to do something to move away
    from these complex passwords. The positive user authentication
    model that I presented earlier is an effort to do just that.
    Again, we have the human being factor here at the edge of the
    envelope.
        Our company has clients, for instance, in the wire transfer
    business where they have 25 passwords to remember. Now, unless
    you are the Great Kreskin, it is pretty difficult to do that.
    So I think rather than trying to formulate ways to help people
    remember passwords, we have to find ways to eliminate them
    entirely, and I think the positive user identification model,
    which I think the DOD originally had come up with 10 years ago,
    is a move toward that.
        Mr. Horn. Does that mean a certain unit has to be built on
    every machine to do that in terms of the fingerprint and all of
    the rest?
        Mr. Collier. Biometrics are certainly one of the legs of
    the stool. The cost, again, is coming down greatly. Right now
    we are seeing it move into the mainstream, certainly in the
    commercial world, protecting enterprise systems within large
    corporations. The Federal Government is doing it at the
    division and command level now, and I think it is just a matter
    of time before we see biometrics not only in computers, of
    course, but in many, many areas of our lives where we have to
    remember passwords, PINs, and the like.
        Mr. Horn. If you had the, say, thumb identification to
    access your particular personal computer, is there any way a
    hacker getting into that would be able to digitize the lines
    and everything else so they could duplicate that?
        Mr. Collier. At the direction of the computer industry and
    the Department of Defense, primary responsibility from the NSA
    side of things, we have addressed the issue of intruder
    attacks, we do encrypt the signals coming out of the scanner,
    so they can't be sniffed. Our product in the sense of the
    templates is part of the operating system which is part of the
    layered security shell around the password protection. We do
    secure sessions between all pieces of hardware, as well as
    between client and work station. There have been a lot of
    efforts put into making this stuff spoof-resistant. James Bond
    might still be able to get in, but not the average user, that's
    for sure.
        Mr. Horn. Well, I was interested when one of you compared
    the need for looking at how you divide the issues in computer
    security are very much like a responsible accounting operation
    when you are handling a lot of money, and you want more than
    one, and my chief auditor said many years ago--he said, make
    sure everybody takes a vacation. The system--when they found
    one in another system in California where the vice chancellor
    just happened to be buying bales of hay for his ranch, but not
    the university ranch, he was charging it to the university, and
    the only way they found that was when he finally took leave and
    somebody said, gee, this is strange, and that was solved.
        That's, I think, what we have to do here. Is there
    something along that line that we ought to be telling everybody
    that runs a computer center in the Federal Government and how
    we could apply what people do in the finance and auditing in
    universities and corporations for standard practice?
        Mr. Brock.
        Mr. Brock. Segregation of duties is perhaps one of the most
    absolute basic controls there is for any type of operation,
    whether it is financial matters, as you were talking about, or
    computer security.
        In fact, when you look at any critical operation from
    beginning to end, you can make breaks in there where you say,
    we are going to have a division of labor, and in computer
    security, if you were looking at a process of changing
    software, you can make breaks from the people who make the
    change to the people who do the testing to the people who do
    the installation, to make sure that there is an independence
    there.
        You could do that for other aspects of security as well.
        Mr. Horn. Well, in other words, in your opinion, are
    Federal agencies susceptible to having one individual either
    intentionally or inadvertently render the computer system
    useless due to the lack of segregation of duties or separation
    of duties involved?
        Mr. Brock. I don't have the exact numbers now, but we
    have--maybe I do have the exact numbers.
        Mr. Horn. Ms. Boltz, glad you came today.
        Mr. Brock. We don't have numbers, but we did identify, for
    example, at the Department of Defense and VA that system
    program and security administration duties were combined. So
    the people who were establishing the controls were also doing
    the programming.
        At the FMS, we were saying that programmers had access to
    production data. So, in both cases they were able to combine
    pieces of information; if they had chosen to, could have taken
    over programs and assumed other responsibilities as well.
        This is fairly common. In some respects, it is done not out
    of a malicious intent. It is done because I think, as Mr.
    Nelson alluded to, you have too few people trying to do too
    many things.
        Mr. Horn. Any other thoughts on that, Mr. Nelson, Mr.
    Collier?
        Mr. Nelson. Yes, I would say I agree with Mr. Brock.
    However, in the scientific and technical area, the terminology
    may be different, and so one has to be a little careful not to
    be too rote in the prescriptions. What applies well to a
    financial system may not apply very well to a scientific data
    analysis system. The principles are correct, but the
    application has to be careful.
        Mr. Horn. Yes. Mr. Collier.
        Mr. Collier. You know, applications that we run into within
    the government, we have established some two-man rules in some
    cases. We have established complex procedures to ensure
    reduction in fraud, for instance, in transferring of funds,
    payment of benefits, etc. What I think biometrics and this
    security model bring to the party there, and that's what we are
    hearing from the government agencies, is we now have
    established the fact who was sitting behind the monitor when
    this fraud took place, not a matter of someone could have
    gotten my PIN or whatever. The banking industry has really
    embraced this because of the nonrepudiation issues and the home
    banking and wire transfers. As we get less and less on a face-
    to-face human basis, the problem increases, and they are trying
    to do something about the future that we know is going to
    explode before it does.
        Mr. Horn. Thank you. Any other thoughts on that?
        Mr. Brock. No, sir.
        Mr. Horn. One of my last questions here will be, in your
    opinion is the current legal framework, which includes the
    Computer Security Act of 1987 supporting Federal information
    security requirements, is that adequate? What needs to be
    updated or modified? Are there things that should be dealt
    with? Mr. Turner and I will be glad to move that legislation,
    if there is need for it. What does the CIO Council think on
    some of these things?
        Mr. Nelson. Let me take that. In my opinion, the legal
    framework is pretty good. I am not a lawyer, so I will speak
    generally. But there is a potential problem that we are dealing
    with, and I think Mr. Brock alluded to it in his oral remarks.
    It has to do with classification.
        The laws governing classification in this country are
    rather strict with regard to national security systems, and as
    the importance of information security has increased and the
    role of commercial and private systems has increased in their
    aid to national defense, then the question of where strictly
    national security stops and broader areas that are related to
    security starts. And so the particular problem that we are
    having is that we believe that within NASA a compendia, that
    is, lists, of open serious vulnerabilities, such as, for
    example, would be turned up by what we call a penetration test
    where we hire somebody or on our own to go through all of our
    systems and look to see how hackers would get in, that those
    lists are very sensitive, and my understanding--and we have
    been working with our legal staff and with the National
    Archives and Records Administration, which has ultimate
    classification authority, on the criteria under which these can
    be classified.
        The issue is a little murky, but right now it looks like
    maybe they cannot be, not even at a confidential level. So it
    could be that some clarification of the extent of national
    security provisions in this gray area of civil systems closely
    allied with national security systems would be helpful.
        Mr. Horn. Well, that's very interesting because this is the
    subcommittee that has oversight for the National Archives and
    the Freedom of Information, and we try to balance all of that.
    If there isn't a need for classification, it shouldn't be
    classified. So I would welcome any thoughts you have on that,
    and I know Mr. Turner would also.
        So----
        Mr. Brock. Mr. Horn.
        Mr. Horn. Mr. Brock.
        Mr. Brock. Can I have a moment of disagreement? I have been
    agreeing with Mr. Nelson all along.
        I do not think the overarching framework is adequate. As we
    mentioned in the testimony, the Computer Security Act is based,
    I think, on an old way of doing things. It is based on an
    environment that existed before the Internet. It was based on a
    mainframe environment, and I believe that it was based on an
    environment where locks and keys were the prevalent security
    devices. It's system-based. It is not management-oriented. It
    misplaces responsibility and accountability. I think it needs
    to be overhauled.
        I think there needs to be more emphasis placed on
    management accountability. I think there needs to be more
    emphasis placed on risk assessments and risk determination. I
    believe there needs to be more emphasis placed on independent
    audit and management audit so that controls can be evaluated.
    Those are not present in the Computer Security Act.
        Now, as you know, there is no law against good management.
    There is no law or anything to prevent an agency from doing all
    of those good practices, but at the same time there is no law
    or legislation or regulation that really encourages that type
    of action and then provides a lever or an oversight mechanism
    to the administration or to the Congress for assuring that that
    framework is being met.
        Mr. Horn. Well, thank you, because that was the answer I
    was going to lead with a question, and I am so used to Joe
    Wilmingson following me around the country on Y2K that I always
    asked, and now I will ask you and anybody from GAO, to what
    degree have we not covered the questions that we should have
    covered. And you have just nailed one down, and I appreciate
    that.
        Would GAO and the CIO Council, Chief Information Officer
    Council, put their thinking caps on, and we would welcome
    taking a look at that again. We need to update it. It has been
    over two decades right now--or a decade and a half, I guess.
        So are there any other questions any of you think--and you,
    Mr. Brock, in particular--what else should we get on the record
    that we haven't put on?
        Mr. Brock. I think that my last response covered the one
    item, and we are continuing to work with your staff on a number
    of computer security issues as well, particularly as they might
    relate to e-commerce and other initiatives that are coming up.
    We are pleased to have the opportunity today to discuss these
    items with you.
        Mr. Horn. Well, we are glad to do it. We certainly welcome
    the comments of these witnesses, as well as the ones from our
    first panel. They were a very excellent group. Thank you, Mr.
    Collier, for coming.
        Mr. Nelson.
        Mr. Nelson. Yes, I would just like to maybe amend what I
    said so perhaps Mr. Brock and I can agree. In addressing your
    question on legal framework, I was responding from the
    standpoint of NASA or an agency as to whether the current law
    gets in our way of doing good things. But for an agency that
    does not wish to practice good management, a legal
    encouragement might not be out of order.
        Mr. Horn. Well, that's well said.
        I would tell you that this chamber operates not by
    consensus, but like a university does, and maybe NASA, but if
    we have 218 votes, we can do almost anything. But obviously we
    also could lose 218 votes if we haven't thought it through very
    well. So I thank you all.
        I want to thank the staff that worked on this hearing.
        You have been excellent witnesses.
        J. Russell George is in the doorway over there. Gosh, are
    you getting framed now over there or what? Staff director and
    chief counsel, and he works wonders. Matt Ryan to my left, your
    right, senior policy director, and who is a GAO alumnus, as are
    a number of our people; Bonnie Heald, director of
    communications, seated in the back there; Bryan Sisk, our
    clerk; Ryan McKee, the staff assistant; and for Mr. Turner's
    staff, Trey Henderson as counsel, and Jean
    Gosa, the minority clerk. And our court reporter today is one,
    and that's Mindi Colchico, and we didn't have to wear you out
    and bring another one in, I take it. So thank you for coming
    again.
        With that, we are adjourned.
        [Whereupon, at 12 noon, the subcommittee was adjourned.]

                                       -