[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]
ENHANCING COMPUTER SECURITY: WHAT TOOLS WORK BEST
=======================================================================
HEARING
before the
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
INFORMATION, AND TECHNOLOGY
of the
COMMITTEE ON
GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
MARCH 29, 2000
__________
Serial No. 106-181
__________
Printed for the use of the Committee on Government Reform
Available via the World Wide Web: http://www.gpo.gov/congress/house
http://www.house.gov/reform
______
U.S. GOVERNMENT PRINTING OFFICE
69-819 DTP WASHINGTON : 2001
_______________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Printing
Office
Internet: bookstore.gpo.gov Phone: (202) 512-1800 Fax: (202) 512-2250
Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON GOVERNMENT REFORM
DAN BURTON, Indiana, Chairman
BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
CONSTANCE A. MORELLA, Maryland TOM LANTOS, California
CHRISTOPHER SHAYS, Connecticut ROBERT E. WISE, Jr., West Virginia
ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York
JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York
STEPHEN HORN, California PAUL E. KANJORSKI, Pennsylvania
JOHN L. MICA, Florida PATSY T. MINK, Hawaii
THOMAS M. DAVIS, Virginia CAROLYN B. MALONEY, New York
DAVID M. McINTOSH, Indiana ELEANOR HOLMES NORTON, Washington,
MARK E. SOUDER, Indiana DC
JOE SCARBOROUGH, Florida CHAKA FATTAH, Pennsylvania
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
MARSHALL ``MARK'' SANFORD, South DENNIS J. KUCINICH, Ohio
Carolina ROD R. BLAGOJEVICH, Illinois
BOB BARR, Georgia DANNY K. DAVIS, Illinois
DAN MILLER, Florida JOHN F. TIERNEY, Massachusetts
ASA HUTCHINSON, Arkansas JIM TURNER, Texas
LEE TERRY, Nebraska THOMAS H. ALLEN, Maine
JUDY BIGGERT, Illinois HAROLD E. FORD, Jr., Tennessee
GREG WALDEN, Oregon JANICE D. SCHAKOWSKY, Illinois
DOUG OSE, California ------
PAUL RYAN, Wisconsin BERNARD SANDERS, Vermont
HELEN CHENOWETH-HAGE, Idaho (Independent)
DAVID VITTER, Louisiana
Kevin Binger, Staff Director
Daniel R. Moll, Deputy Staff Director
David A. Kass, Deputy Counsel and Parliamentarian
Lisa Smith Arafune, Chief Clerk
Phil Schiliro, Minority Staff Director
------
Subcommittee on Government Management, Information, and Technology
STEPHEN HORN, California, Chairman
JUDY BIGGERT, Illinois JIM TURNER, Texas
THOMAS M. DAVIS, Virginia PAUL E. KANJORSKI, Pennsylvania
GREG WALDEN, Oregon MAJOR R. OWENS, New York
DOUG OSE, California PATSY T. MINK, Hawaii
PAUL RYAN, Wisconsin CAROLYN B. MALONEY, New York
Ex Officio
DAN BURTON, Indiana HENRY A. WAXMAN, California
J. Russell George, Staff Director and Chief Counsel
Matt Ryan, Senior Policy Director
Bryan Sisk, Clerk
Trey Henderson, Minority Counsel
C O N T E N T S
----------
Page
Hearing held on March 29, 2000................................... 1
Statement of:
Brock, Jack L., Jr., Director, Governmentwide and Defense
Information Systems, U.S. General Accounting Office,
accompanied by Jean Boltz, U.S. General Accounting Office.. 7
Collier, Paul, division general manager, Identix, Inc........ 39
Nelson, Dave, Deputy Chief Information Officer, National
Aeronautics and Space Administration....................... 27
Letters, statements, et cetera, submitted for the record by:
Brock, Jack L., Jr., Director, Governmentwide and Defense
Information Systems, U.S. General Accounting Office,
prepared statement of...................................... 13
Collier, Paul, division general manager, Identix, Inc,
prepared statement of...................................... 42
Horn, Hon. Stephen, a Representative in Congress from the
State of California, prepared statement of................. 3
Nelson, Dave, Deputy Chief Information Officer, National
Aeronautics and Space Administration, prepared statement of 30
Turner, Hon. Jim, a Representative in Congress from the State
of Texas, prepared statement of............................ 5
ENHANCING COMPUTER SECURITY: WHAT TOOLS WORK BEST
----------
WEDNESDAY, MARCH 29, 2000
House of Representatives,
Subcommittee on Government Management, Information,
and Technology,
Committee on Government Reform,
Washington, DC.
The subcommittee met, pursuant to notice, at 10 a.m., in
room 2154, Rayburn House Office Building, Hon. Stephen Horn
(chairman of the subcommittee) presiding.
Present: Representatives Horn and Turner.
Staff present: J. Russell George, staff director and chief
counsel; Matt Ryan, senior policy director; Bonnie Heald,
director of communications; Bryan Sisk, clerk; Ryan McKee,
staff assistant; Trey Henderson, minority counsel; and Jean
Gosa, minority assistant clerk.
Mr. Horn. A quorum being present, the Subcommittee on
Government Management, Information, and Technology will come to
order.
This is the second in a series of hearings to examine
computer security concerns in the Federal Government. The
subcommittee's first hearing 3 weeks ago shed light on two
important topics, awareness of the increasing number of
computer threats against Federal and private computer systems,
and the need for a coordinated Federal effort to meet this
challenge.
History is full of claims of developing the ultimate
weapon, whether it was a battleship, a supersonic fighter jet,
or a weapon capable of massive destruction. Today's computer
systems and networks provide the newest frontier, the weaponry
of knowledge. With only a few keystrokes, computers provide
massive amounts of information, information that only a decade
ago would have taken months or years to compile. It is, of
course, imperative that these computers and the wealth of
information they contain be protected.
Nearly all computer networks are vulnerable to attack at
some level, but steps can be taken to prevent or reduce those
intrusions. Organizations must focus on two areas, physical
security and information security. No one would buy an
expensive house, furnish it, then walk away leaving the doors
wide open. Physical assets must be protected. Yet many
organizations fail to take basic precautions to protect either
their facilities or their computer systems.
Electronic government and electronic commerce trends should
continue to dictate the way important data are exchanged. From
tax refunds and health records to credit card purchases and
Social Security numbers, organizations must demonstrate that
the information flowing into their computers is secure. Tools
are available to help organizations and citizens protect their
computers against unwanted and unruly intruders. However, they
must be carefully used to ensure that they lead to meaningful
improvement. Today our witnesses will talk about some of these
tools that can enhance computer security at little or no cost.
We welcome our panel of witnesses. We look forward to their
testimony.
[The prepared statement of Hon. Stephen Horn follows:]
[GRAPHIC] [TIFF OMITTED] T9819.001
Mr. Horn. It is now my pleasure to call on the ranking
member of the subcommittee, Mr. Turner of Texas, for an opening
statement.
Mr. Turner. Thank you, Mr. Chairman. This is the second in
a series of hearings that the chairman has designated to
discuss the issue of computer security in the Federal
Government, and it is apparent to all of us that we have become
increasingly dependent upon computer systems and the Internet.
It represents one of our greatest strengths, but perhaps also
one of our greatest weaknesses and vulnerabilities.
While we rely extensively on electronic data, we have
become increasingly vulnerable. The General Accounting Office
has stated that our computer security system is not where it
needs to be to protect ourselves from cyberinvaders. We lack an
overall comprehensive program in the Federal Government to
protect our computer system, and billions of dollars in Federal
assets and large amounts of sensitive data are at risk to the
threat of hackers, both foreign and domestic.
I am pleased that the chairman has chosen to focus upon
this issue of computer security, and I look forward to hearing
from each of our witnesses today.
Mr. Horn. I thank the gentleman.
[The prepared statement of Hon. Jim Turner follows:]
[GRAPHIC] [TIFF OMITTED] T9819.002
[GRAPHIC] [TIFF OMITTED] T9819.003
Mr. Horn. Let me tell you the procedure here. Some of you
have testified here before, but when we introduce you, and we
will go in the order it is on the agenda, your statement, as
written, is fully in the record. What we would like you to do
is spend 5 minutes and at the most 8 or 10 to summarize your
statement, not read it to us. We can read. Then we have more
time for dialog between the three of you and dialog with the
Members here today.
So we, as you know, swear in all witnesses before these
subcommittees of government reform, and if you will stand,
raise your right hand, we will swear you in.
Anybody that is going to give you advice, swear them in,
too.
[Witnesses sworn.]
Mr. Horn. The record will note that three witnesses and one
helper affirmed the oath.
So we will now start with Mr. Brock of the U.S. General
Accounting Office, part of the legislative branch of Congress,
who does a wonderful job on both programmatic and fiscal
matters.
Mr. Jack Brock is no stranger to this subcommittee. He is
Director of Governmentwide and Defense Information Systems for
the U.S. General Accounting Office, otherwise known as GAO.
Mr. Brock.
STATEMENT OF JACK L. BROCK, JR., DIRECTOR, GOVERNMENTWIDE AND
DEFENSE INFORMATION SYSTEMS, U.S. GENERAL ACCOUNTING OFFICE,
ACCOMPANIED BY JEAN BOLTZ, U.S. GENERAL ACCOUNTING OFFICE
Mr. Brock. Thank you very much, Mr. Chairman. Good morning
to you. Good morning, Mr. Turner.
I would like to note that my license plates say Native
Texan.
I would also like to introduce Ms. Jean Boltz. Ms. Boltz is
a senior manager in my group and actually directs a great deal
of our computer security work.
Mr. Horn. That's B-O-W-L-T-Z.
Mr. Brock. B-O-L-T-Z.
Mr. Horn. I am glad I asked.
Mr. Brock. I know you have had a prior hearing on computer
security, and in that hearing you discussed the importance of
good security, but good computer security is important to every
facet of government operations. It assures the integrity and
the confidentiality of information and key processes. It is
important to national security. It is important to other
critical operations. It is important in assuring the integrity
of transactions between the government and its citizens; and as
e-commerce and e-government become more prevalent, it is the
cornerstone of making sure that those services actually achieve
the objectives of better government, more efficient government,
more productive government.
What we found, though, in our work, as you have noted, is
that at virtually every major agency that we go to computer
security, the computer security practices within those agencies
doesn't match the importance of the topic. We or other
independent auditors whose work we reviewed have found serious
computer security weaknesses in virtually every major Federal
agency, and these weaknesses threaten or potentially threaten
the ability of these agencies to protect the confidentiality of
key data, to perform critical operations, and assure the
integrity of important financial and data transactions. I have
identified several examples in my testimony, but I would just
like to quote here what we found at EPA, which is our most
recent report.
We found serious and pervasive problems that essentially
render EPA's agencywide information security program
ineffective. We found that the current security program
planning and management is largely a paper exercise that has
done little to substantially identify, evaluate, and mitigate
risk to the agency's data and systems.
What we found essentially, Mr. Chairman, that EPA has a
central network, and most of EPA's business functions operate
off that network. We were able to penetrate the firewall, which
was largely ineffective, penetrate limited access controls, and
essentially could have had access to most of the information
and processes that ran throughout the entire agency. So the
entire agency in this case was vulnerable.
EPA is not alone. Recent reports at DOD, at NASA--Mr.
Nelson will be talking about that in a moment--the State
Department, the National Finance Center, the Veterans
Administration all had serious weaknesses. I would, at the risk
of preempting Mr. Nelson, say that they have made substantial
strides in improving their program, and our limited followup
work has substantiated those improvements.
I would like to spend just a moment, if I could, going over
the common problems that we find at agencies, and we have a
chart that I would refer you to. Mr. Mike Gilmore is up there
handling the charts.
First of all, computer security programs have to support
the organizational mission and goals of the agency. They can't
be divorced from what the agency does, or they are not
relevant.
Running across the agency is an entitywide security program
planning and management. This is what assures the relevancy of
your computer security program to what you are trying to
achieve at the agency. And then under that we have found a
series of problems that are present in most of our reviews.
First of all, many agencies do not have relevant security
program planning and management, and we are going to talk about
that in a little bit, but that's the root of the problem. When
you look at access controls--access controls, you were talking
about a house, access controls represent the fence around the
house. They represent the lock on the door. They are not in
place.
Here we are talking mainly about processes that provide
authentication that you are who you say you are and, second,
that limit your rights to material that's relevant to you.
Software development and change controls. We are actually
doing an assignment for you right now and we are meeting with
your staff next week to go over the results of that. That means
that when you change software, when you make changes in code,
or when new software is introduced, that is tested to make sure
that you are not maliciously--you are inadvertently introducing
new weaknesses into your application, we find that to be a
common problem in many agencies, where that testing is not
done, and weaknesses are then inserted into an application that
was previously strong.
The next one is on service continuity controls, there you
want to maintain the ability to recover from disaster, or if
the worst happens, that you are able to take strides to recover
your operations and to move forward. Many agencies that we have
gone to do not have good service continuity controls, would not
be able to reconstruct their principal systems, and would have
difficulty bringing--coming back up to speed in an acceptable
amount of time.
System software controls, these are really sort of the
heart and brains of many systems. These are the basic operating
systems, the utilities, that if you don't have good controls
over these, a hacker or an intruder can go in and assume
control over the entire network by becoming a systems
administrator and assuming higher powers than he or she should.
And then finally segregation of duties, if you don't
separate the duties from the person who writes the code, the
person who inserts the code, the person who tests, the various
people who have some element of authorities over the computer
security, then you run the risk of empowering one person or a
small number of people with too much authorities. It is much
like someone who might have authorities over receiving funds,
recording those funds, disbursing those funds, and then doing
the final accounting. The more you place those duties in the
hands of one or a very small number of people, you run the risk
of malfeasance.
These are the problems, and you requested that we prepare
for you a listing of things that you could do to fix the
problems. This really falls into two categories: Is what can
you do right now, and what do you need to do on a long-term to
have more permanency? Again, I am going to go back to your
house example.
Ideally, in a house you have some sort of an alarm system,
a fire suppressant system, or whatever. In this case, the house
is on fire. Building a fire suppressant system isn't going to
do you much good. You have to throw a pail of water on it right
now. So we have identified a number of actions that an agency
can do now.
Any agency could start on this this afternoon and work on
it. So, again, I would refer you to the next table up there,
and we have identified a number of things in our work that can
be done. The diagram there is designed so that if you take
these actions, you will, in fact, be compressing risk and
minimizing risk. The first thing you need to do is to increase
awareness at all levels, and at the management levels managers
need to be aware that this is their information, these are
their programs, that poor computer security endangers their
activities that they have accountability and responsibility
for.
At the user level, you need to make users aware that
actions they take in terms of poor password control, sharing
passwords, not following agency procedures and processes may,
in fact, endanger the system, and at the technical level system
administrators need to be aware that if they don't take their
actions seriously, if they don't have the right kind of
training, if they don't institute software patches or whatever,
they are also endangering the system. So there needs to be a
much higher level of awareness in most agencies.
Second, you have to make sure that the controls you have
work. I know there are going to be tools demonstrated here
today. Every agency has tools, and when we go into agencies, we
frequently find that those tools aren't working. They are not
turned on. They are not monitored. So agencies are spending
money for tools, but they are not using the tools. It is very
similar to the set of tools I have in my garage that my father
gave me when I moved here from Texas 27 years ago. He said, you
will need these tools, and I am sure I do need the tools, but
they are still in the tool box.
The same thing with many agencies. Tools are present, but
they are not turned on, they are not monitored. You are really
not sure that they are working or not.
Third, is implementing software patches. The Carnegie
Mellon CERT-CC has said in most of the intrusions they get,
most of the incidents that are reported to that organization
exploit known vulnerabilities, and for most known
vulnerabilities there are existing patches that could be
implemented. Many agencies are aware of the patches. They don't
follow the advisories that are coming up from the vendors, they
don't follow the advisories that are coming out from the CERT,
or they don't follow the advisories that come out of their own
agencies. By not patching software with known holes, they are
leaving in place known vulnerabilities that offer a hacker or
an intruder an opportunity to enter into their system.
Next, is to identify and propagate pockets of excellence.
Almost every agency we go to, regardless of their overall
program and whether it is good or bad, have individual centers
or individual programs that work really well. Unfortunately,
they are working in concert with other programs that don't work
so well, and so sometimes the good effect there is mitigated.
But if agencies would identify those pockets of excellence, use
those as best practices within the agency, where the agency
culture to some degree has already accepted these practices,
propagate those across the agency, there would be opportunities
for immediate improvements.
Finally, to focus on the most common vulnerabilities first,
when we go into agencies, we find throughout the agency that
there are a few set of problems that come up time and time
again, and surprisingly enough, when we go from one system
administrator to the other, they are frequently not aware of
the problems that their compatriot down the hall is facing.
These need to be shared within the agency. Those need to be
addressed first.
Further, we are finding that many of these common problems
also exist across agencies, and, again, there is very little
sharing of that information across the agency.
If we could turn to the next chart, please.
And these are things agencies can do now. However, computer
security is very dynamic. The technology is changing in a
hurry. The tools are changing. The techniques that intruders
might be using are changing. So the program really has to have
a sense of structure in order to make sure that the computer
security program is dynamic and, in fact, changes as the threat
and risk changes.
About 2 years ago we did a study of leading organizations
that had good computer security, and we found a common set of
practices in these agencies that we believe are appropriate for
Federal agencies to use. In fact, the Federal CIO Council
endorsed these practices, and several agencies have included
them within their own policy and structure.
The S. 1993, the computer security bill introduced by
Senators Thompson and Lieberman earlier this year, also
incorporates these practices, they start off with a central
focal point for computer security. Regardless of whether the
agency is decentralized or centralized, the central focal
point--there was always a central focal point. I think this is
true at NASA, where NASA is highly decentralized, and yet Mr.
Nelson is the central focal point for security.
The real cornerstone of that, though, is that agencies need
to assess the risk and determine needs. Without risk
assessment, you can't move to that next box and have effective
controls and policies. Your controls and policies need to be
built on your risk assessment. They need to be appropriate for
the risks that you are facing and, from that, promote
awareness. Again, you can increase awareness at all levels on a
general level, but at some point the awareness needs to be
focused on your exact controls that you are using, how to use
them, and on the risks that you are facing so that people
throughout the organization can take appropriate action; and
then, finally, monitor, and evaluate.
There are two parts to that. First, managers need to do
their own self-evaluation so that they can continually assess
where the agency is; and second, there needs to be an
independent evaluation, something that we might do or the NASA
IG might do that would allow both the agency and the oversight
agencies or committees such as yourself to take a look at what
is going on within the agency. We feel that if this framework
was adopted, truly adopted, by agencies, it would go a long
ways toward correcting the common problems that we see.
By establishing a framework, we think that an agency can
fulfill several key tasks: One, that agency actions are
appropriately controlled and coordinated; that the testing
tools are appropriately selected and tested; that personnel
involved in using the tools are trained; that good practices
and lessons learned are shared on an agencywide basis; that
controls are systematically tested to ensure that they are
effective; and that appropriate risk management decisions are
made regarding the best way to address and identify problems.
I would just like to highlight that a little bit. If you do
not assess the risk, the controls that you have implemented may
or may not be appropriate. You may well be spending too much
money. You may not be spending enough money. But almost
certainly you will have the wrong kind of control in place, and
you really won't address your company'S problems.
In conclusion, we also believe, Mr. Chairman, there needs
to be some reconsideration of the current legislative
framework. The Computer Security Act and A-130, which provides
the regulations for the Computer Security Act, really is a
system-based piece of legislation. It is based on making every
system good and that the accumulation of those good systems
will, in fact, represent a good agency program. I don't think
that works. It hasn't worked. Legislation needs to be
considered that would, in fact, provide a management framework
and a management perspective.
Also CSA has two categories of information. It is
classified or nonclassified, sensitive or nonsensitive.
Actually, information is graduated. Some systems are at a very
low level of risk. Some are at a high level of risk, and
policies need to be implemented that really reflect that
gradation. It doesn't recognize the need for an independent
audit, and second--or third, it doesn't recognize the need for
more prescriptive guidance that would give agencies more of a
framework.
Finally, there is no call for central leadership, somebody
that can stir the pot, somebody that can make sure that things
are being done, someone that can provide leadership across the
government.
That completes the summary of my statement, Mr. Chairman.
Mr. Horn. Thank you very much, Mr. Brock. That's a most
helpful summary.
[The prepared statement of Mr. Brock follows:]
[GRAPHIC] [TIFF OMITTED] T9819.004
[GRAPHIC] [TIFF OMITTED] T9819.005
[GRAPHIC] [TIFF OMITTED] T9819.006
[GRAPHIC] [TIFF OMITTED] T9819.007
[GRAPHIC] [TIFF OMITTED] T9819.008
[GRAPHIC] [TIFF OMITTED] T9819.009
[GRAPHIC] [TIFF OMITTED] T9819.010
[GRAPHIC] [TIFF OMITTED] T9819.011
[GRAPHIC] [TIFF OMITTED] T9819.012
[GRAPHIC] [TIFF OMITTED] T9819.013
[GRAPHIC] [TIFF OMITTED] T9819.014
[GRAPHIC] [TIFF OMITTED] T9819.015
[GRAPHIC] [TIFF OMITTED] T9819.016
[GRAPHIC] [TIFF OMITTED] T9819.017
Mr. Horn. I might add, I mentioned that all of your texts
will be in when we introduce you. So will your resumes.
The next gentleman, the next two, have very rich resumes.
Dr. David Nelson in particular has certainly been through the
whole computer community, I can see, in terms of committees and
responsibilities you have had.
Currently, he is Deputy Chief Information Officer at the
National Aeronautics and Space Administration.
Mr. Nelson.
STATEMENT OF DAVE NELSON, DEPUTY CHIEF INFORMATION OFFICER,
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
Mr. Nelson. Thank you, Mr. Chairman. Members of the
subcommittee, I am pleased to appear before you today to
discuss NASA's views on the security of our information
technology environment. I have submitted my written statement
for the record. My oral summary will be quite consistent with
that of Mr. Brock.
I would like to emphasize three points. My first point is
the importance of a sound management framework for information
technology security. Two years ago, NASA did not have a
satisfactory framework. Since then we have worked hard to align
our policy, organization, funding and objectives for effective
security.
This began with senior management attention and support,
including the recognition that information technology security
is required for safety of lives and property. In an internal
study, we benchmarked ourselves against good organizations and
copied the best of what we found. We accepted the
recommendations of the General Accounting Office review of NASA
security that Mr. Brock referred to.
Our actions included issuing up-to-date policy,
establishing a senior Council to set strategic directions,
clarifying management responsibilities, budgeting for key tasks
and collecting metrics of progress.
NASA places operational responsibility for information
technology security on line management, complemented by a cadre
of computer security professionals who provide technical
assistance and oversight.
I have mentioned budgets and metrics. If I could have the
chart, please.
This chart shows one of our metrics. Plotted is the number
of serious incidents. Those are things like destruction of
data, theft of passwords, or damage to software, versus on the
X axis the percent of the information technology budget that is
spent on security. Each point is a specific center, and the
data is real. Notice the trend line. As you start from the
left, as the percentage of budget increases to about 2 percent,
the number of incidents levels off. This suggests that spending
about 2 percent of information technology budget on security
gives a good return on information. Spending less increases
risk, as shown by the trend line. Spending more may not add
much return. We have compared notes on this metric with leading
companies. They see the same sort of trend and the same sort of
sweet spot.
Now, this metric isn't perfect, but it gives us a place to
start. Metrics like this are our headlights. They guide our
actions and indicate where we need to work harder.
My second point is the importance of training. NASA is a
highly technical organization. We create and modify leading-
edge information systems to serve our missions. Security risk
evolves as threats and, as a result, vulnerabilities change, so
our personnel must understand the principles of effective
security and apply them to changing situations. Program and
project managers must be trained to evaluate risks and
vulnerabilities in designing and maintaining systems entrusted
to them. System administrators must be trained to properly
configure and upgrade their systems, to recognize attacks and
to respond to them. Users must be trained to practice good
security, to recognize certain types of attack, and to know how
to get help.
Over the last 2 years, NASA has developed or acquired new
training material for managers, system administrators, and
users. This training is now mandatory for all civil servants,
and we are gathering metrics on its delivery. In addition, NASA
has requested comments on a draft regulation that would require
NASA contractors to adhere to the same standards of training
that apply to civil servants.
My last point is the importance of appropriate tools.
Security tools, which are a combination of computer hardware
and software programs, help to protect systems and defend
against attacks.
The technical details of a particular attack may be very
complicated, but once the attack is understood, defense against
it can be incorporated into a tool that is easy to use by a
trained person.
Organizations with modest funding, but substantial
technical skills can obtain free, reputable tools from the
Internet that offer good capability. However, they may not be
well-documented or supported and may be somewhat difficult to
use. NASA tends to purchase key commercial tools and augment
them with free tools. Obviously, purchased commercial tools
have a higher initial cost. However, they are often easier to
use and may have a lower sustaining labor cost.
Most successful attacks are enabled by a relatively small
number of weaknesses, as Mr. Brock has observed. These include
lack of virus detection software; trivial passwords that can
easily be cracked, that means decrypted; failures to install
patches for well-known software vulnerabilities; and poorly
configured computers with open vulnerability holes. Tools help
us to deal with each of these classes of problems. In my
written statement, I have described a number of these and the
practices that NASA uses.
New problems keep appearing, along with new defenses. Thus,
the tools and their use must evolve. There is no substitute for
good proactive management that can respond quickly and
effectively. Unfortunately, easy-to-use tools for attacking
systems are also available on the Internet, and they are
constantly getting better. This means it takes less skill to
mount a sophisticated attack than it used to. The ecologists
would call this a classic predator-prey situation in which both
predator and prey evolve quickly to secure competitive
advantage.
In conclusion, NASA is facing the challenge of the evolving
security universe by marshalling effective management,
effective training, and effective technology. We are in an
environment of increasingly numerous and serious threats, along
with systems whose vulnerabilities tend to increase as they
become more complicated.
Fortunately, our tools and process allow us to make
progress in dealing with this environment, but it is a never-
ending process. We take response--we take seriously our
responsibility as stewards of the public's space and
aeronautics information and systems. We are committed to
working with other agencies of the executive branch and with
the Congress to ensure that we maintain the proper balance
between accessibility of research results and protection of our
information technology investment.
Thank you for the opportunity to testify before you today.
I look forward to answering your questions.
Mr. Horn. Well, thank you very much.
[The prepared statement of Mr. Nelson follows:]
[GRAPHIC] [TIFF OMITTED] T9819.018
[GRAPHIC] [TIFF OMITTED] T9819.019
[GRAPHIC] [TIFF OMITTED] T9819.020
[GRAPHIC] [TIFF OMITTED] T9819.021
[GRAPHIC] [TIFF OMITTED] T9819.022
[GRAPHIC] [TIFF OMITTED] T9819.023
[GRAPHIC] [TIFF OMITTED] T9819.024
[GRAPHIC] [TIFF OMITTED] T9819.025
[GRAPHIC] [TIFF OMITTED] T9819.026
Mr. Horn. Those bells show that there is a vote on the
floor, so we are going to have to go into recess for 20 minutes
before we will take up Mr. Collier and then the questions. So
relax.
[Recess.]
Mr. Horn. The subcommittee will now end the recess for the
voting on the floor, and we will begin with Mr. Paul Collier,
division general manager of Identix Solutions.
You might want to tell us a little about Identix Solutions.
Put in a plug so I can understand it.
Go ahead, Mr. Collier.
STATEMENT OF PAUL COLLIER, DIVISION GENERAL MANAGER, IDENTIX,
INC.
Mr. Collier. Thank you, Mr. Chairman. Thank you for
inviting me to be a part of this distinguished panel today. My
testimony will focus on technology available that offers a
significant advance in the protection of computer networks and
critical data systems.
The greatest challenge we face in controlling access to
computers and information is positive user authentication.
Recent events show that the proliferation of the Internet, our
increased reliance on computer-based information and the rapid
growth of mobile computing has far outpaced our ability to
secure these systems.
Traditionally the use of passwords has been our best
defense. Recent advances in password cracking software and
increased computer processor speeds have required passwords to
become more complex and changed more frequently.
The human element in this new equation has been pushed to
the limit. We now see more passwords written on the back of
mouse pads, on desk leaves, and even on Post-It notes affixed
to monitors. In addition, users tend to leave work stations
logged on and unattended because of the added inconvenience.
It should be noted that there is no single technology that
can serve as a panacea for positive user authentication.
However, a combination of available technologies, working in
concert, can provide a significant advance in addressing this
need. The positive user authentication model consists of three
elements, something you have, something you know, and something
you are: Something you have, such as a smart card with a
digital certificate embedded in the microprocessor; something
you know, a simple PIN, as few as four digits; and something
you are, one or more biometrics.
Someone can give an unauthorized individual their smart
card or token and tell them their PIN number or password. The
biometric is the only nontransferable element in this model.
Briefly, a biometric is a quantitative measurement of a unique
human attribute or behavioral characteristic, such as
fingerprints, face, voice, iris pattern, etc.
Using fingerprints as an example in this model, a finger is
placed on a sensor and then scanned. The image of the
fingerprint is then processed by a series of algorithms which
convert it into a binary representation or template. This
template is then compared to a reference template stored either
on a computer or a card-based data storage medium. Like most
biometrics, you cannot reverse-engineer this binary
representation and recreate the fingerprint image.
Fingerprint biometrics have been used in many civil and
government programs for over 10 years. They have been very
effective in reducing fraud, eliminating multiple identities,
and securing access to sensitive areas.
These wide-scale deployments have served as real-world
proving grounds for this technology and involve many millions
of people. Knowledge gained from these programs and applied to
improvements and cost reductions help produce much of the
commercial products available today.
The Federal Government, in partnership with industry, has
made a significant contribution to the evolution of biometric
technology. Biometrics would not have advanced to their present
level without the help of such agencies as the Department of
Defense, the National Security Agency, the Departments of
Justice, Energy, Treasury and the National Institute for
Standards and Technology.
Like many technologies, biometrics have become faster,
better, and cheaper. An example, only a few years ago the cost
to integrate fingerprint biometric technology was approximately
$3,000 per computer. Recent advances have reduced the cost to
less than $100 per computer. History has shown the ephemeral
nature of benchmarks in information technology, and in the near
future we can anticipate still further reduction in costs and
improved performance.
Commercial Off-The-Shelf products are entering the
government market via GSA schedule and other procurement
vehicles. The recent Smart Access/Common ID procurement by the
General Services Administration represents a 10-year, $1.5
billion governmentwide contract that includes provisions for
biometrics used for both physical and logical access.
Mr. Chairman, with your permission, I would like to
demonstrate two of the products available today. The first is
configured to demonstrate the positive user authentication
model that I discussed earlier. The computer work station that
you see here is in a locked mode. Attached to it is a keyboard
with an integrated smart card reader and fingerprint scanner.
These are commercially available, and the government has really
taken to this particular one. The user takes his or her smart
card, which, as you can see, has the smart card chip on the
back, and inserts it into the work station. The log-on prompts
the user to choose their log-on ID, enter the four-digit PIN
number, which is the something-you-know portion--it is telling
me I haven't put my finger on the scanner--and then place my
finger on the scanner to complete the log-in process.
If the user removes the smart card from the computer
keyboard, the system locks.
The second product, which is available commercially, many
of the components of which were developed in conjunction with
the National Security Agency, is a PC card which has a built-in
fingerprint scanner. This is a simple replacement for password
configuration that you see here. The user need only go up to
the computer, place their finger on the scanner, and the log-on
process is complete, nothing to remember.
In 1998, several key companies founded the International
Biometrics Industry Association. The charter is a nonprofit
trade association to promote competition, establish an industry
code of ethics, represent industry concerns, and serve as a
single voice on major issues such as privacy, computer
security, e-commerce, and legislative issues.
I would like to thank the chairman for the opportunity to
appear here today and demonstrate these products to you. Thank
you, Mr. Chairman.
Mr. Horn. Well, we thank you and your other two colleagues
there.
[The prepared statement of Mr. Collier follows:]
[GRAPHIC] [TIFF OMITTED] T9819.027
[GRAPHIC] [TIFF OMITTED] T9819.028
[GRAPHIC] [TIFF OMITTED] T9819.029
[GRAPHIC] [TIFF OMITTED] T9819.030
[GRAPHIC] [TIFF OMITTED] T9819.031
[GRAPHIC] [TIFF OMITTED] T9819.032
[GRAPHIC] [TIFF OMITTED] T9819.033
[GRAPHIC] [TIFF OMITTED] T9819.034
[GRAPHIC] [TIFF OMITTED] T9819.035
[GRAPHIC] [TIFF OMITTED] T9819.036
[GRAPHIC] [TIFF OMITTED] T9819.037
[GRAPHIC] [TIFF OMITTED] T9819.038
[GRAPHIC] [TIFF OMITTED] T9819.039
[GRAPHIC] [TIFF OMITTED] T9819.040
[GRAPHIC] [TIFF OMITTED] T9819.041
[GRAPHIC] [TIFF OMITTED] T9819.042
[GRAPHIC] [TIFF OMITTED] T9819.043
[GRAPHIC] [TIFF OMITTED] T9819.044
[GRAPHIC] [TIFF OMITTED] T9819.045
[GRAPHIC] [TIFF OMITTED] T9819.046
[GRAPHIC] [TIFF OMITTED] T9819.047
[GRAPHIC] [TIFF OMITTED] T9819.048
[GRAPHIC] [TIFF OMITTED] T9819.049
[GRAPHIC] [TIFF OMITTED] T9819.050
[GRAPHIC] [TIFF OMITTED] T9819.051
Mr. Horn. Let me just ask you about the biometric
technology chart. While going over to vote and coming back, I
talked with Mr. Tauzin, who is very interested in this, and he
is going to have a meeting of the Internet group here on May
19th and 20th. So we hope what will come out of this testimony
of yours and the previous panel a couple of weeks ago will be
helpful.
One of these patterns is rather interesting to me. A few
years ago, the Immigration and Naturalization Service put on a
demonstration in a room in the Capitol, various things they
could do to identify people. I was fascinated by the one where
you put your hand in.
Is that on your chart, the vein patterns, paren, hand? Is
that the one, or is that separate from that?
Mr. Collier. They are different technologies, though they
are essentially similar.
Mr. Horn. Looking at the spread of your fingers, and they
claimed it was better than fingerprints.
Mr. Collier. Well, we all have claims, I guess. The hand
geometry system used by the Immigration and Naturalization
Service, I think, were deployed in their INS-Pass Program and
are still working to this day. Hand geometry is a viable
technology. Fingerprints appear to be what the government has
embraced because of the long experience with them.
Mr. Horn. Yes. So is there any sort of works on this that
will give us an idea as to which is the better of the two
between fingerprints and the hand pattern? Anybody research
that?
Mr. Collier. I believe they both have their place. There
are about 15 different biometric disciplines. There is no one
discipline that fits all scenarios. The real issue comes down
to cost per seat, per deployment. Some of the biometrics
available are extremely effective, but may cost $100,000 per
unit to deploy. It is never going to see widespread deployment
at that cost.
There are studies that have been done by the National
Security Agency that are available. There are studies done by
the National Biometric Test Center at San Jose State
University, and Sandia Laboratories did some studies several
years ago for the Department of Energy.
Mr. Horn. This is a question really for all of you, and
that's based on the testimony. It appears many computer
security tools are free or at little cost, and I guess the
question is this: Why aren't more agencies taking advantage of
all the security tools readily available to them? What is your
experience on that?
Mr. Brock. Well, I think that many tools are free, are
readily available. Many of the tools you can actually download
from the Internet or are made available from vendors free or
low charge.
What we have seen is that agencies inconsistently use the
tools, or they don't provide the appropriate training to
understand how to use the tools, or they don't even know how to
turn the tools on. So while the tools are available, they are
just not used properly. That seems to be the biggest problem
that we have found.
Mr. Nelson. I would agree and would add there is motivation
and resources involved. As I said in my testimony, nothing is
free because there is a labor cost. Many system administrators
were sort of pressed into the job. They weren't well-trained.
It is a new field, and many of them are overloaded because
management doesn't appreciate the importance of security, so
that even if they know in principle the tools are available,
finding the time to acquire them, to understand them, and to
deploy them and to then take action based on them is a pretty
big load.
As I indicated in my testimony, at NASA we have deployed
uniform suites of commercially acquired tools because our
study--I won't say it was a thorough study, but we looked at
the cost of labor and the ease of use, and we found that the
commercial tools were a better buy for us, but then augmented
by selected free tools. No tool is perfect.
Mr. Horn. I was interested in your testimony where you put
the stress on training and supervision, and you remind me now
on management we put a measure through here, and it is, I
think, almost law, or it is still in the Senate, and that would
be to give the new President, whoever that is, a chance to
relate to the top management that he would bring in.
Ordinarily, between the Cabinet, the independent agencies,
that's about 30. Then you have got about 300 Commissioners and
Under Secretaries, so forth.
I think we definitely ought to get on that agenda, then,
their understanding of this type of security management. If it
goes up that high, and they don't understand it, I think it
will--and staff will note this, and we will put it in maybe
even as two words or something in what is coming out of the
Senate.
Mr. Nelson. What we did at NASA at the Administrator's
direction, the Chief Information Officer and I--I am Deputy
Chief Information Officer--visited each of our 10 centers and
headquarters and gave hands-on training briefings to the center
senior and middle managers.
Now, that wasn't a lot of time, but it emphasized that we
meant business, and we talked about metrics. We talked about
actions we were taking. We talked about their responsibilities.
It seems to be working. So I would commend the administration
to think of something like that.
Mr. Horn. Yes, I agree. The way we got leadership finally
on the Y2K thing in the executive branch was when Mr. Koskinen
was picked and went around and sat down with all the Deputy
Secretaries of each department to get them to understand that
this was serious business.
Any other comments on that? Mr. Collier.
Mr. Collier. The tools that are available at little or no
cost need only the person's desire to implement them. We
constantly see Windows basic tools for securing systems totally
inactive. It is a tradeoff between security and convenience.
Biometrics, we feel, brings both to the party in the sense that
it does give you the speed. It is not something else to flip on
and flip off. It is not something else lengthy to remember. If
we look at what we have done at passwords to overcome this
ability for people to break into our systems by finding out
what our passwords are, it is not the dog's name anymore; it is
not a simple thing that you can keep for a year, or your wife's
maiden name. It is an upper/lower case, full eight-character
ASCII 2 set. It is extremely difficult for anyone to remember
that. Change it every 30 to 60 days, and give them three or
four to remember, it can bring about a problem.
So I think the real issue is utilizing the tools that are
available and making the operators understand that the security
is important at the risk of what little inconvenience it is
going to cause.
Mr. Horn. Well, with reference to this subject, where on
the Internet can organizations and citizens find these tools?
Is it there?
Mr. Nelson. Let me speak to that. In my testimony I
indicated two sites. One, is our own NASIRC site,
www.nasirc.gov. The second, that I indicated was the Carnegie
Mellon CERT that I think Jack also mentioned. They have a good
set of tools.
With search engines and other news groups, it is probably a
half-hour to get started. I mean, this is very easy to do. This
is probably the easiest step. There is the step of, well, what
is good and what is not so good; what is easy to use, what is
not so good--what is not so easy to use. But access is the easy
part.
Mr. Brock. I would agree with that.
Mr. Horn. Intrusion detection tools can either be manual or
labor-intensive. Is there a better way to monitor potential
intruders?
Mr. Brock. Intrusion detection tools are a necessity. What
is difficult about intrusion detection tools is actually
following up. I mean, if you--you have an intrusion detection
tool, and you are logging in intrusions, you need to followup.
The issue that we found at many agencies is if they have
intrusion detection tools, and they are logging them in,
frequently they are not following up on the incidents to take
corrective action or to do something to stop the intruder.
That's why they are labor-intensive. You have to look at each
one individually.
I can't recall any intruder detection tool that would
automatically fix the problem or stop the intrusion. At some
point somebody has to intervene.
Mr. Nelson. Let me speak to that. Right now, and I agree
with what Mr. Brock said, right now it is manual, it is labor-
intensive. At NASA we require that every incident be reported
to the IT security manager at the center, and then to our
NASIRC, which we use as a coordination means.
So we send out encrypted alerts to our security people at
all centers based on the incidents reported by each center.
Many of those incidents are detected by the intrusion detection
tools. The securities managers followup with the system
administrators to get things fixed. Again, that's quite manual.
What we are looking at and what I would encourage the
industry to work harder on is automated, if you will,
artificial intelligence means to identify intrusions and
identify a recommended course of action. One of the things we
are looking at doing, we have not done it yet, is to gather
from each center--see, we are using the same tool--into a
centralized analysis location what those tools are reporting
and apply the artificial intelligence to the set of reports. We
find that if one NASA is--one NASA center is being attacked,
often several others are. These are coordinated attacks. But I
repeat, the artificial intelligence tools for analysis do not
appear to exist yet. It is an area that NASA is tracking
carefully, and we hope that in the next year or two we will see
something we can start to deploy.
Mr. Brock. If I could just add to that, Mr. Chairman,
that's true. The intrusion detection tools are very immature at
this point, and they are evolving. Again, another risk is that
as--is once an agency or an individual buys a tool, that tool
is changing rapidly, and the intrusion detection tools, they
are changing very rapidly, and they are not at a stage of
maturity now where they are going to provide the final answer.
Mr. Horn. Is there any way you can tell with the intrusion
that the--the type of computer is doing that, or is it just
hopeless? Because I am looking at individuals have one capacity
generally; foreign governments do have another capacity. If any
of them have something such as a Cray computer in terms of what
they can spin around and test things against to break through
particular firewalls, I am just curious about that.
Mr. Nelson. Usually we can tell what is called the source
Internet protocol address, and that identifies the location of
the attacker fairly well. Occasionally those addresses can be
what they call spoofed, which means they are faked, but
typically we can identify that.
Now, your discussion about the difference between an
individual and a foreign country, I wouldn't make too much of
that because groups of individuals are acting together, and the
power of modern, even personal computers and certainly work
stations is fully adequate to mount an attack that is very
serious.
So we pay a lot of attention to individuals. Obviously when
we sense that it is a better organized group, all the way up to
a government, we pay particular attention to it, but we
wouldn't want to make too fine a point on that distinction.
Mr. Horn. Any other thoughts on that?
OK. Mr. Brock, you mentioned in your statement that poor
security planning and management is, ``the rule rather than the
exception.'' So why is this posture the rule and not an
exception?
Mr. Brock. I wish there was a real simple answer to that
and that it would be easy to fix. It is, unfortunately, like a
lot of other issues, and very similar to the Y2K issue, is that
it--the actual computer security break-ins, the failings there
are technical. The correction is a management issue. There have
to be resources devoted to it. There have to be dollars, and
there has to be training, and the people that own the
processes, that own the information, that are accountable for
that need to be accountable for computer security. That is not
the case, and until that ownership occurs, I don't think you
will see widespread, systematic repair of the poor computer
security problems.
I think that happened in Y2K, in large part because of the
intensive oversight in Congress, in large part because of Mr.
Koskinen coming on board, in large part because Federal
managers were made aware there was a crisis. Those three
elements have not yet been put in place for computer security.
Mr. Horn. Well, you have put them very well, and that's
what I was leading to, in the sense that when Mr. Koskinen came
on board as assistant to the President, he worked with the
Chief Information Officer's Council and got the best out of
them. And I guess I would ask, does the Federal Government need
one organization or one high-ranking information technology
officer to coordinate security planning and management? Do we
need to continue a sort of Koskinen situation and relate it to
security?
Mr. Brock. That's an excellent question. I guess when you
start off saying that's an excellent question, that means you
are going to be wondering about my answer.
Mr. Horn. Is there an excellent answer?
Mr. Brock. I hope so.
Mr. Horn. We are college professors. We ask questions. We
don't answer them.
Mr. Brock. Well, I will go ahead with the answer now.
The--I believe there needs to be a Federal CIO. I think
very strongly that the information management issues, the
information technology issues that run across agencies are
serious. It is not just in computer security, but it is in
terms of how you control your investment dollar. It is do you
have an architecture that will support your business needs and
your technical needs. There are a series of issues that need to
be addressed on a consistent basis.
I think the CIO Council has done a reasonable job of
looking at some of these, but they are not in power. They don't
have budget. They don't have staff. They are volunteers on
this. There needs to be someone who is providing more
direction, more leadership.
Now, in terms of--and I believe that in this case a Federal
CIO would also be responsible for computer security.
Similarly, if you decided that computer security was an
important issue in terms of critical infrastructure protection,
where you were also involving the private sector and you were
involving physical security as well, I could easily see a role
for a national coordinator for critical infrastructure
protection that might be separate from a Federal CIO who would
be dealing primarily with agency responsibilities.
Mr. Horn. I have one reservation here, having been in the
largest educational system in the country, which is California
State University system. When you put somebody in the system
headquarters, everybody sort of says, oh, that's their problem,
and pretty soon they forget that it is their problem. They are
the campus administrators; that's where it happens. It doesn't
happen in headquarters. They never educated a student in their
life. A university does, and so do our departments. They are
mission-oriented, and they are producing things. I worry if,
say--to say, well, that isn't my business, let those people
over in OMB; or if we can separate it into the Office of
Management or the Office of Budget, and that's what worries me.
Doesn't that really sort of let up the heat on the individual,
the independent agencies, Cabinet departments?
Mr. Brock. If I could go back to the Y2K experience, I
think that even though there was a national coordinator with
Mr. Koskinen, he clearly held agencies accountable for their
actions, as did the President. I was here for several hearings,
and you were holding those agencies accountable.
I think you can keep the heat on the agencies. That's where
the responsibility lies for good computer security.
Mr. Horn. Right.
Mr. Brock. But the focal point, the Federal CIO, could
assist in that. I do not think that the Federal focal point
should become the stopgap; that this will solve the problems.
That still has to occur at the agencies, but certainly a CIO at
the national level could propagate good practices, could
leverage resources that were available to that individual and
serve a role, frankly, very similar to the one that Mr.
Koskinen served.
Mr. Horn. Yes. We had a specific time period that wasn't
going to be for 10, 20, or 100 years. It was just going to be a
few months, and that's really what it boiled down to. And the
job was very well done obviously, but that's--I need that
balance, I think.
Mr. Brock. Yes.
Mr. Horn. So you don't have people say, hey, it isn't my
problem, they do that over there, and wash their hands of it. I
don't think that will help us at all.
Mr. Brock. No, it would not.
Mr. Horn. Yes. But we certainly ought to have somebody that
had the right skills, people skills, so they aren't some czar.
The czar makes my spine shudder. But so that they are a
coordinator in getting people in the various systems that
overlap to work together, that's the way I would view that
coordinator role.
Mr. Brock. I would agree. I think that the success of any
coordinator or official like that does depend very much on that
individual's personal skills in terms of working with a very
diverse group of organizations who have different needs and
different objectives. That's a difficult job, very hard job.
Mr. Horn. That's right.
Mr. Nelson, any thoughts on that?
Mr. Nelson. Yes. Just to add a bit to Mr. Brock, I agree up
to possibly whether a CIO, Federal CIO, is warranted. As you
know, that's being debated within the administration, and I
won't take a position on that.
I agree with him that one does not want to separate the
computer security aspects from other aspects of management. We
are focusing on computer security today because, indeed, it is
a new problem. I am an optimist, and I think we are going to
get this problem under control, and if we have a legacy of a
fragmented management approach, it is going to take on a life
of its own.
A number of years ago, I worked on environmental protection
and on OSHA problems, and one of the things that I pushed on
was to reintegrate those functions. I called them the OSHA
Mafia, back with management, because management was abdicating
its responsibility, and, frankly, the Mafia in some cases were
running rampant with things that didn't make sense. Now, that's
a very personal observation. It's not NASA's observation. But
my experience in this area tells me that you want to integrate,
you want to set high standards, you want to measure, you want
to train, but you put the responsibility on the people who have
to make the tradeoffs and get the job done.
Mr. Horn. I agree with you completely on that. You say it
very well.
Mr. Collier, any further thoughts on this?
Mr. Collier. Mr. Brock and Mr. Nelson both mentioned that
communication between different agencies and even within a
particular agency is a critical element here. Within the
government, of course, the Critical Information Assurance
Office paper that came out this past year points to that. The
CIOs do have several venues in which they talk to each other.
The Government Information Technology Services Board, I think,
has done a good job in at least keeping the communication
flowing between agencies.
But I would tend to agree with you that to establish an
individual to take on this responsibility may not be the proper
way. The proper way to do this would be probably to continue
the communications, the lines of discussions, between agencies.
Mr. Horn. In your statement, Mr. Brock, you mentioned that
your audits have shown that Governmentwide computer security is
generally weak because current policies and controls are not
operating effectively. You also stated that the General
Accounting Office audits frequently find the same
vulnerabilities over and over and over again.
In your opinion, what would you specifically suggest that
agencies do to strengthen existing policy or to create stronger
policies? What is your thinking on that?
Mr. Brock. The--you are correct. Our reports have found the
same problem over and over again.
A couple of observations. First of all, many of the
policies have no relationship or a limited relationship to the
problems that we are finding. They are not specific to the
issues and problems that are within an agency. We believe that
policies and procedures need to be based on the risk that the
agencies are facing, and if you do a good risk assessment, you
can then, in fact, determine policies and procedures that will
minimize or mitigate those risks.
Second, most agencies aren't testing their controls. They
rely on GAO or IG to come in and do the test, so there is too
limited information within the agency, one, about what the
risks are and whether the policies would be reflective of
reducing that risk, and second, are the controls in place
working, are they being tested? Those are the things that we
would do to, one, develop policies that are appropriate, and,
second, to strengthen existing policies to make them more
responsive.
Mr. Horn. You also suggested that agencies develop and
distribute lists of vulnerabilities. To whom would these lists
be distributed?
Mr. Brock. Well, first of all----
Mr. Horn. Should it be GAO; should it be OMB; what, CIO
Council?
Mr. Brock. Everyone.
Mr. Horn. All of the above?
Mr. Brock. First of all, let's start within the agency. I
believe I mentioned earlier within some agencies we would go
to, they do not distribute such lists within the agency so that
people that are literally down the hall are not getting these
lists. So, first of all, you need to start within the agency.
Second, there are other organizations, such as the CERT-CC,
the Carnegie Mellon, the Fed CERT, the GSA runs, organizations
that do have distribution mechanisms that are appropriate as
well.
Mr. Horn. Yet Dilbert and the cubicle is broken down?
Mr. Brock. Yes.
Mr. Horn. Mr. Brock, you stated that establishing a
framework for managing security is important. What specific
elements of the framework are missing at most agencies?
Mr. Brock. If I could indulge Mr. Gilmore to put up the
circular chart, the wheel.
The risk management cycle, we believe, is the framework. I
will go back to an answer I just gave you, that the framework
has to start with a central focal point, the accountability.
From there, determine what the risks are, develop controls
based on that risk, promote awareness, and then continuously
monitor and evaluate. That's the framework.
Certainly there are things that you can do independent of
that framework, or you don't have to implement everything in
that exact cycle, but it is dynamic. It is continuous. The
threat is growing. The threat changes. The technology grows.
The technology changes. The services that an agency provides
change. So the risk management cycle has to roll on a
continuous basis.
Mr. Horn. So it is interactive in many ways?
Mr. Brock. Yes, sir.
Mr. Horn. Gentleman, Mr. Nelson, Mr. Collier, what do you
think about that approach there, just as one vision?
Mr. Nelson. Yes. I agree with Mr. Brock. I would like to
give you some examples of what we are doing at NASA along these
lines.
I said before that it starts with management. We have
identified what we call special management attention systems.
These are important computer systems for NASA's missions, and
we are requiring 100 percent completion of security plans for
those systems by this year, and we have asked our Inspector
General to audit that, including the involvement of management
in those plans and management signature on the readiness of
those systems to operate.
But we have had to operate in parallel because the risk is
too great. So at the same time we have identified what we call
the top 50 vulnerabilities in NASA, and we have distributed
that list to every center. It was done by consensus, not
somebody in a closet, but using the tools that I described, all
of our systems are being audited for the presence of those
vulnerabilities. When those vulnerabilities are detected,
management is informed of them and asked to correct them, and
then those systems are rescanned.
Now, management, if in its interest it believes that some
of those vulnerabilities must maintain because the risk is
tolerable and the loss to mission is too great, they can do a
waiver. But this forces them to act even before some of their
plans are completed, because we think that it is too much of a
crisis.
Mr. Horn. OK. Any other comments on that question?
Mr. Collier. I would agree that it is a management and
policy issue. When the Department of Defense began its studies
of biometrics back in the late 1980's, early 1990's, there was
as much emphasis placed on the people interface to biometrics
as there was on the technology side.
I found that a very refreshing model. I mean, the human
element is really what is the issue here. Technology pretty
much does what we make it to do, and it keeps on doing it. In
the area of security, however, the Department of Defense
studies, especially of the National Security Agency, involved
the study of time, motion, and the people's acceptance of a new
way of doing things, and labor was definitely a part of the
decisionmaking process.
I think that's a critical element in moving forward, to
remain dynamic enough to meet the threats as they continue to
improve on a day-to-day basis.
Mr. Horn. Mr. Nelson, any further comment on that question?
Mr. Nelson. No, thank you.
Mr. Horn. Mr. Turner has joined us. I am delighted to yield
such time as he may need for questioning.
Mr. Turner.
Mr. Turner. Mr. Nelson, I wanted to ask you if you could
describe for us the kind of computer intrusions and attacks
that you have experienced. We talk about this all the time, and
I don't really have a good grasp on the scope of the problem.
So can you quantify that and maybe give us some specific
examples of how some hacker has invaded your system, what the
consequences have been?
Mr. Nelson. Yes.
Mr. Turner. I know that we always read this is a widespread
problem.
Mr. Nelson. Yes.
Mr. Turner. I don't think we have a real feel for how
widespread it really is.
Mr. Nelson. First of all, NASA experiences a lot of
attacks, hundreds to thousands per month.
Mr. Turner. You say hundreds to thousands?
Mr. Nelson. Hundreds to thousands--of serious--to thousands
per month of serious attacks.
Mr. Turner. Hundreds to thousands?
Mr. Nelson. Yes. And we are not unusual, although we may be
are slightly favored.
Let me give an example of an attack which has several of
the elements we have been talking about in our testimony.
I am not going to describe the center, but in this
particular instance a system administrator observed that
someone from a foreign country had logged into the computer and
had no reason to think why that person should have--should be
able to log into the computer. He did this by examining records
logs, so he was doing the right thing.
Now, he found by looking at the log that the person had
used a well-known vulnerability to take over that computer; in
other words, to achieve what is called root access. That's like
god of the computer. You can do anything with the computer if
you are root.
Then the person used that vulnerability and his godlike
powers to install what is called a password sniffer. This is
software that observes the network traffic flowing by and looks
for packets that have passwords in them. And he was able, the
intruder, to grab a number of passwords, some of which were for
accounts at another center. So using those passwords and then
the ability to log on as a user, the attacker went to another
center and attacked several other computers.
Now, the sad part about this was that the initial
vulnerability should have been fixed. The system administrator
thought he had fixed it. He installed what is called a patch.
It is a thing like a Band-Aid; it is like a patch that changes
a software to get rid of the vulnerability, but the patch
didn't take. It was a defective installation process, and the
system administrator didn't know it. So he was hit twice with
the same vulnerability.
Now, we have had other attacks, and we keep track of how
much they cost, that have had a direct cleanup cost in time and
resources approaching half a million dollars, one attack. Of
course, it affected a lot of computers.
Mr. Turner. You say one attack cost half a million dollars?
Mr. Nelson. Approached half a million, a little under. The
numbers are not, of course, audit quality, but these are
expensive attacks. It took--in the case that I am referring to
of almost half a million dollars, it took about a month to put
all of these computers back together again. It was a major
problem.
We have had centers actually take themselves off the
Internet, in other words totally sever connections with the
outside for a brief period of time, because they felt that they
were being attacked, the risk was too high, they needed that
time to fix things up.
Now, the incidents that I am describing now are a year or
two old, and we don't have such bad problems now, but we still
get significant attacks.
Does this help? Does this give you a sense of--oh, one area
that I didn't describe is theft of data. We had an incident not
too long ago where substantial number of documents were stolen
by an Internet attack.
Mr. Turner. And what--were those sensitive documents?
Mr. Nelson. No, fortunately not. They were copyrighted.
They had commercial value. They were not sensitive. And these
particular documents were not resident on a NASA computer. It
was a NASA account that was used, and there was a serious
weakness in the vendor's security. But that's an example of an
attack that NASA was peripherally involved with.
Mr. Turner. So you say there are hundreds to even maybe
1,000 attacks per month?
Mr. Nelson. Correct.
Mr. Turner. Now, have you been able to successfully
determine the source of any of these attacks? Or do these
things just go on daily, and you try to prevent them, but you
don't know who did it?
Mr. Nelson. We can determine the source of most of them, at
least within the country, and maybe the organization. And we
work closely with our Inspector General and then with the FBI,
and several of these have been prosecuted and the perpetrator
convicted. In a--on a regular basis, if we see an attack, we
inform the organization that the attack is coming from, and
often the attack is from someone not connected with that
organization, but someone who has seized a computer, seized
meaning this root access, god powers within the organization.
The organization may not know it. That could be a government
organization or a private organization in this country or
abroad.
So one wants to be careful saying we are being attacked
from a certain country; they must be hostile. Maybe they are
the victim.
Mr. Turner. So there have been some convictions that have
resulted from your investigation?
Mr. Nelson. Yes, sir. Yes, sir.
Mr. Turner. Would it be fair to say that the vast majority
of the attacks, that the source of them are--that you never
quite figure out who did it?
Mr. Nelson. Yes.
Mr. Turner. Or where they are from?
Mr. Nelson. Yes. Not in who the individual was or what
their motives were, that's correct. And attack isn't
necessarily successful. I want to make it clear that when I
talk about hundreds to thousands of attacks, I am including all
of the incidents that we gather metrics on. The successful
attacks would be a lot smaller, and increasingly we ward off
those attacks. We use another metric of what is the success
rate of incidents, and we are seeing the numbers turn over. It
is sort of a nice payoff for the hard work we have gone through
in the last couple of years that our numbers are getting
better. The attack rates are going up. The successful attack
rates are going down.
Mr. Turner. Tell me the examples of intrusions from foreign
governments or agencies of foreign governments.
Mr. Nelson. I don't have data on that that I would be
confident in saying, even in a conversation. So I am sorry, I
do not have any data on attacks by foreign governments that I
would have any confidence in reporting.
You know, it is hard to know, when you have an attack from
an IP address, even if that is located within an agency of a
foreign government, is that the activity of a foreign
government. To the best of my knowledge, we have no evidence of
NASA attacks by agents of foreign governments, but I do not
have high confidence in that statement because we do not have
good data.
Mr. Turner. The convictions that have resulted from the
efforts, what kind of individuals are we talking about that
have actually been convicted of a crime?
Mr. Nelson. Our Inspector General would be a lot more
authoritative on this, but I believe they have tended to be
fairly young males working either alone or with others of like
mind, but at least my knowledge is that they do not appear to
be part of what one might call organized either crime or
terrorism in the conventional sense. Their prime aim, as I
recall--but I think if you would like we could submit for the
record a response from our Inspector General, I could request
it--but as I recall, they have not been industrial espionage
cases or the like.
Mr. Turner. I do think it would be helpful, with the
chairman's permission, to ask you to at least give us some
indication maybe for the last 2 or 3 years of the number of
attacks, how they have been resolved, and whatever information
you can provide us about the source of them, because at least
by looking at it as a whole, we would get some picture for us
to look at of how serious this problem really is.
Is that possible to put that kind of data together to give
us an overview?
Mr. Nelson. Indeed, it would. If you will give us just a
little leeway.
We try to not advertise the successful attacks. Our
experience is that one of the motivations for attackers is the
recognition, if you will, the thrill. We are very leery of
playing to that.
Mr. Turner. I suspect that your reticence on that point is
shared by many people in various agencies of the government,
and I think one of the difficulties that we have as a committee
in trying to address this problem is trying to get some data
together to indicate how serious this problem really is.
Mr. Nelson. We would be eager to work with you on getting
data that is helpful to you.
Mr. Turner. When you deal with these kind of intrusions, do
you rely upon NASA employees, or do you rely on contractors to
help you resolve them?
Mr. Nelson. Both. Many of NASA's services are now operated
by contractors, and so we have integrated those contractors
into our operations. In our testimony--in my testimony, I
mentioned that we have a draft regulation out for comment that
would require the same training standards for our contractors
as for ourselves. NASA has not outsourced or not contracted out
our security responsibilities. So where we have contractors
operating systems within our centers, or otherwise directly
attached to NASA, we retain the responsibility and the
capability for detecting and responding to attacks.
Now, that response may be asking the contractor to do
something. Since they are well-integrated now into our
planning, they are eager to do that.
I think the system is working fairly well, but it has added
a complication of crossing these contract boundaries.
Mr. Turner. Is it possible for an intruder to compromise
the success of any of our missions? I know you have had a
tremendous problem recently with success in some of the Mars
missions. Is it possible that a problem could be created of
that nature by an intruder into our computer systems?
Mr. Nelson. We take pretty strong security precautions for
mission-critical systems. Having said that, there is always a
possibility. We are into risk management. Risk avoidance is
very difficult. We do, though, take, as I said, very strong
precautions, including in some cases simply severing the
critical system, planned severing from any outside
communication to minimize that risk, but we are talking about
risk management, not risk avoidance.
Mr. Turner. Thank you, Mr. Chairman.
Mr. Horn. Well, we thank you. That was a very useful
interchange, questions and answers.
Let me go back, Mr. Nelson. Has your top 50 list of
vulnerabilities been distributed outside of NASA?
Mr. Nelson. Not to my knowledge. It was a list that we
arrived at working among ourselves, and it is a list that we
have programmed into our auditing tools. So it is, in effect,
automated now. But I am not aware that we have distributed it
outside the agency. There are other agencies that are doing
similar lists, and I think the overlap would be pretty large.
Mr. Horn. Well, would it be helpful if in a report from
this subcommittee that we use some of that information if there
are ones beyond NASA that differ, and then the question would
be does that encourage hacking or doesn't it? But how we deal
with it, I think we have to get the word out.
Mr. Nelson. We wouldn't want it known what number 51 is,
and 50 was a good round number, and that 50 will change. It is
partly getting well. We have had to beat on this one, as I
indicated earlier, to get managements attention, but we expect
that next year's top 50 will be a different list, and it may
not even be 50. But, yes, with appropriate precautions we would
be willing to share that list, certainly, with responsible
people in other agencies.
Mr. Horn. On Mr. Turner's point, I just suggested to Mr.
Ryan that we find from Justice how many have been jailed and
where are they. I know a few are in the Atlanta prison, but I
think it is good to get at least some of them. We don't have to
make heroes out of them. We can say Mr. Blank and Ms. Blank or
whatever, because I don't want to have this be the award system
for hackers.
Let me ask you, again, Mr. Nelson, another thing. You gave
a very interesting chart when you said you are spending roughly
2 percent of the funding for information technology on security
provided adequate protection. Two percent seems like a very
modest amount to spend on security, so I guess do you think
that's pretty low, and should we invest more?
Mr. Nelson. I can only speak for NASA, and we do gather
budget data on our actual costs. Our information technology
budget as a whole is about $2.1 billion, and our fiscal year
2000 expenditure on information technology security is about
$46 million, which is a little bit over 2 percent.
Now, we don't know that that is optimally allocated. So I
would say at first, my initial reaction is that NASA--and that
increased quite a bit, by the way, from 1999 to 2000. But NASA
is now spending about the right amount, and it is a case of
efficient allocation so that we hit the most important things.
Mr. Horn. So you think you are at the right level of
spending on this then?
Mr. Nelson. Approximately.
Mr. Horn. OK.
Mr. Nelson. Yes. Now, Mr. Collier, in your written
statement, you explained that the prevalence of computer
passwords written on the back of computer mouse pads, on desk
leaves, and even on paper attached to computer monitors do
exist. I know what you mean. I think it is all around Capitol
Hill, too.
In addition, you stated that remembering a PIN, the
personal identification number, is a key piece of computer
security. In your opinion, what can individuals do to better
recall passwords?
Mr. Collier. Aside from memory exercises, if we are going
into this 8 character password with, again, a full keyboard set
of characters, I think the idea is to do something to move away
from these complex passwords. The positive user authentication
model that I presented earlier is an effort to do just that.
Again, we have the human being factor here at the edge of the
envelope.
Our company has clients, for instance, in the wire transfer
business where they have 25 passwords to remember. Now, unless
you are the Great Kreskin, it is pretty difficult to do that.
So I think rather than trying to formulate ways to help people
remember passwords, we have to find ways to eliminate them
entirely, and I think the positive user identification model,
which I think the DOD originally had come up with 10 years ago,
is a move toward that.
Mr. Horn. Does that mean a certain unit has to be built on
every machine to do that in terms of the fingerprint and all of
the rest?
Mr. Collier. Biometrics are certainly one of the legs of
the stool. The cost, again, is coming down greatly. Right now
we are seeing it move into the mainstream, certainly in the
commercial world, protecting enterprise systems within large
corporations. The Federal Government is doing it at the
division and command level now, and I think it is just a matter
of time before we see biometrics not only in computers, of
course, but in many, many areas of our lives where we have to
remember passwords, PINs, and the like.
Mr. Horn. If you had the, say, thumb identification to
access your particular personal computer, is there any way a
hacker getting into that would be able to digitize the lines
and everything else so they could duplicate that?
Mr. Collier. At the direction of the computer industry and
the Department of Defense, primary responsibility from the NSA
side of things, we have addressed the issue of intruder
attacks, we do encrypt the signals coming out of the scanner,
so they can't be sniffed. Our product in the sense of the
templates is part of the operating system which is part of the
layered security shell around the password protection. We do
secure sessions between all pieces of hardware, as well as
between client and work station. There have been a lot of
efforts put into making this stuff spoof-resistant. James Bond
might still be able to get in, but not the average user, that's
for sure.
Mr. Horn. Well, I was interested when one of you compared
the need for looking at how you divide the issues in computer
security are very much like a responsible accounting operation
when you are handling a lot of money, and you want more than
one, and my chief auditor said many years ago--he said, make
sure everybody takes a vacation. The system--when they found
one in another system in California where the vice chancellor
just happened to be buying bales of hay for his ranch, but not
the university ranch, he was charging it to the university, and
the only way they found that was when he finally took leave and
somebody said, gee, this is strange, and that was solved.
That's, I think, what we have to do here. Is there
something along that line that we ought to be telling everybody
that runs a computer center in the Federal Government and how
we could apply what people do in the finance and auditing in
universities and corporations for standard practice?
Mr. Brock.
Mr. Brock. Segregation of duties is perhaps one of the most
absolute basic controls there is for any type of operation,
whether it is financial matters, as you were talking about, or
computer security.
In fact, when you look at any critical operation from
beginning to end, you can make breaks in there where you say,
we are going to have a division of labor, and in computer
security, if you were looking at a process of changing
software, you can make breaks from the people who make the
change to the people who do the testing to the people who do
the installation, to make sure that there is an independence
there.
You could do that for other aspects of security as well.
Mr. Horn. Well, in other words, in your opinion, are
Federal agencies susceptible to having one individual either
intentionally or inadvertently render the computer system
useless due to the lack of segregation of duties or separation
of duties involved?
Mr. Brock. I don't have the exact numbers now, but we
have--maybe I do have the exact numbers.
Mr. Horn. Ms. Boltz, glad you came today.
Mr. Brock. We don't have numbers, but we did identify, for
example, at the Department of Defense and VA that system
program and security administration duties were combined. So
the people who were establishing the controls were also doing
the programming.
At the FMS, we were saying that programmers had access to
production data. So, in both cases they were able to combine
pieces of information; if they had chosen to, could have taken
over programs and assumed other responsibilities as well.
This is fairly common. In some respects, it is done not out
of a malicious intent. It is done because I think, as Mr.
Nelson alluded to, you have too few people trying to do too
many things.
Mr. Horn. Any other thoughts on that, Mr. Nelson, Mr.
Collier?
Mr. Nelson. Yes, I would say I agree with Mr. Brock.
However, in the scientific and technical area, the terminology
may be different, and so one has to be a little careful not to
be too rote in the prescriptions. What applies well to a
financial system may not apply very well to a scientific data
analysis system. The principles are correct, but the
application has to be careful.
Mr. Horn. Yes. Mr. Collier.
Mr. Collier. You know, applications that we run into within
the government, we have established some two-man rules in some
cases. We have established complex procedures to ensure
reduction in fraud, for instance, in transferring of funds,
payment of benefits, etc. What I think biometrics and this
security model bring to the party there, and that's what we are
hearing from the government agencies, is we now have
established the fact who was sitting behind the monitor when
this fraud took place, not a matter of someone could have
gotten my PIN or whatever. The banking industry has really
embraced this because of the nonrepudiation issues and the home
banking and wire transfers. As we get less and less on a face-
to-face human basis, the problem increases, and they are trying
to do something about the future that we know is going to
explode before it does.
Mr. Horn. Thank you. Any other thoughts on that?
Mr. Brock. No, sir.
Mr. Horn. One of my last questions here will be, in your
opinion is the current legal framework, which includes the
Computer Security Act of 1987 supporting Federal information
security requirements, is that adequate? What needs to be
updated or modified? Are there things that should be dealt
with? Mr. Turner and I will be glad to move that legislation,
if there is need for it. What does the CIO Council think on
some of these things?
Mr. Nelson. Let me take that. In my opinion, the legal
framework is pretty good. I am not a lawyer, so I will speak
generally. But there is a potential problem that we are dealing
with, and I think Mr. Brock alluded to it in his oral remarks.
It has to do with classification.
The laws governing classification in this country are
rather strict with regard to national security systems, and as
the importance of information security has increased and the
role of commercial and private systems has increased in their
aid to national defense, then the question of where strictly
national security stops and broader areas that are related to
security starts. And so the particular problem that we are
having is that we believe that within NASA a compendia, that
is, lists, of open serious vulnerabilities, such as, for
example, would be turned up by what we call a penetration test
where we hire somebody or on our own to go through all of our
systems and look to see how hackers would get in, that those
lists are very sensitive, and my understanding--and we have
been working with our legal staff and with the National
Archives and Records Administration, which has ultimate
classification authority, on the criteria under which these can
be classified.
The issue is a little murky, but right now it looks like
maybe they cannot be, not even at a confidential level. So it
could be that some clarification of the extent of national
security provisions in this gray area of civil systems closely
allied with national security systems would be helpful.
Mr. Horn. Well, that's very interesting because this is the
subcommittee that has oversight for the National Archives and
the Freedom of Information, and we try to balance all of that.
If there isn't a need for classification, it shouldn't be
classified. So I would welcome any thoughts you have on that,
and I know Mr. Turner would also.
So----
Mr. Brock. Mr. Horn.
Mr. Horn. Mr. Brock.
Mr. Brock. Can I have a moment of disagreement? I have been
agreeing with Mr. Nelson all along.
I do not think the overarching framework is adequate. As we
mentioned in the testimony, the Computer Security Act is based,
I think, on an old way of doing things. It is based on an
environment that existed before the Internet. It was based on a
mainframe environment, and I believe that it was based on an
environment where locks and keys were the prevalent security
devices. It's system-based. It is not management-oriented. It
misplaces responsibility and accountability. I think it needs
to be overhauled.
I think there needs to be more emphasis placed on
management accountability. I think there needs to be more
emphasis placed on risk assessments and risk determination. I
believe there needs to be more emphasis placed on independent
audit and management audit so that controls can be evaluated.
Those are not present in the Computer Security Act.
Now, as you know, there is no law against good management.
There is no law or anything to prevent an agency from doing all
of those good practices, but at the same time there is no law
or legislation or regulation that really encourages that type
of action and then provides a lever or an oversight mechanism
to the administration or to the Congress for assuring that that
framework is being met.
Mr. Horn. Well, thank you, because that was the answer I
was going to lead with a question, and I am so used to Joe
Wilmingson following me around the country on Y2K that I always
asked, and now I will ask you and anybody from GAO, to what
degree have we not covered the questions that we should have
covered. And you have just nailed one down, and I appreciate
that.
Would GAO and the CIO Council, Chief Information Officer
Council, put their thinking caps on, and we would welcome
taking a look at that again. We need to update it. It has been
over two decades right now--or a decade and a half, I guess.
So are there any other questions any of you think--and you,
Mr. Brock, in particular--what else should we get on the record
that we haven't put on?
Mr. Brock. I think that my last response covered the one
item, and we are continuing to work with your staff on a number
of computer security issues as well, particularly as they might
relate to e-commerce and other initiatives that are coming up.
We are pleased to have the opportunity today to discuss these
items with you.
Mr. Horn. Well, we are glad to do it. We certainly welcome
the comments of these witnesses, as well as the ones from our
first panel. They were a very excellent group. Thank you, Mr.
Collier, for coming.
Mr. Nelson.
Mr. Nelson. Yes, I would just like to maybe amend what I
said so perhaps Mr. Brock and I can agree. In addressing your
question on legal framework, I was responding from the
standpoint of NASA or an agency as to whether the current law
gets in our way of doing good things. But for an agency that
does not wish to practice good management, a legal
encouragement might not be out of order.
Mr. Horn. Well, that's well said.
I would tell you that this chamber operates not by
consensus, but like a university does, and maybe NASA, but if
we have 218 votes, we can do almost anything. But obviously we
also could lose 218 votes if we haven't thought it through very
well. So I thank you all.
I want to thank the staff that worked on this hearing.
You have been excellent witnesses.
J. Russell George is in the doorway over there. Gosh, are
you getting framed now over there or what? Staff director and
chief counsel, and he works wonders. Matt Ryan to my left, your
right, senior policy director, and who is a GAO alumnus, as are
a number of our people; Bonnie Heald, director of
communications, seated in the back there; Bryan Sisk, our
clerk; Ryan McKee, the staff assistant; and for Mr. Turner's
staff, Trey Henderson as counsel, and Jean
Gosa, the minority clerk. And our court reporter today is one,
and that's Mindi Colchico, and we didn't have to wear you out
and bring another one in, I take it. So thank you for coming
again.
With that, we are adjourned.
[Whereupon, at 12 noon, the subcommittee was adjourned.]
-