[House Hearing, 115 Congress]
[From the U.S. Government Publishing Office]
THE CURRENT STATE OF PRIVATE-SECTOR ENGAGEMENT FOR CYBERSECURITY
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
CYBERSECURITY AND
INFRASTRUCTURE PROTECTION
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED FIFTEENTH CONGRESS
FIRST SESSION
__________
MARCH 9, 2017
__________
Serial No. 115-7
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.gpo.gov/fdsys/
______
U.S. GOVERNMENT PUBLISHING OFFICE
26-905 PDF WASHINGTON : 2017
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
__________
COMMITTEE ON HOMELAND SECURITY
Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas Bennie G. Thompson, Mississippi
Peter T. King, New York Sheila Jackson Lee, Texas
Mike Rogers, Alabama James R. Langevin, Rhode Island
Jeff Duncan, South Carolina Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania William R. Keating, Massachusetts
Lou Barletta, Pennsylvania Donald M. Payne, Jr., New Jersey
Scott Perry, Pennsylvania Filemon Vela, Texas
John Katko, New York Bonnie Watson Coleman, New Jersey
Will Hurd, Texas Kathleen M. Rice, New York
Martha McSally, Arizona J. Luis Correa, California
John Ratcliffe, Texas Val Butler Demings, Florida
Daniel M. Donovan, Jr., New York Nanette Diaz Barragan, California
Mike Gallagher, Wisconsin
Clay Higgins, Louisiana
John H. Rutherford, Florida
Thomas A. Garrett, Jr., Virginia
Brian K. Fitzpatrick, Pennsylvania
Brendan P. Shields, Staff Director
Kathleen Crooks Flynn, Deputy General Counsel
Michael S. Twinchek, Chief Clerk
Hope Goins, Minority Staff Director
------
SUBCOMMITTEE ON CYBERSECURITY AND INFRASTRUCTURE PROTECTION
John Ratcliffe, Texas, Chairman
John Katko, New York Cedric L. Richmond, Louisiana
Daniel M. Donovan, Jr., New York Sheila Jackson Lee, Texas
Mike Gallagher, Wisconsin James R. Langevin, Rhode Island
Clay Higgins, Louisiana Val Butler Demings, Florida
Thomas A. Garrett, Jr., Virginia Bennie G. Thompson, Mississippi
Brian K. Fitzpatrick, Pennsylvania (ex officio)
Michael T. McCaul, Texas (ex
officio)
Brett DeWitt, Subcommittee Staff Director
C O N T E N T S
----------
Page
Statements
The Honorable John Ratcliffe, a Representative in Congress From
the State of Texas, and Chairman, Subcommittee on Cybersecurity
and Infrastructure Protection:
Oral Statement................................................. 1
Prepared Statement............................................. 3
The Honorable Cedric L. Richmond, a Representative in Congress
From the State of Louisiana, and Ranking Member, Subcommittee
on Cybersecurity and Infrastructure Protection:
Oral Statement................................................. 4
Prepared Statement............................................. 5
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Security:
Prepared Statement............................................. 5
The Honorable Sheila Jackson Lee, a Representative in Congress
From the State of Texas:
Prepared Statement............................................. 6
Witnesses
Mr. Daniel Nutkis, Chief Executive Officer, HITRUST Alliance:
Oral Statement................................................. 8
Prepared Statement............................................. 9
Mr. Scott Montgomery, Vice President and Chief Technical
Strategist, Intel Security Group, Intel Corporation:
Oral Statement................................................. 13
Prepared Statement............................................. 14
Mr. Jeffrey Greene, Senior Director, Global Government Affairs
and Policy, Symantec:
Oral Statement................................................. 21
Prepared Statement............................................. 23
Mr. Ryan M. Gillis, Vice President of Cybersecurity Strategy and
Global Policy, Palo Alto Networks:
Oral Statement................................................. 27
Prepared Statement............................................. 28
Mr. Robyn Greene, Policy Counsel and Government Affairs Lead,
Open Technology Institute, New America:
Oral Statement................................................. 34
Prepared Statement............................................. 36
Appendix
Questions From Honorable James Langevin for Daniel Nutkis........ 61
Questions From Honorable James Langevin for Scott Montgomery..... 61
Questions From Honorable James Langevin for Jeffrey Greene....... 64
Questions From Honorable James Langevin for Ryan M. Gillis....... 66
Questions From Honorable Cedric Richmond for Robyn Greene........ 67
Questions From Honorable James Langevin for Robyn Greene......... 68
THE CURRENT STATE OF PRIVATE-SECTOR ENGAGEMENT FOR CYBERSECURITY
----------
Thursday, March 9, 2017
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Cybersecurity and
Infrastructure Protection,
Washington, DC.
The subcommittee met, pursuant to notice, at 10:09 a.m., in
room HVC-210, Capitol Visitor Center, Hon. John Ratcliffe
(Chairman of the subcommittee) presiding. Present:
Representatives Ratcliffe, Katko, Donovan, Gallagher,
Fitzpatrick, Richmond, Jackson Lee, Langevin, and Demings.
Mr. Ratcliffe. The Committee on Homeland Security
Subcommittee on Cybersecurity and Infrastructure Protection
will come to order.
The subcommittee is meeting today to receive testimony
regarding the current state of DHS's private sector engagement
for cybersecurity.
I now recognize myself for an opening statement.
Cybersecurity touches every aspect of the world that we
live in. It is central to every sector of our economy. It is
vitally important to the protection of all Americans' most
sensitive information and it is one of the foremost National
security challenges of our time.
Our collective ability to combat these threats with
Government and the private sector working together will be one
of the defining public policy challenges of our generation.
Today, the Homeland Security Subcommittee on Cybersecurity
and Infrastructure Protection meets to hear from key
stakeholders on the current state of private-sector engagement
for DHS's cybersecurity mission.
As Chairman of this subcommittee, I don't take the
responsibility that we as lawmakers in this room have lightly.
In a world of rapidly-evolving threats, we have been entrusted
to be part of the solution, and I believe that today's hearing
will be an important piece of this on-going effort.
DHS's cyber mission includes a robust portfolio of existing
private-sector partnerships, including information-sharing and
analysis organizations, the Cyber Information Sharing and
Collaboration Program, Sector Coordinating Councils and the
Automated Indicator Sharing Program.
Specifically, we hope to learn how these partnerships can
be improved and what more DHS can be doing to ensure that these
programs and activities are meaningful, substantive, and
effective.
Today, the private-sector entities, including U.S. critical
infrastructure owners and operators, are on the front line of
conflict in cyber space. Our civilian networks face countless
attacks every day from bad actors who seek to infiltrate our
trusted systems, cripple our commerce, and expose Americans'
personal information.
Every day, these bad actors are using more advanced
tactics, techniques, and procedures, and higher-quality
information. It is only through constant and vigilant
innovation that their attacks can be prevented, identified, and
mitigated.
While DHS has made headway in this space and has
strengthened many initiatives in its role as the civilian
interface and coordinator across 16 critical infrastructure
sectors for cybersecurity, very clearly more work needs to be
done. It is not enough to simply have programs in place.
Instead, we must be constantly measuring, benchmarking, and
setting goals associated with their outcomes.
Additionally, DHS needs to become fully operational so that
it can effectively carry out the cybersecurity authorities that
Congress deliberately gave the Department just over a year ago.
Today is the start of a new conversation that needs to
occur in a new world on this new battlefield, and the start of
a new administration provides a clean slate, a perfect
opportunity to regroup and reassess before moving forward, an
opportunity to ensure that our efforts and resources are
aligned with the threat landscape that we face right now.
Several weeks ago in a homeland security hearing in this
room, I was pleased to have the opportunity to discuss with
Secretary Kelly the importance of DHS's cyber mission. What I
told him and what I know the rest of this subcommittee joins me
in reinforcing is that we stand ready to pedal as fast as his
agency and the entire Trump administration demands because the
stakes are too high to do anything less right now.
In the cyber domain, we are constantly learning new
lessons. It is only by incorporating the knowledge into
existing programs and processes that we can continue to move
toward greater collaboration and better-secured networks.
Because, while the private sector is on the front lines of our
cyber challenges, the Federal Government, and DHS in
particular, has an important role to play as a force multiplier
to provide the private sector with every advantage available to
defend itself.
In the 115th Congress, this subcommittee will be
legislating and conducting rigorous oversight to further
strengthen DHS's civilian cyber mission. While the various DHS
touch-points with the private that we will discuss today range
in levels of sophistication and size of participant base, they
all depend on quality information flowing at a rate that makes
it timely and actionable.
Marked changes in the security of our country's
cybersecurity posture will only occur in concert with the
advancement of the collaborations that we are going to be
discussing today. The combination of information, capacity, and
technical expertise needs to be leveraged in partnership at
every turn.
We look forward to hearing from the witnesses on these
private-sector engagement efforts at DHS. Our goal on this
topic is to make sure that the private sector has every
opportunity and every reason to take full advantage of DHS's
cybersecurity programs so we can continue to work to secure
cyber space.
Again, thanks to our witnesses for your willingness to be
here today to share your expertise.
[The statement of Chairman Ratcliffe follows:]
Statement of Chairman John Ratcliffe
Cybersecurity touches every aspect of the world we live in. It's
central to every sector of our economy. It's vitally important for the
protection of all Americans' most sensitive information, and it's one
of the foremost National security challenges of our time. Our
collective ability to combat these threats--with the Government and the
private sector working together--will be one of the defining public
policy challenges of our generation.
Today the House Homeland Security Subcommittee on Cybersecurity and
Infrastructure Protection meets to hear from key stakeholders on the
current state of private-sector engagement for DHS's cybersecurity
mission. As Chairman of this subcommittee, I don't take the
responsibility the lawmakers in this room have lightly. In a world of
rapidly-evolving threats, we have been entrusted to be part of the
solution, and I believe today's hearing will be an important piece of
this on-going effort.
DHS's cyber mission includes a robust portfolio of existing
private-sector partnerships--including Information Sharing and Analysis
Organizations, the Cyber Information Sharing and Collaboration Program,
Sector Coordinating Councils, and the Automated Indicator Sharing
Program. Specifically, we hope to learn how these partnerships can be
improved and what more DHS can be doing to ensure that these programs
and activities are meaningful, substantive, and effective.
Today, private-sector entities--including U.S. critical
infrastructure owners and operators--are on the front line of the
conflict in cyber space. Our civilian networks face countless attacks
every day from bad actors who seek to infiltrate our trusted systems,
cripple commerce, and expose Americans' personal and sensitive
information. Bad actors are using more advanced tactics, techniques,
and procedures, and higher quality information. It is only through
constant and vigilant innovation that their attacks can be prevented,
identified, and mitigated.
While DHS has made headway in this space and has strengthened many
initiatives in its role as the civilian interface and coordinator
across the 16 critical infrastructure sectors for cybersecurity, more
work needs to be done. It is not enough to simply have programs ``in
place.'' Instead, we must be constantly measuring, bench-marking, and
setting goals associated with their outcomes. Additionally, DHS needs
to become fully operational so it can most effectively carry out the
cybersecurity authorities Congress deliberately gave the Department
just over a year ago.
Today is the start of a conversation that needs to occur in this
new world with this new battlefield. And the start of a new
administration provides a clean slate--a perfect opportunity to regroup
and reassess before moving forward. An opportunity to ensure that our
efforts and resources are aligned with the threat landscape we face.
Several weeks ago in a Homeland Security hearing, I was pleased to
have the opportunity to discuss with Secretary Kelly the importance of
DHS's cyber mission. What I told him, and what I know the rest of this
subcommittee joins me in reinforcing, is that we stand ready to pedal
as fast as his agency and the Trump administration demands. Because the
stakes are too high to do anything less.
In the cyber domain, we are constantly learning new lessons, and it
is only by incorporating that knowledge into existing programs and
processes that we can continue to move toward greater collaboration and
better-secured networks. Because while the private sector is on the
front lines of our cyber challenges, the Federal Government, and DHS in
particular, has an important role to play as a force multiplier to
provide the private sector with every advantage available to defend
itself.
In the 115th Congress, this subcommittee will be legislating and
conducting rigorous oversight to further strengthen DHS's civilian
cyber mission. While the various DHS touchpoints with the private that
we will discuss today range in levels of sophistication and size of
participant base, they all depend on quality information flowing at a
rate that makes it timely and actionable.
Marked changes in the security of our country's cybersecurity
posture will only occur in concert with the advancement of the
collaborations that we will be discussing today. The combination of
information, capacity, and technical expertise needs to be leveraged in
partnership at every turn.
We look forward to hearing from the witnesses on these private-
sector engagement efforts at DHS. Our goal on this topic is to make
sure that the private sector has every opportunity and every reason to
take full advantage of DHS cybersecurity programs so we can continue to
work together to secure cyber space.
Again, thank you to our witnesses for your willingness to share
your expertise.
Mr. Ratcliffe. The Chair now recognizes the Ranking
Minority Member of the subcommittee, the gentleman from
Louisiana, Mr. Richmond, for his opening statement.
Mr. Richmond. Thank you, Chairman Ratcliffe, for holding
this hearing to examine how the Department and the private
sector work together on cybersecurity.
As this is the first subcommittee hearing, I would like to
start off by welcoming the gentlelady from Florida, Mrs. Val
Demings, to the subcommittee.
Cybersecurity issues dominated the 2016 election, from the
security of Secretary Clinton's server to Vladimir Putin
ordering cyber attacks on the U.S. election systems to
Wikileaks publishing the private emails of prominent Democratic
figures. America got a crash course in cybersecurity.
Before he was sworn in, President Trump said he would
direct the Department of Defense and the Joint Chiefs to
develop a comprehensive plan to protect America's vital
infrastructure from cyber attacks and all other forms of
attacks. This was on his first day in office.
While I share the President's desire to better protect
critical infrastructure, directing the Pentagon to take on
cybersecurity in the private sector would represent a radical
departure from how the Government manages cybersecurity.
Since 2001, DHS has been the lead agency responsible for
coordinating Federal efforts to protect critical infrastructure
and, in that capacity, has made major strides in cyber
information sharing among critical infrastructure owners and
operators.
Then, 2 years ago, with input from some of the witnesses
assembled on this panel, legislation was signed into law
codifying DHS's role as the lead civilian interface for
information sharing. Since that time, DHS has ramped up its
efforts to partner with critical infrastructure.
We often say on this committee that the threat landscape is
constantly evolving. When it comes to cybersecurity, the
volume, the complexity, and scale of attacks grow exponentially
with each passing day.
To meet this challenge, the culture around cyber
information sharing needs to shift, just as it needed to shift
after 9/11 when Federal law enforcement and intelligence
agencies moved from a need-to-know to a need-to-share culture.
As we work to enhance the quality of information sharing,
we must not lose sight of the obligations of all involved to
protect the personal information of Americans or impacted
networks.
I am glad to see that Ms. Greene is here to talk with us
about these obligations. I also look forward to talking with
all the witnesses about what, from their perspectives, DHS and
specifically NCCIC could be doing better.
Last year, Congress enacted legislation I authored to make
sure DHS is carrying out its diverse portfolio of cybersecurity
responsibilities in a strategic manner. In a couple of weeks,
DHS should be transmitting to Congress its first ever
Department-wide cybersecurity strategy. When we see the
strategy, I may want to engage with you all on your thoughts.
Finally, while I recognize that the long-awaited Executive
Order on cybersecurity has not yet been issued, it will be good
to hear your thoughts on what we have seen so far from
President Trump's administration on cybersecurity.
With that, Mr. Chairman, I yield back.
[The statement of Ranking Member Richmond follows:]
Statement of Ranking Member Cedric L. Richmond
March 9, 2017
Cybersecurity issues dominated the 2016 election. From the security
of Secretary Clinton's server, to Vladimir Putin ordering cyber attacks
on U.S. election systems, to WikiLeaks publishing the private emails of
prominent Democratic figures--America got a crash-course in
cybersecurity.
Before he was sworn in, President Trump said he would direct the
Department of Defense and the Joint Chiefs to develop ``a comprehensive
plan to protect America's vital infrastructure from cyber attacks, and
all other form of attacks'' on his first day in office.
While I share the President's desire to better protect critical
infrastructure, directing the Pentagon to take on cybersecurity in the
private sector would represent a radical departure from how the
Government manages cybersecurity.
Since 2001, DHS has been the lead agency responsible for
coordinating Federal efforts to protect critical infrastructure and, in
that capacity, has made major strides in cyber information sharing
among critical infrastructure owners and operators.
Then two years ago, with input from some of the witnesses assembled
on this panel, legislation was signed into law codifying DHS's role as
the lead civilian interface for information sharing. Since that time,
DHS has ramped up its efforts to partner with critical infrastructure.
We often say on this committee that the threat landscape is
constantly evolving. When it comes to cybersecurity, the volume,
complexity, and scale of attacks grow exponentially with each passing
day. To meet this challenge, the culture around cyber information
sharing needs to shift--just as it needed to shift after 9/11, when
Federal law enforcement and intelligence agencies moved from a ``need
to know'' to ``need to share'' culture.
As we work to enhance the quality of information sharing, we must
not lose sight of the obligations of all involved to protect the
personal information of Americans on impacted networks. I am glad that
Ms. Green is here to talk with us about these obligations. I also look
forward to talking with all the witnesses about what, from their
perspectives, DHS (and specifically the NCCIC) could be doing better.
Last year, Congress enacted legislation I authored to make sure DHS
is carrying out its diverse portfolio of cybersecurity responsibilities
in a strategic manner. In a couple of weeks, DHS should be transmitting
to Congress it's first-ever Department-wide cybersecurity strategy.
When we see the strategy, I may want to engage with you on your
thoughts.
Finally, while I recognize that the long-awaited Executive Order on
cybersecurity has not yet been issued, it would be good to hear your
thoughts on what we've seen so far from President Trump on
cybersecurity.
Mr. Ratcliffe. I thank the gentleman.
Other Members of the committee are reminded that opening
statements may be submitted for the record.
[The statements of Ranking Member Thompson and Honorable
Jackson Lee follow:]
Statement of Ranking Member Bennie G. Thompson
March 9, 2017
Cybersecurity is at the forefront of American politics in a way
that, in my 24 years in Congress, I have never seen. On this committee,
we regularly gather to hear from cybersecurity leaders on the most
pressing security vulnerabilities to our Nation and the novel ways our
enemies seek to exploit them. This past fall, details began to emerge
about an entirely new attack vector--a hacking campaign designed to
impact the Presidential election.
Even before the election, the Secretary of Homeland Security and
the Director of National Intelligence warned that Russian President
Vladimir Putin directed hackers to penetrate the email accounts of
high-ranking Democratic party officials to acquire information to be
used to embarrass and undermine the candidacy of Secretary Clinton.
The full scale of this state-sponsored hacking campaign is still
not fully known but what we do know is that in addition to hacking
private email accounts of prominent Democrats, the Russian hackers
tried infiltrate vital networks and equipment maintained by state
election authorities.
The Russian cyber campaign sought to strike at the heart of our
democracy. As such, legitimate questions about contacts between
President Trump's inner circle and associates of the Putin regime need
to be brought to light. That is why I support an independent 9/11-style
commission to investigate the Russian cyber campaign.
It has been disheartening to see President Trump display a somewhat
dismissive attitude about this very significant cyber attack, even as
DHS and its Federal partners work to raise the level of cyber awareness
and hygiene across the country.
I continue to be troubled by how long it took President Trump to
accept the facts presented by the intelligence committee about the
Russians orchestrating the hacking campaign. What seems to be lost on
this man who has repeatedly expressed support for our Government using
cyber offensive capabilities is that there can be no retribution
without attribution.
I am pleased that we have with us today representatives from
private sector that know a thing or two about the nature of the
evolving cyber threat and the importance of attribution.
I would like to also take a moment to welcome Robyn Greene who this
committee has come to count on for counsel when it comes the privacy
challenges associated with cyber information sharing. I look forward to
hearing from the panel on how DHS helps private entities secure their
networks against intrusion.
______
Statement of Honorable Sheila Jackson Lee
March 9, 2017
Chairman Ratcliffe and Ranking Member Richmond, thank you for
convening this opportunity for the Homeland Security Committee
Subcommittee on Cybersecurity & Infrastructure Protection on the topic
of ``The Current State of DHS Private Sector Engagement for
Cybersecurity.''
Today's hearing will give Members an opportunity to hear from
individuals outside the Government about how the Department of Homeland
Security (DHS) works with private entities to improve their network
security and contribute to the overall health of the cyber ecosystem.
I thank today's witnesses :
Daniel Nutkis, CEO, HITRUST Alliance
Scott Montgomery, V.P. and Chief Technical Strategist, Intel
Security Group, Intel Corporation
Jeffrey Greene, Senior Director, Global Government Affairs &
Policy, Symantec
Ryan Gillis, V.P. of Cybersecurity Strategy & Global Policy,
Palo Alto Networks
Robyn Greene, Policy Counsel & Government Affairs Lead, New
America--Open Technology Institute (Democratic Witness).
In the first few weeks of this Congress I introduced a number of
measures on the topic of cybersecurity to address gaps in our Nation's
cyber defensive posture:
SCOUTS Act--H.R. 940;
CAPITALS Act--H.R. 54;
SAFETI Act--H.R. 950;
Terrorism Prevention and Critical Infrastructure--H.R. 945;
and
Cybersecurity and Federal Workforce Enhancement Act--H.R.
935.
H.R. 940, the ``Securing Communications of Utilities from Terrorist
Threats'' or the ``SCOUTS Act,'' directs the Secretary of Homeland
Security, in coordination with the sector-specific agencies, to work
with critical infrastructure owners and operators and State, local,
Tribal, and territorial entities to seek voluntary participation on
ways that DHS can best defend against and recover from terrorist
attacks that could have a debilitating impact on National security,
economic stability, public health and safety, or any combination
thereof.
H.R. 940, is relevant to today's hearing because it addresses the
need for a two-way communication process that enables private-sector
participants in information-sharing arrangements with DHS to
communicate their views on the effectiveness of the information
provided; the method of information sharing; and their particular needs
as time passes.
Specifically the bill establishes voluntary listening opportunities
for sector-specific entities to communicate their challenges regarding
cybersecurity, including what needs they may have for critical
infrastructure protection; and how DHS is helping or not helping to
meet those needs.
The Society of Maintenance and Reliability Professionals have
endorsed H.R. 940, and input on the legislation included the Edison
Electric Institute, an electric utility association.
H.R. 54, the Department of Homeland Security's Cybersecurity Asset
Protection of Infrastructure under Terrorist Attack Logistical
Structure or CAPITALS Act, which directs the Department of Homeland
Security (DHS) to produce a report to Congress regarding the
feasibility of establishing a DHS Civilian Cyber Defense National
Resource.
H.R. 950, requires a report and assessment regarding Department of
Homeland Security's response to terrorist threats to Federal elections.
The Comptroller General of the United States is directed to conduct an
assessment of the effectiveness of Department of Homeland Security
actions to protect election systems from cyber attacks and to make
recommendations for improvements to the actions taken by DHS if
determined appropriate.
H.R. 935, The ``Cybersecurity and Federal Workforce Enhancement
Act'' identifies and trains people already in the work force who can
obtain the skills to address our Nation's deficit in the number of
workers and positions available for those with needed skills.
H.R. 940, the ``Securing Communications of Utilities from Terrorist
Threats'' or the ``SCOUTS Act,'' is the relevant to today's hearing
because this bill focuses on the communications sent by DHS to sector-
specific entities and the ability of these entities to communicate to
the agencies their perspective on the usefulness of the information;
the form of communication that would be most helpful; and requires a
report to Congress by DHS on the views of critical infrastructure
owners and operators on the information-sharing process related to
cybersecurity.
Later today I will be introducing the Prevent Zero Day Events Act,
which will help DHS in working with sector-specific entities to better
understand the detection of undiscovered or unreported vulnerabilities
in software and firmware that if exploited could pose a serious threat
to our Nation's power grid; telecommunications systems; financial
system; health care delivery; water supply or disrupt the ability of
Federal agencies to function.
I look forward to your testimony and the testimony of the second
panel for today's hearing.
Thank you.
Mr. Ratcliffe. We are pleased today to have a very
distinguished panel of witnesses before us on this vitally
important topic. Mr. Daniel Nutkis is the chief executive
officer of the HITRUST Alliance.
Dan, good to have you back before our committee.
Mr. Scott Montgomery is the vice president and chief
technical strategist at Intel Security Group.
We are glad to have you, Mr. Montgomery.
Mr. Jeff Greene is the senior director of global government
affairs and policy at Symantec.
Jeff, good to see you again. Thanks for being here.
Mr. Ryan Gillis is the vice president of cybersecurity
strategy and global policy at Palo Alto Networks.
Mr. Gillis. welcome and we look forward to your testimony
today.
Last but not least, Ms. Robyn Greene is the policy counsel
and government affairs lead of the Open Technology Institute at
New America.
Welcome back, Ms. Greene.
I would now like to ask the witnesses all to stand and
raise your right hand so that I can swear you in to testify.
[Witnesses sworn.]
Mr. Ratcliffe. Please let the record reflect that the
witnesses all answered in the affirmative. You may be seated.
The witnesses' full written statements will appear in the
record. The Chair now recognizes Mr. Nutkis for 5 minutes for
an opening statement.
STATEMENT OF DANIEL NUTKIS, CHIEF EXECUTIVE OFFICER, HITRUST
ALLIANCE
Mr. Nutkis. Good morning, Chairman Ratcliffe, Ranking
Member Richmond, and distinguished Members of the subcommittee.
I am pleased to appear today to discuss the health
industry's experiences in engaging with the Department of
Homeland Security relating to cyber information sharing and
other cyber initiatives, and a role we believe provides the
greatest benefit to industry.
For a little context for the subcommittee, for the last 10
years we have developed and updated a privacy and security
framework and risk management practices for the health care
industry, which were the most widely adopted. Five years ago,
we established the HITRUST CTX which is the health care
industry's most active and robust information sharing and
analysis organization, or ISAO.
While I prepared my written statement for the record, in my
testimony today I will highlight how HITRUST helps elevate the
industry's cyber awareness, improves cyber preparedness, and
strengthens the risk management posture of the health care
industry.
At today's hearing, I would like to highlight three
programs we have pioneered with industry that showcase the
positive efforts under way in collaboration with DHS, and then
speak to our concerns over Government's interference and
disregard for key industry cybersecurity efforts.
The first is the enhanced indicator of compromise program,
the second is the sector guidance for implementing the NIST
cybersecurity framework, and the third is the automated
indicator sharing with DHS. I will touch on each one of these
briefly.
A review in 2015 highlighted a number of gaps and
deficiencies in our cyber information sharing approaches and
led to the development of an enhanced criteria to improve the
collection and sharing of IOCs and maximize its benefits. The
net results is that the HITRUST CTX, which is part of our ISAO,
continues to improve on the number of unique IOCs it shares
across the health care industry, going from 186 unique IOCs in
September 2015 to over 5,100 in September 2016. Additionally,
there were substantial improvements in timeliness, accuracy,
and usability.
I reference this program to illustrate that the private
sector is willing to do its part in facilitating the collection
and dissemination of IOCs and other cyber threat information. I
see DHS as having a vital role in facilitating the collection
and dissemination of other information-sharing organizations in
a streamlined, secure, and efficient manner.
Last year, the Health and Public Health Sector Coordinating
Council and the Government Coordinating Council with input from
HITRUST and other sector members, including the DHS critical
infrastructure cyber community, developed the health sector
implementation guide for the NIST cybersecurity framework.
DHS was an integral partner and commenter during the
development of the sector guide. It should be noted that the
HPHSCC, which was formed under the DHS Critical Infrastructure
Sector Partnership Program, is an example of industry
innovation, leadership, and collaboration across the entire
industry on a number of topics relevant to critical
infrastructure, including cyber.
The HITRUST CTX is fully integrated with AIS and supports
bidirectional cyber threat indicator exchange to better aid
organizations in reducing their cyber risk. In fact, HITRUST
was the first non-Government entity connected to and sharing
cyber threat indicators with DHS AIS program. HITRUST believes
DHS acting as the hub for cyber information sharing benefits
the entire industry. Our engagement with DHS has been both
collaborative and productive.
Despite all the progress the public/private sector has made
in recent years, there are Government efforts underway to
undermine private-sector information-sharing programs and ISAOs
like that of HITRUST.
Even though CISA and the Executive Order made clear that
ISAOs would be established and enable private companies to
decide which ISAO to engage when sharing with DHS, there are
efforts to require health care organizations to only share
information directly with the Department of Health and Human
Services or their designated ISAO, an agency not even
identified in CISA's affording safe harbor liability
protections.
This is certainly troublesome and we find these efforts
alarming and are contrary to the original intent of CISA. We
recognize that there is a large role for Government to play in
supporting information sharing. The private sector should be
considered an equal party and the Government partners should
take a universal and consistent approach when engaging with
industry.
We recognize that each industry is unique with regards to
CTI sharing. In health care, they include health information,
organizational size, technical maturity, control systems,
medical devices, but that doesn't warrant interjecting another
intermediary and certainly not one that regulates, audits, and
has responsibility for imposing fines and other financial
penalties.
The market should drive innovation and Government should
promote the role of industry without changing the rules.
Thank you again for the opportunity to share these
insights. With that, Mr. Chairman, I am pleased to answer the
committee's questions.
[The prepared statement of Mr. Nutkis follows:]
Prepared Statement of Daniel Nutkis
March 9, 2017
Chairman Ratcliffe, Ranking Member Richmond, and distinguished
Members of the subcommittee, I am pleased to appear today to discuss
the health industry's experiences in engaging with the Department of
Homeland Security relating to cyber information sharing and other cyber
initiatives and the role we believe provides the greatest benefit to
industry. I am Daniel Nutkis, CEO and founder of the Health Information
Trust Alliance, or HITRUST. HITRUST was founded in 2007, after industry
recognized the need to formally and collaboratively address information
privacy and security for health care stakeholders representing all
segments of the industry and organizational sizes. HITRUST endeavored--
and continues to endeavor--to elevate the level of information
protection in the health care industry and those it collaborates with,
ensuring greater collaboration between industry and Government, raising
the competency level of information security professionals, while
maintaining trust with consumers and patients regarding their health
information, and promoting cyber resilience of industry organizations.
In my testimony today, I will highlight how HITRUST helps elevate
the industry's cyber awareness, improve cyber preparedness and
strengthen the risk management posture of the health care industry. In
particular, I will explain how programs like cyber information sharing,
cyber threat catalogues, and guidance on implementing the NIST
Cybersecurity Framework\1\ are integral to this process, as is the role
for the Department of Homeland Security.
---------------------------------------------------------------------------
\1\ https://www.us-cert.gov/ccubedvp.
---------------------------------------------------------------------------
In 2012, HITRUST established the HITRUST Cyber Threat XChange or
CTX, the health industry's Information Sharing and Analysis
Organization, or ISAO. The HITRUST CTX has consistently and effectively
enabled cyber information sharing across the entire industry and with
Government, while continuously evaluating and enhancing its services to
ensure better collection, analysis, and consumption of actionable cyber
threat information.
At today's hearing, I would like to highlight three programs we
have pioneered with industry that showcase the positive efforts under
way in collaboration with DHS and then speak to our concerns over
Government's interference, underperformance or disregard as to the
industry's cybersecurity efforts. Concerns, I anticipate this committee
and the new administration will share and appropriately address.
The first of the programs is the Enhanced Indicator of Compromise
(IOC) Program; second, is Sector Guidance for Implementing the NIST
Cybersecurity Framework; and third, is Automated Indicator Sharing with
DHS. I will touch on each one of these briefly.
enhanced indicator of compromise (ioc) program
Since it began an IOC-sharing program over 6 years ago, HITRUST has
been a leader in information sharing and continuously evaluates the
effectiveness of its cyber information-sharing program against stated
goals. A review in 2015 highlighted a number of gaps and deficiencies
in our cyber information-sharing approaches, and led to the development
of an Enhanced IOC criteria to improve the collection and sharing of
IOCs and maximize its benefits. These criteria defined specific
requirements in terms of completeness, timeliness, and accuracy of IOCs
contributed. We then established a pilot to evaluate the effectiveness
of this approach, which demonstrated significant improvements,
highlighted in the findings below:
1. During the pilot period, over 80% of the IOCs collected were
unique and not seen or known by any other open-source,
commercial, DHS CISCP, or user-contributed feeds available to
the HITRUST CTX.
2. The pilot group of eight organizations using Enhanced IOC
sharing reported 45% more IOCs than a comparable group of over
800 existing CTX participants using current sharing practices.
3. 100% of organizations reported IOCs to the HITRUST CTX compared
to only a small percentage of organizations--5%--that
contributed using current sharing practices during the same
period.
4. IOCs were reported to the HITRUST CTX on average 13.1 days
before being seen or identified by any other open-source,
commercial, DHS CISCP, or user-contributed feeds to the HITRUST
CTX. Some indicators were seen in the pilot program up to 123
days before being reported by other feeds.
5. IOCs were submitted in a matter of minutes to the HITRUST CTX
compared to an average of 7 weeks after detection using current
sharing practices.
6. 95% of the IOCs contributed to the HITRUST CTX had metadata
(e.g., malicious IPs, URLs or domains) that made them
actionable for use by others, which is defined as being useful
in allowing preventative or defensive action to be taken
without a significant risk of a false positive. Using current
sharing practices, only 50% of the IOCs contributed to the
HITRUST CTX were considered actionable.
The net result is that the HITRUST CTX continues to improve on the
number of unique IOCs it shares across health care organizations each
month--going from 186 unique IOCs in September 2015 to 5,158 in
September 2016.
In addition, the enhanced IOC pilot improved situational awareness
and predictive threat modeling with the ability to correlate IOCs and
Indicators of Attack (IOAs) between organizations, identify attack
patterns, and alert participants about IOCs and IOAs. These results are
positive with regards to mitigating cyber risk, but don't speak to the
investment required.
To better understand the return on investment, HITRUST is
undertaking a study to quantify the value of information sharing as a
tool in mitigating cyber risk, to aid organizations in prioritizing and
justifying their participation. We are undertaking an ROI study to
evaluate information sharing and the incremental benefits of leveraging
the Enhanced IOC criteria. We look forward to updating the committee on
the results of this study in the near future.
Another important finding is that threat information sharing does
not need to be limited to the largest organizations and that the
scalable sharing of IOCs can be achieved throughout health care
organizations of varying size, intelligence appetite, and the maturity
of an organization's security program. This was evaluated by
integrating the HITRUST CTX with the CyberAid program.\2\
---------------------------------------------------------------------------
\2\ HITRUST CyberAid is an example of enabling information sharing
with smaller organizations--https://hitrustalliance.net/documents/
cyberaid/CyberAidInfographicPresentation.pdf.
---------------------------------------------------------------------------
The results of the Enhanced IOC Collection Pilot indicate that
health care organizations can dramatically improve the timeliness,
completeness, usability, and volume of IOCs contributed to the HITRUST
CTX by implementing the enhanced IOC criteria. In response to these
findings, HITRUST is expanding the Enhanced IOC program and announced
enhancements to the CTX platform to aid organizations in reducing their
cyber risk.
I reference this program to illustrate that the private sector is
willing to do its part in facilitating the collection and dissemination
of IOCs and other cyber threat information (CTI), and sees DHS as
having a vital role in facilitating the collection and dissemination
from other information-sharing organizations in a streamlined and
efficient manner.
sector guidance for implementing the nist cybersecurity framework
Last year, the Health and Public Health Sector Coordinating Council
(SCC) and Government Coordinating Council (GCC), along with input from
HITRUST, and other sector members including the DHS Critical
Infrastructure Cyber Community (C3) developed the Health Sector
implementation guide for the NIST Cybersecurity Framework, specifically
referred to as ``Healthcare Sector Cybersecurity Framework
Implementation Guide.''
The Sector Guide supports implementation of a sound cybersecurity
program that addresses the five core function areas of the NIST
framework to ensure alignment with National standards, help
organizations assess and improve their level of cyber resiliency, and
provide suggestions on how to link cybersecurity with other information
security and privacy risk management activities in the Health Care
Sector. The Health Care Sector leverages the HITRUST risk management
framework, including the HITRUST CSF and CSF Assurance Program to
effectively provide the sector's implementation of the NIST
Cybersecurity Framework.
DHS was an integral partner and commenter during the development of
the Sector Guide. The HPH SCC, which was formed under the DHS Critical
Infrastructure Sector Partnership Program, is an example of industry
innovation, leadership, and collaboration across the entire industry on
a number of topics relevant to the protection of critical
infrastructure including cyber.
automated indicator sharing (ais)
The HITRUST CTX is fully integrated with AIS and supports bi-
directional cyber threat indicator exchange to better aid organizations
in reducing their cyber risk. In fact, HITRUST was the first non-
Government entity connected to and sharing cyber threat indicators with
the DHS AIS Program.
AIS has the potential to facilitate the sharing of crucial cyber
threat information from across organizations, corporations, and Federal
agencies in real time. Given the recent rise in cyber threats targeting
the health care industry, HITRUST believes bi-directional integration
into the AIS program will ensure relevant and timely CTI from HITRUST
and Government is available to all industries--ultimately bolstering
the overall cyber posture of the Nation's critical infrastructure.
Of note, HITRUST's role as an ISAO with strong industry engagement
enabled us to quickly and efficiently address any concerns regarding
the liability of sharing with Government. It was also our continued
evaluation and enhancements to our infrastructure with our technology
partners that enabled us to integrate with AIS and meet the future
needs of information sharing. Both the Cybersecurity Act of 2015 (CISA)
and Executive Order (EO) 13691 intended ISAOs to take up this role in
an effort to help move the private sector in the right direction and
enable them to robustly engage with Government. AIS integration
demonstrates that HITRUST, with its DHS partnership, continues to
evolve, improve, and lead by innovating and ensuring cyber threat
information sharing is providing the most value to the broadest group
of constituents while reducing overall cyber risk.
As a non-Governmental organization, sharing with AIS was not
without initial challenges, we did encounter some technical and
operational issues. They have since been addressed, but we would
encourage greater engagement by DHS with AIS participants to ensure
alignment with on-going and future requirements.
HITRUST is of the opinion that DHS--acting as the hub for cyber
information sharing--benefits the entire industry, and our engagement
with the DHS AIS has been both cooperative and very productive.
However, despite all the progress the public and private sectors
have made in recent years, as I referenced earlier, there are
Government efforts underway to undermine private-sector information-
sharing programs and ISAOs like that of HITRUST. Even though CISA and
the EO make clear that ISAOs would be established and enable private
companies to decide which ISAO to engage when sharing with DHS, there
are efforts under way that will deviate from this effort by requiring
health care organizations to only share information directly with the
Department of Health and Human Services--an agency not even identified
in CISA as affording safe harbor liability protections.
This is certainly troublesome, as we can all agree that CISA placed
DHS at the center of information sharing with the private and civilian
sector. HITRUST supported this effort enthusiastically and continues to
do so. In fact, as we have outlined in our testimony, we have invested
heavily in elevating our information-sharing capabilities to help
industry achieve the goal of working collaboratively with the
Government.
Since HITRUST has led the industry in the collection of IOCs
through the development of enhanced standards and collection practices,
and was the first health care organization to begin sharing bi-
directionally with DHS's AIS program, we find these efforts unnerving
as they are certainly contrary to the original intent of CISA and
Government's commitment to partner with industry through the ISAO
program.
HITRUST has always approached its role as an ISAO with the
entrepreneurial spirit of innovation and leadership. While we recognize
that there is a large role for Government to play in supporting
information sharing and ensuring liability protection, the private
sector should be considered an equal partner, and our Government
partners should take a universal and consistent approach when engaging
with industry.
We appreciate and recognize that each industry has unique dynamics
and challenges with regards to CTI sharing, in health care they include
organizational size, technical maturity, medical devices, and other
control systems, but that doesn't warrant interjecting another
intermediary and certainly not one that regulates and has
responsibility for fines and other financial penalties.
HITRUST was an early supporter of CISA and continues to support the
role of Government to foster transparency by establishing guidance,
clarifying roles and responsibilities, and encouraging industries and
segments to determine how to engage more extensively based on their
value and performance. The market should drive innovation and
Government should promote the role of industry without changing the
rules. We are seeing the opposite occur, and this was never the intent
of CISA or the Executive Order. CISA established a role for the private
sector around cyber information sharing, a role for ISAOs and
associated liability protections offered through DHS. Unfortunately
after supporting, committing, and engaging along that path, we find the
Department of Health and Human Services establishing guidelines and
approaches that are inconsistent and without appropriate consideration
and recognition of industry activities in support of CISA and the
Executive Order.
HITRUST, through its many programs, remains committed to ensuring
the health care industry can properly address these challenges. Cyber
information sharing is, and will continue to be, a key component in
HITRUST's approach to cybersecurity and cyber risk management, and we
are excited about pioneering these approaches. Information sharing is
only one tool that impacts risk management for an organization. HITRUST
continues to develop innovations such as the Health Care Sector
Cybersecurity Framework Implementation Guide, and enhance its security
and privacy framework and assurance programs. We value the partnership
of DHS in these efforts and look forward to their continued support.
Thank you again for the opportunity to join you today and share
these insights. I look forward to your questions.
Mr. Ratcliffe. Thank you, Mr. Nutkis.
Mr. Montgomery, you are recognized for 5 minutes.
STATEMENT OF SCOTT MONTGOMERY, VICE PRESIDENT AND CHIEF
TECHNICAL STRATEGIST, INTEL SECURITY GROUP, INTEL CORPORATION
Mr. Montgomery. Good afternoon, Chairman Ratcliffe, Ranking
Member Richmond, and Members of the subcommittee.
Thank you for the opportunity to testify today.
Intel is global leader in computing innovation, designing
and building the essential foundational technologies that
support the world's computing devices.
Governments, businesses, and consumers face a cybersecurity
threat landscape that is constantly evolving with each new
technology that is brought to market at a faster pace than ever
before.
The challenges we face are too significant for one company,
even as large as Intel Corporation, or entity to address on its
own. Real change on cybersecurity requires leadership from
Washington and a true public/private partnership with industry.
Our own contribution at the new McAfee, currently known as
Intel Security, is based on an open communication fabric that
will enable all of us in cybersecurity, both public and
private, to work together in ways never before thought
possible.
Cyber defense technologies' effectiveness, it peaks really
shortly after it is released and degrades very, very quickly
after its initial release. Actors take little notice, but once
the technology is deployed at scale, they adopt evasion
techniques and countermeasures, causing the effectiveness to
significantly degrade quickly.
This creates situations where defenders are creating dozens
of disparate tools to solve for micro conditions rather than
macro conditions.
Technology efficiencies are already declining by the time
the lengthy purchase and integration cycles are complete and
trained labor is insufficient to deal with the complexity of
supporting all these technologies. It is a strong collaboration
that plays a key role in how we go forward.
Mobile threats, migration to the cloud, and in particular,
the explosion of the number of internet-enabled devices,
commonly known as IOT, the Internet of Things, are going to
test and exacerbate the limits of our ability to work in real
time rather than assist them.
With respect to the partnership model, Intel and Intel
Security have been active in public/private partnerships
managed by DHS and other agencies for more than 10 years. We
have leadership roles in the President's National Security
Telecommunications Advisory Committee, also known as NSTAC, the
Information Technology Information Sector Coordinating Council,
Information Technology Information Sharing and Analysis Center,
National Cybersecurity Alliance, and the National Cybersecurity
Center of Excellence.
With respect to a few policy recommendations to improve
public/private partnerships, the first one is a move toward
more real-time sharing.
As we talked about a little bit earlier, the drive and the
number of devices, the drive and the number of internet-enabled
technologies is going to scale quickly past our ability to
encompass them in real time as workers. We need these
mechanisms to be automated.
With the passage of the Cybersecurity Information Sharing
Act, DHS was directed to deploy the Automated Indicator Sharing
Program. The program allows both the private and public sectors
to share indicators of compromise, but these indicators of
compromise are like breadcrumbs. It is only when you aggregate
them in the context that you see what the meal is. The sharing
of individual indicators of compromise without context leaves
practitioners asking more questions than having them answered.
Second, the NIST cybersecurity framework process should be
used as the model--the model--for public/private partnerships.
The framework for improving critical infrastructure security,
known as the NIST cybersecurity framework, is widely
acknowledged as a highly successful model of public/private
partnership.
Here is our analysis of why. The need was real, the process
was open, NIST listened more than they talked. They were
prepared. They engaged stakeholders of a variety of different
sizes, of a variety of different financial investments, in a
variety of different sectors, both public and private.
The framework was voluntary, not regulatory. Very, very
important for private organizations to particulate.
Then last, we would like to seek innovative ways to further
grow the information-sharing ecosystem. When we share, for
example, with the Cyber Threat Alliance, including Check Point,
Cisco, Fortinet, Palo Alto, and Symantec, my erstwhile comrades
on the panel, the point of it was to share faster than we could
learn ourselves. It is for the whole to be greater than the sum
of the individualized parts.
Examples of successes include cracking the code on
CryptoWall version 3, one of the most lucrative ransomware
families in the world, totaling more than $325 million
ransomed.
Our disruption of the CryptoWall forced criminals to
develop a CryptoWall 4, which we uncovered quickly and it
resulted in a much less successful attack, a prime example of
where the whole was greater than the sum of the individual
vendor parts.
Given that the rapid change continues, public and private-
sector organizations cannot go it alone. We look for the
encouragement of DHS and their participation in helping us
drive to greater wholes and less individual parts.
Thank you. I look forward to your questions.
[The prepared statement of Mr. Montgomery follows:]
Prepared Statement of Scott Montgomery
March 9, 2017
Good afternoon, Chairman Ratcliffe, Ranking Member Richmond, and
Members of the subcommittee. Thank you for the opportunity to testify
today. I am Scott Montgomery, vice president and chief technical
strategist, Intel Security Group, part of Intel Corporation.
I am pleased to address the subcommittee on the value and
effectiveness of current private-sector engagement with the Department
of Homeland Security (DHS) given its importance in helping DHS achieve
its mission of enhancing the security, resilience, and reliability of
the Nation's cyber and communications infrastructure. My testimony will
address Intel Security's commitment to cybersecurity, our assessment of
the global threat environment, the state of various DHS public-private
partnerships and private-sector partnership innovation. Finally, I will
make a number of public policy suggestions to help the new
administration shore up the capabilities and effectiveness of DHS
public-private partnerships.
First, I would like to provide some background on my experience and
Intel's commitment to cybersecurity. I work for the Intel Security
Group Chief Technology Officer (CTO) and manage the world-wide team of
experts that carry CTO titles. Together we drive the company's
technical innovation; evangelize our expertise, thought leadership, and
offerings to public and individual audiences; and work to increase the
public trust by cooperating with law enforcement on cyber criminal
investigations and disruption. With more than 20 years in content and
network security, I bring a practitioner's perspective to the art and
science of cybersecurity. I have designed, built, tested, and certified
information security and privacy solutions for such companies as
McAfee, Secure Computing, and a wide variety of public-sector
organizations.
intel security's commitment to cybersecurity
Intel is a global leader in computing innovation, designing and
building the essential foundational technologies that support the
world's computing devices. Combining Intel's decades-long computing
design and manufacturing experience with Intel Security's market-
leading cybersecurity solutions, Intel Security brings a unique
understanding of the cybersecurity challenges threatening our Nation's
digital infrastructure and global e-commerce. Governments, businesses,
and consumers face a cybersecurity threat landscape that is constantly
evolving with each new technology that is brought to market at a faster
pace than ever before. The sharp rise of internet-enabled devices
(known as ``Internet of Things'' or ``IoT'') in Government, industry,
and the home exacerbates this already difficult challenge. The
challenges we face are too significant for one company or entity to
address on its own. Real change on cybersecurity requires leadership
from Washington, DC, and a true public-private partnership with
industry.
Collaboration will be the driving force behind what soon will be
the new McAfee (currently known as Intel Security)--planned to be a
stand-alone company this year. It's also why we recently announced a
whole new ecosystem of integrated platforms, automated workflows, and
orchestrated systems based on an open communications fabric that will
enable all of us in cybersecurity to work together in ways never before
thought possible.
To be successful, it is important to understand the market-like
forces that drive the effectiveness of cybersecurity defense. Most
information technologies continuously improve over time. Paradoxically,
cyber defense technologies do not follow this pattern. Their
effectiveness peaks shortly after release and then degrades. When a new
defensive capability is first released, bad actors take little notice,
but once deployed at scale, they adopt evasion tactics and counter-
measures, causing the effectiveness to significantly degrade.
Where does that leave us? We see the current paradigm of constant
integration of point products--individual software applications--as
ineffective and unsustainable. Not only are technology efficiencies
already declining by the time the lengthy purchase and integration
cycles are complete, but organizations are unable to deal with the
complexity of supporting upwards of 30 to 40 independent tools and
technologies. That's a losing game, but it's the one security
practitioners find themselves playing.
We need a different approach where technology--enabled with strong
collaboration--can be deployed rapidly to security platforms so they
can communicate with each other over open communication protocols. Such
technology can be guided by the strategic intellect that only humans
can provide. Thus, the only way to have a winning cybersecurity
strategy is to bring technology, the cybersecurity industry, and the
efforts between Government and the private sector together. This is
what real collaboration is all about.
As we collaborate with our public partners, it's important to
highlight how the threat landscape has changed over the years. It's a
top-tier issue for Government leaders because of the critical role IT
systems play in our National security, economy, and daily lives.
the interconnected threat landscape
Increasing Sophistication of Attackers Threatens Organizations of Every
Size
The threat landscape is ever-changing, and it's getting only more
complex with the sharp rise in internet-enabled devices (IoT) and
industry's shift to new computing paradigms such as cloud computing.
What we call the ``attack surface'' continues to grow. This means that
organizations--and more importantly, individuals--are now more
vulnerable in more places. Adversaries are increasingly capable of
attacking strategic assets and critical infrastructure. Traditional
platforms such as phones, tablets, laptops, and servers continue to be
high-value targets, but we must expand our thinking to include all
devices that are ``smart'' and connected. Modern computing runs our
factories, flies our planes, drives our cars, and runs our homes.
Almost every aspect of what our country runs on is potentially
vulnerable to a cyber attack.
The attacker community has matured enough to support a vibrant
criminal underground economy. On-line web stores on the ``Dark Web''
now sell hacking tools to any would-be attacker, and on-line markets
make it easy and efficient to sell stolen credit card and other
personal information. Attackers are also busy developing new techniques
that are substantially more difficult to detect and stop, setting their
sights beyond the operating system or applications and instead focusing
on the underlying virtual machines, firmware, and hardware. The growing
sophistication of these tools and methods of attack has unsurprisingly
placed a tremendous amount of pressure on today's security processes,
tools, and people.
Innovative Technologies Bridge Resource Gaps for Public and Private-
Sector Organizations, but also Magnify Threats
It should come as no surprise that cyber criminals closely follow
the latest technology trends because that's where the targets are the
most promising. Technological innovations can help organizations
deliver better overall security and operations but can simultaneously
expose new avenues for attack, such as:
Mobile Threats.--All organizations are relying more on mobile
devices to improve communication and business processes, and this trend
will undoubtedly continue. At the same time, malware written
specifically to attack mobile devices is proliferating, creating new
challenges as organizations attempt to secure mobile as well as
traditional computing platforms.
Migration to the Cloud.--Organizations can reduce costs, improve
offerings, eliminate complexity, and reduce reliance on on-site
technical staff by outsourcing their IT and communications systems to
the cloud. At the same time, however, they must be careful not to
sacrifice security to achieve these new efficiencies.
IoT and the Explosion in Number of Devices.--The exponential
increase of Internet-enabled and networked devices known as the
Internet of Things (IoT) is expanding both risks and rewards.
Organizations are using networked metering devices, sensors,
appliances, and point-of-sale systems to deliver better customer
service and streamline business processes, but must also be aware that
many IoT devices were not designed with security in mind and could
introduce unnecessary risk to vital IT networks and systems.
Bring Your Own Device (BYOD) Environments.--Given the mobile nature
of today's workforce, as well as the increasing use of BYOD programs,
employees at companies of all sizes commonly access organizational
resources from external networks such as hotspots and home networks.
The result is often that company-owned network equipment will be simply
unable to inspect the growing amount of traffic and devices connected
to internal IT networks.
Performance Issues Preempt Security.--Customers are increasingly
choosing to forego bulkier security features like firewalls in favor of
maximizing network performance levels, creating a tug-of-war between
security and performance priorities.
Adversaries Enjoy Significant Advantages.--Our research and
analysis reveals that cyber adversaries benefit from and exploit
several key advantages, including:
The ability to enhance the tools and capabilities used in an
attack quickly through a community of innovators and service
providers. This has an outsized impact on small organizations,
who may not have the resources to deploy the latest adaptive
technologies, or are not deploying risk management-based
solutions at all.
A working knowledge of how organizations implement defenses,
including knowledge of specific product deployment models,
industry architectures and even specific vulnerabilities. While
an attacker only has to be right once, organizations must be
impenetrable 100 percent of the time--a statistic that is
unrealistic even for the most well-resourced security vendors
or large corporations.
intel security's view of public-private partnerships
Our Commitment to the Partnership Model
Given the current cybersecurity threat environment, organizations
across the spectrum cannot manage their protective defenses alone.
Security is a shared goal carrying a shared responsibility. As a
result, the strategic partnerships that have grown between public and
private-sector entities over the last two decades have never been more
important.
At a National level, critical industry sectors supporting the
safety, security, and economic growth of the United States were among
the first to self-organize in partnership with Government agencies to
assess and mitigate threats to U.S. critical infrastructure. These
public-private partnerships are fueled by a joint commitment to defend
critical infrastructures against increasingly sophisticated cyber
attacks, and they thrive on sharing threat indicators, best practices,
and incident response in a mutual, non-regulatory environment.
Intel and Intel Security have been active in public-private
partnerships managed by DHS and other agencies for more than 10 years.
We have leadership roles in the President's National Security
Telecommunications Advisory Committee (NSTAC), Information Technology
Information Sector Coordinating Council, Information Technology
Information Sharing and Analysis Center, National Cyber Security
Alliance, and National Cybersecurity Center of Excellence (NCCoE).
Through these partnerships, Intel Security works to provide hardware,
software, and training to advance the rapid adoption of secure
technologies around the country. In addition, we remain actively
engaged in the development of new cybersecurity guidelines to help
public and private-sector organizations evaluate their security
postures and conduct risk assessments, regardless of size or
sophistication.
As these partnerships grow and mature, our company will continue to
invest, engage, and contribute. The challenge is never-ending, but we
have no doubt the public-private partnership model will continue to
protect and serve our National interests well into the future. However,
public-private partnerships, as any partnership, benefit from regular
reviews, gap analyses, and a commitment to continual improvement.
Policy Recommendations to Improve Public-Private Partnerships
1. Move to Real-Time Threat Information Sharing
The administration needs to solidify its information-sharing
strategy. Sharing threat information has been a necessity since I
started in cybersecurity, yet we still are not focused on sharing
threat information that will provide real benefits in a meaningful way.
With the passage of the Cybersecurity Information Sharing Act (CISA),
DHS was directed to deploy the Automated Indicator Sharing (AIS)
program. This program allows both the private and public sectors to
share indicators of compromise (IOC) and mitigation with each other.
CISA also does an admirable job of requiring companies and Government
agencies to strip out personal identifiable information (PII) and put
in place thoughtful processes and policies to protect citizen privacy.
While the overall program has been a strong step in the right
direction, it still provides far too little real value. IOCs are just
the breadcrumbs that network security staff look for to uncover clues
as to what may be occurring inside their organizations. Typical IOCs
are registry keys, MD5 hashes of potential malware, IP addresses, virus
signatures, unusual DNS requests, URLs, etc. While these can be useful,
they are really not enough to provide the defensive information needed
to protect an organization. Today, AIS does not provide a means for
enriching the information it shares. It simply shares minimal IOC
information.
To defend our institutions properly, defenders need to understand
cybersecurity threats and their components as a whole. Indicators,
incidents, tactics, techniques, and procedures used, threat actors,
associated campaigns, what is being targeted, malicious tools being
used, software vulnerabilities being exploited, courses of action to
mitigate the threat, are all components of a cyber threat that need to
be understood. Instead of trying to share simple breadcrumbs, we need
to be sharing with a focus on providing a platform for enriching
specific threat information so we can see and understand more about the
threat.
Often one company may discover an IOC, another may be able to
associate it with a specific vulnerability, and still another may be
able to provide a correlation between the known threat items and a past
or similar attack that could lead to a potential remediation, thus
mitigating the threat. Today we have no way to share enriched threat
data effectively. We need information sharing with a focus on enhancing
our abilities to protect our organizations. The administration should
double down on working with the private sector to further evolve the
way cyber threat information is represented, enriched, and distributed
in a timely fashion. Cyber criminals are excellent at information
sharing; the Government and private sectors must be as well.
2. Encourage Full Utilization of and Update Government
Procurement Rules to Enable DHS to Compete with
Hackers
There are significant gaps at DHS that preclude it from competing
with hackers, cyber criminals, and other bad actors who innovate and
share information quickly, often using state-of-the-art technology.
Thus, it is critical that DHS and other Federal agencies have access to
the same tools. This can only be achieved by encouraging full use of
current procurement rules, and by looking for opportunities to update
those rules where necessary. Currently, there are five ways Federal
agencies can acquire products and services rapidly:
Under the Federal Acquisition Streamlining Act of 1994
(FASA), Congress mandated, to the maximum extent practicable,
the use of simplified acquisition procedures (SAPs) for
products and services not exceeding the simplified acquisition
threshold.
The Competition in Contracting Act of 1984 (CICA) allows
Federal agencies to accelerate the acquisition process where
there is an urgent need, or where requiring full and open
competition could compromise National security.
The U.S. General Services Administration (GSA) maintains a
supply schedule for information technology (Schedule 70), where
pre-vetted vendors with pre-negotiated terms offer
cybersecurity products.
Congress authorized the Continuous Diagnostics and
Mitigation (CDM) program at DHS, which allows Federal agencies
to expand their CDM capabilities through the acquisition of
commercial off-the-shelf tools, with robust terms for technical
modernization as threats change.
Congress has granted 11 agencies (including DHS) the ability
to enter into ``other transaction agreements,'' which generally
do not follow a standard format or include terms and conditions
normally found in contracts or grants, in order to meet project
requirements and mission needs.
In addition to encouraging Federal agencies to fully use these
procedures, procurement policy and acquisition procedures must evolve
more rapidly to match the pace of information technology development
and adoption by hackers, criminals, and other bad actors. Currently,
little guidance exists in the Federal Acquisition Regulations (FAR)
regarding the procurement of cybersecurity technology; rather, the FAR
leaves cybersecurity implementation to each individual Federal agency.
Agency officials and contractors must consult a myriad of different
agency regulations to ascertain if and how other agencies have
implemented their acquisition regulations regarding cybersecurity. This
diversity in agency cybersecurity regulations undermines security
requirements and policies governing Federal procurements. Harmonizing
cybersecurity acquisition requirements would allow agencies to: (i)
Target security to highest-priority data and threats; (ii) obtain
greater value through reduced compliance obligations and increased
contractor focus on high-value cybersecurity investments; and (iii)
enhance agency cybersecurity through the adoption of best practices,
tempered through public review and comment.
3. Create Additional Incentives to Participate in
Information-Sharing Partnerships
A critical provision of CISA is that it gives liability protections
to private companies that share cyber threat information (CTI) and
defense measures (DM) on a voluntary basis with DHS. Recent guidance
from DHS on CISA clarifies that private entities also receive liability
protection under section 106(b)(1) for sharing CTI and DM information
with other private entities. Policy makers have done an admirable job
of using the incentive of liability protections, and relaxing antitrust
rules, to help incent broad-based information sharing between the
private sector and the Government, and among private-sector entities.
However, too few companies are actively sharing threat information with
DHS and among themselves to fully realize the aim of CISA--a high-
functioning eco-system of information sharing that enables the public
and private sectors to compete with global networks of sophisticated
hackers.
We need to recognize the disincentive that threat intelligence's
``free rider'' problem has imposed on public and private-sector
information sharing. Every organization benefits from consuming threat
intelligence but gains no direct value from providing it unless the
right organizational structure and incentives are put in place to
eliminate the free rider problem.
While DHS has made progress, it still needs to improve the quality
and the quantity of the threat data it shares with the private sector
to address this issue of the free rider. DHS should thus declassify
larger categories of threat data and actively share them with the
private sector. DHS should issue many more security clearances to
qualified company representatives to enable access to the most
sensitive, and potentially most valuable, pieces or classes of threat
data.
Finally, the new administration should pass into law The Cyber
Information Sharing Tax Credit Act--sponsored by Senators Moran and
Gillibrand--that would incentivize businesses of all sizes to join
sector-specific information-sharing organizations, known as Information
Sharing and Analysis Centers (ISACs), by providing refundable tax
credits for all costs associated with joining ISACs. The effort should
not just focus on ISACs but should also include Information Sharing and
Analysis Organizations (ISAO) as well. ISAOs are not limited to
individual critical infrastructure sectors as ISACs are, and they allow
diverse organizations to share cyber-related threat information.
4. Use the NIST Cybersecurity Framework Process as a Model
for Public-Private Partnerships
The Framework for Improving Critical Infrastructure Cybersecurity,
known as the NIST Cybersecurity Framework, is widely acknowledged as a
highly successful model of public-private partnership. The Office of
Management and Budget is already working to encourage Federal agencies
to adopt the Framework, the new administration's draft Executive Order
mandates Government agencies to deploy the Framework, and the private
sector is rapidly adopting it. Here's our analysis of why:
The need was real;
The process was open;
NIST listened first;
They were prepared;
They engaged all stakeholders;
The framework was voluntary--not regulatory.
I'd like to expand on each of these aspects, not simply to
compliment NIST but to offer the process as a model for future public-
private partnerships.
The need was real
PPPs created around a topic or issue that is real to both the
public and the private sectors has a much better chance of getting the
exposure and participation needed to achieve the goal of the
partnership. In the case of the Cybersecurity Framework, it was obvious
to both groups that the need existed. While NIST had a hard time frame
to be successful in--1 year--they had a long history in risk management
and understood the need well. For too long regulatory compliance had
forced industry to spend valuable security dollars to prove something
to the regulators instead of using those resources to help protect
enterprises. The cost of compliance was impacting our ability to secure
ourselves.
Openness of the process
From the very beginning, NIST made it clear this was going to be a
very open process. In the initial meeting, NIST staff described what
would be occurring, from the RFI-submitted comments being made public
on a NIST project website, to the anticipated workshop process and
general time line for various milestones. Along the way, NIST staff
were quick to ensure that industry participants understood what was
happening so there would be no surprises. This created a growing sense
of trust as the effort evolved and made the process more effective
during the development of the Framework.
Listening
One of the more interesting and effective parts of the development
was the way NIST staff listened to the workshop participants. They used
a moderated dialog approach that allowed all attendees to voice their
opinions to a set of topics the NIST staff wanted to learn about. There
were very active discussions that were highly informative from members
of various sectors and industries. Dr. Gallagher, NIST's Director at
the time, stated quite clearly this was not NIST's Framework; this was
the community's Framework. Having the public side of a public-private
partnership listen instead of dictate allowed private-sector
participants to voice their opinions in a much more open and direct
way. This too built trust as the effort went along.
Being prepared
Each of the workshops seemed very well organized, and the topics,
panels, questions and outcomes were well thought-out before each
workshop began. This gave participants reassurance their time was being
well spent. Open forums with no direction or planning do not give those
involved much confidence the effort will succeed. Being prepared also
meant participants needed to do their homework as well. While not
always the case, as the workshops advanced, they did so.
Engaging all
One of the smartest things NIST did as part of the Framework
development process was to understand they needed to get outside the
Beltway for the effort to be successful. They held the workshops in
different locations around the country so the local owner/operators of
the critical infrastructure could have their voices heard. This ensured
there was a diverse group at each of the workshops and all were able to
participate. The processes used during the workshops encouraged all in
the room to contribute and they did. A highly interactive,
collaborative environment is one where real dialog can occur and
produce positive results.
Voluntary, non-regulatory nature
The fact that NIST is a non-regulatory body also helped their
credibility and the private sector's attitude toward participating and
contributing. This was a topic area that had a lot of people concerned
initially, but as the effort progressed, more and more private-sector
participants relaxed and believed in the voluntary intent of the
effort. NIST also made it clear in each workshop that they were
requiring a non-attribution from any and all regulators in the room.
Each agreed to the rules, making it much more comfortable for real open
and honest dialog to occur.
While others have tried to copy the NIST success, often they have
left out one or more of the characteristics that made the Cybersecurity
Framework effort a success. In reality, both the public and the
private-sector participants must buy in. To do so requires trust in the
process, the effort and the vision for the outcome to be successful
5. Seek Innovative Ways to Further Grow the Information-
Sharing Eco-System
Company-to-company information sharing is growing in certain parts
of the economy. An example is the Cyber Threat Alliance (CTA). Intel
Security, along with Check Point, Cisco, Fortinet, Palo Alto Networks
and Symantec, worked together to start and build the CTA. This is a
group of cybersecurity practitioners from organizations that have
chosen to work together in good faith to share threat information for
the purpose of improving defenses against advanced cyber adversaries
across member organizations and their customers. The key to the success
of this effort is that each organization must supply threat information
to all the members in order to receive threat information. This allows
each of the member organizations to incorporate the others' threat
information into their products' protection mechanisms. This is an
example of valuable and actionable shared threat information having a
direct and positive impact on improving their customers' environments.
The member organizations have decided to participate in the Alliance
for the betterment of the ecosystem they serve.
The CTA is also showing that with the right organizational
construction--with the right incentives to collaborate--real progress
in private-sector information sharing can be made. Examples of
successes include cracking the code on Crypto Wall version 3, one of
the most lucrative ransomware families in the world, totaling more than
US$325 million ransomed. CTA's disruption of Crypto Wall 3 forced
cybercriminals to develop Crypto Wall version 4, which the CTA also
uncovered and resulted in a much less successful attack. This is a
prime example where creating an operationally holistic view of the
threat and how to address it has had an extremely positive impact on
our ability to protect ourselves.
To further incentivize companies to share threat information among
themselves, policymakers should amend The Cyber Information Sharing Tax
Credit Act. Such an incentive would help speed the growth of existing
private sector-to-private sector information-sharing coalitions and
help start news ones, particularly in some sectors of the economy that
have been slow to realize the benefits of sharing threat information
with partners and competitors.
conclusion
Given the rapidly-changing threat environment, public and private-
sector organizations cannot go it alone. The challenge is never-ending,
but I have no doubt that the public-private partnership model will
continue to protect and serve our National interests well into the
future. Public-private partnerships benefit from regular reviews, gap
analysis, and a commitment to continual improvement. The subcommittee
should be commended for taking such a thoughtful approach to reviewing
the successes and challenges of DHS-managed public-private
partnerships.
As stated earlier, DHS deserves much praise. It manages a thriving
number of public-private partnerships that serve the National interest.
At the same time, real-time information sharing needs to be implemented
on a grand scale, IT procurement rules should be updated, DHS
partnerships need to be benchmarked against other successful ones on a
regular basis and additional incentives should put in place to help
grow the information-sharing eco-system. Intel Security--soon to become
McAfee--is committed to continue to invest, engage, and contribute to
support the long-term success of the partnership model. Our collective
security depends on making the promise of ``together is power'' a
reality.
Mr. Ratcliffe. Thank you, Mr. Montgomery.
Mr. Greene, you are recognized for 5 minutes.
STATEMENT OF JEFFREY GREENE, SENIOR DIRECTOR, GLOBAL GOVERNMENT
AFFAIRS AND POLICY, SYMANTEC
Mr. Jeffrey Greene. Thank you. Chairman Ratcliffe, Ranking
Member Richmond, Members of the committee, thank you for the
opportunity to testify today.
As Mr. Montgomery mentioned, the threat landscape is
constantly evolving. In the current situation, there is no
company or no government that can go it alone. We are therefore
pleased to see your continued focus on how DHS can work with
the private sector in new and innovative ways.
I want to start by talking briefly about the current cyber
threat environment. You will see a lot of headlines about cyber
attacks focused on massive data breaches or cyber espionage,
but it is important not to lose sight of the other types of
attacks that can have major consequences.
The incidents we see today range from increasingly
sophisticated forms of ransomware, in particular ransomware
being targeted at the enterprise as opposed to the individual,
to massive distributed denial-of-service attacks, DDoS attacks,
that were launched from connected or internet-of-things, IOT,
devices.
We at Symantec have a long-standing relationship with DHS.
From our perspective, the Department has made significant
progress engaging with the private sector over the past few
years.
The Cyber Information Sharing and Collaboration Program, or
CISCP, allows participants to share information about
incidents, cyber threats, and known vulnerabilities.
One example I would point to is last October we shared
research from a group that we had discovered that was trying to
steal money from banks by exploiting the SWIFT messaging
system. This is the same attack that was used to steal $81
million from the Bangladesh central bank.
CISCP managers took the information that we provided,
developed an indicator bulletin, and pushed that out to all
CISCP participants.
CISCP also convenes practitioners at quarterly advanced
technical threat exchanges. For the most part, we have found
the exchanges useful. Last year, we did a presentation at one
of them focused on new and emerging ransomware. Included in
this presentation was in-depth analysis and specific indicators
of compromise that were then available to all participants to
use to try to upgrade their systems if necessary.
But also beyond the technical information that is shared,
these are opportunities for Government and industry to sit down
face-to-face, develop trusted relationships, both between
Government and the private sector and also within the private
sector itself.
Many of DHS's reports and bulletins include substantive
analysis and actionable information, but at times some do fall
short. In some cases, reports have included indicators of
compromise that were not fully vetted or, as Mr. Montgomery
mentioned, didn't have the context around them. Sometimes some
private-sector companies have used these without proper
research on their end, and there has been in a couple of
instances a high degree of false positives based on them.
To DHS's credit, though, when that has happened they have
been responsive to industry concerns and at times have issued
revised reports.
As DHS moves to machine-speed sharing through the Automated
Indicator Sharing Program, the need for context and vigorous
vetting is just going to grow. This is going to put something
of a burden on DHS and its partner agencies because, on the one
hand, they are being told to share more and to share faster,
but on the other hand they are being told to be very careful
about what you share and vet it before you do so. So this is a
balance that is not easy to strike and it is going to require
constant tuning.
We also engage with DHS informally. An example, last week
we had 10 of DHS's cyber analysts out at our operations center
in Herndon to discuss a few specific threats. Face-to-face
meetings like this can alleviate another concern that you may
have heard that too often the information flow is one way just
from the private sector to the Government. In-person
discussions can lead to a more complete and bilateral exchange
of ideas.
In addition to DHS, we work with the FBI and other agencies
to assist efforts to fight cyber crime and take down botnets.
There is more information in our written testimony, but I do
want to highlight one case. This is our work on unearthing an
international criminal gang that was called Bayrob.
Bayrob evolved over a decade. We spent a year tracking them
and, in part based on the information we provided to the FBI,
they built a case that led to the arrest and extradition from
Romania of three of Bayrob's key actors. So I think we need to
consider broader than just DHS and how DHS works with other
agencies as well.
Finally, the partnership among private-sector companies is
alive and well. As Mr. Montgomery mentioned and Mr. Gillis may
discuss, we are part of what is called the Cyber Threat
Alliance that shows how even competitors can work together to
improve the overall safety and security of the internet and
that of our customers.
As Members of this committee know better than most, we
still face significant challenges in our efforts to improve
cybersecurity and to fight cyber crime. Cybersecurity is first
and foremost a team sport, and at Symantec we are committed to
improving the internet security and will continue to work with
industry and Government collaboratively on ways to do so.
Thanks again for the opportunity to be here. I am happy to
take any questions.
[The prepared statement of Mr. Greene follows:]
Prepared Statement of Jeffrey Greene
March 9, 2017
Chairman Ratcliffe, Ranking Member Richmond, and Members of the
committee, my name is Jeff Greene and I am the senior director, global
government affairs and policy at Symantec. I am responsible for
Symantec's global public policy agenda and Government engagement
strategy, and represent the company in key public policy initiatives
and partnerships. I also serve as a member of the National Institute of
Standards and Technology's (NIST) Information Security and Privacy
Advisory Board (ISPAB), and recently supported the President's
Commission on Enhancing National Cybersecurity. Prior to joining
Symantec, I served as senior counsel with the U.S. Senate Homeland
Security and Governmental Affairs Committee, where I focused on
cybersecurity and homeland defense issues.
Symantec Corporation is the world's leading cybersecurity company.
We help organizations, governments, and people secure their most
important data wherever it resides. Organizations across the world look
to Symantec for strategic, integrated solutions to defend against
sophisticated attacks across endpoints, cloud, and infrastructure.
Likewise, a global community of more than 50 million people and
families rely on our Norton and LifeLock product suites to protect
their digital lives at home and across their devices. Symantec operates
one of the world's largest civilian cyber intelligence networks,
allowing us to see and protect against the most advanced threats. We
maintain nine Security Response Centers and six Security Operations
Centers around the globe and every day we scan 30 percent of the
world's enterprise email traffic and process more than 1.8 billion web
requests. All of these resources combined allow us to capture world-
wide security data that give our analysts a unique view of the cyber
threat landscape.
No government or company can go it alone in this environment, and
we are happy to see the subcommittee focusing on how the private sector
engages with DHS and other government agencies to help defend against
growing cyber threats. Lasting improvements in cybersecurity require
the combined efforts of Government and industry together. In my
testimony today, I will discuss:
The current and emerging threat landscape;
DHS and Private-Sector Engagement; and
How we partner with our industry counterparts to stop cyber
attacks.
i. the current and emerging cyber threat landscape
Many of the recent headlines about cyber attacks have focused on
massive data breaches and cyber espionage across the spectrum of
industries and governments. These headlines remind us that no
organization or government entity is impervious when targeted by a
motivated and skilled attacker. Yet while the focus on data breaches
and the personal information exposed is certainly warranted, we also
must not lose sight of the other types of cyber attacks that are
equally concerning and that can have damaging consequences. There is a
wide set of tools available to the cyber attacker, and the incidents we
see today include increasingly sophisticated forms of ransomware,
massive distributed denial of service (DDoS) attacks by ``Internet of
Things'' (IoT) devices, sophisticated (and potentially destructive)
intrusions into critical infrastructure systems, and the weaponization
of personal information. The economic impact to an organization can be
immediate, through the theft of money or the payment of ransom, or more
long-term and structural, such as through the theft of intellectual
property. It can ruin a company or individual's reputation or finances,
and it can impact citizens' trust in the internet and their Government.
The attackers run the gamut and include highly-organized criminal
enterprises, nation-states, disgruntled employees, individual cyber
criminals, so-called ``hacktivists,'' and state-sponsored groups. The
motivations vary--criminals generally are looking for some type of
financial gain, hacktivists are seeking to promote or advance some
cause, and state actors can be engaged in espionage (traditional
spycraft or economic) or infiltrating critical infrastructure systems.
These lines, however, are not set in stone, as criminals and even state
actors might pose as hacktivists, and criminals often offer their
skills to the highest bidder.
Attack methods vary, and the only constant is that the techniques
are always evolving and improving. Spear phishing, or customized,
targeted emails containing malware or malicious links, is the most
common form of attack. Many of these attacks are extremely well-
crafted; in the case of one major attack, the spear-phishing email was
so convincing that even though the victim's system automatically routed
it to junk mail, he retrieved it and opened it--and exposed his company
to a major breach. Social media is an increasingly valuable tool to
criminals as people tend to trust links and postings that appear to
come from a friend's social media feed and rarely stop to wonder if
that feed may have been compromised or spoofed. We have also seen the
rapid growth of targeted web-based attacks, known as a ``watering
hole'' attack. Like the lion in the wild who stalks a watering hole for
unsuspecting prey, cyber criminals lie in wait on legitimate websites
that they compromise and use to try to infect visitors. Most of these
attacks rely on social engineering--simply put, trying to trick people
into doing something that they would never do if fully cognizant of
their actions. For this reason, we often say that the most successful
attacks are as much psychological as they are technological.
One particularly concerning trend is the recent use of IoT devices
in DDoS attacks. By taking advantage of poor security and design
practices, criminals were able to compromise hundreds of thousands, if
not millions, of devices and aggregate them as a single army of zombie
devices--the world's first major IoT botnet, known as Mirai. In October
2016, cyber criminals used the Mirai botnet to launch a massive DDoS
Attack on DNS provider Dyn, which disrupted some of the internet's
biggest websites, including Spotify, Twitter, PayPal, Reddit, and
others. Mirai's ``bots'' were primarily compromised webcams and digital
video recorders, but also included routers and other internet-connected
devices. This attack was quickly followed by at least two others, each
record-breaking in its size.
How did these IoT-based attacks happen? Very easily, unfortunately.
The average IoT device is scanned for vulnerabilities just 2 minutes
after it is connected, and when one is found that device is promptly
compromised. The most common method is simple--criminals take advantage
of pre-programmed, default usernames and passwords and simply log onto
devices and commandeer them. With the explosion of insecure internet-
connected devices hitting the market, this type of attack will only
continue to grow and become more effective.
ii. dhs and private-sector engagement
The Department of Homeland Security has made considerable progress
in recent years engaging with the private sector, especially in the
area of information sharing. The Cyber Information Sharing and
Collaboration Program (CISCP) is DHS's primary structure for private
companies to share information about incidents, cyber threats and known
vulnerabilities. This information is then shared among participating
industry partners in an anonymized fashion to help secure their own
networks. In addition, CISCP convenes cybersecurity practitioners at
quarterly Advanced Technical Threat Exchanges (ATTE). We have been
active in these exchanges, and late last year presented our research on
ransomware, which included an in-depth analysis of new infection trends
and payload execution. We provided a list of specific indicators that
participants could use to further research and ensure their own systems
were protected. We have also presented on how companies and governments
can leverage threat intelligence to reduce ``Indicator of Compromise
(IoC) noise.'' Beyond the technical information shared, the ATTEs are
helpful in building trusted relationships and contacts between
Government and private industry, and even within the private sector
itself. These exchanges often lead to follow-on collaboration and, in
some cases, joint research.
Another notable example of effective information sharing through
the CISCP program came in October of last year when Symantec published
a report exposing a hacking group that was trying to steal money from
banks by exploiting the financial-based SWIFT messaging system used to
identify electronic transactions in the global financial system. In one
of the highest-profile attacks of the year, attackers used this same
method to steal $81 million from the Bangladesh Central Bank. Similar
to the Bangladesh attack, Symantec found a previously-unknown malware
variant (called Odinaff) being used against financial institutions.
This particular malware can delete customer logs of SWIFT transactions,
allowing attackers to hide their tracks. We passed along our in-depth,
technical research to CISCP managers along with a list of indicators
including hashes, command-and-control nodes, and domains. The CISCP
team then used our indicators to create an Indicator Bulletin (IB) and
pushed it out to all CISCP participants for their use.
The quality of DHS's analysis reports can vary. Many reports
include substantive analysis and actionable information, while some
have fallen short. In those instances, many of the IoCs included in the
report were unvetted, and companies that used them without proper care
saw a high volume of false positives. In some cases the IoCs proved to
be unrelated to the threat itself. To its credit, DHS is generally
responsive to industry concerns and has on occasion issued updated
reports with more information.
The importance of carefully vetting indicators is of increased
importance as DHS moves to Automated Indicator Sharing (AIS). The AIS
program allows the two-way exchange of cyber threat indicators between
the Federal Government and the private sector at machine speed. This
means that as soon as a company or a Federal agency identifies a
threat, that indicator is shared in real time with all of the AIS
participants. However, with an emphasis on velocity and volume,
appropriate context and more vigor in vetting is necessary. Added
context allows recipients to understand how to use an IoC or how to
calibrate their internal response. To be sure, DHS and its partner
agencies are in a difficult spot--the private sector is demanding both
timely and vetted information, and this balance is not easy to strike.
Industry has conveyed these concerns to DHS, which has worked to
improve both its analysis and the quality of the indicators.
Another program DHS has implemented to engage with industry is the
Critical Infrastructure Cyber Community or C\3\. The C\3\ is a
voluntary program that helps critical infrastructure operators improve
their cybersecurity and actively encourages the adoption of the
Framework for Improving Critical Infrastructure Cybersecurity, commonly
known as the NIST Cybersecurity Framework (CSF). The CSF was developed
in collaboration with the private sector, and Symantec was part of that
effort. We began using the CSF when it was still in draft form and was
one of the first companies to map our internal security to it. We
support DHS's efforts to encourage use of the CSF, both for companies
with existing cybersecurity programs and for those who are building one
from scratch.
In addition to the Department's formal programs, we work with DHS
informally. For instance, just last week, we hosted a group of ten
cyber threat analysts at our Herndon Security Operations Center to
discuss specific threats and to explore potential areas to coordinate
in the future. Among other topics, we discussed Shamoon, a family of
destructive malware that we have tracked for years. Shamoon was used in
attacks against the Saudi energy sector in 2012\1\ and recently we have
been tracking a fresh wave of attacks hitting the Middle East.\2\ The
opportunity to sit face-to-face and discuss threats often alleviates
another concern among many private-sector security companies, that too-
often the information flows just one way--from industry to the
Government. In-person exchanges often lead to a more complete and
bilateral interchange of ideas.
---------------------------------------------------------------------------
\1\ The Shamoon Attacks, Symantec Security Response, 8/16/12;
https://www.symantec.com/connect/blogs/shamoon-attacks.
\2\ Shamoon: Multi-staged destructive attacks limited to specific
targets, Symantec Security Response, 2/27/17; https://www.symantec.com/
connect/blogs/shamoon-multi-staged-destructive-attacks-limited-
specific-targets.
---------------------------------------------------------------------------
Other Government Partnerships
Partnerships can lead to concrete results. One recent example came
in December 2016, when Symantec concluded a decade-long research
campaign that helped unearth an international cyber criminal gang
dubbed ``Bayrob.'' The group is responsible for stealing up to $35
million from victims through auto auction scams, credit card fraud and
computer intrusions. Through our research, we discovered multiple
versions of Bayrob malware, collected voluminous intelligence data, and
tracked Bayrob as it morphed from on-line fraud to a botnet consisting
of over 300,000 computers used primarily for cryptocurrency mining.
Over time, Symantec's research team gained deep technical insight into
Bayrob's operations and its malicious activities, including its
recruitment of money mules. These investigations and countermeasures
were crucial in assisting the Federal Bureau of Investigation (FBI) and
authorities in Romania in building their case to arrest three of
Bayrob's key actors and extradite them to the United States.
Indeed, in recent years we have seen a string of successful arrests
and prosecutions of some of the most notorious cyber criminals in the
world. In July 2015, a New York judge sentenced Alexander Yucel, the
creator of the ``Black Shades'' Trojan to 5 years in prison and the
forfeiture of $200,000. Yucel was swept up by the FBI and Europol last
year along with dozens of other individuals in the United States and
abroad. Symantec worked closely with the FBI in this coordinated take-
down effort, sharing information that allowed the agency to track down
those suspected of involvement. In June 2015, Ercan ``Segate''
Findikoglu, who prosecutors say orchestrated one of the biggest cyber
bank heists in American history, was extradited to the United States to
stand trial for stealing more than $55 million by hacking bank
computers and withdrawing millions in cash from ATMs.
Additionally, Government and private-sector cooperation has led to
take-down operations against prominent financial fraud botnets. In June
2014, the FBI, the United Kingdom (UK) National Crime Agency, and a
number of international law enforcement agencies mounted a major
operation against the financial fraud botnet Gameover Zeus and the
ransomware network Cryptolocker. Gameover Zeus was the largest
financial fraud botnet in operation in 2014 and is often described as
one of the most technically sophisticated variants of the ubiquitous
Zeus malware. Symantec provided technical insights into the operation
and impact of both Gameover Zeus and Cryptolocker, and worked with a
broad industry coalition and the FBI during this case. As a result,
authorities were able to seize a large portion of the infrastructure
used by the cyber criminals behind both threats.
iii. private-sector partnerships to enhance cybersecurity--the cyber
threat alliance
While DHS continues to engage industry, the private sector is not
just waiting on the Government to solve the problem. Industry
partnerships have proven to be highly effective in fighting cyber
crime. The Cyber Threat Alliance (CTA) is an excellent example of the
private sector banding together to improve the overall safety and
security of the internet. In 2014, Symantec, Fortinet, Intel Security,
and Palo Alto Networks formed the CTA to work together to share threat
information. Since that time, Cisco and Checkpoint have joined the CTA
as founding members. The goal of the CTA is to better distribute
detailed information about advanced attacks and thereby raise the
situational awareness of CTA members and improve overall protection for
our customers.
Prior industry-sharing efforts were often limited to the exchange
of malware samples, and the CTA sought to change that. Over the past 3
years the CTA has consistently shared more actionable threat
intelligence such as information on ``zero day'' vulnerabilities,
command-and-control server information, mobile threats, and indicators
of compromise related to advanced threats. By raising the industry's
collective intelligence through these new data exchanges, CTA members
have delivered greater security for individual customers and
organizations. In short, the CTA is not about one vendor trying to gain
advantage--we are all contributing and sharing with the community.
Because of the success of the CTA, the founding members decided to
take it to the next level and earlier this year formally incorporated
it as a non-profit organization. Working together, CTA members have
developed a new platform designed to automate intelligence sharing in
near-real time. Through this effort we hope to solve some of the
problems created by isolated and manual approaches to cyber threat
intelligence. The new CTA has three purposes:
1. To share threat information in order to improve defenses against
advanced cyber adversaries across member organizations and
their customers;
2. To advance the cybersecurity of critical information technology
infrastructures; and
3. To increase the security, availability, integrity, and
efficiency of information systems.
CTA is also committed to engaging in discussions around policy
initiatives that will improve cybersecurity for individuals and
governments. As CTA moves forward with its mission, it intends to
explore how to best partner with U.S. and international Government
organizations in furtherance of its mission.
conclusion
As the Members of this subcommittee know better than most, we still
face significant challenges in our efforts to improve cybersecurity and
fight cyber crime. Cybersecurity is a team sport and effective public-
private partnerships with DHS and other Government agencies are
essential. DHS and industry have made notable progress over the last
several years--trust has improved--but there is still room for growth.
Attackers are always evolving, becoming more sophisticated, and both
Government and industry recognize the imperative for cooperation to
fight cyber crime. At Symantec, we are committed to improving internet
security across the globe, and will continue to work collaboratively
with industry and Government partners like DHS on ways to do so. Thank
you again for the opportunity to testify, and I will be happy to answer
any questions you may have.
Mr. Ratcliffe. Thank you, Mr. Greene.
Mr. Gillis, you are recognized for 5 minutes.
STATEMENT OF RYAN M. GILLIS, VICE PRESIDENT OF CYBERSECURITY
STRATEGY AND GLOBAL POLICY, PALO ALTO NETWORKS
Mr. Gillis. Chairman Ratcliffe, Ranking Member Richmond,
Members of the committee, it is an honor to be here today to
discuss DHS's interface with the private sector.
It is tough to go forth after this group of individuals. I
would like to start by thanking the committee for your
leadership in cybersecurity. The legislation that you have
helped lead over the last several years has not only helped
foster responsible cyber threat information sharing, it has
also strengthened the statutory responsibilities and statutory
authorities that DHS has to execute its mission, both within
the Federal Government and to interface with the private
sector. So that has been a critical challenge that DHS has
faced in standing up its cyber capabilities.
My name is Ryan Gillis. I am pleased to represent Palo Alto
Networks. We are newer than some of our other industry
colleagues up here, but within the 10 years since we have
shipped our first product we have become one of the largest
cybersecurity companies in the world.
Also happy to offer some historical perspective as I spent
over a decade within the National Security Council at the White
House and Department of Homeland Security. So this public/
private experience that I have gone through I think represents
the broader operational reality which is that, as you said,
Chairman, cybersecurity is a fundamentally distributed
responsibility. There are capabilities in the private sector
and authorities within the U.S. Government and governments
around the world that can complement each other. DHS is central
to that.
DHS's role in not only protecting civilian networks and
interfacing with the private sector, helping to secure critical
infrastructure, is essential. That is a policy decision that
has been made by consecutive administrations and in a
bipartisan way through Congress to ensure that there is a
civilian interface for that role and mission and to build-up
the capability within DHS, whether it is through informal
sharing examples I will go through, as well as programs such as
CISP and AIS.
Let me give you a quick perspective that we have on the
cyber threat landscape, which is that right now attacks are
overly automated. The bad guys are working together. They are
using free tools and cheaply available tools to launch
automated attacks. So the cost is too low right now to be
successful.
The business model is frequently, whether you don't have
the capability to develop your own attacks, but you are using
those freely available things that can bring you into the
ecosystem, or if you are a sophisticated nation-state, you are
generally going to use the least sophisticated attack that can
accomplish your goal. So what we need to do is flip that cost
curve by automating defenses and making sure that we are
collectively working together.
On a company level, we deploy technology that stops attacks
at certain points within the attack life cycle. It constantly
requires updates, as Scott talked about earlier. So just on a
corporate level, we provide 1.1 million new preventative
measures to our technology around the world on a weekly basis,
pushed out in as little as 5 minutes. One company alone, as you
have heard today, can't do that adequately, so we need to find
partnerships throughout the ecosystem.
On an industry level, you have heard about the Cyber Threat
Alliance. To give a little bit more of an example of how the
Cyber Threat Alliance worked on this CryptoWall example that
Scott talked about, $300 million had been extorted in
ransomware through this CryptoWall campaign. The vendor
community, through the Cyber Threat Alliance, came together and
shared what we knew about the infrastructure, defended all of
our collective clients against those attacks. Prior to
publishing that report, we called up Department of Homeland
Security to ensure that we were collaborating on that.
DHS had FBI on the phone that night. They made sure that
U.S. Government networks were similarly protected against those
types of attack. They did notifications to internet service
providers and to victims to help clean up. Most of the attacks
were coming from unknowing victims that didn't know that their
systems were being repurposed for attack.
Then in an actual, quantifiable example of information
given back from the Government, we got an additional 170
command-and-control nodes, parts of the infrastructure that we
as vendors had not identified as part of the context of that
attack, and we were able to further protect all of our
collective customers.
So it is one example of how we can share, as Scott said,
more context and become more effective overall. What we need to
move to is in programs like CISP and AIS, getting closer to
machine speed with those types of examples.
So there is opportunity to expand on the nascent
capabilities that DHS has rolled out through AIS and CISP and
make us more effective overall.
I think the other thing that you are going to see as well
is that I believe the U.S. Government is never going to be
quick at declassifying some of its most valuable information.
What the U.S. Government may not realize, however, is that we
in the vendor community may see trial balloons of that most
sophisticated technology in a few places and in unclassified
ways.
If we can share that with the U.S. Government, we can
obviate that whole what they call the tear line process, where
the U.S. Government has to declassify that information, and the
U.S. Government can point to the financial sector or the energy
sector, whoever they think may be targeted by that particularly
pernicious campaign, and say you need to focus on this, we have
seen it out in the wild, and we think bad guys are going to go
after it.
So this collective public/private, DHS will be at the
center of that. Ultimately, we think things like the Cyber
Threat Alliance are crucial to taking that next step.
[The prepared statement of Mr. Gillis follows:]
Prepared Statement of Ryan M. Gillis
March 9, 2017
Chairman Ratcliffe, Ranking Member Richmond, and Members of the
committee: Thank you for the opportunity to appear before you today to
discuss how the Department of Homeland Security engages with the
private sector. My name is Ryan Gillis, and I serve as the vice
president of cybersecurity strategy and global policy at Palo Alto
Networks.
I would like to begin today by recognizing the tremendous
leadership this committee has shown on the issue of cybersecurity. I
have seen first-hand this committee's central role in passing a range
of cybersecurity legislation that promotes responsible cyber
information sharing and strengthens the Department of Homeland
Security's (DHS) statutory authority to execute its mission. The
committee is directly responsible for helping shape legal clarity to
expand cyber information sharing, provide appropriately targeted
liability protections for companies, and establish necessary privacy
protections in the Cybersecurity Act of 2015. The end result reflects
this committee's sound understanding of how critical public-private
trust and cooperation is to effective information sharing, and I'm
honored to support this committee's continued oversight
responsibilities. So, let me first say thank you for your leadership
and for the opportunity to speak with you today.
For those not familiar with Palo Alto Networks, we have become one
of the world's largest cybersecurity companies just 10 years after our
first product shipped, actively preventing successful cyber attacks for
more than 37,000 corporate and Government enterprise customers in more
than 150 countries world-wide. Our collaboration with DHS ranges from
strategic policy development to operational initiatives, starting with
a commitment from the top of our organization. Our CEO and chairman,
Mark McLaughlin, just completed consecutive 2-year terms as chairman
and vice chairman of the President's National Security
Telecommunications Advisory Committee (NSTAC). Founded during the
Reagan Administration and administered by DHS, NSTAC brings industry
chief executives together to provide counsel on National security
policy and technical issues for the president and other U.S. Government
leadership.
Since joining Palo Alto Networks in January of 2015, my principal
role has been to work with governments, companies, and organizations
around the world to develop and implement strategies, policies, and
operational partnerships that prevent successful cyber attacks.
Candidly, this approach to cybersecurity builds naturally upon the
years I spent at the DHS and on the National Security Council at the
White House, and it reflects the operational reality that cybersecurity
is fundamentally a shared and distributed challenge that can only be
effectively addressed through collaboration, which leverages the unique
capabilities and authorities of companies, individuals, and
governments.
To that end, we maintain a regular cadence with appropriate
government and law enforcement stakeholders around the world. The U.S.
Department of Homeland Security is the cornerstone of these government
engagements because of its mission to collectively prevent, protect
against, mitigate, respond to, investigate, and recover from cyber
incidents. Our robust and multi-faceted partnership with DHS includes
participation in formalized programs, as well as more informal
collaboration mechanisms built on trust and personal relationships. We
engage with DHS as an individual company and as part of broader
collectives of private-sector entities.
My testimony today will address the full spectrum of this DHS
relationship, framing why public-private sector collaboration is so
critical to improving our cybersecurity as a Nation--and what
collective actions we believe private industry and Government must take
to effectively leverage information sharing as a tool to achieve the
desired outcome of increased cybersecurity. Finally, I'll outline
specific examples of our collaboration with DHS--including information
sharing, policy development, and cybersecurity exercises. In doing so,
I'll highlight several tangible success stories of public-private
partnerships; opportunities for potential improvements; and, not only
what Congress has done to incentivize these partnerships, but also what
can be done to further enable progress in these areas.
why public-private sector cybersecurity collaboration is important
Before providing an assessment of the current state of DHS and
private-sector cybersecurity collaboration, it is critical that we
clearly define the objectives we are seeking to achieve through this
partnership. As arguably the most developed mechanism of public-private
sector cooperation, cyber information sharing provides a valuable use
case for this discussion.
As the concept of information sharing has received wide-spread
attention in recent years, the term has adopted an increasingly broad
and varied definition. Because of this, it is critical to clearly
define how Palo Alto Networks approaches information sharing, and how
it fits into our broader mission of raising costs for our adversaries
and actively preventing cyber attacks. This approach recognizes that
cyber threat information sharing, while critical, is not a panacea.
Information sharing is one necessary tool within a much larger strategy
that leverages people, process, and technology to tangibly reverse the
attackers' current advantage in cyber space.
The Palo Alto Networks perspective on cybersecurity is built on a
relatively simple premise: We believe that cybersecurity is a
correctable math problem that, at present, overwhelmingly favors the
attackers. As the cost of computing continues to decline, our
adversaries have been able to conduct increasingly automated,
successful attacks at minimal cost. In fact, many free and open-source
tools are available on-line that enable repeatedly successful attacks
against poorly-defended networks. In the face of this automated
onslaught, the network defender is generally relying on legacy security
technologies, often cobbled together as multiple layers of ``point''
products that solve discreet problems but do not interoperate in a way
that can holistically reduce priority risks across an organization's
entire network infrastructure. This increased technological complexity
creates a dependence on people--one of the least scalable resources in
any organization--to manually defend against automated, machine-
generated attacks. Network defenders are simply losing the economics of
the cybersecurity challenge.
To flip this equation and gain back leverage against our
adversaries, we need to collectively embrace integrated approaches that
simplify and automate network defense to actively prevent cyber
attacks. This is a critical point: If we focus on preventing attacks in
the correct locations--informed by sophisticated and integrated
detection capabilities--we can deter malicious activity by making it
more expensive in terms of resources, time, and personal impact for our
adversaries to launch a successful attack. True integration across the
cybersecurity ecosystem--leveraging initiatives like automated
information sharing and technology orchestration--can be the catalyst
in reversing this current unsustainable dynamic that exists in cyber
space.
Our approach to automated integration begins within our own
technology platform. We build technology that prevents attacks at the
key tactical and strategic places where cyber attackers need to take
action to be successful, and we update our global customer base with
the latest protections in as little as 5 minutes. As a matter of scope,
we generate more than 1 million new preventive measures each week as we
identify new, or ``zero-day,'' cyber threats. This is not to imply that
we--nor any one company or Government--can alone see and prevent all
the evolving automated threats facing network defenders. Consequently,
we partner with other companies and appropriate Government agencies
whose competencies complement ours to help gain the leverage required
to disrupt attackers and their tools.
At its core, our company's network defense and information-sharing
philosophy closely mirrors the ultimate vision for information sharing
championed by this committee. Our approach is focused on three primary
objectives: (1) Protect against all known cyber threats; (2) turn
unknown threats into known threats as quickly as possible; and (3)
automatically leverage this new threat knowledge to create preventive
countermeasures that are shared broadly within the ecosystem to prevent
other entities from falling victim to similar attacks. This last
component is critical. As this committee knows well, information
sharing is too often a time-intensive process that requires a human to
read, interpret, and manually create prevention controls based on
technical cyber threat indicators provided in a non-machine-readable
format like a PDF or email. This manual process simply can't scale to
the speed and sophistication of the modern cyber threat environment.
Sophisticated cybersecurity companies can uniquely contribute to
this challenge because we collectively have the physical infrastructure
and processing ability to automatically deploy preventive measures
based on new threat information to a broad customer base across
multiple sectors. For these reasons, Palo Alto Networks and other
sophisticated cybersecurity companies can bring a degree of
actionability to information sharing that is critical for achieving our
ultimate goals of raising adversary costs and tangibly improving
cybersecurity across the ecosystem.
Our approach to automated integration doesn't end with our own
platform or even our own company. In 2014, Palo Alto Networks was a
founding member of the Cyber Threat Alliance (CTA). The CTA was
incorporated in January 2017 as an independent, non-profit organization
focused on cybersecurity information sharing. It is the first
information-sharing organization specifically among cybersecurity
vendors. Michael Daniel, the former special assistant to the President
and White House cybersecurity coordinator, was just appointed as the
CTA's first president. The CTA now includes six of the largest global
cybersecurity companies as founding members--Check Point, Cisco,
Fortinet, McAfee, Palo Alto Networks and Symantec--underscoring the
philosophy that we can be force multipliers in support of a coordinated
threat-sharing effort against cyber adversaries.
To fulfill its core mission, the CTA has built an automated
information-sharing platform with the goal of enabling and
incentivizing the sharing of high-quality, actionable threat
information. The CTA and its platform embody a major step forward in
transforming shared threat information into effective preventive
measures that can automatically be deployed by CTA members to their
respective customers. This isn't purely conceptual; the CTA platform is
actively working to protect its members and their customers in near-
real-time.
For example, recently, a single shared sample from one CTA member
allowed another member to build protections before that organization's
customers were targeted--preventing successful attacks against 29
subsequent organizations. In another instance, data shared through the
CTA from one member allowed another member to identify a targeted
attack against its customer and release additional indicators to defend
that organization. The CTA and its platform have shown that a well-
designed and well-built information-sharing program can foster the
sharing of high-quality threat information among competitors, with
members finding that 40 to 50 percent of shared data is new and
directly actionable.
The CTA model directly addresses many of the aspects that have
limited the effectiveness of other information-sharing relationships,
both formal and informal. First, the CTA addresses the problem of
information-sharing ``free riders'' that join information-sharing
groups and simply receive information without sharing. Universal
contributions are achieved by establishing mandatory sharing minimums
for CTA members: Initially on a quantitative basis (1,000 unique cyber
indicators/per day) and now evolving into a scoring system that
measures the qualitative value of shared data. Second, the CTA is
focused on sharing indicators related to an adversary's playbook--a
more limited and predictable series of steps an adversary must take to
complete a successful cyber attack. This is a key departure from many
information-sharing organizations, which focus instead on sharing
malware samples that can be polymorphic and exist in an exponentially
larger quantity than the number of unique adversary playbooks. Third,
because the CTA members' collective customer base spans all industry
sectors, the impact of sharing can protect a large percentage of the
global ecosystem. This type of broad-based sharing of widely-used
threat techniques can help neutralize unsophisticated actors and force
sophisticated adversaries, such as nation-states, to develop new (and
therefore costlier) techniques. This narrowing of the threat landscape
can make attribution easier and enable governments to more effectively
target high-priority and advanced persistent adversaries and threats.
Government has a complementary and equally critical role to play in
fostering information sharing across the ecosystem by leveraging its
unique authorities and capabilities. DHS, for example, has the ability
to amplify and distribute cyber threat information to a wide cross-
section of industry and critical infrastructure operators.
Historically, there have been many efforts by the U.S. Government
to more quickly declassify cyber threat information for distribution to
the broader community. However, given the rapid pace in which cyber
threats mutate and spread, the largely manual declassification process
is rarely fast enough to simultaneously outpace the threat and avoid
disclosures of intelligence sources and methods. Infused with a much
wider set of Unclassified information from the private sector,
Government could be able to more quickly add valuable insight and
perspective without declassifying information. Leveraging the unique
visibility they possess from Classified information, governments can
instead help direct private-sector attention and resources to publicly
available information on priority threats, such as nation-state
activity that may target a particular sector, like energy or finance,
in a way that doesn't reveal Classified information.
palo alto networks engagements with dhs on cybersecurity issues
The Palo Alto Networks collaboration with DHS takes many forms--
both formal and informal--and is related to a broad range of policy and
operational activities. Operationally, our formal and informal
collaboration with DHS has ranged from programmatic relationships to
targeted sharing of threat intelligence reports generated by Unit 42,
the Palo Alto Networks threat intelligence team. These efforts
highlight threat information sharing conducted as an individual company
and as a founding member of the Cyber Threat Alliance.
Cyber Threat Sharing Examples.--Prior to our joining the two DHS
formal sharing programs, the Cyber Information Sharing and
Collaboration Program (CISCP) and the Automated Indicator Sharing (AIS)
program, we established informal processes to share threats,
vulnerabilities, and malicious cyber threat campaign information with
DHS based on personal relationships and our knowledge of their mission
and capabilities. When appropriate, we share advanced copies of
significant threat reports with DHS cyber policy leadership and
operational teams at the National Cybersecurity and Communications
Integration Center (NCCIC). I'd like to highlight just a few specific
examples of these information-sharing success stories that embody the
type of public-private cooperation this committee has sought to
encourage.
In December 2016, Palo Alto Networks threat intelligence
team, Unit 42, discovered new samples of Disttrack--an
evolution of the same malware that was used in the August 2012
``Shamoon'' cyber attack that destroyed over 30,000 hard drives
at a Saudi Arabian energy company. The original Shamoon attack
is widely considered one of the most significant and
destructive cyber attacks in history. Prior to our report's
public release, we coordinated with DHS to enable them to take
preventive action. Based on several reports by Palo Alto
Networks and other researchers, DHS: (1) Issued two Information
Bulletins to the CISCP community of network defense
stakeholders, (2) updated their Indicators of Compromise (IOC)
databases, and (3) created EINSTEIN signatures related to the
threat to protect other Federal Government civilian agencies.
In early 2016, the Palo Alto Networks threat intelligence
team released a report entitled Scarlet Mimic, identifying a
long-running cyber campaign targeting minority activists in
China, as well as Russian and Indian government organizations
responsible for tracking activist and terrorist activities.
Palo Alto Networks reached out directly to DHS to share
indicators related to Scarlet Mimic, allowing them to deploy
preventive countermeasures across their community of network
defense partners. Specifically, DHS indicated its intention to:
Update their Indicators of Compromise databases, vet IOCs
against the intelligence community's Classified databases to
determine threat group attribution, create EINSTEIN signatures
to protect other Federal civilian agencies, and generate
STIXTM files for automated distribution to their
private-sector CISCP partners.
In other instances, we coordinate our outreach to DHS as
part of remediation efforts with public disclosure of new
vulnerabilities that our threat intelligence team discovers in
publicly-available technology across the ecosystem. For
example, in early 2015, our threat intelligence team identified
a new vulnerability in AndroidTM operating systems.
We rapidly shared the information with Google, so they could
take steps to remediate the vulnerability, and then contacted
DHS as we published the report. DHS used the provided
information to generate a US-CERT alert and push the
notification to their public website and their broad community
of network defender partners.
As part of the Cyber Threat Alliance, Palo Alto Networks
coordinated with DHS as well as other U.S. and international
government stakeholders to share threat information about
CryptoWall v3--a ransomware campaign that had extorted over
$300 million from victims in under 1 year. Based on CTA's
shared cyber threat indicators, DHS and the FBI were able to
notify victims whose websites were unknowingly compromised;
contact internet service providers to disrupt compromised
infrastructure; and send alerts to their network defense
partners, including the international CERT community, to
protect against CryptoWall v3 tactics. Subsequently, the U.S.
Government shared back 170 unique CryptoWall indicators with
the CTA, beyond the roughly 850 indicators the CTA report
initially identified. This CryptoWall example is distinct as a
tangible illustration with quantifiable metrics of two-way
sharing of cyber threat information between the Government and
private sector.
While each of these represents an individual success story and an
illustrative use case, we need to focus our collective effort on
ensuring these success stories are the rule rather than the exception.
We can accomplish this by continuing to build trust among partners,
refining the processes, enhancing the existing sharing infrastructure,
and remaining committed to automating threat sharing in a way that can
effectively scale to the pace of the cyber threats.
DHS Cyberthreat Sharing Programs.--Regarding formal information-
sharing partnerships, Palo Alto Networks is a member of DHS's two
primary cybersecurity information-sharing programs: The Cyber
Information Sharing and Collaboration Program (CISCP) and the Automated
Indicator Sharing (AIS) program.
CISCP is a program established to promote robust
information-sharing and analytic collaboration between DHS and
vetted private-sector partners, especially the critical
infrastructure community.
Implemented in accordance with the Cybersecurity Act of
2015, AIS is a DHS-developed capability to enable the automated
exchange of anonymized cyber-threat indicators among a wider
range of private-sector entities and the U.S. Federal
Government.
AIS is intended to provide threat indicators at ``machine speed''
aligns directly with our efforts to increasingly automate threat
sharing, as outlined above. We applaud the concept of AIS and view it
as both complementary and reinforcing to the type of automated
information sharing that is already responsibly occurring at Palo Alto
Networks and within entities like the Cyber Threat Alliance. DHS should
be commended for their continued progress in maturing these
information-sharing program capabilities, but there are certainly
tangible opportunities for improvement.
As discussed with DHS, we believe that the administrative process
for joining these programs could certainly be easier and more
efficient. Because programs like AIS are dramatically enhanced by the
number of contributing members, DHS would benefit from investing in
resources that streamline on-boarding processes and generally make
these private sector-interfacing programs more customer service-
focused. Specifically, DHS should develop a clear step-by-step guide
for on-boarding, publish those requirements broadly, and promote a
singular ``help desk''-type contact for all questions related to the
programs. To their credit, DHS senior officials recognize these
shortcomings, and plan to take concrete steps to implement personnel
and process reforms that should ultimately make the AIS program more
customer service-centric.
Operationally, both AIS and CISCP have initial baseline
capabilities and value, but they also could benefit from incorporating
best practices from industry information-sharing efforts, such as the
Cyber Threat Alliance's platform. According to DHS, AIS has delivered
over 218,000 unique indicators since March 2016. Additionally, CISCP
published 283 Indicator Bulletins in 2016, including nearly 1,300
indicators of compromise, with a recognition they need to refine their
ability to provide useful, Unclassified context. However, DHS could
further engage industry to leverage vendor-neutral technology and
techniques that more rapidly share larger volumes of actionable cyber-
threat information with context about how individual malware is used as
part of broader campaigns.
Information-Sharing Analysis Organizations (ISAO).--Regarding
cyber-threat information-sharing policy development, Palo Alto Networks
had a leadership role in DHS's effort to establish and identify
standards and best practices for Information-Sharing Analysis
Organizations (ISAO), following a 2014 Presidential Executive Order
establishing ISAOs. Specifically, our chief security officer, Rick
Howard, led the effort on information privacy and security in one of
six working groups that wrote and published the official ISAO standards
in September 2016.
National Security Telecommunications Advisory Committee (NSTAC).--
Previously, I referenced our broader policy engagements with DHS, such
as our CEO Mark McLaughlin's current membership and former leadership
roles in the President's National Security Telecommunications Advisory
Committee (NSTAC). Administered by DHS, the NSTAC has recently grown to
become an increasingly relevant policy forum for collaboration between
private industry and the U.S. Government. Senior cybersecurity
officials representing the White House and the Department of Homeland
Security have repeatedly acknowledged the direct impact of NSTAC
studies on the formulation of U.S. policy. The NSTAC has also played an
important role in fostering relationships between Government and the
private-sector technology community. For example, in mid-2016, the
NSTAC hosted the first-ever meeting in its 34-year history in Silicon
Valley, with significant U.S. Government participation, including the
Secretaries of Commerce, Defense, and Homeland Security, as well as
Admiral Rogers, Director of NSA and Commander of U.S. Cyber Command.
Information Technology Sector Coordinating Council (IT-SCC).--Palo
Alto Networks is an Executive Committee member of the IT-Sector
Coordinating Council, the principal entity for coordination between the
Department of Homeland Security and IT sector companies and
associations on a range of critical infrastructure protection and
cybersecurity issues. The IT-SCC provides another official mechanism
for Palo Alto Networks to collaborate with IT sector companies and DHS
senior cyber officials on a range of sector-relevant policy, and
cybersecurity issues.
Cyber Storm V.--Palo Alto Networks was also actively engaged in the
planning and execution of Cyber Storm V in early 2016. The biannual
National cyber exercise is led by DHS and brings together over 1,100
U.S. Government and private-sector participants to test the cyber
incident coordination processes that helped test and inform operational
procedures and subsequent National policies. We commend DHS for their
leadership and execution of these complex exercises, and would like to
increasingly add realistic technical components to future iterations.
Planning for Cyber Storm VI in 2018 has recently commenced, and we look
forward to again working closely with DHS on this critical initiative.
legislative successes and congressional oversight of dhs information-
sharing initiatives
As discussed in my introduction, this committee has played a
central role in passing a range of cybersecurity legislation that
promotes responsible cyber-threat information-sharing and strengthens
DHS's statutory authority to execute its mission.
The information-sharing portion of the Cyber Act (Title I)
understandably garners most of the attention, and today's hearing
demonstrates the need for oversight to ensure that Congress and DHS
continue to identify areas of both progress necessary further
improvements in its implementation.
In general, efforts to promote more direct engagement between DHS
and the private-sector technology community to address homeland
security mission requirements should be encouraged. This can take the
form of new legislation, such as Chairman Ratcliffe's recently
introduced bill on leveraging emerging technologies, to oversight of
existing laws, such as Title II of the Cybersecurity Information
Sharing Act of 2015.
Thank you very much for the opportunity to testify before you
today. I look forward to any questions you may have and your continued
partnership on this critical issue.
ATTACHMENT 1.--Lucrative Ransomware Attacks: Analysis of the Cryptowall
Version 3 Threat \1\
---------------------------------------------------------------------------
\1\ https://www.cyberthreatalliance.org/pdf/cryptowall-report.pdf.
---------------------------------------------------------------------------
ATTACHMENT 2.--Shamoon 2: Return of the Disttrack Wiper \2\
---------------------------------------------------------------------------
\2\ https://researchcenter.paloaltonetworks.com/2016/11/unit42-
shamoon-2-return-disttrack-wiper/.
---------------------------------------------------------------------------
ATTACHMENT 3.--Scarlet Mimic: Years-Long Espionage Campaign Targets
Minority Activists \3\
---------------------------------------------------------------------------
\3\ https://researchcenter.paloaltonetworks.com/2016/01/scarlet-
mimic-years-long-espionage-targets-minority-activists/.
---------------------------------------------------------------------------
ATTACHMENT 4.--Android Installer Hijacking Vulnerability Could Expose
Android Users to Malware \4\
---------------------------------------------------------------------------
\4\ https://researchcenter.paloaltonetworks.com/2015/03/android-
installer-hijacking-vulnerability-could-expose-android-users-to-
malware/.
Mr. Ratcliffe. Thank you, Mr. Gillis.
Ms. Greene, you are recognized for 5 minutes.
STATEMENT OF ROBYN GREENE, POLICY COUNSEL AND GOVERNMENT
AFFAIRS LEAD, OPEN TECHNOLOGY INSTITUTE, NEW AMERICA
Ms. Robyn Greene. Thank you, Chairman Ratcliffe, Ranking
Member Richmond, and Members of the committee for the
opportunity to testify today.
As a policy council and government affairs lead at New
America's Open Technology Institute, I specialize in issues
related to privacy, cybersecurity, and surveillance.
My statement today will cover three subjects: First,
outstanding privacy concerns in the Cybersecurity Information
Sharing Act, CISA; second, how DHS's balanced approach to
implementing CISA has improved cybersecurity and protected
privacy; and third, that a more holistic approach to
cybersecurity, beyond information sharing, is essential.
CISA provides important improvements for many previous
iterations of information-sharing legislation. Many of those
improvements are the result of this committee's hard work and
leadership to protect privacy while improving cybersecurity.
But despite this committee's laudable efforts, certain
privacy concerns remain unaddressed, like imprecise definitions
for the terms like ``cybersecurity threat'' and ``cyber threat
indicator,'' and a weak requirement for the removal of personal
information.
These shortfalls raise concerns that CISA may threaten
privacy and undermine security by resulting in the sharing of
unnecessary information, like information related to false
alarms or communications content and other irrelevant personal
information.
Also troubling are CISA's over-broad use authorizations for
law enforcement to use information it obtains from companies
shred for a cybersecurity purpose, for investigations and
prosecutions that are entirely unrelated to cybersecurity.
This undermines Fourth Amendment protections because it
allows law enforcement to use information that it would obtain
ordinarily pursuant to a warrant or a court order.
Finally, CISA includes a provision that allows the
President to undermine DHS's role as the lead portal for
information sharing by establishing a second portal, possibly
at a law enforcement or intelligence oversight agency, like the
FBI or the Office of the Director of National Intelligence.
This would harm civil liberties and threaten user trust, which
is essential for companies to feel comfortable participating in
the information-sharing program.
With all of that said, DHS has done a good job of
promulgating guidelines and procedures under CISA that protect
privacy and strengthen cybersecurity. DHS has provided clear
interpretations and applications of vague definitions and
requirements.
Additionally, DHS leveraged STIX in its automated
indicator-sharing system to establish standardized fields of
information sharing and it retained human review of personal
information that is shared.
With these steps, DHS has minimized the risk of unnecessary
sharing and dissemination of Americans' personal information.
The committee should continue to support DHS in this important
work.
Since information sharing is not a panacea, more must still
be done to improve cybersecurity. The Government must take a
multi-pronged, holistic, and outcomes-based approach. DHS must
increase the amount of information it shares with the private
sector, including getting more threat indicators declassified.
To protect ourselves from another OPM-style data breach,
Congress must ensure that the Federal Government has the
resources needed to modernize its IT infrastructure, to
maintain up-to-date and secure devices and systems, and to hire
a robust work force of security and technology policy experts.
Recent reporting suggests that the Government is struggling
to fill open cybersecurity positions and that this shortage may
be threatening collaboration with industry.
The Federal Government can also help to improve overall
security by finding ways to incentivize the private sector and
individuals to update software with patches for vulnerabilities
and by formalizing its approach to vulnerabilities management.
Wikileaks' disclosure of CIA hacking tools earlier this
week highlight that it is possible for vulnerabilities to be
publicly released and for individuals, industry, and the
Government alike to be left exposed to malicious actors when
this happens. This drives home how important it is for Congress
to codify a process for the Government to disclose zero-day
vulnerabilities as soon as possible so that they can be
patched.
The Government should also help to shrink the size of the
zero-day market by minimizing its participation in it.
Last, the Government should use its bully pulpit to
champion the wide-spread use of security tools, like two-factor
authentication and encryption, and it should incentivize
companies to offer those tools by default, along with automatic
software updates, as part of an effort to encourage privacy and
security by design.
Thank you very much, and I look forward to your questions.
[The prepared statement of Ms. Greene follows:]
Prepared Statement of Robyn Greene
March 9, 2017
Thank you for the opportunity to testify today on ``The Current
State of DHS Private-Sector Engagement for Cybersecurity.'' I represent
New America's Open Technology Institute (OTI), where I am a policy
counsel and Government affairs lead on privacy, surveillance, and
cybersecurity issues.
New America is a nonpartisan, nonprofit, civic enterprise dedicated
to the renewal of American politics, prosperity, and purpose in the
digital age through big ideas, technological innovation, next
generation politics, and creative engagement with broad audiences. OTI
is a program at New America that works at the intersection of
technology and policy to ensure that every community has equitable
access to digital technology and its benefits. We promote universal
access to communications technologies that are both open and secure,
using a multidisciplinary approach that brings together advocates,
researchers, organizers, and innovators. Our current focus areas
include surveillance, privacy and security, net neutrality, broadband
access, and consumer privacy.
In December 2015, Congress passed the Cybersecurity Information
Sharing Act (CISA).\1\ The law provides private-sector entities with
liability protection for sharing information about cybersecurity
threats with one another and with the Government. Throughout the debate
over information-sharing legislation, OTI voiced significant concerns
about the scope of sharing permitted and the insufficient privacy
protections for internet users both before and after information is
shared. We also urged Congress to take a more holistic approach to
cybersecurity policy, rather than focus solely on information
sharing.\2\
---------------------------------------------------------------------------
\1\ Cybersecurity Information Sharing Act, 6 U.S.C. 1501 et. seq.,
Public Law No: 114-113, H.R. 2029 Division N, Title I, 114th Cong.
(2015), https://www.Congress.gov/114/plaws/publ113/PLAW-114publ113.pdf.
\2\ Robyn Greene, Congress Must Focus on More Than Information
Sharing, The Hill, Jan. 30, 2015, http://thehill.com/blogs/congress-
blog/technology/231190-congress-must-focus-on-more-than-information-
sharing.
---------------------------------------------------------------------------
My testimony will cover three topics: (1) OTI's outstanding privacy
concerns related to how much information can be shared, with whom, and
how it can be used under CISA; (2) the ways in which the Department of
Homeland Security (DHS) has worked in its implementation of the law to
protect privacy and simultaneously enhance cybersecurity, and (3)
additional steps that the Government could take to strengthen public-
private partnerships related to cybersecurity, and to incentivize or
encourage the private sector to adopt best practices, to meaningfully
protect privacy and improve overall security.
outstanding concerns regarding the cybersecurity information sharing
act (cisa)
Information-sharing legislation was extremely controversial for the
entire time that Congress debated it, even up to the point that CISA
became law. The most significant point of contention was always how to
adequately protect privacy and civil liberties. CISA's predecessor, the
Cyber Intelligence Sharing Protection Act (CISPA), contained no
meaningful privacy protections when it was first introduced.\3\ After
years of advocacy by privacy and security experts, and several
iterations of legislation, the final version of CISA included important
improvements and protections. Nevertheless, certain privacy concerns
were left unaddressed or inadequately addressed. Those shortfalls
include imprecise definitions, a too-weak requirement to remove
personal information before sharing cyber threat indicators, overbroad
allowances for law enforcement to use shared data for purposes
unrelated to cybersecurity, and the possibility that the President will
undermine DHS's role as the lead information-sharing portal by
establishing a second authorized portal.\4\
---------------------------------------------------------------------------
\3\ Cyber Intelligence Sharing and Protection Act, H.R. 3523, 112th
Cong. (2011), https://www.Congress.gov/112/bills/hr3523/BILLS-
112hr3523ih.pdf; see also Letter from the ACLU to Hon. Mike Rogers &
Hon. C.A. ``Dutch'' Ruppersberger, Dec. 1, 2011, https://www.aclu.org/
other/aclu-opposition-hr-3523-cyber-intelligence-sharing-and-
protection-act-2011.
\4\ Robyn Greene, The Knock-Down, Drag-Out Fight Over Cybersecurity
Legislation, Slate, Jan. 15, 2016, http://www.slate.com/articles/
technology/future_tense/2016/01/how_the_pri-
vacy_community_made_cyber_security_legislation_better.html.
---------------------------------------------------------------------------
CISA's overbroad definitions threaten privacy because they can
result in over-sharing of personal or otherwise unnecessary
information. This is the case for the definition of ``cybersecurity
threat,'' which triggers the authorization to share. The law defines a
cybersecurity threat as anything that ``may result in an unauthorized
effort to adversely impact'' a device or system.\5\ It covers any
potential threat and does not require that a company make a
determination that the purported cyber threat is likely to cause harm
before sharing their users' information.
---------------------------------------------------------------------------
\5\ Supra note 1 at 1501(5).
---------------------------------------------------------------------------
This low threshold could spur sharing of unnecessary information,
like that concerning false alarms, which would threaten privacy if the
sharer transmits personal information as part of the cyber threat
indicators shared. It could also undermine security. Unnecessary
sharing of personal information can expose internet users to new
threats should their information be successfully targeted and
exfiltrated by malicious actors after being shared under CISA.
Additionally, it can undermine security by creating ``white noise''
that distracts from imminent threats.\6\
---------------------------------------------------------------------------
\6\ See Letter from security experts to Sen. Dianne Feinstein, et
al concerning information-sharing bills (Apr. 16, 2015), https://
cyberlaw.stanford.edu/files/blogs/technologists-
_info_sharing_bills_letter_w_exhibit.pdf.
---------------------------------------------------------------------------
Over-sharing could also result from the insufficiently narrow
definition for ``cyber threat indicator'' and the inadequate
requirement to remove personal information before sharing. Cyber threat
indicators include ``information that is necessary to describe or
identify . . . the actual or potential harm caused by an incident . . .
[or any] attribute of a cybersecurity threat'' so long as disclosure of
the underlying attribute is not otherwise legally prohibited.\7\
---------------------------------------------------------------------------
\7\ Supra note 1 at 1501(6).
---------------------------------------------------------------------------
A broad interpretation of this definition could include personal
information or content of on-line communications that is not needed to
detect or protect against a threat. This is because information that
could be deemed necessary to describe a threat or potential harms
caused by an incident could still be unnecessary to identify or protect
against the threat. For example, while it might be reasonable to share
an IP address that is associated with malicious activity, the breadth
of this definition might also permit a company to share any information
they might have associated with that IP address that identifies a
particular account holder or location because they claim it is
necessary to describe the IP address. In the case of botnets, this
identifying information might not necessarily belong to the malicious
actor; it could belong to a botnet victim.
Similarly, under the law, companies can share any personal
information so long as it is ``directly related to a cybersecurity
threat.''\8\ This could be interpreted in a manner that undermines
privacy by allowing a company to share victim information or other
personal information unnecessary to identify or protect against a
threat. For example, a broad interpretation of this requirement could
allow for a company to share the personal information of the victim of
a cyber incident, like information about the recipient of a phishing
email, since that information could be deemed to be ``directly
related'' to the threat, even though it may not be necessary to
identify or protect against the threat.\9\
---------------------------------------------------------------------------
\8\ Supra note 1 at 1503(d)(2).
\9\ As I discuss in the next section of this statement, DHS has
done a good job of protecting privacy in its promulgation of guidance
to companies on information sharing. It addresses this specific
concern, making clear that companies should not share this kind of
victim information. However, that guidance, and thus DHS's strict
interpretation of the requirement to remove personal information, is
subject to change. To better protect privacy, Congress should amend the
law to address this concern. See Dep't of Homeland Security & Dep't of
Justice, Guidance to Assist Non-Federal Entities to Share Cyber Threat
Indicators and Defensive Measure with Federal Entities under the
Cybersecurity Information Sharing Act of 2015 5 (2016), https://www.us-
cert.gov/sites/default/files/ais_files/Non-
Federal_Entity_Sharing_Guidance_(Sec%20- 105(a)).pdf [hereinafter
``Company Guidance''].
---------------------------------------------------------------------------
In addition to insufficiently narrow definitions and weak front-end
privacy protections, CISA overbroadly authorizes law enforcement to use
the shared information for non-cybersecurity investigations. Under the
statute, any information that is shared with the Government for a
cybersecurity purpose may be used by law enforcement in investigations
and prosecutions entirely unrelated to cybersecurity or computer
crimes. Authorized uses include investigations and prosecutions into
Trade Secrets Act and Espionage Act violations, undefined ``serious
economic harms,'' and certain violent crimes irrespective of whether
the threat is imminent.\10\ This undermines Fourth Amendment
protections because it allows law enforcement to use information in
investigations and prosecutions that it would ordinarily only be able
to obtain pursuant to a warrant issued by a judge based on a finding of
probable cause. Information sharing is subject to no judicial
oversight, and thus no judge ever makes a finding of probable cause
before law enforcement uses the information it receives under CISA,
even where investigations are unrelated to cybersecurity.
---------------------------------------------------------------------------
\10\ Supra note 1 at 1504(d)(5)(A).
---------------------------------------------------------------------------
Finally, CISA includes a provision that could call into question
DHS's important and proper role as the lead civilian portal for
private-sector information-sharing with the Government. Under CISA, if
a company wants to receive liability protection for sharing cyber
threat indicators with the Federal Government, it must share that
information through an authorized portal.\11\ Currently, DHS is the
only authorized information-sharing portal. However, CISA authorizes
the president to establish a secondary portal at any Federal entity
except for the Department of Defense and the National Security
Agency.\12\
---------------------------------------------------------------------------
\11\ Supra note 1, at 1505(b).
\12\ Id. at 1504(c)(2)(B).
---------------------------------------------------------------------------
If the President were to exercise this authority at a law
enforcement or intelligence oversight agency like the Federal Bureau of
Investigation or the Office of the Director of National Intelligence,
it would significantly threaten privacy and undermine Americans' trust
in the Federal Government's information-sharing program. Additionally,
it would introduce operational weakness by further decentralizing
information sharing and undermining DHS's role and authority as the
Federal Government lead on domestic cybersecurity and private-sector
engagement, which Congress just formally established in 2014.\13\
---------------------------------------------------------------------------
\13\ Robyn Greene, Dangerous for Cybersecurity and Privacy: Cotton
Amendment No. 2581, New America's Open Technology Institute (Aug. 25,
2015), https://www.newamerica.org/oti/blog/dangerous-for-cybersecurity-
and-privacy-cotton-amendment-no-2581/ [analyzing a proposed amendment
to CISA that would have authorized the FBI as an additional covered
information-sharing portal]; and National Cybersecurity Protection Act
of 2014, 6 USC 148 note, et seq., Public Law No: 113-282.
---------------------------------------------------------------------------
OTI believes that these outstanding flaws in CISA pose a clear
threat to both privacy and effective cybersecurity practice, and hopes
that Congress will consider amending it to address those concerns.
However, despite those flaws, on the whole, DHS has done a good job of
promulgating guidelines and procedures under CISA that protect privacy
and strengthen cybersecurity. Congress should support DHS in this
important work.
dhs implementation of cisa has been effective and privacy-protective,
but more should be done to improve information sharing
DHS has taken a reasonable and measured approach to implementing
CISA that balances privacy and security. This is clear from how DHS set
up its Automated Indicator Sharing system (AIS), and how its
promulgation of procedures and guidelines clarified ill-defined terms
and standards in the statute.
When DHS rolled out AIS, it leveraged Structured Threat Information
eXchange (STIX) to establish standardized fields of information that
can be shared and Trusted Automated eXchange of Indicator Information
(TAXII) as the secure, automated method for sharing information.\14\
This was an important step, because by setting out specific,
standardized fields of information that can be shared, STIX limits the
potential for sharing unnecessary personal information.
---------------------------------------------------------------------------
\14\ Company Guidance, supra note 9 at 22.
---------------------------------------------------------------------------
It is still possible for unnecessary personal information to be
shared under CISA, because there are STIX fields that could include it
or that allow a submitter to copy and paste communications content, and
because a submitter could choose to send an email in lieu of submitting
information via AIS. DHS mitigates this privacy risk by ensuring that
any personal information included in one of those three types of
submissions is subject to human review to determine if it is necessary
to describe or identify the threat. The personal information is then
either removed if it does not meet the standard or further disseminated
if it does. DHS also discourages the use of e-mail to submit cyber
threat indicators.\15\
---------------------------------------------------------------------------
\15\ Dep't of Homeland Security & Dep't of Justice, Final
Procedures Related to the Receipt of Cyber Threat Indicators and
Defensive Measures by the Federal Government 8, 10 (2016), https://
www.us-cert.gov/sites/default/files/ais_files/
Operational_Procedures_(105(a)).pdf [hereinafter ``Final
Proocedures''].
---------------------------------------------------------------------------
Additionally, DHS guidance on how to determine if personal
information must be removed is effective at protecting privacy,
considering the requirements of the statute. DHS establishes a clear
application of the test for removal of such information in its guidance
to Federal entities. It lays out the critical three-part test: (1) Do
you know it is ``personal information of a specific individual or
information that identifies a specific individual''? (2) If yes, is it
directly related to the threat? (3) If yes, then the entity may share
it, and if no, then it must be removed prior to dissemination.\16\
---------------------------------------------------------------------------
\16\ Dep't of Homeland Security & Dep't of Justice, Privacy and
Civil Liberties Final Guidelines: Cybersecurity Information Sharing Act
of 2015 12 (2016), https://www.us-cert.gov/sites/default/files/
ais_files/Privacy_and_Civil_Liberties_Guidelines_(Sec%20105(b)).pdf
[hereinafter ``Privacy Guidelines''].
---------------------------------------------------------------------------
Importantly, DHS also narrowly interprets the standard for removal
of personal information in company guidance and in privacy guidelines
for Federal entities. It does so by offering a clear explanation of
what is ``directly related'' to a cybersecurity threat. DHS provides
that ``Information is not directly related to a cybersecurity threat if
it is not necessary to detect, prevent, or mitigate the cybersecurity
threat.''\17\ It also offers examples to illustrate what kinds of
personal information can and cannot be shared. Both documents highlight
that personal information related to victims of cyber attacks, such as
information that identifies the recipient of a phishing email, is not
directly related to a cybersecurity threat, and must be removed before
sharing or dissemination.\18\
---------------------------------------------------------------------------
\17\ Company Guidance supra note 9, at 5.
\18\ Id. See also Privacy Guidelines supra note 16, at 12.
---------------------------------------------------------------------------
The standard for removal of personal information before sharing or
dissemination of cyber threat indicators was one of the most
contentious aspect of the debate. Opponents of a strict removal
requirement were concerned that a higher standard would slow down
sharing and raise questions about when liability protections under the
law are triggered. These concerns have been largely put to rest. In the
vast majority of cases, speed of information sharing is not a
determining factor in preventing an attack. The most recent Verizon
data breach report concluded that 93 percent of successful attacks took
minutes to breach a device or network, but organizations took weeks to
discover them, leaving ample time for the attacker to have identified
and stolen the sought-after data in most cases.\19\
---------------------------------------------------------------------------
\19\ Verizon, 2016 Data Breach Investigations Report: Executive
Summary 2 (2016), http://www.verizonenterprise.com/resources/reports/
rp_dbir_092016-executive-summary_xg_en.pdf. Full report available at
http://www.verizonenterprise.com/verizon-insights-lab/dbir/2016/.
---------------------------------------------------------------------------
DHS's application of this standard for removal is also aligned with
Congress' goal in passing CISA: to enhance security while
simultaneously protecting privacy. Personal information is constantly
targeted by hackers, as we have seen in countless data breaches,
whether they be at Government agencies like the Office of Personnel
Management (OPM), health care providers like Anthem, retailers like
Target and Home Depot, financial institutions like J.P. Morgan, or
technology companies like Yahoo.\20\ The more personal information is
shared with more entities, the larger the target for malicious hackers
and nation-states seeking to breach our defenses.\21\ Thus, by reducing
the amount of personal information shared under CISA, DHS is serving a
critical security function, as well as protecting privacy.
---------------------------------------------------------------------------
\20\ See Brian Naylor, One Year After OPM Data Breach, What Has The
Government Learned?, NPR, Jun. 6, 2016, http://www.npr.org/sections/
alltechconsidered/2016/06/06/480968999/one-year-after-opm-data-breach-
what-has-the-government-learned; Steve Ragan, Anthem: How Does a Breach
Like This Happen? CSO, Feb. 9, 2015, http://www.csoonline.com/article/
2881532/business-continuity/anthem-how-does-a-breach-like-this-
happen.html; Michael Kassner, Anatomy of the Target Data Breach: Missed
Opportunities and Lessons Learned, ZD Net, Feb. 2, 2015, http://
www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-
opportunities-and-lessons-learned/; Julie Creswell & Nicole Perlroth,
Ex-Employees Say Home Depot Left Data Vulnerable, NY Times, Sept. 19,
2014, https://www.nytimes.com/2014/09/20/business/ex-employees-say-
home-depot-left-data-vulnerable.html?partner=rss&emc=rss&_r=2; Matthew
Goldstein, Nicole Perlroth & Michael Corkery, Neglected Server Provided
Entry for JPMorgan Hackers, NY Times, Dec. 22, 2014, https://
dealbook.nytimes.com/2014/12/22/entry-point-of-jpmorgan-data-breach-is-
identified/?_r=1; and Asha McLean, Yahoo Says 32m User Accounts Were
Accessed via Cookie Forging Attack, ZD Net, Mar. 2, 2017, http://
www.zdnet.com/article/yahoo-says-32m-user-accounts-accessed-via-cookie-
forging-attack/.
\21\ Robyn Greene, Is CISA Gift-wrapped for Hackers and Nation-
State Actors? The Hill, Aug. 3, 2015, http://thehill.com/blogs/pundits-
blog/technology/250070-is-cisa-gift-wrapped-for-hackers-and-nation-
state-actors.
---------------------------------------------------------------------------
Privacy is not only essential to data security but also to trust.
To the extent that information sharing is an important element of a
holistic cybersecurity strategy, having adequate standards in the law
and its application are essential to expanding its reach and impact.
Companies will be uncomfortable sharing information if they worry their
users will see it as harmful to their privacy. Indeed, 2 months before
CISA's final passage, many leading technology companies and trade
associations specifically cited its insufficient privacy protections as
their grounds for opposition to the bill.\22\
---------------------------------------------------------------------------
\22\ Robyn Greene, Tech Industry Leaders Oppose CISA as Dangerous
to Privacy and Security, The Hill, Oct. 21, 2015, http://thehill.com/
blogs/pundits-blog/technology/257601-tech-industry-leaders-oppose-cisa-
as-dangerous-to-privacy-and.
---------------------------------------------------------------------------
Though DHS has done a good job implementing CISA in a manner that
protects privacy and enhances security, Congress should address the
outstanding concerns outlined above by codifying these sensible
implementations in the law itself. This would provide the public and
the private sector with the assurance that the protections as applied
by the various guidelines and procedures will not be altered or
reinterpreted in a manner harmful to privacy by this or any future
administration.
Finally, more must still be done to increase information sharing by
the Government with the private sector. Throughout the debate on
information sharing security experts were clear that CISA would likely
have only a modest impact on security, if it had any impact at all,
because it focuses on increasing information sharing from the private
sector to the Government or to other private-sector entities. These
experts argued that in order to enhance cybersecurity by increasing
information sharing, the Government needs to improve its system for
sharing actionable information with the private sector. Specifically,
experts called on the Government to declassify more information and
share it with a broader set of stakeholders, to speed up its
declassification process, and to expand the pool of stakeholders that
are cleared to receive Classified indicators.\23\ Congress should look
to how it can help DHS address these concerns.
---------------------------------------------------------------------------
\23\ Sara Sorcher, Security Pros: Cyberthreat Info-sharing Won't Be
as Effective as Congress Thinks, Christian Sci. Monitor, Jun. 12, 2015,
http://www.csmonitor.com/World/Passcode/2015/0612/Security-pros-
Cyberthreat-info-sharing-won-t-be-as-effective-as-Congress-thinks.
---------------------------------------------------------------------------
While improving information sharing can be an important element to
cybersecurity, it is just one of many steps that must be taken overall.
Ultimately, the only effective approach to cybersecurity will be a
holistic approach.
additional steps to strengthen private sector-public sector
partnerships to improve cybersecurity and protect privacy
OTI has long argued that while information sharing can have value,
it is only a part of the more holistic approach to cybersecurity that
Congress, the Federal Government, and the private sector must take.
That approach necessitates more resources for the Federal Government,
as well as more public education about cybersecurity threats and how to
defend against them. The Federal Government also needs to take a
``whole-of-Government'' approach to cybersecurity issues. This is
especially needed in two areas: The establishment of policies on
vulnerabilities management, and identifying ways to encourage users and
private companies to adopt security best practices, like increasing the
use of multi-factor authentication and encryption.
Ensuring that all agencies have sufficient resources to buy newer,
more secure hardware and software systems, and to recruit and retain a
robust staff of skilled security and technology policy experts, has
been a long-standing problem. This was one of the problems that led to
the OPM breach that resulted in the exfiltration of over 20 million
records. Ann Barron-DiCamillo, DHS lead on the team that investigated
the breach, stressed that ``[OPM] had older systems, that needed to be
modernized . . . They had neglected networks from the perspective of
putting in the cybersecurity sensors and technologies that they need to
find adversaries in the network.''\24\
---------------------------------------------------------------------------
\24\ One Year After the Government Data Breach, supra note 20.
---------------------------------------------------------------------------
Less than a year after the OPM breach became public, the previous
administration announced the establishment of the President's
Commission on Enhancing National Cybersecurity.\25\ The commission
concluded its work with the issuance of the Cybersecurity National
Action Plan (CNAP). Many of the Commission's recommendations focused on
adequately resourcing the Federal Government. They recommended
increasing the cybersecurity budget to $19 billion in fiscal year 2017,
including investing $3.1 billion in information technology
modernization to ensure that Federal devices and networks would be
compatible with modern security tools; and allocating an additional $62
million to training and hiring new cybersecurity personnel.\26\
---------------------------------------------------------------------------
\25\ Michael Daniel, Ed Felten, & Tony Scott, Announcing the
President's Commission on Enhancing National Cybersecurity, The White
House, Apr. 13, 2016, https://obamawhitehouse.archives.gov/blog/2016/
04/13/announcing-presidents-commission-enhancing-national-
cybersecurity.
\26\ Press Release, Office of the Press Secretary, White House,
Fact Sheet: Cybersecurity National Action Plan (Feb. 9, 2016), https://
obamawhitehouse.archives.gov/the-press-office/2016/02/09/fact-sheet-
cybersecurity-national-action-plan.
---------------------------------------------------------------------------
These recommendations to significantly increase Federal spending
related to cybersecurity are well taken, considering the scale of
attacks on Federal Government networks in recent years and the
difficulty the Federal Government has hiring and retaining
cybersecurity experts.\27\ As Congress drafts the budget for fiscal
year 2017, it should allocate whatever resources will be necessary to
hire a skilled workforce, and to modernize Federal Government networks
and harden them against attacks.
---------------------------------------------------------------------------
\27\ Dustin Volz & Warren Strobel, NSA Risks Talent Exodus Amid
Morale Slump, Trump Fears, Reuters, Feb. 28, 2017, http://
www.reuters.com/article/us-usa-cyber-nsa-idUSKBN1672ML.
---------------------------------------------------------------------------
In addition to proper resourcing, the Federal Government, including
DHS, should continue its efforts to educate industry and the public
about how to better protect themselves on-line. Increased education on
how to identify social engineering attacks is particularly needed.
Internet users' susceptibility to these kinds of threats has proven to
be a somewhat intractable problem over the years. The most recent
Verizon data breach report found that 30 percent of recipients of
phishing emails opened them (a 23 percent increase from the prior
year), and 12 percent of those people downloaded the malicious
attachment or clicked on the malicious link.\28\ Nonetheless, raising
awareness of these threats via campaigns like ``Stop. Think. Connect.''
may be the first step to reducing the threats' effectiveness.\29\
---------------------------------------------------------------------------
\28\ Supra note 19, at 3.
\29\ Stop. Think. Connect., Dep't of Homeland Security, https://
www.dhs.gov/stopthinkconnect (last visited Mar. 5, 2017).
---------------------------------------------------------------------------
While resourcing and education are important, DHS must also be part
of a whole-of-Government approach to cybersecurity and engagement with
the private sector. Two areas that could most positively impact our
Nation's cybersecurity are vulnerability management and wide-spread
adoption of security best practices.
One key aspect of vulnerability management is incentivizing the
private sector and individuals to protect themselves against known
vulnerabilities by regularly updating their software so that known
vulnerabilities are patched. Yet for 8 years, Congress focused almost
entirely on how to increase information sharing about those
vulnerabilities, without doing anything to help ensure that they are
patched. Indeed, CISA explicitly states that a company is not required
to act on the threat information it receives.\30\
---------------------------------------------------------------------------
\30\ Supra note 1 at 1505(c)(1)(B).
---------------------------------------------------------------------------
Unsurprisingly, the private sector often only takes action to
update their systems after a massive breach, but maintaining updated
software would protect against the vast majority of threats.
Approximately 85 percent of successful exploits used the same 10
vulnerabilities, all of which have patches available.\31\ In order for
CISA to have its intended impact, the Government and the private sector
must turn information sharing into action by encouraging more and more
regular patching of known vulnerabilities.
---------------------------------------------------------------------------
\31\ Supra note 19 at 10.
---------------------------------------------------------------------------
Another critical aspect to vulnerabilities management concerns how
the Federal Government and Congress approach laws and policies
impacting vulnerability research and disclosure, and Government
participation in the market for previously undiscovered
vulnerabilities, called ``zero-days.'' Last year, OTI published a
research paper called ``Bugs in the System'' that serves as a primer on
the vulnerabilities ecosystem. We concluded that the leading factors
hindering effective vulnerabilities management were a lack of clarity
about how best to disclose newly-discovered vulnerabilities in order to
see them patched; the chilling effect that out-of-date technology laws
have on security researchers; and the existence of and U.S. Government
participation in the zero-day market.\32\
---------------------------------------------------------------------------
\32\ Andi Wilson, Ross Schulman, Kevin Bankston & Trey Herr, Bugs
in the System, New America's Open Tech. Institute (July 2016), https://
na-production.s3.amazonaws.com/documents/Bugs-in-the-System-Final.pdf.
---------------------------------------------------------------------------
We made five recommendations as to how Congress and the Federal
Government could most effectively address these issues:
1. The U.S. Government should minimize its participation in the
zero-day market: The zero-day market incentivizes selling
vulnerability information to the highest bidder rather than
disclosing it to the vendor so it can be fixed, and it caters
to the intelligence and law enforcement arms of democratic
governments and repressive regimes alike, as well as spies and
criminals. The U.S. Government can significantly shrink this
market simply by abstaining from it and instead relying on and
growing resources and technical expertise at agencies like the
NSA;\33\
---------------------------------------------------------------------------
\33\ Id. at 21.
---------------------------------------------------------------------------
2. The U.S. Government should establish strong, clear procedures
for Government disclosure of the vulnerabilities it buys or
discovers: When the Government discovers or purchases
vulnerabilities that put American internet users and companies
at risk, it should ensure that they are disclosed and patched
as soon as possible. While there is a process, called the
Vulnerabilities Equities Process (VEP), to decide when the
Government should disclose vulnerabilities, little is known
about how that process works, how often it is used, and how
effective it is at ensuring vulnerabilities are disclosed.
Congress should investigate this issue, and then codify a
process that agencies would be required to follow, and that
heavily favors disclosure;\34\
---------------------------------------------------------------------------
\34\ Id. at 21-22.
---------------------------------------------------------------------------
3. Congress should establish clear rules of the road for Government
hacking in order to protect cybersecurity in addition to civil
liberties: Government hacking is as privacy-invasive as
wiretapping, and it introduces a set of unique risks to
security and to civil liberties, such as Government malware
spreading to innocent people's computers, or resulting in
unintended damage or the creation of new vulnerabilities. Yet,
Congress has not established a clear legal framework for
Government hacking, with rules and constraints that address
these unique concerns, as it did to address concerns associated
with wiretapping;\35\
---------------------------------------------------------------------------
\35\ Id. at 23.
---------------------------------------------------------------------------
4. Government and industry should support bug bounty programs as an
alternative to the zero-day market and investigate other
innovative ways to foster the disclosure and prompt patching of
vulnerabilities: We can improve security by creating more
avenues through which security experts can disclose
vulnerabilities and diverse incentives for disclosing them,
like through Vulnerability Reward Programs, often referred to
as bug bounty programs. These programs also provide an outlet
for researchers who do not want to participate in the zero-day
market; and\36\
---------------------------------------------------------------------------
\36\ Id.
---------------------------------------------------------------------------
5. Congress should reform computer crime and copyright laws, and
agencies should modify their application of such laws, to
reduce the legal chill on legitimate security research: Out-of-
date laws like the Electronic Communications Privacy Act
(ECPA), the Computer Fraud and Abuse Act (CFAA), and the
Digital Millennium Copyright Act (DMCA), chill security
research. This is because under these laws, security
researchers are threatened with criminal and civil penalties
for their efforts to identify vulnerabilities and fix them.\37\
---------------------------------------------------------------------------
\37\ Id. at 24.
---------------------------------------------------------------------------
Finally, in addition to improving vulnerabilities management, the
Federal Government must work with the private sector to help drive a
cultural shift in Government and industry that embraces privacy by
design, and that fuels wide-spread adoption of security best practices.
OTI recently launched a project called ``Do the Right Thing'' in which
we studied the factors that led to the wide-spread industry adoption of
now common, though not yet ubiquitous, security tools like transit
encryption by default and offering two-factor authentication. We found
that Government was often influential in spurring increased adoption of
these tools.\38\
---------------------------------------------------------------------------
\38\ Kevin Bankston, Ross Schulman & Liz Woolery, Getting Internet
Companies To Do The Right Thing, https://www.newamerica.org/in-depth/
getting-internet-companies-do-right-thing/ (last visited Mar. 5, 2017).
For a summary of all of the most common factors spurring the spread of
three privacy and security best practices, see Kevin Bankston, Ross
Schulman & Liz Woolery, Key Lessons, https://www.newamerica.org/in-
depth/getting-internet-companies-do-right-thing/key-lessons/ (last
visited Mar. 5, 2017).
---------------------------------------------------------------------------
DHS and other relevant Federal agencies should champion the use of
multi-factor authentication and of encryption to protect stored data
and communications in transit.\39\ DHS should also work with relevant
Federal entities and industry leaders to encourage a ``privacy by
design'' approach to product development, including employing security
mechanisms like automatic software updates and offering multi-factor
authentication and encryption services by default. Thinking about
security holistically and from the ground up will be especially
important as more devices become connected and the internet of things
morphs into simply ``the internet.''
---------------------------------------------------------------------------
\39\ The question of how to address law enforcement access to
encrypted communications has been the subject of intense controversy
for several years. OTI strongly opposes any policy proposal that would
amount to a mandate for exceptional access to encrypted communications,
commonly referred to as encryption backdoors. For a detailed
explanation of OTI's position on exceptional access for law
enforcement, see Kevin Bankston, Written Statement to the House
Committee on Oversight & Gov't Reform Subcommittee on Information
Technology. Encryption Technology and Possible U.S. Policy Responses,
Hearing, Apr. 29, 2015, http://oversight.house.gov/wp-content/uploads/
2015/04/4-29-2015-IT-Subcommittee-Hearing-on-Encryption-Bankston.pdf.
For more materials on OTI's position on encryption, see Read this
Before You Rail Against Encryption, New America's Open Tech. Institute
(Nov. 19, 2015), https://www.newamerica.org/weekly/101/read-this-
before-you-rail-against-encryption/.
---------------------------------------------------------------------------
In conclusion, while CISA improved in some areas over the course of
the Congressional debate, the final law left certain privacy concerns
unresolved and in need of reform. CISA also addresses only a fraction
of what Congress and industry should be thinking about as they work to
enhance cybersecurity. The focus must now turn to an outcomes-based
approach. Congress must ensure that all Federal agencies, including
DHS, have the resources necessary to hire robust teams of security and
technology policy experts, and maintain modern and up-to-date systems
and equipment. It will also be essential to find ways to incentivize
the private sector and individuals to take action based on new
information, such as patching known and newly-discovered
vulnerabilities and clarifying the Government's approach to
vulnerabilities management in general. Finally, the relevant Federal
agencies should take advantage of their bully pulpit to encourage
broader adoption of security best practices like the use of encryption
and two-factor authentication.
Mr. Ratcliffe. Thank you, Ms. Greene.
Thanks all the witnesses for your testimony.
I now recognize myself for 5 minutes to ask questions.
In my opening remarks, I talked about the fact that we have
got a new administration and with that provides us an
opportunity to regroup and reassess.
I want to ask a broad question and give you all an
opportunity to answer this.
To the extent that, you know the President's cybersecurity
advisers, maybe even Secretary Kelly are listening to our
hearing today or are subsequently briefed on it, if you had the
opportunity to tell them to focus on one or two of the highest
priorities or specific action items that you think that this
administration ought to be focused on with respect to its DHS
mission, what would that be? It could relate to private-sector
relationships for cybersecurity or protection of our critical
infrastructure at large.
But if you had that message to give, what would it be?
So let me start with you, Mr. Nutkis.
Mr. Nutkis. Thank you, Mr. Chairman.
So I think from an ISAO perspective, the guidance we want
is, what are the expectations and the role? I think, as the
other testifiers have presented, we in industry are willing to
step up and provide a lot of the interface. So with regards to
AIS, we do that directly. So everyone in industry connects with
us, we connect with DHS. We deal with a lot of the
anonymization, a lot of the accuracy issues. So for us, it is
guidance in working with what the expectations are.
We deal with a lot of the--we were sharing before the
liability protections in CISA. We would like to see those
increased and better guidance. So we would like to see clarity
around the expectations from industry.
Then with regards to the framework, I will echo those
sentiments is, it is voluntary and each industry has its own
interpretation of the guidance and the guidelines that are
established.
So the cybersecurity framework is a high-level framework.
Each industry then has to customize it for their own
requirements and then it has got to be customized specifically
to the organization.
I just want to make sure there is clarity that one size
does not fit all. There has got to be the ability for
industries and organizations to be able to implement that based
on the specific needs in a voluntary basis.
Mr. Ratcliffe. Thank you.
Mr. Montgomery.
Mr. Montgomery. Thank you. It is labor, labor, trained
labor. As we have all talked about, the size and scale of the
footprint, the impact upon our lives, the cyber impact upon our
lives, it grows by leaps and bounds every minute. The notion
that we are going to out-labor this one person at a time is
preposterous.
So if we break labor into two buckets, bucket No. 1 is,
certainly there is a shortfall, not only, as Ms. Greene pointed
out, in the public sector, but also in the private sector. We
are having trouble hiring people, too. So an intense focus upon
education, making cyber a desirable career and an accessible
career across a wide, disparate labor force that wants to work
in cyber is essential.
But also, the need for reduced labor. We are not going to
out-labor this problem one person at a time. So information
sharing, automation, the ability to act at machine speed.
Our adversaries, as Mr. Greene pointed out earlier, they
already utilize machines in order to further their campaigns
and make it more automated. We need to be doing the same thing,
not only with information sharing, but how we act on behalf of
critical infrastructure.
Mr. Ratcliffe. Thank you.
I will just say we have talked about the cyber work force
as a priority of this subcommittee going forward, so I was glad
to get your remarks.
Mr. Greene.
Mr. Jeffrey Greene. So focusing on DHS, I think we need a
clear statement. I would like to see a clear statement from the
administration that there will be a civilian lead for, you
know, continuing DHS, a civilian lead for the civilian cyber
effort. I think it is important to send a message both to the
companies that have developed relationships with DHS to know
those are going to continue and also around the globe.
Secondarily is something that you mentioned in your opening
statement, look at the operationalization of DHS. From our
perspective having a long relationship, we know where the touch
points are. We know who does cyber in DHS, who we reach out to
for a specific issue. But if you don't know the structure and
you are on the outside looking in, it is really hard to discern
who does cyber, where you want to go to.
I do think aggregating the functions in a central place and
providing an operational context to it is important.
Mr. Ratcliffe. Thank you, Mr. Greene.
Mr. Gillis.
Mr. Gillis. So I would focus very much on implementation.
We are at a place right now where there aren't massive
statutory barriers to executing the cybersecurity mission. We
need to implement more effectively.
We have had a 10-year discussion within this country about
roles and missions of DHS, of DOD, of the intelligence
community, of law enforcement, how all of those entities can
work together with the private sector and internally. And not
re-litigating that and moving forward with being more effective
on the operational environment under that broad policy
construct would be essential.
So what we have seen in at least some of the publicly-
available iterations of the draft Executive Order on
cybersecurity I think has been a progression to get back under
that framework, where the roles and responsibilities reflect
continuity from the Bush administration, CNCI, Comprehensive
National Cybersecurity Initiative, through the Obama
administration policy, through the bipartisan legislation that
this committee has led. So not re-fighting the turf battles and
the roles and missions and getting to a point where we can
execute in a way that is automated and efficient is where I
would focus.
Mr. Ratcliffe. Terrific, thanks very much.
Ms. Greene.
Ms. Robyn Greene. Thank you. I think the things that I
would convey would be in terms of the guidance that DHS
promulgated to implement CISA. I hope that this committee and
the administration will continue to support DHS in that
important work and not do anything to water down the
protections or articulations of the definitions in the
guidance.
As we know, privacy and security are inextricably
intertwined. As Mr. Gillis pointed out, it is very important
that information be actionable. I think that one of the things
DHS did very well in promulgating this guidance is ensuring
that companies focus on sharing actionable information. So
supporting that effort will be critical.
Additionally, making sure that information is a two-way
street, ensuring that DHS starts to do a better job of getting
information to the private sector and doesn't just rely on
information sharing be from private sector to the Government.
I would also agree with the need to increase resources and
to ensure that agencies have the funding that they need to hire
the best people and to update their systems, as I noted in my
opening statement.
Finally, empowering DHS to work with Federal agencies to
shore-up their systems. One of the things that had been
contemplated in the Executive Order is bringing the Department
of Defense more into that work. I think that would be a
mistake.
Having civilian control over domestic cybersecurity was one
of the main points of contention during the debate over CISA
and, as Ryan just pointed out, has been settled. I think that
we should start moving forward instead of moving back and re-
litigating past debates.
Mr. Ratcliffe. I thank you all. I think you gave some very
thoughtful, helpful, and constructive answers. So I appreciate
that.
The Chair now recognizes the Ranking Minority Member, Mr.
Richmond, for his questions.
Mr. Richmond. Thank you, Mr. Chairman.
Ms. Greene, I will start actually where you were leaving
off in terms of the guidance that DHS was able to issue. But I
guess my question would be, are there privacy issues that DHS
did not or could not rectify through guidance? If so, what were
they?
Ms. Robyn Greene. Thank you, that is a really important
question. So there were a few areas that DHS was not able to
address through its guidance, primarily the over-broad law
enforcement use authorizations and the potential for the
President to establish a second authorized portal for
information sharing.
I will elaborate on why the potential for a second portal
is particularly concerning. First, having that second portal
would decentralize the information-sharing process, which is
anathema to the purpose of CISA. It would reduce situational
awareness.
Second, it would create confusion as to the DHS's role as
the civilian lead in the Federal Government in information
sharing with the private sector.
It would also waste taxpayer dollars. It would result in
bypassing the work and resources that have been put into
standing up the NCCIC in order for them to develop the
relationships that they have developed with the private-sector
entities.
Finally, if the second portal was set up in a law
enforcement agency or an intelligence oversight agency, like at
the FBI or the director of national intelligence, it would
undermine user trust, which is just essential for companies to
feel comfortable engaging in the information-sharing program.
Mr. Richmond. Do you expect the administration to address
any of that? Or what are you hearing?
Ms. Robyn Greene. I haven't heard anything with regard to
how the administration will be approaching changing DHS's
implementation of its guidance or sort-of reopening CISA to
amend these problems. I would certainly encourage Congress to
start thinking about whether it would be possible to amend CISA
to address those concerns.
But most importantly, I hope that this committee will work
to bolster DHS in its efforts to implement CISA in the manner
that it is done, which is balancing privacy and security.
Mr. Richmond. Thank you.
I will ask this question to the panel since we have a whole
bunch of experts here.
We hear a lot about whether DHS's automated indicator
sharing is or isn't working. For instance, whether the data is
timely, whether the volume of data is manageable and the cost
of running the program.
So from your perspective, can you tell us what is fact and
what is fiction in terms of the automated indicator sharing?
Mr. Nutkis, if you want to start.
Mr. Nutkis. Sure. So having been involved in information
sharing now for 5 years within the industry and now with
Government, it is an iterative process. So ourselves in
industry had a substantial problem in trying to collect IOCs.
We went from 4 percent of the organizations contributing to 100
percent through the enhanced IOC program and accuracy. So we
realize it is iterative.
Our experiences are quite positive. We had initial
technical issues. We realized, by the way, that there aren't a
substantial number of organizations that are sharing. But we
have seen more and more that are sharing and we are getting
better and better indicators back.
No question that it is not as effective as it could be. But
based on where we were 5 years ago, they certainly have made a
lot more progress in a short amount of time. So we actually
have high hopes that if they can encourage other organizations
to share, and that is really what it comes down to, you know,
we see a ton of situational awareness across our sector, we
would like to see more across the other sectors. We certainly
would like to see more information disclosed from Government.
But the progress we have seen is positive.
Mr. Montgomery. I will give you both the good and the bad.
I agree with Mr. Nutkis. What I think is good is that we are
establishing the right kinds of muscle memory.
Ten years ago, 15 years ago, the idea of sharing an
information security tidbit with a third party was anathema. I
mean, it wasn't done. In fact, it was considered
counterproductive. So I think we are establishing very, very
good muscle memory. The sharing of IOCs among disparate third-
party public and private organizations, that is good muscle
memory.
On the downside, what is actually being shared and its
usefulness and its timeliness, yes, we do need to improve. For
example, if you were an auto mechanic and I handed you a bolt
and said, OK, fix it, you wouldn't really understand where the
bolt was from on the car or what kind of manufacturer it was
from or whether it was a car or a truck. You would just
understand that I had a problem. I think once we say, hey, this
bolt fell off of my 1967 Fiat, now you are starting to
understand the context that is required.
I believe the muscle memory and the sharing will get us
toward those, but certainly we need some better guidelines
about what constitutes good data coming in.
Mr. Jeffrey Greene. I would echo what Mr. Montgomery said.
I think probably one of the most significant wins is that we
now have a formal process, we are not relying on just
relationships.
We are right now in the midst of an analysis as to whether
it makes sense for us to really jump in on AIS. One of the
things we are looking at is how much work it takes to really
make sense to figure out that the nut came from a Fiat once we
get data back.
We are in a little different position just because of the
volume of data that we get in through our own sensors. So there
is, you know, a lot of information we have already obtained on
our own, so there may be less unique data than other
organizations.
But we have reviewed in the past and are now revisiting
again to see if it has evolved to a place where it is useful to
us. So we are looking at the questions that you asked, right
now. But the most important thing, though, is we now have a
formal process as opposed something that is purely
relationship-based.
Mr. Gillis. So on the operational side, I would echo all of
these statements, which is that AIS has the right foundation.
It needs to be sharing more particularly on the context side.
If you look at the Cyber Threat Alliance, the way that we are
now sharing is not just a quantity of indicators of compromise,
you have to actually share with context. So what phase of the
attack is this in? Is it intelligence and reconnaissance? Is it
command-and-control? Is it linked to a known campaign?
With that broader context, if AIS can incorporate some of
those technological best practices, it will be far more
valuable in what it does.
On the programmatic side, this seems simple, but I have
talked to DHS about this, so as a DHS alum I wanted to stick
with this. There are some challenges to just on-boarding. They
are short-staffed and there is not a real customer service
focus to outreach to the private sector and bring even willing
participants on in a timely and effective manner.
So they recognize that. It is something that is very much
correctable, but it would go a long way as you go out to
companies and try and build trust, because AIS is only going to
be more effective with more parties involved. Making that
process as easy as possible is an administrative thing that I
think can add real operational value.
Mr. Richmond. Let me thank you.
Mr. Montgomery, you must be a golfer because you used
``muscle memory'' as opposed to just saying habit or something.
But just thought I would point that out. Thanks.
Mr. Ratcliffe. The gentleman yields back.
The Chair now recognizes the gentleman from Wisconsin, Mr.
Gallagher. The Chair also welcomes him and Mr. Fitzpatrick and
Mr. Garrett and Mrs. Demings to our subcommittee. We are glad
to have you all.
With that, the gentleman is recognized.
Mr. Gallagher. Thank you, Mr. Chairman.
Mr. Montgomery and Mr. Greene, at the end of the second
quarter of 2016, I believe Amazon and Microsoft, IBM and Google
combined for about 55 percent of the global cloud
infrastructure market share. What more could we be doing as a
committee to ensure security of that vital cloud computing
system? Is there any more attention we need to be paying to the
actual physical security of these systems as we talk about
securing sort of cyber space?
Just easy questions today.
[Laughter.]
Mr. Montgomery. Boy, that is a big-boy-pants question.
[Laughter.]
Mr. Gallagher. The only kind of pants we wear on this
committee.
[Laughter.]
Mr. Montgomery. All right. So let us start with hardware
and physical security because I think it is foundational,
whether it is cloud or whether it is brick-and-mortar.
One of the things that we recognize across the technical
folks on the committee is that if you don't have a good
foundation, the pyramid gets top-heavy very, very quickly. So
underlying chip-level, firmware-level security is essential in
the trust model.
Because what you are doing when you go to a--now, when we
do go to the cloud, you are basically renting a data center
from somebody else. So the physical controls and the physical
security and the chip-level security have to be sacrosanct.
Intel has long led with respect to this with a series of
freeware tools that are available in order to test the efficacy
and tamper-proof or tamper state of the firmware and chips that
the commonly-used cloud providers utilize.
I think that one of the things that is challenging about
cloud is that, just like any other technology, it is not a
panacea. It is a useful tool for solving a series of problems.
But one of the things that I think Government can do is help
establish, what problem are you trying to solve? Are you trying
to buy CPU cycles very cheaply? The cloud is the best way for
doing that. Are you trying to have highly regulated or
Classified or Sensitive data housed at the same security as
brick-and-mortar, but have someplace else or somebody else do
it? Your mileage may vary on costs. You will get there, but
your costs will wind up being different.
So what can we do? Homeland's role here in terms of
communication is essential. What do we mean by cloud? If I
asked all of the committee Members or subcommittee Members, you
would all have your own idea on what cloud means.
So putting some definitions around what we mean, what the
best uses are, what Government should be doing or potentially
not doing, where brick-and-mortar is appropriate versus cloud
is a great start to helping to identify not only what should we
doing at home in our own data closet, but also which third-
party partner that you mentioned should we be going to and why.
I think that is a great start.
Mr. Jeffrey Greene. So I would start by cloud is a
different domain, a different environment, but a lot of the
same risks and threats. So let us not overthink in the sense
that we have to come up with something brand new. I would apply
the same thing to this internet of things which is growing. Let
us not forget the lessons we have learned and act like we have
to start from scratch.
So a lot of the same traditional cyber hygiene is going to
apply. I think you also need to distinguish between whether we
are talking about securing the actual cloud provider or
securing the user of the cloud.
Then you get get down to risk-based decisions. If I am
using the cloud to host my kid's Minecraft site, probably not a
high-level security needed. If a power generation plant or some
critical infrastructure is using the cloud for some capacity,
much higher need for security there. In that case, you have to
think about what is the obligation for both the cloud provider
and the organization that chooses to use the cloud, which is a
fine decision.
Here, I think the NIST framework comes in well, both for
the cloud provider and the user. Use the risk-based
calculations in the framework to figure out what you are doing
right, what you are doing wrong, where your gaps are, how you
improve them. So I would encourage you to think about it from
both ends.
Mr. Gallagher. Great. Quickly, Mr. Gillis, in the 30
seconds we have, one of your co-founders is Israeli. Every day
I hear about a new Israeli company in this space. What are we
doing with them now? What can we learn from the Israelis who
seem to be a leader in this space?
Mr. Gillis. Sure. So there are certainly some lessons
learned from Israel. It is obviously a very different dynamic
and not just the neighborhood that they are in, but the
mandatory service. So there is a lot of institutional knowledge
as well as Israel as a government has done a lot both to
attract American company investment and to ensure that those
that they have within country that have expertise are supported
from a venture capital perspective as they transition to the
private sector.
I would also echo on the cloud side of things, too, you
know, fundamentally, we talked earlier, you have got to protect
your customers wherever their data resides and transits. So as
Jeff has said, you need to move effective technology geared to
the specific how of defending a cloud and evolve that into that
new area.
But the principle remains the same, which is that you need
to be secure, whether it is in a data center, whether it is at
a terminal, or on a mobile device.
Mr. Gallagher. Thank you.
Thank you, Mr. Chairman.
Mr. Ratcliffe. The Chair recognizes the gentlelady from
Florida, Mrs. Demings.
Mrs. Demings. Thank you. Thank you to our witnesses for
being with us today.
Ms. Greene, as we continue to assess the impact of cyber
intrusions and begin to make adjustments to cyber policies
based on what we know about these intrusions, what must we keep
in mind on the privacy and the civil liberties front to make
sure we balance security with the privacy concerns?
Ms. Robyn Greene. Thank you. I think ensuring that we
maintain a civilian lead within the Federal Government on
cybersecurity is going to be absolutely essential as we move
forward in this space.
Additionally, always remembering that the more we are
protecting privacy, the more we are increasing security. Well-
curated information is going to be one of the best tools that
we have and security experts are in nearly unanimous agreement
that that almost never includes information like communications
content or personally identifiable information.
So as we move forward, ensuring that whatever new
undertakings, you know, lay ahead and whatever changes to the
guidance that may be made for CISA, we always keep privacy and
minimizing unnecessary information sharing at the forefront.
Mrs. Demings. Also for Ms. Greene, in President Obama's
cybersecurity Executive Order, there was a designated role for
the Privacy and Civil Liberties Oversight Board. Should this
board have a designated role in future Executive Orders and
legislation? How important is it to have a fully functioning
Privacy and Civil Liberties Oversight Board?
Ms. Robyn Greene. So in previous iterations of information-
sharing legislation, there had also been a role for the Privacy
and Civil Liberties Oversight Board contemplated. OTI supported
the inclusion of the PCLOB as an entity to oversee the
implementation of information-sharing programs.
Whether it is expanded into the cybersecurity space or not,
the Privacy and Civil Liberties Oversight Board plays an
incredibly important role in Americans' privacy. It not only
conducts oversight of counterterrorism activities for the
Federal Government and their implications on privacy and civil
liberties, it also serves as a sounding board for the
intelligence community to ensure that they are doing things in
the best way for privacy possible.
Oftentimes, the PCLOB will actually raise concerns or make
suggestions about how the intelligence community can be
improving privacy that they simply hadn't thought of yet. So
they do play a critical role in bolstering Americans' privacy
and civil liberties.
Mrs. Demings. Thank you.
This next question is, for the sake of time, for any
witness who feels it is more appropriate for them.
For a long time, the information-sharing conversation has
been stuck on gathering data, either making it easier to
participate or offering incentives to share.
It is time to start shifting our attention to focus on what
we should do with the cyber threat data that we collect?
Mr. Jeffrey Greene. Real quick, I think I am very pleased
to hear the idea of shifting away from incentives, not that
companies or organizations are going to turn them down. But at
the highest policy level, I have always had a little discomfort
with this notion that we need to give incentives for people to
improve their cybersecurity. It is not something that we should
have to incent people to do.
We need to get to a world where securing your data, whether
your personal, your corporation, your pizza shop, is the same
as locking your door. In college I worked at a bicycle store,
and when I left at night no one had to incent me to lock the
door so someone wouldn't steal my bikes. I think we need to get
to a place in cybersecurity where the mind-set is that this is
just a reality of doing business.
I do have some concern that a continuing discussion of
incentives perpetuates this idea that cybersecurity is some
extra that we need to encourage people to do as opposed to just
the reality of the world we live in today.
Mr. Nutkis. Just to give you a perspective from industry,
so we use the terms ``consumption'' and ``actionability.'' I
think the problem is, is that we work with Fortune Six
organizations and we work with two-doc practices. So when we
are talking about the shift, we also have to shift the
approach.
I think we have piloted and we have seen methods of high-
tech, low-touch where, you know, we hear from the smaller
organizations that they just don't have the resources, they
don't have the appetite. They are trying to screen patients for
Zika virus or other things and that is what they are going to
worry about. They are not worrying about information security.
They expect that that will be an automated process that the
vendors are going to have to figure out how to automate that
process.
So it is not a one-size-fits-all, but the consumption and
actionability is clearly an issue we have to shift to.
Mrs. Demings. Great, thank you so much.
Mr. Ratcliffe. The Chair now recognizes the gentleman from
Pennsylvania, Mr. Fitzpatrick.
Mr. Fitzpatrick. Thank you, Mr. Chairman.
Thank you to the Ranking Member as well.
Thank you to the panel for being here today on a really
critical issue.
I have said many times, of all the threats we face as a
country, I am not aware of a larger threat than that of cyber
threats, both from a National security standpoint and an
economic security standpoint.
When the law enforcement folks appear before us, I am going
to ask them about their relationship with each other.
Generally, the FBI and DHS have concurrent jurisdiction on the
Federal level over cybersecurity-related issues.
But the question I want to ask this panel, given that you
are representing the private sector, is your relationship with
law enforcement, with both organizations, because in order to
advance the ball in this arena it is critically important from
both sides, not just from the private sector, but from law
enforcement that there be a solid relationship, that there be
information sharing, that there be established protocols as far
as reporting incidents.
I can tell you, coming from that profession, we relied
heavily in all areas, but particularly in this area, on the
private sector and sharing information with us as law
enforcement officials, educating us.
What I would like to know from the members of the panel is,
how has that relationship been with both agencies when it comes
to sharing information about threats, digital fingerprints, and
the like? What is working? What is not working? What can be
improved in that area?
Mr. Gillis. Sure. Let me give you a little bit of
historical perspective as well here, because I can tell you
from while I was in government when the U.S. Government first
started responding to victim notifications, sometimes one
company would call several different agencies. As ridiculous as
this sounds, we have seen instances where each agency would
show up with a different nondisclosure agreement, the company
would sign each one of those and then the agencies couldn't
share amongst each other.
Absurd as that is, we have come a long way in just the
basics along those lines. I think you have seen much better
collaboration amongst the Secret Service and FBI. I think they
are working well together.
To give you a personal anecdote from the private sector
side as well, we have talked a little bit before about raising
the cost of an attack. So first, that starts with preventing
attacks, to weed out unsophisticated actors and also to make
sophisticated actors up their game in a way that makes it more
easily attributable.
Law enforcement is going to be an important component of
that. Right now because the noise is so prolific, it is hard to
go after malicious actors because there are so many people in
the space. If the technology can weed out some of the
unsophisticated actors, it can allow law enforcement to go
after those criminals in a way that they will be forced to come
out in the open more. It will be easier to identify who is
acting because they are going to have to develop, not just use
freely available tools, but develop their own tools that will
make it easier to identify those entities.
We as security companies will sometimes be able to identify
as those campaigns are coming in, this is the infrastructure
they are using. So when that case occurs, we contact FBI,
Secret Service, and others as appropriate to help say this is
the playbook that is being run against us and that can help
inform investigations.
So they do have a very important role and it is something
that we focus on from a private-sector side.
Mr. Jeffrey Greene. Yes. I would echo that. I would say
that direct to DHS, as I mentioned earlier. Just last week, we
had 10 analysts in to talk about a specific threat that they
are looking at, to share our research on. At any point in time,
we are active with several active FBI investigations, providing
information about criminal infrastructure, indicators of
compromise.
Not just us, but industry in general has developed a fairly
good relationship with the large actors out there. It is
something we can certainly provide you more details on some of
the cases that we and others have worked on.
Mr. Montgomery. So I would say I would agree with respect
to collaboration. For instance, nomoreransom.org is a not only
National law enforcement collaboration, but also cross-vendor
where we have actually harvested and returned keys to victims
in conjunction with law enforcement investigations.
So I would say with respect to collaboration, there is a
lot of progress, there is a lot of great partnership and
cooperation.
There is one instance where I think we can make improvement
and it is when there is a data classification around a
Government event. I will give you a functional example, the
Iranian incursion into Navy SQL servers.
Basically by classifying the event, what we are doing is
restricting the number of people who can lend assistance and
also allowing the adversary to operate with impunity where, if
we can release this information sooner, we are actually
affecting not only Government, but private-sector organizations
that have the same, very, very common, to Ryan's point, very
low-hanging fruit attack.
So whereas I think the collaboration is good, when there is
a Government instance requiring data classification, we are
classifying too quickly sometimes and not allowing that
information to be propagated both in public and private sector.
Mr. Nutkis. So just for a slightly different perspective.
So we end up working between DHS and FBI on almost, I would
say, a weekly basis between some event that is going on in the
industry. It is sometimes hard to understand the roles. It
certainly, I think, recently has been much more clarified
between the Bureau and Secret Service.
The term that I can't stand hearing is active law
enforcement investigation which shuts down the sharing. That is
really, so they will reach out, they will ask for a whole bunch
of stuff or we will share a whole bunch of stuff with them, and
then everything stops.
From our perspective, since we already are aware of it
because we were sharing it across multiple organizations, in
fact we are not sure why they can't share back as we are trying
to work the same incident as they are.
So again, we understand the obstacles they are under. You
know, we found that certainly it is a great, you know,
relationship, but their hands are tied. So we end up spinning a
lot of cycles.
Also, the part that has, I think, become much more
efficient is now they reach out to us. They used to reach out
to a hundred organizations individually. They reach out to us
and then we will reach out as an outreach effort, which
certainly makes it much more efficient.
Mr. Fitzpatrick. What do you think the solution is
regarding obviously their hands are tied as far as disclosing
law enforcement sensitive information regarding an on-going
investigation?
Mr. Montgomery, regarding the classification issue, what
are suggested improvements on how to deal with that?
Mr. Nutkis. Well, I am not sure I have an answer
specifically because unfortunately we are not aware of what
they are not sharing. But it appears that they don't have to--
from our perspective, the effort that we are trying to put in
place is cyber resilience. We are trying to defend the public
sector from additional loss. So there has to be a happy medium
here where they can provide us with enough information to
defend the sector without compromising a law enforcement
investigation.
But right now, I don't think they are going through the
analysis. It is a binary. It is yes, there is a law enforcement
investigation, stop, versus what do we need to give the sector
to protect itself? I think that varies based on the
significance of the investigation and the significance of the
threat.
Mr. Montgomery. I can't agree more with Mr. Nutkis. This
knee-jerk to classify an issue, for instance, a SQL server on
an Unclassified network, having an issue for which there is a
7-year-old patch, this doesn't feel like a National security
issue, this feels like an overreaction to what has occurred on
an Unclassified DOD network.
That information could have been useful to a broad swath of
practitioners, both in the private and public sector. But the
knee-jerk classification makes that impossible. So I would
agree, the context around the event makes it easy to decide
what should be disseminated quickly and what should not.
Mr. Jeffrey Greene. Mr. Gillis made a great point before,
that a lot of times the information that law enforcement holds
or is looking at exists and that private sector has developed
that on their own. So we may have evidence of the compromise or
know what needs to be done and there is a way and times to push
that out without any connection back potentially to the fact
that there is law enforcement if Palo Alto holds it, if McAfee,
Intel, or Symantec. There are creative solutions that we can
work toward.
Mr. Fitzpatrick. I am over my time, but we really would
like to work with you on that because that is something that is
really important, and it is something I think we could work to
fix.
So I yield back, Mr. Chairman.
Mr. Ratcliffe. Last but not least, the Chair recognizes my
friend from Rhode Island, the Chairman of the Congressional
Cyber Caucus, Mr. Langevin.
Mr. Langevin. Thank you, Mr. Chairman. Thanks for holding
this hearing.
I want to thank our panel of witnesses here today for your
testimony and the work that you are doing to help protect our
Nation in cyber space.
So I wanted to follow up and just talk a little bit more
about the information-sharing issue and build on some of the
questions that Mr. Richmond had asked earlier.
I just wanted to start with Mr. Montgomery and then the
panel members can chime in as well.
But, Mr. Montgomery, I just have a couple of clarifications
I would like to make from your written testimony, if you don't
mind.
First, you state, today, AIS does not provide a means for
enriching the information it shares and it simply shares
minimal IOC information. So do you mean that AIS and the STIX
and CybOX expressions used under the program are not able to
convey meaningful, contextual information or that as a matter
of practice the information being shared currently lacks the
rich, holistic content?
You know, I want to figure out, is this a logistics and
capabilities part of the protocols with AIS? Or is it the
information that they are receiving isn't robust enough?
Mr. Montgomery. Yes. Unfortunately, it is both. The ability
to extract information from a generic individual IOC, like a
domain name or a URL or a fingerprint of a file, unless the IOC
is so damning and points to such a condition, typically it is
simply one of the needles in a pile of needles.
So two things are required. One, a greater degree of
context around how a particular IOC was collected, under what
context. How was it received? How was it transmitted? From
whom, to whom? When was it received? Was it received during the
course of the normal 9-5 business cycle? Was it sent wildly out
of band?
These are the kinds of pieces of information that a
practitioner would require in order to try and sort out what to
do next. The ability to provide those levels of context as part
of AIS is both--it is a technical limitation that we can't do
that today. It is also sort-of it is base-table stakes in terms
of what a practitioner would do next.
So if we were to make recommendations on change, it would
be around sort-of that practitioner knowledge that comes with
an individual IOC because then it becomes a force multiplier.
Mr. Langevin. OK, very good. Thank you.
So another question, again following up on Mr. Richmond's
question, relates to the free rider problem that you describe
with information sharing.
So I have been impressed with CTA's work to address this
problem, particularly as it moves away from volume-based
measures of input to quality-based ones. So in your testimony,
you state that DHS declassifying more information will help
address the issue of free rider.
While I certainly fully support quicker declassification of
threat indicators, it mystifies me how this is going to
incentivize the private sector to share with Government. Can
you help clarify that for me?
The rest of the panel, I welcome any comments that you
might have, how we can deal with free riders in the broader
ecosystem.
Mr. Montgomery. Sure. So with respect to this has been the
long-standing issue with the private-sector sharing. As Mr.
Nutkis pointed out, we feel like we give information and we
don't get the same yield back.
A declassification process would allow the Government to
determine, particularly as it relates to homeland and its
critical infrastructure mission, what is the implication of a
particular piece of information as it relates to the physical
critical infrastructure before giving it back?
But if that vetting process included even a Classified
effort among vendors who were, as Mr. Greene pointed out, we
sit at a lot of interesting nexuses. If we are able to
complement that effort, collaborate in even the
declassification effort, we all have our cleared elements. In
order to get to that point to say, look, although the
Government has classified a particular piece of information, it
is in the wild or it is in the dark web. The value is only
allowing adversaries to operate with impunity.
This would allow people to get real yield back from the
program on a more timely basis.
Mr. Gillis. Sure. Let me add also on a sector-by-sector
basis within industry. One of the real values of the Cyber
Threat Alliance is that everybody in there is a security
vendor, has sophisticated capabilities, and our customer base
is across all sectors of industry.
So by sharing information, No. 1, we wanted to ensure that
the barrier to entry wasn't just a pay-for-play, but that you
had to contribute significant, actionable intelligence on a
regular basis. The benefit of that is that all of our customer
set is better protected.
If you looked at ISACs, so financial sector, energy sector,
health sector, for example, the less that those ISACs have to
do for plugging in individual indicators of compromise or
stopping individual playbooks, if they can rely on the security
vendors to do that, then you can have more participation within
those industry verticals on things that are specific to their
sector. So there is a real force multiplier across different
sectors of industry by coupling the CTA with the role of the
Government and the role of these different ISACs on a sector-
by-sector basis.
Mr. Nutkis. Yes, I would agree with that. Although this has
been an issue that we have had to deal with. I am not sure if
people realize the only organization that doesn't benefit from
information sharing is the one who shared.
So as we have gone through this and we did our original
analysis, we found that 4.1 percent of the organizations that
were in our information-sharing center were actually
contributing. Of that, they were contributing in a relatively
abysmal way, 7 weeks between identification to sharing and
things like that.
We then went to what we called enhanced, which you had to
share within 5 minutes and it had to have the metadata and you
had to share complete indicators. What we did is we delayed the
participation or the sharing of those indicators by 14 days to
anyone else. That was the only carrot we could find which was,
if you wanted better indicators you had to share better
indicators. That was really the incentive.
Actually, it worked. We were able to get a lot of
organizations to step up to the table, by the way recognizing
that, and I think this is also important, that there is an
underlying element here that gets lost, which is a lot of the
issues with sharing has to do with the maturity of the
organization or their ability to share in the first place.
So even though we are sharing, we also have this other
issue, if you are not mature enough to share, are you mature
enough to consume. I know that gets lost on a lot of this and
this hearing is on sharing, but we need to make sure as we
share, again, as the technology vendors look to improve the
infrastructure and the security technology, is how do we
consume them.
Mr. Langevin. Thank you, Mr. Chairman.
Is it your intention, Mr. Chairman, to do a second round or
are we just doing a first round?
Mr. Ratcliffe. Yes. Unfortunately, just one round today.
Mr. Langevin. OK. So I have some additional questions I
would like to submit for the record and hopefully our witnesses
can respond in writing.
Mr. Ratcliffe. Terrific.
Mr. Langevin. Thank you.
Mr. Ratcliffe. Thank the gentleman.
The Chair now recognizes my colleague from Texas, Ms.
Jackson Lee.
Ms. Jackson Lee. Thank you for the courtesy of the Chair
and the Ranking Member.
Thank all the witnesses today.
Let me just begin and thank you for what I have gleaned in
this hearing. I appreciate maybe global responses if you could
quickly give.
A bill that I introduced, H.R. 940, Securing Communications
of Utilities from Terrorist Threats, and an aspect of it is to
seek voluntary participation on ways that DHS can best defend
against and recover from terrorist acts that have an impact on
National security. It involves working with the private sector.
Then H.R. 935, Cybersecurity and Federal Workforce
Enhancement, is to seek a more trained work force that will be
working for the Federal Government.
In the course of my questions, maybe someone would answer
the importance of obtaining skills to address our Nation's
deficit in the number of workers that are so crucial.
I also look forward to introducing soon Prevent Zero-Day
Events which would help DHS in working with sector-specific
entities to better understand the detection of undiscovered or
unreported vulnerabilities in software and firmware. That one
in particular I would like to have a comment on as I ask the
question.
So I want to ask a specific question that deals with, in
the wake of the Russian cyber campaign against our electoral
system, about there has been discussion about the importance of
attribution. Panel, could you speak to why it matters,
particularly as interest grows in exacting retribution? That is
the question of attribution as to, how did it happen?
Also, we are now hearing without details of the potential
release of a number of tactics that are being used by the CIA.
Again, news reports speculate that this may have come from
individuals with access who work for private contractors.
You are from the private sector. I would be interested in
your vetting processes regarding individuals that have access
to governmental, confidential security data and information.
I would also like to put on the record, Mr. Chairman, the
request for a briefing. It may be this committee, it may be
another subcommittee, any one, or the full committee. That I
believe that we should receive a Classified briefing as to what
actually was released that impacts negatively on the
intelligence community regarding the representation that
Wikileaks has released through information they received, some
very viable and important data. I think that this is a key
responsibility that we have.
So could you begin? Who will take questions?
Mr. Gillis. I will start with securing utilities, where you
began there. So that is an essential area that we as a Nation
need to be concerned about. It is an area where we collectively
need to work, again public/private.
Let me give you an example of one instance in which we have
done so. So last fall, our security intelligence team
identified new strands, new iterations of what is called the
Shamoon attack. Shamoon attack is what was levied against Saudi
Aramco, an oil producer within Saudi Arabia, that had destroyed
35,000 hard drives in 2012.
We noticed in late fall that there were new evolutions of
some of that old infrastructure with new techniques being used.
As we identified that, we called up Department of Homeland
Security, ensured that they had a predecisional copy of that
report, ensured that they were able to help protect U.S.
Government networks against it, ensured that they were able to
distribute that across the broader USG community, ensured that
they were able to help develop their own critical
infrastructure bulletin so that U.S. industry in the electric
sector and other utilities were able to prevent against those
types of attacks.
So that is a place where, if you look from a National
security and economic security perspective, utilities are
obviously key. It is essential to look at the intersection of
physical and cybersecurity, as this committee does here and an
example of something that we highly value and DHS has a
tremendous role toward.
Ms. Jackson Lee. Mr. Nutkis and Mr. Montgomery, can you
answer the question about the issue of, how do you vet your
individuals that work with Government data? What do you think
about attribution?
Mr. Nutkis. With regards to vetting, we follow the
Government's requirements for vetting. So DHS has a formal
process which requires for vetting of anyone who has access to
Classified information. That is the process that we follow.
With regards to attribution, we, again, there is--from
cyber resilience and defending, that is a different, you know,
that is not as relevant for us down in the private sector.
We want to know what the threat is, how real the threat is,
what to do about it. It is really about either anticipating the
threat so that we can have a defense posture.
Although it has always been interesting and as we go to
various briefings to understand where the threats are coming
from and, again, it helps us protect our networks and protect
the environment, specific attribution to the individual threat
actor, it has always been interesting, but we have never really
determined how best to use it and certainly use it on a wide
scale at an industry level.
Ms. Jackson Lee. Mr. Montgomery.
Mr. Montgomery. With respect to people having access to
Government data, we use the same DSS and OPM clearance
processes as everybody else does. We do some stove-piping of
Government data away from other systems in order to meet the
physical and data security requirements.
With respect to attribution, I think attribution, it is a
step that I think people are prioritizing more heavily at the
wrong times. Asking about attribution first in the wake of a
breach or of a successful attack is much akin to trying to
decide what color carpet to put in your house while it is still
on fire.
There is a point at which you should decide what color
carpet to put in the house, but put the fire out first.
There are hygiene and security elements that are far more
important to take care of, particularly as it relates to
utility and critical infrastructure, long before sorting out
which foreign national, which we may or may not ever get
jurisdiction over, is ultimately responsible.
So while I think that attribution is an important step in
the life cycle of an event, putting it first is what we seem to
do as a society and as a technical society. It should be far,
far further down the track so that the events can't occur again
rather than figuring out who to blame.
Ms. Jackson Lee. Does anyone else?
Mr. Chairman, you have been very gracious. I know that the
answers refer to the private sector and do not, in respect to
attribution and retribution, I appreciate Mr. Montgomery, do
not reflect on the importance of our Government finding out who
this should be attributed to. Therefore, we have the
opportunity to deal with what our response will be.
Certainly, as the house is on fire, I would like to say, in
concluding, I would like to get it before the house is on fire,
I would like it not to happen. That is what I hope as Members
of the Homeland Security Committee and this committee that we
can work in that preventative mode. That would make us all
safer and securer and make the work with our partners in the
private sector a smoother pathway.
I yield back, Mr. Chairman.
I thank you, Mr. Montgomery.
Mr. Ratcliffe. Thank the gentlelady for her remarks.
That concludes our hearing. I had high expectations, as I
said at the outset, and from my perspective those expectations
have been met for this hearing.
I think the testimony and the responses to questions that
we have had from the witnesses have been particularly
insightful and instructive, certainly to the committee, and
hopefully to the new administration.
So I thank you all for your testimony, and I thank the
Members for their thoughtful questions today.
The Members of the committee, at a minimum Mr. Langevin,
perhaps others, will have additional questions for some of the
witnesses. We will ask you to respond to those in writing.
Pursuant to committee rule VII(D), this hearing record will
be held open for a period of 10 days.
Without objection, the subcommittee will stand adjourned.
[Whereupon, at 11:41 a.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Questions From Honorable James Langevin for Daniel Nutkis
Question 1a. AIS was one of the central accomplishments of the
Cybersecurity Act of 2015, and I believe that real-time, machine-to-
machine sharing can make a real difference in protecting our networks.
I have, however, been concerned by the lack of participation in AIS,
particularly because in order to function, it needs to take advantage
of the network effects of a robust pool of participants. Why do you
think participation numbers are so low, particularly since we heard
from the private sector repeatedly while working on the bill that this
sort of initiative was urgently needed?
What specific measures could DHS take to encourage private-sector
participation?
Question 1b. Does your organization/company participate in AIS?
If yes: (a) When did you join the program? (b) What were your
initial set-up costs to do so? (c) What factors motivated your decision
to join AIS?
If no: (a) Have you considered joining AIS? If so, what factors
caused you to decline to participate? (b) What would need to change
about the program to make it worthwhile to participate?
Answer. Response was not received at the time of publication.
Question 2. One of my goals this Congress is to get a better handle
on cybersecurity metrics: Namely, are the actions we are taking having
measureable improvements on our security? Based on your experience, how
can we better measure cybersecurity outcomes?
Answer. Response was not received at the time of publication.
Question 3a. On December 29, 2016, the Department of Homeland
Security released a Joint Analysis Report (JAR) regarding Russian
malicious cyber activity designated as GRIZZLY STEPPE. Included in the
JAR were indicators that were released in STIX and CSV formats.
How did your organization/company utilize the JAR?
Question 3b. Did you find the technical indicators of malicious
Russian cyber activity useful? Why or why not?
Question 3c. What proportion of the technical indicators was your
organization/company aware of before the release of the JAR?
Question 3d. Do you believe the JAR helped improve the Nation's
cybersecurity?
Answer. Response was not received at the time of publication.
Questions From Honorable James Langevin for Scott Montgomery
Question 1a. AIS was one of the central accomplishments of the
Cybersecurity Act of 2015, and I believe that real-time, machine-to-
machine sharing can make a real difference in protecting our networks.
I have, however, been concerned by the lack of participation in AIS,
particularly because in order to function, it needs to take advantage
of the network effects of a robust pool of participants. Why do you
think participation numbers are so low, particularly since we heard
from the private sector repeatedly while working on the bill that this
sort of initiative was urgently needed?
Answer. The limited level of private-sector participation in the
AIS system has many causes. These include:
Most organizations have an inherent hesitation or fear to
share cyber threat information. There is a concern that sharing
may expose internal corporate information unnecessarily.
General counsels have found it easier to have policies that
restrict sharing to all but the most trusted partners.
The sign-up process for AIS is a bit onerous. The process
could be made much easier and more streamlined to incent
participation.
Currently, AIS only shares indicators and mitigations. While
these pieces of information are large components of the cyber
threat life cycle, there is currently no way to enrich data
that an organization receives from AIS. In other words, if an
organization finds additional data sets that can be used to
enrich the data received from DHS, it has no way to share these
data sets with the AIS community.
The limited legal liability protection established in the
legislation and implemented in regulation has been and
continues to be confusing.
Question 1b. What specific measures could OHS take to encourage
private-sector participation?
Answer.
Provide general counsels with more information that shows
the value of participating in AIS.
Clarify liability protection.
Improve the sign-up process to make it is easier to
understand and implement.
Provide an organization's IT/security staff with materials
they can use ``to sell'' the effort to their management and
general counsel.
Question 1c. Does your organization/company participate in AIS?
Answer. McAfee recently spun-out as a separate, stand-alone
company. As such, we are currently developing new internal processes
and procedures. Currently, we do not participate in the AIS program.
Question 1d. Have you considered joining AIS? If so, what factors
caused you to decline to participate?
Answer. McAfee is still deciding whether to join AIS.
Question 1e. What would need to change about the program to make it
worthwhile to participate?
Answer. The program would be much more valuable if there was a
means to enrich the data provided. It is our understanding that AIS
does not provide a unique set of indicators to the private sector. This
means that multiple indicators could come from different submitters
that, practically speaking, are the same. This puts the burden of data
clean-up on every participating organization. It would be better for
all if AIS did this data clean-up as part of their redistribution
process.
Question 2. One of my goals this Congress is to get a better handle
on cybersecurity metrics: Namely, are the actions we are taking having
measurable improvements on our security. Based on your experience, how
can we better measure cybersecurity outcomes?
Answer. It is very difficult to accurately measure progress in the
cybersecurity domain. Scope and scale are the main challenges.
There are organizational risk management tools that can be used to
track and depict organizational cyber program improvements, such as the
NIST Cybersecurity Framework, but they are not appropriate when
comparing one organization to another.
Because cybersecurity impacts so many parts of our digital world
today, appropriate metrics need to be developed for each of the
specific areas being examined. For instance, with an organizational
baseline, it is not hard to measure how fast patches are deployed each
month within a given organization. Macro-level measurements, on the
other hand, are much more complex and difficult to develop. For
example, how would you measure the impact of delaying procurement of
new cybersecurity capabilities? The cybersecurity landscape is very
much an arms race between the defenders and the malicious actors. If
the process to acquire new capabilities takes two or more years, what
effect does that have on an organization's defensive capabilities?
Given the many difficulties associated with metrics, it would be
useful for NIST to create a metrics research effort. Such an activity
should not be tied to the NIST Cybersecurity Framework, but should be a
stand-alone effort that considers the scope and scale of the various
needs for measurement. Organizational internal measurements, sector-
specific comparison metrics, and consumer-, industry-, and National-
level improvement tracking could all be areas of study. A research
effort of this magnitude and complexity would require NIST to work in
close collaboration with industry to produce a successful outcome.
Question 3a. On December 29, 2016, the Department of Homeland
Security released a Joint Analysis Report (JAR) regarding Russian
malicious cyber activity designated as GRIZZLY STEPPE. Included in the
JAR were indicators that were released in STIX and CSV formats.
How did your organization/company utilize the JAR?
Question 3b. Did you find the technical indicators of malicious
Russian cyber activity useful? Why or why not?
Question 3c. What proportion of the technical indicators was your
organization/company aware of before the release of the JAR?
Question 3d. Do you believe the JAR helped improve the Nation's
cybersecurity?
Answer. This event occurred prior to McAfee spinning-out from Intel
and becoming an independent company. Since McAfee and Intel are two
separate stand-alone companies, it would not be appropriate for McAfee
to discuss Intel's use of the JAR. Intel's threat intelligence team
should respond to this question.
Question 4a. Your company is involved in the Cyber Threat Alliance.
What indicators does your company choose to share with CTA? By what
process are they selected?
Answer. The slide below depicts the information shared between CTA
members, which Members agreed to.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Question 4b. How does your company decide which indicators to share
with the Government? To your knowledge, how does CTA decide which
indicators (if any) to share with the Government?
What criteria/process is used to select indicators/threat
intelligence to share with the Government?
What is the reason for not sharing more threat indicators with the
Government?
Answer. The CTA does not currently allow direct Government
membership. The Cyber Threat Alliance is a coalition of cybersecurity
companies and is focused on expanding its private-sector membership. It
should be noted, though, that the CTA has a history of sharing
intelligence during events of National significance such as CryptoWall
3 and WannaCry with the appropriate Federal agencies. We expect to
continue working with agencies on research/takedowns in those
situations
Question 4c. What technical protocols does CTA use to share threat
indicators?
Answer. The CTA members share information via STIX/TAXII.
Question 5. What suggestions do you have for DHS to enhance the
Nation's cybersecurity workforce, in both the public and private
sectors?
What actions can be taken by the Department acting alone, and what
requires public/private collaboration?
Answer. DHS is an active participant in NSF's CyberCorps
Scholarship for Service (SFS) program. DHS should support the expansion
of this program.
The CyberCorps SFS program is designed to increase and strengthen
the cadre of Federal information assurance specialists that protect
Government systems and networks. Here's how it works: The National
Science Foundation (NSF) provides grants to about 70 institutions
across the country to offer scholarships to 10-12 full-time students.
Students get free tuition for up to 2 years in addition to stipends--
$22,500 for undergraduates and $34,000 for graduate students. They also
get allowances for health insurance, textbooks, and professional
development. Some universities also partner with DHS on these programs.
Students generally have to be juniors or seniors and must qualify for
the program by attaining a specific GPA, usually at least a 3.0 or
higher. Upon completing their coursework and a required internship,
students earn a degree, then go to work as security experts in a
Government agency for at least the amount of time that they have been
supported by the program. After that they can apply for jobs in the
public or private sector.
With additional funding, the CyberCorps SFS program certainly could
be expanded to more institutions and more students within each of those
schools. To date, the Federal Government has made a solid commitment to
supporting the SFS program, having spent $45 million in 2015, $50
million in 2016, and the most recent administration's budget requests
$70 million. As a baseline, an investment of $40 million pays for
roughly 1,560+ students to complete the scholarship program. Given the
size and scale of the cyber skills deficit, policy makers should
significantly increase the size of the program, possibly something in
the range of $180 million. At this level of funding, the program could
support roughly 6,400 scholarships. Such a level of investment would
make a real dent in the Federal cyber skills deficit, estimated to be
in the range of 10,000 per year. At the same time, this level of
investment could help create a new generation of Federal cyber
professionals that can serve as positive role models for a countless
number of middle and high school students across the country to
consider the benefits of a cyber career and Federal service. Indeed,
this positive feedback loop of the SFS program might well be its
biggest long-term contribution.
What should the private sector do to make an impact on the cyber
skills deficit? The private sector must also be prepared to up-level
its partnerships with the Government and others in industry to ensure a
steady supply of worthwhile internships, co-ops, and training
opportunities. In a recent report from McAfee and the Center for
Strategic and International Studies (CSIS), a lack of quality training
opportunities was cited as a significant reason why cyber practitioners
seek alternative employment. For this reason, it is not only imperative
that public-sector entities compensate their cyber professionals well,
but also provide ample opportunities for employees to learn new skills
and train on new technologies. With more robust public-private
partnerships in this area, private companies in different industries
can reach individuals at every stage in their career and engage them
with new opportunities to learn about a wide variety of digital
environments and next-generation technologies.
Questions From Honorable James Langevin for Jeffrey Greene
Question 1a. AIS was one of the central accomplishments of the
Cybersecurity Act of 2015, and I believe that real-time, machine-to-
machine sharing can make a real difference in protecting our networks.
I have, however, been concerned by the lack of participation in AIS,
particularly because in order to function, it needs to take advantage
of the network effects of a robust pool of participants. Why do you
think participation numbers are so low, particularly since we heard
from the private sector repeatedly while working on the bill that this
sort of initiative was urgently needed?
What specific measures could DHS take to encourage private-sector
participation?
Question 1b. Does your organization/company participate in AIS?
If yes: (a) When did you join the program? (b) What were your
initial set-up costs to do so? (c) What factors motivated your decision
to join AIS?
If no: (a) Have you considered joining AIS? If so, what factors
caused you to decline to participate? (b) What would need to change
about the program to make it worthwhile to participate?
Answer. The roll-out of DHS's Automated Indicator Sharing (AIS)
program was an important step in developing real-time information
sharing. And while the program is still new, it shows great promise.
Symantec is currently testing AIS to determine how the automated feed
can contribute to our overall protection system and in the coming
months will be conduct a pilot program to ingest some of the indicators
and review them for accuracy and value.
The current participation rate in AIS no doubt reflects in part
that it is still relatively new--it has only been functioning for less
than 1 year. Some companies, especially smaller ones, are still
establishing internal policies for sharing. Additionally, investing in
the STIX/TAXI protocols could be a resource barrier for some smaller
companies that might otherwise want to join. In larger companies,
policy development can be a lengthy process as it typically includes
input from operational, corporate, legal, and privacy functions. Last,
while the fidelity of the indicators is improving, the quality in the
early days was inconsistent and some would have caused false positives
had they been fully deployed within a company or across a security
vendor's customer base.
As a security vendor, Symantec is in a different position from many
potential program partner. We are concerned with much more than our own
systems; rather, we have to assess the impact on millions of customers
around the world who rely on our near-real-time security updates. Each
indicator of compromise needs to be carefully vetted to ensure we are
pushing out quality indicators with a minimum of false positives. This
vetting requires context, which at times has been insufficient. We
recognize that DHS is in a difficult spot--industry is asking for both
timely and rigorously-vetted information and this balance can be
difficult to strike. DHS has made strides in the year AIS has been
operational, and we hope that will continue.
Question 2. One of my goals this Congress is to get a better handle
on cybersecurity metrics: Namely, are the actions we are taking having
measureable improvements on our security? Based on your experience, how
can we better measure cybersecurity outcomes?
Answer. Cybersecurity metrics is certainly a hotly-debated topic.
At core, measuring success is often proving the negative--pointing to
attacks that did not occur or did not succeed. Moreover, how do you
show what might have happened if you do not have appropriate tools and
procedures in place? One approach is to focus on cyber hygiene basics
that provide a foundation for an effective cyber defense posture. These
are relatively easy to measure and include activities such as:
Hardware and Software Asset Management.--Identifying all
hardware and software assets; it is often said that ``you can't
protect what you can't see.''
Configuration Management.--Properly configuring assets to
eliminate known threat vectors.
Vulnerability Management.--Scanning assets for known
vulnerabilities and applying the appropriate patches.
Identity Credential and Access Management.--Checking user
privileges to ensure they are limited to only the rights they
need and limiting any excessive privileges found.
Multi-Factor Authentication (MFA).--Implementing MFA and
enforcing its use.
Consistent progress on these basic--but critical--foundational
activities will lead to a reduction of some of the most commonly
exploited cyber threat vectors.
Question 3a. On December 29, 2016, the Department of Homeland
Security released a Joint Analysis Report (JAR) regarding Russian
malicious cyber activity designated as GRIZZLY STEPPE. Included in the
JAR were indicators that were released in STIX and CSV formats.
How did your organization/company utilize the JAR?
Question 3b. Did you find the technical indicators of malicious
Russian cyber activity useful? Why or why not?
Question 3c. What proportion of the technical indicators was your
organization/company aware of before the release of the JAR?
Question 3d. Do you believe the JAR helped improve the Nation's
cybersecurity?
Answer. We received the December 29, 2016 Joint Analysis Report
(JAR) regarding Russian malicious cyber activity designated GRIZZLY
STEPPE and reviewed the indicators to ensure that our customers were
properly protected. While most DHS reports include substantive analysis
and some actionable information, on this occasion we believe the report
fell short. Unfortunately, the indicators led to a high volume of false
positives and in some cases the indicators proved to be unrelated to
the threat itself. Finally, we were already aware of all indicators
provided and those that we were not aware of were unrelated to the
threat. However, to its credit, DHS issued an updated report that was
higher in quality in terms of analysis and accuracy of indicators.
Question 4a. Your company is involved in the Cyber Threat Alliance.
What indicators does your company chose to share with CTA? By what
process are they selected?
Question 4b. How does your company decide which indicators to share
with the Government? To your knowledge, how does CTA decide which
indicators (if any) to share with the Government?
What criteria/process is used to select indicators/threat
intelligence to share with the Government?
What is the reason for not sharing more threat indicators
with the Government?
Question 4c. What technical protocols does CTA use to share threat
indicators?
Answer. The Cyber Threat Alliance (CTA) is an excellent example of
the private sector banding together to improve the overall safety and
security of the internet. In 2014, Symantec, Fortinet, Intel Security,
and Palo Alto Networks formed the CTA to work together to share threat
information. The goal was to distribute detailed information about
advanced attacks and thereby raise the situational awareness of CTA
members and improve overall protection for our customers.
Prior industry-sharing efforts were often limited to the exchange
of malware samples, and the CTA sought to change that. Over the past 3
years the CTA has consistently shared more actionable threat
intelligence such as information on ``zero day'' vulnerabilities,
command-and-control server information, mobile threats, and indicators
of compromise related to advanced threats. By raising the industry's
collective intelligence through these new data exchanges, CTA members
have delivered greater security for individual customers and
organizations. In short, the CTA is not about one vendor trying to gain
advantage--we are all contributing and sharing with the community.
Each member must share at least 1,000 samples of new Portable
Executable (PE) malware per day that are not observed on VirusTotal
over the preceding 48 hours at the time of sharing, and meet at least
one of the following three criteria:
Mobile Malware.--At least 50 samples of new mobile malware
per day in the APK, DEX, or other popular mobile malware file
formats that are not observed on VirusTotal over the last 48
hours at time of sharing.
Botnets C2 Servers.--At least 100 botnet command-and-control
servers (C2), and/or peer-to-peer nodes, per week beyond those
listed on public forums such as ZeusTracker, must be different
than the previous week's dump from the contributing member; and
must be active upon sharing.
Vulnerabilities & Exploits Sites.--At least 100 attack sites
per week beyond those listed on public forums, must be
different than the previous week's dump from the contributing
member, and must be active upon sharing.
CTA is also committed to initiatives such as developing industry
best practices that will improve cybersecurity for individuals and
governments. As CTA moves forward with its mission, Government
partnerships will be an important piece of the process.
Question 5a. What suggestions do you have for DHS to enhance the
Nation's cybersecurity workforce, in both the public and private
sectors?
Question 5b. What actions can be taken by the Department acting
alone, and what requires public-private collaboration?
Answer. Today, there are an estimated 1 million cybersecurity jobs
in the United States that supposedly cannot be filled. We believe that
a new approach to IT professionals generally will help solve this
problem. There are many general IT professionals in both Government
agencies and in businesses around the world, and with in-house training
they could become specialized security professionals. Their roles could
in turn be filled by junior IT professionals or even recent graduates.
Looking to existing IT staff to train for security roles has several
benefits--these personnel will already know an organizations' systems,
and providing another opportunity for career growth will improve
retention and job satisfaction. Training the current IT workforce in
cybersecurity is also fiscally smart, as it allows governments and
enterprises to cut down their contract workforce and train from within,
leading to a more secure IT environment.
We do this at Symantec, in part by conducting an annual ``Cyber War
Games'' exercise. This exercise takes IT professionals from 10 regions
around the world and creates scenarios to encourage innovative thinking
and growth in cybersecurity skills. These types of activities allow us
to find hidden expertise in current employees as well as new expertise
to bolster our own workforce. In addition, Symantec created the
Symantec Career Connection (SC3). SC3 is an innovative program designed
to help close the cybersecurity workforce gap while creating meaningful
career paths for underrepresented young adult and veterans. Through
targeted classroom education combined with hands-on training, SC3
graduates are working amongst many of the world's largest and reputable
companies.
Thank you again for the opportunity to testify and to provide these
further responses.
Questions From Honorable James Langevin for Ryan M. Gillis
Question 1a. AIS was one of the central accomplishments of the
Cybersecurity Act of 2015, and I believe that real-time, machine-to-
machine sharing can make a real difference in protecting our networks.
I have, however, been concerned by the lack of participation in AIS,
particularly because in order to function, it needs to take advantage
of the network effects of a robust pool of participants. Why do you
think participation numbers are so low, particularly since we heard
from the private sector repeatedly while working on the bill that this
sort of initiative was urgently needed?
What specific measures could DHS take to encourage private-sector
participation?
Question 1b. Does your organization/company participate in AIS?
If yes: (a) When did you join the program? (b) What were your
initial set-up costs to do so? (c) What factors motivated your decision
to join AIS?
If no: (a) Have you considered joining AIS? If so, what factors
caused you to decline to participate? (b) What would need to change
about the program to make it worthwhile to participate?
Answer. Response was not received at the time of publication.
Question 2. One of my goals this Congress is to get a better handle
on cybersecurity metrics: Namely, are the actions we are taking having
measureable improvements on our security? Based on your experience, how
can we better measure cybersecurity outcomes?
Answer. Response was not received at the time of publication.
Question 3a. On December 29, 2016, the Department of Homeland
Security released a Joint Analysis Report (JAR) regarding Russian
malicious cyber activity designated as GRIZZLY STEPPE. Included in the
JAR were indicators that were released in STIX and CSV formats.
How did your organization/company utilize the JAR?
Question 3b. Did you find the technical indicators of malicious
Russian cyber activity useful? Why or why not?
Question 3c. What proportion of the technical indicators was your
organization/company aware of before the release of the JAR?
Question 3d. Do you believe the JAR helped improve the Nation's
cybersecurity?
Answer. Response was not received at the time of publication.
Question 4a. Your company is involved in the Cyber Threat Alliance.
What indicators does your company chose to share with CTA? By what
process are they selected?
Question 4b. How does your company decide which indicators to share
with the Government? To your knowledge, how does CTA decide which
indicators (if any) to share with the Government?
What criteria/process is used to select indicators/threat
intelligence to share with the Government?
What is the reason for not sharing more threat indicators
with the Government?
Question 4c. What technical protocols does CTA use to share threat
indicators?
Answer. Response was not received at the time of publication.
Question 5a. What suggestions do you have for DHS to enhance the
Nation's cybersecurity workforce, in both the public and private
sectors?
Question 5b. What actions can be taken by the Department acting
alone, and what requires public-private collaboration?
Answer. Response was not received at the time of publication.
Questions From Honorable Cedric Richmond for Robyn Greene
Question. Your organization, the Open Technology Institute, has
taken a relatively hard line on two issues that are central to the
current cybersecurity threat landscape--first, on the dangers of active
cyber defense (i.e. allowing companies to ``hack back''); and second,
that the Government should adopt a more transparent, Congressionally-
authorized process for when to disclose zero-day vulnerabilities in its
possession. What are some of the key considerations policy makers
should bear in mind on these issues?
Answer. New America's Open Technology Institute (OTI) opposes
proposals to authorize active cyber defense (also known as ``hacking-
back'') because they threaten to undermine cybersecurity rather than
enhance it, and may result in harming innocent third parties. Hacking-
back is a form of digital vigilantism. As vigilantism is illegal in the
physical world, so too should it remain on-line. As Congress carefully
weighs the risks and rewards that may result from hack-back proposals,
it will likely find that the risks are unjustifiably high.
Hacking is dangerous whether you are a victim reacting to a cyber
attack, a malicious actor, or a Government. Authorizing cyber attack
victims to hack-back will almost certainly result in harms to innocent
third parties. It is possible that a malicious actor could obtain
malware used in a hack-back and turn it against innocent third parties.
Further, attribution of the attack, though constantly improving, is
still exceedingly difficult. When deploying an active cyber defense, it
is difficult to guarantee that the device or network affected does not
belong to an unrelated third party who has been misidentified as the
malicious actor. Additionally, the hack-back could target a perceived
malicious actor who is actually a person or entity that has been the
victim of a cyber attack themselves, like a hospital or fire department
whose network has been taken over by a botnet.
Finally, even if an attack has been successfully attributed to a
particular malicious actor, identifying that attacker can still be
difficult and time-consuming. Because of the rapid-response nature of
hacking-back, it is possible that an entity will be retaliating against
foreign actors, including nation-states. This could put entities that
choose to engage in hacking-back in a conflict of law with the country
where their target is located. It could also raise diplomatic concerns.
For example, if hacking-back was legal in 2014, Sony could have chosen
to retaliate against its attackers who turned out to be agents of the
North Korean government, a hostile foreign power, instead of seeking
assistance from law enforcement.
FBI Director Comey raised similar concerns at two speaking
engagements this year. He was unequivocal in his opposition to allowing
victims to hack-back. He cautioned that such an authorization was
dangerous, and that it would interfere with the FBI's ability to
conduct its investigations into cyber crimes.\1\ OTI agrees with this
assessment and would urge Members of Congress to oppose any proposal
that legalizes hacking-back.
---------------------------------------------------------------------------
\1\ See James Comey, Dir. Fed. Bureau of Investigation, Speech at
Boston Cybersecurity Summit 2017 (Mar. 8, 2017), https://
www.youtube.com/watch?v=VzhVYv7K4qc; and James Comey, Dir. Fed. Bureau
of Investigation, Speech at U. of Tex. Austin (Mar. 23, 2017), https://
www.youtube.com/watch?v=iR5EwIbUvA0.
---------------------------------------------------------------------------
Unlike hacking-back, establishing a permanent process for
disclosing previously unknown vulnerabilities (often called zero-days)
in the Government's possession is essential to improving cybersecurity.
As we have seen from the Shadow Brokers disclosures,\2\ the arrest of
an NSA contractor for hoarding zero-days at his home,\3\ and the recent
CIA leaks,\4\ secrets get out. There is no way to guarantee that when
the Government is in possession of zero-days and related exploits, that
information will not eventually be leaked, posing significant and
immediate risks of exploitation to Americans and internet users
everywhere.
---------------------------------------------------------------------------
\2\ See David E. Sanger, ``Shadow Brokers'' Leak Raises Alarming
Question: Was the NSA Hacked?, NY Times (Aug. 16, 2016), https://
www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises-alarming-
question-was-the-nsa-hacked.html; Bruce Schneier, Another Shadow
Brokers Leak, Schneier on Security (Nov. 1, 2016), https://
www.schneier.com/blog/archives/2016/11/another_shadow_.html; and Don't
Forget Your Base, Medium (Apr. 8, 2017), https://medium.com/
@shadowbrokerss/dont-forget-your-base-867d304a94b1.
\3\ Ellen Nakashima, Matt Zapotosky, & John Woodrow Cox, NSA
Contractor Charged with Stealing Top Secret Data, Wash. Post (Oct. 5,
2016), https://www.washingtonpost.com/world/national-security/
government-contractor-arrested-for-stealing-top-secret-data/2016/10/05/
99eeb62a-8b19-11e6-875e-2c1bfe943b66_story.html.
\4\ Scott Shane, Matthew Rosenberg, & Andrew W. Lehren, Wikileaks
Releases Trove of Alleged C.I.A. Hacking Documents, NY Times (Mar. 7,
2017), https://www.nytimes.com/2017/03/07/world/europe/wikileaks-cia-
hacking.html.
---------------------------------------------------------------------------
When the Government discovers or purchases vulnerabilities that put
American internet users and companies at risk, it should disclose them
as soon as possible so they may be patched. To ensure this happens,
Congress should codify a interagency review and disclosure process. Any
such process should be mandatory, such that no matter how the
Government comes into possession of a zero-day vulnerability, it must
submit it for review so that disclosure to the developer can be made in
a timely manner.
The review of vulnerabilities should be undertaken with a
presumption in favor of disclosure, and a requirement for recurring
review of any vulnerability that is not disclosed. The reviews should
be conducted by a set group of stakeholders representing the prevailing
interests in favor of and opposing disclosure. Those stakeholders
should represent the equities of the U.S. economy, including the
digital economy; domestic cybersecurity and critical infrastructure
owners and operators; the intelligence community; and the civil rights
and civil liberties communities.
Finally, the process should include robust transparency mechanisms.
The vulnerability review and disclosure process should be transparent
about the points of inquiry it considers when making its assessments,
and what agencies participate in the reviews. Congress should also
require the review board to publish annual public reports that assess
the efficacy of the process, and provide related metrics, such as the
number of zero-days submitted for review, and the percentage of those
zero-days that were disclosed to developers.
Questions From Honorable James Langevin for Robyn Greene
Question 1a. AIS was one of the central accomplishments of the
Cybersecurity Act of 2015, and I believe that real-time, machine-to-
machine sharing can make a real difference in protecting our networks.
I have, however, been concerned by the lack of participation in AIS,
particularly because in order to function, it needs to take advantage
of the network effects of a robust pool of participants. Why do you
think participation numbers are so low, particularly since we heard
from the private sector repeatedly while working on the bill that this
sort of initiative was urgently needed?
What specific measures could DHS take to encourage private-sector
participation?
Question 1b. Does your organization/company participate in AIS?
If yes: (a) When did you join the program? (b) What were your
initial set-up costs to do so? (c) What factors motivated your decision
to join AIS?
If no: (a) Have you considered joining AIS? If so, what factors
caused you to decline to participate? (b) What would need to change
about the program to make it worthwhile to participate?
Answer. Though New America does not currently participate in the
Department of Homeland Security's Automated Information Sharing (AIS)
program, one of the concerns that we raised as CISA was being debated
was that it would not address the need for two-way information sharing.
Security experts and witnesses at the March 9, 2017 hearing were clear
that for information sharing to be effective, the Government must be
willing and able to increase its declassification and sharing of unique
cyber threat indicators in a timely and actionable manner.\5\
---------------------------------------------------------------------------
\5\ ``While DHS has made progress, it still needs to improve the
quality and the quantity of the threat data it shares with the private
sector to address this issue of the free rider. DHS should thus
declassify larger categories of threat data and actively share them
with the private sector. DHS should issue many more security clearances
to qualified company representatives to enable access to the most
sensitive, and potentially most valuable, pieces or classes of threat
data.'' Current State of DHS Private Sector Engagement for
Cybersecurity: Hearing Before the H. Homeland Sec. Subcomm. on
Cybersecurity and Infrastructure Protection, 115th Cong. 7 (2017)
(Written statement of Scott Montgomery, V. President and Chief
Technical Analyst, Intel Security Group), http://docs.house.gov/
meetings/HM/HM08/20170309/105671/HHRG-115-HM08-Bio-MontgomeryS-
20170309.pdf. See also Sara Sorcher, Security Pros: Cyberthreat Info-
sharing Won't Be as Effective as Congress Thinks, Christian Sci.
Monitor, Jun. 12, 2015, http://www.csmonitor.com/World/Passcode/2015/
0612/Security-pros-Cyberthreat-info-sharing-won-t-be-as-effective-as-
Congress-thinks.
---------------------------------------------------------------------------
Rather than focusing on persuading more companies and Information
Sharing and Analysis Organizations and Centers to join AIS, DHS should
focus on showing these entities why joining AIS would be beneficial by
increasing information sharing by the Government to the private sector.
DHS should also endeavor to be transparent about how much information
it shares with the private sector, and what the quality of that sharing
has been.
Additionally, many technology companies voiced opposition to CISA
just before its passage citing to concerns, shared by the privacy
community, about the civil liberties of their users.\6\ Companies may
feel more comfortable participating in information sharing under CISA
if Congress amended the law to address those concerns. Specifically,
Congress could amend CISA to strengthen the requirement to remove
personal or identifiable information before sharing by clarifying that
such information is not directly related to a cyber threat unless it is
necessary to ``detect, prevent, or mitigate'' it.\7\
---------------------------------------------------------------------------
\6\ Robyn Greene, Tech Industry Leaders Oppose CISA as Dangerous to
Privacy and Security, The Hill, Oct. 21, 2015, http://thehill.com/
blogs/pundits-blog/technology/257601-tech-industry-leaders-oppose-cisa-
as-dangerous-to-privacy-and.
\7\ Dep't of Homeland Security & Dep't of Justice, Guidance to
Assist Non-Federal Entities to Share Cyber Threat Indicators and
Defensive Measure with Federal Entities under the Cybersecurity
Information Sharing Act of 2015 5, https://www.us-cert.gov/sites/
default/files/ais_files/Non-
Federal_Entity_Sharing_Guidance_(Sec%20105(a)).pdf.
---------------------------------------------------------------------------
Congress should also consider amending CISA to narrow the law
enforcement use authorizations so that information shared can only be
used for cybersecurity purposes and investigations into related
computer crimes. Finally, Congress can resolve the privacy community
and technology industry's concerns by removing the authorization for
the President to designate a second authorized information-sharing
portal.
Question 2. One of my goals this Congress is to get a better handle
on cybersecurity metrics: Namely, are the actions we are taking having
measureable improvements on our security? Based on your experience, how
can we better measure cybersecurity outcomes?
Answer. The annual Verizon Data Breach Investigations Report is one
of the best-available resources for measuring the effectiveness of our
actions to improve cybersecurity. The report provides a good 60,000-
foot view of the state of cybersecurity threats and response. It can
also help to provide guideposts for where to focus resources to yield
the most improvement.
For example, year after year, these reports make clear that the
vast majority of cyber threats target previously known vulnerabilities,
so Americans fall victim to data breaches simply because they have
failed to maintain updated software. Verizon's 2016 report concluded
that 85 percent of successful exploits used the same 10
vulnerabilities, all of which have patches available.\8\ This marks an
improvement over the previous year, where Verizon found that ``99
percent of the exploited vulnerabilities were compromised more than a
year after the CVE was published,'' and 97 percent of those exploits
targeted just 10 vulnerabilities.\9\
---------------------------------------------------------------------------
\8\ Verizon, 2016 Data Breach Investigations Report: Executive
Summary 10 (2016), http://www.verizonenterprise.com/resources/reports/
rp_dbir-2016-executive-summary_xg_en.pdf. Full Report available at
http://www.verizonenterprise.com/verizon-insights-lab/dbir/2016/.
\9\ Verizon, 2015 Data Breach Investigations Report 15-16 (2015),
https://msisac.cisecurity.org/whitepaper/documents/1.pdf.
---------------------------------------------------------------------------
Thus, the reports show that one of the most meaningful ways to
enhance cybersecurity would be to reduce the frequency of successful
attacks that were preventable. Despite the improvements that are being
made, Congress should place greater focus on identifying policy
solutions that will encourage more and more regular vulnerability
patching. Additionally, Congress should identify ways to incentivize
companies to incorporate privacy by design as they build their products
and services, such as by providing automatic security updates.
Though Verizon's annual report, and similar reports from other
companies are helpful, they do not provide the granular data that may
be necessary to respond to more advanced threats or to identify certain
trends. For this, improving metrics is key. DHS is currently
collaborating with the insurance industry through the Cyber Incident
Data and Analysis Working Group to try to establish a repository for
sharing of current and historical non-personally identifiable cyber
incident data.
The goal of the repository would be to create a data-rich resource
that can be analyzed to ``promote greater understanding about the
financial and operational impacts of cyber events, the effectiveness of
existing cyber risk controls in addressing them, and the new kinds of
products and services that cybersecurity solutions providers should
develop to meet the evolving risk mitigation needs of their
customers.''\10\ Thus, if effective, the repository would yield new
metrics that can be used to improve risk mitigation strategies, and may
also positively impact the cybersecurity insurance market. Congress
should follow the progress of this working group to determine if such a
repository is an effective way to obtain more and more actionable
metrics on the effectiveness of our cybersecurity strategy.
---------------------------------------------------------------------------
\10\ Dep't of Homeland Sec., Enhancing Resilience Through Cyber
Incident Data Sharing and Analysis: The Value Proposition for a Cyber
Incident Data Repository 2 (2015), https://www.dhs.gov/sites/default/
files/publications/dhs-value-proposition-white-paper-2015_v2.pdf. For
more resources on the CIDAWG, see Cyber Incident Data and Analysis
Working Group White Papers, Dep't of Homeland Sec, https://www.dhs.gov/
publication/cyber-incident-data-and-analysis-working-group-white-papers
(last accessed Apr. 13, 2017).
---------------------------------------------------------------------------
Question 3a. On December 29, 2016, the Department of Homeland
Security released a Joint Analysis Report (JAR) regarding Russian
malicious cyber activity designated as GRIZZLY STEPPE. Included in the
JAR were indicators that were released in STIX and CSV formats.
How did your organization/company utilize the JAR?
Question 3b. Did you find the technical indicators of malicious
Russian cyber activity useful? Why or why not?
Question 3c. What proportion of the technical indicators was your
organization/company aware of before the release of the JAR?
Question 3d. Do you believe the JAR helped improve the Nation's
cybersecurity?
Answer. New America did not utilize the Joint Analysis Report (JAR)
regarding Russian malicious cyber activity designated as GRIZZLY
STEPPE.
[all]