[Senate Hearing 117-266]
[From the U.S. Government Publishing Office]
S. Hrg. 117-266
NATIONAL CYBERSECURITY STRATEGY:
PROTECTION OF FEDERAL AND CRITICAL INFRASTRUCTURE SYSTEMS
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON
HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
SEPTEMBER 23, 2021
__________
Available via the World Wide Web: http://www.govinfo.gov
Printed for the use of the
Committee on Homeland Security and Governmental Affairs
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
__________
U.S. GOVERNMENT PUBLISHING OFFICE
47-628PDF WASHINGTON : 2023
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
GARY C. PETERS, Michigan, Chairman
THOMAS R. CARPER, Delaware ROB PORTMAN, Ohio
MAGGIE HASSAN, New Hampshire RON JOHNSON, Wisconsin
KYRSTEN SINEMA, Arizona RAND PAUL, Kentucky
JACKY ROSEN, Nevada JAMES LANKFORD, Oklahoma
ALEX PADILLA, California MITT ROMNEY, Utah
JON OSSOFF, Georgia RICK SCOTT, Florida
JOSH HAWLEY, Missouri
David M. Weinberg, Staff Director
Zachary I. Schram, Chief Counsel
Christopher J. Mulkins, Director of Homeland Security
Jeffrey D. Rothblum, Senior Professional Staff Member
Michael A. Garcia, Professional Staff Member
Pamela Thiessen, Minority Staff Director
Andrew Dockham, Minority Chief Counsel and Deputy Staff Director
William H.,W. McKenna, Minority Chief Investigator
Patrick T. Warren, Minority Investigative Counsel
Cara G. Mumford, Minority Professional Staff Member
Laura W. Kilbride, Chief Clerk
Thomas J. Spino, Hearing Clerk
C O N T E N T S
------
Opening statements:
Page
Senator Peters............................................... 1
Senator Portman.............................................. 3
Senator Carper............................................... 13
Senator Hassan............................................... 15
Senator Ossoff............................................... 23
Senator Lankford............................................. 26
Senator Scott................................................ 29
Prepared statements:
Senator Peters............................................... 37
Senator Portman.............................................. 39
WITNESSES
Thursday, September 23, 2021
Hon. Chris Inglis, National Cyber Director, Executive Office of
the President.................................................. 5
Hon. Jen Easterly, Director, Cybersecurity and Infrastructure
Security Agency, U.S. Department of Homeland Security.......... 7
Christopher DeRusha, Federal Chief Information Security Officer,
Office of Management and Budget................................ 9
Alphabetical List of Witnesses
DeRusha, Christopher:
Testimony.................................................... 9
Prepared statement........................................... 54
Easterly, Hon. Jen:
Testimony.................................................... 7
Prepared statement........................................... 47
Inglis, Hon. Chris:
Testimony.................................................... 5
Prepared statement........................................... 42
APPENDIX
Portman chart.................................................... 58
Portman CISA Alert............................................... 59
Portman Communications Association Letter........................ 65
Portman Financial Associations Letter............................ 70
Portman Multi Association Letter................................. 73
Portman Pipeline Letter.......................................... 76
Additional statements for the Record:
AAI.......................................................... 80
Responses to post-hearing questions for the Record:
Mr. Inglis................................................... 83
Ms. Easterly................................................. 88
NATIONAL CYBERSECURITY STRATEGY:
PROTECTION OF FEDERAL AND CRITICAL INFRASTRUCTURE SYSTEMS
----------
THURSDAY, SEPTEMBER 23, 2021
U.S. Senate,
Committee on Homeland Security
and Governmental Affairs,
Washington, DC.
The Committee met, pursuant to notice, at 10:15 a.m., via
Webex and in room SD-342, Dirksen Senate Office Building, Hon.
Gary Peters, Chairman of the Committee, presiding.
Present: Senators Peters, Carper, Hassan, Sinema, Rosen,
Padilla, Ossoff, Portman, Johnson, Lankford, Romney, Scott, and
Hawley.
OPENING STATEMENT OF CHAIRMAN PETERS\1\
Chairman Peters. The Committee will come to order. I want
to thank our witnesses for joining us here today and for their
service to the American people. Your agencies and offices are
vital to protecting Federal cyber networks and critical
infrastructure systems.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Peters appears in the
Appendix on page 37.
---------------------------------------------------------------------------
Although it can often be difficult to understand the
complexity and severity of many cyberattacks, they are only
increasing in sophistication and frequency, and have a
significant cost on our national security.
The Federal Bureau of Investigation (FBI) reported that
there were 2,474 ransomware attacks in 2020, though experts
believe that that number is actually much, much higher.
Just last month, in my home State of Michigan, about 1,500
patients were notified that their information had been exposed
as a result of the breach of a file-sharing service used by
their hospital. This breach, like the SolarWinds attack, is yet
another example of how our adversaries target vendors and
contractors, including small businesses, to find the weakest
link and exploit our greatest vulnerabilities.
In order to prevent these types of attacks, potential
victims, from the public sector to the private sector, must be
aware of these ever-changing threats, and have the right
information to safeguard their networks. Whether it is
widespread spyware or a ransomware attack, the Federal
Government needs to know when cyber incidents have occurred so
they can determine if there are patterns, also future potential
targets, and help seal up vulnerabilities.
This information is especially vital when it comes to our
nation's critical infrastructure, 85 percent of which is
privately owned and operated. Despite this vulnerability there
is currently no national requirement for all critical
infrastructure owners and operators to report to the Federal
Government when they have been hit with a significant attack,
and that needs to change.
As we have seen from recent attacks on an oil pipeline,
water treatment plants, food processing facilities, and
hospitals, these breaches can cause serious economic and
national security concerns, and disrupt our daily lives. If
multiple critical infrastructure entities, like energy
companies for example, are reporting similar attacks, then
Cybersecurity and Infrastructure Security Agency (CISA) and
other Federal entities should be able to warn others, prepare
for potential impacts to that sector or other related sectors,
and help prevent further widespread attacks.
Ranking Member Portman and I are currently working on
legislation that we plan to introduce soon, to require critical
infrastructure companies that experience cyber incidents, and
other entities that make ransomware payments, to report this
information to CISA. This requirement will ensure CISA and
other Federal officials have better situational awareness of
ongoing cybersecurity threats, who those targets are, how the
adversary is operating, and how best to protect the Nation.
I am looking forward to hearing from our witnesses today
about how an incident reporting law could help each of your
organizations assist victims in recovering from an attack and
prevent them from happening in the first place. But we also
need to ensure the Federal Government is sharing this same
information in a timely manner.
The last time Congress substantially addressed Federal
cybersecurity was in 2014, when this Committee, led by then
Chairman Carper, passed the Federal Information Security
Modernization Act (FISMA). Since then, our technology has
developed rapidly, along with the sophisticated threats that we
face. When that legislation was passed, CISA had not yet even
been created.
We need to pass updated legislation that clarifies CISA's
roles and responsibilities in Federal information security,
improves how incidents on Federal networks are reported to
Congress, and ensure that our cybersecurity resources are
effectively aligned with emerging threats. Ranking Member
Portman and I are also working on legislation that would help
achieve these goals.
We also need a better understanding of how the Federal
Government is balancing its responsibility to bring
cybercriminals to justice and helping victims recover from an
attack.
We learned earlier this week that in one instance, the FBI
withheld a digital key that could have aided victims for
several weeks to pursue its investigation. In order to conduct
thorough oversight, this Committee needs to know more about the
Federal Government's processes for assisting the victims of
attacks and how your agencies weigh investigative, national
security, and economic needs.
Finally, I want to acknowledge the important actions the
Biden administration has already taken to bolster our
cybersecurity defenses, improve information sharing, and apply
the lessons learned from previous breaches to avoid future
attacks. The President's Executive Order (EO) ``On Improving
the Nation's Cybersecurity,'' for example, is paramount to
securing our Nation.
This is a top priority for both myself and Ranking Member
Portman, and I look forward to today's discussion and working
productively with these vital Federal agencies to ensure we are
addressing this threat.
Ranking Member Portman, you are now recognized for your
opening comments.
OPENING STATEMENT OF SENATOR PORTMAN\1\
Senator Portman. Thank you, Mr. Chairman, and thanks for
convening this critically important hearing. I look forward to
the dialog and it is great to have people in place who are now
in charge of our cybersecurity system at the Federal Government
level. Our strategy for protecting our cyber networks and
critical infrastructure is something that we have been
struggling with, frankly, and to have the leadership in place
is very important to get that strategy right.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Portman appears in the
Appendix on page 39.
---------------------------------------------------------------------------
One important part of that, in my view, is accountability,
and I hope to have a conversation about the appropriate roles
and responsibilities for the many different cybersecurity
positions within the Federal Government, who is in charge, who
is making decisions, who is accountable. I also look forward to
discussing how cyber incident reporting legislation might
better inform that strategy, as the Chairman has just said. I
think that is very important, and if we can get that right and
if we can get a bipartisan product on that.
In recent years, hostile cyber adversaries, both foreign
and domestic, have executed some of the most damaging
cyberattacks ever, and we all know about these. We have had
hearings about them, Colonial Pipeline most recently. Both the
Federal Government and private sector companies have been
targeted. We held hearings on SolarWinds, Colonial Pipeline,
and others. These events are stark reminders of the wide-
ranging and real-world impacts of sophisticated cyberattacks
and impacts on people.
These attacks have become more and more common, and so it
is important that we work to protect ourselves and our
networks. One of the best strategies for preventing these
attacks, of course, is to improve baseline cybersecurity
practices, basic cyber hygiene. We also know that Federal
agencies have failed to make meaningful progress on the
implementation of these practices, as is actually required by
law under FISMA.
In August, just last month, Chairman Peters and I released
a report detailing the significant cybersecurity
vulnerabilities of eight key Federal agencies: the Departments
of Homeland Security (DHS), State, Transportation (DOT),
Housing and Urban Development (HUD), Health and Human Services
(HHS), Agriculture (USDA), Education, and Social Security
Administration (SSA). This report follows a 2019 report I
released with Senator Carper as Chair of the Permanent
Subcommittee on Investigations (PSI), evaluating the same eight
agencies.
In this year's report, only DHS had an effective
cybersecurity program. Every other agency featured in the
report failed to meet this standard. We also found the average
grade across all government agencies was a C minus, close to
failing. The report identifies several common agency
vulnerabilities, including the failure to adequately protect
personally identifiable information (PII); maintain an accurate
and up-to-date list of the agency's information technology (IT)
assets; install security patches in a timely fashion; and
retire vulnerable legacy technology that is no longer secure.
Securing fragmented networks against increasingly
sophisticated attackers is not an easy or trivial task. It
would be unfair to suggest otherwise. Yet, in the nearly seven
years since FISMA was last updated in 2014, agencies still have
the same vulnerabilities, year after year.
Accountability is a critical aspect of any strategy. All
three witnesses with us here today have heard me discuss the
importance of it for Federal cybersecurity in particular. At
all of your confirmation hearings and in our conversations we
talked about the need to ensure that we have appropriate
accountability for these Federal networks and the agency
systems. Among the three of you and the Deputy National
Security Advisor for Cyber, I believe that we will continue to
see these inconsistencies or vulnerabilities, because of the
question about accountability, unless we are clear about who is
in charge, who is in charge to better prevent, who is charge to
better respond to cyberattacks. I look forward to continuing
that discussion today again of how we can best achieve that
accountability.
We are also here to discuss another important topic of
overarching strategy, and particularly, cyber incident
reporting. As I said, recent attacks on critical
infrastructure, particularly through ransomware, demonstrate
how prompt notification to the government can benefit both the
government and its victims. In the case of Colonial Pipeline,
the FBI was able to recover part of the ransom paid by Colonial
to the attackers. There is a balance between getting
information quickly, letting victims respond to an attack
without imposing onerous requirements on them, and getting
accurate information. We understand that balance and we want to
try to reach the right balance to be sure that we are actually
doing what we intend to do, which is to help the private sector
and government agencies deal with cyberattacks. I look forward
to the witnesses' perspectives on how to balance those
competing priorities.
Again, Mr. Chairman, I appreciate the witnesses being
here--glad you are in place--and I look forward to the dialog.
Chairman Peters. Thank you, Ranking Member Portman.
It is the practice of this Committee to swear in witnesses,
so if each of you would please stand and raise your right
hands.
Do you swear that the testimony you will give before this
Committee will be the truth, the whole truth, and nothing but
the truth, so help you, God?
Mr. Inglis. I do.
Ms. Easterly. I do.
Mr. DeRusha. I do.
Chairman Peters. You may be seated.
Our first witness today is National Security Director (NSD)
Chris Inglis. Director Inglis has over 41 years of Federal
service and has held a variety of senior leadership assignments
at the Department of Defense (DOD) and the National Security
Agency (NSA). He initially began his career at NSA as a
computer scientists within the National Computer Security
Center, eventually serving seven and half years as a senior
civilian and deputy director. His work included tours in
information assurance, policy, time-sensitive operations, and
signal intelligence operations.
In addition to his civilian work, Mr. Inglis' military
career includes over 30 years of service in the U.S. Air Force
(USAF), nine years on active duty, and 21 years in the Air
National Guard (ANG), from which he retired as a brigadier
general in 2006.
Mr. Inglis, thank you for all of your service to the
American people. I know this is the first time you have come
before this Committee since your confirmation, and we expect
you will be here many times in the time ahead.
So welcome. You may proceed with your opening comments.
TESTIMONY OF THE HONORABLE CHRIS INGLIS,\1\ NATIONAL CYBER
DIRECTOR, EXECUTIVE OFFICE OF THE PRESIDENT
Mr. Inglis. Thank you, sir. As do I. With your permission,
I will remove my mask for the duration of my remarks.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Inglis appears in the Appendix on
page 42.
---------------------------------------------------------------------------
Chairman Peters. Certainly.
Mr. Inglis. Chairman Peters, Ranking Member Portman,
distinguished Members of the Committee and staff, thank you for
the privilege to appear before you today and the honor to
appear alongside Director Easterly and Mr. DeRusha. I am eager
to update you on the Biden-Harris administration's progress in
standing up the new Office of the National Cyber Director
(ONCD) and to discuss the administration's approach to
cybersecurity.
I am mindful of the history of this moment, and appearing
before you as the first National Cyber Director (NCD), a
position that you created last year and confirmed me for
following my nomination by President Biden. I am grateful for
the confidence that the President and the Congress have placed
in this role, for the opportunity to bring it to fruition, and
for the cybersecurity and critical infrastructure investments
that you have made and are proposing in follow-on vehicles like
the Infrastructure Investment and Jobs Act. I remain committed
to engaging with you as we take on these critical, shared
imperatives.
To that end, I am pleased to tell you that the Office of
the National Cyber Director is making progress in standing up
as a full-fledged contributor to the various initiatives we
will discuss today. While we are anxious to receive
appropriations needed to implement our strategy fully, no
resource in this business is more valuable than our people. As
you well realize, cyber talent is in high demand everywhere,
but we are pleased with the quality and the experience of the
people we have recruited thus far, and we will continue to work
with Congress to secure the resources we need to bring on key
staff.
In the coming months, I expect our contribution from the
Office of the National Cyber Director to the President's
cybersecurity agenda to grow and focus on a few key challenges:
accountability and follow-through on the implementation of
cybersecurity policy and investments; securing technology
supply chains and the broader cyber ecosystem; fostering
collaboration across the public and private sectors;
coordinating closely with the Office of Management and Budget
(OMB) and CISA on the security, resilience, and coherence of
the Federal network enterprise; and ensuring defensive cyber
operation and planning we are equipped and postured for
success.
I will also be working with my colleagues to continue
implementing crucial initiatives, directed by President Biden,
including working with my counterparts on the implementation of
Executive Order 14028, on improving the nation's cybersecurity;
initiatives to strengthen and proactively defend critical
infrastructure cybersecurity; and the central challenge of
building a cyber workforce to meet our needs well into the
future.
To these ends, the Office of the National Cyber Director
will endeavor to drive the Federal Government's efforts through
the following priorities. First, the office will champion
coherence across the Federal cyber enterprise, ensuring we
speak with one voice, and more importantly, operate with unity,
purpose and effort.
Second, we will zero in on improving public-private
collaboration, supporting and building on the work of CISA and
others.
Third, we will carefully analyze the cyber maturity of
Federal agencies and chart a path for ambitious cybersecurity
goals against which the U.S. Government can effectively
execute. We look forward to close partnership with OMB to align
resources and authorities together with these ambitions.
Finally, the office will work to increase present and
future resilience, not only within the Federal Government but
across the American digital ecosystem. That is a big task for
which we have started by exercising incident response and
planning processes from which we have already learned much
regarding how to evolve those processes into the future.
Through these and other efforts, we are working to ensure
that our workforce, our technologies, our organizations, and
our relationships are not only fine-tuned for today's needs but
are futureproofed for service in an ever-changing world. These
are daunting undertakings. While the Office of the National
Cyber Director is young and small, once expected funding is in
place, and with the partners we have today, along with the
support of Congress, it will be in a strong position to succeed
in delivering the expected returns.
Thank you for the opportunity to testify before you today.
I look forward to your questions.
Chairman Peters. Thank you, Mr. Inglis.
Our next witness is Jen Easterly, Director of the
Department of Homeland Security's Cybersecurity and
Infrastructure Security Agency. As Director, Ms. Easterly leads
CISA's efforts to protect and defend the security of the
nation's cyber and physical infrastructure. Ms. Easterly has an
established record of public service, including two tours at
the White House, most recently as Special Assistant to
President Obama and Senior Director for Counterterrorism, and
previously as Executive Assistant to National Security Advisor
Condoleezza Rice in the George W. Bush Administration.
She is a veteran of the United States Army, with more than
20 years of service in intelligence and cyber operations,
including tours of duty in Haiti, the Balkans, Iraq, and
Afghanistan.
Ms. Easterly, I know this is also your first time you have
been before this Committee since your confirmation, and we
expect to see you here on numerous occasions in the time ahead
as well. Welcome, thank you for your service. You may proceed
with your opening comments.
TESTIMONY OF THE HONORABLE JEN EASTERLY,\1\ DIRECTOR,
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY, U.S.
DEPARTMENT OF HOMELAND SECURITY
Ms. Easterly. Thank you Chairman. I look forward to it.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. Easterly appears in the Appendix
on page 47.
---------------------------------------------------------------------------
Chairman Peters, Ranking Member Portman, distinguished
Members of the Committee, thanks for the opportunity to testify
on behalf of CISA on what I believe is the most important
national security imperative, our nation's cyber defense. I am
grateful for your trust in confirming me to this position, and
as I have shared with my team on each of my first 73 days in
this office, I have the best job in government.
As I always say, cybersecurity is a team sport, so I am
truly honored to testify today alongside Chris Inglis and Chris
DeRusha, my teammates and partners in cyber defense.
I have spent the past two and half months getting to know
my teammates within CISA and engaging with partners across the
Federal Government at the State and local level, in private
industry, and across the globe. Based on those observations, I
want to outline my priorities for CISA and thoughts for how to
move forward collectively to raise our cybersecurity baseline.
As the Director of CISA, I am focused on building our
workforce, strengthening the resilience of our Federal civilian
enterprise, and elevating the security of our nation's cyber
ecosystem. First, people are CISA's No. 1 asset, and I am
intently focused on making CISA the world's premier cyber and
infrastructure defense agency, the place where the best network
defenders want to work.
When I arrived at CISA I found a dedicated, innovative, and
inspiring team. I intend to expand upon that foundation to
build a culture of excellence and a talent management ecosystem
that prizes teamwork and collaboration, innovation and
inclusion, trust and transparency, ownership and empowerment. I
am equally focused on building a workforce that reflects the
diversity of our Nation, not just because it is the right thing
to do but because it is the smart thing to do. Diversity of
experience, background, and thought enables better problem-
solving.
Incidents like SolarWinds and Colonial Pipeline, JPS Foods,
and the scourge of ransomware attacks that you mentioned on our
schools and hospitals and small businesses illustrate how
cybersecurity impacts our daily lives. They also highlight the
need to address shared cybersecurity risk, and it truly is
shared. Together we have to focus on strengthening our cyber
defenses, investing in new capabilities, and fundamentally
reimagining how we think about cybersecurity for the Nation.
To that end, CISA is pursuing capabilities that increase
visibility into cybersecurity risks across Federal agencies and
critical infrastructure. One such capability, CyberSentry,
helps identify sophisticated threats to critical networks. We
are excited about the results from the pilot and appreciate
Congress' efforts to fully resource it.
CISA, as an agency, as you know, was designed to be
something different and special, built on the foundation of
collaboration with partnerships at the core of our mission.
Recognizing that no single entity has all the answers, my goal
is to shift the paradigm, transform public-private partnerships
into operational collaboration, transformation information-
sharing into information-enabling, making sure that the data we
deliver to network defenders is timely, relevant, and most
importantly, actionable.
We are going to do this, in part, through the newly
established Joint Cyber Defense Collaborative (JCDC), and I
want to thank you for authorizing it. JCDC harnesses the power
of the Federal cyber ecosystem and the private sector to create
a common operating picture. Our goal is to be able to see the
dots, to connect the dots, and then to drive action to enable
collective defense.
All of these efforts align with the imperatives conveyed in
the President's Executive Order, as you mentioned, as well as
the last year's National Defense Authorization Act (NDAA). They
seek to further CISA's implementations of those requirements,
and with respect to the EO in particular, I am pleased to note
that CISA has fully met the highly aggressive deadlines for
each of the 35 unique implementation efforts we were charged to
lead.
That said, we have a lot of work ahead of us and we need
Congress' help. As you know, there is no single mandatory
Federal requirement for the reporting of cyber incidents, and
without timely notification to CISA critical analysis,
mitigation guidance, and information-sharing is severely
delayed, leaving infrastructure vulnerable. Incident reporting
must be timely, broad-based, and not limited by incident type
or sector impacted. It also has to provide enforcement
mechanisms to drive compliance.
Finally, legislation should provide CISA with the
flexibility to define the scope of requirements in consultation
with our partners, including importantly, the Department of
Justice (DOJ) and FBI, balancing the benefit of reporting
against the burdens to industry and government.
Finally, I would like to thank the Committee for the
efforts on FISMA reform. As you said, FISMA is outdated. The
status quo clearly is not working. A modernized FISMA should
shift the spotlight from compliance and docs checking to true
risk management. It also should recognize and codify CISA's
role as the operational lead for Federal cybersecurity. As
these efforts move forward, I really look forward to working
with the Committee and our partners on it. It is hugely
important.
Our nation faces an unprecedented array of cyber risks. Now
is the time to act to deepen our collaboration, to strengthen
our ability to defend the government's network to drive
targeted action. We must address this risk collectively to
defend today and secure tomorrow.
Thanks for the opportunity to appear before you. I look
forward to your questions.
Chairman Peters. Thank you, Director Easterly. Thank you
for being here.
Our final witness is Chris DeRusha. Mr. DeRusha has broad
experience managing cybersecurity and critical infrastructure
programs, plans, and operations in both the Federal Government
and private sector. He has held roles at the Department of
Homeland Security and at the White House, where he served as
Senior Cybersecurity Advisor in the Obama Administration. He
also previously served as the State of Michigan's Chief
Information Security Officer (CISO).
Mr. DeRusha, as the Federal Chief Information Security
Officer, you are charged with implementing and coordinating
many of the efforts that we will be discussing here today, and
based on your strong record in my home State of Michigan and
your extensive experience, I have every confidence that you are
up to this challenging task.
Welcome, Mr. DeRusha. You may proceed with your opening
remarks.
TESTIMONY OF CHRISTOPHER DeRUSHA,\1\ FEDERAL CHIEF INFORMATION
SECURITY OFFICER, OFFICE OF MANAGEMENT AND BUDGET
Mr. DeRusha. Thank you, Chairman Peters and Ranking Member
Portman, distinguished Members of the Committee. Thank you for
the invitation to testify about the administration's
cybersecurity priorities. I am pleased to be here today with
Directors Easterly and Inglis. The three of us work closely
together in service of a common mission, to build a more secure
Federal enterprise.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. DeRusha appears in the Appendix
on page 54.
---------------------------------------------------------------------------
This Committee took decisive action earlier this year by
supporting $1 billion in emergency funding to the Technology
Modernization Fund (TMF). I would like to provide a brief
update. To date, we have received more than 100 project
proposals, requesting over $2.3 billion. Seventy-five percent
of those proposals are focused on cybersecurity improvements.
The need is clear. As the board prepares to release its first
round of awards for this emergency funding, we are focused on
learning what works well for one agency and translating that
into successful outcomes for all.
These are challenging times to manage cybersecurity for any
enterprise. It is not the time for us to maintain a steady
course. We need to embrace bold ideas. We need to form enduring
partnerships. Above all, we must act with a sense of urgency.
I would like to now highlight three areas of focus where
the administration is taking decisive action on Federal
cybersecurity. The first is zero trust. Earlier this month, we
released, for public comment, a draft strategy to move the U.S.
Government toward zero trust principles. This term, ``zero
trust,'' refers to a security model where every person, device,
and network is considered untrusted and potentially
compromised. This is a significant shift from the traditional
model we have used throughout the public and private sector.
We have proposed an ambitious, multiyear plan that
establishes a new baseline for government security and will
require us to iterate and adjust over time. Our strategy
directs agencies to adopt known, trusted technologies and
practices that make harder for even sophisticated adversaries
to defeat our defenses. The approach is purposeful and
specific, yet flexible, for agencies to learn and adjust along
the way. OMB will require agencies to develop funding and
implementation plans to demonstrate earlier iterative progress,
and, most importantly, to work together as one community in
implementation.
The second area I would like to highlight is the Executive
Order on improving the nation's cybersecurity. In May, the
President issued Executive Order 14028, with the intent of
dramatically improving the nation's cybersecurity, by deploying
critical capabilities governmentwide, by improving information-
sharing between U.S. Government and the private sector, and by
strengthening the United States' ability to respond to
incidents when they do occur.
We recently passed the 120-day milestone since the EO was
issued. Over that time, OMB, National Security Council (NSC),
and now the NCD have been working closely with agencies to
execute key deliverables, which include a definition of
critical software as well as accompanying security guidance
from National Institute of Standards and Technology (NIST); the
recommendation of new contract causes that will enhance how the
Federal Government aims to work together to address cyber
threats; OMB memoranda to help agencies identify and secure
their most critical software; and set requirements for storing
and sharing security data to support incident detection and
response activities.
Finally, as I described a moment ago, it drives zero trust
strategy and key supporting technical guidance developed by
CISA designed to raise the security baseline of the entire
Federal civilian government.
The final area I would like to highlight is FISMA reform.
The Federal Information Security Modernization Act of 2014
describe the roles and responsibilities that underpin much of
the policy and oversight work that my office does today. We
appreciate the opportunity to work with Congress in reforming
this flagship piece of legislation to improve the government's
ability to manage risk. We share Congress' view that we should
be more clearly oriented toward security outcomes, and we are
actively updating guidance to agencies in support of this goal.
In conclusion, this administration is dedicated to making
cybersecurity the immediate priority in Federal IT. Since
January, we have been balancing a national response to a series
of significant cyber events, well weighing the strategic
groundwork for the future. As we move forward, we are focused
on supporting agencies as they work to implement these
priorities with diligence and that sense of urgency.
As I have said today, none of us can do this alone. It is a
partnership where collaboration is key, with my colleagues here
today, but more importantly with the personnel across the
Federal Government that work tirelessly every day to safeguard
our nation's digital assets. I appreciate this Committee's
leadership in this field, and I am confident that with your
partnership and frank discussions, we are going to build a more
secure and resilient Federal enterprise together.
I thank you for the opportunity to testify today and I look
forward to your questions.
Chairman Peters. Thank you, Mr. DeRusha.
All of you are well aware that Ranking Member Portman and I
are working together on an incident reporting bill that would
require specific companies to report to CISA regarding cyber
intrusions and when they make ransomware payments as well.
Certainly after thousands of cyberattacks, including
SolarWinds, the Microsoft Exchange, and the Colonial Pipeline
ransomware attack, I think it is probably well past time for us
to have some sensible legislation put forward to make sure that
we are getting timely information about these incidents.
My first question is for Director Easterly. If our incident
reporting bill were enacted, what would CISA do with this
information, and how would you be able to help victims?
Ms. Easterly. Thanks very much for your question, Chairman.
First of all, we really appreciate this effort. We absolutely
agree it is long past time to get cyber incident reporting
legislation out there, and we are excited to work with you on
this.
CISA plays a critical role as the national coordinator for
critical infrastructure resilience and security. As I think
about CISA's superpower that we use on behalf of the Nation and
the American people is our ability to share information rapidly
to enable us to protect other potential victims.
What we could do with this information is not only render
assistance to the victim and help them remediate and recover
from the attack but we can use that information, we can analyze
it, and then we could share it broadly to see whether, in fact,
evidence of such intrusions were found across the sector or,
frankly, across other sectors, or across the Federal civilian
Executive Branch.
We think that timely and relevant reporting of cyber
incidents is absolutely critical to help us raise the baseline
and protect the cyber ecosystem.
Chairman Peters. Mr. Inglis, my next question is for you.
Would the type of information being collected by CISA, as laid
out in the draft legislation that we are working on, help NCD
formulate a national strategy and develop policies to prevent
these attacks from happening in the first place? Clearly we
want to be a deterrent for them to occur. Would this be
helpful?
Mr. Inglis. Thank you for the question, Mr. Chairman. I
wholeheartedly support what Director Easterly just said, and do
believe that information would be profoundly useful for the
determination of an appropriate strategy. To reprise, that
information is useful to help us be more efficient and to
prioritize our response in the moment, to inform investments
that we should make to get left of the event, to prevent these
from happening in the future, and ultimately as a foundation of
true knowledge, factual-based knowledge, such that we can
create strategies that cover the gamut of cybersecurity
activities.
Chairman Peters. Mr. DeRusha, the incident reporting data
from the bill that we are talking about, as well as a FISMA
reform bill that we are also working together on would help
protect Federal networks by indicating when intrusions have
occurred on both private and government-owned systems, much
like we saw after FireEye announced the SolarWinds attacks.
Is there anything else from the OMB's perspective that we
should consider as we are developing the text in both of these
bills?
Mr. DeRusha. Senator, I believe it is crucial that Federal
civilian agencies are included. We need to ensure that we have
one common standard that everyone is following. That has been
my experience, both at the State and Federal level, that there
is patchwork of reporting requirements and they need to come
together. It is really burdensome, and we are not focused on
the right security outcomes.
The other thing I would say, though, is we have a really
good partnership with CISA sharing threat information in a
timely way to Federal agencies, and what we need is we need to
increase the pipeline of information and getting it faster.
Those are the things that I would be really focused on.
Chairman Peters. This next question is for all three of
you, and I will start with you, Director Easterly. We will go
in the same order that we just went through.
Each of you has a lot of experience in the private sector,
and part of what we are looking at here is mandating companies
to submit these reports, but we have to make sure they actually
comply with that to get this information. I would love to hear
your thoughts, and the Committee would love to hear your
thoughts on the right enforcement mechanism to make sure that
that information actually gets submitted. What should we be
focused on. Director Easterly.
Ms. Easterly. Yes, thanks for the question, Chairman. As I
mentioned in my opening remarks I do think a compliance and
enforcement mechanism is very important here. I know some of
the language talks about subpoena authority. My personal view
is that is not an agile enough mechanism to allow us to get the
information that we need, to share it as rapidly as possible,
to prevent other potential victims from threat actors.
I think that we should look at fines. Fines are obviously
used across industries. I just came from four and half years in
the financial services sector where fines are a mechanism that
enable compliance and enforcement. I realize this is a
complicated issue, and I really look forward to working through
it with you, because I think it is important that we are able
to get the information that we need in a timely way.
Chairman Peters. Thank you. Mr. Inglis.
Mr. Inglis. Mr. Chairman, I support that view strongly. I
would observe that most of the 50 States have reporting
requirements of a similar sort, and the vast majority of those
have an enforcement mechanism. Many of those use fines. There
may be some best practices in there, if we do a thoughtful
survey of how they have actually addressed this and how that
has worked, and whether that has imposed an unfair burden on
the victims.
We, of course, do not want to impose an unfair burden on
the victims, but this information is essential for the welfare
of the whole. There should be rewards for good behavior. If you
have performed well and thoughtfully in this, the benefit
should obvious, which is that we can provide better services,
both in response and in preventing this in the future.
Chairman Peters. Mr. DeRusha.
Mr. DeRusha. Yes, Senator. I also agree, enforcement is
needed, and I share the views of my colleague, and I would be
happy to work with this Committee.
Chairman Peters. Thank you. Before I recognize Senator
Carper for his questions I need to step aside and attend
another committee. As you can see from attendance we have
committees. We are actually in the middle of a vote, so Members
will be coming and going as this hearing continues. Senator
Hassan, will chair in my absence. But as I leave, Senator
Carper, you are recognized for your questions.
OPENING STATEMENT OF SENATOR CARPER
Senator Carper. Senator Peters, can you hear Ms. Easterly?
Chairman Peters. I can hear you.
Senator Carper. All right. That is great. I can hear you
too. Welcome to all of our witnesses today and thank you for
your leadership and what you do with your lives.
My first question is for Director Inglis. Have I pronounced
your right name correctly?
Mr. Inglis. Yes, sir. Precisely correct. Thank you.
Senator Carper. That is great. I have worked with
colleagues, not just Democrats but colleagues on the other side
of the aisle for many years on Federal data security and breach
notification legislation that would protect the consumers'
sensitive personal information. As you know, Director Inglis,
each State as well as the District of Columbia and several
territories have some form of their own breach notification
law. There is, however, as has been said, there is no national
standard.
In 2019, while I was privileged to lead the Permanent
Subcommittee on Investigations, Senator Portman and I released
a report dealing with Equifax's repeated failures to protect
sensitive information for 145 million Americans, a lot of
people. Director Inglis, can you take a moment to speak to the
importance of having Federal data being breached standard and
whether or not it would help covered entities have consistency
in cyber-best practices and places to protect Americans'
personal information?
Mr. Inglis. Thank you for the question, Senator. As you may
well know, the administration has no formal position on that at
the moment, but I would observe the following, which is that
given that 50 States have essentially addressed this, each one
in their own way, if you are a company that operates across
those 50 States you then have 50 challenges in terms of doing
breach notification. I imagine that most of those companies are
trying to get it exactly right, so they have to do it 50 times.
To the degree that we can harmonize and standardize that
essential requirement to provide the breach notifications so
that we can assure that the victims are properly notified and
the recovery efforts address their needs at that moment of
vulnerability, I think that Federal legislation would be
useful.
Senator Carper. All right. Thank you for those comments.
Next, Jen Easterly, how are you?
Ms. Easterly. I am great, sir. How are you?
Senator Carper. Good. How are things at CISA?
Ms. Easterly. They are awesome. Best job in government.
Senator Carper. That is good. Would you work for nothing?
Ms. Easterly. Yes. I almost do.
Senator Carper. All right. We are looking for ways to bring
down the deficit. I will pass that on. [Laughter.]
Seriously, as we saw from the Colonial Pipeline ransomware
attack earlier this year, when disaster strikes in the cyber
world folks do not always know who to call. In fact, the Chief
Executive Officer (CEO) of Colonial Pipeline, Joseph Blunt, was
actually before our Committee earlier this year. He placed his
first call, he told us he placed his first call to the FBI, but
the FBI did not put him in touch with CISA. This incident, I
think, makes clear that we need a plan for who to contact when
a cyber incident occurs, and we need to better communicate that
plan with not just our Federal partners but with State and
private partners too.
Director Easterly, is there a clear and well-communicated
plan in place for the Federal Government and for critical
infrastructure entities to implement should they be subject to
a cyber, or in the case of Colonial Pipeline, to a ransomware
attack?
Ms. Easterly. Thanks so much for the question. A hugely
important issue.
Senator Carper. Who are you going to call? Ghostbusters.
How are you going to call? They are not around these days, so
who are we going to call?
Ms. Easterly. I think we are the new Ghostbusters,
actually, Senator.
It is a hugely important question, and I would just say, I
watched the hearing with Mr. Blunt from Colonial and I think it
was great that FBI immediately reached out to CISA. We have a
fabulous partnership with FBI, and that has only been confirmed
over my last two and half months how important and how strong
that partnership is.
But I think your point speaks to the larger issue and why
this cyber incident reporting legislation is so important,
because we need to get reports both about breach, as you were
just talking to Director Inglis about, about ransomware, but
really about all flavors of cyber incident. Because it is very
important for us to both be able to render assistance to any
entity that suffers an attack but to be able to analyze that
information and to share it more widely, because we know that
in today's world everything is connected, everything is
interdependent, and everything is vulnerable.
So having that information in a timely way so that CISA can
share it both with our partners across the Federal Government
but, importantly, with our partners across critical
infrastructure, and then, of course, at the State and local and
tribal and territorial (SLLT) level, so that we can
collectively raise the baseline of the cyber ecosystem. I think
it is incredibly important to instantiate that in legislation,
sir.
Senator Carper. I agree. Thanks for that response.
I have a question, as well, if time will allow, to ask of
all three witnesses. Let us start with you, Director, and then
we will go to the other witnesses. As I believe you know, each
of you mentioned, I think, in your testimony, in May 2021,
earlier this year, President Biden signed the Executive Order
aimed at strengthening our cybersecurity as well as our
authority to respond to cyber incidents when they occur. I am
pleased to see that we are shifting to a more proactive as
opposed to a reactive posture in the cybersecurity space.
My question would be this for the three of you. To that
end, could each of you take a moment to share with us how you
are working in concert with one another to implement President
Biden's Executive Order and what you need from Congress in
order to implement these changes?
Director Easterly, why don't you go first.
Ms. Easterly. Great. Thanks so much, sir. Yes, I agree, it
was a very significant Executive Order and I think it will
really help make a difference for both the Federal cyber
ecosystem as well as the broader ecosystem.
We have been working very closely with all of our partners,
in particular our partners with Federal CISA, with my good
teammates, Chris DeRusha here, and Chris Inglis, to make sure
that we are implementing all of the tasks that were assigned to
us. I think we had 35 total, and we have met all the deadlines
to date.
As you said, this is about a paradigm shift and how we
protect the Federal cyber ecosystem, improving information-
sharing from Federal contractors, modernizing the
infrastructure to move to zero trust architecture, as Mr.
DeRusha already talked about, making sure we have cloud-secure
instantiations, and then making sure that we are implementing
what we call endpoint detection and response (EDR) technology,
which allows us to not just focus on the perimeter but really
to focus in depth, all the way down to the host level, at the
workstation, at the server, to ensure that we can see what
threats are out there, detect suspicious activity, and ensure
that we are able to mitigate and remediate it as soon as
possible.
So those aspects of it, plus all we are doing about secure
software, software bill of materials, and then finally,
everything we are doing to improve detection around logging.
So a lot of work done. I look forward to keeping the
Committee updated, sir, on the important work. Thank you.
Senator Carper. Thank you, ma'am. Mr. DeRusha, really the
same question. Talk to us a little bit about----
OPENING STATEMENT OF SENATOR HASSAN
Senator Hassan [Presiding.] Senator Carper, I am going to
ask each witnesses to respond to your question, but you are
over by about a minute, and so we need to move along.
Senator Carper. OK. Thank you. All right. I will yield.
Thank you.
Mr. DeRusha. Yes, Senator. Look, it was a very large,
aggressive action plan, which we felt completely appropriate
for the moment. We are focused, and made a lot of progress
already on baseline hygiene measures. Director Easterly just
described some of those.
We have also set in place a multi-year strategy and plan,
and, what we are going to need from Congress is, we are going
to need some new resources to implement this plan. But what we
have done is we have really laid out, in pretty descriptive
detail, what we need to do to become more secure as a Federal
enterprise. We really look forward to working with Congress on
those priorities.
Mr. Inglis. Senator, I will answer quickly. I am largely in
agreement with all of those remarks. I was impressed with the
audacity of the plan--very aggressive. I am pleased with the
performance. We have met or exceeded the objectives that were
established. I am sobered by the idea that it is simply a down
payment. To Mr. DeRusha's point, we have much more work to do,
and we, therefore, need to redouble our efforts to do that.
Senator Carper. Thank you all very much.
Senator Hassan. Thank you, Senator Carper. Because Senator
Portman is not back yet I am going to recognize myself for a
round of questions, and I want to thank Chair Peters and the
Ranking Member for this hearing, and I also want to thank the
three of you not only for your service but for your testimony
today and your commitment to improving the country's
cybersecurity.
My first question goes to Directors Easterly and Inglis,
and I will start with Director Easterly. One of the biggest
impediments to improving cybersecurity is the shortage of
qualified cybersecurity professionals at Federal, State, and
local level. I have introduced, along with Senator Cornyn, the
Bipartisan Federal Cybersecurity Workforce Expansion Act. The
act would authorize a registered cybersecurity apprenticeship
program at CISA, and it would also create a veteran
cybersecurity training program at the Department of Veterans
Affairs (VA).
Director Easterly, how would an apprenticeship program help
address workforce challenges at CISA?
Ms. Easterly. Thanks for the question. I love that. I love
apprenticeships. We have already started talking about how we
could implement apprenticeships at CISA. I would love to work
with you on that legislation.
I think we need to be as creative as possible in all our
approaches to deal with the deficit that we have across the
country and then across the Federal cyber workforce. So
programs like rotational programs, apprenticeships,
internships, and I am very excited, in particular, about
implementing our Cyber Talent Management System (CTMS),
finally, to enable us to more flexibly hire people from all
walks of life, basically based on their aptitude, not based on
certifications or degrees.
So anything to do with workforce, Senator, I would love to
work with you and your team and this Committee.
Senator Hassan. Great. I would look forward to that.
Director Inglis, what do you think of cyber apprenticeships
and a veterans' training program, and are there other ways we
can increase the talent pipeline to build a larger
cybersecurity workforce?
Mr. Inglis. Senator, once again I am in that position where
happily I agree strongly with both the premise that you have
established and Director Easterly's remarks. I think
apprenticeships are essential, not simply because they provide
experience for its own sake, but they bridge the gap between
aspiration that is often supported by training and education
and the real experience that employers need or want when you
show up at that door. It helps to transition from one phase to
another, in terms of one's work life.
To the extent that that is something we can pilot, at CISA
or within the Veterans Administration or other places, I would
hope that we make that broadly available to the rest of
government.
As to what else we can do, I think that it falls into three
broad buckets, which are not unrelated. We need to increase
awareness, so that every citizen, every person who experiences
cyberspace has what is necessary to cross the digital cyber
street in the same way that we teach children to cross actual
streets, and that they are aware of the opportunities in this
space.
It would be to make sure that we invest some more training
and education in those who make decisions that implicate
cybersecurity but they do not know it, whether they are lawyers
or logisticians or system engineers.
Then, of course, we need to double down on filling the jobs
that have cyber and IT in their job title. I think we need to
be as broad-based as possible. To Ms. Easterly's point, we need
to encourage diversity, because that is a mission-essential
strength. But at the same time let us relook those jobs skills
to make sure we are asking for the right things. You do not
need a bachelor of science in computer science for every one of
those jobs.
Senator Hassan. Thank you very much.
Director Easterly, the Office of Management and Budget
recently released a draft zero trust strategy, and it was nice
to hear Mr. DeRusha talk about it. It states that the
continuous diagnostics and mitigation (CDM) program run by CISA
is a foundational element of the Federal Government's
cybersecurity. I introduced legislation with Senator Cornyn
last Congress to codify the program, and we are working on
reintroducing CDM legislation this Congress.
When do you expect all civilian Federal agencies to have
their electronic assets inventoried and continuously monitored
via CDM?
Ms. Easterly. Thanks for the question. It is a great one.
Having a lot of experience in this space, and certainly in the
private sector, asset inventories and ensuring that you know
exactly what is in your network is not a trivial endeavor.
All that said, I am told that we are at about 85 percent of
an understanding of the Federal endpoints, and so I think we
will get there in the near term, and I am happy to keep you
updated on the course of our progress.
Senator Hassan. OK. A related issue, of course, is whether
CISA is re-evaluating previously approved CDM tools to ensure
that they still meet the newest best practices and our zero
trust strategy. So is that happening as well?
Ms. Easterly. Yes, ma'am, absolutely, as part of our entire
modernization effort to make sure that we are able to provision
the right capabilities through the CDM program, and some of the
most important ones, as you are aware of, are EDR capabilities.
Senator Hassan. OK. Another question for you, Director
Easterly. Next week I am going to lead a Subcommittee hearing
on the Federal Government's IT management resources. The
service is available to agencies to modernize their aging
systems and ways to improve those programs while also saving
taxpayers money. Mr. DeRusha, I am looking forward to hearing
from your colleague, Federal Chief Information Office (CIO)
Clare Martorana on this topic.
An important aspect of ensuring the cybersecurity of
Federal systems is modernizing outdated and obsolete IT
systems, which are difficult, if not impossible to properly
secure. Director Easterly, how is CISA supporting agency
efforts to modernize their aging IT systems to improve
cybersecurity?
Ms. Easterly. We are taking a very aggressive approach,
because we understand the urgency here. That said, Senator,
this is a very complex endeavor, dealing with years and years
of legacy systems. It is why, as my colleague, Mr. DeRusha,
mentioned, the TMF fund is so important to enable that
modernization.
We are working hand-in-hand with departments and agencies
to ensure that they have the capabilities that they need to
enable them to build out networks in a different way, and it
really goes to zero trust architecture, the secure cloud
systems, the maturity model. We are pushing as hard as we can,
Senator. It is a big project, and it is really one of the
reasons why I am excited about FISMA reform, because we need to
ensure that we can do this the right way, and secure an
enterprise, not 102 separate departments and agencies.
Senator Hassan. Thank you.
Last question for you. I was delighted to hear your
testimony and by the recent announcement from CISA about the
Joint Cyber Defense Task Collaborative.
Ms. Easterly. Like ACDC.
Senator Hassan. I know, yes, except not. But yes. It is
intended to improve planning, information-sharing, and
collaboration among interagency, intergovernmental, and private
sector partners. However, several of our critical
infrastructure sectors, particularly the health care and
education sectors, are severely under-resourced when it comes
to cybersecurity, especially compared to the JCDC's initial
private sector partners.
What lessons is CISA learning to learn from its initial
industry collaboration that will help it and the JCDC support
health care, education, and other sectors that are often under-
resourced? I see that I am over time, so if you can make your
answer brief. I can follow up with you as well.
Ms. Easterly. I will do my best. The whole idea of those
initial plankholders were those who had massive visibility, so
they can drive action at scale, Senator. The fact that we have
the Content Security Policy (CSPs), the Internet Service
Provider (ISPs), the cybersecurity vendors, that see the dots
so we can connect them, will allow us to have that information
and provide it to the other critical sectors, so that we can
help health care and education and all of the, what I would
call, target-rich, sometimes resource-poor sectors. So they
will accrue benefit from what we are building in the JCDC.
Senator Hassan. Thank you very much. Senator Portman.
Senator Portman. Thank you, Madam Chair. I want to start,
if I could, by asking unanimous consent (UC) to put something
in the record that has to do with reporting. This is some of
the feedback that we have received from industry and government
with regard to our cyber notification legislation. I think the
bill is better for this input, and I think it would be
appropriate to have these letters included in the hearing
record.\1\ All three relate to the legislation. One is from 18
trade associations, one is from the financial sector, one is
from the communications sector, and the fourth is from the oil
and gas sector, expressing their concerns in that case about
lack of consultation with the pipeline industry before issuing
security directives.
---------------------------------------------------------------------------
\1\ The letters referenced by Senator Portman appears in the
Appendix on page 65.
---------------------------------------------------------------------------
Senator Hassan. Without objection, so ordered.
Senator Portman. Thank you, Madam Chair. Let me start with
something urgent. I am really eager to get to the
accountability issue because, as you know, I think that is
critical for us to be able to organize ourselves properly going
forward. But unfortunately, we live in a state of constant
attacks, and we just had another one.
There is a joint publication by CISA, the FBI, and the U.S.
Coast Guard (USCG) last week that indicates an advanced,
persistent threat, meaning right now, timely, a threat,
targeting a software program used to authenticate users when
they log onto their computer. According to this publication it
is widely used by several critical infrastructure sectors. The
hackers have covered their tracks, much like we saw with
SolarWinds.
Again, I would hope we could talk about the important, not
just the urgent, but the urgent is upon us again. I would ask
you, Ms. Easterly, can you briefly explain, what this is and
why it matters?
Ms. Easterly. Yes. Thanks very much for asking that
question, Ranking Member Portman, because it does speak to, I
think, a really good-news story and the collaboration and how
we use data to help protect other sectors of critical
infrastructure.
So you are referring to something called ManageEngine
ADSelfService Plus, which is this password management and
single sign-on capability. We worked with the U.S. Coast Guard
on a vulnerability at the Port of Houston and found out about
this. We worked with our FBI partners and our Coast Guard
partners to better understand that vulnerability, and then to
be able to get that information out, to see whether, in fact,
we saw the same vulnerability across the Federal cyber
ecosystem and in our critical infrastructure partners. This was
actually one of the early successes for JCDC, because we were
able to share that information across our JCDC partners to see
if they could find additional victims to notify.
To this point in time, we see that the campaign thus far is
limited, but we are continuing to work through it, and I am
happy to keep you apprised.
Senator Portman. I appreciate that. I guess I am glad to
hear that, that you feel like, in this case, we have a handle
on it. I did speak to one of your prominent JCDC members
yesterday, and I support what you are doing there, including
bringing the private sector expertise in. I think it is
critically important.
The alert indicates that this advanced persistent threat
and these actors have been exploiting vulnerabilities but also
covering their tracks. What does that mean, and does that mean
if it is a nation-state actor, as an example, we are not going
to be able to determine who it is?
Ms. Easterly. As you know, Ranking Member Portman,
attribution can always be complicated in terms of being able to
positively say who that threat actor is. Certainly the most
sophisticated threat actors go to great winds, as we saw with
SolarWinds, to be able to cover their tracks and obfuscate
their presence, so that they can live for long times in
networks and be able to extract data.
But we are working very closely with our interagency
partners and the intelligence community (IC) to better
understand this threat actor so that we can ensure that we are
not only able to protect systems but ultimately to be able to
hold these actors accountable.
Senator Portman. Right. But in terms of this one, can you
tell us who you think it is?
Ms. Easterly. At this point in time I would have to get
back with my colleagues, but I do think it is a nation-state
actor, sir.
Senator Portman. Concerning, yes.
Ms. Easterly. Yes, sir.
Senator Portman. OK. We look forward to hearing more as you
have it, perhaps even in a classified setting, to understand
what we can do to be able to respond, as you say, to be able to
push back against these nation-state actors who continue to
probe and to commit these crimes against our public and private
sector entities, in this case critical infrastructure.
OK. Accountability. I am going to show a chart\1\ here. It
is a chart that tries to explain what the roles are. Maybe it
is just me, but it seems like there is a lot of overlapping
responsibility, including, by the way, among the three of you.
The question is, who is in charge, who is accountable.
---------------------------------------------------------------------------
\1\ Thge chart referenced by Senator Portman appears in the
Appendix on page 58.
---------------------------------------------------------------------------
We talked about this latest hack, and you mentioned that
you are involved, as the, CISA lead, which is good. But also
you indicated that there are other entities involved. The
question is, who is in charge and who will take accountability
as things happen?
This chart has, with regard to the strategic side, the
National Cyber Director, who is here with us today, and the
Deputy National Security Advisor, who has been with us here
before. She is not with us today but she has a role that she
has indicated is, in some ways, quite similar to your role.
Then we have OMB, of course, the Federal CIO, and the Federal
CISA role. Then the CISA Director and the FBI CISA Director for
Cyber are more on the operational side.
On the strategic side, of course, every agency head has to
be involved, and should be, and then, of course, the agency
CIOs and the CISA in the agencies, and that goes to our FISMA
issue we talked about earlier.
I guess I would start with you, Mr. Inglis, and again, I am
glad you are where you are. I wish you had more staff to be
able to do your job, which is another topic we will discuss.
Under your authorizing statute, you are the principal advisor
to the President on cybersecurity and cybersecurity strategy.
Is that correct?
Mr. Inglis. That is correct, sir.
Senator Portman. Does that mean that you are the single
point of accountability for Federal cybersecurity within the
Executive Branch?
Mr. Inglis. I think I am the single point of accountability
for Federal cybersecurity on owned or leased estates, to
include the Federal Government and the critical infrastructure.
When we determine that we need to use instruments of power
outside of owned or leased estates, then military diplomacy,
financial instruments of power, the National Security Council
(NSC) is the natural place to essentially coordinate those
instruments of power, and, therefore, they would interact to
determine what that strategy should be to do the rest of what
is required.
But for purposes of preparation, synthesis of the big
picture, defense of owned and leased estates, performance
assessments, I am the accountable person.
Senator Portman. So are you accountable, as an example, if
the Department of Homeland Security does not have proper cyber
hygiene in place? Probably not a good example because they are
one of the few agencies that we found, of the eight, that was
doing some of the right things. But let us say the Department
of Health and Human Services or the Department of Energy (DOE).
Are you the one responsible?
Mr. Inglis. Yes, sir. I am ultimately the accountable
person. Now, my job is to ensure that that accountability has
been allocated property to agency and department heads, to CISA
for being the operational entity coordinating the defense, to
OMB for issuing the right directives. As the coach--as we have
used that term before--I need to ensure those roles are
properly assigned, properly executed, and ultimately to do
performance assessments to ensure that we are meeting the need.
Senator Portman. Let me ask you this. This organizational
chart, again, we have talked about, in the past, the overlap,
and you just talked about the National Security Council overlap
with what you are doing. Do you think the Federal Government's
organizational structure is effective right now, and do you
think that the lines of responsibility are clear?
Mr. Inglis. I think it is reasonably effective. Can we make
it better? We can, and we will. The three of us at this table
talk on a daily basis about how to actually ensure that these
roles complement one another.
I would observe that the chart does not show sector risk
management agencies. That is a further complication of what
they on the edge of the enterprise that they represent. All of
those strengths represent diversity, which properly applied can
be a huge strength for us. It is perhaps then less complicated
than the U.S. Department of Defense or an American football
team, which, if it has the right strategy, if it has the right
roles, if the life forces that course across it create
coherence, Unity of Purpose, Unity of Effort, it can, in fact,
be quite useful. That is our job, is to make sure that the
video actually makes sense, even if the static picture does
not.
Senator Portman. You make the football analogy. There you
have a coach, who is ultimately responsible. You have a
quarterback responsible for the offense. The question is, how
do you have that with this more diffuse structure?
Is there any thought of issuing an Executive Order or some
other rulemaking to more clearly delineate what the----
Mr. Inglis. I think there is, sir. I think that is
essential. We are actually taking our time, not because we are
complacent in any way, shape, or form, but taking our time to
actually let a modest amount of experience drive our efforts to
then clarify, in writing, what we believe is the right and
proper way to describe that chart in action.
I think you would have hopefully seen, over the last three
or four months, there were several times when we reported
informally to this Committee not on a major incident but an
incident we thought was reflective of the work that we do
together, where we surged to the point of maybe to assist an
agency that was encountering some difficulty. We checked the
rest of the enterprise, the Federal enterprise in that case, to
ensure that that had not been something experienced by others.
We visited with the investment strategy, using OMB resources to
ensure that we were making the proper investments to get ahead
of this, and reworked that according. Then ensure that
ultimately those best practices became something that everyone
could benefit from.
That is complicated. That is hard to do, but it is the
necessary work of the leadership that you have charged to
undertake coherence in that diagram behind you.
Senator Portman. Let us go to one of those points that you
just made, which is the cybersecurity budget for the agencies.
Mr. DeRusha is here with us, on the panel, and you are here on
the panel, yet both of you have that responsibility as I
understand it. You have responsibility over the agency
cybersecurity budgets and what they ought to be. Is that true,
Mr. DeRusha?
Mr. DeRusha. Sir, OMB does, absolutely.
Senator Portman. So say it again?
Mr. DeRusha. I am sorry, sir. Yes, OMB has the
responsibility. It is a shared responsibility between the
management side, but largely the budget side, the resource
management officers.
Senator Portman. OK. I do not want to put Mr. Inglis on the
spot here, but would you agree with that, Mr. Inglis, that you
do not have responsibility for cybersecurity budgets?
Mr. Inglis. I do not have unique and solitary authority
over that. I agree.
Senator Portman. Not unique and solitary, but Mr. DeRusha
just said that it is OMB who has unique and solitary over that,
that responsibility, and my understanding is that you believe
you have responsibility for it too.
Mr. Inglis. Oh no, sir, I do not. By statute I have the
responsibility to report on performance. I do not have the
authority to direct dollars. I do not have the authority to
move dollars. But I think I have a useful and necessary
function to report on performance.
I think by example what we have done has actually joined
those two responsibilities in a way that it is coherent. Take
the Technology Modernization Fund in hand, as earlier described
by Mr. DeRusha. There is $1 billion allocated by the Congress
for that purpose. There is $2.3 billion in applications. OMB,
using its authority, has described what the requirements are
that would allow them to judge the merits of any particular
application. They have been paneled aboard.
I have looked at those requirements. I have judged that the
panel is an appropriate panel to adjudicate this, and I look at
each of the applications and each of the awards to ensure that
they are consistent with our overall cyber strategy. I
therefore am in a place where I am performing my responsibility
to ensure performance, at the same time allowing OMB to perform
their statutory responsibility to be accountable for the
budget.
Those two nicely, but in a complicated way, intersect at
this thing we call cyber. I think that is, by statute, where we
are. We could possibly clarify that to a greater degree in the
FISMA modernization and other bills, but the things that I
think that we are enjoying at the moment, we can achieve
coherence with the roles as they are defined.
Senator Portman. OK. I am over time already and I apologize
to my colleagues. Let me read the statute for what you are
supposed to be doing: ``Reviewing the annual budget proposals
for relevant Federal agencies and departments and advising the
heads of such departments and agencies whether such proposals
are consistent with the national cyber policy and strategy.''
It sounds like you are involved in the budgets. But I look
forward to further conversation in the second round.
Thank you, Mr. Chairman.
Chairman Peters [Presiding.] Thank you, Ranking Member
Portman.
Senator Ossoff, you are recognized for your questions.
OPENING STATEMENT OF SENATOR OSSOFF
Senator Ossoff. Thank you, Mr. Chairman, and thank you to
our panel. Thank you for your service.
Mr. DeRusha, you have responsibility as Chair of the
Federal Acquisition Security Council (FASC) for risk management
in the supply chain for Federal agencies. We saw Apple rush out
an iDevide Operating System (iOS) patch a couple of weeks ago,
an exploit that allowed targeted, remote jailbreaking of iOS
devices, which it appears had been outstanding for at least
several months, and was used to target certain individuals, was
revealed.
What is your assessment of your capabilities and the
capabilities of the private sector partners you work with, your
interagency partners at identifying zero-day exploits that
could be used to target senior government executives by foreign
intelligence services or to penetrate public sector or private
sector networks, and what additional authorities or reforms to
procedure or law might be contemplated to improve our ability
to get ahead of that kind of exploit?
Mr. DeRusha. Senator, I will respond first, but there is
also a shared equity with this entire group, in particular at
CISA and FBI and other partners.
I will speak a little about the role of the FASC. We are
primarily focused on supply chain risks that have a nexus to
national security, foreign threats, and others. There is an
acute focus of the FASC and its responsibilities, however, in
our ability to make recommendation of exclusion or removal
orders for the Federal Government.
We also take on the responsibility, strategically, to
ensure that we are providing the right guidance and risk
information to Federal agencies. We are working on some new OMB
guidance on that front, and we also work closely with NIST to
ensure that they have the appropriate understanding of the
standards that sit behind the effective risk management
programs that they need to build at each Federal agency to
secure itself. There is partnership there.
We have efforts to engage all the key stakeholders, both
industry and other committees, like in Team Telecon and the
Committee on Foreign Investment in the United States. There are
a lot of groups and bodies that need to be pulled together to
address the risks that you have described.
In particular to what you were talking about,
vulnerabilities of that sort are, unfortunately, fairly
pervasive across the entire ecosystem, and, that has not
traditionally been the explicit focus of the FASC itself. But I
would be happy to have a discussion regarding that further.
Senator Ossoff. OK. We will come back to this topic in a
moment. Mr. Inglis, I want to come to you for a moment and then
hear from you, Ms. Easterly, on this as well. What changes to
policy or operational posture of executive agencies have been
made in response to lessons learned from the Colonial Pipeline
breach?
Mr. Inglis. Thank you for the question, Senator. In
response to the Colonial Pipeline breach, what we have done is
to shore up our response mechanisms. Ms. Easterly can talk at
some length about that. We have engaged the CEOs of the
pipeline sector to ensure that they understand what the Federal
Government is prepared to do, but at the same time what we have
an expectation of that they need to do in terms of increasing
resilience and robustness, and they have responded in kind.
We have, therefore, kind of articulated what we believe the
requirements are for the pipeline sector. We will probably do
that for other sectors as well. We have worked closely with the
private sector to make sure that that is understood and
reasonable, and ultimately develop a response plan such that we
can help them in the moment of need in a way that is timely,
efficient, and prioritized.
Senator Ossoff. Thank you. Ms. Easterly?
Ms. Easterly. Yes. I think as you know, Senator, there were
security directives that were issued in the wake of the
Colonial Pipeline incident, one of which, importantly provides
the requirement to report cyber incidents to CISA. This is a
way that we are able to gather the information to protect the
larger sector and also connected sectors, so that is one very
important thing.
Also, as part of the White House's Industrial Control
System (ICS) Initiative, that first looked at energy, it is now
looking at pipeline. We are actually working with major
companies about what we can do to help them shore up their
security to include instantiating technology that will allow
them to detect more rapidly and to remediate and respond to any
intrusions, one of those programs being CyberSentry, which we
appreciate that Congress is focused on permanently authorizing.
Senator Ossoff. Thank you, Ms. Easterly. I share the
Ranking Member's concerns about the complexity of this
bureaucracy. I recognize you are making good-faith efforts
every day to rationalize it and streamline, apply the right
authorities through the right agencies.
But I am curious, Ms. Easterly, based on your experience
thus far, surely there is room for improvement. What is the
most significant impediment to operational efficiency or
effectiveness that you have experienced and observed in your
time in this position?
Ms. Easterly. To be honest, Senator, it has been a pretty
good experience thus far. At the end of the day, I think CISA's
role is pretty clear. We have two primary roles. We are the
operational lead for Federal cybersecurity, and I hope that
gets formally instantiated in FISMA reform, and by statute we
are the national coordinator for critical infrastructure,
resilience, and security.
Both of those missions necessarily are team sports. It
implicates partners across the Federal Government, as well as
partners across critical infrastructure. We will never own that
mission wholly because, as the Chairman said, over 85 percent
is privately owned.
I feel very comfortable with the partnerships that we have
forged to date, across the Federal cyber ecosystem, as well as
with the private sector. As I said earlier, Senator, I am very
excited about what we are building with the Joint Cyber Defense
Collaborative.
Senator Ossoff. I appreciate that, Ms. Easterly, and yet
there must be obstacles in efficiencies and impediments to
effectiveness that you do encounter on a daily basis, and the
Congress needs to hear them, because we can learn lessons about
modifications to statute or reforms to policy based upon your
testimony. I would like to hear from you. What is not working?
We need to know.
Ms. Easterly. With respect to Federal cybersecurity, I
think with FISMA reform I would ask that the Congress do three
things. First, that we codify CISA's role in Federal
cybersecurity as the operational lead, that we make sure that
we are holding departments and agencies specifically
accountable for the investments that they make in their
cybersecurity teams. They are making tradeoffs every day. They
need to take that seriously and invest in cybersecurity and
give some of those authorities between OMB and NCD and make
that more explicit. Finally, we need to move from this
compliance and box-checking to true operational risk
management. I think instantiating all of that in FISMA reform
will be incredibly important and helpful for our role.
Finally, I do think the cyber incident notification
legislation is incredibly important to establish our ability to
receive reports and then share them agilely and rapidly with
the rest of the community so we can raise the baseline on the
cyber ecosystem. I am sure as I progress in this job I may have
some more things to come back to you on, Senator.
Senator Ossoff. In addition to your deep experience in the
Army, you have also worked in the financial services sector.
How resilient and robust do you believe that sector's
cybersecurity is, and what changes, either within the industry
or at the regulatory level, need to be made to protect our
markets from what could be a devastating cyberattack that could
lead to a financial crisis or significant economic damage?
Ms. Easterly. Thanks for the question. It is a great one.
Since 2012, when Wall Street was subject to a massive
distributed denial of service attack there has been significant
investments made by the financial services sector, billions of
dollars to ensure that there is the right process, the right
technology, the right people. That is why I think finance is
generally in such good shape.
This is just my experience at Morgan Stanley--I think with
respect to regulatory regime I always found it necessary to try
and harmonize that, and I think we need to think about that
with respect to cyber incident reporting, because it is very
important that we are not asking a company, a business, that is
under duress during a cyber incident to report to seven
different entities, whether it is CISA for cyber incidents or
to other regulatory agencies. The harmonization piece, I think
is important.
But one other really important aspect of this, as good as
finance can be it does not matter if electricity is not
working, if the telcos are not working. Even as we look at
these sector models, sir, we really have to look at this
functionally, right? We have to look at the national critical
functions. I think that is a very important lens, because
everything is interdependent. Everything is connected.
Everything is vulnerable. At the end of the day that is why I
think CISA's statutory role as the national coordinator is so
important because we have to look across the whole critical
infrastructure ecosystem and make sure that it is as protected
as it is connected in cyberspace.
Senator Ossoff. Thank you. Mr. Chairman, I am over time. I
have a couple more questions, if there is time for it later.
But I yield.
Chairman Peters. Very good. Thank you, Senator Ossoff.
Senator Lankford, you are recognized for your questions.
OPENING STATEMENT OF SENATOR LANKFORD
Senator Lankford. Mr. Chairman, thank you. Thank you all
for the work that you are doing. It is exceptionally important
for the country, and I am grateful that you are engaging in
this.
Mr. Inglis, let me walk back to something that Senator
Portman was talking about before on the budget issues. You have
a fairly unique situation here all of a sudden, that your
office requested about $15 million to be able to stand up the
office. The infrastructure bill gave you $21 million, and then
the House Appropriations bill has allocated almost $19 million
more. So you suddenly went from a $15 million request to, it
looks like, a $40 million allocation. Is that what you are
hearing, seeing?
Mr. Inglis. My understanding is that there are three
numbers. The $15 million was imagining that we would get a slow
start in fiscal year (FY) 2022, therefore not be able to
execute at a flat, high level across the whole year. Therefore
you might take a $21 million figure, which is probably about
the right number, and reduce that, because you are not going to
expend all those resources if you do not have the same number
of people at the start of the year as you do at the end.
With respect to the other budgets, my understanding is they
are not additive, that they are kind of one or the other, those
will hold sway.
Senator Lankford. OK. That is helpful, because we are
trying to be able to track this as well, as you are trying to
be able to stand this up.
Ms. Easterly, thanks again for your engagement on this.
Obviously, after the Colonial Pipeline whole incident a lot of
pipeline folks awakened to vulnerabilities that were out there,
and that has been in the long-term conversation for years with
a lot of the pipeline companies and some areas of vulnerability
on this.
They made lots of hard decisions on this, but directives
came out immediately that were emergency directives. What I am
hearing now from a lot of the companies, not only pipeline
companies but in others, saying, ``Will we get to be at the
table when the final version is done?''
Help us understand what you think that would mean, for them
to be at the table, because obviously every single company is
not going to be able to be there. There is a notice and comment
period that allows every single entity and company to be able
to contribute, but what does that look like now in the days
ahead, when we start getting a finally ruling on this? Because
there were some really good actors that had additional
requirements put on them, or had to redo some things, but they
were doing all the right things already on this. So they got
consequences even though they were actually doing all the right
things originally.
What does this look like, to be able to have more
cooperation?
Ms. Easterly. Yes, thanks for the question. You are
absolutely right. Some companies were doing the right things.
Some were not. I think the objective of the security directive
was to set baselines, and I think that is incredibly important.
As you know, we have been working with pipeline companies for
many years. Some of those vulnerabilities that we illuminated
in the security directive had not been remediated for years,
and we felt it was incredibly important to be able to really
make aggressive progress on this.
So we absolutely recognize, and as I mentioned earlier, we
are working closely with the big pipeline companies. We have a
task force that has been set up. I was on the phone with them
earlier this week. Understanding that there was some
unhappiness from the community, I know that my colleague,
Administration Pekoske briefed them on the security directive
the other week and they were quite happy with having that
opportunity to consult and collaborate on the way forward.
That is absolutely my approach going forward, Senator.
Everything we do has to be in partnership, and I am looking
forward to furthering those conversations.
Senator Lankford. Great. How do we start proactively
sharing intelligence information, not just with pipeline
companies but everybody in the infrastructure world, that
actually has some context to it, if I can say it that way.
Because sometimes different reports come out and they look so
neutral that it really does not look like hair's on fire, do
something right now. It is just a hey, be aware of, but there
is no real context to it.
How do we help provide information to people proactively,
to say we are hearing this, seeing this, take action
immediately on this, in a way that has context to it and has
some clarity to it of what to be able to do?
Ms. Easterly. Yes, that is a fabulous question. You sound
like me when I was at Morgan Stanley. What we wanted was not
just indicators but real context, because you have to take
action against something, and if it unclear information it does
not help a network defender. That is why we are so focused on
timely, relevant, actionable, contextual information. We are
making improvements on what is called automated indicator
sharing (AIS). That is a program that has been around for a
while, and we actually are adding context from things like the
MITRE attack network that all network defenders use, to give
more granular information for defense.
We are also looking to use CSPY, which is our cyber
information-sharing collaboration platform, about 300 companies
there, to ensure that we have regular analytic exchanges to
include classified exchanges, to make sure that everybody has
the information they need to shore up their networks.
Then finally, with respect to the JCDC, that is a way to be
able to share information very rapidly, both within that small
ecosystem and then within the larger community, to help enforce
across the board what companies need to do to protect
themselves in cyber.
I am optimistic about making progress, exactly as you are
saying, contextual.
Senator Lankford. All right. That is helpful. If you are a
large energy company you have lots of support on that. If you
are a local co-op, you do not have the same level of support on
that. As we are communicating with these companies, how are we
getting to the co-op the same as we are getting to an Edison?
Ms. Easterly. That is a great question. I would answer it
two ways. First of all, we are constantly putting out
information through our platforms. We manage the Critical
Infrastructure Partnership Advisory Council (CIPAC), which
reaches all aspects across infrastructure to put out this
information. We have resources, education, technical guidance,
and assistance.
But one of the greatest things about CISA is our field
force. We are 10 regions, 500 people across the country,
security advisors that are in touch at the State and local
level, with some of those smaller businesses, to ensure they
have what they need to be able to make those changes to improve
their cybersecurity baseline.
Senator Lankford. OK. That is helpful. Let me ask a
question as you walk into this. Just perception at this point.
Is the IC, the intelligence community, doing enough to be able
to actually reach into areas for critical infrastructure
protection, as was discussed earlier, to get left of some of
these challenges, to be able to make sure that we are seeing
into it, to see what is actually developing? We do a lot on our
national security side, as we should, trying to be able to
protect our larger systems and how we operate as well.
Are there things that we can do to be able to help engage
with him more, to be able to raise the level of priority there?
Ms. Easterly. I think with respect to the intel community,
in the past two and half months I have had many engagements
across the board, and I have been, as I always was when I was
in government, incredibly encouraged and impressed with the
power and capability of our intel community.
I would say, though, Senator, with respect to some of the
more exotic and sophisticated actors that take advantage of the
blind spots in domestic infrastructure--we saw that with
SolarWinds, we saw it with Microsoft Exchange--I do not think
that that should be an IC role. I am sure you agree with me on
that.
Strongly, though, that is really the motivating impetus for
the JCDC. The plankholder partners are those that have
incredible visibility across the ecosystem, so they are able to
see into things that the government cannot and alert us to
trends in malicious cyber actor behavior and suspicious
activity, to enable us to use that information to make the
ecosystem safer. I think that is how we solve the dots issue.
We solve the dots issue by the visibility through our
partnership construct that we are building out now.
Senator Lankford. OK. Thank you.
Ms. Easterly. Thank you.
Chairman Peters. Thank you, Senator Lankford. Senator
Scott, you are recognized for your questions.
OPENING STATEMENT OF SENATOR SCOTT
Senator Scott. Thank you, Chairman Peters. Thanks for being
here.
How important is the existing satellite system that the
Federal Government uses to cybersecurity, and how risky do you
think the satellite system is, as far as its ability to, in any
time that somebody wanted to have a conflict with us, that it
would be still viable?
Mr. Inglis. I appreciate the question, Senator. Without
having the details in hand, but happy to respond to that in
further detail, I would say that the question is probably
equally apt of how important is cybersecurity to those
satellites. Satellites often perform critical functions for the
Nation, whether it is weather observations or military command
and control, and so on and so forth. We need to ensure that we
have invested as much in them as we have in any other piece of
critical infrastructure. Cybersecurity is essential for them. I
think our adversaries would clearly hold those at risk if they
thought they had the means or the ability to do so, and
therefore it has to be in scope.
Senator Scott. Jen, what do you think?
Ms. Easterly. I would agree with that, Senator. Obviously,
anything that is critical to our national security is something
that we need to make sure is protected and secure. In today's
technology world, we know that many things are connected and
almost everything is vulnerable. It is why we work so hard to
ensure that all sectors are raising their cybersecurity
baseline. I very much agree with the Director on this.
Senator Scott. The way to think about it is, it is more
they need you to make sure that they are not damaged rather
than the other way around.
Mr. Inglis. I agree. I talked with a gentleman a couple of
weeks ago and he gave me a wonderful analogy. He says, ``You
know why race cars have bigger brakes? So they can go faster.''
The point he was making is that the reason we have
cybersecurity, the reason we lay it on, is not for its own
sake, and that is what we can be proud that we have done that,
but so that we can enable a critical mission. I think that is
the case with satellites or any other piece of our critical
infrastructure.
Senator Scott. OK. What is the administration doing to go
after these nation-states that target our critical
infrastructure? I was Governor of Florida so we had all these
hurricanes, a lot of them. The first thing you realize is you
have to get the power back up and you have to get your
communication back up, because eventually, if you do not get
that done, you are going to run out and get food and water out
to everybody.
What do you think we should be doing to deal with these
nation-states that are targeting our critical infrastructure
and central services, and are we doing enough?
Mr. Inglis. Senator, I will start. I think that the
administration's strategy, take ransomware as an example but it
is not the only example where a nation-state would hold us at
risk, there are four lines of effort currently in that
strategy. One is you have to disrupt the infrastructure and the
actors, determine what it is they make use of and try to hold
that at risk, using all instruments of power, not simply cyber
instruments of power. But use your legal remedies, your
diplomatic remedies, your financial remedies, all of that, to
essentially make it such that they cannot succeed.
Two, promote resilience, such that we are simply a harder
target. That is sometimes less satisfying because you do not
see kind of some flash in the night, but actually if you simply
avoid the event it is far more meritorious than kind of working
your way through it.
Three, address the abuse of virtual currency, which is
underpinning. It is a huge fuel inside of this fire, and we----
Senator Scott. Can I interrupt you? Do you think that is
doable?
Mr. Inglis. I think it is doable, maybe not to the 100th
percentile, but I do think it is doable.
Senator Scott. Good.
Mr. Inglis. Right. So the sanctioning that occurred, what,
two days ago, of MUEX, which has shown itself to be involved in
so many of these transactions of virtual currency turning into
hard currency, or vice versa, we can essentially kind of lock
those down if we know that they are engaged in illicit
activities, and actually try to hold the virtual system
accountable for the same requirements that the hard currency
system does.
Finally, I think that the fourth element, not independent
of the other three, is to do this in the broadest possible
coalition. This is an international issue, not a U.S.-only
issue. We need to, if we are bringing pressure to bear on
Vladimir Putin because he gives sanctuary or permissive action,
we need to bring a coalition to bear to hold him at risk, to
determine what it is he cares about, to use all of our powers
across nation who have this same problem, who are like-minded
in their desire to achieve the outcomes in this space.
Senator Scott. Do you want to add anything?
Ms. Easterly. I think it is a great rundown. I mean, this
really is a whole-of-nation effort, where CISA's role, of
course, is in that promoting resilience phase. We also do
response and recovery. But I would be failing if I did not take
this opportunity to just say that, yes, there are sophisticated
and highly dedicated actors, sir, but much of the attacks that
we see could be prevented with good cyber hygiene. And so
incredibly important that all entities do the basics, to
include, most importantly, in my view, implementing multi-
factor authentication. We are going to spend Cybersecurity
Awareness Month in October making sure that everybody has what
they need to implement the basics.
Mr. Inglis. Sir, if I might jump back in, just to
complement Jen on this, if you go to StopRansomware.gov, a site
set up by CISA, you actually learn quite a lot about how you
can actually be your own best defense.
Senator Scott. Mr. DeRusha, do you want to add anything?
Mr. DeRusha. No, sir. I think that it was well stated by my
colleagues. The only thing I would say is, as the lead for
Federal civilian we take an approach of anything of value is
going to be a high target, so we have the high value asset
approach. Then we prioritize our efforts around looking at the
threats and vulnerabilities of those assets first. So that
aligns completely with the concerns you raised and expressed
here.
Senator Scott. Good. According to the U.S. Office of the
Director of National Intelligence (ODNI) 2021 Annual Threat
Assessment, China presents a prolific and effective cyber
espionage threat, possesses essential cyberattack capabilities,
and presents a growing influence threat. I think everybody
would pretty much agree with that.
Can you describe some of the risks we face when it comes to
cyberattacks from--let us pick on one--I would pick on
Communist China?
Mr. Inglis. Sir, I can, and I will try to go fast. I think
we know all of this, and it is just a summary of what I think
is already out there.
First and foremost, there is the theft of intellectual
property that constitutes hard-won competitive advantage of our
businesses, our industries to aid and abet the development of
their own industries. That is simply wrong, and it an unlevel
playing field that we need to challenge.
Second, kind of stealing some of that materiel, those
secrets, they can hold our maneuvers, our actions at risk, our
legitimate actions in the realm of diplomacy or military
actions, hold that at risk in ways that are inappropriate.
Finally, they can attack our confidence by making it such
that we might come to the conclusion that this digital
infrastructure will not work for us when, and as it should, and
that perhaps is the most insidious, pernicious threat of all.
The answer to all of this----
Senator Scott. I think that is true. Right? Don't you think
most people believe it will not be there when we need it?
Mr. Inglis. I think it is possibly true. I think it our job
to ensure that we have sufficient confidence. I think that we
can agree that the infrastructure that we make use of can never
be perfectly secure, and it will not defend itself. So we can
make it defensible--Jen has described many ways to do that. We
then must actually defend it, and we must have a transcendent,
resilient idea of who we are and where we are going such that
that is the thing that they have to challenge, such that we
essentially achieve our aspirations through momentum as much as
more as they are knocking down, right, the efforts that
somebody else undertakes to hold that at risk.
Ms. Easterly. I do not think I can say it better.
Senator Scott. OK. All right. Thank you, Chairman.
Chairman Peters. Thank you, Senator Scott. Ranking Portman,
I know you have a question that you would like to ask, you are
recognized for it.
Senator Portman. Yes, thank you, and again, thanks for the
opportunity today to dig into some of these issues, including
the good dialog we just had with Senator Scott. There is so
much that needs to be done to tighten up our defenses and
respond more effectively, but one is this reporting
requirements legislation we talked about earlier. We would like
to get legislation passed that is bipartisan, that you all can
work with. The bottom line is it would require entities to
report to you, Ms. Easterly, in a more expedited fashion and,
in some cases, clarifying that that is a responsibility,
because it is not, as we saw with Colonial Pipeline, when they
got the FBI and did not contact you, based on our hearing
testimony.
So for you to be able to properly disseminate that
information that you get to the right agencies and, therefore,
to have the right analysis--I suppose you need to do that--what
do you need? In other words, if we have a reporting
requirement, what do you need to make it effective so that CISA
can take that information and get it out immediately to the
right actors?
Ms. Easterly. Thanks for the question, Senator. That is
what we do every day. We receive a variety of reports across
the Federal civilian Executive Branch. We receive a variety of
reports at the State and local level, and then, of course, at
critical infrastructure. We analyze those reports to ensure
that if there is information that needs to be shared with other
entities to help us raise the cybersecurity baseline of the
cyber ecosystem that we are doing that. That really is what I
describe as our super power, is to share that information, and
the authorities that we were given by the Congress to do that,
I think, are exactly what we need.
If this legislation goes into place--and I am a huge
supporter of it and I think, as I said earlier, we need to
craft it in such a way that it enables enforcement, it is
timely, but we are going to need to put in place a process to
be able to handle this information at even greater scale and
make sure that we can share it as agilely as possible.
I think that the JCDC that we are standing up will help
enable that, because again, that gives a construct to share
many to many. Uniquely, it is the only Federal cyber entity in
statute that brings together NSA, FBI, CISA, United States
Cyber Command (CYBERCOM), DOD, ODNI with the private sector, so
that we can share that many to many. That is the dots
visibility issue that we are trying to solve, Ranking Member
Portman, and I am optimistic that we will be able to leverage
any new legislation to share that information as agilely as
possible.
Senator Portman. I appreciate that. My colleagues want to
ask some additional questions and I want to make sure they get
the chance to. We will have more follow-up on this as we move
the legislation through the process. But we want your input. We
want to make sure that this works right and does not unduly
burden those who get hacked at a time when they have to be able
to respond. That is why there is a time period here, to give
them time where they are not filling out paperwork but they
are, in fact addressing the attack. So there is a balance
there, and we understand that, but ultimately we want to have a
reporting requirement, and we want to make sure that you have
the resources to be able to properly take that information and
get it out to the right Federal agencies and others as quickly
as possible.
Ms. Easterly. Can I respond to that?
Senator Portman. Yes.
Ms. Easterly. I totally agree with you. I mean, we went
through this in the private sector at Morgan Stanley. What we
do not want is to have CISA overburdened with erroneous
reporting, and we do not want to burden a company under duress
when they are trying to actually manage a live incident. That
is why I think the rulemaking process that will be consultative
with industry will really be important to getting this right.
We do not want to be flooded with reports saying we
detected something and we are not sure whether there is actual
impact or not. I think we need to make sure that there is
determined impact, and then we can get that information and we
can do something with it that will help ensure the
cybersecurity baseline is raised. But erroneous noise is not
what we need. We need signal.
Senator Portman. Yes, I could not agree more. You noted
that, at the outset, we introduced into the record letters we
have received from the private sector, and I think you will
see, in some of that information, the input that you are
talking about. It is a balance, and we will try to achieve that
balance but also provide some discretion so that we get it
right. We look forward to working with you.
Thank you, Mr. Chairman.
Chairman Peters. Thank you, Ranking Member Portman. Senator
Ossoff, if you have an additional question or two you may
proceed.
Senator Ossoff. Thank you, Mr. Chairman. I know time is
short and there is a vote on the floor. Two final questions for
you please, Mr. Inglis. The first is, what do we all need to
do, as public leaders, what would we call upon the private
sector to do to build a privacy culture in this country such
that citizens understand the risks associated with engagement
online with the use of technology so that basic cyber hygiene
principles, practices like patching and using complex passwords
and preferring encrypted messaging apps, avoiding reckless
public disclosure that can put one at risk or one's family at
risk or invite financial intrusion, what can we all do to make
that something that is closer to our core understanding of
citizenship?
Mr. Inglis. Senator, thank you for that terrific question.
I would say many things. First, I would say follow the best
examples of this Committee in two key ways. One, this is, by
every kind of representation, a nonpartisan and bipartisan
issue. You all speak with equal fervor about the nature of what
this means to us and what we should do about that. That is
extraordinarily important.
Two, you have taken it seriously such that you have asked
us questions, you demand that we give you good answers. We will
continue to work our way through that. This is an issue that
all of us have as a responsibility, not simply the people that
have ``IT'' or ``cyber'' in their name.
Three, to the point that you have mentioned some things
that people should know, regardless of whether they are Python
coders or IT experts, I think that we assume too much about
people raised in the midst of technology that they are digital
natives. They are generally not. They are app natives. They
understand how to use this stuff. They have no idea about what
the security consequences are.
In as much as we teach our children how to walk across a
busy street, especially when they are in an environment where
perhaps the traffic goes the wrong way, we need to spend an
equal amount of time teaching them something about the basics
of cyber space--how that works, what happens when you touch a
link, what perhaps are the responsibilities, who is defending
your stuff when you store it in whatever the cloud is. We need
to tell them a little bit more about those. Those are basic,
fundamental issues.
Finally, I would say that we need to redouble our efforts
to imbue critical thinking in our people, because we cannot
predict all of the situations they are going to encounter.
They, therefore, need to have foundational abilities to say
does this make sense, and make a choice based upon some facts
that are kind of solid underneath them.
I think if we do all of those things we are in a better
place.
Senator Ossoff. Thank you, Mr. Inglis, and let us continue
the conversation on this subject. My final question, and it is
a brief one, Mr. Chairman, for you, Mr. Inglis. In your
capacity you have to consume threat intelligence, work with the
intelligence community, work with law enforcement agencies. You
have a background at the National Security Agency. What is your
involvement, if any, with respect to policy decisions,
operational decisions, legal interpretation that touches on
intelligence collection that may be related to or include
collection of data, information, or anything pertaining to U.S.
persons?
Mr. Inglis. Senator, as you indicate I am an avid consumer
of that, not simply for my own sake, so that on behalf of those
I represent, the institutions that are charged with cyber
defense, that we can be properly informed about the true nature
of threat. That would, in turn, have an effect on what they
then attempt to collect and how they then produce that. But I
am not able to direct that with a hands-on ability, as
appropriate to my limited responsibilities with respect to
offensive or intelligence capabilities.
Senator Ossoff. Thank you. Thank you, Mr. Chairman.
Chairman Peters. Thank you, Senator Ossoff.
A couple of final questions here for the panel, but I will
start with Mr. Inglis on this question. I think all of you know
right now we are in the middle of an investigation into the
Kaseya hack, so I know you will be limited as to what you can
say.
But I think this Committee needs to understand,
particularly with some of the information that came to light
just recently regarding the FBI's action, that we need to
understand how the administration balances the need for
investigating a cyberattack and providing relief to the victims
as well.
As National Cyber Director, could you explain the process
that the government uses to evaluate investigative needs
compared to assisting victims in attacks, and do you coordinate
with the FBI? Give us a better picture of how this happens.
Mr. Inglis. Yes, sir. Thank you for the question. First I
would say that the overwhelming bias is to assist the American
people to essentially provide the government's resources focus
its time and attention to assist them, as opposed to develop,
for its own sake, some instrument of power for its own sake.
The article the other day, that probably showed up first in
The Washington Post, had a headline that indicated that there
potentially was an undue delay in the kind of provision of the
key. But when you read the article, the article itself,
actually, I think, thoughtfully said that there was, in fact, a
very strong focus on how do we help Kaseya, how do we help the
downstream or upstream customers, and that challenge, which is
the first and foremost priority, has to take into consideration
how can we do this in a way that is at once time and has the
most significant impact. Those two things, sometimes when you
align them, you wind up not trading one for the other, but not
achieving an optimal effect on both of them at the same time.
But I would say that the government starts with how do we
actually assist the private sector in the most impactful way,
how do we then use all of the instruments at our disposal to do
that, and how do we then have a full-fledged discussion across
those instruments of power in as timely a way as possible to
come up with the strategy, the play.
I will defer to Jen for the rest of the answer.
Chairman Peters. Ms. Easterly.
Ms. Easterly. Yes. Just to add to that, I have to say I was
not here during those discussions. Certainly having managed
live incidents in real time it is a very complex process, and
certainly there are competing goals around doing what you can
for current victims and then protecting potential victims.
What I would say is I would expect to be part of any of
those discussions going forward, and at CISA what I would do
would be advocating for doing everything that we can to ensure
that victims have the tools that they need to recover,
remediate, and get their businesses back up and running, and
that we have the information that we need to protect future
victims. That is why your cyber incident legislation is so
important.
Chairman Peters. Mr. DeRusha, we will do a final question
for you. We have been discussing some of the legislation that
we are working on here in the committee to reform FISMA, and we
have heard from the other witnesses, some good input related to
that. I wanted to give you an opportunity to suggest any
reforms that you think are needed to FISMA to protect our
Federal networks.
Mr. DeRusha. Absolutely, Senator, and I appreciate the
opportunity. As you know, we are working closely with your
Committee staff on the bill, and we are excited about that
opportunity. Director Easterly stated a lot of our priorities
already, but I would reiterate that clarifying roles and
responsibilities is crucial, and we are committed to that.
Really moving toward tested security, away from attested
security so that we can determine, through continuous
monitoring and testing where the greatest risks are and address
those first, and having supportive legislation of that.
Having legislation that ensures that we are not being
overly burdensome with multiple compliance requirements and
regimes that are going toward agencies, and so that we can
streamline some of that and maybe provide some relief on how
often they need to do that so they can focus on remediating the
vulnerabilities that they are finding through test and
mechanisms.
Also moving toward automation. There is a skills gap in
this space--we are working to address it--but we cannot do that
fast enough. We have to an on the technology and integrate that
into our processes.
I think those priorities are well aligned and shared, and
we look forward to the right language to codify this into law.
Chairman Peters. Thank you for that answer, and once again
thank you to our witnesses for joining us today. I appreciate
all of your efforts to strengthen our cybersecurity defenses.
It is a big challenge. All three of you are certainly up to
that challenge, and I appreciate you taking the time today to
discuss these issues with the Committee. I think you can tell
this Committee is very focused on these issues. All of the
Members are very engaged, and we understand the seriousness of
what we are dealing with and we want to support you in your
efforts each and every day.
We have to stay vigilant against these breaches and
ransomware attacks, and effectively addressing these is going
to require strong coordination between our offices and work in
a bipartisan way.
I look forward to continuing my work with Ranking Member
Portman to introduce bills that will strengthen the cyber
incident and ransom payment reporting requirements for key
public and private sector entities and ensure that Federal
Government networks are also prepared to deal with these
evolving threats.
I think we heard today that there is a clear need for our
offices to get this information, which can help you connect the
dots and who is behind these attacks, and help prevent
potential targets from being potential victims. I look forward
to continuing to work with all of you and my colleagues on this
Committee to do everything in our power to strengthen our
cybersecurity defenses.
The record for this hearing will remain open for 15 days,
until 5 p.m. on October 8, 2021, for the submission of
statements and questions for the record.
This hearing is now adjourned.
Ms. Easterly. Thank you, Chairman.
[Whereupon, at 12:05 p.m., the hearing was adjourned.]
A P P E N D I X
----------
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[all]