[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]
COMPUTER SECURITY REPORT CARD
=======================================================================
HEARING
before the
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
INFORMATION, AND TECHNOLOGY
of the
COMMITTEE ON
GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
SEPTEMBER 11, 2000
__________
Serial No. 106-260
__________
Printed for the use of the Committee on Government Reform
Available via the World Wide Web: http://www.gpo.gov/congress/house
http://www.house.gov/reform
U.S. GOVERNMENT PRINTING OFFICE
74-495 WASHINGTON : 2001
_______________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Printing
Office
Internet: bookstore.gpo.gov Phone: (202) 512-1800 Fax: (202) 512-2250
Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON GOVERNMENT REFORM
DAN BURTON, Indiana, Chairman
BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
CONSTANCE A. MORELLA, Maryland TOM LANTOS, California
CHRISTOPHER SHAYS, Connecticut ROBERT E. WISE, Jr., West Virginia
ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York
JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York
STEPHEN HORN, California PAUL E. KANJORSKI, Pennsylvania
JOHN L. MICA, Florida PATSY T. MINK, Hawaii
THOMAS M. DAVIS, Virginia CAROLYN B. MALONEY, New York
DAVID M. McINTOSH, Indiana ELEANOR HOLMES NORTON, Washington,
MARK E. SOUDER, Indiana DC
JOE SCARBOROUGH, Florida CHAKA FATTAH, Pennsylvania
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
MARSHALL ``MARK'' SANFORD, South DENNIS J. KUCINICH, Ohio
Carolina ROD R. BLAGOJEVICH, Illinois
BOB BARR, Georgia DANNY K. DAVIS, Illinois
DAN MILLER, Florida JOHN F. TIERNEY, Massachusetts
ASA HUTCHINSON, Arkansas JIM TURNER, Texas
LEE TERRY, Nebraska THOMAS H. ALLEN, Maine
JUDY BIGGERT, Illinois HAROLD E. FORD, Jr., Tennessee
GREG WALDEN, Oregon JANICE D. SCHAKOWSKY, Illinois
DOUG OSE, California ------
PAUL RYAN, Wisconsin BERNARD SANDERS, Vermont
HELEN CHENOWETH-HAGE, Idaho (Independent)
DAVID VITTER, Louisiana
Kevin Binger, Staff Director
Daniel R. Moll, Deputy Staff Director
James C. Wilson, Chief Counsel
Robert A. Briggs, Clerk
Phil Schiliro, Minority Staff Director
------
Subcommittee on Government Management, Information, and Technology
STEPHEN HORN, California, Chairman
JUDY BIGGERT, Illinois JIM TURNER, Texas
THOMAS M. DAVIS, Virginia PAUL E. KANJORSKI, Pennsylvania
GREG WALDEN, Oregon MAJOR R. OWENS, New York
DOUG OSE, California PATSY T. MINK, Hawaii
PAUL RYAN, Wisconsin CAROLYN B. MALONEY, New York
Ex Officio
DAN BURTON, Indiana HENRY A. WAXMAN, California
J. Russell George, Staff Director and Chief Counsel
Ben Ritt, Professional Staff Member
Bryan Sisk, Clerk
Trey Henderson, Minority Counsel
C O N T E N T S
----------
Page
Hearing held on September 11, 2000............................... 1
Statement of:
Dyer, John R., Chief Information Officer, Social Security
Administration............................................. 142
Gilligan, John, Chief Information Officer, Department of
Energy, cochair, security, privacy and critical
infrastructure committee, Chief Information Officers
Council.................................................... 116
Hobbs, Ira L., Deputy Chief Information Officer, Department
of Agriculture............................................. 184
Hugler, Edward, Deputy Assistant Secretary for Administration
and Management, Department of Labor........................ 179
Singleton, Solveig, director of information studies for the
CATO Institute............................................. 201
Spotila, John T., Administrator, Office of Information and
Regulatory Affairs, Office of Management and Budget........ 27
Tanner, Mark A., Information Resources Manager, Federal
Bureau of Investigation, Department of Justice............. 193
White, Daryl W., Chief Information Officer, Department of the
Interior................................................... 155
Willemssen, Joel, Director, Accounting and Information
Management Division, U.S. General Accounting Office,
accompanied by Robert Dayce, Director for Computer Security
Issues, General Accounting Office.......................... 95
Letters, statements, etc., submitted for the record by:
Dyer, John R., Chief Information Officer, Social Security
Administration, prepared statement of...................... 145
Gilligan, John, Chief Information Officer, Department of
Energy, cochair, security, privacy and critical
infrastructure committee, Chief Information Officers
Council, prepared statement of............................. 120
Hobbs, Ira L., Deputy Chief Information Officer, Department
of Agriculture, prepared statement of...................... 186
Horn, Hon. Stephen, a Representative in Congress from the
State of California:
Letter dated July 27, 2000............................... 46
Prepared statement of.................................... 4
Hugler, Edward, Deputy Assistant Secretary for Administration
and Management, Department of Labor, prepared statement of. 181
Singleton, Solveig, director of information studies for the
CATO Institute, prepared statement of...................... 204
Spotila, John T., Administrator, Office of Information and
Regulatory Affairs, Office of Management and Budget,
prepared statement of...................................... 31
Tanner, Mark A., Information Resources Manager, Federal
Bureau of Investigation, Department of Justice, prepared
statement of............................................... 196
Turner, Hon. Jim, a Representative in Congress from the State
of Texas, prepared statement of............................ 25
White, Daryl W., Chief Information Officer, Department of the
Interior, prepared statement of............................ 157
Willemssen, Joel, Director, Accounting and Information
Management Division, U.S. General Accounting Office,
prepared statement of...................................... 97
COMPUTER SECURITY REPORT CARD
----------
MONDAY, SEPTEMBER 11, 2000
House of Representatives,
Subcommittee on Government Management, Information,
and Technology,
Committee on Government Reform,
Washington, DC.
The subcommittee met, pursuant to notice, at 10 a.m., in
room 2154, Rayburn House Office Building, Hon. Stephen Horn
(chairman of the subcommittee) presiding.
Present: Representatives Horn and Turner.
Staff present: J. Russell George, staff director and chief
counsel; Randy Kaplan, counsel; Ben Ritt, professional staff
member; Bonnie Heald, director of communications; Bryan Sisk,
clerk; Elizabeth Seong, staff assistant; George Fraser, intern;
Michelle Ash and Trey Henderson, minority counsels; and Jean
Gosa, minority assistant clerk.
Mr. Horn. The quorum being present, this hearing of the
Subcommittee on Government Management, Information, and
Technology will come to order.
We're here today to discuss one of the Federal Government's
most important and ongoing challenges, the security of
government computers. Computers and the Internet are
revolutionizing the way we do business, conduct research and
communicate with friends and associates. The benefits are
enormous as vast amounts of information flow instantly from
business to business and individual to individual, but
widespread access to computers and the Internet also carries
the significant risk that personal, financial or business
information can fall into the hands of computer hackers or
others with more malicious intent.
Similarly, as the Federal Government becomes increasingly
dependent on computers and the Internet, the computer systems
and the sensitivity of information they contain come under an
increasing number of attacks. Unlike the year 2000 or Y2K
computer challenge, this threat has no deadline. Rather it is a
day-to-day challenge created by an increasingly sophisticated
technology. In order to guarantee the integrity of the Federal
programs and to protect the personal privacy of all Americans,
government leaders must focus their attention on the security
of their vital computer systems.
Today the subcommittee is releasing its first report card
on the status of the computer security at executive branch
departments and agencies. These grades are based on self-
reported evaluation of agency information, in addition to the
results of audits conducted by the General Accounting Office
and the various agency inspectors general. This is the first
time such governmentwide information has ever been compiled.
As you can see, only two agencies have made progress toward
protecting their computers against invasion. Although auditors
found some significant weaknesses at the Social Security
Administration and National Science Foundation, both agencies
received Bs, the highest grade awarded. But the rest of the
picture is very dismal. Overall the government earned an
average grade of D minus. More than one-quarter of the 24 major
Federal agencies received a failing F; the Department of Labor,
charged with maintaining vital employment statistics, an F; the
Department of the Interior, which manages the Nation's public
lands, an F; the Department of Health and Human Services that
holds personal information on every citizen who receives
Medicare, another F; Agriculture and Justice, the Small
Business Administration, the Office of Personnel Management,
the personnel office for the entire executive branch of the
Federal Governments, all Fs.
Six other vital agencies nearly failed. The Department of
Defense, whose computers carry some of the Nation's most
sensitive secrets, earned only a D plus for its computer
security program; Veterans Affairs and Treasury, along with the
Environmental Protection Agency, General Services
Administration and National Aeronautics and Space
Administration, more Ds.
Four other government agencies received grades of
incomplete. These vital agencies oversee key elements of the
Nation's infrastructure and emergency services. They are the
Departments of Energy and Transportation, the Nuclear
Regulatory Commission and the Federal Emergency Management
Agency [FEMA]. These agencies could not receive a grade because
there has been insufficient auditor resources and scrutiny to
validate the agencies' self-evaluations.
Obviously there is a great deal of work ahead. Regardless
of grade, each agency must recognize that the daily challenges
to their computer systems will continue to grow in number and
sophistication. They must take the necessary steps to mitigate
those threats. There is no room for complacency, for the stakes
are simply too high.
We have with us today witnesses representing six of the
agencies that were graded. They will discuss their agency's
progress and plans to develop acceptable computer security
procedures.
Mr. John Gilligan from the Department of Energy will also
testify on behalf of the Chief Information Officers Council. In
addition, we have the Honorable John Spotila from the Office of
Management and Budget, which is charged with overseeing the
agency's computer security efforts; and Mr. Joel Willemssen
from the General Accounting Office, which works for the
legislative branch, headed the Comptroller General of the
United States. And I want to thank Comptroller General Walker
and the staff for their excellent help in regard to the grades
and everything else. I take the responsibility for the grades,
but they sat for hours with us on making sure that we've been
fair.
We have the ability, the government has the ability, to
protect the integrity of the vital computer systems. As I look
back, this is sort of where we were on Y2K in April 1996. There
are a lot of Fs, a lot of Ds, but the executive branch came
through on midnight January 1 where it counted, and I am
confident that the executive branch will do the same thing this
time.
We welcome all of our witnesses, and we look forward to
their testimony.
I now yield to the ranking member for an opening statement,
the gentleman from Texas Mr. Turner.
[The prepared statement of Hon. Stephen Horn follows:]
[GRAPHIC] [TIFF OMITTED] T4495.001
[GRAPHIC] [TIFF OMITTED] T4495.002
[GRAPHIC] [TIFF OMITTED] T4495.003
[GRAPHIC] [TIFF OMITTED] T4495.004
[GRAPHIC] [TIFF OMITTED] T4495.005
[GRAPHIC] [TIFF OMITTED] T4495.006
[GRAPHIC] [TIFF OMITTED] T4495.007
[GRAPHIC] [TIFF OMITTED] T4495.008
[GRAPHIC] [TIFF OMITTED] T4495.009
[GRAPHIC] [TIFF OMITTED] T4495.010
[GRAPHIC] [TIFF OMITTED] T4495.011
[GRAPHIC] [TIFF OMITTED] T4495.012
[GRAPHIC] [TIFF OMITTED] T4495.013
[GRAPHIC] [TIFF OMITTED] T4495.014
[GRAPHIC] [TIFF OMITTED] T4495.015
[GRAPHIC] [TIFF OMITTED] T4495.016
[GRAPHIC] [TIFF OMITTED] T4495.017
[GRAPHIC] [TIFF OMITTED] T4495.018
[GRAPHIC] [TIFF OMITTED] T4495.019
[GRAPHIC] [TIFF OMITTED] T4495.020
Mr. Turner. Thank you, Mr. Chairman.
As we all understand, our Federal agencies rely on
computers and electronic data to perform functions that are
essential to our national welfare and directly affect the lives
of millions of Americans.
This technology greatly benefits Federal operations through
the speed and accessibility it provides, but it also creates
vulnerability to attack. Individuals, organizations and
virtually anyone today with a computer and a modem has the
potential to interrupt and to eavesdrop on government
operations around the world. Many experts are predicting that
future wars will be in the form of cyberattacks and fought out
over a computer grid rather than a battlefield.
I want to commend the chairman for his interest and his
work on this important issue. Computer security is without a
doubt one of the most critical and difficult technical
challenges facing our government. Like Y2K, this subcommittee
has an important oversight role in holding our Federal agencies
accountable for implementing computer security efforts, and
while I commend the chairman's efforts to reduce the task to a
simple report card grade, I also realize that improving
computer security is a very complicated, timely and costly
process.
Additionally, I do understand that the subjective format of
our grading system could in some cases unfairly portray the
significant efforts an agency has made to take corrective
actions. I realize that some agency computer systems are
critical to national security, while others may not be. I also
realize that this Congress has an obligation to provide
adequate funding to agencies so that they might meet the
requirement that we have imposed on them.
While I want to commend the agencies that are moving
forward, it is clear that the Federal Government has a long way
to go before an effective, comprehensive Federal computer
security system is in place. It is my hope that as a result of
these hearings, we will be closer to achieving our mutual goal.
We want to make sure that the Federal managers have the tools
and the funds in place to be accountable for the protection of
agency infrastructures.
Again, I thank the chairman for calling this hearing. I
appreciate the good work that the committee and the staff has
done, and I look forward to hearing from each of our witnesses.
Thank you, Mr. Chairman.
[The prepared statement of Hon. Jim Turner follows:]
[GRAPHIC] [TIFF OMITTED] T4495.021
[GRAPHIC] [TIFF OMITTED] T4495.022
Mr. Horn. Well, we thank you, and I agree with you. We need
to be talking to the authorizers and the appropriators to make
sure that what is needed will be there. So I imagine the next
round we should have some improvement.
We will now start with the witnesses, and along the agenda
the Honorable John Spotila is the Administrator, Office of
Information and Regulatory Affairs, Office of Management and
Budget, part of the President's Executive Office of the
President, and he is speaking on behalf of OMB today.
So, Mr. Spotila.
STATEMENT OF JOHN T. SPOTILA, ADMINISTRATOR, OFFICE OF
INFORMATION AND REGULATORY AFFAIRS, OFFICE OF MANAGEMENT AND
BUDGET
Mr. Spotila. Good morning, Mr. Chairman and members of the
committee. Thank you for inviting me here to discuss OMB's
efforts in the vital area of computer security.
OMB policies build on a statutory framework requiring that
Federal agencies adopt a set of risk-based management controls
for all Federal computer systems. The agencies must
periodically review their security controls to ensure continued
effectiveness.
In an effort to identify strengths and weaknesses in agency
security programs, OMB sought updated information from the
agencies in June 1999 on their risk management processes. We
are now focusing on the security posture of 43 high-impact
government programs where good security is particularly
important. These programs include Medicare, Medicaid, the air
traffic control system, Social Security and Student Aid. In
late May of this year, we asked the agencies to send us
specific information regarding the management, operational and
technical controls in place for each application or general
support system sustaining these programs.
Our preliminary findings are illuminating. We have made
significant progress, but can still do better. Agencies are
working to integrate security into their capital planning and
investment control processes. We have made this a high
priority. Many agencies have completed a security review of
their systems and have updated their security plans within the
last 2 years. Many agencies develop and share their security
plans with their partner organizations and other agencies. This
promotes a comprehensive understanding of the interconnections
prevalent in a shared risk environment.
Due to their extensive Y2K work, most agencies have tested
their continuity of operations plans within the last 2 years.
Most agencies have provided users and system administrators
with IT security training within the last year. Most agencies
update their virus detection and elimination software on an
ongoing basis and have successfully implemented processes to
confirm the testing and installation of software patches in a
timely manner.
Nearly all agencies have documented incident handling
procedures and have a formal incident response capability in
place. More agencies need to install firewalls at external
entry points to exclude unauthorized users and within their
networks to ensure that authorized users do not exceed
authorization.
Agencies can better protect the confidentiality of
sensitive material through increased use of encryption for
password files and personal information. Agencies should
improve their intrusion detection capabilities and procedures.
This should include increased involvement of agency privacy
officers and legal counsel in reviewing the monitoring
activities.
More agencies should ensure that agency managers
specifically authorize the processing of each new or updated
system before actual operations begin. More agencies should
have independent review of their security plans.
We are working with the agencies on all of these areas. The
President, his chief of staff and the Director of OMB have all
taken a personal interest in enhancing security for our
interconnected systems. This has gone a long way to establish
senior management support at the agencies.
In February, OMB issued important guidance to the agencies
on incorporating security and privacy requirements in each of
their fiscal year 2002 information technology budget
submissions.
A well-known computer security expert, Robert Courtney,
once said, ``Good security is the ultimate non-event.'' In that
phrase, he summarized the difficulty of measuring effective
security. We face a significant challenge. We must devise a
method to assess security for the whole of government, its
thousands of vastly diverse systems and millions of desktop
computers. No other organization faces demands in this area
that are as broad as those the government confronts.
Since last fall, OMB has worked with the CIO Council, NIST,
GAO and the agencies to develop security performance measures
against which agencies can assess their security programs. As
you know, CIO Council and NIST representatives have met with
your staff to discuss this effort. We have made great progress
in a relatively short period of time, but, not surprisingly,
there is more to be done. Even the private sector is struggling
with this challenge.
Mr. Chairman, clearly you are focused on the need to assess
agency security programs. While we appreciate your serious
interest in security and your belief that grades will help the
agencies improve their performance, we do have some concerns
with this approach. We look forward to working closely with you
to develop better ways of measuring progress in this area. We
learned much from our collegial efforts with the committee, GAO
and the agencies in developing good Y2K measurements. Ideally,
we should work together to develop a similar workable set of
measurements for assessing agency security programs.
Measuring agency security effectiveness is at least as
complex as the Y2K measurement effort. We must assess programs
and implementation at three different levels: the relatively
uniform agency management or executive level; the expansive mix
of individual programs where agency business operations take
place; and at each of the thousands of government information
systems that support actual agency program operations.
Cursory measurements can be misleading. A well-documented
security program without the periodic evaluation of control
effectiveness can give a false sense of security. A weak
central organization can obscure highly effective component,
program or system-level security. We must take a comprehensive
approach to evaluating security if we are to generate
meaningful results.
Our assessment approach begins with the premise that all
agency programs and systems must include a continuing cycle of
risk management, appropriate methods to evaluate and measure
performance, and the ability to anticipate or quickly react to
changes in the risk environment.
We are putting great emphasis on agency self-assessment.
This fall all agencies will use a NIST-prepared questionnaire
that focuses on overall agency programs as well as on specific
management, operational and technical controls applied to each
system or group of systems. Assessing the effectiveness of the
program and the individual controls, not simply their
existence, is vital to achieving and maintaining adequate
security.
The NIST questionnaire will help agencies identify whether
the program and controls are properly documented, implemented
and continuously tested and reviewed. We can then determine a
security level for an individual system, an agency or
component, or an aggregated form, an entire agency.
Self-assessments improve security. They are less costly and
can be performed more frequently than compliance inspections
and audits. They can be performed by system users, thereby
helping to promote buy-in and greater compliance. They promote
openness and cooperation among all participants. They can also
give us good information on a timely basis.
In seeking to measure security effectiveness, we should not
equate it to our Y2K experience. While Y2K was a complex
management challenge, it was a relatively straightforward
technical one, and we could measure progress toward a known
event. Security challenges, on the other hand, are
unpredictable, ongoing, ever-changing and multidimensional.
Security threats often arise from malicious parties who probe
for vulnerabilities and risks. These threats can strike at the
confidentiality of our information, the integrity of our
systems and data, and our ability to ensure that information in
systems will be ready for use when needed. These threats are
ever-changing and our approach to security must be equally
dynamic.
While a general progress report at an agency level can be
valuable when used in the proper context, it is but a snapshot
taken at a point in time. It may or may not even be a clear
picture. Because a security program comprises physical,
personnel, technical and other controls, accurately assessing a
program is an extremely complex undertaking. In our view, the
differences between the two call for different responses. Just
as we must resist the simplicity of a one-size-fits-all
security program for the wide variety of agency systems, we
must also avoid a one-size-fits-all approach to measuring
successes and shortfalls.
If we are to improve the government's approach to
information security, we need to work together. We very much
appreciate the committee's interest in this important area and
look forward to continuing our close cooperation with you. We
value our partnership with you and hope that this hearing will
mark a further strengthening of our joint efforts on behalf of
the American people. Thank you.
Mr. Horn. We thank you. And in courtesy to the executive
branch, we let you go beyond the 5-minute rule.
Mr. Spotila. Thank you.
[The prepared statement of Mr. Spotila follows:]
[GRAPHIC] [TIFF OMITTED] T4495.023
[GRAPHIC] [TIFF OMITTED] T4495.024
[GRAPHIC] [TIFF OMITTED] T4495.025
[GRAPHIC] [TIFF OMITTED] T4495.026
[GRAPHIC] [TIFF OMITTED] T4495.027
[GRAPHIC] [TIFF OMITTED] T4495.028
[GRAPHIC] [TIFF OMITTED] T4495.029
[GRAPHIC] [TIFF OMITTED] T4495.030
[GRAPHIC] [TIFF OMITTED] T4495.031
[GRAPHIC] [TIFF OMITTED] T4495.032
[GRAPHIC] [TIFF OMITTED] T4495.033
[GRAPHIC] [TIFF OMITTED] T4495.034
[GRAPHIC] [TIFF OMITTED] T4495.035
[GRAPHIC] [TIFF OMITTED] T4495.036
Mr. Horn. I will say for all the other witnesses after Mr.
Willemssen, who speaks for the General Accounting Office of the
legislative branch, that we would like you to summarize, and we
will bring the gavel down every 5 minutes now or we're not
going to be out of here, and we want to be out of here by
roughly 11:45. I know a number of you have commitments.
What I would like to put in the record at this point for
the hearing record--and tell me if there's anything else that
ought to go into it, or some of these are classified, just to
redact them, as the saying goes--Presidential Directive 63;
OMB-A130, the Budget Director Mr. Lew's guidance, to agencies;
the appendix 3 and associated NIST--what was once the Bureau of
Standards and Security--guidance. And I would like these simply
as appendices to your testimony, and if there's a problem, work
it out with staff.
Mr. Spotila. That's fine.
[The information referred to follows:]
[GRAPHIC] [TIFF OMITTED] T4495.037
[GRAPHIC] [TIFF OMITTED] T4495.038
[GRAPHIC] [TIFF OMITTED] T4495.039
[GRAPHIC] [TIFF OMITTED] T4495.040
[GRAPHIC] [TIFF OMITTED] T4495.041
[GRAPHIC] [TIFF OMITTED] T4495.042
[GRAPHIC] [TIFF OMITTED] T4495.043
[GRAPHIC] [TIFF OMITTED] T4495.044
[GRAPHIC] [TIFF OMITTED] T4495.045
[GRAPHIC] [TIFF OMITTED] T4495.046
[GRAPHIC] [TIFF OMITTED] T4495.047
[GRAPHIC] [TIFF OMITTED] T4495.048
[GRAPHIC] [TIFF OMITTED] T4495.049
[GRAPHIC] [TIFF OMITTED] T4495.050
[GRAPHIC] [TIFF OMITTED] T4495.051
[GRAPHIC] [TIFF OMITTED] T4495.052
[GRAPHIC] [TIFF OMITTED] T4495.053
[GRAPHIC] [TIFF OMITTED] T4495.054
[GRAPHIC] [TIFF OMITTED] T4495.055
[GRAPHIC] [TIFF OMITTED] T4495.056
[GRAPHIC] [TIFF OMITTED] T4495.057
[GRAPHIC] [TIFF OMITTED] T4495.058
[GRAPHIC] [TIFF OMITTED] T4495.059
[GRAPHIC] [TIFF OMITTED] T4495.060
[GRAPHIC] [TIFF OMITTED] T4495.061
[GRAPHIC] [TIFF OMITTED] T4495.062
[GRAPHIC] [TIFF OMITTED] T4495.063
[GRAPHIC] [TIFF OMITTED] T4495.064
[GRAPHIC] [TIFF OMITTED] T4495.065
[GRAPHIC] [TIFF OMITTED] T4495.066
[GRAPHIC] [TIFF OMITTED] T4495.067
[GRAPHIC] [TIFF OMITTED] T4495.068
[GRAPHIC] [TIFF OMITTED] T4495.069
[GRAPHIC] [TIFF OMITTED] T4495.070
[GRAPHIC] [TIFF OMITTED] T4495.071
[GRAPHIC] [TIFF OMITTED] T4495.072
[GRAPHIC] [TIFF OMITTED] T4495.073
[GRAPHIC] [TIFF OMITTED] T4495.074
[GRAPHIC] [TIFF OMITTED] T4495.075
[GRAPHIC] [TIFF OMITTED] T4495.076
[GRAPHIC] [TIFF OMITTED] T4495.077
[GRAPHIC] [TIFF OMITTED] T4495.078
[GRAPHIC] [TIFF OMITTED] T4495.079
[GRAPHIC] [TIFF OMITTED] T4495.080
[GRAPHIC] [TIFF OMITTED] T4495.081
[GRAPHIC] [TIFF OMITTED] T4495.082
[GRAPHIC] [TIFF OMITTED] T4495.083
[GRAPHIC] [TIFF OMITTED] T4495.084
[GRAPHIC] [TIFF OMITTED] T4495.085
Mr. Horn. So we will now move to have the oath since I
didn't begin it that way. If you will all stand.
[Witnesses sworn.]
Mr. Horn. The clerk will note all the witnesses affirmed.
And we now go to the agent of the Comptroller General of
the United States, which is Joel Willemssen, Director,
Accounting and Information Management Division, U.S. General
Accounting Office.
Mr. Willemssen.
STATEMENT OF JOEL WILLEMSSEN, DIRECTOR, ACCOUNTING AND
INFORMATION MANAGEMENT DIVISION, U.S. GENERAL ACCOUNTING
OFFICE, ACCOMPANIED BY ROBERT DAYCE, DIRECTOR FOR COMPUTER
SECURITY ISSUES, GENERAL ACCOUNTING OFFICE
Mr. Willemssen. Thank you, Mr. Chairman, Ranking Member
Turner. Thank you for inviting us to testify today.
Accompanying me is Robert Dayce, GAO's Director for Computer
Security Issues, and as requested I'll briefly summarize our
statement.
Overall GAO and inspector general reviews done over the
past year continue to show that Federal agencies have serious
and widespread computer security weaknesses. Our analysis of
recently issued GAO and inspector general reports revealed
significant weaknesses at each of the 24 major Federal
agencies. As displayed on the board, these weaknesses were
reported in all six major areas of general computer security
controls.
For example, in the area of security program management,
weaknesses were identified at 21 agencies. Security program
management is fundamental to the appropriate selection and
effectiveness of the other categories of controls shown on the
board. This area covers a range of activities related to
understanding risks, selecting and implementing controls
appropriate with risk levels, and ensuring the controls, once
implemented, continue to operate effectively.
Another critical area where weaknesses have been found at
each of the 24 agencies is access controls. Weak controls over
access to sensitive data and systems make it possible for a
person to inappropriately modify, destroy or disclose data or
computer programs. For the other highlighted areas of security
controls, we've also found significant weaknesses at most of
the agencies in which audit work has been done.
I think it's noteworthy to point out that since our last
analysis of issued reports in 1998, the scope of audit work
performed has expanded to more fully cover all six major
control areas at each agency. Not surprisingly, this has led to
the identification of additional areas of weakness. However,
this does not necessarily mean that security is getting worse,
although it is clear that serious pervasive weaknesses persist.
These serious weaknesses present substantial risk to Federal
operations, assets and confidentiality.
Because virtually all Federal operations are supported by
automated systems and electronic data, the risks are very high,
and the breadth of the potential impact is very wide. The risks
cover areas as diverse as taxpayer records, law enforcement,
national defense, and a wide range of benefit programs.
While a number of factors have distributed to weak Federal
information security, I want to emphasize that we believe the
key underlying problem is ineffective security program
management. With that in mind, we have issued two executive
guides that discuss practices that leading organizations have
employed to strengthen the effectiveness of their security
programs.
In conclusion, the expanded body of audit evidence that has
become available shows that important operations at every major
Federal agency continue to be at risk as a result of weak
controls. Reducing these risks will require agencies to
implement fundamental improvements in managing computer
security.
Thank you, Mr. Chairman, and I would be pleased to address
any questions that you may have.
Mr. Horn. Well, thank you very much. We will have the
questions after all the witnesses have made their presentation.
[The prepared statement of Mr. Willemssen follows:]
[GRAPHIC] [TIFF OMITTED] T4495.086
[GRAPHIC] [TIFF OMITTED] T4495.087
[GRAPHIC] [TIFF OMITTED] T4495.088
[GRAPHIC] [TIFF OMITTED] T4495.089
[GRAPHIC] [TIFF OMITTED] T4495.090
[GRAPHIC] [TIFF OMITTED] T4495.091
[GRAPHIC] [TIFF OMITTED] T4495.092
[GRAPHIC] [TIFF OMITTED] T4495.093
[GRAPHIC] [TIFF OMITTED] T4495.094
[GRAPHIC] [TIFF OMITTED] T4495.095
[GRAPHIC] [TIFF OMITTED] T4495.096
[GRAPHIC] [TIFF OMITTED] T4495.097
[GRAPHIC] [TIFF OMITTED] T4495.098
[GRAPHIC] [TIFF OMITTED] T4495.099
[GRAPHIC] [TIFF OMITTED] T4495.100
[GRAPHIC] [TIFF OMITTED] T4495.101
[GRAPHIC] [TIFF OMITTED] T4495.102
[GRAPHIC] [TIFF OMITTED] T4495.103
[GRAPHIC] [TIFF OMITTED] T4495.104
Mr. Horn. The next witness is John Gilligan, the Chief
Information Officer for the Department of Energy, the cochair
for Security, Privacy and Critical Infrastructure Committee of
the Chief Information Officers Council. I will give you another
minute besides the 5 because you're speaking for the Chief
Information Officers Council. Mr. Gilligan, you've prepared a
very thorough statement, but we can't obviously get over 25
pages into the record at this point, but it is in the record,
but not having been spoken.
So if Mr. Gilligan will proceed.
STATEMENT OF JOHN GILLIGAN, CHIEF INFORMATION OFFICER,
DEPARTMENT OF ENERGY, COCHAIR, SECURITY, PRIVACY AND CRITICAL
INFRASTRUCTURE COMMITTEE, CHIEF INFORMATION OFFICERS COUNCIL
Mr. Gilligan. Thank you, Chairman Horn and Ranking Member
Turner. I want to thank you for the opportunity to appear
before this subcommittee to address the very important issue of
improving security of our Federal information systems. My
remarks today will focus on my perspectives as cochair of the
CIO Council's Security, Privacy and Critical Infrastructure
Committee.
Federal CIOs share the concerns that have been expressed by
Members of Congress, senior members in the administration, and
the public, that we need to improve the security of our
government information systems. Federal CIOs take their
responsibility to oversee agency efforts in cybersecurity very
seriously. We share the frustration of members of this
committee that progress in securing government systems has not
been more rapid. Let me assure you that Federal CIOs are not
asleep at the wheel. Rather, they are laboring hard to get a
handle on one of the Nation's most complex technological and
management problems.
Perhaps it is useful to put the difficulty of cybersecurity
into perspective. I recall an exchange I had with a military
four-star general a few years ago. We were discussing his
frustration with the slow progress on an information technology
project. This very successful commander with hundreds of
thousands of troops under his command was clearly exasperated.
He commented to me after we had discussed the project status,
``John, after all, this is not rocket science.'' As I later
examined his comment, it became clear that he was right. The
problem could not correctly be compared to rocket science where
we have literally hundreds of years of experience, including a
well-defined set of engineering principles.
Due to the rapid pace of evolution of information
technology, we are typically faced with applying information
technology solutions that have been in existence for months or,
at best, a few years. I submit that the situation is acute for
cybersecurity. It is not rocket science. No, many aspects of
cybersecurity are indeed much more difficult than rocket
science.
When I addressed this committee in March of this year, I
stated that the single biggest challenge that I saw for CIOs in
cybersecurity was making line management aware that
cybersecurity is not just a complex technological issue. At the
core cybersecurity is also a complex risk management issue.
Another challenge that I see facing CIOs is helping line
management answer the question, ``what is adequate security?''
Security experts tell us that no system is impenetrable if
network access is provided. However, the collective
inexperience of government and industry in applying security to
a range of functions including public Web sites, financial data
bases, procurement-sensitive data, citizen benefits and
corporate-sensitive or government-sensitive research, makes
this a hard problem.
The primary focus of the CIO Council efforts in this area
has been to help Federal organizations address the question of
what is adequate security. The CIO Council has sponsored a Web-
based repository for sharing best practices. This repository
can be found at http://bsp.cio.gov.
We have developed sample security policies for use by
agencies in intrusion reporting and procuring security
projects. We have worked to improve governmentwide processes
for reporting security incidents and distributing warnings in a
rapid fashion. An ongoing effort is to develop a set of
benchmark security practices for electronic services.
The Council has also sponsored a number of training and
education forums addressing privacy and critical infrastructure
protection.
The CIO Council is also leading efforts to establish a
governmentwide encryption infrastructure using public key
technology called a public key infrastructure [PKI].
An additional CIO Council effort that is particularly
relevant to today's hearing is the development of an
Information Technology Security Assessment Framework. This
effort was initiated about 10 months ago to provide a tool to
help guide security efforts within Federal agencies. This
framework has been developed largely with the leadership of the
National Institute of Standards and Technology and built upon
existing policy and guidance from the Office of Management and
Budget, the General Accounting Office, and the National
Institutes of Standards and Technology.
The framework provides a road map for Federal organizations
to guide them in focusing and prioritizing their efforts to
improve security. For each of five levels in the framework, a
set of activities is defined that should be undertaken to
assure a sound and effective security program. The framework
reinforces the importance of a solid foundation for an
organization security program and is based on sound policy,
clearly defined management responsibility, and organizationwide
coverage.
The CIO Council has completed a final draft of version one
of the Information Technology Security Assessment Framework and
hopes to publish this version in October. Following the example
of similar efforts by Carnegie Mellon University to develop
security frameworks for software and other disciplines, we plan
to continue to refine the framework over the upcoming months.
With advice and input from GAO, we have started working on
enhancements to the framework that would permit organizations
to better assess the effectiveness of the security programs
that have been documented and implemented.
The final area that I would like to address is the need for
stronger funding support from Congress for a small set of
cross-government security initiatives that serve as the
foundation for governmentwide improvements in cybersecurity.
The cochairs of the Security, Privacy and Critical Committee of
the CIO Council recently sent a letter to all Members of
Congress that highlighted our concern in this area. The letter
points out that while there is almost $2 billion identified in
the administration's fiscal year 2001 budget request for
cybersecurity-related items, only a very small portion of this
request totaling less than $50 million is requested for these
essential governmentwide foundation programs. The efforts of
this group include the Federal Computer Incident Response
Capability [FEDCIRC], which is managed by GSA and provides
alerts and warnings of virus attacks to all Federal agencies.
It has become clear to the CIO Council that these necessary
foundation efforts to improve cybersecurity governmentwide are
being hampered by a patchwork of funding and oversight
structures in both the executive and legislative branches. We
cannot hope to achieve robust governmentwide security without
these programs. We urge the respective congressional committees
who have jurisdiction over these efforts not to view them as
politically driven projects, but as essential elements of a
governmentwide foundation for cybersecurity. Moreover, we
believe that a $50 million investment for these efforts is a
very small investment in view of the great leverage that these
efforts will provide.
I would like to enter into the record a copy of the letter
entitled ``Essential Programs for Ensuring Security of the
Federal Cyber Infrastructure.''
Mr. Horn. Without objection, it will be in the record at
this point in your testimony.
Mr. Gilligan. It is clear to Federal CIOs that the lack of
a single integrated budget for cybersecurity items--these
foundation cybersecurity items--keeps these efforts from
getting the proper attention that they deserve and makes
progress and governmentwide efforts more difficult.
In similar fashion, the efforts of the CIO Council Security
Committee and other CIO Council committees continue to be
hampered by lack of effective methods to fund these cross-
government initiatives that we undertake. The synergistic
benefit and opportunity for savings across the government are
enormous. However, due to the use of pass-the-hat funding
approaches for the CIO Council, for example, funding for the
best security practices efforts that was mentioned earlier had
to be limited to $200,000 and was received 9 months into the
fiscal year. We will not be able to continue to operate and
expand this site or undertake other projects with operational
demands without an adequate level of funding.
I would suggest that this committee, working with the
administration, should examine ways to provide better methods
to fund and manage cross-government initiatives in the
information technology area. As a taxpayer, I am dismayed by
the difficulty of funding these efforts which have the ability
to yield tremendous efficiencies. It is an area where our
executive and legislative branches are truly failing, unable to
leverage the potential of information technology.
In my written testimony, I've included descriptions of
efforts within the Department of Energy to improve the security
of our many security systems.
In summary, let me again express my appreciation for the
opportunity to share my views on the important subject and
encourage the committee to continue to support the CIO Council-
sponsored efforts, especially the Information Technology
Security Assessment Framework.
While our joint challenge to improve cybersecurity may be
more difficult than building rockets, chief information
officers are committed to rapidly improving the protection
afforded to information systems managed by the Federal
Government.
This concludes my remarks. Thank you.
[The prepared statement of Mr. Gilligan follows:]
[GRAPHIC] [TIFF OMITTED] T4495.105
[GRAPHIC] [TIFF OMITTED] T4495.106
[GRAPHIC] [TIFF OMITTED] T4495.107
[GRAPHIC] [TIFF OMITTED] T4495.108
[GRAPHIC] [TIFF OMITTED] T4495.109
[GRAPHIC] [TIFF OMITTED] T4495.110
[GRAPHIC] [TIFF OMITTED] T4495.111
[GRAPHIC] [TIFF OMITTED] T4495.112
[GRAPHIC] [TIFF OMITTED] T4495.113
[GRAPHIC] [TIFF OMITTED] T4495.114
[GRAPHIC] [TIFF OMITTED] T4495.115
[GRAPHIC] [TIFF OMITTED] T4495.116
[GRAPHIC] [TIFF OMITTED] T4495.117
[GRAPHIC] [TIFF OMITTED] T4495.118
[GRAPHIC] [TIFF OMITTED] T4495.119
[GRAPHIC] [TIFF OMITTED] T4495.120
[GRAPHIC] [TIFF OMITTED] T4495.121
[GRAPHIC] [TIFF OMITTED] T4495.122
[GRAPHIC] [TIFF OMITTED] T4495.123
[GRAPHIC] [TIFF OMITTED] T4495.124
[GRAPHIC] [TIFF OMITTED] T4495.125
[GRAPHIC] [TIFF OMITTED] T4495.126
Mr. Horn. Well, thank you very much. And I would hope that
when there is some budget negotiations going on toward the end,
that the President's list will include this, and we hope that
the Speaker will include it.
The next witness is John R. Dyer, the Chief Information
Officer for the Social Security Administration.
Mr. Dyer.
STATEMENT OF JOHN R. DYER, CHIEF INFORMATION OFFICER, SOCIAL
SECURITY ADMINISTRATION
Mr. Dyer. Good morning, Mr. Chair, Mr. Turner. Thank you
very much for inviting us to testify.
We, too, as this committee, consider security to be an
actual vital concern, particularly in this day as we move more
into the systems world.
At the onset let me emphasize that the Social Security
Administration has always taken the responsibility to protect
the privacy of personal information in agency files very
seriously. The Social Security Board's first regulation
published in 1937 dealt with the confidentiality of SSA
records. For 65 years SSA has honored its commitment to the
American people to maintain the confidentiality of the records
in our possession. We understand in order to address privacy
concerns, we need a strong computer security program in place.
Today I would like to discuss where we are with computer
security, what improvements we're making.
SSA approaches computer security on an entitywide basis. By
doing so we address all aspects of the SSA enterprise. Overall
the Chief Information Officer, who reports directly to the
Commissioner and Deputy Commissioner, is responsible for
information system security. In my role as CIO, I assure that
our security initiatives are enterprisewide in scope. At the
Deputy Commissioner level, Social Security's Chief Financial
Officer assures that all new systems have the required
financial controls to maintain sound stewardship over the
moneys entrusted to our care. We have also placed our system
security policy function with this Deputy Commissioner.
In order to meet the challenges of data security in today's
highly technological environment, this agency has adopted an
enterprisewide approach to system security, financial
information, data integrity and prevention of fraud, waste and
abuse. We have full-time staff devoted to system security
stationed throughout the agency, in all regions and in the
central office. We have established centers for security and
integrity in each Social Security region. They provide day-to-
day oversight control over our computer software. In addition,
we have a Deputy Commissioner-level Office of Systems which
supports the operating system, develops new software and the
related controls, and, in general, assures that Social Security
is taking advantage of the latest in effective systems
technology.
SSA has been certifying its sensitive systems since the
original OMB requirement was published in 1991. Our process
requires Deputy Commissioners responsible for those systems to
accredit them. SSA's planning and certification activity is now
in full compliance with NIST 800-18 guidance.
SSA sensitive systems include all programmatic systems
needed to support programs administered by the agency as well
as critical personnel functions. They also include the network
and the system used to monitor Social Security's data center
operations.
As an independent agency we have our own inspector general
who can focus his efforts on the agency needs and concerns. The
IG is also very active working with other Federal, State and
local law enforcement agencies to assure all avenues for
investigation and prosecution are being pursued, especially for
systems security-related issues.
In summary, we have in place the right authorities, the
right personnel, the right software controls to prevent
penetration of our systems and to address systems security
issues as they surface.
As I mentioned, SSA has maintained an information security
program for many years. Key components, such as deploying new
security technology, integrating security into the business
process, and performing self-assessment of our security
infrastructure, to name a few, describe the goals and
objectives that will touch every SSA employee.
Of particular importance this year are the activities
related to the Presidential Decision Directive PDD-63 on
cyberterrorism and infrastructure protection and continuity of
operations. We have recently completed an evaluation of all
critical SSA assets. I am pleased to note that SSA was one of
the first agencies to do so.
Originally, SSA was not a tier I agency, but given the
importance of our ongoing monthly payments, we were elevated to
this level by the Critical Infrastructure Assurance Office. As
part of this effort we have completed an inventory of all
critical assets and implemented an incidence response process
for computer incidents. We have also revised our physical
security plans to assure our facilities are properly secured.
An independent auditor, Pricewaterhouse Coopers, has
evaluated our security program over the last 4 years working
with the IG. They have given us many recommendations to
strengthen our security program, and we have implemented 77
percent of their recommendations. We are addressing the
remainder at this time. Most of the ones that will take us to
finish up over the next fiscal year are facility-related, and
that's what takes a little bit of time.
In addition, we have ongoing site reviews, corrective
actions, and we also have another independent contractor,
Deloitte and Touche, reviewing our systems and overall
management.
In the contingency area this year, we actually tested all
of our sites at one time, which was an area of recommendation
that Pricewaterhouse Coopers had recommended for us. And so we
believe that when we get the next report from PwC, it will
indicate that we have made substantial progress.
In terms of the new increasing technology, and as we're
moving toward Internet, we are putting in place all the latest
security features from firewalls to filters to head off
specific attacks.
So I would like to say in conclusion, Mr. Chairman, the
Social Security Administration has a longstanding tradition of
assuring the public that their personal records are secure.
Both the Commissioner and the Deputy Commissioner give system
security their highest priority. We all recognize this is not a
one-time task to be accomplished, but rather it's an ongoing
mission that we can never lose sight of. We know we cannot rest
on past practice. We must be vigilant every way we can to
assure that these records remain secure and that the public
confidence in Social Security is maintained.
I want to thank the committee for the opportunity to
testify at this hearing, and I will be glad to answer any
questions you might have.
Mr. Horn. Thank you very much, Mr. Dyer.
[The prepared statement of Mr. Dyer follows:]
[GRAPHIC] [TIFF OMITTED] T4495.153
[GRAPHIC] [TIFF OMITTED] T4495.154
[GRAPHIC] [TIFF OMITTED] T4495.155
[GRAPHIC] [TIFF OMITTED] T4495.156
[GRAPHIC] [TIFF OMITTED] T4495.157
[GRAPHIC] [TIFF OMITTED] T4495.158
[GRAPHIC] [TIFF OMITTED] T4495.159
[GRAPHIC] [TIFF OMITTED] T4495.160
[GRAPHIC] [TIFF OMITTED] T4495.161
[GRAPHIC] [TIFF OMITTED] T4495.162
Mr. Horn. As usual, Social Security is at the top of the
heap even though it's a B. So we're used to you getting As
under the Y2K situation, and we look forward to you keeping
ahead of the pack, shall we say. Thank you very much for
coming. Thanks to your colleagues that led to a B grade.
We now go to Daryl W. White, the Chief Information Officer
of the Department of the Interior, who has presented us with
quite a full platter of documentation. We appreciate that. It's
all in the record, and now you have 5 minutes to summarize it.
STATEMENT OF DARYL W. WHITE, CHIEF INFORMATION OFFICER,
DEPARTMENT OF THE INTERIOR
Mr. White. Good morning, Mr. Chairman and Mr. Turner. Thank
you for the opportunity to appear before you today to discuss
the status of computer security at the Department of the
Interior. The Department of the Interior appreciates being
afforded the opportunity to complete the recent computer
security questionnaire. We are pleased to report that we are
making substantive progress to improve our computer security
posture.
The Department of the Interior recognizes that computer
security is of agencywide importance and is actively working to
implement a well-structured program to protect our information
assets. It is anticipated that the vast majority of issues
identified in the questionnaire will be adequately addressed
through implementations of our program.
Let me summarize the steps that Interior has taken over the
past 14 months to improve our computer security posture. During
1999, Interior performed extensive work in Y2K readiness for
mission-critical systems and major data centers. As a result of
Y2K preparation, policies and guidance for contingency planning
and physical security were issued and several implemented.
In September 1999, we acquired limited funding for
contractor services to perform automated vulnerability scanning
of our most critical systems. Based on the results of the
scanning, remediation was performed where needed.
January 2000, Interior accomplished priority filling of the
Department Information Technology Security Manager position
with a well-qualified and experienced individual. We were
fortunate to have obtained Steve Schmidt from the State
Department's Bureau of Diplomatic Security. Mr. Schmidt has
brought a wealth of experience and practical knowledge to
Interior. It is through his leadership and direction that we
have seen a revitalizing of the Department IT Security Working
Group.
Also in January 2000, $175,000 was allocated for computer
security program development. Funding was obtained through an
internal competitive process whereby senior Department managers
clearly chose computer security as a high priority issue in
competition with other equally important issues. This funding
was obligated to obtain contractor computer security services
in program development and limited as-needed vulnerability
scanning.
February 2000, Interior was successful in including in the
fiscal year 2001 President's budget request $175,000 for
electronic data security. The House and Senate omitted this
funding from their versions of the fiscal year 2001
appropriations bill. Interior continues to clarify the urgent
need for the funding to the Appropriations Committee.
In May 2000, the Departmental Information Technology
Security Manager issued the Interior Information Technology
Security Plan, fully specifying the National Institute of
Standards and Technology [NIST], published generally accepted
principles and practices for securing Federal computer systems.
This plan provides the basis for ensuring a computer security
program that meets or exceeds the minimum Federal requirements
as required by public laws, Federal regulations and executive
branch directions.
July 2000, the Department issued agencywide budget guidance
that further supported Office of Management and Budget
instructions on incorporating computer security funding in all
information technology projects. This guidance advised that
computer security spending should average 5 percent of the
total budget for information technology spending and placed a
high priority on increasing resources for security.
August 2000, a contract was awarded by the General Services
Administration under the SafeGuard program to Science
Applications International Corp. to provide computer security
program development services to the Department. This is
significant to our approach to computer security, and I wish to
elaborate further.
One of the primary means to improve IT security across the
Department of the Interior is to establish proven structured
and self-documenting methodologies for working through the
security life-cycle process. I am pleased to report that
realizing this goal has begun through the award of the
mentioned contract. The associated statement of work divides
the task into two phases. The first phase tasks will provide
Interior with the technical and administrative assistance to
put in place proven structured methodologies for information
technology security development. The second phase will produce
minimum requirements for risk mitigation in the form of
policies for agencywide information technology security issues.
From here we will develop technology and product-specific
implementation guides. Dependent upon the availability of
resources, we will then implement operating capabilities.
In August 2000, an additional $240,000 was obtained for
computer security program development. This funding will be
used to accomplish the development and implementation of
selected security practices.
In closing, it must be noted that our ability to completely
implement an adequate computer security program is strongly
dependent upon the availability of necessary resources.
This concludes my statement. I will be happy to respond to
any questions that you or any members of the committee may
have.
Mr. Horn. Well, we thank you very much, Mr. White.
[The prepared statement of Mr. White follows:]
[GRAPHIC] [TIFF OMITTED] T4495.163
[GRAPHIC] [TIFF OMITTED] T4495.164
[GRAPHIC] [TIFF OMITTED] T4495.165
[GRAPHIC] [TIFF OMITTED] T4495.166
[GRAPHIC] [TIFF OMITTED] T4495.167
[GRAPHIC] [TIFF OMITTED] T4495.168
[GRAPHIC] [TIFF OMITTED] T4495.169
[GRAPHIC] [TIFF OMITTED] T4495.170
[GRAPHIC] [TIFF OMITTED] T4495.171
[GRAPHIC] [TIFF OMITTED] T4495.172
[GRAPHIC] [TIFF OMITTED] T4495.173
[GRAPHIC] [TIFF OMITTED] T4495.174
[GRAPHIC] [TIFF OMITTED] T4495.175
[GRAPHIC] [TIFF OMITTED] T4495.176
[GRAPHIC] [TIFF OMITTED] T4495.177
[GRAPHIC] [TIFF OMITTED] T4495.178
[GRAPHIC] [TIFF OMITTED] T4495.179
[GRAPHIC] [TIFF OMITTED] T4495.180
[GRAPHIC] [TIFF OMITTED] T4495.181
[GRAPHIC] [TIFF OMITTED] T4495.182
[GRAPHIC] [TIFF OMITTED] T4495.183
[GRAPHIC] [TIFF OMITTED] T4495.184
Mr. Horn. Our next presentation is from Edward Hugler, the
Deputy Assistant Secretary for Administration and Management,
Department of Labor.
STATEMENT OF EDWARD HUGLER, DEPUTY ASSISTANT SECRETARY FOR
ADMINISTRATION AND MANAGEMENT, DEPARTMENT OF LABOR
Mr. Hugler. Thank you, Mr. Chairman and Ranking Member
Turner. I will be brief, as you requested.
We share your view that computer security is a high
priority, a priority that the Department of Labor takes very
seriously at the highest levels. Quite frankly, I am
disappointed at the grade we received today, and in some small
measure dismayed by it.
Following a successful transition or the century date
change, we have directed significant attention to enhancing our
security program and strengthening our security perimeter to
defend against its attack. While this surely is an ongoing and
very complex task, I am pleased to report that we have made
solid progress to date and are continuing to improve our
ability to defend against cyber attacks.
As we began the fiscal year, we had a number of security-
related issues identified by our Office of the Inspector
General in their audit of our financial statement. The issues
encompassed work to done in six areas of Department-wide
security program planning and management structure. The good
news is, because computer security is a high priority, we had
already identified areas that needed attention and had plans
under way for corrective action. This proactive posture was
acknowledged by the OIG in their audit findings.
At this stage we have resolved all of the audit report
issues at the departmental level and are working toward closing
out the remaining issues with specific agency systems.
In addition to dealing with immediate day-to-day issues,
such as continued attempts to gain unauthorized access to our
systems and responding to malicious codes such as the I Love
You virus, we have invested substantial effort in planning
ahead. Led by the Department's Chief Information Officer, our
strategy in this undertaking has been twofold: First, align our
information technology investments with legislative mandates
and other direction; and second, bring a departmental focus to
our information technology investments where a unified approach
and economies of scale are advantageous.
Information technology approaches that are common across
the Department, such as the implementation of a common
architecture and needed improvements in the infrastructure,
lend themselves to a common cross-cutting strategy. The use of
a common strategy then enables us to effectively leverage the
use of individuals' expertise and other scarce resources for
the good of all at the Department of Labor.
Utilizing this approach for fiscal year 2001, the
Department identified three cross-cutting areas for investment,
one of which is computer security. The computer security cross-
cut represents approximately 18 percent of the Department's
information technology cross-cutting investment portfolio for
fiscal year 2001. It includes plans to ensure that the
information security policies, procedures and practices of the
Department are adequate, as well as reflect the first step
toward implementing a multiyear plan for protecting our
critical infrastructure. Notably this will be a separate budget
activity, and the funds will be administered by the
Department's Chief Information Officer to ensure an organized,
disciplined approach to implementing a stronger security
program.
Mr. Chairman, our plans for next year should not, however,
overshadow what we've accomplished this year, 2000. I would
like to submit a brief highlight of those accomplishments for
the record, if I may.
Mr. Horn. Without objection, it will be in the record at
this point.
Mr. Hugler. Thank you, Mr. Chairman.
Mr. Chairman, we concur with the need to assess the overall
state of the Federal Government's computer security
environment, and we welcome the opportunity to work with you
and the subcommittee to devise an instrument that will provide
the flexibility necessary to accurately assess agencies'
progress. We also recognize that work remains to be done at the
Department of Labor to further improve our computer security.
I share with you your confidence that we will come through
as we did with the year 2000 challenge. I am confident as well
that we have sound plans for making these improvements and the
skill on hand to do so. However, the key to our success, as has
been mentioned by other witnesses at the table this morning,
will be making the necessary funding available.
Thank you, Mr. Chairman. I appreciate the opportunity to be
here, and I will be happy to take your questions.
Mr. Horn. Well, thank you very much.
[The prepared statement of Mr. Hugler follows:]
[GRAPHIC] [TIFF OMITTED] T4495.185
[GRAPHIC] [TIFF OMITTED] T4495.186
[GRAPHIC] [TIFF OMITTED] T4495.187
Mr. Horn. And our next presenter is Ira L. Hobbs, the
Deputy Chief Information Officer for the Department of
Agriculture.
Mr. Hobbs.
STATEMENT OF IRA L. HOBBS, DEPUTY CHIEF INFORMATION OFFICER,
DEPARTMENT OF AGRICULTURE
Mr. Hobbs. Thank you, Mr. Chairman. Good morning, Mr.
Chairman and Ranking Member Turner.
I am pleased to appear before the committee this morning to
update you on the status of the computer security program of
the U.S. Department of Agriculture. With your permission, I
will make a few brief comments and submit my written testimony
for the record.
USDA's programs touch the lives of every American every
day. We manage a diverse portfolio of over 200 Federal programs
throughout the Nation and the world at a cost of about $60
billion annually.
The information we manage, which includes Federal payroll
data, market-sensitive data, geographical data, information on
food stamps and food safety, proprietary research data, is
among USDA's greatest assets.
The Department is committed to protecting its information
assets as well as the privacy of its customers and its
employees. Audit reports conducted by both USDA's own Office of
the Inspector General and the General Accounting Office have
identified significant weaknesses in our overall computer
security program, which we are working hard to correct. As an
example, the Department is acquiring and installing necessary
equipment to upgrade security at our highest priority Internet
access points, and we are strengthening our intrusion detection
capabilities. We are working diligently to correct all of the
deficiencies that have been identified by the reports and hope
to be able give you a much more expanded impact in terms of the
changes that we have made.
Reports such as those cited above, as well as internal
security reviews mandated by the Secretary of Agriculture in
July 1999, made it clear that the Department requires an
overall coordinated and corporate approach to cybersecurity if
it is to succeed.
The USDA agencies include some security funding in their
respective budgets. Departmental funding is critical to
ensuring the creation of a standard security infrastructure,
and departmental leadership is required to ensure that we have
a comprehensive set of policies and guidelines.
The Secretary's security review also resulted in a
multiyear action plan to strengthen USDA's information
security, which addresses program organization, staffing needs,
policy and program operations, and security and
telecommunications technical infrastructure. When fully enacted
our plan will align USDA security practices with those of
leading organizations.
Our recent focus primarily has been upon building upon the
competency and skill of our security staff. We are extremely
fortunate working with the Secretary to establish the first
Associate Chief Information Officer for Cybersecurity at the
Department of Agriculture and able to select a senior level
executive, Mr. William Hadesty, formerly with the Internal
Revenue Service, as our first CIO for Cybersecurity. With the
recent addition of Mr. Hadesty, we have already started to
implement the priority actions in our action plan.
The Congress provided a $500,000 budget increase for the
Office of the Chief Information Officer for security in fiscal
year 2000. With these funds and existing resources, we are
assembling a well-qualified staff of security experts to lead
the Department's efforts.
Since joining with us in February 2000, the Associate CIO
for Cybersecurity has carefully analyzed and made adjustments
to our ongoing program. In addition, our most critical
information resources, including the National Information
Technology Center in Kansas City and the National Finance
Center in New Orleans, have been or are now undergoing critical
review. We recognize, though, that we still have a long way to
go.
The Office of the Chief Information Officer's fiscal year
2001 budget request included an increase in funding for
cybersecurity of approximately $6.5 million. If enacted as
requested, our security budget will provide the resources to
complete the development of a USDA risk management program,
continue to expand our cybersecurity office, increase our
capacity to conduct onsite reviews, and provide training and
hands-on assistance to augment the skills of our agency's
security staff. Additionally our project plans call for a major
effort in 2001 to further define requirements for a security
architecture and begin its redesign and implementation.
In fiscal year 2002, we will continue to develop and
implement our USDA-wide computer security program. The
information survivability program and the sensitive systems
certification program we plan to establish will complete USDA's
computer security umbrella.
Mr. Chairman, we believe that fulfillment of our
cybersecurity action plan will position the Department to
comply with Federal computer security guidelines and best
management practices. The reality is, though, that until our
computer security program is fully funded, we will remain much
too vulnerable.
I appreciate the opportunity to speak to the committee. I
look forward to being able to answer any questions you may
have.
Mr. Horn. Thank you very much, Mr. Hobbs.
[The prepared statement of Mr. Hobbs follows:]
[GRAPHIC] [TIFF OMITTED] T4495.188
[GRAPHIC] [TIFF OMITTED] T4495.189
[GRAPHIC] [TIFF OMITTED] T4495.190
[GRAPHIC] [TIFF OMITTED] T4495.191
[GRAPHIC] [TIFF OMITTED] T4495.192
[GRAPHIC] [TIFF OMITTED] T4495.193
[GRAPHIC] [TIFF OMITTED] T4495.194
Mr. Horn. Our next presenter is Mark A. Tanner, Information
Resources Manager, Federal Bureau of Investigation, Department
of Justice.
Mr. Tanner.
STATEMENT OF MARK A. TANNER, INFORMATION RESOURCES MANAGER,
FEDERAL BUREAU OF INVESTIGATION, DEPARTMENT OF JUSTICE
Mr. Tanner. Good morning, Mr. Chairman, Mr. Turner and
other members of the audience. I thank you for inviting us here
to discuss computer security at the FBI. The FBI shares your
conviction that computer security is a vital concern. That
concern is manifested in a variety of levels: First, the
concern within the FBI as to how the FBI collects and handles
sensitive personal information; the concern as a member of the
U.S. intelligence community where there is a growing awareness
and desire to achieve a collaborative sharing of intelligence
information while at the same time securing highly sensitive
and classified sources and techniques; the concern as a member
of the law enforcement community often called upon to
investigate, identify and apprehend those responsible for
hacking into government systems and critical infrastructures of
this Nation; and the concern as a Federal law enforcement
agency called upon to investigate computer and computer-related
crimes as diverse as a pedophile seeking to prey on a
youngster, Internet fraud crimes which victimize all elements
of our society, including persons and businesses, and those who
would seek to enrich themselves by manipulating stock prices.
The FBI's internal computer policies and practices present
a somewhat unusual picture as far as Federal agencies are
concerned. The FBI is, as I have stated, an agency charged with
investigating many computer-related crimes and it is charged
with the conduct of all counterintelligence activities in the
United States.
In addition, the FBI operates several systems on which
State and local law enforcement agencies have come to rely as a
necessity. As such, the FBI must operate both classified and
unclassified systems, and many of those unclassified systems
have strong requirements for the protection of personal data
about American citizens as well as a need to maintain instant
availability.
In addition, the nature of some of these, some of these
systems presents special requirements in that the data
represents information gathered through a variety of methods,
each requiring its own specialized method of handling and
protecting the information. These methods includes Federal
grand jury subpoenas which are subject to the requirements of
rule 6(e) of the Federal Rules of Criminal Procedure, material
identified as Federal taxpayer information, and thus, subject
to specialized handling and disclosure requirements, as well as
other many other specialized requirements. Of course, the
specific requirements of classified information such as that
obtained as a result of title 50, the Foreign Intelligence
Surveillance Act, activities or by other intelligence community
agencies, which must be respected.
To accomplish these tasks, the FBI operates 35 general
support systems and 12 major applications; 24 of the 35 general
support systems are classified and 6 of the 12 major
applications are classified. In other words, the FBI operates
30 national security systems. It should be noted that the vast
majority of the FBI's classified systems are currently internal
systems and thus do not have external connections to nonsecure
or unclassified systems.
The FBI's information systems security policy is codified
in our Manual of Investigative Operations, section 35. A copy
of this policy has previously been provided to this
subcommittee. The policy is a compilation of requirements which
are outlined in section 35-11 of this policy. In general, let
me state that because of the variety of types of systems used
by the FBI, our practice, where practical, involves using a
hierarchical approach to any requirement from these sources
based on the selective system's criticality and risks. This is
to avoid any possible confusion as to whether or not a system
should follow this or that set of rules and regulations. To
choose any other course of action would be folly.
The FBI's policy is coordinated with the Information
Systems Security Unit which is a part of our National Security
Division. The security unit works closely with the Department
of Justice entities which oversee classified and unclassified
computer systems. In addition, they maintain a good working
relationship with the national entities responsible for
computer security policy, such as the NSTISSC and NIST and the
Security Policy Board to ensure that the latest information is
available.
There are many challenges which face the FBI in today's
computerized world. One of the biggest challenges involves the
rapidly changing environment and the rapidly changing world in
which we all live. New technologies are moving into the
marketplace at a frenetic pace; old technologies are undergoing
metamorphosis. Each of these new products presents particular
problems and a careful and thoughtful analysis to ensure that
the FBI continues to maintain a policy which recognizes the
business needs of the computerized world and still providing
meaningful security practice.
The FBI is practicing risk management approach in its
certification and accreditation of all computer system
security. As I previously noted, most systems are internal and
not connected to nonsecure unclassified systems. This isolation
provides some sense of comfort in that these systems are not
connected to the outside and far less vulnerable to compromise
and attack. In this manner, our approach has been to identify
both systems which pose the largest risk in terms of their data
and sensitivity of the data. These systems are approached
before systems which play a lesser role in either their data or
sensitivity. The FBI is currently engaged in a series of
activities which will hopefully lead to the speedy completion
of the certification and accreditations. Resources have been on
loan from the Department of Justice as well as other
intelligence community under the ICAP program.
The FBI has undertaken a--an effort to make system owners
cognizant of system security requirements in their initial and
life-cycle development of plans for systems, in that way
ensuring that systems security is built into all systems and
that the continuing costs are specifically identified as a
separate line in each proposal.
In conclusion, let me just reiterate that the FBI
appreciates the interest of this subcommittee, indeed the
interests of all parts of Congress in this area where we share
your interests and concern. Our efforts will continue to ensure
that all systems, including those of the FBI, meet the
expectations of the American public to appropriately protect
that information which must be protected. The FBI respects the
trust placed in it by the American public and the Congress and
will do the utmost to maintain that trust.
Thank you.
[The prepared statement of Mr. Tanner follows:]
[GRAPHIC] [TIFF OMITTED] T4495.195
[GRAPHIC] [TIFF OMITTED] T4495.196
[GRAPHIC] [TIFF OMITTED] T4495.197
[GRAPHIC] [TIFF OMITTED] T4495.198
[GRAPHIC] [TIFF OMITTED] T4495.199
Mr. Horn. Well, thank you Mr. Tanner. We appreciate very
much what the FBI has done in tracking down a lot of these
hackers, and some I believe are in Federal prison now. So we
thank you for that effort, and I think you were very on top of
the situation in the Philippines when that occurred.
Our last presenter before questions is Solveig Singleton,
Director of Information Studies for the CATO Institute. Am I
correct to say the CATO Institute would be called a
libertarian-based institute?
Ms. Singleton. Yes.
Mr. Horn. OK. Ms. Singleton, it's all yours for 5 minutes.
STATEMENT OF SOLVEIG SINGLETON, DIRECTOR OF INFORMATION STUDIES
FOR THE CATO INSTITUTE
Ms. Singleton. Thank you, Mr. Chairman. My testimony today
is going to offer examples of some of the types of data bases
maintained by Federal agencies and offer a big-picture
perspective on the significance of any security problems within
those data bases.
With the power to command, powers of arrest, police, courts
and armies, the government has powers that the private sector
lacks. You can hang up on an annoying telemarketer but it's
hard to hang up on the IRS. Recognizing that in the
Constitution we have the fourth amendment which limits the
means by which government may collect information and we also
had the idea originally of a government of relatively limited
powers, and inherently a government of more limited power has
less need for hundreds and hundreds of data bases than a
government of broader powers.
Now, for better or for worse, we have drifted away from
this concept of limited government, and there's a natural
consequence. The amount of detailed information about private
citizens in Federal files has grown by leaps and bounds.
To underscore the importance of keeping this information
secure, I will offer an overview of the types of information
that are held by Federal agencies.
Essentially, Federal agencies collect an enormous array of
information. The Federal Government will inexorably record,
obviously, your name, your address, your income, but also your
race, details of how you spend your money, your employer,
updated quarterly, whether you've asked for information from
government agencies, student records, whether your banker
thinks you've engaged in any suspicious activities like making
an unusually large withdrawal or deposit, and finally, of
course, a surprising number of agencies hold different types of
medical records and not simply Health and Human Services.
I am going to run down some of the departments that we
looked at very quickly and offer a very small number of
examples of the type of information that they hold. Let me
start with the Commerce Department.
One file maintained by this Department keeps individual and
household statistical surveys which include individual's names,
age, birth date, place of birth, sex, race, home business phone
and address, family size and composition, patterns of product
use, drug sensitivity data, medical, dental, and physical
history and other information as they consider necessary.
The Department of Education has the national student loan
data system and, among other items, a registry of deaf-blind
children nationwide.
The Department of Energy maintains, among some very
sensitive counterintelligence data bases, records of human
radiation experiments.
The Federal Bureau of Investigation, obviously, is home to
the FBI central records system, alien address reports, witness
security files and information on debt collection and parole
records.
The Department of Health and Human Services has massive
quantities of medical record information, filling hundreds of
data bases. Some of these data bases include the personal
Medicaid data system and the national claims history billing
and collection master records system.
Next comes the Department of Housing and Urban Development.
Now, this agency is perhaps best known among privacy advocates
over the last few years, urging that residents of Federal
housing agree to warrantless searches of their apartments in
their lease agreements. This agency holds data such as single
family research files, income certification evaluation data,
and tenant eligibility verification files.
The Department of Labor has a lot of data bases including a
data base with information on applicant race and national
origin, records from the workers' compensation system and
records from the national longitudinal survey of youth, which
is a longterm study of certain individuals as they grew up over
the past few decades.
Obviously the Social Security information collects
information on lifetime earnings, as well as information
related to insurance and health care and census data. What may
be less well known is the extent to which they share and match
information with Health and Human Services, the IRS, and other
agencies. So, for example, one data base at the Social Security
Administration is--matches Internal Revenue Service and Social
Security Administration data with census survey data and
records of Cuban and Indo-Chinese refugees.
The Department of Treasury, last but not least, holds a
financing data base which contains millions of reports of
banking activities of privately named U.S. citizens. They have
also got the national data base of new hires, which holds
records of the income and employment of every working American,
updated quarterly.
Now, to sum up, I don't want to suggest that all this data
is part of some kind of sinister plot and we should all go
around wearing tinfoil hats on our head, nor do I want to
denigrate the well-intentioned efforts that have been made to
make many of these data bases more secure, but what I would
like to point out is that the growth of these data bases makes
security and the need for internal controls against
unauthorized use by government employees a systemic problem
rather than an occasional problem, and it generally--the growth
of these data bases threatens to shift the balance of power
between individuals and the Federal Government. So this really
is a systemic issue and it will be become more and more acute
as we move away from a vision of limited government and want
the government to be involved more and more in our day-to-day
lives.
Thank you.
[The prepared statement of Ms. Singleton follows:]
[GRAPHIC] [TIFF OMITTED] T4495.200
[GRAPHIC] [TIFF OMITTED] T4495.201
[GRAPHIC] [TIFF OMITTED] T4495.202
[GRAPHIC] [TIFF OMITTED] T4495.203
[GRAPHIC] [TIFF OMITTED] T4495.204
[GRAPHIC] [TIFF OMITTED] T4495.205
[GRAPHIC] [TIFF OMITTED] T4495.206
[GRAPHIC] [TIFF OMITTED] T4495.207
[GRAPHIC] [TIFF OMITTED] T4495.208
[GRAPHIC] [TIFF OMITTED] T4495.209
Mr. Horn. We thank you and now begin the questioning. What
we'll do is alternate the questioning, 5 minutes for myself and
5 minutes for the ranking member and back and forth until we
get the questions out of our system.
I'm going to start with the Department of Agriculture. As I
recall in your statement, Agriculture repelled 250 hacker
attacks. Were any of these successful attacks, Mr. Hobbs, and
if so what kind of damage was done?
Mr. Hobbs. In some instances, Mr. Chairman, the attacks
were successful. They resulted in things like changes to Web
pages. We report all of our intrusions. Some of them like
changes to Web pages. We were able to identify where people had
been able to access systems, but in no instance were there any
major or significant damages done. In most instances we've
taken the necessary steps to shut down what we consider to be
backdoor ways that people were getting into the systems, and
are trying to be more vigilant in our monitoring and tracking
of those activities and those kinds of concerns.
Mr. Horn. On the Agriculture, you completed the security
questionnaire and it states the Department doesn't really feel
that the system accreditation is important. A lot of other
agencies feel the system accreditation, where possible, is
important. Why isn't accreditation that important to the
Department of Agriculture?
Mr. Hobbs. I don't think that we said that it was not
important. I believe that what we are doing is we have a
prioritized program that we are working toward completion of,
with systems accreditation being a part of that. So I don't
think we said it was unimportant. I think what we said is we
have a prioritized effect--direction in terms of which we're
trying to proceed, and that we're moving with deliberate speed
in that sense of looking at all aspects and all phases of our
security program.
Mr. Horn. Well let me ask Mr. Willemssen, on behalf of the
General Accounting Office, as I understand, system
accreditation is a formal management process to test and accept
the adequacy of the system's security before putting it into
operations. So how important is it to an agency's security
computer programs that they're accredited; and could you
explain that process and why most of the Departments are doing
that where they can?
Mr. Willemssen. We believe system accreditation is
especially critical, and it represents management's judgment
that they have gone in, made an assessment of the risk of a
particular system and the associated data; that given the risk
associated with the system and data, appropriate controls have
been put in place to fend off any attacks that may occur, and
that management is therefore making a declaration that the
appropriate controls are there to deflect or at least be aware
of any such attacks that may happen. We think it's especially
important. Most agencies agree. We do see at times differences
in nomenclature. Some agencies may actually be doing something
similar to accreditation but may call it something else.
Mr. Horn. Moving to the Department of Labor, Mr. Hugler, as
I looked at the information, the computer security
questionnaire indicated weaknesses in all six general control
areas and the weaknesses were confirmed by the Inspector
General's audit results. So I'm curious, what does the
Department consider to be its most critical weaknesses?
Mr. Hugler. Well, Mr. Chairman, I think you're correct to
state what the Inspector General found last year and they did
find weaknesses in all six areas. I think what's important to
recognize is that we have now addressed all of those issues,
and in fact the Inspector General's audit findings, as I
recall, acknowledged that if we did two important things, one
is put out the rules for the Department's computer security and
put out the rules for the Department, in terms of systems
development and life-cycle criterion rules, if we did those two
things, that we would have addressed all six of the categories
with which they found issues.
We have done that and, more importantly I think, we have
gone ahead aggressively with implementing those rules. And the
example, I would cite to you, is our experience with the I-
love-you virus. We have incident response procedures now in
place at the Department. We had some 33,000 attacks from that
virus. A small number of computers, 243 as I recall, were
infected. I think the most--the best measure of our response,
however, was the fact that we notified our employees of that
virus and what to do with it 3 hours in advance of the official
Federal notification.
So I would commend your attention to that as an example of
the kind of things we've been able to do over the last year. So
really the OIG's findings from last year are just that, a year
old, and we have improved dramatically since then.
Mr. Horn. And so you would say the corrective action for
these has been completed?
Mr. Hugler. Yes, sir. At the Department level we have done
that and I am very comfortable with that.
Mr. Horn. I now yield 5 minutes to the gentleman from
Texas, Mr. Turner.
Mr. Turner. Thank you, Mr. Chairman. As I listen to each of
you who come from your respective agencies, it causes me to
come back to a comment Mr. Gilligan made about the importance
of cross-government initiatives. As many of you know, I have
been an advocate of having a Federal CIO, a chief CIO for the
Nation, someone who had the expertise, the competence, the
leadership role, as well as the budgetary support necessary to
be sure that we can have stronger cross-government initiatives
in the area of information technology and certainly in the area
of computer security.
And I think I'd like to ask you, Mr. Gilligan, to expand
upon your assessment of the need for these cross-government
initiatives, and I would be interested in your insight on it,
because not having nearly the expertise in the area that you do
nor the experience in the area, I still am left, after hearing
all this testimony, with the conviction that the area of
information technology certainly provides the potential for the
expenditure of vast sums of Federal dollars in a very
inefficient way. And I would be interested in your comments on
the idea of more emphasis on cross-governmental initiatives and
what kind of leadership might be necessary to ensure that
happens.
Mr. Gilligan. Mr. Turner, I'd be happy to comment. What I
have found in my activities in the CIO Council is that the
potential that you allude to for enormous sufficiencies as a
result of cross-government IT efforts is there, but that
potential is difficult to realize because our fundamental
government structures in the executive branch and in the
legislative branch tend to be stovepipe-oriented on particular
agencies and particular missions, and in fact, what I have
found is the most difficult efforts to get support for are
cross-government initiatives. And relatively small sums of
money that would have enormous benefits often fall through the
cracks because there is no clear forum for advocacy. And
individual committees, whether they be in the executive or the
legislative branch, tend to be very narrowly focused on that
portfolio to which they're assigned responsibility.
In my testimony, I noted our best security practices
effort. This is an effort that is enormously compelling. The
objective is to pull together best security practices from
across the Federal Government, provide a Web repository where
they can be accessed easily, and to share this wealth of
experience that we have across the government.
We have found that getting small sums, hundreds of
thousands of dollars for this initiative, is very difficult,
and it's not that the effort is not supported. It is supported.
And when I talk to members in the administration and Members of
Congress, it is supported. But the question is, ``who should
pay for it and where should that funding come from?''
The Federal incident response capability, FedCIRC, which is
our government's central point for disseminating information on
viruses and patch updates, is funded through a set of
committees. It is sponsored by Department of Defense, the FBI
and GSA. We have found in the recent remarks that the report
has not been strong, and again I don't think it's because the
merits of this effort are not supported in general. It's that
there is no central focus that helps bring this together and to
help identify that these individual, relatively small dollar
items in individual budgets, are in fact of far greater
importance than their small dollars would indicate.
And so I think as you suggest, this is an area where we
desperately need to focus attention. I think not only in the
security area will it help us improve security, but we can far
better leverage the enormous resources that we do have in
attacking a whole range of information technology issues.
Mr. Turner. Thank you.
Mr. Spotila, I know you have worked in this area, and one
of your duties at OMB is to try to be sure that we move toward
the kind of things Mr. Gilligan is talking about. I know there
is a Presidential directive that established two tiers of
agencies. It strikes me, and you might want to explain that a
little bit, but it strikes me that it is certainly appropriate
to acknowledge that the importance of computer security may
vary from agency to agency, and that when we try to focus our
resources, perhaps we should choose certain agencies over
another. If we did that, we would expect to see different
grades from the agencies because we would have made a choice
regarding where to place the initial dollars to improve
security. But describe for us a little bit that Presidential
directive that established those first, those two tiers.
Mr. Spotila. Yes, Mr. Turner. First of all, let me just
mention that OMB has been very supportive, as I've testified to
the committee before, of these cross-cutting initiatives. We
share Mr. Gilligan's belief that these are very important, that
they would make a great deal of difference, and that they do
need support.
The President, in May 1998, put out a Presidential Decision
Directive aimed at critical infrastructure protection. It was
at that time that he designated Mr. Richard Clark as his
adviser on counterterrorism. He's worked with the committee and
has been very active. The Critical Infrastructure Assurance
Office was then established.
What we have tried to do in the administration is to
prioritize in this area. I mentioned in my testimony that OMB's
focus has been on the same 43 high-impact programs that we
focused on during the Y2K effort. We have more than 26,000
systems in the government. If we're going to enhance our
ability to serve the American people by promoting effective
information security, we need to prioritize. We need to start
with the areas that have the greatest impact, whether they be
agency by agency, or, more accurately, within agencies, program
by program, system by system.
The Critical Infrastructure Assurance Office has tried to
zero in on those areas, those agencies, and those aspects
within agencies that have the greatest importance and perhaps
would be at risk the most. We've tried to work at OMB at
focusing on the programs that we think have the greatest impact
on the American people; as I'd mentioned, Medicare, Medicaid
and the like. We think that we have to begin with the most
important things. That's where we're going to have the most
significant improvement and have the most significant benefit,
which is not to say that we ignore all the other areas. We put
out general guidance. We're working with the agencies. We're
relying on the agencies to try to improve their efforts in this
regard across the board.
But in terms of White House attention, we're obviously
starting with the things that matter the most.
Mr. Turner. Thank you.
Mr. Horn. Let me add to that the following. This is the
last month of a fiscal year. This is the time Cabinet officers,
deputy secretaries, assistant secretaries, all of them sit
around and say, what can we do with the surplus we have in our
budget? And having been in administration, I know exactly what
they do, and this is the time, if they're serious about this,
to reprogram some of that money into what everybody's saying,
oh, we've got to have new money. That isn't the way we started
with Y2K. We started when I urged a lot of the people to start
reprogramming.
When Dr. Raines came in as budget director, he said, You're
absolutely right, and that's what I'm going to tell them. And
he did, and that's how we got the job done. We also made sure
Congress provided the money. But if they're serious in these
various executive branch agencies, this is the time to get a
few million here and there.
And then besides that, let's just talk about a few simple
steps such as policies requiring regular changing of passwords,
safeguarding equipment, turning off computers. That doesn't
cost a thing. That just costs doing it, if any. And I guess I
would ask, because energy has certainly been in the papers for
the last 2 years on this, but I'd ask, is there in OMB the
concern about policies to just get those basic areas done?
Mr. Spotila. Let me respond in a couple of respects.
First of all, I agree with you, Mr. Chairman, that some
agencies are going to have discretionary funds available this
September. We would certainly hope that they would apply them
to this area. I know that the various CIOs at this table and
others around government are going to do all they can to try to
impress that upon their agency heads. So I think that we do
need to be serious; just as all of us need to be serious, the
executive and the legislative branch, because this is a really
important area.
We have a lot of policy out there, even things that you
mentioned about passwords, changing passwords and the like. The
key is getting people to implement and follow the policy that
may be out there. One of the things I emphasized in my
testimony today and in my written testimony is that, in order
to have effective security, it is essential that nonsecurity
people buy in, that they participate, that they understand the
significance and that they buy into it. Because we can have all
the policies in the world and we can have all the centralized
supervision in the world, but if that person at the desk
doesn't follow it, it doesn't do any good.
You know, we tell the story about having very complex
passwords that people write on little yellow sticky notes and
paste to their computer screen. You can't have effective
security without cooperation at all levels, and it's a message
that we're trying to impart throughout the government. I think
it will be an ongoing challenge to continue to do that.
Mr. Horn. I thank you very much.
Let me ask Mr. Dyer, who's got the B grade, the social
security system, there is--apparently you're farther along than
most other agencies now. Do you have a best practices that
others might implement and what are they?
Mr. Dyer. Mr. Chair, I think it's just like when we
approached Y2K. Early on we saw it coming, and we
institutionalized the process, the resources to deal with it.
And we've done the same thing with security. It's part of our
life cycle with our programs. Anytime we think about bringing
up a new system, we look at the security aspects. Any
modification to any system, we check the security all the way
through and how it could roll over into other security systems.
I pick up on what GAO said and what John Spotila said. The
biggest challenge we're finding is managing it. You can have
good procedures, policies, rules in place, but you constantly
have to be working with your managers, your employees that they
follow them, and that's where we've been putting a tremendous
amount of our effort.
We've had conferences across the country. We've set up
centers so that we're able to make sure that we have people in
place that are doing the dogging and checking it. We change
passwords every month now. We found that it just didn't happen
the way it should. So we have instituted it. We're going
through. We found out that they change the passwords to
something they could remember. We now have software to check to
see if it's dates of birth or names of family members or
whatnot so you can start to screen those things out.
So, to me, it's a constant management challenge. You can do
the systems, but you've got be there, right there on top of it
all the time.
Mr. Horn. In my 26 seconds remaining, Mr. Willemssen,
anything you want to add to that as to what might be done that
isn't being done?
Mr. Willemssen. One thing that I would add, Mr. Chairman--
and it somewhat extending off of Mr. Spotila's comment--and
that is, it's one thing for agencies to have the policies and
procedures which I think in many cases they do. It's quite
another to see whether the accompanying practices have actually
been put in place.
That's been particularly the case when we and Inspectors
General go out and we test whether these policies and
procedures are actually being implemented. They often have not
been. And that really is a key distinction I think often
between what the agencies believe is going on and what may
actually be happening, although I think there is clearly many
of the agencies are on the road for improvement in that
direction, also.
Mr. Horn. I now yield 5 minutes to the gentleman from
Texas, Mr. Turner.
Mr. Turner. Thank you, Mr. Chairman.
The designation of the Presidential directive--is it tier
1, tier 2, phase 1, phase 2, whatever it's called--I'm curious
as to what kind of impact that has and how is that designation
significant; and I'd like, Mr. Hugler, if you would, to comment
on that because I know Department of Labor is a tier 2
designation.
Mr. Hugler. Yes, sir. Thank you, Mr. Turner.
It is an important distinction, because it is important to
recognize that some agencies handle more sensitive information
and have more sensitive systems than others do. We certainly
believe that our mission is important to American workers, but,
frankly, we do not have critical information that directly
implicates national security. So, as such, if we are going to
prioritize funding and implementation priorities, I think it is
appropriate for the Department of Labor to be a phase 2 agency
or tier 2 agency.
I think it's also important to note, though, that we take
those responsibilities as a tier 2 agency as important and that
we meet them and we are on target to meet all the milestones
for which we are accountable.
Mr. Turner. Mr. Spotila, when you think about funding for
these various agencies to be sure they move forward in the area
of computer security, do you make budgetary recommendations
based on this phase 1, phase 2 designation?
Mr. Spotila. What we do in the first instance is to
actually have the agencies themselves come to OMB with their
own determinations as to what they'd like to accomplish and
what they feel they need in the information security area. They
do so within their overall budget submissions when they go
through the OMB review process.
With the guidance that OMB put out earlier this year,
focusing on the next budget year, we've made it very clear that
information security needs to be part of that agency initial
analysis. It needs to be integrated within the entire area of
information technology planning for budget purposes because we
don't believe that doing it as an add-on is effective at all.
Within the budget review process, obviously if an agency is
a higher priority, if the need is greater, that will be
recognized in the process. Very often, the budget issues turn
more on whether or not the proposal has been well thought out,
whether it is likely to be a good use of money and a good
expenditure of money and one that is likely to contribute not
only to increased security but the agency's performance of its
mission. Those are the kinds of factors that OMB takes into
account, just as later on the Congress will take that into
account.
And your comment earlier about the risk, that money could
be wasted in this area, is also something that we take very
seriously. You can't just fund a proposal because it sounds
good or because the agency is an important agency or the area
is an important area. You have to make certain that the
proposal will work, that it will contribute something that will
add value and will involve money well spent. And so this
analysis is actually a very comprehensive and thorough one.
We think in the next budget cycle we're going to get better
submissions from the agencies. We've been working with the
agencies directly one on one to get them to understand the
change. We're expecting that in the IT area we are going to
receive budget submissions that are better thought out and that
will have better justifications.
Mr. Turner. Mr. Gilligan made a strong case for greater
emphasis on cross-agency initiatives. What has OMB done to
promote greater cross-agency efforts?
Mr. Spotila. We've actually been doing a variety of things.
We've worked closely with the CIO council, which I've chaired
since last year until their DDM was confirmed. We've worked
closely with John and his committee in that regard trying to
identify areas. We've worked closely with Dick Clark and the
Critical Infrastructure Assurance Office and the national
security community and with others throughout OMB and the
agencies trying to identify areas where crosscutting
initiatives would help.
John mentioned public infrastructure which would enable us
to authenticate signatures. We think that's an important area.
We know we need better intrusion detection capability. We think
we need expert review teams that can get out onsite in the
various agencies and help them not only assess security but try
to improve their efforts in security. We think we need more
efforts in the R&D area. We need scholarships for people to
start learning this area so that the Federal Government can get
the kind of personnel it needs with the kind of experience and
educational background it needs to work in this area over the
long term.
So we have tried to identify areas of need, working closely
with all these other parties, and then within the budget
process we've actually given it a huge amount of support to try
to help develop proposals that make sense, that will have
credibility with the Congress, that will work once implemented.
I think that the reality is we do start with a stovepipe
approach. We all need to think outside of the box. We need to
make certain that, as we do crosscutting initiatives, that they
work so that we can buildup credibility and support for further
efforts in the future. That's something we take very seriously,
and I think that will be an ever-growing need in the future.
Mr. Turner. How many dollars have you expended on cross-
agency initiatives and how many of them have been accomplished?
Mr. Spotila. Well, I think the reality is that in the past,
as John has said, when there have been efforts like
crosscutting initiatives, for example, support of the CIO
Council and its efforts, we've done that by what John indicates
is passing the hat. Under the Clinger-Cohen Act, we have some
ability to do that, to have agencies contribute toward support
of crosscutting measures.
The President's budget, as I outlined in my testimony, not
only includes an increase for computer security in general, but
it highlights crosscutting initiatives that we think are very
important. John mentioned that for $50 million an awful lot can
be accomplished. I think the President's request is actually
greater than that in this area because we're also focusing on
research and development and on cyberscholarships and the like.
Still, we're looking at a relatively small amount of money.
$150 million would make a huge impact in this area. The key is
to get it appropriated.
And so when we talk about past crosscutting initiatives
it's hard to track because we haven't had the kind of
appropriations in large numbers that we're talking about here.
We have used relatively small amounts of money to support the
CIO Council and some other developmental areas along these
lines. The GITS Board, for example, worked on the PKI--public
key infrastructure-- issue for some time. The Board has now
been rolled into the CIO Council. We've identified a need to do
much more of this going forward. I think the key now will be to
see what happens in the appropriations process this fall.
Mr. Turner. You've requested how many dollars for cross-
agency initiatives?
Mr. Spotila. We have a list in my testimony that I can just
mention, highlight real quickly.
Mr. Turner. Where would that be found?
Mr. Spotila. In my written testimony?
Mr. Turner. I mean in the budget itself. Is it
appropriations in OMB? Is that where the money would reside
currently?
Mr. Spotila. No. Actually, although these are crosscutting
initiatives in the budget, they appear in the departmental
submissions. So, for example, the Department of Commerce is
seeking $5 million for NIST to establish an expert security
review team that can then go to agencies, to a number of
different agencies outside of Commerce. That's an example. When
we talk about crosscutting initiatives, because of the nature
of the appropriations process, it needs to appear in an
individual agency's budget. Part of the difficulty is--not to
single out Commerce--if that particular appropriations
committee or subcommittee doesn't think it a priority, that an
expert security review team at Commerce will be helping 25
other agencies, they might give it less support. That's where
the difficulty comes in the budget process.
So all of these so-called crosscutting initiatives still
appear in individual agency budget submissions.
Mr. Turner. I think that's one of the things that I have
concern about, that perhaps we need some central location, some
leadership for this that would flow through our Federal CIOs to
be sure that these things happen. Because I think what you're
left with, even after you secure the appropriations agency by
agency, you're still in the pass-the-hat mode, which I think is
one of the problems that we perhaps face in the area that we
are discussing.
Thank you, Mr. Chairman. I know my time's expired.
Mr. Horn. Thank you.
Let me followup on that again. There's obviously a concern
when you have these cross--the boundaries, if you will,
initiatives. Now, can--on reprogramming, you know, $5 million,
that's chicken feed to any agency. They have got the--they can
reprogram that.
So you don't really need to worry too much. But you're
right. If they're trying to help four or five other agencies,
the appropriations and authorizers here might say, hey, not on
my beat, put them somewhere else. So--but, hopefully, that's
why OMB is there, to sort of help straighten it out.
I am not going to embarrass any of the CIOs here, the chief
information officers, but have the secretaries and heads of the
agencies within the executive branch been responsive to the
efforts to strengthen computer security? And I just--perhaps
Mr. Gilligan on behalf of the CIO Council, Chief Information
Council, do you get a feeling in those meetings that some of
them just--these are not, obviously, here. They're other
places. But do you get a feeling that they're not getting good
backing from the top executives in the agency?
Mr. Gilligan. It's my clear sense that the senior
executives across the agencies are getting the message. It's a
complex issue, and I think the difficulty, as I addressed in my
testimony, is understanding both that cybersecurity is
important, and understanding what to do about it are two
different things, and I think that's, in many cases, where
agencies are stuck. It is not an issue that can be delegated
down. It has to be undertaken and aggressive leadership has to
be provided by senior management, as we found with Y2K.
So I reiterate, I think the actions of the senior levels of
the administration, and of this committee and others are going
to be important in helping to get that message across. While
there are complex technical issues that equate to rocket
science, there is a foundation that must be built that is just
good sound management practice that requires aggressive
involvement at the senior levels.
Mr. Horn. Let me move to another question, that when we had
this discussion a few minutes ago on the libertarian
suggestions, what message do the grades that we have given you
send to the American people regarding the security of the
citizens' personal information? Should we have a special
category in that as to how that's dealt with in an agency and
on those files that such as the census and others are the
obvious one over in Commerce? Should we have a category as to
how high in the agenda and hierarchy of things to be done that
you first protect the information of the American citizen from
getting out for people making use of those data and, therefore,
perhaps as we've seen what's happened in credit card operations
is some of these idiots take exactly the whole name and number
and all the rest of it, and the result is that those poor souls
can never get a loan again because somebody's running around
the country with their credit card. Well, isn't that also true
in some of the agencies here? What do you think, Mr. Spotila?
Mr. Spotila. Well, let me start by saying that we take very
seriously the importance of preserving the confidentiality of
information that the government holds. As we've been discussing
throughout this morning, we recognize that, although a lot of
progress has been made, we are not done. We cannot afford to be
complacent because the challenge in this area is a dynamic one.
The threat changes; new technology, new threats can appear. And
so, on a day-by-day basis, we need to continue to do the best
we can and to improve our efforts.
Without getting into the grades themselves, we all agree
here that there is room for improvement. I'm perhaps more
sanguine in the sense that I think that the information that
we're talking about here is not at great risk. I think the
agencies are very careful about protecting that information, as
John Dyer indicated at Social Security. They take it very
seriously and realize the importance of it. This is not to say
that we're complacent. A new threat could emerge tomorrow that
hasn't been anticipated, and a part of what you need in the
security area is the ability to detect intrusions and to react
to them and to correct problems when they surface.
So I would say to the American people that we take security
very seriously and that we all need to work together on behalf
of the American people in this area.
Mr. Horn. Mr. Willemssen, you've looked at a lot of
agencies over the years. What is your answer to that question
and how worried should the American people be about this
situation?
Mr. Willemssen. Well, I think--point one, Mr. Chairman, I
think it's imperative to point out that absolute protection is
not possible, and so we've got to look at this from a risk
perspective. And in doing those risk assessments, the higher
the sensitivity of systems and data, then the more rigid and
tight the controls need to be and agencies need to make that
up-front judgment on how much risk for particular systems and
data they're willing to accept and, given that acceptance of
risk, then put in the appropriate controls.
And I think in many cases we still have agencies who
haven't done the in-depth risk assessments of systems and data
in order to come to those judgments because not all systems and
data are created equal. There has to be some judgments up front
on what we absolutely have to protect as best as possible,
again recognizing that there is no absolute as it pertains to
protection but that we can narrow the margin significantly.
Mr. Horn. Ms. Singleton, would you like to get your licks
in, shall we say?
Ms. Singleton. I'd like to offer one additional comment
along those lines, which is to say that part of the problem
that I think the American people might perceive with this
system as a whole is that in the private sector if you leak a
document--say you work in a law firm and you leak a document
about a client. The law firm stands a good chance of losing its
client and you stand a good chance of losing your job. But
there's a greater perception I think on the part of the
American people--and partly it's correct that, in a Federal
Government agency, if there's a leak or a mistake or an error,
that there will be relatively lesser consequences for the
agency as a whole and for the employee of that agency than
there would be in the private sector.
For example, if somebody in the agency does lose your file
or give it to the wrong person, you still have to deal with
that agency. You can't go to say another Department of
Agriculture or another Department of Labor and find a, you
know, better security practice there. So I think that also goes
to the issue of some of the expense involved, is that it would
be very helpful for the perception of the American people to
have an understanding that if these policies are violated that
there will be real consequences for the agency and for the
employees involved.
Mr. Horn. Well, we thank you on that.
I'm going to have a few closing words, and I want to thank
the staff and tell you what we're doing tomorrow here.
It's clear that a great deal of attention must be focused
on this vital issue. There's a lot of computer security policy
out there, but it isn't necessarily being followed by some
agencies and others. And when we look at all of the State
governments you've got another matter there in terms of
privacy. What does it take, legislation? You can be assured if
it does we will continue to monitor the government's progress
in this area.
This report card sets a baseline for the future oversight.
It also is a wake-up call for Federal departments and agencies
to begin taking the necessary steps to ensure that the
sensitive information contained in the computers will be
protected.
Tomorrow at 10 a.m. the subcommittee will hold a related
hearing to examine two proposals that would establish the
position of a Federal chief information officer. The gentleman
from Texas has proposed that. Among other responsibilities,
this governmentwide position would be responsible for the
government's computer security efforts, and that's one
approach, and that's in essence what we asked the President to
do in the summer of 1997, was get somebody to put them in
charge.
Now, they didn't move for about a year, but when they did
move that was exactly what was needed to get the coordination,
somebody to be assistant to the President as Mr. Constant was
when he was brought back into government, and he did a very
fine job of pulling all the pieces together. Because I would
ask, has the President brought this up at a Cabinet meeting?
And, Mr. Spotila, I don't know if you know the answer to
that, but in the Eisenhower administration, that thing would
have been up there 10 years before. That's what Social Security
was under the Y2K. They were on their own. There was no
administration. They went through three of them in that period
that didn't really face up to it until the bells were really
ringing.
So that's one of our concerns. But I think the next round
we'll have a better feel for how accurately and diligently the
agencies are doing it.
I want to thank each of these witnesses today, and I want
to thank the staff on both the minority and majority: J.
Russell George, staff director, chief counsel of the
subcommittee; Randy Kaplan, counsel; on my left, your right,
Ben Ritt, professional staff member on loan from the GAO and
the one that has had a lot of effort on putting this particular
hearing together; Bonnie Heald, director of communications;
Bryan Sisk, clerk; Elizabeth Seong, staff assistant; Earl
Pierce, also a professional staff member; and George Fraser,
intern.
On Mr. Turner's side, Trey Henderson, minority counsel; and
Jean Gosa, minority clerk.
Court reporters, Colleen Lynch and Melinda Walker.
May I say that we're now going to end this, and I know the
media have wanted to have some questions, and those of you that
would like to stay, please, gentlemen, and Ms. Singleton,
you're welcome to stay. You're the experts in a lot of these,
and I'm sure they'd like to ask you a few questions, but we
won't do it in a formal hearing, and we--I don't know how the
oath spreads over to a press conference, but we're in recess
here. So--till tomorrow anyhow.
[Whereupon, at 11:50 a.m., the subcommittee was adjourned.]