Chairman and CEO of NetWitness, Amit Yoran, gave testimony yesterday to the House Committee on Homeland Security regarding the Review of the Federal Cyberspace Mission. The House Committee wanted Mr. Yoran’s input based on his leadership in cyber security in the private and Federal space and his experiences as the first Director of the National Cyber Security Division (NCSD) and standing up the United States Computer Emergency Readiness Team (US-CERT) and Einstein program at the Department of Homeland Security (DHS), and as founder and CEO of Riptech.
Below is his five-minute summary to the Committee.
Ms. Chairwoman and members of the committee, thank you for the opportunity to testify before the Homeland Security Committee on Reviewing the Federal Cybersecurity Mission and for your attention to this important topic.
My name is Amit Yoran and I have a lot to say, so I’ll skip reading you my bio and jump into it.
Any effective national cyber effort must leverage the intelligence community’s superior technical acumen and scalability. However, it is in grave peril if this effort is dominated by the intelligence community. Simply put, the intelligence community has always and will always prioritize its own collection efforts over the defense and protection of our government’s and nation’s digital systems. Where intelligence operations discover a compromise, the decision to inform system defenders or not, lacks transparency. Mission conflict exists between those defending systems and those attempting to collect intelligence or counter intelligence insights.
The current series of cyber programs call for billions of dollars in funding for intelligence and centralized security efforts but are designed with very little emphasis on helping defenders better protect the systems housing our valuable data and business processes. For instance the Center for Disease Control, which houses sensitive research and information about biological threats such as Anthrax, has ongoing cyber incidents which it lacks the personnel and technologies to adequately investigate, In the face of spending billions more on centralized cyber intelligence activities, the CDC’s cyber budget is being cut by 37%.
Intelligence focused, our national cyber efforts are over-classified to the point where catastrophic consequences are highly probable. High levels of classification prevent the sharing of information necessary to adequately defend systems. For instance, IP addresses, when classified cannot be loaded into defensive monitoring systems. It also creates insurmountable hurdles when working with a broad range of government IT staffs that do not have appropriate clearances, let alone when trying to communicate or partner with the private sector.
Classification cannot be used effectively as a cyber defensive technique, only one for avoiding responsibility and accountability. Over-classification leads to a narrowly limited review of any program. One of the hard learned lessons from the Terrorist Surveillance Program (TSP) is that such limited review can lead to ineffective legal vetting of a program. The cyber mission cannot be plagued by the same flaws as the TSP.
An immediate, thorough and transparent legal analysis of the governance, authorities, and privacy requirements should be performed on both the efforts used to protect IT systems as well as all cyber collection activities. Given the broad concerns of over-classification and its cascading consequences, conducting these reviews must be a high priority task.
Cyber research investments are practically nonexistent at a time when bold new visions need to be explored.
The Department of Homeland Security (DHS) has demonstrated inefficiency and leadership failure in its cyber efforts. While pockets of progress have been made, administrative incompetence and political infighting have squandered meaningful advancement and for years now, while our adversaries continue to aggressively press their advantage. DHS has repeated failed to either attract or retain the leadership and technical acumen required to successfully lead the cyber mission. While the tendency would be to move the cyber mission to the NSA, it is ill advised for all of the reasons provided in my much longer written testimony. We must enable civil government to succeed at its defensive mission or also concede that the private sector must be subjugated to intelligence support.
DHS is the natural and appropriate placement for public private partnership and cooperative activities, including those in cyber. The current set of public private partnerships is at best ill defined. They categorically suffer from meaningful value creation or private sector incentive.
Such incentives might include tax credits, fines, liability levers, public recognition, or even occur at an operational level, through mechanisms such as the sharing of threat intelligence, technical knowledge or incident response support to name just a few.
Trust relationships when dealing in cyber security matters are critical. In discussions among privacy and civil liberties groups the role of the NSA in monitoring or defending US networks is debated. Should such intelligence programs exist, DHS should be very careful before participation in, supporting or engagement in these activities. The department’s ability to fulfill its primary mission and responsibilities may be permanently damaged by a loss of public confidence and trust.
At a bare minimum, in order to preserve public trust, any interaction with domestic intelligence collection efforts should be explicitly and clearly articulated. Such transparency will increase public trust and confidence and offset concerns raised by uncertainty and the uninformed.
DHS must be formally charged with and enabled to build an effective cyber capability in support of securing federal civilian systems.
Special provisions should be made in the hiring, contracting, human resources and political issues within the cyber mission of DHS to prevent it from remaining a victim of the department’s broader administrative failures.
DHS should also be given specific emergency authorities to address security concerns in civil systems, to include the ability to measure compliance with security standards, protocols and practices and take decisive action where organizations are not applying reasonable standards of care.
At present the operations cybersecurity arm of DHS, the US-CERT, remains politically torn apart into three components and completely subjugated to a cadre of detailees from the intelligence community. In order to regain efficiency, the department’s operational security role activites must be reconsolidated in the US-CERT. This operational mission is not resourced to succeed with less than 20 government FTEs, and a budget of only $67 million. Additionally, the US-CERT must be led by a single federal civil executive.
The US-CERT must be provided appropriate staffing levels to move forward and given adequate funding. Not doing so cannot help but send the strongest message to the cyber community, the rest of government, the intelligence community and the critical infrastructure in the private sector that cybersecurity does not matter to DHS leadership and should not matter to them.
A newly focused US-CERT should report directly to the Secretary of DHS, just as NTOC reports to the Director of the NSA. The cyber responsibilities of the department must not remain buried in the bureaucracy of DHS or, alternatively, they must be removed and placed in an independent agency where they can succeed.
