NIST Closer to Solidifying Critical Infrastructure Cybersecurity Framework

The National Institute of Standards and Technology (NIST) held in San Diego last week the third of four workshops to develop a comprehensive cybersecurity framework for critical infrastructure as required under an executive order signed by President Obama on February 12, 2013.  As my latest piece for CSO discusses, it won't be clear what the 500 participants produced until NIST releases its summary document later this month.

But several cracks in the process continued to emerge during the workshop, including doubts about whether NIST is trying to recreate the wheel, whether enough critical infrastructure sectors are actually participating in the process, whether DHS and NIST are coordinating well enough and whether this whole thing might slip from the voluntary to the mandatory category.

Check out the piece here.

Read More

DHS Official: Napolitano Departure Won't Delay Cybersecurity EO or PPDTasks

(La Jolla, CA)  A top Department of Homeland Security (DHS) official involved in a number of initiatives flowing from President Obama's February 12 cybersecurity executive order (EO) and Presidential Policy Directive (PPD) said today that the impending departure of DHS Secretary Janet Napolitano shouldn't delay any of the time-sensitive and crucial tasks assigned to DHS under the EO and PPD.  

At a workshop hosted here at the University of California, San Diego (UCSD),  Robert Kolasky, Director of the DHS Integrated Task Force, said in an interview that (acting) DHS Deputy Secretary Rand Beers "is well familiar with the work involved.  I don't anticipate any delays."  The workshop, run by the National Institute of Standards and Technology, was a key event in the development of a voluntary critical infrastructure cybersecurity framework. Napolitano is leaving DHS in September to run the University of California system (UCSD is part of that system although the NIST workshop and Napolitano's new role are unrelated).

As the table below highlights, not only has DHS been assigned a central coordinating role in both the the EO and PPD, it also has a number of fast-track tasks that must be completed prior to Napolitano's departure.  DHS officials say that the agency has fulfilled its obligations on all of the tasks in that it has submitted to either the President or the Office of Management and Budget (OMB) required reports and materials by the specified deadlines that have occurred to date.  None of the reports listed in the table below have been made public yet, although Kolasky said that at least one of the reports, recommendations on the incentives critical asset owners need to participate in the new wide-ranging security efforts, will be made public by the end of July.

Read More

NIST Gets Down to Brass Tacks on Cybersecurity Framework in San Diego

Starting tomorrow in San Diego, the National Institute of Standards and Technology (NIST) will host the third, and perhaps most important, in a series of workshops aimed at developing a voluntary comprehensive cybersecurity framework that will apply across sixteen critical infrastructure sectors.

As the first in a series of articles I've been commissioned to write for CSO Magazine discusses, the NIST process faces a host of challenges, including CEO apathy, government agency rivalry and asset owner fear of vendor dominance.  Still, most of the major players say everything is on track and proceeding as expected.

Check out the article here.

Read More

Napolitano: Voluntary Cybersecurity Framework is "An Experiment" At This Point

Department of Homeland Security (DHS) Secretary Janet Napolitano said today that the voluntary cybersecurity framework outlined in President Obama's February 2013 executive order (EO) and public policy directive is at this point "an experiment" because it grants major responsibility for the nation's security to the private sector, an arguable first in the history of national defense.  Speaking at an event at the Wilson Center in Washington, DC, Napolitano said "the voluntary program…is going to be at this point an experiment and a very important one.  Where security is concerned, we don’t normally depend on the private sector.  We inherently view that as an inherently government function."

Napolitano was specifically referring to the development of a cybersecurity framework taking place under the auspices of the National Institute of Standards and Technology (NIST) pursuant to the EO, which is premised on the idea that a public-private partnership can create cybersecurity rules of the road that minimize cybersecurity breaches across 16 critical infrastructure industries.  "If we can make this work and show that there is a vital ongoing strong partnership…we will have succeeded in this experiment," she said .  

But, "I don’t think we have yet come to closure whether this is an appropriate thing to have shared responsibility as opposed to an inherently governmental responsibility," she stressed.  "This is really the first time in our nation’s history that we’ve approached a major security problem in this way."

Other speakers at the event echoed Napolitano's skepticism.  Former DHS Secretary Michael Chertoff, now Chairman of the Chertoff Group, said "it is kind of a novelty…we don’t really expect the private sector to defend itself against attacks."  The only other alternative is for the federal government to step in which would "put the government into everybody’s computers and everybody’s networks," he said. Speaking about Napolitano's emphasis on how experimental the framework is, Chertoff said "I do think her message is that at the end of the day if it’s not done and the private sector doesn’t step up…the public will demand mandates."

It won't be easy for the private sector to implement the right cybersecurity measures needed, according to Steve Flynn, Founding Co-Director of the George J. Kostas Research Institute for Homeland Security and Professor of Political Science at Northeastern University.  "An element of the challenge here is that we’re kind of late to the game and kind of boilerplate on security safeguards for systems that were not built to be made essentially safe, certainly  for the threats we have," he said.  "It’s a bit like trying to take a raised ranch home and make it handicapped accessible.  It’s going to be expensive, ugly and not work well."

Read More

DHS Advisor: There Is a Really Short List of Potential Cybersecurity Catastrophes

(Washington, DC)  One of the Department of Homeland Security (DHS) officials in charge of executing on the key tasks outlined in President Obama's February 2013 cybersecurity executive order (EO) and public policy directive said yesterday that his agency has found few situations that can cause a catastrophe.  "Our critical infrastructure is pretty resilient and we do not see a long list of things that can cause catastrophe," Robert Kolasky, Co-Chair of the DHS Integrated Task Force said during a panel discussing at The Cable Show, the cable industry's big annual conference held here.

Kolasky was mainly referring to the process outlined in the EO whereby DHS is obligated to identify what constitutes critical infrastructure, a controversial task that has to be completed by July 12 of this year. Presumably in developing the list or inventory or identification of critical infrastructure, DHS has examined where potential cyber harm can cause the greatest damage.  "It's going to be a really short list of potential catastrophes," he said, noting that communications and electricity are the top two critical infrastructure sectors under examination.  "We still come at it from the perspective that communications and electricity are critical."

The communications sector may be in better shape than electricity.  "A lot of what we've seen is that there is redundancy and resiliency with communications service," Kolasky said.  The situation is different for the electric sector he said later in an interview because of the various structural and geographic factors that make it difficult to build redundancy and resiliency into the electric grid.

Another task in the EO, the development of a comprehensive cybersecurity framework that covers 16 designated critical infrastructure sectors, is well underway with a third workshop on that framework to be hosted in San Diego during the second week of July.  Critical infrastructure representatives should be really prepped for that meeting, Donna Dodson, Chief of Cybersecurity for the National Institute of Standards and Technology (NIST), the government arm in charge of developing the framework, told the cable group.  "I think it's important from our perspective that people come in to the next workshop with a strong understanding of the executive order and the framework process," she said.

One question dogging the President's EO and policy directive mandates is whether the various agencies involved can meet what some consider to be extraordinarily tight deadlines for a host of difficult tasks on such a complex subject.  "With the executive order, we have really stepped it up," Samara Moore, White House Director for Cybersecurity and Critical Infrastructure said.  Through an active interagency process, "we've been working together to meet the deadlines."

Read More

NIST Cybersecurity Workshop: Well-Organized but Concerns Crop Up

(Pittsburgh, PA)  Hundreds of top cybersecurity professionals gathered here at Carnegie Mellon University on May 29 for the second Cybersecurity Framework Workshop hosted by the National Institute of Standards and Technology (NIST) to help develop a comprehensive framework for critical infrastructure industries, as mandated under President Obama's February 2013 Executive Order.  With the goal of producing a framework that can adequately stretch across 16 critical infrastructure sectors by October of this year, NIST hired facilitators to lead three days of discussions across eight break-out groups along four tracks, which NIST says are the areas where "gaps" were identified based on a review of the comments filed by numerous parties in response to an RFI issued by NIST.

The four tracks are the "Business of Cyber Risk," "Threat Management," "Cybersecurity Dependencies and Resiliency" and "Progressive Cybersecurity:  From Basics to Advanced Cybersecurity."  I participated in the first three of the tracks and spent some time talking to my fellow break-out group members, other break-out group attendees as well as some of the NIST organizers and track facilitators.  Based on all this, here are the top takeaways so far:

1.  The process is well-organized although the substance seems to be lacking:   although the NIST organizers get high marks for a well-coordinated workshop, a recurring comment is whether the open-ended nature of the break-out sessions has achieved anything so far.  One of the facilitators told me that the soft nature of this first roll-up-your-sleeves workshop is intentional in order to give all parties an opportunity to provide input - the next workshop in California will present an actual straw-man framework for the attendees to address.

2.  Asset owners need to have a stronger representation:  although a good chunk of the 300 to 400 attendees are asset owners (mostly utilities and telcos with a sprinkling of cable companies and financial institutions), the majority appear to be either consultants or vendors.  Several of the asset owner attendees have remarked that the break-out sessions are heavily tilted toward vendors and that in the smaller groups within those sessions, the ratio of vendors/consultants to asset owners can be five to one.  This criticism harkens back to the process that NIST undertook when it developed interoperability standards for the smart grid, which is an oft-cited model for the current cybersecurity framework process.  During the development of the smart grid standards, several utility representatives remarked that the process was vendor-driven and therefore of lower value to them as a consequence.

3.  Some of the topics veer outside the scope of cybersecurity:  during my break-out session on dependencies and reliabilities, for example, the facilitators widened the scope of the discussion to include all possible dependencies (including human capital, legal and contract-related requirements and other issues). Some of the asset owners in the room balked at this wide scope, arguing that the process should stay narrowly focused on pure cybersecurity matters. As one of these participants said during my session, business practices should be outside the scope of NIST's investigations.  A fear among some critical infrastructure owners is that the NIST process might lay the foundation for regulatory action someday despite its current voluntary and public-private partnership approach.  Thus the further the process strays from the topic of cybersecurity, the wider the potential regulatory field, or so some fear.

Whether NIST can develop a comprehensive framework that addresses cybersecurity in a meaningful way while setting aside too many business practices is an open question at this point. During the plenary session on the second day of the workshop, Bruce McConnell, Acting Deputy Under Secretary of DHS said one of the goals of the framework is to "raise the level of conversation about cybersecurity...The conversation we've been having over the past 25 years has been a technical conversation. There is a gap between information technology risk and enterprise risk management."

Read More

Who's Paying for Huawei's Cybersecurity Evaluation? Not Huawei, Apparently.

Under tough questioning yesterday from Silicon Valley-area U.S. Representative Anna Eshoo (D-CA), John Lindquist, the CEO of highly regarded defense contractor and security firm Electronic Warfare Associates (EWA), said that a major American telecommunications company paid for a recent cybersecurity audit of technology from controversial Chinese telecom equipment supply giant Huawei.  Speaking at a hearing on supply chain cybersecurity issues before the the House Energy and Commerce Committee's Subcommittee on Communications and Technology, John Lindquist, President and CEO of EWA was asked by Eshoo who paid for the cybersecurity "seal of approval" that she assumes EWA gave to Huawei.

Eshoo had presumed that Huawei had paid for the evaluation given that Huawei itself has said on several occasions that it has "hired" EWA "to audit our products in order to certify the safety and reliability of the products at the source code."  If that were the case, Eshoo said, it could be the "equivalent of what happened on Wall Street" when the ratings agencies gave glowing marks to some unstable financial institutions that paid the agencies.

To Eshoo's surprise, Lindquist said that in fact Huawei didn't pay for the evaluation but that an unnamed major American telecommunications company did instead.  Lindquist said that an NDA barred him from naming the company.  In his written testimony, Lindquist did note that EWA's business practices, as is the case with many technology evaluation firms, call for the telecommunications company, as the primary beneficiary, to pay for security evaluations of vendor products.

It wouldn't be surprising, then, that a major U.S. telecom company would pay for an evaluation of Huawei's products.  A number of U.S. telecom companies do business with Huawei, including Cricket Communications, Clearwire, Cox and Level 3/BTW, according to a report by Chairman Mike Rogers (R-MI) and Ranking Member C.A. Dutch Ruppersberger (D-MD) of the Permanent Select Committee on Intelligence.  In addition, a number of other Tier 1 telecom providers, such as Verizon, are clearly evaluating if not currently using Huawei technology.

Whichever telco it is, "they are in the process" of contemplating a purchase and "we are in the process of evaluating their system.  The evaluation is by no means complete and we’re only evaluating the radio area network portion," Lindquist said.

Lindquist stressed, however, that "we do not give a seal of approval.  What we do is take known threats and we have very good access in the government to the agreed list of cyberthreats...what we do say is what we looked at and what we found and if we found things, what corrections were made."

Huawei, an equipment and networking giant whose global sales of gear and software skyrocketed over the past ten years, topping $30 bil. in annual revenue, is viewed by some military and cybersecurity specialists as a threat to the security of critical telecommunications infrastructure.  Some Huawei opponents believe that the company is bankrolled and controlled by the Chinese government, which is arguably the most active nation-state engaged in cyber espionage and hacking.  They further suspect the motives of Huawei's founder, Ren Zhengfei, who formed the company after leaving a civilian-ranked engineering post in the Chinese military.

As a consequence, Huawei has the capability of introducing, and incentive to introduce, undetectable backdoors and other vulnerabilities in the products it sells to telecom companies, for the benefit of China's economic and military interests, detractors argue.  Other experts, however, contend that the focus on Huawei, and to a lesser extent another telecom tech giant, ZTE, is a form of paranoia inappropriately focused on Chinese companies due to the often overheated and sometimes nationalistic rhetoric surrounding cybersecurity matters.

Read More