|Federal Information & News Dispatch, Inc.|
Chairman Carter, Ranking Member Price, and distinguished Members of the Subcommittee, let me begin by thanking you for the strong support that you have provided the
We are pleased to appear before the Committee today to discuss NPPD's efforts to strengthen the Nation's physical and cyber critical infrastructure security and resilience against terrorist threats, cyber events, natural disasters, and other catastrophic incidents. The President's Fiscal Year (FY) 2015 Budget Request for NPPD is
The National Infrastructure Protection Plan (NIPP) was released in
Leveraging Integrated Capabilities: Implementing PPD-21 and EO 13636
The FY 2015 budget request reflects targeted enhancements to continue implementation of the EO and PPD. Enhancements of
C2 Voluntary Program
The C3 Voluntary Program is a public-private partnership aligning business enterprises as well as Federal, State, local, tribal, and territorial (SLTT) governments to existing resources that will assist their efforts to use the
Enhanced Cybersecurity Services
The ECS capability enables owners and operators of critical infrastructure to enhance the protection of their networks from unauthorized access, exfiltration, and exploitation by cyber threat actors. The requested enhancement of 24 positions and
Regional Resiliency Assessment Program (RRAP)
The proposed increase of three positions and
Infrastructure Design and Recovery Support
To support its role in PPD-21 and assignment in the National Disaster Recovery Framework, an increase of
Integrated Cybersecurity Operations
Increased connectivity has led to significant transformations and advances across our country and around the world. It has also increased complexity and exposed us to new vulnerabilities that can only be addressed by timely action and shared responsibility. Successful responses to dynamic cyber intrusions require coordination among DHS, the Departments of Justice (DOJ), State (DOS) and Defense (DOD), the Intelligence Community, the specialized expertise of Sector Specific Agencies such as the
DHS is home to the
The NCCIC also provides strategic cyber-threat analysis, through its United States Computer Emergency Readiness Team (US-CERT) and the
Further demonstrating NPPD's commitment to greater unity of effort in strengthening and maintaining secure and resilient critical infrastructure against both physical and cyber threats, the NICC has moved its watch operations center to collocate with the NCCIC. The NICC is the information and coordination hub of a national network dedicated to protecting critical infrastructure essential to the nation's security, health and safety, and economic vitality. In accordance with and supporting the physical-cyber integration directives of PPD-21, this new integration will enhance effective information exchange, and improve the alacrity of protection with real-time indicator sharing. Concurrently, the NCCIC will refine and clarify the NICC-NCCIC relationship to advance national unity of effort within NPPD and the Federal Government.
Protecting Federal Networks
DHS directly supports federal civilian departments and agencies in developing capabilities that will improve their own cybersecurity posture. Through the
Available to all Federal civilian agencies, the CDM program provides diagnostic sensors, tools, and dashboards that provide situational awareness to individual agencies and at a summary federal level. This allows agencies to target their cybersecurity resources toward the most significant problems, and enables comparison of relative cybersecurity posture between agencies based upon common and standardized information. The CDM contract can also be accessed by defense and intelligence agencies, as well as by State, local, tribal, and territorial (SLTT) governments. 108 departments and agencies are currently covered by Memoranda of Agreement with the CDM program, encompassing over 97 percent of all federal civilian personnel. In FY 2014, DHS issued the first delivery order for CDM sensors and awarded a contract for the CDM dashboard. The
In addition, the National Cybersecurity Protection System (NCPS), a key component of which is referred to as EINSTEIN, is an integrated intrusion detection, analytics, information sharing, and intrusion-prevention system utilizing hardware, software, and other components to support DHS responsibilities for protecting Federal civilian agency networks. In FY 2015, the program will expand intrusion prevention, information sharing, and cyber analytic capabilities at Federal agencies, marking a critical shift from a passive to an active role in cyber defense and the delivery of enterprise cybersecurity services to decision-makers across cybersecurity communities.
It is important to note that the Department has strong privacy, civil rights, and civil liberties standards implemented across its cybersecurity programs. DHS integrates privacy protections throughout its cybersecurity programs to ensure public trust and confidence. DHS is fully responsible and transparent in the way it collects, maintains, and uses personally identifiable information.
Data Security Breaches
During both incidents, NPPD's NCCIC utilized its unique cybersecurity, information sharing and mitigation capabilities to help retailers across the country secure their systems to prevent similar attacks while simultaneously providing timely analysis to the
In response to this incident, NCCIC/US-CERT analyzed the malware identified by the USSS as well as other relevant technical data and used those findings, in part, to create two information sharing products. The first product, which is publicly available and can be found on US-CERT's website, provides a non-technical overview of risks to point of sale systems, along with recommendations for how businesses and individuals can better protect themselves and mitigate their losses in the event an incident has already occurred. The second product provides more detailed technical analysis and mitigation recommendations, and has been securely shared with industry partners to enable their protection efforts. NCCIC's goal is always to share information as broadly as possible, including by producing actionable products tailored to specific audiences.
While the criminal investigation into the these activities is on-going, NPPD, through the NCCIC and other organizations, continues to build shared situational awareness of similar threats among our private sector and government partners and the American public at large. At every opportunity, the NCCIC and our private sector outreach program publish technical and non-technical products on best practices for protecting businesses and customers against cyber threats and provide the information sharing and technical assistance necessary to address cyber threats as quickly as possible. DHS remains committed to ensuring cyberspace is supported by a secure and resilient infrastructure that enables open communication, innovation, and prosperity while protecting privacy, confidentiality, and civil rights and civil liberties by design.
Understanding Cyber and Physical Critical Infrastructure Interdependencies
One of NPPD's top priorities is providing our government and private sector partners with the information, analysis, and tools they need to protect our Nation's critical infrastructure in the face of physical and cyber risks. Key to this effort is understanding the consequences of potential disruptions to critical infrastructure, including interdependencies and cascading impacts, from all hazards to better equip and prepare our partners and stakeholders. Understanding consequences helps identify potential mitigation measures and prioritize the allocation of limited resources for both government and private sector.
NPPD has already demonstrated the impact of this enhanced coordination over the last year. For example, prior to the establishment of OCIA, the Homeland Security Infrastructure Threat and Risk Analysis Center (HITRAC) established the Integrated Analysis Cell to serve as the intersection of NPPD's two operational centers: the National Infrastructure Coordinating Center (NICC) and
Integrating Cyber and Physical Analytic Capabilities
To advance this objective, NPPD established the
OCIA grew out of a pilot effort, the
Similarly, the IATF brought together experts from across Government, including the
In addition to these recent efforts which demonstrated NPPD's ability to integrate cyber and physical infrastructure analysis, OCIA will incorporate and build upon the established analytic expertise of both Homeland Infrastructure Threat and Risk Analysis Center and the National Infrastructure Simulation and Analysis Center.
Partnering Across the Homeland Security Enterprise
California Power Substation Attack and Subsequent Outreach Campaign In response to the
NPPD also took part in a national drill involving more than 10,000 electrical engineers and cybersecurity specialists, among others, in
In addition to the extensive interagency efforts described above, IP has been conducting security assessments of electrical power and telecommunications facilities to provide stakeholders with best practices in access control, closed-circuit television usage, and intrusion detection systems and protective measures. This effort assists power companies by recommending security practices and protective measures, which are captured in the Infrastructure Protection Report Series that is broadly shared with critical infrastructure stakeholders.
NPPD, along with the DOE - which as the sector-specific agency for energy, works to protect against and mitigate threats to energy infrastructure - continues to coordinate national efforts to raise awareness about evolving threats and promote measures to reduce risks to systems such as the electric grid and system components such as electric substations. This effort is part of ongoing collaboration with industry to understand and reduce other physical and cyber risks to the energy sector and critical infrastructure.
Engaging with Federal, SLTT, and Private Sector Entities
NPPD is committed to engaging with Federal, SLTT, and private sector stakeholders. More than 1,100 participants were involved in the development of NIPP 2013, providing thousands of comments reflecting our partners' input and expertise. Through the
NPPD serves as a principal coordination point for stakeholder engagement for Cybersecurity through the Cyber Security Evaluation Program (CSEP). CSEP which provides voluntary evaluations intended to enhance cybersecurity capacities and capabilities across all 16 Critical Infrastructure Owner/Operators, as well as SLTT governments through its Cyber Resilience Review (CRR) process. The goal of the CRR is to develop an understanding and measurement of key cybersecurity capabilities and provide meaningful maturity indicators to an organization's operational resilience and ability to manage risk to its critical services during normal operations and times of operational stress and crisis.
The FY 2015 President's Budget includes
NPPD provides a series of NS/EP and emergency communications capabilities required by National Security Presidential Directive-51/Homeland Security Presidential Directive-20, National Continuity Policy, and the 21st Century Emergency Communications Act of 2006 that support SLTT and private sector stakeholders. NPPD develops and maintains NS/EP communications priority services programs, which ensure commercial communications are available during a crisis to over 300,000 NS/EP users across all levels of government and first responders, even during heavy telecommunications usage/congestion.
EO13618, Assignment of National Security and Emergency Preparedness Functions, assigned DHS responsibility for ensuring priority communications requirements using commercial, government, and privately-owned communications resources. The Next Generation Networks-Priority Services (NGN-PS) program was established to ensure priority services will be available to NS/EP users as commercial telecommunications carriers transition from circuit-switched to Internet Protocol-based infrastructures. Over the long term, NGN-PS will deliver priority voice, video, and data communication services.
The FY 2015 President's Budget Request includes an enhancement of
The Government Emergency Telecommunications Service (GETS) program supports more than 310,675 FSLTT government, industry, and non-governmental organization personnel in performing their NS/EP communications missions by providing a mechanism to complete calls during network congestion from anywhere in
NPPD is also supporting the implementation of the Middle Class Tax Relief and Job Creation Act of 2012 (Public Law 112-96), which established the Nationwide Public Safety Broadband Network for emergency responders at all levels of government. A DHS priority is to ensure resilience measures are built into the network as part of the design. DHS worked closely with industry and Federal stakeholders to develop a risk assessment of the network's physical and cybersecurity infrastructure and offered recommendations to ensure appropriate security measures are built in from the outset of the Network's deployment. In 2013, this risk assessment was provided to the
DHS continues to aid in the advancement of FirstNet's deployment of a nationwide public safety broadband network through
Securing High-Risk Chemical Facilities
NPPD secures America's high-risk chemical facilities through the systematic regulation, inspection, and enforcement under the authority of the Chemical Facility Anti-Terrorism Standards (CFATS). The CFATS rule establishes enforceable risk-based performance standards for the security of our Nation's highest risk chemical facilities. High-risk facilities have the flexibility to develop appropriate site-specific security measures that will effectively address risk by meeting these standards through Site Security Plans (SSPs) or, if the facility so chooses, through Alternative Security Programs (ASPs). In FY 2015,
NPPD continually evaluates the CFATS program to pinpoint areas for improvement and fine-tunes its processes when necessary to ensure efficient and effective implementation, resulting in continued forward progress for the program. The Department remains committed to working with
ASPs are also an important part of the CFATS program's continued progress. The ASP provides an option for regulated facilities to submit information required to document site security measures that address the risk-based performance standards through an alternative format. As of
In addition to carrying out the CFATS program, ISCD also is working to implement the Ammonium Nitrate Security Program. The Department is continuing to adjudicate comments received on the Ammonium Nitrate Security Program Notice of Proposed Rulemaking issued in
DHS/NPPD, along with the
OBIM is the lead entity within DHS responsible for biometric identity management services. OBIM, through the Automated Biometric Identification System (IDENT) system, stores biometric identities and conduct recurrent matching against derogatory information, and analysts provide other biometric expertise and services to deliver accurate information to decision makers. By matching, storing, sharing, and analyzing biometric data, OBIM provides partners on the front lines of homeland security with rapid, accurate, and secure identification.
OBIM's current services consist of the biometric identity management and analysis capabilities that directly support agencies within DHS, as well as the
OBIM's total budget request for FY 2015 is
Protecting Federal Facilities
FPS protects more than 9,000 GSA-owned, -leased, or -operated facilities, serving more than 1.1 million occupants, and receiving 1.4 million visitors per year. In this capacity, FPS conducts protective law enforcement and security services and leverages the intelligence and information resources of FPS' network of Federal, State, and local partners. FPS conducted almost 1,700 Facility Security Assessments in FY 2013 and continuously recommends appropriate countermeasures, ensures stakeholder threat awareness training, and oversees approximately 13,000 Protective Security Officers (PSO). FPS also responds to more than 40,000 calls for service annually, investigates a wide range of crimes related to Federal property and Federal employees, protects Federal facilities during national and local security special events, and provides protection services for disaster and emergency response.
During the last fiscal year, FPS responded to more than 45,700 incidents, made over 1,700 arrests, interdicted more than 781,000 weapons and prohibited items at Federal facility entrances during routine checks, conducted more than 50,400 post inspections, disseminated more than 300 threat and intelligence-based products to stakeholders, and investigated and addressed more than 900 threats and assaults directed towards Federal facilities and their occupants. Also in FY 2013, FPS delivered the first phase of a working cost model, which aligned costs to the activities performed by FPS for its customers. Through this effort, FPS stakeholders have greater transparency into the costs of FPS activities and the level of services provided in law enforcement operations and risk-based security services at Federal facilities.
Additional priorities for FY 2014 and continuing through FY 2015 include: continued implementation of the Facility Security Assessment process; enhancing stakeholders' understanding of vulnerabilities and protective and mitigation strategies; and the institution of enhanced professional development training for law enforcement, management, and mission support personnel across DHS. FPS will continue to provide tailored recommendations for countermeasures and expand its countermeasure program to include closed-circuit television, Intrusion Detection Systems, and other technical countermeasures to standardize and create acquisition efficiencies.
FPS continues to enhance its facility assessment capability to integrate threats, vulnerabilities, and consequences to support risk-based facility protection decisions. Additionally, FPS is collaborating with the
Infrastructure is the backbone of our nation's economy, security and health. We know it as the power we use in our homes, the water we drink, the transportation that moves us, and the communication systems we rely on for business and everyday life. We have an extremely dedicated and talented workforce engaged in activities that advance our mission and their innovation will continue to propel NPPD and DHS forward in FY 2015 and beyond. Each employee is dedicated to a safe, secure, and resilient infrastructure that enables our way of life to thrive.
Thank you, Chairman Carter, Ranking Member Price, and distinguished Members of the Subcommittee for the opportunity to discuss the FY 2015 President's Budget Request for NPPD. We look forward to any questions you may have.
Read this original document at: http://docs.house.gov/meetings/AP/AP15/20140429/102081/HHRG-113-AP15-Wstate-SpauldingS-20140429.pdf
|Copyright:||(c) 2010 Federal Information & News Dispatch, Inc.|