S 4049 Introduced – FY 2021 NDAA

Earlier this week Sen Inhofe (R,OK) introduced S 4049, the National Defense Authorization Act (NDAA)for Fiscal Year 2021. The bill contains many cyber provisions, but most are related to cyber warfare operations. There are seven sections however, that may have an impact on industrial cybersecurity operations.

The Senate Armed Services Committee has reported the bill, but the written report is not yet available from the Government Printing Office. The Senate has started the process for consideration of this bill with the first cloture vote scheduled for tomorrow.

Cybersecurity Items of Interest

The seven sections of potential interest are (number in parenthesis are page number in bill):

§590. Pilot programs on remote provision by National Guard to State governments and National Guards of other States of cybersecurity technical assistance in training, preparation, and response to cyber incidents. (pg 361)

§1623. Defense industrial base cybersecurity sensor architecture plan. (pg 881)

§1631. Defense industrial base participation in a cybersecurity threat intelligence sharing program. (pg 905)
§1632. Assessment on defense industrial base cybersecurity threat hunting. (pg 911)

§1635. Expansion of authority for access and information relating to cyber attacks on operationally critical contractors of the Armed Forces. (pg 915)

§1642. Assistance for small manufacturers in the defense industrial supply chain on matters relating to cybersecurity. (pg 927)

§3131. Reporting on penetrations of networks of contractors and subcontractors [of NNSA]. (pg 1044)

Section 590 is almost certainly essentially the same language that we will eventually see in S 3929 that was introduced on June 10^th, 2020. That bill has not yet been published by the GPO; continuing problems there due to COVID-19 restrictions. The §590 provisions would require DOD to develop a pilot program to asses and develop National Guard capabilities to conduct remote operations to assist other States and National Guard units “with cybersecurity technical assistance in training, preparation, and response” while remaining within their home State.

The five sections relating to the Defense industrial base (DIB) would increase requirements and authority for DOD to oversee cybersecurity operations within the DIB. The provisions would include:

§1623 – DOD establishment of cybersecurity monitoring requirement and DOD access to the data from that monitoring,

§1631 – Mandatory 2-way information sharing about cybersecurity incidents, including incident reporting to DOD and threat analysis sharing from DOD,

§1632 – Require DOD to assess the need for DOD to conduct continuous threat hunting operations on DIB networks,

§1635 – Would amend 10 USC 391(c) to provide authority for armed forces to investigate cyber incident at facilities of ‘operationally critical contractors”, and

§1642 – Would authorize DOD grants to small manufacturers to obtain cybersecurity assistance from centers established under 15 USC 278k(a).

A unifying thread in these five sections is a gradual move from voluntary to mandatory cybersecurity activities in the DIB. A similar move is reflected in §3131 with reference to contractors for the National Nuclear Security Administration (NNSA).

Floor Amendments

The bill was opened for the submission of amendments starting on Wednesday of last week. To date there have been over 500 amendments submitted. Only a small number of these amendments will make their way to the floor of the Senate for actual consideration. Amendments that I will be watching for include (the number in the brackets is the page number in the linked document):

SA 1710. Mr. KING (I,NH) - SEC. XX. Department of Homeland Security Critical Technology Security Centers. [S3233],

SA 1711. Mr. KING - SEC. XX Cybersecurity Reporting Requirements for Publicly Traded Companies [S3233],

SA 1711. Mr. KING - SEC. XX Cyber State of Distress [S3235],

SA 1715. Mr. KING - SEC. XX Bureau of Cyber Statistics [S3236-7],

SA 1719. Mr. KING – SEC. XX Strengthening Processes for Identifying Critical Infrastructure Cybersecurity Intelligence Needs and Priorities [S3239-40],

SA 1723. Mr. KING - SEC. XX Assessing Private-Public Collaboration in Cybersecurity [S3243],

SA 1751. Mr. PETERS (D,MI) - SEC. 1643. Pilot Programs on Remote Provision by National Guard to State Governments and National Guards of Other States of Cybersecurity Technical Assistance in Training, Preparation, and Response to Cyber Incidents [S3258],

SA 1806. Mr. JOHNSON (R,WI) - SEC. XX Countering Unmanned Aircraft Systems Coordinator [S 3329],

SA 1807. Mr. JOHNSON - SEC. XX Subpoena Authority [S 3329-30],

SA 1814. Mr. RUBIO (R,FL) - SEC. XX Secure and Trusted Technology [S 3333-4],

SA 1815. Mr. RUBIO - DIVISION XX Intelligence Authorizations for Fiscal Year 2021 [S 3335-44],

SA 1816. Mr. RUBIO - DIVISION XX Intelligence Authorizations for Fiscal Year 2021 [S 3344-55],

SA 1827. Mr. WARNER (D,VA) - SEC. XX Secure and Trusted Technology [S 3362-4],

SA 1868. Mr. REED (D,NV) - SEC. XX Cybersecurity Transparency [S 3389],

SA 1892. Mr. PORTMAN (R,OH) - SEC. 240. Element in Annual Reports on Cyber Science And Technology Activities on Work with Academic Consortia to Develop a Strategy to Secure Embedded Hardware in Department of Defense Capabilities [S 3399],

SA 1910. Mr. WARNER - SEC. XX Study on Alternatives and Recommendations for Providing a Cyber Protection Program for the Defense Industrial Base [S 3407],

SA 1911. Mr. WARNER - SEC. XX Policies for Cybersecurity and Resilience for Certain Programs Developing Applications Using Artificial Intelligence or Machine Learning [S 3408],

SA 1917. Ms. HASSAN (D,NH) - SEC. ll. Cybersecurity State Coordinator Act [S 3409],

SA 1936. Mr. PETERS - SEC. 590. Pilot Programs on Remote Provision by National Guard to State Governments and National Guards of Other States of Cybersecurity Technical Assistance in Training, Preparation, and Response to Cyber Incidents [S 3415],

SA 2080. Mr. PORTMAN - SEC. 240. Element in Annual Reports on Cyber Science and Technology Activities on Work with Academic Consortia on High Priority Cybersecurity Research Activities in Department of Defense Capabilities [S 3523],

SA 2094. Mrs. FISCHER (R,NE) - SEC. XX Support and Enhancement of Defense Critical Electric Infrastructure [S 3527],

SA 2098. Mr. PERDUE (R,GA) - SEC. XX Cybersecurity Advisory Committee [S 3528],

SA 2104. Ms. HASSAN - SEC. XX National Guard Cyber Support and Cyber Services For Governmental Entities Outside the Department of Defense and Nongovernmental Entities [s 3542],

SA 2135. Mrs. FISCHER - SEC. XX Internet of Things [S 3552],

SA 2178. Mr. WICKER (R,MS) - TITLE XX Cyber Workforce Matters [S 3569-72],

SA 2195. Mr. JOHNSON - SEC. XX Subpoena Authority [S 3584-5],

SA 2209. Mrs. FISCHER - SEC. XX Internet of Things [S 3621],

Since most of these amendments will not make it to floor consideration, I will not take up any more time on the detailed analysis of the listed amendments. Two things I will mention, however. First many of these bills have similar names to bills that have been introduced in the Senate. This is not unusual. The NDAA is a ‘must pass bill’ so the attachment of other legislation to the bill that otherwise would not make it to the floor on its own is a common legislative tactic.

The second item of note is that there are a number of instances where the same person has proposed two (slightly) different versions of the same amendment. Typically, minor revisions have been made to make the amendment more palatable to one or more factions (or even just a single Senator) to make it easier for the bill to make into the limited consideration space.

More amendments will be submitted next week.

Commentary

This is considered to be a ‘must pass’ bill and this is the one ‘must pass’ bill that usually makes it through the legislative process. This is because the leaders of the Armed Services Committee typically do a good job of keeping the most contentious issues out of the bill, but that has been getting more difficult as the political gulf in Washington has been widening. In today’s political environment there is no guarantee that this bill will pass in regular order. Watch for the cloture vote on Monday for indications of how much of a problem this bill will be facing.

In the normal course of events, this bill would be expected to pass by the end of the week. I would not be surprised to see it held over until next week or even later. In the meantime, some amendments will be dealt with and even more will be introduced.

S 1790 Introduced – FY 2020 NDAA

Last week Sen. Inhofe (R,OK) introduced S 1790, the National Defense Authorization Act (NDAA) for Fiscal Year 2020. The bill was reported favorably by the Senate Armed Services Committee which Inhofe chairs. The Senate is scheduled to take up the bill this week. The bill includes an entire sub-title that addresses cyber operations; including one section that addresses the development of a set of cybersecurity standards for the defense industrial base.

Defense Industrial Base Cybersecurity

Section 1634 requires DOD to “develop a consistent, comprehensive framework to enhance cybersecurity for the United States defense industrial base” {§1634(a)}. The framework would be developed by February 1^st, 2020. The framework would include {§1634(b)}:

• Identification of unified cybersecurity standards, regulations, metrics, ratings, third-party certifications, or requirements to be imposed on the defense industrial base for the purpose of assessing the cybersecurity of individual contractors.

• The roles and responsibilities of various activities within the Department of Defense, across the entire acquisition process, beginning with market research, including responsibility determination, solicitation, and award, and continuing with contractor management and oversight on matters relating to cybersecurity.

• The responsibilities of the prime contractors, and all subcontractors in the supply chain, for implementing the required cybersecurity standards, regulations, metrics, ratings, third-party certifications, and requirements identified under paragraph (1).

• A plan to provide implementation guidance, education, manuals, and, as necessary, direct technical support or assistance to such contractors on matters relating to cybersecurity.

• Methods and programs for defining and managing controlled unclassified information, and for limiting the presence of unnecessary sensitive information on contractor networks.

• Quantitative metrics for assessing the effectiveness of the overall framework over time, with respect to the exfiltration of controlled unclassified information from the defense industrial base.

While the language in the bill does not specify whether the cybersecurity concerns cover both the information technology and control system technology used in the industrial base, the Committee Report does address the matter. It notes (pg 306):

“The committee is concerned that contractors within the defense industrial base are an inviting target for our adversaries, who have been conducting cyberattacks to steal critical military technologies.”

Control System Cybersecurity

The Report does address control system cybersecurity research being conducted by DOD. On pages 325-6 the Committee “commends the Department of Defense for its efforts to address the cybersecurity of installation industrial control systems (ICSs).” It goes on to discuss a National Security Agency research program, Integrated Adaptive Cyber Defense (IACD).  It notes that “IACD technologies include sensing and automated orchestration and interoperability among cybersecurity tools and systems to defend both operational technology (such as ICSs) and information technology”. There is additional discussion of this technology under the “Software defined networking and network and cybersecurity orchestration” heading on pages 333-4.

Cybersecurity Research

The Report notes (pgs 97-8) that the Committee is recommending funding Defense-wide cybersecurity research (line item # PE 62668D8Z) at $25.1 million, an increase of $10.0 million above the Administration’s request.

Moving Forward

This bill will start to be considered on the floor of the Senate sometime this week (a number of nominations have to be completed first). Amendments have already started to be proposed to this bill, over 200 were submitted on Thursday alone. How many of those (and yet to be submitted) amendments will make it to the floor of the Senate remains to be seen.

DOD Publishes Final Rule on DIB Cybersecurity Information Sharing

While Congress is unable or unwilling to move forward on cybersecurity information sharing legislation, the Department of Defense published their final rule on cybersecurity information sharing with its Defense Industrial Base (DIB) partners in today’s Federal Register (78 FR 62430-62438). I discussed many of the details of this rule last year when DOD published their interim final rule on the topic.

Public Comments and DOD Responses

With the numerous controversies surrounding this topic (controversies that are responsible in large part for the congressional paralysis on the issue) it is not unexpected that the DOD received a large number of comments. The bulk of the preamble to this final rule deals with identifying and responding to the issues raised. In all but two cases the DOD response boiled down to: “No change is made to the rule”.

The first comment eliciting a change in the rule dealt with the definition of a “US Citizen” in the rule and the DOD clarified that issue by removing the phrase ‘holding a U.S. passport’ as part of the definition of ‘U.S. citizen’ in §236.2(o).

The second comment dealt with a requirement in the program to conduct a legal review of the implementation of the program and the language in §236.6 that appeared to require a violation of attorney-client privilege. DOD responded by removing the second sentence in §236.6(c), noting that that sentence “was not intended to imply that there was a requirement to provide such information as a condition of the program”.

Effective Date

This program is currently running under the interim final rule. The limited changes made in this final rule become effective on November 21^st, 2013.

DOD Sends Cybersecurity Assurance Rule to OMB

Yesterday the Office of Management and Budget (OMB) announced that the Department of Defense submitted their final rule for the Defense Industrial Base (DIB) Cyber Security/Information Assurance (CS/IA) Activities. The interim final rule on this program was published last year and apparently DOD takes seriously their responsibility for actually finishing the rule making process.

Last year I described the proposed program this way:

This program is based upon the realization that both sides have unique sorts of cybersecurity information that will have value for the other side if the information were to be shared. Because of its extensive intelligence collection and analysis capabilities DOD is likely to have information about cybersecurity threats (capabilities, techniques, intentions and other actual attacks) that could be used by DIB entities to protect their cybersecurity systems. DIB entities would have details about intrusions and attempted intrusions on their systems (attack vectors, methodologies, information targeted and information compromised) that DOD could use to assess the extent that DOD unclassified information has been compromised and to extend the analysis of cybersecurity threats to DOD/DIB systems.

Of course, the same could be said about DHS and critical infrastructure organizations. Maybe this will be one of the things that comes out of the development of the Cybersecurity Framework.

There are no details available on how the submitted final rule will change the interim rule. We will just have to wait and see. It could take months for OMB to approve this for publication.