S 3033 Introduced – Education Cybersecurity

Last week Sen Peters (D,MI) introduced S 3033, the K–12 Cybersecurity Act of 2019. The bill would require the Cybersecurity and Infrastructure Security Agency (CISA) to establish a K–12 education cybersecurity initiative with the goal of providing “K–12 educational institutions with resources to aid cybersecurity efforts will help K–12 educational institutions prevent, detect, and respond to cyber events” {§2(3)}.

Definitions

Section 3(a) of the bill provides the key definitions used in the bill. Two cybersecurity terms are defined by reference to existing definitions in the US Code:

• ‘Cybersecurity risk’ – 6 USC 659(a)(1); and

• ‘Information system’ – 44 USC 3502(8)

CISA Study

Section 3(b) would require CISA to conduct a study “on the cybersecurity risks facing K–12 educational institutions, including the challenges K–12 educational institutions face” {§3(b)(1)} in securing”

• Information systems owned, leased, or relied upon by K–12 educational institutions; and

• Sensitive student and employee records.

CISA would provide Congress with a report on the results of the study. Separately, CISA would develop recommendations for voluntary cybersecurity guidelines to assist K-12 educational institutions face the cybersecurity risks identified in the study. CISA would also be required to develop an online training toolkit to{§3(d)}:

• Educate the officials about the cybersecurity recommendations developed under subsection (c)(1); and

• Provide strategies for the officials to implement the recommendations developed.

Moving Forward

Both Peters and his cosponsor {Sen Scott (R,FL)} are members of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This means that they probably have sufficient influence to see this bill considered in Committee in the coming year. There is nothing in this bill that would engender any significant opposition in either the Committee or before the full Senate.

If this bill is favorably reported out of Committee, the bill would likely be considered under the Senate’s unanimous consent process without debate or vote. The bill would not be ‘important’ enough to take up under the Senate’s regular order. The bill could also be included in a CISA authorization bill; one of the perks that comes from being an ‘agency’.

Commentary

The cybersecurity definitions in this bill, and the wording of the bill in general, make it clear that the crafters of the bill were only considering vulnerabilities in the IT portions of school computer systems. While these parts of the system are arguably the ‘most important’ for the purposes of accomplishing what schools are designed to do, they are not the only computer systems in place. Schools also have building services, security systems and fire systems that are becoming more and more computerized. Those computerized systems are also becoming more connected to outside systems and entities, while at the same time becoming more intertwined with the school’s IT systems. It is becoming increasingly possible to use these OT systems as a backdoor into the more conventional IT systems. CISA should not ignore this.

More importantly, congressional staffers need to become more cognizant of the increasing interconnectedness of IT and OT systems and ensuring that their legislative language takes these inter-system vulnerabilities into account. Again, I would like to refer readers and legislators to the blog post I made earlier this year about the importance of including appropriate OT/ICS definitions in cybersecurity legislation. I included specific recommended changes to the currently IT-restrictive cybersecurity definitions in §659(a).

Bills Introduced – 12-12-19

Yesterday with both the House and Senate in session there were 55 bills introduced. Of those three may receive additional coverage in this blog:

S 3033 A bill to establish a K-12 education cybersecurity initiative, and for other purposes. Sen. Peters, Gary C. [D-MI]

S 3040 A bill to amend the Higher Education Act of 1965 to include teacher preparation for computer science in elementary and secondary education. Sen. Rosen, Jacky [D-NV] 

S 3045 A bill to amend the Homeland Security Act of 2002 to protect United States critical infrastructure by ensuring that the Cybersecurity and Infrastructure Security Agency has the legal tools it needs to notify private and public sector entities put at risk by cybersecurity vulnerabilities in the networks and systems that control critical assets of the United States. Sen. Johnson, Ron [R-WI]

Cybersecurity Education

Actually, I doubt that S 3033 and S 3040 will contain language specifically including control system security processes in the required curriculum. That would normally mean that I would not cover these bills here. So I will take this opportunity to get a screed about K-12 education out of my system.

Students are in the K-12 education environment for 13 years for something like 9 months out of the year. A typical school day (minus extracurricular activities) last six to eight hours. In that brief time students are exposed to the basic knowledge necessary for participation in our society. Back in the dark ages when I went to school that consisted of reading, writing, arithmetic, foreign language, history and the arts with a smattering of physical education. Each year the components of those basics became more complex, building on the previous knowledge gained. And the school day was rather full.

Whenever we add new curriculum to that base, decisions have to be made about where the time for teaching the new material will be added. We could increase the number of hours at school, but that would cut into extracurricular activities and besides students can only be expected to take so much time sitting around learning. The alternative it to reduce the time it takes to teach the other subjects or to remove some of those subjects.

It would seem to me that anytime we legislatively attempt to expand the required knowledge base we must also determine where the time will come from to add that instruction. Unfortunately, congresscritters are notorious for adding program requirements without adding resources to effect those requirements. Just let the affected managers make the hard decisions. That way the complaints will be focused on them not congresscritters.

CISA Subpoenas

S 3045 has been in the works for a while now. I have not yet seen the bill, but press accounts (see here for instance) make this seem like a good idea. It would apparently give CISA that power to issue subpoenas to Telecoms to require them to provide contact information for internet addresses where CISA has identified a critical infrastructure vulnerability. That would allow CISA to contact the vulnerable party and work with them to mitigate the vulnerability. Motherhood and Apple Pie, who can object to that? Of course, the devil is in the details.