[House Hearing, 115 Congress]
[From the U.S. Government Publishing Office]
CHALLENGES OF RECRUITING AND RETAINING A CYBERSECURITY WORK FORCE
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
CYBERSECURITY AND
INFRASTRUCTURE PROTECTION
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED FIFTEENTH CONGRESS
FIRST SESSION
__________
SEPTEMBER 7, 2017
__________
Serial No. 115-26
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.govinfo.gov
__________
U.S. GOVERNMENT PUBLISHING OFFICE
28-415 PDF WASHINGTON : 2018
____________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Publishing Office,
Internet:bookstore.gpo.gov. Phone:toll free (866)512-1800;DC area (202)512-1800
Fax:(202) 512-2104 Mail:Stop IDCC,Washington,DC 20402-001
COMMITTEE ON HOMELAND SECURITY
Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas Bennie G. Thompson, Mississippi
Peter T. King, New York Sheila Jackson Lee, Texas
Mike Rogers, Alabama James R. Langevin, Rhode Island
Jeff Duncan, South Carolina Cedric L. Richmond, Louisiana
Lou Barletta, Pennsylvania William R. Keating, Massachusetts
Scott Perry, Pennsylvania Donald M. Payne, Jr., New Jersey
John Katko, New York Filemon Vela, Texas
Will Hurd, Texas Bonnie Watson Coleman, New Jersey
Martha McSally, Arizona Kathleen M. Rice, New York
John Ratcliffe, Texas J. Luis Correa, California
Daniel M. Donovan, Jr., New York Val Butler Demings, Florida
Mike Gallagher, Wisconsin Nanette Diaz Barragan, California
Clay Higgins, Louisiana
John H. Rutherford, Florida
Thomas A. Garrett, Jr., Virginia
Brian K. Fitzpatrick, Pennsylvania
Ron Estes, Kansas
Brendan P. Shields, Staff Director
Steven S. Giaier, Deputy Chief Counsel
Michael S. Twinchek, Chief Clerk
Hope Goins, Minority Staff Director
------
SUBCOMMITTEE ON CYBERSECURITY AND INFRASTRUCTURE PROTECTION
John Ratcliffe, Texas, Chairman
John Katko, New York Cedric L. Richmond, Louisiana
Daniel M. Donovan, Jr., New York Sheila Jackson Lee, Texas
Mike Gallagher, Wisconsin James R. Langevin, Rhode Island
Thomas A. Garrett, Jr., Virginia Val Butler Demings, Florida
Brian K. Fitzpatrick, Pennsylvania Bennie G. Thompson, Mississippi
Michael T. McCaul, Texas (ex (ex officio)
officio)
Kristen M. Duncan, Subcommittee Staff Director
C O N T E N T S
----------
Page
Statements
The Honorable John Ratcliffe, a Representative in Congress From
the State of Texas, and Chairman, Subcommittee on Cybersecurity
and Infrastructure Protection:
Oral Statement................................................. 1
Prepared Statement............................................. 3
The Honorable Cedric L. Richmond, a Representative in Congress
From the State of Louisiana, and Ranking Member, Subcommittee
on Cybersecurity and Infrastructure Protection:
Oral Statement................................................. 4
Prepared Statement............................................. 7
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Security:
Prepared Statement............................................. 8
Witnesses
Dr. Frederick R. Chang, Executive Director, Darwin Deason
Institute for Cyber Security, Southern Methodist University:
Oral Statement................................................. 9
Prepared Statement............................................. 10
Mr. Scott Montgomery, Vice President and Chief Technical
Strategist, McAfee:
Oral Statement................................................. 15
Prepared Statement............................................. 17
Dr. Michael Papay, Vice President and Chief Information Security
Officer, Northrup Grumman:
Oral Statement................................................. 22
Prepared Statement............................................. 24
Ms. Juliet ``Jules'' Okafor, Strategic Advisory Board Member,
International Consortium of Minority Cybersecurity
Professionals:
Oral Statement................................................. 27
Prepared Statement............................................. 28
For the Record
The Honorable James R. Langevin, a Representative in Congress
From the State of Rhode Island:
Statement of Wesley Simpson, CISSP and Chief Operating Officer,
(ISC)\2\..................................................... 5
Letter From Hon. James R. Langevin............................. 35
Appendix
Questions From Chairman John Ratcliffe for Frederick R. Chang.... 47
Question From Chairman John Ratcliffe for Scott Montgomery....... 49
Questions From Chairman John Ratcliffe for Michael Papay......... 49
CHALLENGES OF RECRUITING AND RETAINING A CYBERSECURITY WORK FORCE
----------
Thursday, September 7, 2017
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Cybersecurity and
Infrastructure Protection,
Washington, DC.
The subcommittee met, pursuant to notice, at 3:14 p.m., in
room HVC-210, Capitol Visitor Center, Hon. John Ratcliffe
(Chairman of the subcommittee) presiding.
Present: Representatives Ratcliffe, Fitzpatrick, Katko,
Richmond, Demings, and Langevin.
Also present: Representative Barragan.
Mr. Ratcliffe. The Committee on Homeland Security
Subcommittee on Cybersecurity and Infrastructure Protection
will come to order.
The subcommittee is meeting today to receive testimony
regarding the challenges of recruiting and retaining a
cybersecurity work force.
I now recognize myself for an opening statement.
Good afternoon. I would like to begin by thanking our panel
for taking the time today to be here to testify. I appreciate
your patience as we just finished up a vote series. I am glad
that you waited for us. Your thoughts and your opinions are
very important to us and will help inform us as we oversee the
Department of Homeland Security in meeting its cybersecurity
work force challenges.
Cybersecurity is one of the most daunting National security
and economic security challenges of our generation. As our
adversaries grow in sophistication, so, too, will the
challenges associated with preventing their attacks.
My colleagues on this committee have heard me say this
often, but I will say it again. America will remain the world
superpower only so long as it remains the world cybersecurity
superpower.
As the lead civilian agency for our Federal cybersecurity
posture, the Department of Homeland Security factors as a
critical piece of this equation. It is a tremendous privilege
to chair this subcommittee and I look forward to our continued
partnership with the private sector and the administration on
these important cybersecurity issues, because inaction is
simply not an option.
In 2014, it was estimated that $1 billion of personally
identifiable information was stolen from cyber attacks. It is
also estimated that the average cost of a data breach will be
$150 million by 2020. Cyber attacks are growing in frequency
and they are growing in their sophistication, but the
availability of qualified cybersecurity professionals to deal
with these challenges is unfortunately not keeping pace.
There have been several studies over the past few years
documenting the growing shortage of cybersecurity
professionals. In this ever-increasingly connected world, the
problem is only going to get worse. One estimate from the
consulting firm of Frost & Sullivan is forecasting a shortage
of a staggering 1.8 million cybersecurity workers world-wide by
2022, just 5 years from now.
Some industry estimates are that 53 percent of
organizations now experience delays of 6 months or longer to
find qualified cybersecurity candidates. We know that the
entire industry is facing an unprecedented shortage of
cybersecurity workers at all levels of competency, from front-
line defenders to CIOs.
It is against this backdrop that the Department of Homeland
Security must compete with the private sector to recruit and
retain the best talent possible in order to carry out its
cybersecurity mission and to protect our critical
infrastructure. Unfortunately, DHS's issues are compounded by
the additional hiring challenges often felt by the Federal
Government.
DHS must work to overcome slow hiring processes and work
force supply and pipeline issues in order to build the
essential work force required to meet its cyber mission. DHS
must strategically plan for the training, recruitment, and the
retention of its cybersecurity work force.
The Homeland Security Committee passed several pieces of
legislation that were signed into law to augment the
cybersecurity work force at DHS, including the Border Patrol
Agent Pay Reform Act of 2014 that expanded DHS's hiring
authorities allowing the Department to better recruit and hire
qualified cyber professionals. Unfortunately, these new
authorities have not yet been fully implemented.
This is an area where hearing from the experts before us
today will provide valuable input as we conduct oversight of
DHS's responsibilities and ensure that DHS has the human
capital and resources necessary to carry out its important
cybersecurity mission.
The Federal Government supports a number of programs to
recruit and retain its work force. In particular, the
CyberCorps Scholarship for Service Program was authorized in
the National Cybersecurity Enhancement Act of 2014 and focuses
on recruiting and training the next generation of information
technology professionals, industry control system security
professionals, and security managers.
Working with DHS, the National Science Foundation has
awarded grants for the CyberCorps Scholarship for Service
Program since 2011 to increase and strengthen Federal, State,
local, Tribal, and territorial governments' cyber work force.
As of January 2017, there were 69 active Scholarship for
Service institutions, including eight in my home State of
Texas. CyberCorps has provided scholarships to 2,945 recipients
with 2,223 graduates serving Federal, State, local, Tribal, and
territorial governments and 623 students are currently working
toward that goal.
The recent interest my office has received from both 2- and
4-year colleges in my district about participating in the
CyberCorps program is encouraging. It reinforces that
stakeholders of all sizes, from all corners of the country want
to be part of the cybersecurity work force solution.
I look forward to a robust conversation with our
distinguished panel of witnesses today that will support our
efforts in strengthening DHS's effort to recruit and retain
talented cybersecurity professionals.
The Chair now recognizes the Ranking Minority Member of the
subcommittee, the gentleman from Louisiana, Mr. Richmond.
[The statement of Mr. Ratcliffe follows:]
Statement of Chairman John Ratcliffe
September 7, 2017
Good afternoon.
I would like begin by thanking our panel for taking the time today
to testify. Your thoughts and opinions are very important as we oversee
the Department of Homeland Security in meeting its cybersecurity work
force challenges.
Cybersecurity is one of the most daunting challenges of our
generation, and as our adversaries grow in sophistication, so will the
challenges associated with preventing their attacks. My colleagues on
this committee have heard me say this often, but I'll say it again--
America will only remain the world's superpower so long as it remains
the world's cybersecurity superpower.
As the lead civilian agency for our Federal cybersecurity posture,
DHS factors as a critical piece of this equation. It is a great
privilege to chair this subcommittee, and I look forward to our
continued partnership with the private sector and the administration on
these important cybersecurity issues.
Because inaction is simply not an option.
According to the Cisco 2017 Annual Cybersecurity Report, ransomware
is growing at a yearly rate of 350 percent and the firm Cybersecurity
Ventures predicts cyber crime will cost the world in excess of $6
trillion annually by 2021, making it more profitable than the global
trade of all major illegal drugs combined. It is also estimated that
the average cost of a data breach will be $150 million by 2020. Cyber
attacks are growing in frequency and sophistication, but the
availability of qualified cybersecurity professionals to deal with
these challenges is not keeping pace.
There have been several studies over the past few years documenting
the growing shortage of cybersecurity professionals. In this ever-
increasing connected world, the problem is only going to get worse.
Today, one estimate, from the consulting firm Frost & Sullivan, is
forecasting a shortage of a staggering 1.8 million cybersecurity
workers world-wide by 2022. One industry organization estimates that 53
percent of organizations experience delays of 6 months or longer to
find qualified cybersecurity candidates.
We know that the entire industry is facing an unprecedented
shortage of cybersecurity workers at all levels of competency--from
front-line defenders to CIOs. Against this backdrop, the Department of
Homeland Security must compete with the private sector to recruit and
retain the best talent possible in order to carry out its cybersecurity
mission and protect our critical infrastructure.
Unfortunately, DHS's issues are compounded by additional hiring
challenges often felt by the Federal Government. DHS must work to
overcome slow hiring processes and work force supply and pipeline
issues in order to build the essential work force required to meet its
cyber mission. DHS must strategically plan for the training,
recruitment, and retention of its cybersecurity work force.
The Homeland Security Committee passed several pieces of
legislation that were signed into law to augment the cybersecurity work
force at DHS, including the Border Patrol Agent Pay Reform Act of 2014
that expanded DHS's hiring authorities, allowing the Department to
better recruit and hire qualified cyber professionals. Unfortunately,
these new authorities have not yet been fully implemented. This is an
area where hearing from the experts before us today will provide
valuable input as we conduct oversight of DHS's responsibilities and
ensure that DHS has the human capital and resources necessary to carry
out its important cybersecurity mission.
The Federal Government supports a number of programs to recruit and
retain its work force. In particular, the CyberCorps: Scholarship-For-
Service Program was authorized in the National Cybersecurity
Enhancement Act of 2014 and focuses on recruiting and training the next
generation of information technology professionals, industrial control
system security professionals, and security managers.
Working with DHS, the National Science Foundation has awarded
grants for the CyberCorps: Scholarship-For-Service program since 2011
to increase and strengthen Federal, State, local, Tribal, and
territorial governments' cyber work force. As of January 2017, there
were 69 active Scholarship for Service institutions, including 8 in my
home State of Texas. CyberCorps has provided scholarships to 2,945
recipients, with 2,223 graduates serving Federal, State, local, Tribal,
and territorial governments and 623 students currently working toward
that goal.
The recent interest my office has received from 2- and 4-year
colleges in my district about participating in the CyberCorps program
is encouraging. It reinforces that stakeholders of all sizes from all
corners of the country want to be part of the cybersecurity work force
solution.
I look forward to a robust conversation with our distinguished
panel of witnesses that will support our efforts in strengthening DHS's
efforts to recruit and retain talented cybersecurity professionals.
Mr. Richmond. Let me first thank the Chairman for holding
this hearing because our Nation faces an evolving array of
cyber threats and it is crucial that we have a robust, talented
cybersecurity work force.
For some time now, experts have predicted that the demand
for cybersecurity professionals was quickly outpacing our
supply. In 2012, the Bureau of Labor Statistics projected that
by 2020 there would be 400,000 computer scientists available to
fill 1.4 million computer science jobs. Recent estimates
suggest that the deficit is growing instead of shrinking and
may reach 1.8 million by 2022.
Let's be clear: This is nothing short of a threat to our
National security.
These are the professionals we rely on to help us prepare
for and respond to the next WannaCry, Mirai, or Fancy Bear.
These are the people who will prevent State-sponsored hackers
from taking down our electrical grid or infiltrating our State
election systems. These are the experts we need to stand on the
front lines during a major cyber attack and make sure we have
functioning hospitals, banks, transportation systems, and lines
of communication.
We need cybersecurity professionals in the private sector
protecting our intellectual property and personal data, and we
need them in the public sector protecting our Nation's most
sensitive intelligence. Yet we know that the Federal Government
and DHS in particular is struggling to compete with the private
sector for cyber talent.
What is more, this administration has failed to fill even
the most critical, senior-level, cybersecurity posts, asking
agencies like DHS's National Programs and Protections
Directorate to carry out broad, complex cybersecurity missions
without a permanent under secretary. This lack of leadership
makes us vulnerable.
We should be doing everything we can to right-size our
cybersecurity labor force. There is a lot more we can do. We
need to introduce students to computers before they get to
college, even the ones who go to schools that can't afford
expensive tech programs and specialized instructors. I also
believe there is untapped potential in vocational schools, 2-
year programs, minority-serving institutions, and our
historically black colleges and universities.
Once we have figured out how to get more people to choose
cybersecurity as a career, we need to convince them to turn
down a higher-paying job and spend some time in Federal
service.
Within the Federal Government, we need to promote
recruitment and retention programs, particularly at DHS which
has lagged behind other cyber-focused Federal agencies like the
NSA or FBI in attracting cyber talent. For its part, DHS needs
to be more forward-thinking and learn to anticipate the needs
of an evolving work force that values professional development,
a flexible work culture, the ability to transition in and out
of positions or even fields.
In closing, there is no question that the cyber work force
challenge is a daunting one, but the stakes are too high for us
to ignore it. Last year, the global economy lost over $450
billion to cyber criminals and over 2 billion personal records
were stolen in the United States alone. Meanwhile, studies show
that less than half of United States' businesses would say that
they are prepared for a cyber attack, and that small Main
Street businesses are struggling the most.
I look forward to hearing the testimony of our witnesses
today and hope we can identify innovative ways to work together
to address cybersecurity work force challenges.
Mr. Chairman, before I yield back, I would like to submit
for the record from Wesley Simpson, chief operating officer of
(ISC)\2\, along with the 2017 Global Information Security
Workforce Study: Women in Cybersecurity; and the report the
2017 Global Information Security Workforce Study: U.S. Federal
Government Results.
Mr. Ratcliffe. Without objection.
[The information referred to follows:]
Statement of Wesley Simpson, CISSP and Chief Operating Officer,
(ISC)\2\
September 7, 2017
Chairman Ratcliffe, Ranking Member Richmond, Members of the
subcommittee, thank you for the opportunity to provide written
testimony for today's hearing titled Challenges of Recruiting and
Retaining a Cyber Workforce. This hearing is an important one as it
highlights a critical work force and ultimately a critical National
security challenge that we face: Ensuring that we are training enough
cybersecurity professionals to address the current and projected work
force shortage in the public and private sector.
My name is Wesley Simpson and I am the chief operating officer of
the International Information System Security Certification Consortium,
commonly known as (ISC)\2\, the world's leading cybersecurity and IT
security professional organization. We are an international, non-profit
membership association for information security leaders. We have
125,000 members world-wide and continue to grow just as the cyber work
force needs grow.
In addition to the training and certification work that we do,
including the internationally recognized CISSP certification, we are
also committed to education of the general public through our support
for the Center for Cyber Safety and Education. We believe it is crucial
not only to close the current gap in cybersecurity professionals, but
we must also do so in a diverse way bringing more women and minorities
into the field of cybersecurity. Information on our work with the
Center for Cyber Safety and Education can be found at
www.iamcybersafe.org.
Earlier this year, (ISC)\2\ in partnership with the Center for
Cyber Safety and Education, Booz Allen, Frost & Sullivan and Alta
Associates released the 2017 Global Information Security Workforce
Study. This is the 8th biennial release of the study and the largest to
date. We surveyed 19,641 cyber professionals representing 170
countries. This included 2,620 professionals from the U.S. Federal
Government.
According to our survey we are on pace to reach a cyber work force
gap of 1.8 million jobs by 2022--a stunning 20% increase from our
forecast made in 2015. As part of our study, we also segmented out the
data for certain demographic groups and I will provide information
around the Government work force, and women in the cyber work force
later in my remarks.
Globally, our survey found that 66% of information security workers
said their staffs are short-handed--too few professionals to address
the threats they encountered. That's an increase of 4 percent from the
2015 survey. This number jumps to 68% when you consider only
respondents from North America.
Workers cite a number of reasons for the current shortage. These
include: Qualified personnel are difficult to find; work force
requirements are not understood by leadership; business conditions
can't support hiring additional personnel; security workers are
difficult to retain; and a belief that there is no clear information
security career path.
On the positive side, 70% of hiring managers surveyed are looking
to increase their work force. In fact, 30% are planning to increase
that work force by 20% or more. This is most evident in the fields of
health care, retail, and manufacturing. So the job opportunities are
there. In addition, fully 87% of cyber professionals started out in a
different career. While most came from IT, a number come from other
career fields. For North America, about 35% started in a different
field. This indicates that training, retraining programs, and
certification programs are working and are necessary to help close the
current work force gap.
Let me now turn to some of the segments that we examined within the
larger data set, starting with the Federal Government. Overall there is
some good news in the Government data. Half of the respondents feel
that Government security has improved. This is due to improved security
awareness, improved understanding of risk management and effective
security standards. Some 36% believe that it the level of Government
security has stayed the same, and 4% believe that Government security
has gotten worse. Of those that felt the situation has gotten worse,
they cited the need for more qualified professionals, adequate funding,
and better security standards. In addition, respondents felt that the
most important factor in securing an organization's infrastructure is
the hiring and retaining of qualified information security
professionals.
We also asked about the key factors in retaining Government
information security professionals. Interestingly, the top two
responses were not directly related to compensation, but rather focused
on training and certification. Respondents wanted the Government to
offer training programs and to pay for cyber certifications. This was
followed by improving compensation packages, flexible work schedules,
and supporting remote/flexible working. So you can see that while
compensation is important, other factors rise to the top in terms of
retaining talent in the Government work force. When looking at
incentives for new hires, we see a similar trend, with certification,
training, and education reimbursement as the most effective recruitment
tool followed by flexible work schedule.
Let me close on this segment by providing three additional findings
that are relevant to the question of attracting and retaining cyber
professionals. First, 78% of respondents felt that greatest demand for
new hires is in nonmanagerial staff. Second, the respondents felt that
the most significant impact of the current work force shortage is on
the existing information security work force. Finally, the greatest
area of need for additional training and certification is in cloud
computing. We need to fill that gap as soon as possible to ensure that
we don't face burnout and departure from the current work force. And we
need to get training programs in place in key priority areas like cloud
security.
Let me now turn to women in the cyber work force. As stated
earlier, we strongly support bringing more gender and ethnic diversity
into the cyber work force. It is a key to helping close the growing gap
that we face in both the public and private sectors here in the United
States. For this particular segment we partnered with the Executive
Women's Forum on Information Security, Risk Management, and Privacy. As
the overall report shows, the work force gap continues to rise.
Globally, the number of women professionals in the field remains
stagnant at 11% (14% for North America). While this is extremely low,
it is higher than in Europe or Asia, both of which are in single
digits. The report also shows that women continue to lag behind when it
comes to pay equity, despite higher levels of education. The report
found that more than half of women respondents have faced
discrimination in the workplace. Globally, men are four times more
likely to attain C-level and Executive-level positions and nine times
more likely to hold managerial positions in the cybersecurity field. On
the positive side, women do feel more valued when participating in
mentorship, sponsorship, and leadership development programs.
We believe that focusing on fixing the above-mentioned areas--pay
inequity, creating a more inclusive workplace, valuing education, and
providing mentorship and development opportunities for women to
advance--can move the needle in the right direction and help bring more
women into the cyber work force.
In conclusion, demand for cyber workers continues to grow.
Unfortunately, the current work force gap is also growing. We must work
together--Government, training and certification organizations,
educational institutions and the private sector--to help close that
gap.
Cybersecurity is a critical component of our National security. And
the key factor to ensuring a more secure IT infrastructure is a skilled
and trained cyber work force. As I highlighted in the data from the
2017 Global Information Security Workforce Study, we have many
challenges ahead of us. However, this study also points us to solutions
such as training and certification, bringing diversity into the work
force and through leadership development and mentorship, and finally
through incentives and pay equity.
I would like to request that the Global Information Security
Workforce Study and the accompanying segments on Government and women
be included in the record. Again, on behalf of (ISC)\2\ and its 125,000
members, I thank you for the opportunity to provide our input. Thank
you again for your focus on the cyber work force. We look forward to
continuing to be a resource to the committee and to working with the
subcommittee on this critical National security issue.
Mr. Richmond. I would also ask unanimous consent that Ms.
Barragan be allowed to participate in today's hearing.
Mr. Ratcliffe. Welcome.
Mr. Richmond. Thank you, Mr. Chairman. I yield back.
[The statement of Mr. Richmond follows:]
Statement of Ranking Member Cedric L. Richmond
September 7, 2017
For some time now, experts have predicted that the demand for
cybersecurity professionals was quickly outpacing supply. In 2012, the
Bureau of Labor Statistics projected that by 2020, there would be
400,000 computer scientists available to fill 1.4 million computer
science jobs. Recent estimates suggest the deficit is growing instead
of shrinking, and may reach 1.8 million by 2022.
Let's be clear--this is nothing short of a threat to National
security. These are the professionals we rely on to help us prepare for
and respond to the next WannaCry, Marai, or Fancy Bear. These are the
people who will prevent state-sponsored hackers from taking down our
electrical grid or infiltrating our State election systems.
And these are the experts we need to stand on the front lines
during a major cyber attack and make sure we have functioning
hospitals, banks, transportation systems, and lines of communication.
We need cybersecurity professionals in the private sector
protecting our intellectual property and personal data, and we need
them in the public sector protecting our Nation's most sensitive
intelligence. Yet, we know that the Federal Government--and DHS in
particular--is struggling to compete with the private sector for cyber
talent.
What's more, this administration has failed to fill even the most
critical, senior-level cybersecurity posts--asking agencies like DHS's
National Programs and Protection Directorate to carry out broad,
complex cybersecurity missions without a permanent under secretary.
This lack of leadership makes us vulnerable. We should be doing
everything we can to ``right-size'' our cybersecurity labor force--and
there's a lot more we can do.
We need to introduce students to computers before they get to
college--even the ones who go to schools that can't afford expensive
tech programs and specialist instructors. I also believe there may be
untapped potential in vocational schools, 2-year programs, and
minority-serving institutions.
And once we've figured out how to get more people to choose
cybersecurity as a career, we need to convince them to turn down a
higher-paying job and spend some time in Federal service. Within the
Federal Government, we need to promote recruitment and retention
programs, particularly at DHS, which has lagged behind other cyber-
focused Federal agencies like the NSA or FBI in attracting cyber
talent.
For its part, DHS needs to be more forward-thinking and learn to
anticipate the needs of an evolving work force that values professional
development, a flexible work culture, and the ability to transition in
and out of positions or even fields.
In closing, there is no question that the cyber work force
challenge is a daunting one--but the stakes are too high to ignore it.
Last year, the global economy lost over $450 billion to cyber
criminals--and over 2 billion personal records were stolen in the
United States alone. Meanwhile, studies show that less than half of
U.S. businesses would say they are prepared for a cyber attack, and
small ``Main Street'' businesses are struggling the most.
I look forward to hearing the testimony of our witnesses today, and
hope we can identify innovative ways to work together to address
cybersecurity work force challenges.
Mr. Ratcliffe. Other Members of the committee are reminded
that opening statements may be submitted for the record.
[The statement of Ranking Member Thompson follows:]
Statement of Ranking Member Bennie G. Thompson
September 7, 2017
Good afternoon. I would like to thank Chairman Ratcliffe and
Ranking Member Richmond for holding today's hearing to continue the
work of identifying solutions to an on-going National challenge: The
cyber work force shortage.
I want to take this opportunity to express my growing concern about
the number of cybersecurity leadership vacancies across the Federal
Government.
There are numerous vacancies in cybersecurity positions across the
Executive Branch, and last month, 8 of the 28 members of the National
Infrastructure Advisory Council resigned in protest of the President's
failure to prioritize cybersecurity.
Most dramatically, this administration has chased out the State
Department's first cybersecurity coordinator and plans to bury the
State Department's cyber office in the Office of Bureau of Economic and
Business Affairs.
And as we speak, there has been no nomination of someone to serve
as the under secretary of the Department of Homeland Security's
National Protection and Programs Directorate, which is tasked with
leading the Federal Government's efforts to secure our Nation's
critical infrastructure and protect Federal civilian networks from
malicious cyber activity.
A strong cybersecurity posture is essential to National security
and to our ability to compete in the global economy.
Policies necessary to build a strong cybersecurity posture require
strong leadership.
I urge the President to quickly address cybersecurity leadership
vacancies and organizational issues.
Turning to the issue at hand, I am eager to learn about innovative
private-sector approaches to developing and maintaining the
cybersecurity work force challenges.
I also hope to hear where the Federal Government can better partner
with the private sector to cultivate the cybersecurity talent.
When I am in Mississippi, all too often, I get asked why so much
focus is placed on importing cybersecurity talent from overseas instead
of cultivating the talent we have here at home.
I support tech-visas, but at the same time agree with my
constituents that we must more aggressively build and recruit a
domestic cybersecurity work force.
We also must also do more to develop cybersecurity skills in
overlooked talent pools.
Today, African Americans and Hispanics--combined--make up only 12
percent of the cybersecurity work force.
We need to do a better job understanding why that is.
We can and should continue expanding traditional career pathways to
diverse populations--from building relationships between public and
private-sector employers and diverse institutions of higher educations
and implementing mentorship programs.
But we also have to start thinking ``outside the box''.
We need to get young people from all backgrounds interested in
cybersecurity early and we need to figure out how to transition
displaced employees into the cybersecurity work force.
According to Juniper Research, the cost of data breaches globally
will increase to $2.1 trillion dollars by 2019.
And the State actors have demonstrated a clear interest in hacking
into our critical infrastructure--from dams and the utility companies--
to our elections.
We must build the cyber work force necessary to protect our
National security and our economy.
Mr. Ratcliffe. As I mentioned before, we are very pleased
to have this distinguished panel of witnesses before us today
on this vitally important topic. Dr. Frederick Chang is the
executive director of the Darwin Deason Institute for Cyber
Security at Southern Methodist University.
Dr. Chang, it is great to see you again and have a fellow
Texan here today. Welcome.
Mr. Chang. Thank you.
Mr. Ratcliffe. Mr. Scott Montgomery is the vice president
and chief technical strategist of McAfee.
We welcome you back to the subcommittee as well.
Dr. Michael Papay is the vice president and chief
information security officer of Northrop Grumman.
Dr. Papay, it is always good to see you and thank you for
being here today.
Finally, Ms. Juliet Okafor is the vice president of global
business development of Fortress Information Security.
Ms. Okafor, welcome back to the subcommittee as well to
you.
I would now ask all of the witnesses to stand and raise
your right hand so I can swear you in to testify.
[Witnesses sworn.]
Please let the record reflect that each of the witnesses
has been so sworn. You all may be seated.
The witnesses' full written statements will appear in the
record. The Chair is now pleased to recognize Dr. Chang for 5
minutes for his opening remarks.
STATEMENT OF FREDERICK R. CHANG, EXECUTIVE DIRECTOR, DARWIN
DEASON INSTITUTE FOR CYBER SECURITY, SOUTHERN METHODIST
UNIVERSITY
Mr. Chang. Thank you. Chairman Ratcliffe, Ranking Member
Richmond, Members of the subcommittee, thank you for the
opportunity to appear before you today regarding the challenges
associated with recruiting and retaining and cybersecurity work
force.
My name is Frederick R. Chang and I am the executive
director of the Darwin Deason Institute for Cyber Security at
Southern Methodist University in Dallas, Texas. I am also the
Bobby B. Lyle Centennial Distinguished Chair in Cybersecurity
and professor in the Department of Computer Science and
Engineering.
I don't need to reiterate to this group the nature of
today's cyber threats and their consequences, so I will simply
say that today's cyber insecurity is a multifaceted topic
involving technology, policy, work force, and more. In my brief
comments now, I will focus on the topic of work force.
One of the reasons why cyber compromises are so prevalent
today is that there is a lack of trained and qualified
personnel to defend the Nation's cyber assets. This lack of a
trained cybersecurity work force has been referred to as the
cyber skills gap. The gap is large and growing, as Chairman
Ratcliffe and Ranking Member Richmond have both mentioned.
Hiring managers are having a hard time finding the talent
they need right now and there is a critical need for technical
talent. Organizations will get creative in their hiring
practices. I believe the market will work in some very
innovative ways to adapt to the changing conditions by, for
example, retraining some workers for roles in cyber and moving
them around to manage the workload. Talent can and will come
from some unexpected places. I am sure we will hear some
creative ideas from the other panelists.
But the fact that the problem is growing is a serious issue
because there have been a number of important activities that
have been on-going for a while now around the country in
academia, in industry and in Government. I will quickly touch
on just a few of them now.
The NSA/DHS centers of academic excellence, the DOD and NSF
cyber scholarship programs have been good and useful programs
and have helped to jump-start and bolster university
cybersecurity programs around the country. As universities grow
their cyber portfolios to train more students, they will
benefit from comprehensive curricular guidance and important
progress is being made on that front.
Student cyber competitions are becoming increasingly
popular. As long as we can ensure the right balance between the
competitions and coursework, I am a supporter of these
competitions because I think they build depth of knowledge and
they provide a valuable team experience which will be useful
when the students enter the work force.
We are also seeing now more cyber summer camps for both
middle and high school students. I think these summer camps are
quite important because they will help us grow a pool of cyber-
and STEM-, science-, technology-, engineering-, and math-
motivated students. We need a larger pipeline of folks from
which to recruit into key cyber positions.
We will also see an increasing effort to advance
technologies that will help automate different cybersecurity
tasks and this will assist in giving human cyber experts more
time to perform other tasks that we will not be able to
automate at the time.
Let me close by saying that, in general, the actions that
are being taken now are important, valuable, and are making a
difference. But given that these actions are being taken and
the fact that the cyber skills gap continues to grow tells me
that we must do more.
In 1958, science education in America got a shot in the arm
when the National Defense Education Act was passed the year
after the Soviet satellite Sputnik was launched into outer
space. This act helped launch a generation of students who
would study math and science. So while we need to work very
hard today to recruit and retain urgent cyber positions today
and in the near future, I hope we can also consider the future
of cyber space.
How secure will it be? How will we defend it? Today's
students will be responsible for designing, creating,
operating, maintaining, and defending tomorrow's cyber
infrastructure. We need a large and capable pool of folks to
staff these positions for the future.
Thank you again for allowing me to be here today. I look
forward to your questions.
[The prepared statement of Dr. Chang follows:]
Prepared Statement of Frederick R. Chang
September 7, 2017
Chairman Ratcliffe, Ranking Member Richmond, Members of the
subcommittee, thank you for the opportunity to testify before you in
today's hearing regarding the challenges associated with recruiting and
retaining a cybersecurity work force. My name is Frederick R. Chang and
I consider it an honor and a privilege to come before this
subcommittee. I am the executive director of the Darwin Deason
Institute for Cyber Security at Southern Methodist University (SMU) in
Dallas, Texas. I am also the Bobby B. Lyle Centennial Distinguished
Chair in Cyber Security, Professor in the Department of Computer
Science and Engineering in SMU's Lyle School of Engineering, and a
senior fellow in SMU's John G. Tower Center for Political Studies.
Prior to coming to SMU, I have held academic positions at the
University of Texas at San Antonio and at the University of Texas at
Austin. I have worked in the private sector and have also served as the
director of research at the National Security Agency. I would also
mention that I served as a member of the CSIS Commission on
Cybersecurity for the 44th Presidency.
SMU is a Nationally-ranked private university in Dallas founded
over 100 years ago. The university enrolls more than 11,000 students--
including about 5,200 graduate students--who all benefit from the
academic opportunities and international reach of seven degree-granting
schools. The Carnegie Foundation recognizes SMU as a university with
``high research activity,'' which ranges across disciplines from
particle physics at the Large Hadron Collider at CERN, to geothermal
energy, to the science of human speed, to cybersecurity through the
Bobby B. Lyle School of Engineering. SMU's Lyle School of Engineering,
founded in 1925, is one of the oldest engineering schools in the
Southwest. The school offers eight undergraduate and 29 graduate
programs, including master's and doctoral degrees, through the
departments of Civil and Environmental Engineering; Computer Science
and Engineering; Electrical Engineering; Engineering Management,
Information, and Systems; and Mechanical Engineering. Finally, the
Darwin Deason Institute for Cyber Security is a research institute with
the goal of advancing the science, policy, application and education of
cybersecurity through basic and problem-driven, interdisciplinary
research.
the new normal
Early computer worms and viruses date back to the 1970's and 80's
and while they were rare and experimental back then, as we fast forward
to 2017, terms such as ``malware'', ``data breach'', ``phishing'' and
``botnets'' are unfortunately all too common today. We are no longer
surprised to read about the latest data compromise or cyber attack as
they are sadly a regular occurrence. In fact, not long ago a technology
company ran a series of television commercials depicting that it is
newsworthy when there is not a data breach. The internet, high-
performance computing clusters, high-density storage, ultra high-speed
communication links, the cloud, our laptops, and smart phones are
technologies that we take for granted today. They are so integral to
our personal and professional lives that it is hard to remember a time
when we didn't have these technologies available to us. But in the
larger scheme of things the technologies that comprise cyber space are
young and changing at a stunning rate of speed. As we have become
increasingly dependent on these technologies we have also come to
understand just how vulnerable these technologies are to malicious
attackers of many kinds. We have also come to understand the
consequences of these security vulnerabilities to us personally,
professionally, and to our National security.
The source of today's cyber insecurity is multifaceted, involving
technology, policy, law, economics, work force, and more. In my brief
comments this afternoon, I will focus on the topic of today's hearing:
The cybersecurity work force. One of the reasons why cyber intrusions
are so prevalent today is that there is a lack of trained, qualified
personnel to defend the Nation's cyber assets. This lack of trained
personnel has been referred to as the ``cyber skills gap''.
the cyber skills gap
Over the past several years there has been increasing concern about
the cyber skills gap problem, and the extent to which this gap
contributes to the Nation's challenge in defending cyber space, today
and into the future. An image that comes to mind is from the child's
game of whack-a-mole. Cyber defenders within an enterprise are
stretched too thin, quickly moving from issue to issue in an effort to
keep their networks secure. Two natural questions to ask are: How large
is the problem? Is the problem going to get worse in the future? There
have been a number of studies and reports on this topic and I have
listed a few illustrative bullets points below that shed some light on
these questions. I would hasten to add that perhaps more important than
the specific numbers that are listed are the trends that they suggest.
The size of the global cyber skills gap was estimated at
about 1 million people in a 2014 report.\1\ \2\
---------------------------------------------------------------------------
\1\ Cisco 2014 Annual Security Report, Cisco Systems, San Jose, CA,
2014.
\2\ Cobb, S. Sizing the Cybersecurity Skills Gap: A White Paper,
2016. Paper can be found here: http://cisosurvey.org/wp-content/
uploads/2016/10/sizing-cyber-skills-gap-v1a.pdf.
---------------------------------------------------------------------------
The size of cyber skills gap globally will grow to about 1.8
million in 2022. This is 20 percent higher than an estimate
made 2 years earlier.\3\
---------------------------------------------------------------------------
\3\ 2017 Global Information Security Workforce Study: Benchmarking
Workforce Capacity and Response to Cyber Risk, report can be found
here: https://iamcybersafe.org/wp-content/uploads/2017/07/N-America-
GISWS-Report.pdf.
---------------------------------------------------------------------------
The size of the cyber skills gap in the United States was
estimated to be over 200,000 in 2015.\4\ The size of the cyber
skills gap is estimated to grow to about 265,000 in North
America by 2022.\3\
---------------------------------------------------------------------------
\4\ Setalvad, A. Demand to fill cybersecurity jobs booming,
Peninsula Press, March 31, 2015, report can be found here: http://
peninsulapress.com/2015/03/31/cybersecurity-jobs-growth/.
---------------------------------------------------------------------------
In the United States there were nearly 300,000 on-line job
listings for cybersecurity-related positions between April 2016
through March 2017, and the National average ratio of existing
cybersecurity workers to cybersecurity job openings is only
2.5, while the National average for all jobs is 5.6 according
to the website CyberSeek.\5\
---------------------------------------------------------------------------
\5\ http://cyberseek.org/heatmap.html.
---------------------------------------------------------------------------
In addition to the shortfall estimates above, it is instructive to
look at some illustrative responses sampled from a variety of different
surveys of different groups of cybersecurity professionals. The goal
here is not to be exhaustive but rather to provide a perspective on
some of the challenges facing enterprises as they address the
challenges associated with hiring qualified cybersecurity workers.
In one international survey, the North American respondents
reported that they were not able to fill open cybersecurity positions
about 26 percent of the time and that for all respondents, over a
quarter of the time finding an appropriate person for the job can take
up to 6 months. In the same survey, respondents reported that while
they do receive quite a few applicants for each job opening, most
applicants are viewed as unqualified--and this response is reflected by
the North American respondents to the survey as well.\6\
---------------------------------------------------------------------------
\6\ State of Cyber Security 2017, Part 1: Current Trends in
Workforce Development, ISACA, 2017.
---------------------------------------------------------------------------
In another survey that included only North American respondents
(Information Technology (IT), and IT security professionals), 35
percent reported that there is a shortage of IT security professionals
at most every level, and 37 percent reported that there are lots of
less experienced/trained people, but it is hard to fill the most-
skilled positions. In the same survey only 33 percent of respondents
report that they have enough people to meet the threats they will face
in the coming year and only 23 percent report that their security team
is well-trained and up-to-date on the latest technologies and
threats.\7\
---------------------------------------------------------------------------
\7\ Chickowski, E. Surviving the IT Security Skills Shortage, Dark
Reading Reports, May 2017.
---------------------------------------------------------------------------
In a study we conducted at SMU we explored how organizations made
cybersecurity investment decisions.\8\ We conducted semi-structured
interviews with cybersecurity executives and managers from primarily
four vertical sectors: Health care, financial, retail, and Government.
Over 75 percent of the respondents were from U.S. organizations.
Consistent with the findings reported above, our respondents reported
that finding qualified cybersecurity talent was a key challenge.
Sufficient budgets were often available for a particular cybersecurity
project but that lack of availability of qualified personnel served as
a limiting factor in budget requests. Respondents reflected that even
though they had considerable professional networks from which to draw,
they had difficulty finding the talent they needed.
---------------------------------------------------------------------------
\8\ Moore, T., Dynes, S. & Chang, F. Identifying How Firms Manage
Cybersecurity Investment. Paper presented at the 15th Annual Workshop
on the Economics of Information Security, June 13-14, 2016 Berkeley,
California.
---------------------------------------------------------------------------
Finally, a theme that was highlighted in one of the earlier reports
on the cyber skills gap emphasized the need for technical talent.
Indeed this need is reflected in the report title: A Human Capital
Crisis in Cybersecurity: Technical Proficiency Matters.\9\ A quote from
the report describes the sentiment well: ``We not only have a shortage
of the highly technically skilled people required to operate and
support systems we have already deployed; we also face an even more
desperate shortage of people who can design secure systems, write safe
computer code, and create the ever more sophisticated tools needed to
prevent, detect, mitigate, and reconstitute systems after an attack''.
---------------------------------------------------------------------------
\9\ A Human Capital Crisis in Cybersecurity: Technical Proficiency
Matters. A White Paper of the CSIS Commission on Cybersecurity for the
44th Presidency, July 2010.
---------------------------------------------------------------------------
cyber students in demand
The previous section provided some perspective on the size and
nature of the cyber skills gap today and into the future and the trends
are that the gap is large and challenging today and that it will worsen
in the years ahead. As enterprises think through how they will staff to
meet their cyber defense needs they will do well to think creatively
and unconventionally as talent could well come from disciplines that
are not traditionally associated with cybersecurity. Additionally, as
cybersecurity becomes a higher priority within an enterprise, talented
employees from different parts of the enterprise can and are being
retrained to move into higher-priority cyber positions. In fact, we've
offered an MS degree in Security Engineering for over a decade at SMU
and that degree is popular with corporate employees who are interested
in retraining themselves.
For an enterprise it is clearly desirable to be able to hire
highly-experienced professionals who can immediately perform at a high
level, but due to the talent shortage and associated salary limitations
that may not always be possible. An alternate strategy may be to
strategically hire more junior talent and patiently grow the needed
capability internally. Indeed in our own research \8\ some of our
respondents expressed this perspective. So, in addition to the natural
course of hiring college graduates for positions that are appropriate
for their skill level, there is additional demand for cyber-capable
college graduates. I am seeing this demand for our students at SMU as
are my peers around the country for their students at their respective
universities.
---------------------------------------------------------------------------
\8\ See note, previous page.
---------------------------------------------------------------------------
As part of our undergraduate computer science major, we've offered
a security track for many years now in which students can take elective
courses in security which allows them to emphasize cybersecurity as
part of their undergraduate computer science major. We are seeing an
uptick in the number of students who are pursuing this security track
and we believe that when students pursue this track they very often go
on to pursue a cybersecurity-related job upon graduation. In addition,
anecdotally, we are seeing an uptick in the number of high-school
seniors who plan to pursue cybersecurity in their undergraduate
studies.
answering the need
The cyber skills gap has been known about and discussed for many
years now and over time, I've had my fair share of discussions with
enterprise managers who are eagerly awaiting the arrival of more
trained cyber defenders. As mentioned above these students are in high
demand. While for many hiring managers the supply of students isn't
arriving fast enough to meet the demand, there are many activities
underway in the government, the private sector, and academia--often
working together--that are helping to meet the demand. Let me touch on
a few such activities below.
Centers of Academic Excellence and Scholarships.--Historically the
NSA/DHS Centers of Academic Excellence in Cyber Defense (CAE-CD)
program (and extensions) have helped to jump start skill building in
cybersecurity in higher education, by among other things, requiring the
CAE-CD-designated universities to map their curriculum to specific
information assurance knowledge units. Additionally the Government has
funded scholarship programs (the NSF CyberCorps Scholarship for
Service, and the Department of Defense, Information Assurance
Scholarship Program) that have provided funding (tuition, books,
stipend, etc.) for students to complete their cybersecurity education
in return for service to the Government following graduation.
Curricular guidance.--As more university capability, capacity, and
programs are created to answer the need for more cyber defenders it
will be important to have clear curricular guidelines that will assist
in building these new programs. Cybersecurity is still a young field
but is emerging as a distinct discipline. As universities compose new
cybersecurity academic programs out of elements from computer science,
computer engineering, information systems and the like, it will be
extremely valuable to have comprehensive curricular guidance. The ACM
(Association for Computing Machinery) Joint Task Force on Cybersecurity
Education is in the process of creating this guidance and it is
expected to be released later this year.\10\ Importantly it defines
cybersecurity as an interdisciplinary area of study including elements
from risk management, policy, human factors, law and more, but that
fundamentally is a computing-based discipline.
---------------------------------------------------------------------------
\10\ https://www.csec2017.org/.
---------------------------------------------------------------------------
Cyber Competitions.--For over a decade now university students have
been competing in a cybersecurity competition that is now known as the
National Collegiate Cyber Defense Competition (NCCDC). The competition
provides a challenging and motivating event in which students must
defend a simulated small company network while operationally keeping
services up and running while responding to business requests.
Depending on how they do, points are scored and teams advance in the
competition. The competition has grown in popularity over the years and
now there are 10 regions across the country that compete, and the
regional winners compete in a National finals event. At the National
finals event, a National winner is crowned. Cyber competitions in
general have become very popular, and there are now many in which to
participate and they focus in different areas (cybersecurity,
forensics, and capture-the-flag). With the increasing number of cyber
competitions it is fair to ask about their educational impact.\11\ That
said, cyber competitions provide a means to increase depth of technical
knowledge in cybersecurity \12\ and there is some evidence that cyber
competitions will attract individuals who will stay in the field a long
time.\13\ At SMU there is a student-run security club where interested
students meet to learn from each other and practice security concepts.
A highlight for club members is to participate in cyber competitions
including the NCCDC. The cyber competitions are popular with the
students in part because they feel the competitions provide a valuable
supplement to what they learn in class. Additionally, cyber
competitions give students experience working as part of a team, and
this is valuable when they graduate and join the work force. As the
popularity of cyber competitions has continued to grow, they have moved
into the K-12 domain as well.
---------------------------------------------------------------------------
\11\ Fulton, S., Schweitzer, D., and Dressler, J. What Are We
Teaching In Cyber Competitions? Frontiers in Education Conference
(FIE), October 3-6, 2012.
\12\ Manson, D., and Pike, R. The case for depth in cybersecurity
education. ACM Inroads, Vol. 5, No. 1, pp. 47-52, March 2014.
\13\ Tobey, D.H., Pusey, P., and Burley, D.L. Engaging learners in
cybersecurity careers: lessons from the launch of the national cyber
league, ACM Inroads, Vol. 5, No. 1, pp. 53-56, March 2014.
---------------------------------------------------------------------------
Cyber summer camps.--Related to, but distinct from cyber
competitions, are summer cybersecurity camps for K-12 students. For
example, the GenCyber program, funded by NSA and NSF, offers a summer
cybersecurity camp experience to middle and high school students, as
well as teachers, in an effort to increase the pool of students who
might go on to study cybersecurity in the United States. One of the
goals of these summer camps is to teach students about cyber safe and
correct on-line behaviors. Over the last several years, in keeping with
the effort to get more K-12 students interested in the STEM (Science,
Technology, Engineering, and Math) fields, among other things, SMU has
conducted a Crime Scene Investigation (CSI) summer camp for middle
schoolers. Students are introduced to the science, technology, and math
behind CSI via expert presentations from real-world professionals and
hands-on activities. For the past two summers we have added a
cybersecurity module into the CSI curriculum.
Augmenting human capability with technology.--Finally, there are
some important efforts to augment human capability in cybersecurity via
the use of technology. For example, there is promise in the use of
advanced reasoning techniques to augment the human cyber expert by
automating some portions of the cyber defense task (e.g., finding and
fixing flaws in software). This was the goal of the recent DARPA Cyber
Grand Challenge in which important advances were made in the ability to
automate the process of detecting software vulnerabilities, creating an
appropriate patch, and then applying that patch in real-time.\14\ To
the extent that these, and other, difficult and time-consuming tasks
can be automated, this will leave the time-limited human cyber expert
more time to perform important analytic tasks that are not able to be
automated at this time.
---------------------------------------------------------------------------
\14\ https://www.darpa.mil/news-events/2016-08-04.
---------------------------------------------------------------------------
conclusions
Many students I speak with are eager to join this new field and as
mentioned previously we are seeing an uptick in that interest. I
occasionally engage students in brief career-oriented discussions and a
few themes emerge in these discussions as students think about their
job choices that I thought might be relevant as we discuss recruiting
and retaining top cyber talent.
1. The students want challenging work. They are challenged in their
coursework to master difficult technical material, but also
exercise creativity in using those skills. They want nothing
less when they move into the workplace. They want to jump into
the game and show that they have what it takes.
2. The students want to make a difference. As they evaluate
positions they will try to determine if the position will allow
them to make a difference--they want their efforts to have an
impact. Sure, salary will be a factor, but as one student
commented, for some they will choose ``mission over money''.
3. The students want to keep their technical skills sharp. When
students graduate their technical skills are sharp and up-to-
date. They understand that the computing and technological
landscape changes rapidly. They will want to work with the most
modern tools, with colleagues who they respect and from whom
they can learn, and in an environment that gives them
opportunities to refresh their technical skills.
In closing, in my comments earlier I briefly mentioned a number of
activities that the Nation is undertaking now in an attempt to help
close the cyber skills gap including: Scholarships, new cybersecurity
curricular guidance, cyber competitions, cyber summer camps, and
technological advances that will augment human cyber capability. These
activities are important, valuable, and are making a difference, but I
believe we can and should do more. We now have a much better
understanding of the constantly-changing nature of the cyber threat and
the consequences of our cyber insecurity. Are there lessons to be
learned from America's ``Sputnik moment'' nearly 60 years ago?
Following the launch of the Soviet satellite Sputnik in 1957, science
education got an infusion of funds of over a billion dollars in 1958
when the National Defense Education Act was passed, and this helped
launch a new generation of students who would to be motivated to go on
to study math and science.\15\ The challenge to make cyber space more
secure is a long-term, enduring problem. While we urgently need short-
term solutions to make available more cyber-trained workers to fill
positions now and in the near-term, we also need to ask ourselves what
will cyber space look like 10, 20, and 30 years from now--and how much
more dependent will we be on it? Today's students will be responsible
for designing, creating, operating, maintaining, and defending
tomorrow's cyber infrastructure.
---------------------------------------------------------------------------
\15\ Abramson, L. Sputnik Left Legacy for U.S. Science Education,
All Things Considered, NPR, September 30, 2007. Story can be found
here: http://www.npr.org/templates/story/story.php?storyId=14829195.
Mr. Ratcliffe. Thank you, Dr. Chang.
The Chair now recognizes Mr. Montgomery for his opening
statement.
STATEMENT OF SCOTT MONTGOMERY, VICE PRESIDENT AND CHIEF
TECHNICAL STRATEGIST, MC AFEE
Mr. Montgomery. Good afternoon, Chairman Ratcliffe, Ranking
Member Richmond, and Members of the subcommittee. Thanks very
much for the opportunity to testify today.
I am Scott Montgomery, vice president and chief technical
strategist of McAfee, one of the world's leading independent
cybersecurity companies.
Inspired by the power of working together, McAfee creates
enterprise, Government, and consumer solutions that make the
world a safer place.
As a group, we have studied this well-documented work force
shortage for several years now and we need to do something
about it immediately. Following are some recommendations for
training and incentivizing more people and also using
technology to help fill the gap.
First, we should expand programs that are working today,
such as the NSF CyberCorps Scholarship for Service Program
which manages to retain an impressive 80 percent of its
graduates as workers for the Federal Government. We should also
consider expanding this program to focus on community colleges.
These institutions tend to attract a diverse variety of
students, including recent high school grads, but also
returning veterans and other adult students who might be
working full or part time.
I want to recognize full committee Chairman McCaul's Cyber
Scholarship Opportunities Act and its Senate counterpart that
was recently voted out of committee. Both require the NSF
program to include students pursuing an associate's degree in
cybersecurity without the intent of transferring to a 4-year
institution.
The public sector as well as the private sector have thorny
challenges in attracting and retaining cybersecurity talent. At
the very high level, there are three categories of Government
cyber professionals. There are operators, the people who
implement and keep security technology running, researchers who
explore the latest in cyber defense, and finally analysts,
experts that can respond to an event in the first few minutes.
It is this third area where Government and the private sector
have the most serious need.
Congress gave DHS expedited hiring authority for
cybersecurity 3 years ago, an authority that could address many
of the suggestions. It is incumbent upon the Department not
only to move these plans forward, but also to come up with
creative ways to address the known pay disparity between the
public sector and the private sector. Whether this is through
accelerated grades or accelerated retirement packages, there
has to be some creative way where we can address the pay
disparity.
We should also explore creative ways to enable the public
and private sectors to share talent. Adversaries are constantly
innovating and changing course. It is unrealistic to think that
Government cyber practitioners will be able to keep up with a
rapidly-evolving environment by themselves.
We should design a mechanism for cyber professionals to
move back and forth between the public and private sector so
that the Government organizations would have a continual
refresh of expertise, much like the National Guard.
We should work quickly to solve this cyber work force
challenge. But in the mean time, while we still have this gap,
we must rely on technology, such as moving to the cloud and
using automation wisely. We can automate lower-level tasks,
freeing up personnel to serve in key roles that humans can best
fill. Those are the analysts who can use creative insight to
determine why an attacker might have chosen a particular attack
method or target or how best to respond to an incident.
When considering the role of security technologies, it is
important to understand the market-like forces that drive the
effectiveness of cybersecurity defense. Information
technologies continuously improve over time.
Paradoxically, cyber defense do not follow this pattern.
Their effectiveness peaks shortly after release and degrades
quickly thereafter. When a new defensive capability is first
released, adversaries don't take much notice. But once it is
deployed at scale, they adopt evasion tactics and
countermeasures causing the effectiveness to degrade
significantly.
We also see the current paradigm of constant integration of
point products as ineffective and unsustainable, particularly
given the substantial number of cyber professionals needed to
knit together these disparate systems. Not only are technology
efficiencies already declining by the time the lengthy
acquisition and deployment cycles are complete, but
organizations are unable to deal with the complexity of what
they have acquired and deployed.
An approach where technology enabled with strong
collaboration can be deployed rapidly to security platforms
using open-source communication means as required. Both the
public and private-sector organizations need their tools to
utilize these kinds of open-source communication mechanisms.
No single industry partner can cover the vast spectrum of
security and privacy problems or catch every issue every time.
Only by working collaboratively in the private and public
sectors can we defeat cyber attackers.
I look forward to our discussion and would be happy to
answer any questions. Thank you.
[The prepared statement of Mr. Montgomery follows:]
Prepared Statement of Scott Montgomery
September 7, 2017
Good afternoon, Chairman Ratcliffe, Ranking Member Richmond, and
Members of the subcommittee. Thank you for the opportunity to testify
today. I am Scott Montgomery, vice president and chief technical
strategist of McAfee, LLC.
I am pleased to address the subcommittee on the challenges of
recruiting and retaining a cybersecurity work force. My testimony will
address the broad contours of the cybersecurity skills shortage, both
in the public and private sectors, and what we can do about it. One
involves people: Training more, broadening our perception of what
attributes and skills are needed, and incentivizing Government
investments in cyber specialists. The other involves technology: Moving
to the cloud, using automation wisely, and encouraging industry to move
to interoperable platforms.
First, I would like to provide some background on my experience and
McAfee's commitment to cybersecurity. I help drive the company's
technical innovation, evangelize our expertise, thought leadership, and
offerings to public and individual audiences; and work to increase the
public trust by cooperating with law enforcement on cyber criminal
investigations and disruption. With more than 20 years in content and
network security, I bring a practitioner's perspective to the art and
science of cybersecurity. I have designed, built, tested, and certified
information security and privacy solutions for such companies as
McAfee, Secure Computing, and on behalf of a wide variety of public-
sector organizations.
mcafee's commitment to cybersecurity
McAfee is one of the world's leading independent cybersecurity
companies. Inspired by the power of working together, McAfee creates
business and consumer solutions that make the world a safer place. By
building solutions that work with other industry products, McAfee helps
businesses orchestrate cyber environments that are truly integrated,
where protection, detection, and correction of threats happen
simultaneously and collaboratively. By protecting consumers across all
their devices, we secure their digital lifestyle at home and away. By
working with other security players, we are leading the effort to unite
against State-sponsored actors, cyber criminals, hacktivists, and other
disruptors for the benefit of all.
the cybersecurity skills gap
In 2016 the Center for Strategic and International Studies (CSIS)
and McAfee undertook a study titled Hacking the Skills Shortage based
on a global survey of IT professionals. Some of the findings about the
cybersecurity talent gap include:
82 percent of those surveyed reported a lack of
cybersecurity skills within their organization.
71 percent agreed that the talent shortfall makes
organizations more vulnerable to attackers, and 25 percent say
that lack of sufficient cybersecurity staff has actually
contributed to data loss or theft and reputational damage.
The most desirable skills cited in all 8 countries surveyed
were intrusion detection, secure software development, and
attack mitigation.
76 percent of respondents say their governments are not
investing enough in programs to help cultivate cybersecurity
talent and believe the laws and regulations for cybersecurity
in their country are inadequate.
Since that July study, the numbers haven't improved any. According
to a recent Global Information Security Workforce Study, the
cybersecurity work force shortage is projected to reach 1.8 million by
2022. The cybersecurity skills shortage is equally troublesome in the
Federal Government. Tony Scott, the Federal Government's former CIO,
said in a GovLoop article, ``There are an estimated 10,000 openings in
the Federal Government for cyber professionals that we would love to
fill, but there's just not the talent available.'' Given the vital role
such Government agencies as the Departments of Defense and Homeland
Security as well as the intelligence agencies play in protecting the
United States, this skills gap is disquieting and merits attention from
policy makers.
None of this is news. We've studied this work force shortage for
several years now, and if we're serious about its importance we need to
do something about it immediately. Following are some recommendations
for training and incentivizing more people and also using technology to
help fill the gap.
train and cross-train more people
Expand the Current CyberCorps Program
First, we need to focus on expanding existing programs that train
people in the cybersecurity field. For example, The CyberCorps
Scholarship for Service (SFS) program is designed to increase and
strengthen the cadre of Federal information assurance specialists that
protect Government systems and networks. The program is structured so
that The National Science Foundation (NSF) provides grants to about 70
institutions across the country to offer scholarships to 10-12 full-
time students each. With this structure, students get free tuition for
up to 2 years in addition to annul stipends--$22,500 for undergraduates
and $34,000 for graduate students. They also get allowances for health
insurance, textbooks, and professional development. Some universities
also partner with the Department of Homeland Security (DHS) on these
programs.
Generally, students must be juniors or seniors and must qualify for
the program by attaining a specific GPA, usually at least a 3.0 or
higher. Upon completing their coursework and a required internship,
students earn a degree, then go to work as security experts in a
Government agency for at least the amount of time they have been
supported by the program. After that, they can apply for jobs in the
public or private sector.
With additional funding, the CyberCorps SFS program could be
expanded to more institutions and more students within each of those
schools. To date, the Federal Government has made a solid commitment to
supporting the SFS program, having spent $45 million in 2015, $50
million in 2016, and the most recent administration's budget requesting
$70 million. As a baseline, an investment of $40 million pays for
roughly 1,500+ students to complete the scholarship program.
With the cyber skills deficit being substantial, policy makers
should significantly increase the size of the program, possibly
something in the range of $180 million. If this level of funding were
appropriated, the program could support roughly 6,400 scholarships.
This investment would make a dent in the Federal cyber skills deficit,
estimated to be in the range of 10,000 per year. At the same time, this
level of investment could help create a new generation of Federal cyber
professionals who could serve as positive role models for a countless
number of middle and high school students across the country to
consider the benefits of a cyber career and Federal service. On a long-
term scale, this positive feedback loop of the SFS program might be its
biggest contribution.
Create a Community College Program
While the CyberCorps program serves college juniors and seniors who
are already well along the learning path, we believe another program,
or an expansion of the SFS program, could seek to attract high school
graduates who don't yet have specific career aspirations. Private
companies could partner with a community college in their area to
establish a course of study focusing on cybersecurity. The Federal
Government could fund all or part of the tuition remission for
students. Interested students would be taught both by college faculty
and private-sector practitioners. For example, an IT company could
offer several faculty members/guest lecturers who would participate
during a semester. Students would receive free tuition--paid by a
Federal program, perhaps with private-sector contributions--but they
would not receive a stipend for living arrangements, as 4-year college
students do in the CyberCorps program. Students would receive a 2-year
certificate in cybersecurity that would be transferrable to a 4-year
school. Like the CyberCorps program, graduates would spend the same
amount of time as their scholarship period, working in a guaranteed
Government job.
Community colleges tend to attract a variety of students--including
recent high school graduates but also returning veterans and other
adult students who might have pursued other careers or might even be
working full- or part-time. The community college option could also
further ethnic and racial diversity in a cyber program--something that
is badly needed. This diversity would be a plus rather than a minus for
the cybersecurity profession, as the field requires a diverse set of
skills and individuals. Not all of these skills are strictly technical,
and for those that are technical, not all require high levels of formal
education. You don't need a Ph.D.--or even a bachelor's degree--to work
in cybersecurity. For instance, a 4-year degree is not necessarily
required to work in a security operations center (SOC). As pointed out
earlier, a strong security operation requires various levels of skills,
and having a flexible scholarship program at a community college could
benefit a wide variety of applicants while providing the profession
with other types of necessary skills.
Encourage Cultural Changes to Close the Cyber Skills Gap
As cybersecurity is one of the greatest technical challenges of our
time, we need to be creative in attracting more people to the work
force. One of the ways we can do this is by changing our way of
thinking about the industry. Cybersecurity professionals can--and do--
have broad and varied backgrounds. Diverse skills and experience can
enable them to examine problems from a different perspective, bringing
creativity rather than just linear thinking to cyber problems and
solutions. The legacy tech innovator Bell Labs proved that diverse
teams produce more creative, high-quality products. Likewise, a diverse
incident response team can benefit from look at cyber incidents and
responses from a multitude of perspectives.
We must also address the gender and diversity gap, which would help
alleviate the skills gap. In North America, women constitute only 14
percent of the information security work force, according to a Women in
Cybersecurity report by the Executive Women's Forum and (ISC). The
numbers are even worse for African Americans, who comprise only 3
percent of information security analysts in the United States,
according to the Bureau of Labor Statistics figures cited in an article
in Forbes. Research on large, innovative organizations has shown that
gender and racial diversity improves the organizations' financial
performance. The title of this article in Scientific American states
the case well: How Diversity Makes Us Smarter: Being around people who
are different from us makes us more creative, more diligent and harder
working. McAfee believes we need to focus on hiring a diverse work
force, which will in turn make us an even stronger company.
Pass Legislation like the ``Cyber Scholarship Opportunities Act of
2017''
I'd also like to take a moment to applaud the recently approved
``Cyber Scholarship Opportunities Act of 2017'' that was passed through
the Senate Commerce, Science, and Transportation Committee, as well as
Chairman McCaul's ``Cyber Scholarship Opportunities Act of 2017.'' Both
bills require the SFS program to include students pursuing an
associate's degree in a cybersecurity field without the intent of
transferring to a bachelor's degree program, people who have a
bachelor's degree already, or people who are veterans of the Armed
Forces.
This is encouraging news for closing the skills gap at the operator
and junior analyst levels. McAfee supports these bills and hopes they
get signed into law. However, there is still more work to be done. The
Senate bill directs the NSF to provide awards to improve cybersecurity
education and increase teacher recruitment. We hope the Senate
considers those with hands-on cybersecurity experience as potential
candidates for teaching.
The Thorny Problem of the Government's Gap
The cybersecurity skills gap also extends to Government. Quite
simply, the public sector can't keep up with the private sector in
terms of pay scale and benefits. We have to change that to be able to
attract and retain excellent cyber professionals in the public sector.
To date, the SFS program has been particularly effective in adding to
cybersecurity talent in the Government. While all graduates are
required to begin their careers by serving in the Government, an
impressive 70 percent, according to NSF, actually remain in Government
jobs. I'd like to unpack this issue a bit and distinguish between
different types of cyber professionals in Government organizations.
At a very high level, there are three categories of cyber
professionals. First there are operators--the people who implement the
security technology and keep it running in systems and networks. You
don't need a Ph.D. in computer science to fill an operator role, and in
fact the Government has a good supply of such people either directly or
through contractors. Then there are researchers, people who explore the
latest in cyber defense. Again, the Federal Government is well-served
here by labs in the Department of Defense, DARPA, IARPA, and the
intelligence community. The third category is analysts--the people who
can respond to a breach in the first few minutes and conduct the
necessary analytical work to understand the implications of an attack
and develop a remediation plan. This is the area where the Government
has the most serious need and where they need people who are not just
technically trained but also astute and creative problem solvers.
In order to attract this kind of talent, the Federal Government
needs to find ways to incentivize people and reduce obstacles to them
serving in cybersecurity positions. The salary issue cannot be
overlooked, as this is a major incentive for most professionals--
especially in the most sought-after areas of IT like cybersecurity.
Government needs to offer competitive salaries, and if that's not
possible, Government should offer better retirement packages to be more
on a par with the private sector. Alternatively, agencies could offer
cybersecurity personnel the ability to up-level their positions (e.g.,
from a GS12 to a GS13) more quickly than usual.
Congress gave DHS expedited hiring authority for cybersecurity 3
years ago--an authority that could address many of these suggestions.
It's incumbent upon the Department to move these plans forward as soon
as possible.
Another impediment to getting cybersecurity personnel where they
need to be in Government agencies has to do with clearances. Often an
agency will require an advanced clearance to enter a facility when, in
fact, many of the systems don't house Classified data. As there's a
limited number of personnel with high-level security clearances--and as
it takes a long while to get one--this also contributes to the
cybersecurity talent shortage in Government. Expediting the vetting
process and carefully reviewing which clearances are truly necessary to
work on a system, while still protecting National security, would both
be steps in the right direction.
Another topic that deserves attention is the need to review and
declassify materials over time. This merits a lot more study, and I
know there are efforts within the Defense Department, in particular, to
better determine what data actually needs to be Classified and for how
long. If data were to be declassified more quickly, more cybersecurity
professionals with lower or no clearances would be able to be of
service.
public-private sector cross-pollination
We must also develop creative approaches to enabling the public and
private sectors to share talent, particularly during significant
cybersecurity events. Cybersecurity is a rapidly changing area, and
what's valid today might well be superseded tomorrow. We know that the
adversary is constantly innovating and changing course, often reacting
to new defensive capabilities the private sector develops. It's
unrealistic to think that Government cyber practitioners would be able
to keep up with such a rapidly-evolving environment without private-
sector assistance. We should design a mechanism for cyber
professionals--particularly analysts or those who are training to
become analysts--to move back and forth between the public and private
sector so that Government organizations would have a continual refresh
of expertise.
One way to accomplish this would be for DHS to partner with
companies and other organizations such as universities to staff a cadre
of cybersecurity professionals--operators, analysts, and researchers--
who are credentialed to move freely between public and private-sector
service. These professionals, particularly those in the private sector,
could be on call to help an impacted entity and the Government respond
to a major hack in a timely way. Both Government and private-sector
cybersecurity professionals would benefit from regular job rotations of
possibly 2 to 3 weeks each year. This type of cross-pollination would
help everyone share best practices on technology, business processes,
and people management. DHS should include a flexible, public-private
pool of certified professionals in its plan to rewrite its
cybersecurity hiring and retention plan. If DHS is not ready to act,
Congress should establish a blue-ribbon panel of public and private-
sector experts to study how a flexible cadre of cybersecurity
professionals could be started and managed. Much like the National
Guard, a flexible staffing approach to closing the skills could become
a model of excellence.
how technology can help alleviate the problem
Even though we should work hard and think creatively to fill it,
the cyber skills gap won't be closed any time soon. In the mean time,
we must rely technology more and more.
Moving to the Cloud
Both the Government and industry are moving their IT operations to
the cloud. Last year, McAfee surveyed over 2,000 professionals for our
annual cloud security research study, Building Trust in a Cloudy Sky:
The State of Cloud Adoption and Security. We found that hybrid cloud
adoption tripled in the last year, increasing from 19 percent to 57
percent in organizations surveyed. Additionally, IT executives believed
their IT budget would be 80 percent cloud-based within an average of 13
months, and 73 percent of companies are planning to move to a fully
software-defined data center within 2 years.
Here's the relevance to the work force shortage: As more
organizations move to the cloud, the cloud providers rather than the
organizations are delivering a baseline of foundational technology--
hardware, operating systems, and so forth. This reduces the overall
amount of labor that an organization's IT and information security
staff needs to exert, leveraging cloud's inherent economies of scale.
However, the move to the cloud will not, by itself, close the cyber
skills gap in the short run; there are just too many open slots to
fill. Indeed, our recent cloud study also found that 49 percent of
businesses are currently delaying cloud deployment due to a
cybersecurity skills gap. Nevertheless, the move to the cloud will help
reduce the labor shortage; it will just take more time to pay off as
more organizations off-load their IT environments to cloud providers.
Human-Machine Teaming
One strategy for addressing the cybersecurity skills deficit is to
use automation--through such solutions as machine learning and
artificial intelligence. Legacy IT systems, however--like many of those
in the Federal Government--lack the ability to take advantage of the
most contemporary security architectures and development techniques.
While it is possible to isolate or wrap security around a legacy
system, the approach is far inferior to a well-designed secure
implementation designed for the security challenges of 2017 and beyond.
This speaks to the need for investments in IT modernization and
modern cybersecurity solutions, which the President's Executive Order
addresses. We support these much-needed policy changes, which will
allow for better use of automation, or machine learning.
The ideal situation for now is what McAfee calls human-machine
teaming. This means taking advantage of the particular strengths of
each. Machine learning can save security teams both time and energy, as
it is the fastest way to identify new attacks and push that information
to endpoint security platforms. Machines are excellent at repetitive
tasks, such as making calculations across broad swaths of data. That's
one of the strengths of machine learning: Its ability to crunch big
data sets and draw statistical inferences based on that data, detecting
patterns hidden in the data at rapid speed.
Humans, on the other hand, are best at insight and analysis (the
cybersecurity analysts referred to earlier). With the assistance of
machine learning, human analysts can devise new defenses quickly,
adapting to attackers' automated processes and limiting their
effectiveness. The human intellect is capable of thinking like an
adversary and understanding a scenario that might never have been
executed in any environment previously. Machines can take over some
simple processes, automating them so the humans can be free to
understand context and implication, such as why a bad actor might want
to attack a Government agency.
Fostering Interoperability
When considering the role of security technologies, it's important
to understand the market-like forces that drive the effectiveness of
cybersecurity defense. Most information technologies continuously
improve over time. Paradoxically, cyber defense technologies do not
follow this pattern. Their effectiveness peaks shortly after release
and then degrades. When a new defensive capability is first released,
bad actors take little notice, but once deployed at scale, they adopt
evasion tactics and counter-measures, causing the effectiveness to
significantly degrade.
Where does that leave us? We see the current paradigm of constant
integration of point products--individual software applications--as
ineffective and unsustainable, particularly given the substantial
number of cyber professionals needed to knit together disparate
systems. Not only are technology efficiencies already declining by the
time the lengthy purchase and integration cycles are complete, but
organizations are unable to deal with the complexity of supporting
upwards of 30 or 40 independent tools and technologies. That's a losing
game, but it's the one security practitioners find themselves playing.
We need a different approach where technology--enabled with strong
collaboration--can be deployed rapidly to security platforms so they
can communicate with each other over open communication protocols.
Organizations in both the public and private sector need security tools
that are interoperable and interchangeable to protect against existing
and prospective threats. As cybersecurity solutions become
interoperable, they become more efficient and cost-effective. They also
become easier to maintain than a IT environment of disparate systems,
the classic IT hair ball. Over time, more interoperable cybersecurity
systems will contribute to closing the skills gap as they get more
widely deployed. We call on the cybersecurity industry to design
technology to an open standard, on an open platform, so customers are
not locked into proprietary technologies that don't work with each
other or allow for change.
McAfee has taken a major step toward fostering interoperability by
opening our Data Exchange Layer (DXL)--a communications fabric that
enables unprecedented collaboration in an open-source, real-time
system--to other developers and vendors to use at no expense. OpenDXL--
is at the core of our mission to enable security devices to share
intelligence and orchestrate security operations at rapid speed. As of
today, there are 13 companies connected to the DXL ecosystem, 12 others
in testing or development, and 14 additional companies in the design
phase.
OpenDXL is a big part of what we mean by Together Is Power. No
single industry partner can cover the vast spectrum of security and
privacy problems. No single industry partner will catch every issue
every time. Only by working collaboratively in the private and public
sectors can we defeat cyber attackers. This means bringing the best
ideas, the best technologies and the best people to bear on our common
security problem. It means leveraging technologies guided by the
strategic intellect that only humans can provide. And to ensure that we
have enough human intellect to work with our continually evolving
technology, we need to encourage more people from diverse backgrounds
to enter the cybersecurity field, train them, and--particularly in the
case of Government--reward them.
I look forward to our discussion and will be happy to answer any
questions.
Mr. Ratcliffe. Thank you, Mr. Montgomery.
The Chair now recognizes Dr. Papay for 5 minutes for his
opening remarks.
STATEMENT OF MICHAEL PAPAY, VICE PRESIDENT AND CHIEF
INFORMATION SECURITY OFFICER, NORTHRUP GRUMMAN
Mr. Papay. Thank you, Chairman Ratcliffe, Ranking Member
Richmond, and Members of the subcommittee for hosting today's
important hearing.
As our Government, military, and society become
increasingly dependent upon digital technology, it is a
National and economic security imperative to ensure that we
have a cyber-trained work force to meet this demand.
My name is Dr. Michael Papay and I am the vice president of
cyber initiatives and the chief information security officer
for Northrop Grumman, the leading cyber provider across the
Federal Government.
As critical as technology is, at Northrop Grumman, we
firmly believe that our employees are the single-most important
aspect of cybersecurity, and we have made it a top priority to
not only support the development of a larger cyber-qualified
work force globally, but also to increase its diversity.
Like DHS and the Federal Government, Northrop Grumman can
offer prospective employees something unique, the opportunity
to do really exciting, cutting-edge work that is vital to our
National security. For many cyber professionals, it is this
sense of mission that drives them.
In 2012, I had the privilege of participating in the
Homeland Security Advisory Council Task Force on Cyber Skills.
I applaud DHS for adopting many of the task force
recommendations, including additional cyber training which
Northrop Grumman provided to hundreds of DHS employees.
Northrop Grumman has also incorporated the majority of
recommendations into our internal cyber work force strategy.
At Northrop Grumman, we look at the continuum of education
from elementary school through the professional ranks to build
a diverse, highly-skilled work force. The Northrop Grumman
Foundation is honored to be the presenting sponsor of the Air
Force Association's CyberPatriot Program, a youth, teen cyber
defense competition which boasted over 4,400 teens from all 50
States last year. While most STEM programs report a female
participation rate around 12 percent, I am especially proud
that CyberPatriot boasts 23 percent female participation.
Northrop Grumman is actively engaged with universities
across the country to help to develop curriculum, fund hands-on
student research and development projects and educate future
cyber professionals. Because cyber is such a complicated and
dynamic challenge, we need a work force that brings with it a
diversity of thought, culture, education, experience, and
problem solving. Diversity drives innovation and breeds
success.
Therefore, in many cases, we are specifically targeting
investments to increase the participation of women and
underrepresented groups in the cyber profession. For example,
cyber scholars at the University of Maryland, Baltimore County,
and the Cyber Warrior Diversity Program at Morgan State
University and Coppin State University.
As part of our retention efforts and to support their
growth, we rotate cyber professionals around the company to
keep them engaged and challenged while also offering on-going
educational and training opportunities. We even developed our
own in-house cyber academy to provide our employees, customers,
and even policy makers with the macro understanding and
technical skills cyber often requires.
A few final thoughts to leave the committee with. On
clearances, beyond just a shortage of cyber professionals,
there is also a lack of cleared cyber professionals. We need to
figure out ways to improve the clearance process to ensure that
both the Federal Government and contractors have the cleared
employees to do all the critical National security work that is
required.
More cyber-trained Federal employees. Cyber training across
the Federal Government is inconsistent. The Federal Government
as a whole needs to put a greater emphasis on ensuring its
employees have the cyber understanding and tools to effectively
and securely do their jobs.
Increased partnerships and coordination. There is no single
answer to addressing the shortage of cyber workers. Continuing
to work across academia, Government, and industry is essential
to leveraging investments, best practices, and collectively
working together to ensure that our great Nation continues to
securely grow and prosper in this increasingly digital age.
I would be happy to answer any questions. Northrop Grumman
looks forward to working with the subcommittee on this effort.
Thank you again.
[The prepared statement of Dr. Papay follows:]
Prepared Statement of Michael Papay
September 7, 2017
Thank you Chairman Ratcliffe, Ranking Member Richmond, and Members
of the House Homeland Security Subcommittee on Cybersecurity and
Infrastructure Protection for holding today's hearing on the critical
topics of attracting, retaining, educating, and training our Nation's
cyber work force. As our Government, military, and society overall
become increasingly dependent upon digital technology, it is a National
AND economic security imperative to ensure that we have the cyber-
trained work force to meet this demand.
My name is Dr. Michael Papay and I am vice president of cyber
initiatives and chief information security officer (CISO) for Northrop
Grumman, a leading cyber provider across the Federal Government and
producer of innovative solutions from autonomous systems to strike
platforms to space products. Given the often sensitive and critical
National security nature of our work; it is absolutely essential for
resilient cybersecurity to be a key component to all that we do. From
original code, to hardware, to uninterrupted mission performance while
enduring cyber threats, our customers trust us to deliver systems that
enable them to confidently execute the mission in any environment,
including cyber space. We are proud of our strong reputation earned
through 70 years of integrity, innovation, dedication to the customer,
and a proven track record of performance. As important as technology
is, at Northrop Grumman we firmly believe that our employees are the
single most important aspect of cybersecurity. Therefore, we have made
it a top priority to not only support the development of a larger cyber
qualified work force globally but also to increase its diversity.
Thank you again for having me here today and I hope that my
testimony is useful. I look forward to your questions.
attracting and retaining employees
Northrop Grumman is at the forefront of cyber research,
development, and technology, and it is our people that make this
possible. While Northrop Grumman, like the DHS and the Federal
Government, must continue to work to overcome a perception hurdle for
cyber talent--we can offer prospective employees something unique--the
opportunity to do really exciting, cutting-edge work that is vital to
our National security. For many cyber professionals (and employees
across Northrop Grumman and the Federal Government) it is this sense of
mission that drives them.
As part of our effort to ensure that our cyber employees are
continually challenged and provided opportunities for growth, we move
them around inside the company from customer to customer, tough problem
to tough problem. We utilize rotational programs that expose and train
our cyber work force in defending our network, enabling our customers'
missions, and supporting full spectrum cyber operations. We work with
employees to help them create their own growth along the cyber career
path, give them the time to take the training necessary to maintain
their certifications, and keep their knowledge and skills fresh. We
even offer educational assistance in some instances.
To provide our employees, customers, and even policy makers with
the macro understanding and technical skills cyber often requires,
Northrop Grumman created its own, in-house ``Cyber Academy''. We also
utilize a matrix model for customer mission support and employee
development--allowing us to hire for critical skills and redeploy our
talent across programs. We are committed to providing positions that
work best for our employees by allowing flexible work schedules and
opening up work locations in customer-approved non-traditional cyber
hubs throughout the country to broaden our talent pool.
At Northrop Grumman, we are focused on attracting all those who are
interested and qualify through a sense of mission, passion for solving
complex challenges, and desire to work on cutting-edge technologies
that they are unable to do anywhere else in the world.
partnering with the federal government and dhs cyber training
In 2012, I had the privilege of participating in the Homeland
Security Advisory Council Task Force on CyberSkills, an initiative that
was launched to help develop a National security work force as well as
enable DHS to recruit and retain its own cyber talent. I applaud DHS
for adopting many of the Task Force's recommendations. At Northrop
Grumman, I am pleased to note that we have incorporated the majority of
these recommendations as part of our internal cyber work force
strategy. Members of my team also participated in the DHS Cyber
Education and Workforce Development Working Group and then the NIST
National Initiative for Cybersecurity Education (NICE). Northrop
Grumman representatives are members of both the Collegiate Working
Group and the K-12 Working Group. Our engagement brings industry
perspective in full collaboration with Government and academia. We also
contribute to the NIST NICE Workforce 2.0 model which creates a
framework for professionalization of the cyber career.
Partnering with our Federal Government customers on cyber work
force education and training is critical to supporting a National
security mission and our mutual success. One of the key findings of the
CyberSkills Task Force was the need to provide more cyber training to
DHS employees and I am pleased that Northrop Grumman has helped support
this initiative. Starting in 2014, as part of our National
Cybersecurity & Communications Integration Center (NCCIC) contract, we
began using 39 cyber training courses to help DHS employees increase
their efficiency and improve retention. Our training program heavily
leveraged our internal Northrop Grumman Cyber Academy for a large
portion of the course content and developed a three-level competency
model. Hundreds of DHS employees received targeted training ranging
from how to review cyber threat analysis reports to effectively
coordinating with partners. Northrop Grumman cyber practitioners
provided advice and guidance on National-level cyber security policy as
well as implementation and support of new or existing technical
solutions to enhance the mission. These training plans aligned to Cyber
Skills and Cyber Pay initiatives, with incentives tied to requisitions
and future hirings.
northrop grumman cyber workforce development
Growing a cyber work force from the ground up begins with inspiring
youth to pursue this field. At Northrop Grumman and for our customers,
in working to build a cyber work force, we look at the continuum of
education--from elementary school through the professional ranks--and
are collaborating with academia and organizations world-wide to help
address this issue and build a diverse, highly-skilled work force.
For more than 7 years--Northrop Grumman has partnered with the Air
Force Association to present the CyberPatriot National Youth Cyber
Education Program. CyberPatriot is one of our most successful and
impactful initiatives and features the wildly popular annual cyber
defense competition. It started in 2009 with 8 teams and I'm proud to
say over 4,400 teams participated this past year from all 50 States,
Canada, and Department of Defense Dependent Schools in the Pacific and
Europe. Given the fact that teams average about 5 students, we are
reaching tens of thousands of youth each year who are learning how to
harden and protect computers and networks. A full 87 percent of
CyberPatriot participants go on to pursue STEM degrees in college. In
addition to deep technical skills, the students, through the program
structure, their mentors and hands-on experience, also develop their
talents in cyber ethics, collaboration, communication, and leadership--
all life skills that enhance their career readiness. Northrop Grumman
has awarded more than $350,000 in scholarships to winning teams. Like
others in industry and Government, the company has employed these high
school students as paid summer interns, more than 300 to date, working
side-by-side with our cyber professionals. Many of these interns have
stayed with Northrop Grumman, returning summer after summer for paid
internships through high school and then college. While most STEM
programs report a female participation rate around 12 percent, I am
especially proud that CyberPatriot boasts 23 percent female
participation! None of this could be accomplished without the academic
partner of the program, the University of Texas San Antonio's Center
for Infrastructure Assurance and Security. To that end, we have found
that you cannot only focus on higher education or at the high school
level. In many cases, students have already decided upon their desired
field by the 5th or 6th grade. Therefore, the earlier you can expose
students to STEM topics in an engaging and exciting way as we do with
the CyberPatriot Elementary School Cyber Education Initiative, the
greater likelihood they will pursue a STEM path.
university partnerships
Northrop Grumman is actively engaged with universities across the
country to provide an industry perspective on cyber curriculum and
degree programs to prepare students for real-world challenges. We
helped launch the Nation's first cyber honors program at the University
of Maryland--College Park called ACES, the Advanced Cybersecurity
Experience for Students. ACES is a living learning community for
exceptional students from a variety of majors to enhance their cyber
studies. We've also assisted in creating the Nation's first
undergraduate Cybersecurity Engineering degree at George Mason
University in Fairfax, Virginia. Further, at the University of
Maryland--Baltimore County (UMBC), we are providing grants to students
from diverse academic and socio-economic backgrounds to pursue
cybersecurity education. At great schools ranging from Cal Poly Pomona
to the University of Cincinnati and dozens of others across the country
our employees are actively engaged in helping to develop curriculum,
fund hands-on student projects, and educate future cyber professionals.
diversity
Because cyber is such a complicated and dynamic challenge, we need
a work force that brings with it diversity of thought, culture,
education, experience, and problem solving--diversity drives innovation
and breeds success. Diversity is truly a strategic asset. Working with
university and professional organizations that cater to diverse
populations is a great way to attract cyber employees and build a
stronger, ethnically and racially diverse work force. We partner with
the Society of Hispanic Professional Engineers, Women in Technology,
Women in Cyber Security, and Society of Women Engineers to name just a
few organizations. We need to ensure that young girls, minorities, and
other underrepresented populations recognize that they are welcome and
can succeed in the cyber work force. This past year working with a
small, disadvantaged business located in Baltimore, Maryland we
developed the Cyber Warrior Diversity Program at Morgan State
University and Coppin State University, two Historically Black Colleges
and Universities (HBCU). This training is designed to prepare
individuals to defend information systems and networks by training,
testing, and providing certifications in accordance with the DoD
Information Assurance Workforce Improvement Program. Additionally, the
Northrop Grumman Foundation is funding a 3-year, $2 million program
with the National Society of Black Engineer's (NSBE) designed to expand
the Nation's engineering work force through a partnership with
Historically Black Colleges and Universities (HBCUs). The Northrop
Grumman Corporation/NSBE Integrated Pipeline Program will provide 72
engineering students with $8,000 scholarship grants, internships with
Northrop Grumman and year-round academic and professional development
support. The program's three HBCU partners--Florida A&M University,
Howard University, and North Carolina A&T State University--will
receive grants, technical assistance, and a package of programs
researched and managed by NSBE.
Expanding the diversity of the cyber work force is critical to not
only ensuring that we have a sufficient number of cyber professionals
but also the range of perspectives and backgrounds necessary to counter
a constantly-evolving threat.
breaking barriers
I am honored to be here today representing Northrop Grumman and
proud of our company's efforts to help develop a robust pipeline of
innovative thinkers, engineers, and passionate professionals who will
secure our Nation's cyber future. A few final thoughts to leave the
committee with:
Clearances.--Beyond just a shortage of cyber professionals,
there is also a lack of cleared cyber professionals. We need to
figure out ways to improve the clearance process to ensure that
both the Federal Government and contractors have the cleared
employees to do all the critical National security work that is
required.
More Cyber-Trained Federal Employees.--Cyber training across
the Federal Government is inconsistent. The Federal Governments
as a whole needs to put a greater emphasis on ensuring its
employees have the cyber understanding and tools to effectively
and securely do their jobs.
Increased Partnerships and Coordination.--There is no single
answer to addressing the shortage of cyber workers. Continuing
to work across academia, Government, and industry is essential
to leveraging investments, best practices, and collectively
working together to ensure that our great Nation continues to
securely grow and prosper in this increasingly digital age.
I would be happy to answer any questions and Northrop Grumman looks
forward to working with the committee on this effort.
Thank you again.
Mr. Ratcliffe. Thank you, Dr. Papay.
The Chair now recognizes Ms. Okafor for 5 minutes.
STATEMENT OF JULIET ``JULES'' OKAFOR, STRATEGIC ADVISORY BOARD
MEMBER, INTERNATIONAL CONSORTIUM OF MINORITY CYBERSECURITY
PROFESSIONALS
Ms. Okafor. Thank you, Chairman Ratcliffe, Ranking Member
Richmond, and Members of the House Homeland Security
Subcommittee on Cybersecurity Infrastructure Protection.
I am pleased to appear before you today to discuss the
challenges of addressing the severe people problem that hinders
our ability to address the advancing threat against our
Nation's critical infrastructure.
Technology alone cannot bridge the increasing skills gap
our Federal Government continues to face in recruiting and
retaining highly skilled cybersecurity talent. Similar to the
private sector, it is our belief that the Federal Government
must take a more innovative approach to the recruitment and
retention of our future cyber work force.
My name is Juliet Okafor, J.D., vice president of business
development for Fortress Information Security and Strategic
Advisory Board member for the ICMCP, the International
Consortium of Minority Cybersecurity Professionals. I am the
first black and female employee of Fortress Information
Security, a minority-owned cyber risk, intelligence, and
management start-up based in Orlando, Florida.
Fortress was founded in 2015 by two entrepreneurs who
thought to apply practical business intelligence to address the
most complex and emerging challenges across IT, OT, and third-
party risk management facing the global critical
infrastructure. Our approach for the market, bundling
analytics-enabled security-risk orchestration technology, risk
governance, and the people. It stemmed from the constant
concern reported by CISOs of the world's largest organizations
about their ability to hire skilled security staff to fill
critical technical security roles.
In May 2016, I joined the International Consortium of
Minority Cybersecurity Professionals as the first female co-
chairwoman of the Strategic Advisory Board. I lead strategic
planning and roadmap development for strategic initiatives,
partnerships, and community outreach.
In this role, spend much of my time listening to the
efforts taken by the largest global corporations, small
businesses, and educational institutions regarding building a
talented, diverse, highly diverse, and innovative cyber work
force, and then identifying opportunities, programs, tools, and
processes that we can implement with these enterprises to
leverage and expand diversity-inclusion programs.
The key organizational objectives of ICMCP are, No. 1, to
increase the number of female and minority students pursuing
cybersecurity-related disciplines at both the undergraduate and
post-graduate levels by funding scholarship opportunities;
facilitate the career advancement of existing member
cybersecurity practitioners through mentoring and grants
leading to advanced degrees and/or professional certifications
in the field of cybersecurity; promote public awareness of
cybersecurity and the opportunities for minorities and
underrepresented groups in the profession; No. 4, function as a
representative body on issues and developments that affect the
careers of minority and women cybersecurity professionals; No.
5, establish a mechanism for gathering and disseminating
information toward minorities and underrepresented groups.
In my testimony today, I will highlight the challenges
being faced across the public and private sectors in
recruitment and retention of cybersecurity talent. These
challenges are compounded for diverse populations which face
issues with career investment for existing diverse
practitioners and retention challenges that also exist in
keeping diverse talent once they are recruited.
I will also discuss the efforts and progress made by large
and small enterprises, grassroots and nonprofits, like the
organizations I represent today, and the efforts that they are
making to address the cybersecurity industry's largest and most
critical vulnerability, the human factor.
Our research shows that these challenges extend across
Government and private sector with scarce talent in high
demand, making it even more critical to focus efforts on
increasing capacity.
As noted in the Cybersecurity National Action Plan and 2017
budget, the goal remains to identify, recruit, develop, retain,
and expand the pipeline of the best, brightest, and most
diverse cybersecurity talent for Federal service and for our
Nation.
Additionally, a 2014 CIA Diversity in Leadership Study
commissioned by the director of the CIA, one of the Nation's
largest intelligence and security agencies, said that the lack
of diversity in its leadership ranks is of great concern and
that diversity is critical to the mission.
The agency further stated that a lack of diversity of
thought and experience was identified by Congressional
committees and independent commissions as a contributing factor
to past intelligence failures and that diversity is mission
critical is no longer a debatable proposition, if it ever was.
I thank you for allowing me to speak with you today.
[The prepared statement of Ms. Okafor follows:]
Prepared Statement of Juliet ``Jules'' Okafor
September 7, 2017
Thank you Chairman Ratcliffe, Ranking Member Richmond, and Members
of the House Homeland Security Subcommittee on Cybersecurity and
Infrastructure Protection. I am pleased to appear before you today to
discuss the challenges of addressing the severe ``people problem'' in
addressing the advancing threat to our Nation's critical
infrastructure. Technology alone cannot bridge the increasing skills
gap our Federal Government continues to face in recruiting and
retaining highly-skilled cybersecurity talent. Similar to the private
sector, it is our belief that the Federal Government must take a more
innovative approach to the recruitment and retention of our future
cyber work force.
My name is Juliet Okafor, JD, vice president of business
development for Fortress Information Security and strategic advisory
board member for the International Consortium of Minority Cybersecurity
Professionals (ICMCP). I am the first black and female employee of
Fortress Information Security, a minority-owned, cyber risk
intelligence and management start-up based in Orlando, Florida.
Fortress was founded in 2015 by two serial entrepreneurs, who sought to
apply practical business intelligence to address the most complex and
emerging challenges across IT, OT, and Third-Party Risk Management,
facing the global critical infrastructure. Our approach to the market--
bundling analytics-enabled security risk orchestration technology, risk
governance, and people stemmed from the constant concern reported by
CISO's of the world's largest organizations about their ability to hire
skilled security staff to fill critical technical security roles.
In May 2016, I joined the International Consortium of Cybersecurity
Professionals as the first female co-chairwoman of the Strategic
Advisory Board and chair of the fundraising committee for ICMCP. I lead
strategic planning and roadmap development for strategic initiatives,
partnerships, and community outreach. In this role, I spend much of my
time listening to the efforts experienced by the largest global
corporations, small businesses, and educational institutions regarding
building a talented, diverse, and innovative cyber work force. Then
identifying opportunities, programs, tools, and processes that
enterprises can leverage to expand diversity and inclusion programs.
ICMCP's the key organizational objectives are to:
1. Increase the number of female and minority students pursuing
cybersecurity-related disciplines at both the undergraduate and
post-graduate levels by funding scholarships opportunities.
2. Facilitate the career advancement of existing member
cybersecurity practitioners through mentoring and grants
leading to advanced degrees and/or professional certifications
in the field of cybersecurity.
3. Promote public awareness of cybersecurity and the opportunities
for minorities in the profession.
4. Function as a representative body on issues and developments
that affect the careers of minority cybersecurity
professionals.
5. Establish a mechanism for gathering and disseminating
information for minority cybersecurity professionals.
In my testimony today, I will highlight the challenges being faced
across the public and private sectors in recruitment and retention of
cybersecurity talent. These challenges are compounded for diverse
populations, which faces issues with career advancements for existing
diverse practitioners and retention challenges that also exist in
keeping diverse talent once they are recruited. We will also discuss
the efforts and progress made by large and small enterprises, and
grassroots non-profits like the organizations I represent today,
Fortress Information Security and ICMCP, have made in addressing the
cybersecurity industry's largest and critical vulnerability--the human
factor.
Our research shows that these challenges extend across Government
and private sector, with scarce talent and high demand, making it even
more critical to focus efforts on increasing capacity. As noted in the
Cybersecurity National Action Plan and 2017 Budget, the goal remains ``
. . . to identify, recruit, develop, retain, and expand the pipeline of
the best, brightest, and most diverse cybersecurity talent for Federal
service and for our Nation.'' Additionally, a 2014 CIA Diversity in
Leadership study commissioned by the director of the CIA, one of the
Nation highest intelligence and security agency cited that the lack of
diversity in its leadership ranks is of great concern as diversity is
``critical to the mission''. The agency further stated that ``a lack of
diversity of thought and experience was identified by Congressional
committees and independent commissions as a contributing to past
intelligence failures . . . that diversity is mission-critical is no
longer a debatable proposition--if it ever was''.
the shortages in the cybersecurity work force diversity
According to Frost & Sullivan's 2017 International Information
Systems Security Certification Consortium (ISC) Global Information
Security Workforce Study (GISWS) of over 19,000 information security
professionals globally, across 170 countries, women represent only 11
percent of the total cybersecurity work force despite a projected work
force shortfall of 1.5 million people during the next 5 years due to a
lack of trained professionals. The percentage representation of African
Americans and Hispanics in cybersecurity has been reported at
approximately 12 percent combined, for both these groups. This data
takes on added meaning when we consider the projected growth in the
U.S. minority population over the next few decades where the Hispanic
population is expected to grow to 28.8 percent of the U.S. population
and the African American population is expected to climb to almost 20
percent according to Census data reflecting population growth 2014-
2060.
In a recent USEOC Report, projections for selected STEM occupations
with fast employment growth, projected 2012-22, Information Security
Analysts have a 37 percent projected growth rate (currently 75,100 jobs
annually and 102,500 jobs created annually by 2022), with a Median
Annual Wage in 2013 of $88,590.00. Global Information Security
Workforce Sub-Reports issued by various industry groups (to include
(ISC)2) cite the consistent underrepresentation of African Americans
and Hispanics in STEM careers. Only some 6 percent of STEM workers are
African American compared to an overall 10 percent of the U.S. work
force. Similarly, Hispanics comprise only 7 percent of the STEM work
force while making up 15 percent of the U.S. work force. In the past,
human bias was understood to be largely a conscious and intentional
reason for such gross underrepresentation. New research from the fields
of neuroscience and sociology now suggest that human biases are largely
unconscious and unintentional.
As the demographics of the U.S. population continue to become more
diversified, the importance of increasing the participation of women
and minorities in the work force becomes of paramount concern. Ashley
Tolbert, a recent Information Security graduate from Carnegie Mellon
now working in the Bay Area in Cyber Security Operations, writes of her
experiences as a student, intern, and professional in the cybersecurity
field that ``a lack of diversity and inclusion in the information
security field is one of the foremost impediments to attracting and
retaining diverse talent, which the industry sorely needs. Since
cybersecurity is one of the biggest challenges to our Nation's National
and economic security and we're facing a major talent shortfall in the
industry, strategies to ensure all capable talent regardless of race,
ethnicity, or sexual orientation feel welcome and included is
important.''
This work force shortfall should be of much consternation given
that cyber crime and information theft, to include cyber espionage,
remain the most serious economic and National security challenges that
our country faces. It has also been reported that this under-
participation by large segments of our society represents a loss of
opportunity for individuals, a loss of talent in the work force, and a
loss of creativity in shaping the future of cybersecurity. Not only is
it a basic issue of digital diversity and equality, but it threatens
our global economic viability as a Nation.
the roots of the cybersecurity workforce diversity goes back to our
middle schools and high schools
The work force shortfall and the growing diversity gap in the
cybersecurity industry in the United States also reflects the broader
challenge that the USA faces in science, technology, engineering, and
mathematics, or STEM, programs in our schools. Until we can get more
students matriculating with STEM-related degrees, these challenges
faced within the cybersecurity industry and overall information
technology industry will persist. According to the PEW Research ``Fact
Tank'' Report of International Students in Math and Science, American
15-year-olds were ranked 38th out of the 71 countries included in the
report. The results were only slightly more encouraging for our 8-year-
olds, who were ranked 11th out of the 38 countries included. As a
country, we have to be laser-focused on quality and retention in middle
and high school STEM programs, as these formative years determine the
future talent pipeline for the cybersecurity work force. Strategies and
programs are needed to provide significantly more apprenticeship
opportunities as well as opportunities in colleges and universities, to
include an infusion of Federal resources to support everything from
curriculum and faculty development to tuition support.
Chairman Ratcliffe, our STEM imperative cannot be more urgent for
minority students when we consider the projected growth of minority
populations according to the census data and the reported labor trends
citing the fact that over 90 percent of all jobs by 2030 will require
information technology skills.
the imperatives for grassroots organizations and private enterprises
Nonprofits and educations institutions are tackling the cyber
divide by creating academic scholarship opportunities to attract more
females and students of color into the career field. For existing
minority cybersecurity practitioners, ICMCP is deploying strategic
mentoring programs geared toward fostering the career growth of junior
and mid-level practitioners into becoming the next generation of
executive decision makers. Studies by various groups, have underscored
the importance of work-based learning programs, mentorship,
apprenticeship, sponsorship, and employee affinity groups as key
strategic components of successful diversity and inclusion programs and
employee retention initiatives.
Toward fulfilling these five key organizational objectives, last
year ICMCP was able to accomplish the following thanks to the
generosity of our sponsors,
Awarded 10 Academic Scholarships @$5K
Awarded 5 Certification (average $3K)
Awarded 1 Executive Development ($16K)
Placed 12 interns in cybersecurity positions
Matched 17 Proteges to Mutually-Matched Mentors
Assisted and facilitated the job placements of over one
dozen minority cybersecurity professionals at various levels in
several industries
Implemented the first operational Security Operations Center
(SOC) at an academic institution toward ensuring students
graduate with hands-on skills to augment their classroom
learning.
So far in 2017, ICMCP has already accomplished the following:
Awarded over $100K in academic scholarships,
Awarded at least 10 certification vouchers (ISC2, CompTIA,
SANS, ISACA, IAPP),
Coordinated the placement of 15 interns and 20 job-seekers.
We should also mention our participation in note-worthy and
Government-led initiatives diversity underpinnings also tackling the
``Great Minority Cybersecurity Divide'' which include:
gencyber
The National Security Agency's GenCyber program, co-sponsored by
the National Science Foundation, sponsors cybersecurity summer camps
for students and teachers at the K-12 level. The goals of the GenCyber
program are to help increase in cybersecurity and diversity in the
cybersecurity career field; help students understand correct and safe
on-line behavior and to improve the teaching methods for delivering
cybersecurity content in the K-12 curricula. This year the program
sponsored 130 GenCyber camps and reached nearly 5,000 students and
1,000 teachers across the Nation.
the consortium enabling cybersecurity opportunities and research
(cecor)
The Consortium Enabling Cybersecurity Opportunities and Research
(CECOR) funded by the Department of Energy is a collaborative effort
among 13 colleges and universities and 2 National laboratories to
develop a K-12 pipeline for the cybersecurity work force.
cybercorps scholarship for service (sfs) program
SFS is a program designed to increase and strengthen the cadre of
Federal information assurance professionals that protect the
Government's critical information infrastructure. This program provides
scholarships that may fully fund the typical costs incurred by full-
time students while attending a participating institution, including
tuition and education and related fees. The scholarships are funded
through grants awarded by the National Science Foundation, NSF.
But this is clearly not enough. To make significant progress in
developing and employing the cybersecurity capacity our Nation needs,
we need to be filling over 200,000 cybersecurity jobs annually
according to the Frost and Sullivan ISC2 GISWS Report and to be filling
these jobs with diverse candidates.
diversity wins
Chairman Ratcliffe, several studies have proven that diverse teams
wins and specifically in the private sector, diversity has been shown
to positively impact bottom-line revenues. In fact recent reports are
showing that every incremental percentage point in African American and
Hispanic representation at NASDAQ-listed tech companies is linked with
a 3 percentage point increase in revenues. If the racial/ethnic
diversity of tech companies' work forces reflected that of the
engineering talent pool, the sector at large could generate a 20-22
percent increase in revenue--an additional $300-$370 billion each year.
Companies with above-median Hispanic representation (currently standing
at roughly 5-6 percent of the technical work force) are linked with
annual revenues that are 40 percent higher than companies that fall
below the median in Hispanic representation. The links between African
American representation and revenues were also positive, yet did not
show statistical significance.
There is also a linkage between racial/ethnic diversity and
operating margins--every 1 percentage point increase in racial/ethnic
diversity at a tech company is linked with 0.3--0.4 percentage point
increase in operating margins. Extrapolating to the tech sector
achieving levels of racial/ethnic diversity that reflect the talent
marketplace would be linked with $6-7 billion in additional operating
earnings industry-wide, or roughly a 2-3 percent increase in total
industry earnings.
These links between diversity and financial performance are not
unique to the tech industry--a range of studies conducted in other
industries support them. For instance, research published in the
American Sociological Review found that firms with high levels of
racial/ethnic diversity have more than 98 percent higher sales revenue,
serve over 54 percent more customers, are roughly 33 percent more
likely to have above-average market share, and are nearly 30 percent.
Our analysis is supported from the commercial sector, by the well-
known consulting firm of McKinsey & Company, who conducted a 2015 study
of 366 public companies across a range of industries in the United
Kingdom, Canada, the United States, and Latin America. The resulting
analysis of the 366 companies revealed a statistically significant
connection between diversity and financial performance. The companies
with the highest gender diversity were 15 percent more likely to have
financial returns that were above their National industry median, and
the companies with the highest racial/ethnic diversity were 35 percent
more likely to have financial returns above their National industry
median. The correlation does not prove that greater gender and ethnic
diversity in corporate leadership automatically translates into more
profit--but rather indicates that companies that commit to diverse
leadership are more successful.
conclusion
Mr. Chairman, in closing, there are lots of vital efforts underway
to tackle the problem we have titled the ``The Great Diversity Divide''
and progress is being made. Sadly however, with over 250,000 unfilled
jobs in cyber each year, with the average representation of women in
the cybersecurity industry averaging barely 10 percent for the past few
years, same with the combined representation of African Americans and
Hispanics with 1 or 2 percentage points, there is much more that can be
done and that must be done when we consider the projected minority
population growth and trends in the labor market.
Thank you for the opportunity to testify before you today, and I
look forward to any questions that you have.
Mr. Ratcliffe. Thank you, Ms. Okafor.
I now recognize myself for 5 minutes for questions.
I want to start out by thanking you all again for your very
thoughtful opening statements.
Dr. Chang, I want to start with you because I know in
addition to your prior Federal experience at NSA you are now
essentially on the front lines teaching and educating our
future cyber work force. Therefore so I would like your
perspective on whether working for a larger purpose factors
into whether students will choose to serve the Government. In
other words, does the potential of protecting our homeland and
working at a Classified level, incentivize students and young
people?
Mr. Chang. Yes, I believe it is. I on occasion have the
opportunity to chat with students about career choices, about,
you know, individual opportunities they may seek. It would be
fair to say that for a number of the students they believe that
there is potentially something larger than just salary. Now,
clearly salary will have a bearing, but I did have one
particular student, who, by the way, is a veteran, a former
Marine, the guy is a rock star. He is a terrific cyber
performer. Any company represented here I think would really
enjoy having him. He specifically made the point that for him
and many people that he knows would basically choose mission
over money.
They want to have an impact, they want to make a
difference. They are trained, they are ready, they want to get
in the game. To the extent that they understand that, whatever
organization will allow them and their skills to make a
difference, they would absolutely raise the hand.
Mr. Ratcliffe. Terrific, thank you.
Mr. Montgomery, with so much focus in recent years about
expanding cyber educational opportunities, like we have talked
about and in your opening statement as well, why do you think
the cyber skills gap is getting worse?
Mr. Montgomery. Well, demand. Think about what is under
control of most organizations. They control the number of
people that they can hire. They control the budget for
technology. Another static factor is the number of hours in the
day, that doesn't change. But think about what does change
dynamically. The number of systems that you use in your own
household, for example, rages beyond control.
I remarked to a reporter today I have five more IP-enabled
devices in my book bag today than I did 5 years ago. I don't
see that trend diminishing. So demand, and I don't mean demand
for the skills of the personnel, I mean the demand upon those
personnel themselves.
So if you have these dynamic factors, the number of
systems, the attacks against those systems, the lucrative
nature of cyber crime, the interconnectivity of devices to just
about everything these days, it creates an untenable math
problem that the practitioner can't solve by himself.
So we don't have enough kids coming in, we all know that,
but we are also making the existing problem of the existing
practitioner worse because of the raw demand of computer power.
Mr. Ratcliffe. Terrific, thank you.
Dr. Papay, what programs have you found to be most
effective for your company's recruiting and retention efforts?
Are there metrics at Northrop Grumman that are used to judge
the success and failure of recruitment and retention programs?
Obviously, one of the purposes of this is that we are
trying to learn from some of the private-sector best practices
and whether or not those can apply or should apply in the
Federal sector.
Mr. Papay. Thank you, Mr. Chairman. So we approach the
problem just like any other business would. Where do you want
to spend your money? Where do you want to invest your time and
energy in looking at, first of all, the recruiting side and
then on the retention side. So let me just give you a few
numbers, like, some metrics that we look at for Cyber Patriot,
for instance.
If we look at the Cyber Patriot participation of the
students that are coming in there in the middle schools and
high schools, about 87 percent of the kids that are in that
program go on to pursue a STEM degree in college. That is a
pretty good number.
Then you look at how many of those kids go on and get a
college degree and come to work at big companies or go work for
the Government, then how long can you keep them with the
company? So we look at numbers, like, something like a 92
percent of those kids that come out of the Cyber Patriot
Program and then come in to work for Northrop Grumman as an
intern or as a summer hire, about 92 percent of them come back
again and stay and either continue their education or continue
their career with us or both.
So you have got to think about where you want to invest
your money and where you want to spend the time. I think the
Federal Government can look at that like a business.
Mr. Ratcliffe. Terrific.
My time is expired.
The Chair now recognizes the Ranking Minority Member for
his questions.
Mr. Richmond. Sure.
Dr. Chang, I will just start with a comment where you are.
So if you look at SMU, whose tuition is, give or take,
somewhere around $45,000 a year, not including room and board,
the demand upon students as they come out of college now, the
financial demand is a serious obstacle as we talk about--maybe
somebody has a solution for it. Who knows?
So the question becomes, and I think that you are right
when you start talking about supply and demand and you start
talking about the overall good of the country, demand is so
high right now, whether you are talking about Samsung and a
refrigerator that hooks up to the internet of things or you are
talking about my sous vide device where I can cook over wifi in
my home while I am here in the District of Columbia and it is
in New Orleans.
So the demand is very extraordinary, which then the supply
is still limited and it is going to be limited for a while. So
the question I have is, as Government, how do we think outside
the box? How do we do things in a creative manner to create
some capacity? How do we compete for those students who have a
number of challenges that they have to deal with?
Just as a side, do you know any State or local governments
that are doing a good job at retention or recruitment?
Mr. Chang. I will offer a couple of thoughts. So I think
there is sort-of this notion of top-down and bottom-up. So the
bottom-up perspective basically says when students graduate
they kind-of know and follow where the other students go. So if
they join a company or an organization and the students say,
hey, that is a really great place, come join me, they sort-of
keep track of each other. So there is this sort-of bottom-up
perspective that if you get some number of students, they may
attract some others.
I think there is also sort-of a top-down perspective as
well that says if DHS, for example, were able to recruit a
really big-name cyber professional, that would be a little bit
of a magnet for some other students. So I think maybe some
Fortune 500 CISO or something like that or some big name out of
Government, I do think the students would say, gosh, that is
somebody I admire, that is somebody I respect, somebody I can
learn from, might be an interesting strategy as well.
Mr. Richmond. Anyone else?
Ms. Okafor.
Ms. Okafor. Thank you. I believe that cybersecurity has a
branding problem. One of the biggest inhibitors in my
conversations with students and practitioners looking to enter
the field from non-IT-related industries is that it is mostly
military or it is seen as highly technical with penetration
testing. It sort-of in some situations lacks the kind of cool
that I think a lot of millennials are looking toward when they
are looking to build out their career.
Then when you talk about the Federal Government and you
think about some of the issues that we are facing in society
today, some people are reticent to enter something that both
seems very, you know, sort-of situated around military and then
institutionally-based.
So one of the things that I noticed is, a number of years
ago when I, and I won't share my age, but when I was growing
up, I saw a number of commercials as a young black woman who
grew up in Brooklyn about the military and the benefits the
military had very early on. For a commitment up front, you got
a lot on the back end. I think cybersecurity needs to really
start to broaden its awareness of the opportunities in it and
get people to invest in the mission very early on.
That will then allow them to, as they are being sort-of
approached by other industries, it is not just the money
because they are aware of what the benefits are and they also
understand what the task is that they would be a part of. So I
think that would be much more helpful with regards to the
branding issue I see.
Mr. Richmond. Thank you. I guess just from my perspective,
and you all can just tell me if you agree, part of it is just
that when you work for Government it is so rigid. When you are
in the cybersecurity space or really coding space or whatever
you want to call it, you know, the days of wearing a suit, the
days of all of this structure are really going away because
people have the ability to work anywhere and work in any kind
of environment.
Are we perpetuating our own barrier by our traditional
means of how we think about the workplace as opposed to what
technology offers?
With that, Mr. Chairman, I will yield back.
But, you know, a yes or a no or a sentence would help.
Mr. Papay. Yes. I will expand a little bit. One of the
things that I think, and to Ms. Okafor's point, cyber doesn't
know boundaries, it doesn't know buildings, it doesn't know
facilities, it doesn't know data centers, it doesn't know
anything. It knows where the demand is. So the notion of going
to this same cube to work on something that affects someone in
Ohio versus Montana versus Texas, it is a little bit at cross
purposes, absolutely.
Mr. Ratcliffe. All right.
The Chair now recognizes the gentleman from Rhode Island,
Mr. Langevin.
Mr. Langevin. Thank you, Mr. Chairman. I want to thank you
for holding this hearing.
I want to thank our distinguished panel for being here. I
appreciate the contributions that each of you have made in your
own right to advancing the field of cybersecurity.
So, Mr. Chairman, in March, NICE, National Initiative for
Cybersecurity Education, issued a request for information on
scope and sufficiency of efforts to educate and train the
Nation's cybersecurity work force. I responded to highlight
several areas that I hope that they will focus on.
I ask unanimous consent, Mr. Chairman, if I could, that the
letter that I sent to be included in the record as context for
my questions for this distinguished panel.
Mr. Ratcliffe. Without objection.
[The information follows:]
Letter From Hon. James R. Langevin
August 1, 2017.
Ms. Danielle Santos,
Cybersecurity Workforce RFI, National Institute of Standards and
Technology, 100 Bureau Drive, Stop 2000, Gaithersburg, MD
20899.
Dear Ms. Santos: The National Institute of Standards and Technology
has requested information on the scope and sufficiency of efforts to
educate and train the American cybersecurity work force of the future.
Investment in our nation's cybersecurity work force is crucial to our
national and economic security, and I write to applaud NIST for its
efforts in this matter. While we often focus on the technologies that
result from research, it is at least as much the skilled work force
behind the breakthroughs that drives our country forward.
Unfortunately, we are far behind where we need to be. Within the
cybersecurity work force today, we have hundreds of thousands of jobs
unfilled, thereby limiting our ability as a nation to respond to the
malicious actors who daily target our infrastructure, finances, and
intellectual property. We need short-, medium-, and long-term solutions
that reach all components of the educational pipeline from K-12
education to university programs to certifications. We also need to
explore retraining and apprenticeships as ways to infuse additional
talent into the field.
In order to properly understand the scope of the challenge, it is
crucial that NIST applies measures and metrics to the cybersecurity
work force, and I was pleased to see their inclusion within the
request. As a nation, we must analyze the expected demand for
cybersecurity personnel, the efficacy of training programs in producing
skilled workers, and the ability of our educators, both in number and
in capability, to instruct students. Furthermore, we must share across
our communities the lessons and best practices learned from these
studies to ensure that students throughout the nation have access to
the best cybersecurity education possible no matter where they live.
Additionally, the dynamic nature of technology development ensures
that even our best-laid plans will require adaptation as innovative
technologies come on the market. This is perhaps one of the most
significant challenges that we will face in shaping tomorrow's work
force, and it will require novel approaches to training. The emerging
use of artificial intelligence to assist cybersecurity tasks, for
example, may dramatically alter the tasks of a computer and network
security engineer in the coming decades. Similarly, the rapid growth in
connected devices may create new classes of cybersecurity professionals
focused on the unique challenges posed by the Internet of Things. We
must prepare our work force for this future while also preparing them
to be adaptable to the disruptions that we expect but cannot predict.
Only by continuing to invest in our skilled work force will we be
able to ensure our nation's continued security and prosperity in the
digital economy. This request for information is a positive
contribution to understanding where the work force is today and what we
must do in the future. I thank you for your leadership on this issue
and I look forward to the results of your request.
Sincerely,
James R. Langevin,
Member of Congress.
Mr. Langevin. Thank you, Mr. Chairman.
So to the panel, in all of your testimony, you point out
that there is a strong demand signal for more cybersecurity
workers. Yet, and you in particular, Dr. Chang, can appreciate
as one of the members of the CSIS task force with me and
Chairman McCaul, and I thank you for your work there, but
understand that this is not a new problem. The demand signal
really has existed for well over a decade now. One of the
biggest challenges that policy makers have faced, in my view,
is figuring out why there really hasn't been more of a market-
driven response to the shortage.
So based on your experiences, why has the cybersecurity
work force gap lagged behind the broader computer science gap
which has seemed much more responsive to the growing demand for
software engineers?
Mr. Chang. Yes, so a couple of things. So I think it is
very thoughtful when you make a comparison between
cybersecurity and computer science. The field of computer
science as a major has been around for many years now, as you
know. In terms of a specific discipline for cybersecurity, it
is very new.
It seems to us that we have been sort-of thinking about
cybersecurity for a very long time, but as a discipline
distinct from computer science, computer engineering,
information technology, it really is very new. So as students
begin taking some of these programs from these different
universities, they are not getting the same thing.
I mention in my testimony the idea that when universities
begin building up their cybersecurity programs there really
needs to be a common curricular guidance so that everybody
basically says cybersecurity is kind-of the same thing. Because
right now it is a little bit of a mix-and-match and so you
will, you know, you will get a major or a minor or a
certificate or something, but you are not getting quite the
same thing.
So it is, you know, still a little bit of a new thing. I
think it is now public awareness has raised, but it is still
basically a pretty infant discipline.
Mr. Langevin. Thank you.
Mr. Montgomery. I would agree, and I don't want to sound
like a broken record, but it is demand. It is demand. The
demand for practitioners has far outpaced the ability for the
educational system to deliver because we have changed
everything. You didn't buy anything on your telephone 10 years
ago. Many of us didn't buy anything on the internet 10 years
ago. Many of us didn't have broadbands to our house 10 years
ago. Certainly, no one had an internet-connected refrigerator
or television 10 years ago.
So it is absolutely that I don't think that it is a lack of
interest or a lack of programs. I don't think it is a lack of
educational institutions offering education. I think it is
nascent from the cybersecurity as a discipline standpoint, but
we simply have far more demand than our ability to fulfill and
that will worsen as more devices are IP-enabled. The Patriot
Missile has an IP address while it is in flight. That is going
to get worse before it gets better.
Mr. Papay. Congressman Langevin, if I may agree with Scott
here for a second, I know it doesn't happen often, the demand
is building up because all of the things that are out there
that are legacy systems as well are now possible attack
targets. So you even think about DHS's mission, not just one
from a responsibility to provide information out to businesses
and Government organizations through US-CERT, but also the work
that DHS does in TSA and CBP, all those are opportunities for
people who are cyber-trained to become part of DHS's mission
and protect the systems that DHS delivers for our Nation. So
the demand may be even more than we see up front because of
that number of legacy systems that are out there that need
protection.
Mr. Langevin. Thank you.
Ms. Okafor. I would add a caveat that it is not the demand
itself, but the lack of response to the demand, meaning we are
not changing fast enough with regard to the systems that we
have in place.
For instance, the Ranking Member talked about, you know,
sort of the rigidity of the Federal Government. I am often
concerned with the kind of education that exists to prepare
people for a cybersecurity job. You need more hands-on
learning. But often, you are still seeing these certificate
programs come up that teach using just books.
So what happens? They graduate school and then it becomes a
company's responsibility to invest in training the work force
to actually start on Day 1. So there is a gap there because
organizations are not quickly responding, due to bureaucracy or
politics, to the demand of the new work force.
Then finally, we talk about technology as an enabler, but I
want to talk about the fact that technology is engineered by
people. Unless we address the fact that people still continue
to have unconscious bias and are reticent to change and,
therefore, it is impacting our ability to hire quickly enough
to bring on the right people to address the demand. Thank you.
Mr. Langevin. Thank you.
I know my time is expired.
I thank all of you for your insights into this. I just, you
know, I just see the, you know, the fact that, you know,
computer scientists are learning new language, new things are
being coded. I mean, the web programming languages are new and
apps have only existed for a decade, but, you know, there are
plenty of app coders, but we don't see enough market demand
moving into cybersecurity, I would say, filling those roles.
So we have a couple hundred thousand openings right now in
the cybersecurity field and we just don't--it doesn't seem like
that is migrating enough in terms of training enough people in
that field, so it is a challenge.
But I know my time is expired. I yield back. I will perhaps
have some questions for the panel that I will submit for the
record. Thank you.
Mr. Ratcliffe. Advise the gentleman I intend to have a
second round if you are interested in staying around.
The Chair recognizes the gentlelady from Florida, Mrs.
Demings.
Mrs. Demings. Thank you so much, Mr. Chairman.
Thank you to our witnesses and welcome.
Particularly to you, Ms. Okafor, who comes from my home
town.
What a very interesting topic. I want to thank our Chairman
and Ranking Member for it.
Mr. Montgomery, I would just like to go back to what you
were saying about demand. You know, I spent a lot of years in
law enforcement and we used to talk a lot about being proactive
and not reactive. DHS was created 17 years ago or so to change
the way we do business. So did we just not see the demand
coming? Or did the internet exceed our wildest dreams?
Mr. Montgomery. Can it be both? If I had told you when
homeland was founded what you would be able to do from the
confines of your pocket and your phone, would you have believed
it?
I believe that the pace of technology has accelerated so
dramatically in the last 20 years so much faster than the prior
200, the things that we do and take for granted today, they
simply didn't exist 10 years ago, 15 years ago, 20 years ago.
So I think it is we are always going to err on the side of
availability and progress. There is definitely contention
between availability and progress and security and privacy. The
practitioner's first job is to say no, you can't do that, it is
new, I don't understand it yet. But what do we say as
consumers? Hey, I just need it to work. So there is definitely
contention.
I don't think the Government missed the boat or missed the
size of the problem any more than anyone else did. It is simply
a question of the pace outpacing our ability to respond. I
don't think that is a Government issue, I think that happens in
every organization, whether they are in the private sector or
not.
Mrs. Demings. You also talked about a shared work force, if
you will, combining a private and public sector employee to do
both jobs. I think the pros of that are very, very obvious.
Could you talk about some of the cons of having that kind of
work environment?
Mr. Montgomery. Well, certainly clearances and the
clearance process make it trickier for certain systems to be
protected. But let's face it, the overwhelming percentage of
systems and the overwhelming percentage of data are
Unclassified. Certainly, as the Department moves toward the
cloud and embraces that economy of scale like everyone else,
that rotating work force could be relegated to the cloud
management aspects which are more public. So I think there are
ways to offset sort-of the recurring nature or the temporary
nature of workers by simply relegating them to more
Unclassified roles.
I see tremendous benefit in that a private citizen may not
understand what the word ``mission'' means until they are
exposed to it. I am a software engineer by background, but my
own exposure to the word ``mission'' came with involvement in
the Department of Defense. I take that word more seriously now
than I did when I was a kid in the cube. I think the same thing
could be said of these cyber partnerships between the private
and public sector.
Mrs. Demings. Thank you.
Ms. Okafor, in a study that was done this year involving
women who had worked or working in cybersecurity, over half of
them reported that they had been discriminated against in some
way. You certainly talked about being a first on more than one
occasion. I would like to hear about your own experiences of
discrimination within the field and hear some more about what
recommendations you would make for employees in the private and
the public sector to create an environment that is more
conducive to recruiting women and other minorities.
Ms. Okafor. I would be happy to share. So it is, you know,
it is not easy to be the first black woman, but I wear it as a
badge of honor. The biggest areas of discrimination I face
tends to be overt. There is a subtlety mostly of a suggestion
that I perhaps don't know what I am talking about or perhaps
need to be explained.
I find often that I need my male coworkers to vouch for
some of my big ideas, unlike some of my male counterparts. So I
can't say that in my experience I have faced anything that
would sort-of, you know, touch anything near some more overt
forms of racial discrimination, but there are lots of
conversations that I am not included in because lots of the
dealing happens after hours in places that perhaps they don't
think I would perhaps be welcome.
So what I suggest for organizations is really starting to
question itself. I talk a lot about organizations conducting
both third-party and self-assessments of the culture. The
culture of an organization is critical, not only with regard to
who they are hiring and who is in the organization, but also an
unhappy, unproductive work force cannot be a secure work force.
So those two are linked; and therefore, an organization
needs to understand how it treats its employees, how it is
perceived by the market with regard to attracting employees and
then ensuring that they give opportunities for women to be seen
as having the right frame of mind, the right thoughts on big
projects, to have executives that they can see as being perhaps
an ideal that they could perhaps reach.
So I feel like you can no longer separate the need for
diversity of thought, gender, racial diversity without also
saying that without doing that you are impacting directly the
ability to secure the organization, secure the Nation. Thanks.
Mrs. Demings. Thank you so much. I am out of----
Mr. Montgomery. I am sorry, if I can just add briefly.
Mrs. Demings. OK, please go ahead.
Mr. Montgomery. I can't agree enough. No insider threat
starts their career as a threat to their organization. It is
through cultural pressure, cultural unhappiness. We have seen
this at TSA on the front lines. No one starts unhappy. It is
their environmental pressures that create insider threat, so I
totally agree on checking your culture and reassessing from
time to time.
Mrs. Demings. Thank you so much.
Thank you, Mr. Chairman.
Mr. Ratcliffe. The Chair now recognizes the gentleman from
New York, Mr. Katko.
Mr. Katko. Thank you all for being here. I constantly hear
from my constituents back home about this issue, about the
whole cybersecurity issue. They are terrified. Getting it right
is critically important.
I have really got to commend both of you for the last
colloquy you had because it is really important to have the
discussions. You can't make change until you identify the
problem. Once you identify the problem, then you can address
it. So I encourage you to continue to speak up and let us know
how we can help, if in any way. So it is a very important issue
and keep it up.
But, Dr. Montgomery, I want to talk a bit about the public/
private-sector cross-pollinization I call it, pollination,
whatever we want to call it. I am very interested in that. I
think it is something that can be a very dynamic thing. I am
also interested in how we can better expand that and better
utilize that moving forward as a way to get people from both
the Government sector and the private sector get on the same
page more instead of having this more stratified relationship
that we have now.
So would you like to comment on that a little bit? I would
like to have others as well.
Mr. Montgomery. Sure. So first and foremost, having some
industry influence inside the confines of Government is never
going to be a bad thing. Exposing permanent Government
employees----
Mr. Katko. So what you are saying is people in Government
don't always know everything that is right for industry?
Mr. Montgomery. I would never say it that way specifically.
Mr. Katko. That is shocking.
[Laughter.]
Mr. Katko. Well, I am, I am telling you that is why we want
to do it.
Mr. Montgomery. But I think that sharing of ideas, there is
certainly process in the Government that has to be observed
with respect to data classification. But beyond that sort of
rigid wall, the whole reason that enterprise works and industry
works is because it is allowed to try to solve problems more
creatively.
The other thing I think that helps a lot with respect to a
visiting work force, so to speak, is the diversity of that work
force itself. Many of them will be returning veterans whose
experience in the most difficult places on earth lends itself
pretty well to crisis situations in a civilian organization as
well.
But if you think about visiting professionals, you may wind
up having all sorts of diversity, whether it is racial
diversity, whether it is more women in the workplace, but that
constant influx of new ideas is how problems get solved.
Cybersecurity is almost, when you look at the highest ends
of the practitioners, it is almost more like an art than a
science and it takes a lot of different points of view. Right
now, we don't have enough points of view, including more people
who aren't necessarily, ``cyber practitioners'' to be some of
these rotating personnel who will sharpen the ideas of the
cyber practitioners, being exposed to those ideas in the cyber
workplace.
I can't say enough about how this will help spur new
thinking, both in the private sector as well as the public
sector.
Mr. Katko. The Department of Homeland Security has just
secured its first loaned executive, as they call it. I think we
need more. I say that because even in my subcommittee which I
chair, the Transportation and Protective Service Subcommittee,
we now have a Secret Service agent that is detailed to us. He
is giving us a totally different perspective on the Secret
Service side of things.
So I totally agree with it. Now you see a lot of colonels
come through here and they do their time, if you will, on
Capitol Hill before they become a general. They have to
understand how this place works if they are ever going to be
able to be effective at their jobs as a general for the most
part.
So I would like to hear from you all, not just that it is a
good idea. How can we expand it? What can we do better with
that? What would you suggest we do?
Go ahead, Dr. Papay, you want to try?
Mr. Papay. Sure. So one of the things that as you are
facing this big demand, a shortage of people, we are never
going to fill the gap by just continuing to funnel new kids in
the bottom. You are not going to get to 1.8 million jobs in
2022 doing it that way. So the importance of information
sharing now becomes clear in our role as cyber defenders. I
share information on a tactical level and a strategic level
with both my defense industrial base partners and the
Government counterparts.
We need to adopt a much more broad information-sharing
approach that takes advantage of the fact that my folks now
don't have to find every threat targeted at my company because
somebody else over there found that threat first, let me know
about it, and I put it in automatically, automatic information
sharing, I am up, I am good, and I am protected. So I think
scalable solutions are the key and information sharing is one
of those.
I don't think we realized it at the time when we were
thinking about, hey, we have got to get information sharing
more broad. It is a scalable solution that helps us solve that
gap.
Mr. Katko. Ms. Okafor.
Ms. Okafor. I would agree with him. Two of the examples
that I have seen that work really, really brilliantly is when
you have the public and private sector actually collaborate
around a goal. I have seen cyber exercises in particular
industries, so, for instance, maritime security via U.S. Coast
Guard. They have been doing these exercises all across the
country where they are inviting U.S. Coast Guard cybersecurity
professionals in addition to industry and they are actually
doing exercises together. So they can each come to the table
with what they know and actually solve a problem.
I have also seen this done with GridEx, which is an
initiative led by the Department of Energy, and all of the
energy companies who are naturally sharing information, they
come together to work to do tabletop exercises, cybersecurity
workshops, and this is an opportunity in a much more informal
setting to actually have a real conversation.
I think the problem with the public and private sector,
they speak different languages. Oftentimes in these very rigid,
hierarchical structures, people are not willing to share. So
these are some of the things I have seen in real life that
actually have people leave and they feel much more enlightened
than they started.
Mr. Katko. Thank you.
Dr. Chang, anything?
Mr. Chang. Yes. I will mention information sharing, though,
in a different way. So at our university, there is a security
group where students meet on their own time voluntarily once a
week to basically share information with each other. You see
that they are exploring different career options.
One of the sessions they have is to basically bring
companies in to kind-of describe what those companies do. So
when you are a student, maybe you have heard of Google or
Facebook or Microsoft or something, you probably haven't heard
of DHS or TSA or, you know, Customs and Border Protection or
something.
So the extent to which students find out that, gosh,
working at this particular organization has a really cool cyber
mission, they just wouldn't know. So the extent that you can
kind-of get the word out there I think would be quite
appealing.
Students really do, they are sponges, they are soaking it
up. So they actively seek information. If the word got out
there a little bit more that there is an interesting cyber
mission, that would be helpful.
Mr. Katko. It just seems to me that a great way to do it is
with cross-pollinization. I hope we can continue to expand
this. If there are ideas you think about later of what we can
do to incentivize that or do something, it should go both ways.
I mean, we would want people from Capitol Hill to come work
in industry for 6 months and see that side of it as well. It
would definitely give them a different perspective, especially
as the pay disparity between the two, so maybe that is not such
a good idea.
[Laughter.]
Mr. Katko. But it is very, very important. I encourage you
all to partake in it as best you can. We are going to endeavor
to do the same.
With that I yield back, Mr. Chairman.
Mr. Ratcliffe. Thank you.
The Chair now recognizes the gentlelady from California,
Ms. Barragan.
Ms. Barragan. Thank you, Mr. Chair.
I represent a majority minority district. It is about 75
percent Latino and African American. I recently read a report
that said only about 12 percent of the information security
work force was made up of African Americans, Asian Americans,
and Latinos. What is the cybersecurity industry doing to ensure
a more representative work force?
Go ahead, you want to start?
Ms. Okafor. OK. So yes, the fact you stated is completely
correct. The activities are disparate, and I think that is part
of the problem is not a lot of the organizations are working
together. But what we are seeing from the large organizations,
like a McAfee, like Google, Facebook, what they are doing is
most recently Google actually put a new Howard University
campus on its campus in order to start to raise awareness of
minority students about the opportunities at Google.
What we have also seen is a rise in those organizations
sponsoring HBCU programs, doing college tours that take into
consideration HBCUs and primarily Hispanic-serving
institutions.
What they are attempting to do is, instead of expecting, as
in the past, that minorities and women find them, they are
actually going out into those communities and using the
channels that they know those communities actually look to for
additional information.
What they are also trying to do is sort-of broaden overall
awareness with, you know, sort-of social activism, things that,
you know, that represent strongly with women, taking part in
some of the urban community events that they might not
typically be seen.
Then more than anything, actually doing career days where
they are having their employees go on-site, do either lunch-
and-learns that I have seen or they are actually doing
workshops with some of the students just to talk to them about
the opportunities.
So the activities have not been combined and I think that
might be part of the problem. But what I have seen is a
frequency, an increasing amount of frequency in the activities
that they are conducting.
Ms. Barragan. So the district I represent also is a very
low-income community. Median income is about $44,000. Only
about 11 percent of students go on to college. So everything I
am hearing is having the word ``college'' in it, you know, on
colleges it is happening. You are telling me, you know, a lot
of college tours. What about the students who don't want to do
a 4-year? What kind of opportunities are there for them in this
work force? What can we do to make sure that they are not left
out?
Before I let you answer, you know, I used to be on a
council in a very affluent city called Hermosa Beach. They had
something called UCode, and you could sign up as a student and
you could go after school. It was not--it was expensive. Even
people there said it was not affordable. You don't see anything
like that in Compton or Watts where I represent. Certainly, it
would be very challenging for people there to send their kids
to something that is so expensive. So what can we do to make
sure we don't leave these communities out?
Mr. Papay. So, ma'am, another great example of that is a
partnership we just started with the National Society of Black
Engineers where, like you say, you reach out to them through
these societies where you can reach a larger population. This
is a--it is an integrated pipeline program to provide 72
engineering students with $8,000 scholarship grants at
historically black colleges and universities.
You don't have to go to a 4-year university to get into the
cyber program. You know, we are hiring kids in high school and
getting them started that early. Then if they want to stop
after 2 years and then work on some certifications, that is
what you need to get started in cyber.
Then you continue and if they are interested and they want
to go on for a further degree, great, we will support that. But
you have got to reach in to them early and say here is an
opportunity for a scholarship. If you don't have a lot of
money, a great chance to go to a school nearby and get started.
Ms. Okafor. Also, the idea of the lack of, you know, either
the pipeline or the lack of ability to track talent often comes
down to dollars and cents. The digital divide is a big issue
with the number of minorities and Latino students not having
the same access to technology at a younger age as some of their
white counterparts or white peers.
So a number of institutions, like Symantec, they are
donating some of their technology to schools in areas with
primarily underrepresented groups. I have seen that quite a
bit.
The other thing that I am seeing is a rise in the number of
apprenticeships that are available to either students of
vocational programs and junior colleges or high school students
who demonstrate an ability to pass a certain criteria or a
test.
In doing so, what they are doing is building loyalty to the
organization early on, but they are also creating hands-on
learning that will allow them to be ready on Day 1 with the
organization making the initial investment in that talent and
saying we think you are important enough to invest our money
and our resources to train you.
So there is a preponderance of apprenticeships, hands-on
learning programs, internships that are focusing on junior
colleges, community colleges, and also vocational institutions.
Ms. Barragan. Great, thank you.
I yield back.
Mr. Ratcliffe. Thank the gentlelady for coming to our
subcommittee hearing.
I am going to exercise my discretion as the Chairman to ask
a second round of questions, and I invite any Members that want
to do that and I will recognize you as well, really for the
purpose of asking one question.
I think we have had a great discourse on some of the areas
where we need to focus, some of the solutions. But with respect
to the overall goal here, assisting the Department of Homeland
Security in accomplishing its cyber mission, I want to make
sure that I have given each of you the opportunity to highlight
the most important and the most immediate steps that you think
DHS can take to mitigate the shortage of cybersecurity workers
at the Department.
I know, Mr. Montgomery, that you have identified the
CyberCorps, expanding that as one of the things.
It is not intended to be redundant, but I want to make sure
that we have captured everything valuable that you all might be
able to relate to us.
So I will just go down in order and start with you, Dr.
Chang.
Mr. Chang. OK. So as I mentioned, occasionally I have
conversations with students about career choices and so forth.
I expressly put to them the question, if you were motivated to
work for the Government, what do you think?
So the organizations that kind of rose to the top for them
were NSA and FBI. One student actually mentioned that they had
watched ``CSI: Cyber'' on TV and thought that was really cool,
so I don't know how many other students watch ``CSI: Cyber''
but, you know, maybe that sort-of rose, you know, created a
little bit more demand for FBI. So I think it is really
important, again, to kind-of raise awareness.
Another thing that comes up, and I think this is important,
the students come out of school at the top of their game and
they are technically really sharp, they kind-of, you know, want
to stay sharp. If they thought that they would move to an
organization that weren't using the best tools, that didn't
have the best people, they would be less motivated to go there.
So I would really encourage the idea that it is a place
that is, you know, sort-of at the leading edge, you get to work
with really cool people, it has got a great mission. These are
some of the thoughts that students have.
Mr. Ratcliffe. Terrific. Thank you, Dr. Chang.
Mr. Montgomery. So two things I think that are immediate.
No. 1, I would echo Dr. Papay's comments on information
sharing. If there is an incident at CBP and it is a system that
exists in every other portion of the department, CBP should
automatically share that information to the rest of the
Department, it shouldn't be a discussion, it shouldn't be a
committee, it shouldn't be tabled, it should be automatic.
So if a system is attacked, we know the root cause, we know
how to protect against that particular attack. All of that
should be made available to the rest of the Department
immediately, automatically, without anybody having to touch it.
There are ways to do that and they don't actually cost that
much, they are actually free, so employ them.
The second thing I would say is, we talk about the math
problem, there is a finite number of people, there is a finite
amount of budget, 24 hours in the day. So anything that reduces
the labor on those practitioners has to be employed. The public
cloud is part of this, right?
So let us say a system, to secure a system takes one
practitioner 10 hours, just making this up. By contracting with
a public cloud provider or a hybrid cloud provider like
Northrop, the amount of labor that the practitioner has to
spend goes down to only 4 hours because the cloud provider is
providing 6 hours of that labor, you have to employ those
techniques. You are not going to get more workers, we already
talked about that, so you have to reduce the amount of labor.
How do you do it? Automation, information sharing, cloud
technologies.
Mr. Ratcliffe. Thank you.
Dr. Papay.
Mr. Papay. I think if I could make one additional
recommendation, it would be for the new administration at DHS
to go back and look at that 2012 Homeland Security Advisory
Council Task Force on Cyber Skills report where we laid out 11
recommendations, and refresh it a little bit, look at it again
with a new eye and say, hey, that was 5 years ago, how many of
these are still valid, how many of these haven't we done,
should we pick up a couple more and really push, because that
was a lot of effort by a lot of people across academia and
Government and industry to participate in that.
Mr. Ratcliffe. Terrific.
Ms. Okafor.
Ms. Okafor. One of the things I think is a key way for the
public sector to benefit from the private-sector ingenuity and
innovation is USA Jobs. I myself have taken the steps of trying
to apply for jobs in the Federal Government and found a job in
the private sector. So I can imagine that there are lots of
people who perhaps would be interested in working for the
Government who just are daunted by the process.
You know, if anything, Google, Facebook, you know, the
McAfees and the Northrop Grummans of the world, they have
figured some of that stuff out, we don't have to reinvent the
wheel. So why not use some of that work that has already been
done? So we don't have to completely innovate, we are just
enhancing some of the things we know have already been done.
So I would say I do believe that there is some of this that
could be focused on technology, but easily the private sector
could help with some of the hiring practices through the system
currently existing. Thanks.
Mr. Ratcliffe. Very good.
Would the gentlelady from Florida like to be recognized?
Well, very good then.
I really want to thank the witnesses for your insightful,
thoughtful, and frankly, very valuable testimony today.
I also want to thank the Members for their questions.
Members of the committee may have some additional questions
for some of you and we would ask you to respond to those in
writing.
Pursuant to committee rule VII(D) the hearing record will
be held open for a period of 10 days. Without objection, the
subcommittee stands adjourned.
[Whereupon, at 4:32 p.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Questions From Chairman John Ratcliffe for Frederick R. Chang
Question 1a. It seems right now that we are waging war against
criminals who would hack our systems, and the role of the cybersecurity
professional is one of defender. Do you foresee technical solutions
that could perform the work that cyber defenders do now?
Answer. I believe we will see continued innovation and investment
in technologies that aim to assist the human cyber defender. As was
discussed in the hearing, the cyber skills gap is large and growing, so
to the extent that technological breakthroughs can be achieved to
assist existing cyber defenders would potentially be of great value. In
my written testimony I briefly referenced the recent DARPA Cyber Grand
Challenge. The goal of the Cyber Grand Challenge was to explore the
possibility of actually automating the complex tasks of: (A)
Identifying a vulnerability in software, (B) creating a fix (or
``patch'') for that vulnerability and then (C) implementing that patch,
in real time. These are complex and time-consuming tasks to perform for
a human cyber defender. The result of this Cyber Grand Challenge
demonstrated the progress that could be made in automating these tasks.
This was an important and significant result. Did the technology
perform at the level of the human experts? No--but the results that
were achieved are a positive sign about the sorts of advances that
might be possible over time.
The technologies of artificial intelligence and machine learning
have been around for decades now but in recent years we have seen some
important advances in how these machine learning (deep learning)
technologies can assist us in everyday tasks (e.g., visual pattern
recognition, language processing). We will see increasing efforts to
incorporate these sorts of technologies to assist the human cyber
defender. At a very general level the idea would be to have computers
process large data sets in an attempt to detect suspicious behavior in
the data--in a way that a human might not be able to detect. Its clear
why techniques like these will be pursued: (A) Limited numbers of human
cyber defenders, (B) growing amounts of data to analyze, (C) the
criticality of proactively stopping the attacks before they compromise
a network or system. The techniques are far from perfect, but important
progress is being made. We are also seeing these and other sorts of
technologies being positioned on the inside of networks, again with the
intent of detecting anomalous behavior and taking action rapidly. At a
much more general level, I am bullish on human innovation and ingenuity
in discovering creative ways to harness technology in the aid of human
cyber defenders.
Question 1b. What research is being performed in cyber defense
tools?
Answer. In the response to the previous question I touched on some
types of tools that are being developed to assist the human cyber
defender. Indeed there is a whole industry of researchers, inventors,
developers, startup companies, large established technology companies
and Government labs working on R&D in cyber defense and cyber defense
tools. As mentioned earlier, I remain bullish on how creative solutions
may be brought to bear on the cyber problem; there are lots of bright
and motivated people who are working in this space now. With that said,
the efforts to create effective cyber defense tools, in my view, will
be improved based on the extent to which they are based on a solid
scientific foundation, and this foundation--the science of
cybersecurity--has been elusive. The field remains too reactive and
after-the-fact. Something bad happens and we have to react afterwards.
We lack an adequate understanding of how to construct and compose
systems that are fundamentally resilient and secure, based on first
principles.\1\ A very recent report \2\ from the National Research
Council (NRC) captures the sentiment very well: ``Security science has
the goal of improving understanding of which aspects of a system
(including its environment and users) create vulnerabilities or enable
someone or something (inside or outside the system) to exploit them.
Ideally, security science provides not just predictions for when
attacks are likely to succeed, but also evidence linking cause and
effect pointing to solution mechanisms. A science of security would
develop over time, for example, a body of scientific laws, testable
explanations, predictions about systems, and confirmation or validation
of predicted outcomes.'' The NRC report continues: ``A scientific
approach to cybersecurity challenges could enrich understanding of the
existing landscape of systems, defenses, attacks, and adversaries.
Clear and well-substantiated models could help identify potential
payoffs and support of mission needs while avoiding likely dead ends
and poor places to invest effort. There are strong and well-developed
bases in the contributing disciplines. In mathematics and computer
science, these include work in logic, computational complexity, and
game theory. In the human sciences, they include work in judgment,
decision making, interface design, and organizational behavior.''
---------------------------------------------------------------------------
\1\ Schneider, F.B. (2012). Blueprint for a science of
cybersecurity. The Next Wave, Vol. 19, No. 2, pp. 47-57, National
Security Agency, Ft. Meade, MD.
\2\ Millett, L.I., Fischhoff, B., and Weinberger, P.J., (Editors),
(2017). Foundational Cybersecurity Research: Improving Science,
Engineering, and Institutions, National Academies Press, Washington,
DC.
---------------------------------------------------------------------------
As the community tasked with developing new cyber defense tools
works to innovate and create new and better tools, I think it is
equally important that the research community work to advance the
scientific foundation that will help to make tomorrow's cyber defense
tools even more effective. The NSA sponsors a Science of Security (SoS)
effort currently that is actively engaging the open academic community
in advancing this foundational research. The activity has defined a set
of hard problems as a way to focus the effort. The hard problems
include: (A) Scalability and Composability, (B) Policy-Governed Secure
Collaboration, (C) Security-Metrics-Driven Evaluation, Design,
Development, and Deployment, (D) Resilient Architectures, and (E)
Understanding and Accounting for Human Behavior. More detail on the
NSA's SoS effort can be found on the NSA website \3\ as well as the
Science of Security website.\4\
---------------------------------------------------------------------------
\3\ https://www.nsa.gov/what-we-do/research/science-of-security/.
\4\ https://cps-vo.org/group/SoS/.
---------------------------------------------------------------------------
Question 2. You mention that many companies are ``training in
place'' to educate individuals to fill cybersecurity knowledge or
skills gaps. While this is a worthy exercise, it takes time. What steps
can DHS take now to fill the gap, while embarking at the same time on a
retraining program?
Answer. In an effort to bring on cyber talent more quickly,
companies are engaging with students at the high school level. With the
success of various different cybersecurity competitions at the
university level (e.g., the National Collegiate Cyber Defense
Competition), cyber competitions have now expanded to include students
at the high school level (e.g., Cyber Patriot). One company (and I
understand that there are others that are pursuing a similar strategy)
is pursuing a strategy to bring on some high school students--who have
participated in high school cyber competitions--as summer interns. Upon
their high-school graduation, some of these students would be offered
full-time positions in the company and the company would support their
college education, while they are full-time employees. Perhaps DHS has
been looking into this, but if not, it might be a way to augment cyber
capability.
On a related topic--given that many of these positions will require
the employee to be granted a security clearance, I can comment on one
company's thinking about this issue. The company recognizes that the
time required for their new employee's security clearance processing to
be completed can sometimes be lengthy. As a result they have given a
lot of thought about how to ensure that the employee is motivated,
productive, and contributing during the security clearance processing
period. Via a combination of relevant Unclassified projects and self-
learning assignments, the company works hard to introduce the new
employee to the company's culture, working environment, etc. such that
once the security clearance is granted, the employee can hit the ground
running to become as productive as possible, as quickly as possible.
One other thought was triggered by a conversation I had recently
with a couple of military reservists who are currently employed as
cybersecurity employees in the private sector--along with an article I
recently came across.\5\ The article describes that there are large
numbers of folks who serve in the Reserves or National Guard who have
cyber skills that could increasingly be brought to bear to expand the
pool of qualified cyber workers that are available to the Government,
particularly in times of crisis.
---------------------------------------------------------------------------
\5\ https://techcrunch.com/2017/04/18/reservists-and-the-national-
guard-offer-untapped-resources-for-cybersecurity/.
---------------------------------------------------------------------------
One final thought relates to the one above and involves
volunteerism. During periods of crisis and emergency, many Americans
generously offer their time--and specialized skills--to assist. An
example comes from the field of amateur radio (also referred to as
``ham radio'') where there are many examples of people, who hold an
amateur radio license, who assist with communications when conventional
communication systems are temporarily down due to a storm, hurricane,
or other natural disaster. By analogy, perhaps it would be possible to
form a civilian voluntary cyber corps to assist DHS during periods of
crisis. The State of Michigan has implemented this sort of notion and
describes many benefits.\6\
---------------------------------------------------------------------------
\6\ http://www.michigan.gov/som/0,4669,7-192-78403_78404_78419---
,00.html.
---------------------------------------------------------------------------
Question From Chairman John Ratcliffe for Scott Montgomery
Question. We heard in the hearing that DHS has to overcome a
perception hurdle. What can DHS offer its prospective cyber work force
to mitigate this perception besides the importance of its mission?
Answer. DHS needs to think and act more strategically when
recruiting cybersecurity talent. It all starts back at DHS--DHS needs
to upgrade cybersecurity compensation at all levels to attract the best
and the brightest and ensure that these professionals, when they earn
it, are fast-tracked to more senior levels. DHS needs to ensure that
those professionals that want to stay on the technical track, rather
than moving up the management ladder, are likewise given real
opportunities for career advancement. DHS needs to customize
cybersecurity training and continue to invest in its talented cyber
work force to ensure that DHS is seen as an agency that values and
trains its people. Finally, DHS needs to stream line its decision
making as much as possible to ensure that cybersecurity professionals
can work in a fast-paced, exciting environment.
Questions From Chairman John Ratcliffe for Michael Papay
Question 1. We heard in the hearing that DHS has to overcome a
perception hurdle. What can DHS offer its prospective cyber work force
to mitigate this perception besides the importance of its mission?
Answer. The Department of Homeland Security (DHS) plays an
absolutely essential role in providing cyber protection for our
critical infrastructure, Government systems, and our way of life. We
need to do a better job in communicating the criticality of DHS's cyber
responsibilities. I think if the public (and DHS employees) better
understood the importance of DHS, it could help ensure that the
organization was more respected/ appreciated and subsequently instill a
stronger sense of service within its work force.
An additional way to help DHS enhance its ability to attract talent
is to build an even more positive campaign around Cyber Grants and the
National Science Foundation Scholarship for Service program. Students
get college tuition paid in exchange for service after graduation.
Since students have a choice of which Federal agency to work, DHS can
stand-out among the other agencies by advertising among key target
audiences the importance of their mission, their work environment, the
enormous opportunities, and professional development programs that make
it a great place to work. Cyber Grants is frequently offered at
universities with high minority population, DHS could effectively build
an even stronger, more diverse, and qualified work force (especially if
they focus on institutions ((2-year and 4-year)) with those who have
achieved the DHS/NSA Certification of Academic Excellence in
Information Assurance Education ((CAE)) ). Additionally, if DHS hires
students out of the CAE2Y program (community college) they could
develop an energized, qualified, diverse, and committed work force.
Beyond the importance of its mission, in many ways DHS is on the
cutting edge of technology. The Science and Technology, Cyber Division
is focused on developing innovative solutions for a wide range of
challenges. It might be useful to leverage the exciting work of this
organization as a tool to energize the Department's cyber work force.
DHS does unjustly suffer from a perception challenge. However, by
doing more to communicate the importance of DHS's role in protecting
our National security, strengthening the college recruitment and
highlighting the exciting technologies that DHS is involved in, I am
hopeful that we can help embolden its cyber work force.
Question 2. What do you think is the main reason that CyberPatriot
programs have a 23 percent participation rate for females with 12
percent for the average STEM programs?
Answer. CyberPatriot has higher participation of girls than most
programs because, quite simply, it is a focus for both Northrop Grumman
and the Air Force Association.
CyberPatriot has grown from 9% female participation in 2009 to 23%
girls in 2017. The program offers a fun, team environment that makes it
easy for girls to get involved. We encourage all girl teams and provide
them registration free of charge. Another reason CyberPatriot has
higher female participation is because we recognize that children are
determining/considering future academic and career choices by about
grade 5-7, if we wait 'til high school, it is too late. That's one
critical reason CyberPatriot added the middle school division in the
competition--girls have not self-selected out of STEM/cyber fields. In
order to open minds even earlier, we created the cyber awareness
program (Elementary School Cyber Education Initiative (ESCEI)) for
grades K-6. We've sent out more than 6,000 free-of-charge ESCEI
packages to academic and other young children's programs, so young
girls are getting great exposure to the topic--they think it's a
perfectly acceptable and normal academic and career choice.
Lastly, many of Northrop Grumman's women employees spend time
volunteering in classrooms and coaching CyberPatriot teams. These women
are fantastic role models and help inspire future generations of girls
to get involved in cyber. Also, we're targeting women's professional
associations (Women in Cybersecurity, Women in Technology, Society of
Women Engineers, and others) to not only speak at their conferences
about the need for girls in Cyber/STEM but also give them another
opportunity for their own outreach.
Getting more girls involved in STEM programs is critical to not
only helping girls reach their full potential, but diversity in the
cyber field also strengthens our long-term economic and National
security.