THE SENATE SELECT
COMMITTEE ON CYBER SECURITY
IDENTITY THEFT PREVENTION WILL
COME TO ORDER. GOOD AFTERNOON
IN RESPONSE TO THE COVERT
NINETEEN EMERGENCY TO PROTECT
THE PUBLIC LEGISLATORS AND
EMPLOYEES. WE MUST LIMIT
NONESSENTIAL GATHERINGS AND
HERE TO SOCIAL DISTANCING AND
FACE COVERING GUIDELINES. IN
COMPLIANCE WITH THESE ORDERS
THE SENATE HAS MADE NECESSARY
ADJUSTMENTS TO NORMAL PRACTICES
IN ORDER TO ENSURE THE PUBLIC
CONTINUES TO HAVE ACCESS TO THE
LEGISLATIVE PROCESS. WE ALSO
HAVE PANELISTS TODAY WHO ARE
PARTICIPATING REMOTELY. FOR OUR
REMOTE PARTICIPANTS PLEASE MUTE
YOUR PHONES OR COMPUTERS WHEN
NOT SPEAKING. THIS WILL GREATLY
AID IN ELIMINATING ANY ACOUSTIC
FEEDBACK I ASKED EVERY TIME YOU
WISH TO BE RECOGNIZED. THAT YOU
USE YOUR RAISE HAND FEATURE IN
THE PROGRAM. WHEN YOU RECOGNIZE
TO SPEAK A POP UP WINDOW WILL
APPEAR ASKING IF YOU WOULD LIKE
TO ON MUTE. PLEASE SELECT ON
YOU BEFORE YOU BEGIN SPEAKING.
R. I. T. PERSONNEL PUT YOU BACK
ON YOU WHEN YOU ARE DONE. ONCE
RECOGNIZED TO SPEAK PLEASE MAKE
SURE YOU CAN BE SEEN ON THE
SCREEN STATE YOUR NAME. AND
THEN YOU'RE READY TO ADDRESS
THE COMMITTEE. WELL THE PUBLIC
ACCESS WE'VE ADMITTED MEMBERS
OF THE PUBLIC TO TWO HEARING
ROOMS TO THE EXTENT THAT SOCIAL
DISTANCING REQUIREMENTS ALLOW.
AND WE'RE USING A
TELECONFERENCE SERVICE FOR
THOSE INDIVIDUALS WHO WISH TO
TESTIFY TESTIFIED BY PHONE
TODAY. FOR ALL INDIVIDUALS
WISHING TO PROVIDE PUBLIC
COMMENT THE PARTICIPANT TOLL
FREE NUMBER AND ACCESS CODE IS
POSTED ON OUR COMMITTEE
WEBSITE. WILL BE DISPLAYED ON
THE SCREEN AND I ALSO ANNOUNCE
IT NOW. TODAY'S PARTICIPANT
NUMBER IS EIGHT FOUR FOUR. TWO
NINE ONE FIVE FOUR NINE ZERO
AND THE ACCESS CODE IS SEVEN
ONE SIX TWO THREE FIVE THREE.
AGAIN THE PARTICIPANT NUMBER IS
EIGHT FOUR FOUR TWO NINE ONE
FIVE FOUR NINE ZERO. AND THE
ACCESS CODE IS SEVEN ONE SIX
TWO THREE FIVE THREE. FOR
DETAILED INSTRUCTIONS ON HOW
THE TELECONFERENCE SYSTEM WORKS
PLEASE REFER TO THE SENATE AND
OR COMMITTEE WEBSITE. FOR
TODAY'S HEARING WE'LL BE
HEARING ALL THE PANELS OF
WITNESSES ON THE AGENDA PRIOR
TO TAKING ANY PUBLIC COMMENT.
ONCE WE'VE HEARD ALL OF THE
WITNESSES WE WILL HAVE A PUBLIC
COMMENT PERIOD FOR THOSE WHO
WISH TO COMMENT ON THE TOPICS
ON TODAY'S AGENDA. PLEASE NOTE
THAT IN ORDER FOR US TO HEAR
YOU CLEARLY AND AVOID ACOUSTIC
FEEDBACK. YOU MUST MUTE THE
DEVICE YOU'RE WATCHING THE
HEARING ON PRIOR TO GIVING
TESTIMONY OVER THE PHONE. IT'S
IMPORTANT THAT WE HEAR FROM YOU
AND WE THANK YOU AGAIN FOR YOUR
PATIENCE. I WILL MAINTAIN
DECORUM DURING HERE I'M AS IS
CUT HEARING AS IS CUSTOMARY. IN
ANY GIVEN INDIVIDUAL WHOSE
DISRUPTIVE MAY BE REMOVED FROM
THE REMOTE MEETING SERVICE OR
HAVE THEIR CONNECTION TO MUTED-
EVERY EFFORT HAS BEEN MADE TO
STREAMLINE THE HIRING PROCESS
AND CONDUCT OUR HEARINGS. IN AS
CLOSE A MANNER TO THE SAME
MANNER AS IS CUSTOMARY. THERE
MAY BE SOME TIME WAX FOR
PETITIONS FOR JUSTIN TO THE NEW
USE OF ONLINE TOOLS OR
TECHNOLOGIES. WE ASK THAT YOU
PLEASE BE RESPECTFUL AND
PATIENT SO INTERESTED PARTIES
CAN BE HEARD. WITH THAT WHO-
I'D LIKE TO ASK MY COLLEAGUE
FROM SANTA ANA SENATOR UMBERG
IF HE HAS ANY COMMENTS. OR
OPENINGS THANK YOU- CHAIRMAN
JUST OF THE FEW QUICK COMMENTS.
A NUMBER ONE I WANT TO
CONGRATULATE YOU FOR YOUR
LEADERSHIP ON THIS INCREDIBLY
IMPORTANT ISSUE. THIRTY YEARS
AGO WHEN I CAME THE
LEGISLATURE. CYBER SECURITY I
THINK THAT WAS- THAT THAT MEANT
THAT THE STAR WARS POLICE FORCE
THAT'S WHAT THEY REFERRED TO I
THINK IS CYBER SECURITY. AND
TODAY IS ONE THE MOST IMPORTANT
ISSUES THAT WE CAN DEAL WITH WE
ARE VULNERABLE. AT EVERY LEVEL
OF GOVERNMENT- WITH RESPECT TO
CYBERSECURITY BOTH FROM A
NATION STATE BAD FOLKS AS WELL
AS INDIVIDUAL BAD FOLKS SO I
WANT TO THANK YOU AGAIN FOR
HIGHLIGHTING THIS ISSUE AND
BRINGING FORTH SOME EXCELLENT
PANELISTS. SO THAT WE CAN
GATHER INFORMATION PERHAPS TO
IMPROVE OUR PUBLIC POLICY THANK
YOU CENTERMAN THANK YOU SO MUCH
CENTER ON BURKE AND I WANNA
THANK YOU ALL FOR JOINING THE
SENATE SELECT COMMITTEE ON
CYBER SECURITY IDENTITY THEFT
FROM MENTIONS- FIRST
INFORMATIONAL HEARING. THIS
SELECT COMMITTEE WHICH WE
FORMED EARLIER THIS YEAR WILL
STUDY AND MAKE LEGISLATIVE
RECOMMENDATIONS REGARDING
THREATS. PREPAREDNESS AND
EMERGING TECHNOLOGIES
ASSOCIATED WITH CYBER SECURITY.
AS WELL AS DATA PRIVACY AND
PROTECTING CALIFORNIANS FROM
THE DANGERS OF IDENTITY THEFT.
THE TOPIC OF TODAY'S
INTRODUCTORY HEARING IS THE
GROWING THREAT OF DATA
BREACHES. LAST DECEMBER TWENTY
TWENTY A CYBER SECURITY ATTACK
ON EXCEL IN. AN AMERICAN
TECHNOLOGY COMPANY HIT OUR OWN
UNIVERSITY CALIFORNIA AND ITS
COMMUNITY IMPACTING FACULTY
STUDENTS CURRENT AND FORMER
EMPLOYEES AND THEIR DEPENDENTS.
RETIRES AND MANY OTHERS. THIS
ATTACK HAS RESULTED IN
COUNTLESS REPORTS OF SENSITIVE
INFORMATION ENDING UP ON THE
DARK WEB. LEAVING THOUSANDS OF
CALIFORNIANS INCLUDING ME AND
MY OWN FAMILY VULNERABLE TO
IDENTITY THEFT. FRAUD AND OTHER
DANGERS. I SHOULD SAY THAT
EARLY THIS YEAR EARLIER THIS
YEAR IN JANUARY- I FIRST
RECEIVE NOTICE THAT MY WIFE
MYSELF AND OUR THREE YOUNG
CHILDREN. I HAD HAD OUR DATA
LEAKS BECAUSE OF THIS BREACH-
AND THAT WAS THE PROXIMATE
REASON THAT I DECIDED TO FORM
THE CYBER SECURITY. COMMITTEE
BUT UNFORTUNATELY THIS EVENT IS
NOT ISOLATED BUT JUST ONE IN A
LARGE STRING OF CONCERNING
CYBERSECURITY TACT IN. RECENT
YEARS. FIVE SIX MONTHS AFTER
THAT YOU SEE NOTICE I SHOULD
SAY FROM A PERSONAL PERSPECTIVE
I LEARNED. THAT I WAS. MY DATA
WAS BREACHED AGAIN BECAUSE I'M
A CUSTOMER T. MOBILE WHICH WAS
SUBJECTED TO A- LARGE AND
CONCERNING CYBER SECURITY HACK-
AS OUR WORLD HAS GROWN MORE
DIGITALLY CONNECTED WE'VE NOT
KEPT UP. WITH IMPLEMENTING
SAFEGUARDS AGAINST MISUSE OF
THIS TECHNOLOGY. IN THE LAST
YEAR ALONE WE'VE SEEN SO MANY
ENTITIES FALL VICTIM TO THESE
ATTACKS AND THESE ARE THE ONLY%
ONLY THE ONES THAT HAVE BEEN
PUBLICLY REPORTED. IN FEBRUARY
THIS YEAR A CYBER ATTACK WAS
MADE AGAINST THE WATER
TREATMENT SYSTEM IN FLORIDA.
THE ATTACKER ATTEMPTED TO
POISON THE WATER SUPPLY AND
MANAGE TO INCREASE THE AMOUNT
OF SODIUM HYDROXIDE TO
POTENTIALLY DANGEROUS LEVELS.
THAT'S ONE MONTH LATER ONE OF
THE BIGGEST CYBER INSURANCE
FIRMS UNITED STATES CNA
FINANCIAL. SUFFERED A
RANSOMWARE ATTACK INTERRUPTING
KANNST CUSTOMER AND EMPLOYEE
SERVICES FOR THREE DAYS. ALSO
AROUND THIS TIME A MASS
CYBERATTACK AFFECTED MILLIONS
OF MICROSOFT CLIENTS AROUND THE
GLOBE. WHEN INDIVIDUALS
ATTACKED THE MICROSOFT EXCHANGE
SERVER. NEW SOURCES ESTIMATED
THAT NINE GOVERNMENT AGENCIES
AND OVER SIXTY THOUSAND PRIVATE
COMPANIES AND UNITED STATES
WERE AFFECTED IN THIS ATTACK.
WHILE THESE ATTACKS COST REAL
CONCERN AND ECONOMIC DAMAGE TO
INDIVIDUALS AND THEIR FAMILIES
THEY ALSO COME AT GREAT COST
OUR BROADER ECONOMY. IN TWENTY
TWENTY CYBERATTACKS COST THE
GLOBAL ECONOMY APPROXIMATELY
ONE TRILLION DOLLARS
REPRESENTING MORE THAN 1% OF
GLOBAL GDP. THE AVERAGE COST OF
DATA BREACH IS AVERAGE IN
TWENTY TWENTY WAS THREE POINT
EIGHT SIX MILLION DOLLARS IN
TWENTY TWENTY ONE THAT AVERAGE
COST OF A DATA BREACH ROSE TO
FOUR POINT TWO FOUR MILLION. WE
HAVE TO ACT QUICKLY AND UTILIZE
EXPERTISE FROM THE PUBLIC AND
PRIVATE SPHERE TO BUILD ROBUST
SOLUTIONS. WHICH IS WHY WE'RE
HERE TODAY MY STRONG BELIEF AND
I THINK I'M JOINED IN THIS
BELIEF BY MY COLLEAGUES. IS
THAT THERE IS A ROLE FOR THE
GOVERNMENT TO PLAY HERE IN
SUPPORTING THE PRIVATE SECTOR
IN PROTECTING OUR OWN PUBLIC
SECTOR VULNERABILITIES. AND
THAT IS ONE REASON WE ARE
HEARING FROM THIS PANEL OF
EXPERTS SO TODAY WE'RE GONNA
HEAR FROM TWO PANELS OF EXPERT
WITNESSES. PANEL ONE WILL
PROVIDE AN OVERVIEW OF DATA
BREACHES RESPONSE EFFORTS AND
PREVENTION MEASURES. PENALTY
WILL DIVE INTO STATE AND LOCAL
GOVERNMENT EFFORTS IN CYBER
SECURITY. AND THEN AFTER TWO
PANELS WE OPEN UP WE WILL OPEN
UP THE DISCUSSION OF PUBLIC
COMMENT BEFORE WE ADJOURN THIS
HEARING. OUR GOAL FOR TODAY IS
TO DIVE INTO LOCAL AND STATE
EFFORTS TO PREVENT CYBERATTACKS
AND DISCUSS HOW WE CAN EXPAND
UPON THOSE EFFORTS TO MEET THE
GROWING DEMAND FOR ROBUST
SOLUTIONS. AND SENATOR UMBERG
YOU'LL YOU'LL GIVE YOUR OPENING
RESPITE CENTRE BORJAS HAS
JOINED US INSIDE LIKE TO ASK MY
COLLEAGUE IF YOU MIGHT. HAVE
ANY OPENING REMARKS. JUST
SIMPLY TO EXPRESS APPRECIATION
FOR YOU SPEARHEADING THE
CREATION OF THE SUBCOMMITTEE- I
THINK YOU HAVE- ADDED
INFORMATION- BASED ON YOUR OWN
PERSONAL EXPERIENCE I TO.
REPRESENT CONSTITUENTS ARE WHO
HAVE BEEN HACKED AND- YOU HAVE
GONE THROUGH THE RANSOMWARE
PROCESS AND- IT'S A TERRIBLE
EXPERIENCE. AND ONE THAT- ON
FEDERAL LAW ENFORCEMENT AND OUR
INTELLIGENCE COMMUNITIES. ARE
HAVING A DEVIL OF A TIME.
TRYING TO ASCERTAIN THE
WHEREABOUTS IN ORIGINATION OF
THOSE ACTORS. SOME OF WHOM MAY
BE STATE ACTORS SO THIS IS A
VERY TIMELY TOPIC THANK YOU FOR
BRINGING FORWARD. THANK YOU
SENATOR BORDERS IN THE FREE
LEADERSHIP. BEFORE WE BEGIN
WITH OUR SPEAKERS I WANT TO
INVITE THE PUBLIC WHO MIGHT
WANT TO PARTICIPATE TO GO AHEAD
AND CALL IN NOW YOU CAN DIAL
THIS TOLL FREE NUMBER EIGHT
FOUR FOUR. TWO NINE ONE FIVE
FOUR NINE ZERO. EIGHT FOUR FOUR
TWO NINE ONE FIVE FOUR NINE
ZERO AND WHEN PROMPTED PLEASE
USE THE ACCESS CODE SEVEN ONE
SIX TWO THREE FIVE THREE. BUT
LET'S OPEN UP OUR FIRST PANEL
AND WE'LL HEAR FROM OUR FIRST
PRESENTER BRUCE R. BIRD
EXECUTIVE VICE PRESIDENT AND
GENERAL COUNSEL OF PALO ALTO
NETWORKS. WHICH IS ONE OF THE
LEAGUE'S LEADING CYBERSECURITY
PREVENTION COMPANIES IN THE
UNITED STATES IN THE WORLD. MR
BIRD IF YOU COULD PLEASE BEGIN
YOUR PRESENTATION. THANK YOU.
THANK YOU SENATOR MAN FOR- GIVE
ME THE OPPORTUNITY TO SPEAK
WITH YOU TODAY ON BEHALF OF THE
ALSO NETWORKS. I'M GOING TO DO
THREE THINGS IN MIND SHORTER
ALL THE REMARKS. FIRST I GIVE
YOU A LITTLE BIT OF BACKGROUND
ABOUT OUR COMPANY. SECOND I'LL
GO OVER SOME OF THE- KIA
MERGING CYBERSECURITY THREATS
THAT WE SEE RIGHT NOW. AND
THIRD I'LL GIVE YOU SOME
CONSIDERATION POLICYMAKER
CONSIDERATIONS. ARE THE BEST
WAYS. TO COMBAT CYBER SECURITY
THREATS. SO LET ME START BY
TELLING A LITTLE BIT ABOUT OUR
COMPANY- BALANCE IN IT WHICH IS
A CALIFORNIA BASED COMPANY WE
HAVE OVER ELEVEN THOUSAND
EMPLOYEES WORLDWIDE THIRTY SIX
HUNDRED OF THEM ARE BASED HERE
IN CALIFORNIA- WE PROVIDE.
SECURITY TO THE MOST SENSITIVE
GOVERNMENT NETWORKS. THE
FORTUNE FIVE HUNDRED AND MANY
OF THE WORLD'S LARGEST CRITICAL
INFRASTRUCTURE PROVIDERS. MORE
LOCALLY WE PROVIDE SECURITY THE
MAJORITY OF CALIFORNIA STATE
AGENCIES HIGHER EDUCATION
INSTITUTIONS AND LOCAL
GOVERNMENTS THROUGHOUT
CALIFORNIA. AND WE SUPPORT
THIRTY NINE CYBER ACADEMY
PROGRAMS AND THE GIRL SCOUTS OF
CALIFORNIA. WHAT I THINK IS
MORE IMPORTANT THAN THAT BASIC
BIO IS A LITTLE BIT OF HISTORY
ON OUR EVOLUTION AS A
TECHNOLOGY COMPANY BECAUSE I
THINK IT MIRRORS. THE THREATS
THAT WE'RE SEEING EMERGE OVER
TIME IN THE CYBER SECURITY
SPACE. YEARS AGO BEFORE HELLO
TO NETWORKS ENTERED THE CYBER
SECURITY SPACE. CYBER SECURITY
WAS DELIVERED IN A SPECIFIC WAY.
PRODUCTS WERE CREATED TO DEFEAT
ROMERO CYBER IDENTIFIED CYBER
SECURITY THREATS AND THAT WAS
NO LONGER WORKING AS THE
INTERNET BECAME- AND ACCESS TO.
THE INTERNET AND THE USE OF THE
INTERNET AS A TOOL OF COMMERCE
COMMUNICATION. AND
SOCIALIZATION GROUP AND SO THE
FIRST PHASE OF OUR TECHNOLOGY
EVOLUTION AT PALO ALTO NETWORKS
WAS THAT WE DEVELOPED A BEST IN
CLASS NEXT GENERATION FIREWALL
A PIECE OF TECHNOLOGY
EQUIPMENT- THAT IS USED FOR
NETWORK SECURITY BUSINESSES AND
ENTERPRISES AND GOVERNMENT
INSTITUTIONS. WHAT MADE THAT
DID WHAT MADE THAT DIFFERENCE.
OR REVOLUTIONARY WITH A LEAF IS
THAT IT ALLOWS FOR THE
INTEGRATION OF SECURITY
CAPABILITIES ACROSS THE NETWORK
AS OPPOSED TO USING SPECIFIC
PRODUCTS TO DEFEAT SPECIFIC
CYBER THREATS SO THAT WAS EIGHT
S. EACH CHANGE IN THE WAY CYBER
SECURITY. WAS IT WAS WAS
APPROACHED. THE NEXT PHASE. OF
MATCHED HOW THREATS AND THE USE
OF THE INTERNET EVOLVED. AS YOU
KNOW MUCH OF- INTERNET FACING
COMMERCE AND EVEN IN CONSUMER
USE IS EMPOWERED BY CLOUD
NETWORKS- THESE CALL NETWORKS
ARE PROVIDED BY A VARIETY OF
INSTITUTIONS BUT YOU KNOW SOME
OF THE MOST NOTABLE AMAZON. WEB
SERVICES GOOGLE CLOUD MICROSOFT
AND THERE ARE OTHER CLOUDS THAT
DISTRIBUTE- COMPUTING
CAPABILITY. ANY EXTRAORDINARILY
EFFICIENT MANNER. WHAT NEEDED
TO HAPPEN WAS IF WE WERE GOING
TO DISTRIBUTE THAT- COMPUTER
CAPABILITY THAT TECHNOLOGY WE
NEED TO BE SURE THAT WE COULD
PROTECT DISTRIBUTED FLOW OF
INFORMATION AT THE SAME TIME
AND SO THE NEXT BIG PHASE OF
OUR DEVELOPMENT OR TECHNOLOGY
DEVELOPMENT WAS TO MATCH THE
USE OF CLOUD- AS A TOOL FOR
FAR- COMPUTING CAPABILITY AND
TECHNOLOGY. SO NOW WE SHOULD.
ARE UNIFIED WAY THE USE OF THE
USED BY GOVERNMENT BY
INDIVIDUALS AND BY COMPANIES.
THE USE OF CLOUD NETWORKS. THE
THIRD BIG M. O. EVOLUTION WHICH
I THINK IS THE FRONTIER OF
CYBER SECURITY AND I THINK IT'S
IMPORTANT TO REALLY FOCUS ON
THIS BECAUSE IT MATCHES UP.
WITH THE EMERGING THREATS THAT
WE'RE SEEING IS THE USE OF.
MAPPING OKAY ALEX DESCRIBE THAT-
AUTOMATED DETECTION AND SO THIS
IS ARTIFICIAL INTELLIGENCE TO
HELP DETECT THREATS BEFORE THEY
GET TO SOMEONE'S NETWORK AND
AUTOMATION FOR YOUR SECURITY
OPERATIONS THAT IS THE FRONTIER
OF CYBER SECURITY AND THAT IS
WHERE WE HAVEN'T WE'VE INVESTED
FOUR MILLION DOLLARS JUST OVER
THE PAST THREE YEARS TO BECOME
BEST IN CLASS IN THAT FRONT
HERE. AND SO THINK ABOUT
MAPPING THIS WAY YOU YOU-
YOU'VE CERTAINLY HEARD OF THE
INTERNET OF THINGS THIS IS THE
ATTACHMENT OF BILLIONS AND
BILLIONS OF DIFFERENT TYPES OF
DEVICES TO BROADBAND NETWORKS
EVERYTHING FROM- HEALTH
DETECTOR THAT YOU MIGHT WEAR ON
YOUR WRIST TO INDUSTRIAL
CONTROL SYSTEM ON A FREIGHTER
SHIP OUT IN THE MIDDLE OF THE
OCEAN. BECAUSE NOW BILLIONS OF.
DEVICES HANG OFF THE INTERNET
WE HAVE TO GET VERY SMART ABOUT
THE WAY YOU DO TO PROTECT THEM
BECAUSE EACH ONE OF THEM.
PRESENTS ARE ACTUALLY IS THE
POINT OF VULNERABILITY IN THE
SYSTEM. SO WHAT WE BELIEVE
STRONGLY IN IS YOU HAVE TO KNOW
YOUR VULNERABILITIES ARE BEFORE
YOU CAN PROTECT THAT AND SO WE
ALONG WITH OTHERS IN OUR
INDUSTRY. HAVE DEVELOPED
MAPPING TECHNOLOGY TO HELP YOU
FIND WHERE YOUR VULNERABILITIES
ARE AND THEN DEPLOY DETECTION
AND DEFEAT CAPABILITIES TO USE
SMART AND DDOT ARTIFICIAL
INTELLIGENCE ANOTHER SMART
TECHNOLOGIES TO DEFEAT THE
VULNERABILITIES BEFORE THEY GET
TO THOSE WILL BE CALL IN
POINTS. THAT IS THE NEXT
FRONTIER SO THAT IS THE
EVOLUTION OF THE TECHNOLOGY IN
MATCHES THE EVOLUTION OF THE
THREAT. SO LET ME BRIEFLY GO
OVER STRESS WHAT ARE THE SOME
OF THE BIGGEST THREATS AND
EMERGING THREATS THAT WE'RE
SEEING- ONE ALREADY ALLUDED TO
RANSOMWARE. I THINK IT IS. THE
BEST WAY TO DESCRIBE RANSOMWARE
IS THAT IS THAT HE IS A SCOURGE
USED TO ACTUALLY BE A BIT OF A
HOBBY. WHERE THE AVERAGE RANSOM
WAS TWO OR THREE HUNDRED
DOLLARS. IN THE FIRST SIX
MONTHS OF TWENTY TWENTY ONE BY
CONTRAST THE AVERAGE RANSOM
DEMAND ROSE FIVE HUNDRED
EIGHTEEN PERCENT. TO FIVE POINT
THREE MILLION DOLLARS. THE
AVERAGE RANSOM IS NOW OVER FIVE
HUNDRED FIFTY THOUSAND DOLLARS.
SO IT IS IT IS NOT IT IS THIS
IS WHY I CALLED A SEARCH. ONE
OF THE MOST NOTABLE RANSOMWARE
ATTACKS OF THIS YEAR WAS THE
COLONIAL PIPELINE ATTACK. THAT
DISRUPTED OIL PRODUCTION- FOR A
SYSTEM THAT PROVIDED NEARLY 45%
OF THE FUEL PROVIDED THE WAY TO
THE EAST COAST. A SECOND MAJOR
EMERGING THREAT RELATES TO
INDUSTRIAL CONTROL CONTROL
SYSTEMS SO ABSOLUTE AS I
ALLUDED TO A MOMENT AGO THESE
ARE THE SYSTEMS PHYSICAL
SYSTEMS LIKE PUMPS. THAT UNDER
TO UNDERPIN CRITICAL
INFRASTRUCTURE LIKE A WATER
SYSTEM OR ELECTRIC ELECTRIC
SYSTEM. THESE INDUSTRIAL
CONTROL SYSTEMS ARE A NEW
SIGNIFICANT EMERGING THREATS IN
THE CYBER SECURITY SPACE A
RECENT EXAMPLE- CENTER
REFERRED. TO IT ALREADY IS THIS
OLD SMART WATER TREATMENT
FACILITY BREACH IN FLORIDA
EARLIER THIS YEAR WHERE TAX
GAIN ACCESS TO SYSTEMS THAT
CONTROL THE MIXTURE OF SODIUM
HYDROXIDE IN THEWATER SUPPLY.
AND THEY WERE ABLE TO MAKE IT
ONE HUNDRED TIMES HIGHER THAN
NORMAL. ESSENTIALLY CREATING
THE POSSIBILITY THIS ACTUALLY
POISONING THE WATER. THAT'S
BECAUSE THESE INDUSTRIAL
CONTROL SYSTEMS ARE ARE
MANIFOLD AND YOU HAVE TO KEEP
UP WITH THEM YOU HAVE TO
PROTECT ESPECIALLY ALL OF THEM.
THE OUR SUPPLY CHAIN ATTACKS
THESE ATTACKS THAT SEEK TO
DAMAGE AN ORGANIZATION BY
TARGETING THE LESS SECURE
ELEMENTS IN ITS SUPPLY CHAIN
SO. ENTERPRISE MIGHT AT BEST IN
CLASS CYBER SECURITY CAPABILITY.
WHAT IF ITS SUPPLY CHAIN HAS
IDENTIFIABLE- BONNEVILLE
RESENTED CYBER ATTACKERS ARE
LIKELY TO FIND IT AND EXPLOIT
THE MOST NOTABLE SUPPLY JACK'S
SPY TRAINING TAX OF LATE WAS
THE US SOLAR WINDS TACK SURE
YOU'VE ALL HEARD THAT- THIS IS
OUR ATTACKERS MOST LIKELY FROM
RUSSIA RABAL TO COMPROMISE-
WHAT SHOULD HAVE BEEN A SUMMER
ROUTINE SOFTWARE UPDATE FROM A
TRUSTED SOURCE. WELL SAID THIS
OFFER WAS DOWNLOADED AND
EXECUTED AS FOLLOWS THE
NETWORKS. THAT DOWNLOADED THE
SOFTWARE. AND FOURTH ALL WE THE
CAN IMPORTANT THREAT THAT WE
FACE IS SOMETHING WE CALL ON
OUR ABILITY EXPLOITATION. THAT
BASICALLY IS A FANCY WAY OF
SAYING SOFTWARE CAN CHANGE WE
CAN ASSESS SOME OF THOSE
WEAKNESSES ARE KNOWN SOME OF
THEM ARE NOT REAL. AND IT
TANKERS SEEK THEM OUT. AND THEY
REALLY WHAT THEY DO. IS THEY
FIND VULNERABILITIES BECAUSE
USERS OF THE SOFTWARE HAVE NOT
DONE THIS SIMPLE THING OF
PATCHING SOFTWARE PATCHES THAT
HAVE ALREADY BEEN PUSHED OUT.
SO WE CALL THESE UNMITIGATED
VULNERABILITIES IN SOFTWARE AND
THEY POSE A SERIOUS THREAT. TO
OUR INFRASTRUCTURE JUST THIS
WEEK. ACTUALLY JUST ONE WEEK
AGO I BELIEVE- THE GUARDIAN US
GOVERNMENT THIS IS A THE- CYBER
SECURITY INFRASTRUCTURE
SECURITY AGENCY HOSTED A SET OF
KNOWN VULNERABILITIES AND
DIRECTED FEDERAL AGENCIES TO
CLOSE THEM THROUGH AVAILABLE
SOFTWARE PATCHES. ENTERPRISES
HOWEVER ARE NOT GOOD ENOUGH AND
OFTEN DO NOT HAVE THE RIGHT
PROCESSES AND HYGIENE BREAK IN
PLACE TO ENSURE THAT
VULNERABILITIES ARE CLOSED EVEN
WHEN PATCHES ARE AVAILABLE. SO
FINALLY JUST A FEW THOUGHTS ON
WHAT POLICY MAKERS CAN DO OR
WHAT THEY MIGHT CONSIDER- MIGHT
CONSIDER AS WE FACE THESE
EMERGING THREATS. FIRST OF ALL
WE ENCOURAGE POLICYMAKERS TO
INCENTIVIZE THE ADOPTION OF
WHAT WE CALL A SECTORAL
FRAMEWORKS. THE NATIONAL
INSTITUTE OF STANDARDS AND
TECHNOLOGY FOR INSTANCE HAS
ADOPTED A WELL KNOWN CYBER
SECURITY FRAMEWORK. THERE ARE
SIMILAR FRAMEWORKS. THESE ARE
GUIDEPOSTS EASIER THESE ARE
PLAIN BOX IF YOU WILL FOR
TAKING ADVANTAGE OF EXISTING
TECHNOLOGY TO SECURITY. TO
SECURE YOUR NETWORKS WHETHER
YOU'RE IN A GOVERNMENTAL
INSTITUTION OR OTHER FORM OF
ENTERPRISE. SECOND WE THINK
THAT IN THE RANSOMWARE SPACE
THERE SHOULD BE SMART FORMS OF
REQUIRED INCIDENT REPORTING. TO
OFTEN- IF YOU CAN BELIEVE IT OR
NOT THESE RANSOMWARE ATTACKS
COMING GO. RANSOM IS PAID
VULNERABILITIES ARE KNOWN BUT
THERE ISN'T ENOUGH.
COLLABORATIVE COMMUNICATION
BETWEEN THE VICTIM. AND THEY
TRULY ARE VICTIMS AND LAW
ENFORCEMENT ANOTHER
GOVERNMENTAL INSTITUTIONS THIRD
KNOWING THE THREATS GET
INFORMED- MANY MOST MOST LARGE
GOVERNMENT INSTITUTIONS ALL
HAVE A SECURITY TEAM THE
LEADERS OF THOSE INSTITUTIONS
SHOULD BE TALKING THAT SECURITY
TEAM. AND THE SECURITY TEAM
SHOULD BE TAKING ADVANTAGE OF
EXPERTISE OUTSIDE OF THEIR
ROUND. FOR INSTANCE JUST TODAY
ARE KIND OF PALO ALTO NETWORKS
ARE UNIT FORTY TWO- RESEARCH
TEAM PUBLISHED A REPORT
REGARDING VULNERABILITIES THAT
WE HAD IDENTIFIED INVOLVING
DEFENSE CONTRACTORS. AND
THREATS THEY WERE FACING.
FINALLY KNOW WHO YOUR ATTACKERS
ARE. LOOTED EARLIER TO THIS
IDEA OF MAPPING YOUR YOUR
ENDPOINTS MAPPING YOUR TAX BASE
WE CALL THAT A TAX SERVICE
MANAGEMENT. YOU CANNOT PROTECT
YOUR INSTITUTION IF YOU DON'T
KNOW WHERE ITS VULNERABILITIES
ARE WE CALL THAT THE DIDN'T DO
THAT USE LESS TECHNICAL TERMS
THE DENOMINATOR. WHAT'S THE
DENOMINATOR OF YOUR THREATENED
INFRASTRUCTURE. ONCE YOU KNOW
THAT YOU ARE MUCH BETTER ABLE.
TO KNOW HOW TO PROTECT IT. WE
HAVE WORKED WITH GOVERNMENT
FEDERAL GOVERNMENT INSTITUTIONS
FOR INSTANCE IN SITUATIONS
WHERE WE IDENTIFY TWICE AS MANY
VULNERABLE ENDPOINTS THAN THEY
THOUGHT THEY HAD. THAT'S GOOD
NEWS BECAUSE IT MEANS WE CAN GO
OUT AND PUT UP TECHNOLOGY
APPEARS AND POINTS TO PROTECT
THEM. THANK YOU VERY MUCH. SHE
SAID MISTER BYRD OUR NEXT-
PANEL THIS IS MIKE MCNERNEY
CHIEF OPERATIONS OFFICER
RESILIENCE- MR MCNERNEY WELCOME
AND PLEASE FEEL FREE TO BEGIN.
THANK YOU CHAIRMAN
DISTINGUISHED MEMBERS OF THE
SELECT COMMITTEE THANK YOU FOR
THE OPPORTUNITY TO TESTIFY
TODAY ON THE CHALLENGES OF DATA
BREACHES ON THE THREATS THEY
POSE TO SOCIETY AND NATIONAL
SECURITY. IS NOT ISSUING SUCH A
DISTINGUISHED PANEL WITNESSES
HERE TODAY AND TOMORROW BUT I
CAN GET TRICKY INSIGHTS INTO
THIS DESTRUCTION PARTICULARLY
IN THE AREAS ARE RESPONSIBLE
BASH. MY NAME IS MIKE MCNERNEY
AND I'M THE CHIEF OPERATIONS
OFFICER RESULTS ON A MILITARY
VETERAN INSIDER ENTREPRENEUR
AND HELD A RANGE OF POSITIONS.
INSIDE AND OUTSIDE OF
GOVERNMENT. RESILIENT FLOORING
NOW IS A CYBER INSURANCE AND
SECURITY STARTUP HEADQUARTERED
IN SAN FRANCISCO. MOST OF OUR
FOUNDERS AND EXECUTIVE TEAM ARE
MILITARY VETERANS OR CYBER
SECURITY EXPERTS. AND WE ARE
DEDICATED TO IMPROVING
CYBERSECURITY PRACTICES FOR
CUSTOMERS. SUMMERS ARE
GENERALLY SPEAKING ENTERPRISES
THAT UNDERPIN THE AMERICAN
ECONOMY INCLUDING CONSTRUCTION
AND MANUFACTURING FINANCIAL
SERVICES AND EVEN HOSPITALS.
OUR POSITION AS BOTH A CYBER
SECURITY AND CYBER INSURANCE
COMPANY ALLOWS US TO DEVELOP
BEST PRACTICES FOR
CYBERSECURITY CONTROLS AND ALSO
TO ENCOURAGE THEM TO BE YOURS.
IT IS THIS COMBINATION OF
STANDARDS AND INCENTIVES THAT
IS GAINING RECENT TENSION
FEDERAL POLICYMAKERS AS AN
ELEMENT OF A LARGER SOLUTION TO
SOME OF OUR. NATION'S
CYBERSECURITY CHALLENGES.
SENATORS LET ME DIRECT PEOPLE
ARE HURTING OUT THERE. OVER THE
PAST SEVERAL YEARS
CYBERSECURITY HAS GONE FROM A
RELATIVELY BACKWARD ISSUE TO
TOP NATIONAL SECURITY THREAT.
THIS MOVE ALSO DEPENDING ON
WHERE I USED TO WORK DIRECTLY
TO MAIN STREET. EVERYONE ON
THIS COMMITTEE KNOWS SOMEONE
PERHAPS A SCHOOL PERHAPS A
SMALL BUSINESS WHO IS THE
IMPACTS OF DATA. BREACH OR THE
IMPACTS OF RENTAL. TAYLOR EVEN
OF HOSPITAL TURNING AWAY.
NEEDING CRITICAL CARE DUE TO A
CYBER. IN SOME CASES THIS IS
EVEN LED TO INSTANCES OF DEATH
OR BODILY HARM AND PEOPLE ARE
TAKING NOTICE REMARKABLY IN A
RECENT NATIONWIDE POLL OF
REGISTERED VOTERS RESPONDED
CITING QUOTE IMPROVING CYBER
SECURITY INFRASTRUCTURE AND
WELL. THAT'S A TOP HIGH
PRIORITY FOR THE BUILD BACK
BETTER PROPOSAL BUT FULLY ONE
QUARTER PLACING IN THE TOP
THREE I'VE NEVER SEEN ANYTHING
LIKE. THIS IMPACTS ALL OF US
AND SO I THINK THE SOLUTIONS.
WILL ALSO REQUIRE ALL OF US.
BATTERIES HER NUMBER HACKER
GAINED ACCESS TO THE COMPUTER
SYSTEM AND USES ACCESS YOUR
PRIVATE INFORMATION. WHILE
WORKING AT A RECENT SELLS ONLY
ONE TYPE OF MAY AND A BAD ACTOR
CAN PROCEED TO ACCESS THE
SYSTEM. THAT SAME ACCESS WILL
BE A SUCCESSFUL PERSON IN TOWN
OR ON THE SPOT AND UNMATCHED
YOU SUPPOSE. AN OPERAND
SOMEWHERE ESPIONAGE OR IN SOME
CASES EVEN VISIBLE DAMAGE. BUT
THE CHALLENGE FOR DEFENDERS AS
YOU TRY TO PREVENT HACKERS FROM
ENTERING THE SYSTEM. CASTLE.
AND REMOVE THEM AS QUICKLY AS
POSSIBLE. FORTUNATELY THERE ARE
SOME PRACTICES CAN BE IN
EMPLOYEE TO IMPROVE EVERYONE.
CYBER HYGIENE. WELL THERE'S NO
WAY TO GUARANTEE PREVENTION
ACTIONS CAN BE TAKEN THAT YOU
CREATE YOUR REST AN INCREASE
YOUR SITE RESULTS. FIRST AS ANY
HACKER KNOWS ITS USERNAME
CREDENTIAL ACCESS TO SYSTEM AS
OPPOSED TO USING EXPORT. THIS
COMMITTEE KNOWS HOW OFTEN DATA
REACHES. MANY PEOPLE'S PRIVATE
INFORMATION INCLUDING PASSWORDS
ON THE DARK WEB. AS A RESULT
ONE OF THE FIRST PROTECTIVE
MEASURES EACH MONTH FOR SCALE
BUSTERS POLICY PASSWORD. AND
MANY IMPLEMENTATION OF MULTI
FACTOR AUTHENTICATION. ALSO
SOMETIMES KNOWN AS- I CAN TELL
YOU THAT WILL YOUR CAR. AT RISK.
USING DECENT. ANOTHER COMMON
WASTE YOUR CREDENTIALS THIS
YEAR FISHING. USING A VARIETY
OF TECHNIQUES MALICIOUS HACKERS
ARE CONSTANTLY ATTEMPTING TO
TRICK UNSUSPECTING USERS INTO
CLICKING ON SE AND ST LOUIS
SEND ME EMAIL AS SUCH INSURING
YOUR ORGANIZATION HAVE STRONG
EMAILS A STRONG EMAIL SECURITY
HOUSE PROGRAM A CONSTANT USER
TRAINING ON PHISHING AWARENESS
ARE CRUCIAL. SIMILARLY
ORGANIZATION SHOULD ALSO
INCLUDE TECHNOLOGIES ON YOUR
DOWN USER DEVICES ALSO KNOWN AS
END ONCE TO HELP DETECT AND
MITIGATE UNAUTHORIZED. ACCESS
AFTER REACH. J. TIGER ACCESS TO
ASSIST. THE NEXT THING WE TO DO
A ESSENTIALLY CALL. USING
WHAT'S CALLED GAS OR REMAINING
SYSTEM. DNS ACTS LIKE THE PHONE
BOOK AND INTERNET THIS CALL BUT
LETS THE ATTACKER MIGHT BE
RUNNING MANY OPERATIONS NO THIS
SYSTEM HAS BEEN BREACHED AND
EVEN WHERE IT'S LOCATED. THE
SIMPLE ACT OF ATTEMPTING TO
BLOCK THAT CALL BACK COULD
EFFECTIVELY NEUTERING THE
CHOOSING. FINDING A CRITICAL
INSTRUCTIONS. I EVEN THOUGH IT
IS ACCESS IS GENERALLY PREFER
ATTACKER STILL DO TAKE
ADVANTAGE OF VULNERABILITIES IN
SYSTEMS. TO MITIGATE THIS
ORGANIZATION SHOULD EMPLOY A
COMPREHENSIVE PAST MEDICATION
MANAGEMENT PROCEDURES. THAT
RESILIENCE WE SEND OUT MONTHLY
ALERTS FOR CUSTOMERS ABOUT ANY
KNOWN WATER BILLS AND HOW THEY
CAN BE REMEDIATED THAT'S ONE OF
THE EASIEST AND MOST COST
EFFECTIVE THINGS WE DO TO
PROTECT OUR CUSTOMERS. AS I
NOTED ABOVE THERE'S NO SUCH
THING AS PERFECT SECURITY.
HOWEVER YOU CAN ACTUALLY FIND
YOURSELF IN A DATA BREACH THERE
ARE A FEW STEPS YOU CAN TAKE A
CHART TOPPER. FIRST EVERY
ORGANIZATION GOOD BOOKS YOU
DON'T KNOW THE PROCESS OF
BUILDING PLANS AND POLICIES TO
HANDLE THE SIRENS. AND DRILL
THOSE PLANS DURING TABLE TOP
EXERCISES. COULD LEAD. TO ANY
LEGAL CONSIDERATIONS SUCH AS
STATE LEVEL DATA REPORTING
REQUIREMENTS. ALSO TAKE THIS AS
AN OPPORTUNITY TO BUILD
RELATIONSHIPS WITH ANY PARTIES
YOU MIGHT NEED AFTER THAT.
EXAMPLES INCLUDE INCIDENT
RESPONSE FORENSICS TEAMS-
OFFERS. USERS CAN USE THE
INSURANCE. INDUSTRY CAN ALSO BE
HELPFUL. NOT ONLY CAN INSURANCE
LET OF FIVE DOWN AND REACH BUT
GOOD ONES ALL HAVE THESE PRE
EXISTING RELATIONSHIPS. IF
THERE'S A SILVER LINING TO THE
CURRENT SEVERITY OF DATA
BREACHES RANSOMWARE. PEOPLE
ACROSS THE NATION ARE BEGINNING
TO TAKE CYBERSECURITY
SERIOUSLY. DON'T YES HAS A
CRUCIAL ROLE TO PLAY. AT THE
FEDERAL LEVEL I CAN SAY THIS
ADMINISTRATION IS THE MOST
AGGRESSIVE ON CYBERSECURITY OUT
OF STATE. THE PRESIDENT'S NEED
MAJOR PLAYERS A WHOLE NATION
EVER TO MITIGATE THE STRESS AND
BEGINNING TO SEE SOME OF THE
FOR SERVICE. INCLUDING IN THE
NEWS TODAY. A LITTLE PART OF IS.
RENTS MORGAN. WHO ALSO
COMMITTED OUT OF REACH. TO THE
SAME LEVEL AS TERRORIST
ORGANIZATIONS. ARE ALSO REPORTS
THAT THE NATIONAL SECURITY
ESTABLISHMENT IS NEUTRALIZED
SEVERAL INTERNATIONAL CRIMINAL
OPERATIONS. ON THE PRIVATE
SECTOR SIDE ISN'T GOING TO TAKE
DECISIVE STEPS TO MITIGATE
THREATS. THREE SHOWING THE
PRIVATE SECTOR ENTITIES CAN
SOMETIMES ACT EFFECTIVELY NEW
CONTRACTUAL MECHANISMS IN.
PLACE FOR GOVERNMENTS FIND IT
HARDER OPERATE. EXAMPLE HER
NAME THE KIDNAPPING RANSOM. IN
NINETEEN EIGHTIES FOR PRIVATE
SECTOR ACTORS BY MELISSA MONDAY
WORKS A SECOND WORK
SUCCESSFULLY CAN MITIGATE THE
THREAT COMBINATION BEST
PRACTICES AND FINANCIAL
INCENTIVES MUCH LIKE DURING THE
PREVIOUS KIDNAP AND RANSOM.
INSURANCE INDUSTRY HAS A KEY.
ROLE TO PLAY IN CYBER SECURITY
AS WELL. I SAY LEVEL CALIFORNIA
CAN CONTINUE TO LEAD THE NATION
AND I COMMEND THE WORK OF THIS
NATURE THAT. OUR STATE HOUSE ON
THE FIRST AND MOST URGENT DATA
PROTECTIONS FOR CUSTOMERS AND
THIS LEGISLATION ANYTIME THE
MODEL FOR MANY STATES THAT ALL.
STATE ATTORNEY GENERAL HELLO
YES AND THE NATIONAL GUARD ARE
ALSO WORKING DILIGENTLY ON
SEVERAL INITIATIVES. THAT SAID
MORE CAN STILL BE DONE. HELLO
SHOULD TAKE FULL ADVANTAGE OF
FEDERAL ASSISTANCE THIS
INCLUDES ENGAGING WITH THE
CYBER SECURITY INFRASTRUCTURE
AND SECURITY AGENCY THE MULTI
STATE INFORMATION SHARING AND
ANALYSIS CENTER I KNOW THIS.
THAT YOU CAN ALWAYS ASK FOR
GREATER RESOURCE FOR EXAMPLE
THE ADMINISTRATION'S
INFRASTRUCTURE PLAN INCLUDES A
SERGEANT GRANT. WORTH OVER A
BILLION DOLLARS. SECOND THE
GOVERNMENT IS ELEVATED YOU
SHOULD START CAPITAL CONCERN
THE CITY DO THE SAME YOU TOO
BYE BUILDING UPON THE SIDE
STREET TASK FORCE CREATED BY
JERRY BROWN ESTABLISHING A
PERMANENT COMMISSION OR EVEN
CREATING ANY MISSED LIKE AGENCY
WITH RESPONSIBILITY FOR DATA
COLLECTION ANALYSIS AND
STANDARD SO. FINALLY MISTAKEN
ALSO REQUIRED FUND LOCAL
GOVERNMENTS TO ADOPT BASELINE
SECURITY MEASURES LOCAL
GOVERNMENTS ARE OFTEN THE FRONT
LINES. IN PEOPLE'S DAILY LIVES
AN EXISTING AND WHAT WE NEED TO
DO I WOULD ONLY BENEFIT. THE
CHALLENGES WE FACE SIDE STREETS
ARE SERIOUS HOWEVER CALIFORNIA
LEADING NATION IN THIS ISSUE AS
IT DOESN'T SOMEONE ELSE WE
DON'T KNOW ONE OUT OF EVERY
EIGHT AMERICANS IN ADDITION
CAPITAL THE WORLD. LEADER ON
ISSUES LIKE CLIMATE CHANGE BY
WORKING TOGETHER AS A STATE WE
CAN HOWEVER START TO MINISTRY
SOURCES AND SURE THE INTERNET.
IS FREE AND SAFE. THANK YOU.
THANK YOU VERY MUCH MR MCNERNEY
FOR THAT TESTIMONY. WILL NOW
BRING THE DISCUSSION BACK TO
OUR MEMBERS- COLLEAGUES DO YOU
HAVE ANY QUESTIONS FOR THE
SEARCH PANEL AT CENTRE BORDERS
FROM PRESIDENT. THE CATCHER.
I'D LIKE TO THANK- ON MISTER
BYRD AND MR MCNERNEY FOR THE
PRESENTATION. PROBABLY HAVE
FORTY OR FIFTY FIVE QUESTIONS
THAT I WOULD LOVE TO POSE GIVE
HER TIME CONSTRAINTS SO TRY TO.
ASK YOUR YOUR THOUGHTS AND-
OFFER YOUR INSIGHTS- RIGHT NOW
IS IT LEGALLY REQUIRED FOR A
PRIVATE BUSINESS TO DISCLOSE TO
THE FEDERAL AUTHORITIES. ARE
THAT THEY HAVE BEEN HACKED OR
HAVE PAID OUT OF SOME SORT OF
RANSOM. EIGHT SHE IS OKAY I
JUST SAW A HARD I DON'T WANT TO
TALK OVER MIKE- I'LL GIVE YOU A
QUICK ANSWER THEY MIGHT MAYBE
CAN SUPPLEMENT AND THEN- THE
SHORT ANSWER IS I DON'T KNOW
THAT I COULD GIVE YOU A-
ABSOLUTELY- UNIFORM ANSWER FOR
EVERY SITUATION. BUT GENERALLY
SPEAKING THE ANSWER IS IT
DEPENDS ON THE TYPE OF DATA
THAT WAS IF ANY DATA WAS
BREACHED. AND EXFILTRATE IT
SUCH THAT DATA BREACH LAWS ARE
IMPLICATED. THEY ARE RANSOMWARE
ATTACKS FOR INSTANCE WHERE THAT
IS NOT IMPLICATED BECAUSE- THE
RANSOM IS PAID IN FULL AND THE
ATTACK IS- REVERSED FOR THE
SYSTEMS ARE MADE AVAILABLE AND
THERE'S NO EXFILTRATION OF
DATA. SO RIGHT NOW WHEN THAT
HAPPENS THERE IS NO UNIFORM
LEGAL SCHEME THAT REQUIRES
VICTIMS TO REPORT THAT EVENT
ARE YOU MENTIONED EARLIER THAT-
HAVING THE FOLKS COLLABORATE
AND BE ENGAGED WITH ONE ANOTHER
SO THAT THEY CAN DETERMINE
WHETHER OR NOT THERE IS A
PATTERN OF OR THERE MIGHT BE. A
COMMON SOURCE- THAT IS- SERVING
AS THE ACTOR. IN YOUR OPINION
DO YOU THINK IT WOULD BE.
FAVORABLE FOR AT THE FEDERAL
LEVEL OR EVEN AT THE CALIFORNIA
LEVEL. FOR THERE TO BE- LAW
DRAFTED THAT WOULD MAKE IT
ILLEGAL TO EITHER PAY. R.
RANSOM FOR- TO FORCIBLY
DISCLOSE WIN AND INDEED A
PRIVATE BUSINESS HAS BEEN
HACKED. GOD AND IF ANYTHING HAS
BEEN PAID OUT THERE'S TWO
SCENARIOS DO YOU THINK THAT.
DOES HAVE MERITS AT ALL. I'LL
GIVE YOU A YEAH SO EARLIER THIS
YEAR- IF PALO ALTO NETWORKS CO
CHAIRED BY THE RANSOMWARE TASK
FORCE WHICH WAS A PUBLIC
PRIVATE- COLLABORATION TO
EVALUATE BEST PRACTICES AND RAN
SOMEWHERE IN THE SPACE OF
DEFEATING RANSOMWARE. AND WE'RE
ALIGNED WITH WHERE THAT TASK
FORCE CAME OUT THAT ONE OF THE
THORNIEST TOPICS THAT THE TASK
FORCE CONFRONTED WHAT WAS THIS
TOPIC OF SHOULD THERE BE A
PROHIBITION. ON PAYING RANSOM
IN THE SHORT ANSWER IS IT WOULD
BE WE'VE WE'VE WHERE THE TASK
FORCE CAME DOWN IS IT WILL BE
VERY DIFFICULT AND POTENTIALLY
COUNTERPRODUCTIVE TO IMPLEMENT
THAT RULE MAINLY BECAUSE YOU
WOULD FORCE. INSTITUTIONS IT
MIGHT NOT BE READY OR CAPABLE
OF DEFEATING RANSOMWARE
RANSOMWARE ATTACK IS TO BE
LEFT- ESSENTIALLY ON GUARD AND
DEFENSELESS AND SO IT'S HARD TO
SAY THAT IN EVERY CIRCUMSTANCE
YOU WOULD WANT TO DISABLE AN
ENTITY FOR PAYING A RANSOM THE
TRUTH OF THE MATTER IS. THE
RANSOMWARE THE REASON WHY THE
ATTACK SORRY THE AMOUNTS OF
DAWN OPPOSITE RANSOMWARE ATTACK
DOING TWO THINGS ONE THEY'RE
RELYING ON HOT- UPDATED
TECHNOLOGY THEY'RE OPERATING
WITH AUTOMATED IN AN AUTOMATED
FASHION TO THEIR TARGETING
CRITICAL ENTITIES HEALTH CARE
CRITICAL INFRASTRUCTURE AND
THIS MAKES IT VERY DIFFICULT TO
IMPOSE. EIGHT ABSOLUTE BAN ON
RANSOMWARE PAYMENTS WE THINK
THE BETTER THING IS TO GET
PEOPLE PREPARED. USE TECHNOLOGY
USE GOOD SYSTEMS USED TO TYPE
OF HYGIENE AND MIKE IS TALKING
ABOUT TO PREPARE SO DID YOU
DON'T FACE A HOBSON'S CHOICE
AND FINALLY THE ANSWER YOUR
OTHER QUESTION WE DO BELIEVE
THAT APPROPRIATE INCIDENT
RESPONSE REQUIREMENTS ARE WE
THAT THAT THAT SHOULD BE
REQUIRED AND THERE ARE LAWS
BEING DISCUSSED IN THE U. S.
CONGRESS RIGHT NOW. ON THAT
TOPIC. AND WE SUPPORT THAT NO
NO CLUE THE PYRAMID COLLEAGUES
JUMP IN A I THINK YOU'D BE INTO.
UP I DON'T KNOW WHERE THE NEW
SOME MINISTRIES IS THIS IS BUT
IT'S STILL SOME SORT OF CALLOUS
SO I SECURE. AGENCY EITHER AS A
STANDALONE OR A- SUPPORTED
DIVISION WITHIN- THE AG'S
OFFICE OR SOMETHING LIKE THAT
PROPERLY STAFF CERTAINLY
ELIGIBLE FOR FEDERAL GRANTS. I
THINK WOULD BE A SMART MOVE
FORWARD- MY LAST QUESTION IS DO
YOU THINK THAT THERE SHOULD BE
AN- ENHANCED PENALTIES. HI IF
THERE ARE ATTACKS ON CRITICAL
INFRASTRUCTURE. WHETHER IT BE
AT THE STATE LEVEL OR THE
FEDERAL LEVEL THAT IF YOU DO
MOVE INTO THE AREA OF- HEALTH
CARE OR GREED OR ENERGY- THAT
THOSE ARE AREAS AND I KNOW MY
UNDERSTANDING IS THAT- THE
PRESIDENT BIDEN WAS PROPOSING A
HANDS OFF POLICY WITH- WITH
RUSSIA THAT THERE'S A TOLERABLE
AMOUNT OF. A BREACH THAT
AMERICANS THIS CAN SUSTAIN BUT
IF YOU GO AFTER THESE AREAS
THAT WOULD BE CONSIDERED A
OVERT AND PROVOCATIVE MOVE
NECESSITATING A- AT THE FEDERAL
RESPONSE. DO YOU HAVE ANY
THOUGHTS ON CREATING ENHANCED
PENALTIES FOR ATTACKS THAT HIT
CERTAIN DESIGNATED CRITICAL
INFRASTRUCTURE IS. YEAH BUT ON
THIS ONE NOT MIKE MCNERNEY
HERE- WHAT A GREAT QUESTION- HI
I AM IN FAVOR I DO THINK IT'S
TIME TO TAKE THE GLOVES OFF TO
BE HONEST- AND TO SOME EXTENT
WE'RE SEEING THE CURRENT
ADMINISTRATION DOING THAT- WE
SAW IT YESTERDAY. ANOTHER SIX
MILLION DOLLARS IN NEW CRYPTO
CURRENCIES I THINK WE HAVE- I
THINK POLAND BABY ANNOUNCED
THAT THEY HAVE THE PERSON WHO
WAS RESPONSIBLE FOR ABOUT AND
SAY- ATTACK UNDER CUSTODY KNOW
THE RESULTS OF. INTERNATIONAL
EFFORTS WE WORK WITH OUR OUR
ALLIES ACROSS EUROPE IN OTHER
NATIONS TO TRY TO BRING POP UPS
TO JUSTICE- THE JUSTICE
DEPARTMENT ELEVATING OUR RANKS
MORE GAMES TO BE LEVEL- YOU
KNOW TERRORIST ORGANIZATIONS- I
THINK THESE ARE ALL THE RIGHT
MOVES WE DO HAVE TO BRING MUCH
MORE PRESSURE TO BEAR. A LOT OF
THESE- AND HE'S YOU KNOW-
SENATOR THEY'RE BASED IN IN
OTHER COUNTRIES- THEN WE HAVE
TO PUT PRESSURE ON THEM TO- TO
BRING THESE PEOPLE TO YOU KNOW
OTHERWISE THEY'RE GONNA
CONTINUE. WHAT THEY'RE DOING SO
I AM IN FAVOR. PLEASE ENTIRELY.
FIVE BUSINESS MODEL I MEAN.
YOU'RE LOCATED ANOTHER PART OF
THE- PRESUMABLY- IN AREAS OR IN
COUNTRIES. THAT DON'T HAVE A
STRONG RELATIONS WITH THE U. S.
OR EVEN. EXTRADITION AGREEMENTS
WITH THE U. S. LIFE WE DON'T
ELEVATE THIS DIED AT THE
APPROPRIATE LEVEL AND I DON'T.
I DON'T JUST MEAN THE FEDERAL.
THE GIRL. WAS HACKED. AW IT
WITHDREW THE RATES WERE PROCESS
AND HAD TO MAKE A DECISION
DUDE. DID HE PAY OR NOT. AND
REACHING OUT TO THE FEDERAL
AUTHORITIES THEY WERE SO
OVERWHELMED. THAT IT LITERALLY
WAS. A SPEED BUMP THAT TYPE OF
RESPONSE- THEY JUST DIDN'T KNOW
WHAT TO DO. TWENTY CENTER
BORDERS- CENTER NUMBER. THANK
YOU CENTER BOARDS PERFECT
SEGUE- IN TERMS OF FORMING SOME
SORT OF CYBER SECURITY AGENCY I
INVITE YOU TO JOIN SENATOR MEN
SENATOR STERN AND ME- IN OUR
ENDEAVOR. TO DO JUST THAT NOW
FOCUSES ON CYBER TERRORISM BUT
IT'S REALLY THE SAME FAMILY OF-
MISCREANTS I THINK THAT THAT
ARE BOTH STEALING AND CREATING
OTHER KINDS OF TURMOIL. A
COUPLE THINGS- ALSO WITH
RESPECT TO INCREASE PENALTIES-
I'M ALL FOR INCREASING
PENALTIES I THINK ONE OF THE
CHALLENGES WE HAVE IS ACTUALLY-
IDENTIFYING IN APPREHENDING
THOSE WHO HAVE COMMITTED THESE
CRIMES- AND THEN THAT'S MY
QUESTION- I UNDERSTAND THAT
THAT WE ARE. CONTINUING TO
FOCUS I'VE NOT HEARD OF ANY
SUCCESSFUL PROSECUTION- WITH
RESPECT TO IDENTITY THEFT- OF
ANY GREAT MAGNITUDE OR ANY SORT
OF RANSOMWARE PROSECUTION AND
PERHAPS YOU CAN EDUCATE ME AND
ALSO EDUCATE US AS TO WHAT WE
MIGHT BE DOING. AS A STATE A
COUPLE THINGS ONE IS
GOVERNMENTAL INTERVENTION AND
THEN SECONDLY SECOND PART OF MY
QUESTION FOR EITHER OR BOTH OF
YOU. IS BOB I'M JUST LOOKING AT
MY COMPUTER RIGHT NOW I HAVE
TWO EMAILS THAT ARE SUSPECT ONE
FOR MY CREDIT CARD COMPANY ONE
FROM MY BANK THEY BOTH LOOK
VERY OFFICIAL I I'D LOOK JUST
TO SEE I DON'T. I DON'T THE
WHOLE THANK YOU CENTER BOARD
JUST I APPRECIATE YOU
TRANSFERRING TEN MILLION
DOLLARS ALL I NEED TO DO IS
SEND YOU. A COUPLE HUNDRED
THOUSAND DOLLARS AND YOU'RE
GONNA SEND ME TEN MILLION BUT
WHAT BUT IT LOOKS VERY
AUTHENTIC AND THEN LETS YOU
LOOK AT THE ADDRESS. YOU CAN'T
TELL THAT IT'S NOT FROM THE
ACTUAL ENTITY THAT PURPORTS TO
BE FROM. AND THE QUESTION IS
WHAT IS THE RESPONSIBILITY SO
FOR EXAMPLE- WHEN MY BANK IS
TOLD THAT THERE'S A MESSAGE
COMING PURPORTEDLY FROM THEM
THAT LOOKS VERY OFFICIAL DO
THEY HAVE ANY RESPONSIBILITY
SHOULD THEY HAVE ANY
RESPONSIBLE SAME THING WITH A
CREDIT CARD. IT LOOKS LIKE IT
COMES FROM THE CREDIT CARD
COMPANY LOOKS VERY OFFICIAL
TELLS ME THAT I NEED TO MAKE AT
LEAST IN THE SUBJECT LINE SOME
SORT OF PAYMENT IT'S FALSE. IN
ANY EVENT WHAT WHAT SHOULD BE
THEIR RESPONSIBILITY AND LASTLY
THANK YOU BOTH FOR YOUR VERY-
IMPORTANT TESTIMONY THANK YOU
MR MCNERNEY FOR YOUR SERVICE
WERE UP ON THE EVE OF VETERANS
AND WE APPRECIATE THAT. ALL
RIGHT I'LL LEAVE THE TWO OF YOU
TO RESPOND. ALL RIGHT I CAN
MAYBE PICK UP A CENTER WHERE I
LEFT OFF AND I'M I'M HAPPY. TO
YIELD TO THE BRUCE IS WELL- ON
THE FIRST OF ALL WAIT WELL I
THINK YOU'RE RIGHT WE SEE SOME
PROSECUTIONS BUT I WANT TO SAY
MOST OF THOSE HAVE BEEN ABOUT.
ESPIONAGE AND IT ENDED IN A LOT
AT LEAST HIGH PROFILE ONES-
ALTHOUGH I DO THINK HE'D BE
RANSOMWARE- WHEN'S IT COMING I
DON'T THINK YOU CAN
DESTRUCTION. MAKING THIS MUCH%
NOISE IF THEY DIDN'T HAVE.
SOMETHING IN MIND SO- I THINK
SHE PROBABLY YOU KNOW STAY
TUNED ON THAT BUT YOUR LARGER
POINT ABOUT THIS BEING.
DIFFICULT IS EXACTLY CORRECT.
IT'S VERY HARD TO ATTRIBUTE. TO
TRIBUTE- YOU KNOW THESE
ACTIONS. ARE IN CYBERSPACE AND
EVEN WHEN YOU DO THE WRONG
COUNTRIES WHERE IT'S VERY
DIFFICULT TO KIND OF. YOU KNOW
GET OUT ON- BUT YOU CAN- YOU
KNOW. THE UNITED STATES ONE
QUITS ITS YOU KNOW WE- I IT IS.
GOOD AT. MY AND SO I WE ALL.
THE ARE THINGS THE LEVEL WE
ELEVATE. THEM TO MATCH. AS I
MENTIONED ON THIS HAPPENED
RECENTLY I THINK WE WILL BE
ABLE TO FIND A LOT MORE ROOM-
WE MAY NOT BE ABLE TO BRING ALL
OF THEM TO JUSTICE BUT I DO
THINK WE WILL. HAVE THE TOOLS
TO BE BACK WE MAY BE ABLE TO DO
THINGS DIPLOMATICALLY WORK WITH
INTERNATIONAL PARTNERS AND
AGAIN. WE SEE A LOT MORE THAT.
THE SAMPLE THAT WE WILL BE AND
I THINK IT'LL BE- I THINK IT
WOULD BE IMPOSSIBLE SO THAT'S-
THAT'S GREAT YOUR SECOND
QUESTION IS A GREAT ONE AS
WELL- I WOULD ADD ONE OTHER
LEVEL OF NEW WANTS TO THAT- I
JUST RECEIVED ONE OF THESE. YOU
KNOW FAKE. CREDIT CARD- EMAILS
THE OTHER DAY ON AND- IT
pADDRESS IS BECAUSE THE ATTACKER
HAD- ALL. ACCESS THE SCHOOL
SYSTEM IN SOUTH DAKOTA- AND
WAS. USING THEIR SYSTEM. AS A
LAUNCHING POINT TO SEND. OUR
STATE EMAILS LOOKING FOR ARE
YOU HOPING I WOULD CLICK ON IT
AND THEN GIVE THEM MY BANK
ACCOUNT INFORMATION. SO IT'S
NOT JUST THE BANK IN THE AMOUNT
OF TIME I HAVE HEARD THE VICTIM
WAS ALSO. THIS KIND OF ERROR.
RT WHERE- YOU MAY MAYBE I'M
BEING. TO POSTING ABOUT ACTOR
IN BARN. OUR MISSILES. TO FOR
EVERYONE REALLY NOT JUST ABOUT
MUST FOR EVERY- T. PRIESTS
THERE. HI INCREASE THEIR SIZE.
POSTURE UNDER WHAT'S GOING ON
IN THEIR- FOLLOW. BECAUSE YOU
NEVER KNOW WHERE ONE OF THESE
THINGS AND PUMP. THAT'S WHY I
THINK WE NEED TO KIND OF LOOK
EVERYBODY. ARE GAINING EXACTLY
CAN. ALL MOVE BACK TO PROCESS
ARE. SECURE YOU LIKE TO ADD A-
JUST A FEW QUICK ANSWER FOR.
FIRST OF ALL I AGREE IT IS IT
IS OFTEN DIFFICULT TO IDENTIFY.
THE ATTACKERS AND THEREFORE
PROSECUTIONS ARE A REAL. BUT WE
ARE SEEING SOME SUCCESS IN THE-
DESTRUCTION OF THEIR NETWORKS
SHE'S RIGHT. AS YOU MAY HAVE
SEEN A FAIR A LARGE PERCENTAGE
OF THE RANSOM PAID IN THE
COLONIAL PIPELINE ATTACK WAS
RECOVERED AND THAT'S BECAUSE
LAW ENFORCEMENT AND- THE- ON
THE BROADER LONG FORCE FEDERAL
LAW ENFORCEMENT COMMUNITY. USED
EXISTING FINANCIAL SERVICES LAW
CONCERNING CREEK DR CRYPTO
EXCHANGES AND ACTUALLY
DISRUPTED THE FINANCIAL SUPPLY
CHAIN IF YOU WILL THAT THE
ATTACKER WAS USING I THINK
WE'RE GOING TO SEE MORE OF
THAT. BEFORE WE SEE MORE
PROSECUTIONS. AS FOR THE- WHAT
WHAT WHAT CAN GOVERNMENT LIKE
LOCAL AND STATE GOVERNMENT YOU
I THINK THERE IS I'LL JUST-
I'LL EMPHASIZE ONE BIG CONCEPT
WHICH IS COLLABORATION AND PART
OR AND OUR PARTNERSHIP. WE'VE
SEEN A GREAT DEAL OF BENEFIT
FROM A PUBLIC PRIVATE
COOPERATION AND COLLABORATION
IN DEFEATING CYBER SECURITY OR
AT LEAST PREPARING
ORGANIZATIONS TO GET THEIR
SYSTEMS READY TO DEFEND AGAINST
CYBERTHREATS- I'LL GIVE YOU
ANYTHING TO GIVE YOU AN EXAMPLE-
WE- WORKED WITH. THE WITH VISA
AND OTHER AGENCIES OF THE
FEDERAL GOVERNMENT WHEN- YOU
RECALL EARLIER SHE THIS YEAR
THERE WAS A- VULNERABILITY
IDENTIFIED WITH MICROSOFT
EXCHANGE SERVERS. WE WERE ABLE
TO HELP IDENTIFY WHERE THE-
VULNERABLE SOFTWARE INSTANCES
WERE. AND WE DID SO IN A
LEGALLY COMPLIANT FASHION AND
THEN WE'RE ABLE IN A LEGALLY
COMPLIANT FASHION TO SHARE THAT
WITH THE RIGHT GOVERNMENTAL
AGENCIES. AND THEY WERE ABLE TO
COMMUNICATE THAT YOU DISTRIBUTE
FASHION TO POTENTIALLY
VULNERABLE INSTITUTIONS AND
USERS THAT WAS A GOOD
COLLABORATION I THINK THERE
NEEDS TO BE MORE THAT I THINK
THERE'S DEFINITELY A ROLE FOR
STATE LOCAL GOVERNMENT IN THOSE
COLLABORATIONS FINALLY YOUR
POINT ABOUT. A PHISHING SCAMS
IN THE ROLE WHAT WHAT
RESPONSIBILITY TO DO- DO THE DO
THE TWO COMPANIES HAVE I THINK
ANY CONSUMER FACING COMPANY
NEEDS TO HAVE GOOD HYGIENE
PRACTICES RIGHT I KNOW THE
BANKS HAVE. EXCELLENT HYGIENE
PRACTICES THERE'S ALSO A HUGE
EDUCATIONAL COMPONENT. I THINK
THE CONSUMER FACING
ORGANISATIONS DO A LOT OF
EDUCATING THEIR CONSUMER BASE
TO SAY THESE ARE THE TYPES OF
EMAILS AND COMMUNICATIONS YOU
RECEIVE FROM US. IF IT DOESN'T
LOOK LIKE THIS DON'T ACT ON IT
BUT I THINK THAT I'VE SEEN ARE
REALLY EFFECTIVE- EDUCATION AND
COMMUNICATION COMING OUT OF.
GOVERNMENTAL INSTITUTIONS TO
CONTINUALLY REFRESH- THE
AVERAGE YOU KNOW THE AVERAGE
PERSON'S UNDERSTANDING OF WHAT
IS OR IS NOT STATE SPACE. IN IN
THE ON THE INTERNET. THANK YOU
LET ME JUST FOLLOW UP A COUPLE
THINGS ONE IS- I'M- SOLICITOUS
OF SUGGESTIONS AS TO HOW WE CAN
INCENTIVIZE THAT KIND OF
COOPERATION I SUPPOSE THIS
INCENTIVIZE NON COOPERATION
THAT THAT'S POINT NUMBER ONE.
NUMBER TWO IS I MENTIONED
GETTING- OF. PHISHING EMAIL
FROM SOME IMPORTS TO BE MY
BANK. TODAY MY BANK CONTINUALLY
ASK ME FOR MORE INFORMATION
THEY CONTINUALLY ASK ME NOT TO-
REQUIRE PAPER STATEMENTS BUT TO
REQUIRE JUST TO PROVIDE FOR
ELECTRONIC STATEMENTS. AND IT
WOULD SEEM THAT THERE IS A
SPACE FOR US TO. REQUIRE THAT
WHEN YOU'RE PROVIDING THIS
INFORMATION THAT THE ENTITYHAS
SOME SORT OF OBLIGATION. TO
MAKE SURE THAT THEY DO THAT AT
LEAST SOMETHING TO NOTIFY THEIR
CONSUMERS THAT THAT. YOU MAY
RECEIVE SOMEHOW THEY GOT MY
INFORMATION TO THE BANK THAT I
USE THAT YOU MAY RECEIVE YOU
KNOW SCAMMY. EMAILS AND HERE'S
HOW TO JUST TO YOUR POINT
HERE'S HOW TO PROTECT YOURSELF
THEY HAVE SOME OBLIGATION ALSO
I THINK. TO ENGAGE IN THIS
ACTIVITY PARTICULARLY WITH
RESPECT TO SENIORS. THE SENIORS
ARE TARGETED IN SOMETIMES
VULNERABLE POPULATION- AND-
THAT SEEMS LIKE A SPACE IN
WHICH WE MIGHT WANNA OPERATE
ANYWAY THE INTEREST IN YOUR
THOUGHTS. SO- ALTHOUGH IT WAS
DARK BUT- CENTER SO- ACTUALLY
LET ME- LET ME SAY ALSO- HAPPY
OUT RUSSIANS DO YOU AS WELL-
ALSO GREAT- GREAT QUESTIONS- I
THINK CLEARLY THE STATE CAN BE
MORE- I THINK- THERE ARE SOME
EXAMPLES LIKE FOR AT THE
FEDERAL LEVEL- THE DEPARTMENT
OF COMMERCE AND THE- THE-
AGENCY THAT WORKS FOR THEM
CALLED NEXT. THEY'RE WORKING
WITH THE PRIVATE SECTOR- TO
SET- NEW CYBER SECURITY HYGIENE
STANDARDS USING VOLUNTARY
STANDARDS AND IT WILL BE
ADOPTED. NATIONWIDE BUT- I
DON'T FOLLOW THE NETWORKS
OTHERS YOU WERE INVOLVED IN
TRYING TO SET SOME OF THE
STANDARDS TO TRY TO. HELP
EVERYBODY UNDERSTAND EXACTLY
WHAT IT IS WE NEED TO DO TO
PROTECT OURSELVES AND PROTECT
INFORMATION- THAT WE MAYBE- ARE
YOU KNOW REALLY GET CUSTOMER
INFORMATION HOW DO YOU PROTECT
THAT HOW TO PROTECT OURSELVES.
AND THEN ADOPT THEM- AND YOU
KNOW WE CAN GO A STEP FURTHER
AS WELL WE COMMIT- TO- PRESENTS
A WHOLE OUR CUSTOMERS. TO THEIR
STANDARDS ON THE RIGHT. SO
THERE ARE THINGS IN THE PRIVATE
SECTOR CAN YOU ARTICLE SAYS
STANDARDS AND SEE IF THEY ARE
FORCED THERE'S NO REASON THE
STATE CAN'T HELP- DO SIMILAR
THINGS RIGHT- I THINK BRUCE
ALLUDED TO THIS EARLIER.
COLLABORATION AND DATA SHARING-
AND THAT KIND OF STUFF WILL
ALWAYS BE REALLY HELPFUL IT
CANNOT BE UNDERSTATED- AND THEN
YOU CAN ALSO REQUIRE STATE. AND
LOCAL ENTITIES TO MEET A
CERTAIN LEVEL OF HYGIENE- YOUR
SECURITY STANDARDS- THEMSELVES-
COURSE YOUR FINAL POINT. YOU
KNOW WHEN- WHEN IN OF THE CALL
I. PRIVATE FROM FROM. ANYONE DO
YOU HAVE AN ELEVATOR STANDARD-
TO TAKE. AWAY YOU KNOW LOT MORE
OBLIGATION TO TAKE CARE NEXT BE
A- ONE THAT ALL THE SERIES. AND
I CAN YOU KNOW SO HELP IS LED
THE WAY MAKING A REGULAR. AND
LEGAL- OR MAY. AGAIN LEADING
THE IN THINGS LIKE THAT RUGE.
SO THERE'S ABSOLUTELY A R. AS
WELL TELL ME SOMETHING. SO WE
WELCOME YOUR C. S. TO HOW WE
CAN AGAIN INCENTIVIZE.
COOPERATION COLLABORATION AND
THIS IS WHAT'S THIS
INCENTIVIZE. THE FAILURE TO DO
SO. THANK YOU SENT- I WANT TO
FOLLOW UP ON INCENTIVES- I
OBVIOUSLY WANT TO INCENTIVIZE
COLLABORATION COOPERATION- BUT
I'M ALSO HEARING THAT. WHEN
WE'RE TALKING ABOUT HOW TO BEEF
UP CYBERSECURITY PROTOCOLS-
THERETHERE'S A LOT OF
DIFFERENT PROCESSES THAT WE
WOULD WANT THE PRIVATE SECTOR
TO TOP WHETHER THAT SOME OF THE
WAR GAME TYPE SELF ASSESSMENTS
THAT- SOME YOU HAVE ALLUDED TO-
WHETHER THAT'S- YOU KNOW JUST
DEVOTING RESOURCES OR
OTHERWISE- AND I'M CURIOUS
ABOUT. WHAT IDEAS YOU HAVE ON
GOVERNMENT POLICIES STATE
GOVERNMENT POLICY THAT CAN HELP
ENCOURAGE TAKE UP. OF SOME OF
THESE BASIC CYBERSECURITY
PRACTICES THAT WE KNOW ARE
LACKING ACROSS LARGE SWATHS OF
THE PRIVATE SECTOR I'M NOT SURE
IF YOU MR MCNERNEY- YOU KNOW
CAN WE SEE INSURANCE USING A
LOT OF PLACES AS A WAY TO TRY
TO INCENTIVIZE A PRUDENT
PRACTICES ARE BEST. BEST
PRACTICES WHETHER THAT'S CAR
INSURANCE HEALTH INSURANCE OR
OTHERWISE- WE KNOW WE GET
PREMIUMS FOR YOU KNOW- GETTING
IN ACCIDENTS OR OR TRAFFIC
INCIDENTS OR WHATNOT. DO YOU
SEE A SIMILAR ROLE FOR CYBER
INSURANCE AS MAYBE BEING A
PATHWAY TO- INCURSION PRIVATE
COMPANIES TO ADOPT BEST
CYBERSECURITY PRACTICES. AND IF
SO- MAYBE COLLABORATE ALSO
ELABORATE ON WHAT THE
GOVERNMENT CAN DO TO ENCOURAGE
MORE CYBER INSURANCE BECAUSE
THIS IS SUCH A NASCENT INDUSTRY.
YEAH THANK YOU SENATOR- I DO
FEEL THAT WAY IF I CONTINUE TO
BE TO BE DIRECT- I DON'T KNOW
THAT THE CYBER INSURANCE
INDUSTRY HAS BEEN ALL THAT
HELPFUL IN THIS REGARD YES-
IT'S RELATIVELY IMMATURE
INDUSTRY- AND SPOTTING
RANSOMWARE- WHICH IS CALLED A
SURGE EARLIER TODAY I THINK IS
EXACTLY RIGHT. THAT IS CHANGE
THE MARKET I THINK IT IS AND IT
SHOULD NOT BE MARKET IS-
BECAUSE INSURERS- TO KIND OF
WAKE UP TO THE CHALLENGES IN A
WAY THAT MAYBE DIDN'T BEFORE.
BECAUSE THE LOSSES ARE SO
TREMENDOUS RIGHT AND REALIZED
IMMEDIATELY IN A VERY LARGE AND
SO WE'RE STARTING TO SEE A
CONTRACTION IN THE MARKET- A
LESSENING OF SUPPLY OR DEMAND
IS GOING UP- AND THAT IS
ACTUALLY A LEADING- YOU KNOW
THOSE OF US THAT ARE THAT ARE
CONTINUING TO OFFER CYBER
INSURANCE. I HAVE A BIGGER HAND
IN IN WHAT WE ARE YOU KNOW KIND
OF REQUIRE OF OUR CUSTOMERS.
AND OUR VISION I DO THINK THE
MARKET IS HEADED THIS WAY IS A
LOT MORE LIKE YOU DESCRIBE.
WITH DRIVERS INSURANCE OR OR
LIFE INSURANCE WERE YOU CAN'T
ENGAGE IN RISKY BEHAVIOR
EXPECTS. TO GET LIFE INSURANCE
YOU CAN'T GO YOU KNOW- LIGHTING
AND EXPECT THAT LIFE LIFE
INSURANCE RIGHT- CYBERSECURITY
INSURANCE IS HEADED THAT WAY-
LAST YEAR- WAS COMPLETELY
DIFFERENT STORY I'VE- BEEN
TELLING YOU SOMETHING DIFFERENT
AND THIS WAS LAST YEAR. BUT
THIS YEAR LIKE FOR EXAMPLE IF
YOU KNOW AS I MENTIONED MY
TESTIMONY YOU DON'T HAVE MULTI.
FACTOR AUTHENTICATION YOU
PROBABLY CAN'T- THAT IS NEW
DATA ON THIS AND I THAT TREND I
THINK HE'S GOING TO- AND SO
THIS THAT IS MOST HELPFUL TO US.
THE SHARES WERE. IN DAY. SO TO
THE EXTENT THAT THE- THE STATE
AND- HELP US- YOU KNOW JACK'S.
TO WHAT CONTROLS ARE THE MOST
IMPORTANT TO PREVENT ANY
BREACH- WHAT DID DAMAGES LOOK
LIKE. THOSE KINDS OF THINGS
THAT WILL HELP US DETERMINE-
YOU KNOW WHAT OUR UNDERWRITING
STANDARDS SHE BASED ON THOSE
THINGS ARE REALLY GOING TO- AND
THEN YOU KNOW AGAIN AS I
MENTIONED. ARE REQUIRING. OR
REQUESTING A WHATEVER YOU WANT
TO DO THAT THAT- STATE AND
LOCAL GOVERNMENTS HAVE AN
ELEVATED- CYBER SECURITY LEVEL
OF HYGIENE BEFORE BY THE WAY
MANY MUNICIPALITIES ARE
QUALIFIED FOR CYBER INSURANCE.
ON IT VERY HARD TO GET IT-
BECAUSE THE CONTROLS ARE SO
POOR RIGHT SO- YOU KNOW HAVING
THEM I HAVE THE RESOURCES AS
WELL AS THE UNDERSTANDING OF
WHAT THEY NEED TO DO TO
INCREASE OUR CYBERSECURITY
POSTURE. ALL RIGHTS ARE AND
HAVE YOU BEEN IN DISCUSSIONS
WITH COMMISSIONER LAWRENCE
OFFICE AROUND- WHAT WE CAN DO
TO. BEEF UP AND. AND REALLY
EXPAND US EVER INSURANCE. US
SENATOR WE HAVE NOT YET OTHERS
MAY- I KNOW ARE ON OUR LIST.
BUT- OUR COMPANY'S NOT. BAD AND-
I WANT TO TAKE THIS QUESTION
YOU MISTER BYRD IN A SLIGHTLY
DIFFERENT WAY. YOU KNOW WHAT I
THINK AGAIN TO THE POINT OF NOT
JUST COLLABORATION COOPERATION
BUT BEGINNING FOR THE PRIVATE
SECTOR TO. YOU JUST A TOP BASIC
CYBERSECURITY PROTOCOLS IT'S
GREAT TO HAVE STANDARDS BUT- I
THINK AN IMPORTANT. NEXT STEP
IS TO ENSURE THAT R TRY TO
INCENTIVIZE- PRIVATE COMPANIES
TO TAKE UP THOSE MEASURES AND I
GUESS. YOU KNOW WHEN I THINK OF
POLICY WE THINK OF CARROTS AND
STICKS. WHAT THE CARROTS AND
STICKS YOU THINK MIGHT BE
HELPFUL COMING FROM THE STATE
GOVERNMENT THAT MIGHT INCREASE
ADOPTION OF CYBER SECURITY BEST
PRACTICES. WELL FIRST I THINK
THAT- I'LL FOCUS PRIMARILY ON.
CARROTS. ONE ONE THING IS OUR
TOP DOWN LEADERSHIP. I THINK
THAT. ABOUT ONE ONE VALUABLE
ACTIVITY THAT STATE GOVERNMENT
CAN DO. IS ENSURE THAT ITS OWN
HOUSES IN ORDER FROM A CYBER
SECURITY STANDPOINT- THAT
DOESN'T NECESSARILY MEAN
SPENDING AND- YOU KNOW.
LAVISHLY ON EVERY SINGLE PIECE
OF NEW TYPE OF TECHNOLOGY. BUT
THERE ARE SOME THESE FRAMEWORKS
ARE WE'RE TALKING ABOUT I
THINK. EVALUATING THEM AND
ENSURING WITH YOUR OWN- CYBER
PROFESSIONALS THAT YOU ARE JUST
HOLDING- CYBER SECURITY
PROTECTION ON YOUR EXISTING IT
SYSTEMS BUT YOU ARE REALLY
MAKING IT AN INTEGRAL PART OF
YOUR PROCUREMENT PLANS AND YOUR
TECHNOLOGY ROADMAPS. SIX
PURSUANT TO ALREADY ESTABLISHED
FRAMEWORKS THAT WE KNOW CAN
WORK I THINK IT'S A IT'S A
GREAT WAY TO INCENTIVIZE GOOD
BEHAVIOR. TO I THINK YOU HAVE
TO BE HONEST ABOUT THE RESOURCE
CONSTRAINTS AND FIGURE OUT
WHERE RESOURCE CONSTRAINTS
EXIST WHY WHY AREN'T CERTAIN
BUSINESSES- ASSESSING OUR OR
EMPLOYING NEW TECHNOLOGIES AND
FIGURING OUT WHERE THOSE
RESOURCE HOLES ARE- IF THERE IS
A SIGNIFICANT OR LEGITIMATE
RESOURCE PROBLEM. I DON'T KNOW
WHETHER A MANDATE ALONE WOULD
SOLVE IT AND SO- I GUESS THAT
LEADS TO THE THIRD POINT WHICH
IS YOU CAN'T PROTECT SOMETHING
YOU DON'T KNOW NEEDS
PROTECTING. SO I THINK THAT-
FIGURING OUT YOU KNOW WAYS TO
USE TECHNOLOGY TO IDENTIFY
WHERE THE MOST VULNERABLE
SYSTEMS ARE- AND THEN
PRIORITIZING THOSE SYSTEMS IS A
GOOD WAY TO AT LEAST MARSHAL
RESOURCES- AND THEN FINALLY I
WOULD FOCUS ON- PARTNER- I
THINK THAT A- COLLABORATION
THAT INVOLVES. THE UNIQUE.
CAPABILITIES AS PARTICULARLY
LAW ENFORCEMENT ENFORCEMENT
CAPABILITIES OF GOVERNMENT WITH
THE KNOWLEDGE OF CYBER SECURITY
COMPANIES HAVE- TO UNDERSTAND
EMERGING THREATS AND THE LAW
THE- VISIBILITY THAT. PRIVATE
INDUSTRY CAN US INTO THE- THEIR
THEIR RESOURCE CONSTRAINTS I
THINK A PARTNERSHIP IN THAT
AREA IS THE BEST WAY TO MOVE
FORWARD. GOT IT THANK YOU
MISTER BYRD- SO MOVING TO THE I
GUESS PUBLIC SECTOR- YOU KNOW
WHEN WE THINK ABOUT GOVERNMENT
PROTECTING ITS OWN HOUSES YOU
PUT MISTER BYRD WHAT ARE SOME
OF THE BEST PRACTICES THAT WE
SEEN FROM OTHER COUNTRIES OR
OTHER JURISDICTIONS SUCH AS
STATES LIKE. ARE THEIR MODELS
THAT WE CAN LOOK TO THAT THAT
MIGHT HELP INFORM US AS WE
PROCEED DOWN THE LINE HERE IN
CALIFORNIA. FRIDAY YES. SIR
WOULD YOU MISTER BYRD. I JUST
HAVE TO THINK ABOUT SPECIFIC
INSTANCES OF- I WOULD I WOULD
SAY THE MOST NOTABLE THAT COMES
TO MIND IS SMETHING THAT WE'RE
FAMILIAR WITH AND THAT IT
PROBABLY DESERVES A LITTLE BIT
OF STUDY IS THAT THERE IS A-
PUBLIC PRIVATE PARTNERSHIP IN
THE NORTH JUST IN NORTH DAKOTA
DESIGNED TO INTEGRATE- THE
CYBER SECURITY CAPABILITIES
ACROSS AGENCIES ACROSS ACROSS
INSTITUTIONS AND IT'S DONE IN A
PUBLIC PRIVATE PARTNERSHIP. I
WOULD SAY THAT IS A GOOD MODEL
FOR HOW A STATE STATE ACTORS
CAN INCENTIVIZE GOOD BEHAVIOR
AND THEN HELPED PUSH RESOURCES
OUT TO WHERE IT'S NEEDED MOST-
ALSO I CAN I THINK WE CAN'T.
IGNORE IF WE'RE TALKING ABOUT
INCENTIVES HOW TO HOW TO INSURE
THAT CYBER DEFENSES ARE PUSHED
OUT MORE HOLISTICALLY TO WHERE
THEY'RE NEEDED THEN THE
RECENTLY ENACTED OR ARE SOON TO
BE SIGNED- INFRASTRUCTURE
LEGISLATION. I HAVE SEVERAL
INTERESTING. REGARDING CYPRUS I
THINK THE TOTAL AMOUNT-
APPROPRIATED FOR CYBER SECURITY
IS ROUGHLY TWO BILLION DOLLARS.
BUT THEY ARE THERE IS A STATE
OR LOCAL PROGRAM GRANT PROGRAM
ESTABLISHED BY THAT LAW. WE
THINK IT COULD BE A REALLY
COMPELLING- ELEMENT OF THAT LAW
TO OVERCOME RESOURCE
CONSTRAINTS- AT THE STATE BUT
ALSO PARTICULARLY AT THE LOCAL
LEVEL SO THAT GRANT PROGRAM IS
SOMETHING THAT. I THINK EVERY
OF STATE AND LOCAL GOVERNMENT
INSTITUTIONS SHOULD PROBABLY
GET- INFORMED ABOUT. AND I
SHOULD PROBABLY RELYING ON
CYBER SECURITY EXPERTS TO HELP
IDENTIFY THE BEST WAY TO MAKE A
GRANT REQUEST. MENTAL HEALTH
CENTER HOW TO ADD TO THAT
REALLY QUICKLY I'M A BIG FAN OF
EXERCISING- AND SO- YOU KNOW TO
THE EXTENT YOU'RE ABLE TO USE
POWER WE ASKED OF THE NATIONAL
GUARD. TO GO THROUGH CYBER
INCIDENT I KNOW I THINK I
ALWAYS BEEN A VERY BIG ONE I'LL
GO THROUGH THAT AND IT. WILL
BECOME APPARENT RIGHT YOU MAY
NOT BE JUST TECHNOLOGICAL MEDIA
PEOPLE YOU DON'T HAVE ENOUGH OF
THE RIGHT PEOPLE IN THE RIGHT
PLACES MAYBE THEY DON'T HAVE
THE RIGHT TRAINING OR COULD BE
PROCESSES RIGHT- SO I WOULD SAY
PEOPLE PROCESS AND TECHNOLOGY
AND DO A- DO A COUPLE EXERCISES
AND SEE WHAT SHAKES OUT AND
THEN I THINK HE'S- GOING. TO
COME UP WILL BECOME VERY. GREAT
THANK YOU I'M JUST TWO MORE
QUESTIONS- FIRST- GOING. TO THE
QUESTION A STANDALONE AGENCY-
YEAH WE KNOW THAT THERE IS THE
WORKING GROUP ON ACCOUNT- YES-
BUT- WHAT WOULD YOU SEE IS THE
KEY ATTRIBUTES AND RESOURCES
AND OTHER CHARACTERISTICS. IF
WE WERE TO TRY TO CREATE AN
EFFECTIVE AND ROBUST.
STANDALONE AGENCY WHAT WOULD
THAT LOOK LIKE FROM YOUR
PERSPECTIVE- AND YOU KNOW
OBVIOUSLY WE HAVE TO ADAPT TO
ONGOING- YOU KNOW DEVELOPING-
TRANSFORMING THREATS WHAT. WHAT
ARE THE CHARACTERISTICS THAT WE
NEED TO BE THINKING ABOUT FOR A
STANDALONE AGENTS. I'LL START
WITH YOU MR MCNERNEY. THANK YOU
SENATOR I THINK WE CAN TAKE
SOME LESSONS MAYBE FROM FROM
THE FEDERAL EXPERIENCE HERE
IT'S A REALLY TOUGH QUESTION-
CYBER SECURITY IS VERY COST
CUTTING- YOUNG CALLOW YES HAS A
TREMENDOUS- PART OF THIS AS I
MENTIONED THE NATIONAL GUARD
HOW DOES THE STATE CIO AND
CISO- AND SO YOU'RE MAYBE
EXPECTED TO TAKE LESSONS FROM.
THE FEDERAL GOVERNMENT WITH
ADAM HOW'RE I NEED TO SEE LIKE
SEA SALT- AND GIVEN IT. WE YOU
HAVE MORE ABOUT IBM HOW TO
SEVERAL. ONE OF THE- THAT SPACE
WORKS AND ALL OTHER THEIR THEIR
SCIENCE YOUR REQUIREMENTS. YEAH
I LOVE THE MODEL OF THIS ARE WE
HAVE A NEW STANDARD COMMERCE-
THAT WORKS CLOSELY WITH THE
PRIVATE SECTOR TO COLLECT DATA
ANALYZE DATA- AND PUT OUT
STANDARDS. AND THEN FINALLY YOU
KNOW WE'RE SEEING RIGHT NOW AN
EXPERIMENT WITH A NEW NATIONAL
CYBER RECORD THAT IS HAPPENING
RIGHT- SOMEONE HAS A YEAR TO
THE PRESIDENT. OUGHT TO HELP-
YOU KNOW SHOW THAT THIS IS
REALLY IMPORTANT ISSUE- AND THE
DRIVE DOWN DECISIONS ARE YOU
FROM THE TOP ALL THE WAY ON
DOWN SO. I THINK ANY ONE OF
THOSE THINGS MAYBE ALL THOSE
COULD BE CERTAIN FOR CALIFORNIA
CONSIDER GANGS IT'S SUCH A
CROSSCUTTING ISSUE- EFFECTS SO
MANY DIFFERENT AGENCIES.
PRIVATE SECTOR AND PEOPLE AS
WELL. MR THOUGHTS. REALLY QUICK
NUMBER ONE I THINK YOU'VE GOT
TO YOU KNOW THIS INSTANCE-
AGENCY TO HAVE BUILT IN
SKEPTICISM MEANING IT'S IT
NEEDS ITS OWN RED TEAM SO THAT
IS CONTINUALLY EVALUATING THE
CONCLUSIONS AND RECOMMENDATIONS
OF THE AGENCY THAT'S BECAUSE
THE ATTACK. MELODIES THE
ATTACKERS CAPABILITIES ARE
EVOLVING SO QUICKLY IF YOU WANT
TO MAKE SURE THAT YOU HAVE SOME
SOME BUILT IN. HE PROBABILITY
TO CHALLENGE YOUR ASSUMPTIONS
AND ENSURE THAT YOU ARE ALWAYS
IT'S NOT THE POINT THE MOST UP
TO DATE INFORMATION UPSTART
TECHNOLOGY YOU'RE AWARE OF IT.
AND THERE ARE RESOURCES
AVAILABLE INSIDE AND OUTSIDE
GOVERNMENT TO MAKE SURE THAT
BUT DIDN'T INFORMATION ABOUT
TECHNOLOGY AND THE MOST UPDATED
INFORMATION ABOUT THE TAX
THAT'S ONE THING THE SECOND
THING IS- MAKE SURE THAT THIS
AGENCY. ONE OF ITS PRIMARY
MISSIONS IS EDUCATION. IT NEEDS
TO BE THE SOURCE FOR SMALL
BUSINESS LARGE BUSINESS OTHER
GOVERNMENT AGENCIES IT NEEDS TO
BE THAT SOURCE THAT CAMPBELL H.
YES REQUEST FOR UNDERSTANDING
INFORMATION BUT ALSO PUSHES OUT
INFORMATION SO THAT- YOU HAVE
THE MOST INFORMED- GROUP OF
ACTORS GROUP OF POTENTIALLY
VULNERABLE INSTITUTIONS AS IT
CAN BE. THANK YOU MISTER BYRD
LAST QUESTION FOR ME- IS SO I
DON'T YOU HAVE A CHANCE TO
REVIEW THE GOVERNOR'S PROPOSED
A CAL SECURE INTERMITTENT C.
FRAMEWORK ON CYBER SECURITY
BUT- JUST LIKE MAYBE A QUICK
THIRTY SECOND REACTION YOU KNOW
IF YOU HAVE ANY QUICK THOUGHTS
THAT NOT LIKE A DEEP DIVE HERE
BUT- YEAH AND I SHOULD ADD THAT
I ASSEMBLYWOMAN JACQUI IRWIN
AND I ARE GONNA BE HOLDING A
HEARING ON THAT AT SOME POINT
IN YOUR FUTURE- JOINT HEARING
BUT- WOULD JUST BE INTERESTED
IN YOUR TAKE AWAYS WHAT
COMPLETES A GOOD SORT OF
BOOKING THE IMPROVED- WHAT
WHAT'S YOUR QUICK REACTION.
ALSO SENATOR I HAVEN'T- IT YET
BUT I'M HAPPY TO DO SO RIGHT
AND WRONG. THANK YOU MR
MCNERNEY. I THINK I AM I WOULD
JUST SAY THAT THE THINGS THAT
I. FIND MOST COMPELLING ABOUT
IT ARE PRETTY CONSISTENT WITH-
WHAT I'VE ALREADY SAID SO THE
RISK OF REPEATING MYSELF I JUST
I GIVE YOU I BROKE AND TOOK
SOME NOTES DOWN BEFORE THIS
HEARING. THE FACT THAT IT'S- IT
HAS BOUGHT IT IT APPEARS THAT
BUYING FROM LEADERSHIP IS KEY.
YOU'VE GOT UNFORTUNATELY YOU
KNOW TONE FROM THE TOP. MATTERS
AND IT HAS TO BE PERSISTENT
TRUE- A ROAD MAP. THAT THAT
STITCHES TOGETHER THE PEOPLE
AND THE PROCESSES AND THE
TECHNOLOGY IS GREAT BUT FOLLOW
THROUGH ON THE MEASURING OUT.
RIGHT YOU'LL YOU'LL SUCCEED AT
WHAT YOU MEASURE SO I WOULD SAY
IT IT REFLECTS SOME MEASURE
MEASURING OF SUCCESS THAT'S
CRITICAL DON'T LET THAT FALL TO
THE WAYSIDE. AND- REQUIRING THE
AGENCIES TO TESTING ANNUALLY
THAT THEY HAVE ACHIEVED CERTAIN
CAPABILITIES IS THAT'S THAT'S A
REALLY GOOD LOOKING PIECE OF
pYOU MISTER BYRD THANK YOU MR
MCNERNEY FOR YOUR TIME AND
EXPERTISE- WE'LL BE MOVING ON
SIR MR OMBRES SANTORUM HAS A
QUESTION IT'S VERY VERY
QUICKLY- AND I THINK SENATOR
EXCUSE ME I THINK MISTER BYRD
RAISE THIS ISSUE THAT'S WHAT'S
HAPPENING IN OUR OWN HOUSE IN.
IT APPS YOU CAN RESPOND TO THIS
EITHER MISTER BERGER MR
MCNERNEY. AS TO WHETHER OR NOT
WE'VE ACTUALLY DONE ASSESSMENT
IS TO STATE FUNCTIONS AND
THEIR- RESILIENCE TO. CYBER
THREATS IF WE HAVE GREAT IF WE-HAVE NOT I WOULD SUGGEST TO
CHAIRMAN MEN THAT THAT MAY BE A
USEFUL EXERCISE FOR THIS
COMMITTEE TO BEGIN. GERMAN ANY
ANY RESPONSE THAT. AS NOTED IN
MY OPENING REMARKS WE AT PALO
ALTO NETWORKS HAVE A
SIGNIFICANT RELATIONSHIPS ARE
RELATIONSHIPS WITH CALIFORNIA
AGENCIES WE'RE WE'RE HONORED TO
DO THAT WELL WHAT I CAN TELL
YOU IS WHETHER THAT KIND OF
MORE COMPREHENSIVE ASSESSMENTS
BEEN DONE AND I THINK GETTING
AN ANSWER FIGURING OUT THE
ANSWER TO THAT QUESTION IS A
REALLY GOOD ONE. AND IF THE
ANSWER IS IT STILL NEEDS TO BE
DONE. YOU KNOW THE OUR INDUSTRY
CAN HELP YOU DO IT. BUSSER I
BELIEVE WE HAVE ALSO ADDED YOU
KNOW MAYBE IT'S TIME TO DO
ANOTHER ONE EVEN IF YOU HAVE
THAT ONE RIGHT SO I THINK THESE
EXERCISES ARE INVALUABLE AND
WE'RE DOING YOU KNOW- YEAH.
THANK YOU. THANK YOU CENTER
NUMBER AND THANK YOU TO MISTER
BYRD MR MCNERNEY FOR YOUR TIME
AND EXPERTISE. I WILL B NOW
MOVING ON OUR SECOND PANEL
WHICH IS FOCUSED ON STATE AND
LOCAL CONSIDERATIONS. OUR FIRST
SPEAKER IS JOHN M. GILLIGAN
PRESIDENT AND CHIEF EXECUTIVE
OFFICER FOR. THE CENTER FOR
INTERNET SECURITY- MISTER
GILLIGAN THANK YOU SO MUCH FOR
APPEARING TODAY AND PLEASE FEEL
FREE TO BEGIN. THANK YOU OUR
CHAIRMAN AND MEMBERS OF THE
SELECT COMMITTEE THANK YOU FOR
INVITING ME TO THE HEARING
TODAY. HI MY NAME IS JOHN
GILLIGAN AND I SERVE AS
PRESIDENT AND CHIEF EXECUTIVE
OFFICER OF THE NON PROFIT
CENTER FOR INTERNET SECURITY OR
C. I. S. AN ORGANIZATION THAT
THAT HOUSES ONE OF ITS FOCUS IS
IMPROVING. THE CYBERSECURITY OF
STATE LOCAL TRIBAL AND
TERRITORIAL ORGANIZATIONS. MOST
OF MY CAREER IN SERVICE TO THE
FEDERAL GOVERNMENT INCLUDING
SERVING AS THE CHIEF
INFORMATION OFFICER BOTH THE US
DEPARTMENT OF ENERGY. AND THE
UNITED STATES AIRFORCE. I
APPRECIATE THE OPPORTUNITY
TODAY TO SHARE OUR THOUGHTS ON
THE CURRENT STATE OF
CYBERSECURITY WITHIN STATE
LOCAL AND PRIVATE ORGANIZATIONS
AND I COMMEND THE CALIFORNIA
SUN ON THE CREATION OF THE
SELECT COMMITTEE. ASI WILL
DISCUSS IN A FEW MINUTES IT'S
ESSENTIAL BUT STATE
LEGISLATURES TAKE A PROACTIVE
ROLE IN ESTABLISHING THE
GOVERNMENT STRUCTURES AND
EXPECTATIONS ARE METRICS
NECESSARY TO IMPROVE
CYBERSECURITY ACROSS THEIR
STATE. TODAY I'D LIKE TO FIRST
PROVIDE A SHORT BACKGROUND
ABOUT CIS. SECOND BRIEFLY
DESCRIBE A SET OF PROVEN BEST
PRACTICES WE CALL ESSENTIAL
CYBER HYGIENE BUT CIOS
RECOMMENDS FOR ALL GOVERNMENT
AND PRIVATE SECTOR
ORGANIZATIONS. AND THIRD
SUMMARIZE THE RECOMMENDATIONS
IN A RECENT REPORT C. I. ASCO
DEVELOPED FOR GOVERNORS AND
STATE LEGISLATORS REGARDING
ESTABLISHING GOVERNANCE AS A
NECESSARY FOUNDATION AND UNLIKE
SOME OTHER RAIDER AND IMPROVING
STATEWIDE CYBERSECURITY- SOME
BACKGROUND ON THE CENTER FOR
INTERNET SECURITY. ESTABLISHED
IN TWO THOUSAND AS A NON PROFIT
ORGANIZATION THE PRIMARY
MISSION OF CIOS IS TO ADVANCE
CYBERSECURITY READINESS AND
RESPONSE SHE I ALSO WORKS WITH
THE GLOBAL SECURITY COMMUNITY
USING COLLABORATIVE
DELIBERATIVE PROCESS SEES TO
DEFINE SECURITY BEST PRACTICES
FOR USE BY GOVERNMENT AND
PRIVATE SECTOR ENTITIES. IN
ADDITION SYNONYMOUS OPERATES
THE MULTI STATE INFORMATION
SHARING AND ANALYSIS CENTER OR
MS ISAC AND THE ELECTIONS
INFRASTRUCTURE INFORMATION
SHARING AND ANALYSIS CENTER OR
E. I AND I SAID. THESE
ORGANIZATION HAVE OVER TWELVE
THOUSAND STATE LOCAL TRIBAL AND
TERRITORIAL GOVERNMENT
ORGANIZATIONS PARTICIPATING.
INCLUDING ALMOST A THOUSAND IN
THE STATE OF CALIFORNIA. THE
AMAZIGH SACK AND THE E. ISAC
MEMBER ORGANIZATIONS ARE TAKING
ADVANTAGE OF A SORT OF
SUPPORTING SERVICES INCLUDING
CYBER BEST PRACTICES
EDUCATIONAL AND TRAINING
OPPORTUNITIES CYBER THREAT
INDICATORS SHARING AND
TRAVELERS. MONITORING OF
NETWORKS AND ENDPOINTS AS WELL
AS CYBER INCIDENT RESPONSE AND
RECOVERY. SECOND I WOULD LIKE
TO HIGHLIGHT ONE OF OUR
RECOMMENDED CYBER SECURITY BEST
PRACTICE LET ME FIRST START
WITH SOME CONTRACTS FOR A BEST
PRACTICE RECOMMENDATIONS. ONE
OF THE CHALLENGES THAT
ORGANIZATIONS HAVE WITH
REGARDING THE CYBER SECURITY IS
WHAT WE LIKE TO CALL A FOG OF
MORE. HAVING BEEN A CHIEF
INFORMATION OFFICER AT SEVERAL
ORGANIZATIONS I HAVE SEEN THE
FOG OF WAR FIRST HAND. MANY
WELL INTENDED BUT COSTLY CYBER
SECURITY EFFORTS TO RESTORE
KRISTIN FRY MINUTE OVERLAPPING
TOOLS FROM WANT TO DOCTORS
RESULTING IN LITTLE ACTUAL
IMPROVEMENT IN THE
CYBERSECURITY RESILIENCE OF THE
ORGANIZATION. AND LEADING TO
REPEATED EMBARRASSMENTS AS THE
ORGANIZATION FALLS VICTIM TO
RANSOMWARE. OR BREACH OF
CONFIDENTIAL DATA OR SOME OTHER
CYBER ATTACK. AS A PERSONAL
EXAMPLE I CAN SHARE THAT AS CEO
OF THE UNITED STATES AIRFORCE.
I FOUND THAT DESPITE SPENDING
ALMOST TWO BILLION DOLLARS
ANNUALLY FOR CYBER SECURITY.
THE NATIONAL SECURITY AGENCY
AROUND SO I WAS ABLE TO EASILY
PENETRATE OUR CYBER DEFENSES
AND THEIR ANNUAL PENETRATION
TEST. I KNEW THAT THE AIRFORCE
HAD LOTS OF BRIGHT BRIGHT CYBER
SECURITY EXPERTS AND ALMOST
EVERY SECURITY TOOL IN
EXISTENCE. YOUR OVERALL
SECURITY POSTURE WAS
EMBARRASSINGLY WEAK. I ASKED
THEM TO SAY WHERE SHOULD I
START THE ADVICE THEY PROVIDED
WAS START WITH STRENGTHENING
DEFENSES AGAINST THE MOST
COMMON ATTACK PATTERNS. WE DID
THIS OVER THE NEXT EIGHTEEN
MONTHS THE RESULT WAS MUCH
IMPROVED SECURITY. BETTER
OPERATIONAL SYSTEM AVAILABILITY
AND SURPRISINGLY LOWER ****
THIS IS WHAT I AM REFERRED TO
AS A NO BRAINER. C. I. ****
DEVELOPED A BEST PRACTICE THAT
WE STRONGLY BELIEVE IS THE WAY
TO AVOID COSTLY DISJOINTED AND
INEFFECTIVE CYBERSECURITY
EFFORTS. IN ESSENCE THIS BEST
PRACTICE IS THE ANSWER TO WHERE
TO START. WORKING WITH THE SORT
OF GLOBAL COLLABORATORS
LEVERAGING THREAT DATA FROM U.
S. INTELLIGENCE COMMUNITY
DEPARTMENT HOMELAND SECURITY
STATE LOCAL ORGANIZATIONS AND
MANY PRIVATE SECTOR
ORGANIZATIONS. CIOS HAS
DEVELOPED WHAT WE CALL A
CENTRAL CYBER HYGIENE. SORT OF
A RELATIVELY SMALL SET OF
SECURITY BEST PRACTICES OR
SAFEGUARDS. AND WE RECOMMEND
EVERY ORGANIZATION IMPLEMENT TO
PROTECT THEM FROM THE MOST
COMMON CYBER ATTACK PATTERNS.
PERCENT OF FIFTY SIX SAFEGUARDS
THAT COMPRISES CENTRAL CYBER
HYGIENE OR CONCRETE ACTIONS
WITH MEASURABLE COMPLETION
CRITERIA THAT ADDRESS THE ROOT
ISSUES ACCOUNT FOR THE
OVERWHELMING MAJORITY OF
SUCCESSFUL CYBER ATTACKS.
ASCENTIAL CYBER HYGIENE CAN
PREVENT THE MOST SIDE CORRECT
MOST CYBER ATTACKS. CERTAINLY
CONSIST MOSTLY OF GOOD SYSTEMS
AND NETWORK MANAGEMENT
PRACTICES NOT COSTLY TOOLS THIS
IS AN IMPORTANT REVELATION. G.
R. YES RECENTLY DEVELOPED AND
PUBLISHED THE RESULTS OF A
RIGOROUS ANALYTICAL EFFORT TO
DOCUMENT THE EFFECTIVENESS OF
ESSENTIAL CYBER HYGIENE. THE
ANALYSIS SHOWED THAT ESSENTIAL
CYBER HYGIENE SAFEGUARDS WERE
EFFECTIVE IN DEFENDING AGAINST
SEVENTY SEVEN PERCENT. OF THE
TOP CYBERATTACK TRIBES
INCLUDING RANSOMWARE MALWARE
AND INSIDER PRIVILEGE MISUSE.
IMPLEMENTING A CENTRAL CYBER
HYGIENE FOR ALL ORGANIZATIONS
MAKE SENSE AND WE RECOMMEND
THAT THE CALIFORNIA LEGISLATURE
CONSIDER MANDATING IT ACROSS
CALIFORNIA. THIRD I WANT TO
BRIEFLY DESCRIBE SOME
RECOMMENDATIONS FROM THE RECENT
STUDY ON THE NECESSITY OF
STRONG GOVERNANCE TO EMPLOYMENT
AND ACCELERATE THE EXPANSION
AFFECTED STATEWIDE
CYBERSECURITY. A YEAR AGO THE
CENTER FOR INTERNET SECURITY
WORKING WITH UNIVERSITY OF
ALBANY CENTER FOR TECHNOLOGY
AND GOVERNMENT. THE NATIONAL
GOVERNORS ASSOCIATION AND THE
NATIONAL CONFERENCE OF STATE
LEGISLATORS. PUBLISHED THE
RESULTS OF A STUDY EXAMINING
HOW EFFECTIVE CYBERSECURITY
GOVERNANCE WITHIN STAGE
CORRELATED TO IMPROVE
CYBERSECURITY RESILIENCE. THE
TITLE OF THE STUDY REPORT IS
MANAGING CYBER THREATS THROUGH
EFFECTIVE GOVERNANCE A CALL TO
ACTION FOR GOVERNORS AND STATE
LEGISLATURES COPY THE REPORT
HAS BEEN PROVIDED AS PART OF
THE HEARING CORPORATION
INSURANCE. THE STUDY
INTERVIEWED DOZENS OF STATE
OFFICIALS CIO'S SEE I ALSO AS
WELL AS EXECUTIVE AND
LEGISLATIVE BRANCH LEADERS. THE
STUDY FOUND THAT EFFECTIVE
CYBER GOVERNANCE WAS A
PREREQUISITE FOR EFFECTIVE
CYBERSECURITY PROGRAM WITHIN
THE STATE. BY MAKING FINDINGS
OF THE STUDY WERE THE FOLLOWING.
FIRST A FEW STATES HAVE CYBER
SECURITY GOVERNANCE EFFECTIVELY
ENSURES THAT THEIR CYBER RISK
IS MANAGED TO A LEVEL AND IN
WAYS THAT HAVE BEEN DETERMINED
THROUGH GOVERNANCE PROCESS SEES
AS ACCEPTABLE TO THE GOVERNOR
AND THE STATE LEGISLATURE.
SECOND IF YOU COMMONLY AGREED
INDICATORS OR METRICS SUGGEST
TO DISCUSS CYBERSECURITY
OPERATIONS WITHIN THE STATE AND
THOSE THAT DO EXIST ARE USED
INTERMITTENTLY. FINALLY THERE
WAS CLEAR RECOGNITION OF THE
NEED TO EXPAND GOVERNANCE
BEYOND STATE LEVEL AGENCY
ASSETS TO WHAT WE CALL A
HOLISTIC PERSPECTIVE THAT
ENGAGES STAKEHOLDERS ACROSS
MULTIPLE SECTORS AND LEVELS OF
GOVERNMENT. IN A COORDINATED
AND COLLABORATIVE PROCESS OF
CYBER RISK MANAGE. THE STUDY
IDENTIFIED FOR RECOMMENDATIONS
FOR GOVERNORS AND STATE
LEGISLATURES. FIRST ESTABLISHED
OF THE WORDS THROUGH BOTH
EXECUTIVE ORDERS AND
LEGISLATION WE FOUND THAT A
STRONG GOVERNOR EXECUTIVE
LEADER IS VERY VALUABLE PERHAPS
ESSENTIAL. IMPROVING CYBER
SECURITY ACROSS THE STATE IS
NOT A ONE OR TWO TERM AFTER
LEGISLATION IS NEEDED TO CODIFY
AND FORMALIZE THE NECESSARY
GOVERNANCE PROCESS. SECOND
FORMALIZE KEY PROCESS SIX
APPLES ARE NUMBER STANDARDS FOR
CONDUCTING RISK ASSESSMENTS
LEVERAGING CONTROLS OVERIT
PROCUREMENTS AND ACQUISITIONS
AND ESTABLISHING ENFORCING
STATEWIDE CYBERSECURITY
ARCHITECTURES. THIRD CLEARLY
ASSIGNED ROLES AND
RESPONSIBILITIES- HAS
ACCOUNTABILITY CERTAINLY THE
COMMENSURATE AUTHORITY. AND
FOURTH MONITOR INDICATORS FOR
DECISION MAKERS THE STUDY
IDENTIFIED SIXTEEN INDICATORS
AND METRICS THAT ALL GOVERNORS
AND STATE LEGISLATORS SUCH
PLANTATIONS FOR ASSESSING THE
STATE OF CYBERSECURITY ACROSS
THEIR STATE. DURING A STUDY WE
FOUND THAT STATE SENATE
IMPLEMENTED THE CORE
RECOMMENDATION RECOMMENDED
ACTIONS AND MADE SIGNIFICANT
PROGRESS IN IMPROVING STATEWIDE
CYBERSECURITY. LET ME CLOSE BY
SAYING THAT I HAVE REVIEWED
YOUR BIOGRAPHIES AND I REALIZED
THAT NONE OF YOU ARE CYBER
SECURITY EXPERTS IN THAT CYBER
SECURITY IS A VERY COMPLEX VERY.
I ENCOURAGE YOU TO CUT THROUGH
THE FOG OF MORE. AND KEEP YOUR
ACTIONS SIMPLE AND FOCUSED. TO
SUMMARIZE OUR FIRST
RECOMMENDATION WOULD BE TO
ESTABLISH REQUIREMENTS FOR
ESSENTIAL CYBER HYGIENE FOR ALL
SYSTEMS AND NETWORKS WHY. THIS
IS NOT THE FINAL STEP BUT IT IS
ACHIEVABLE BY ALMOST ANY
ORGANIZATION AND THE
DESTRUCTIVE INCREMENTING ABOUT
80% OF THE MOST COMMON CYBER
ATTACKS. THE CALIFORNIA
LEGISLATURE MAY ALSO WANT TO
CONSIDER A SIMILAR APPROACH TO
LEGISLATION PASSED IN OHIO UTAH
AND CONNECTICUT. WHICH PROVIDES
A SAFE HARBOR FOR ORGANIZATIONS
TO IMPLEMENT APPROPRIATE
CYBERSECURITY SAFEGUARDS LIKE
ESSENTIAL CYBER HYGIENE. SECOND
WE WOULD RECOMMEND A
COLLABORATIVE EFFORT BETWEEN
THE GOVERNOR'S OFFICE AND THE
CALIFORNIA LEGISLATURE TO
ESTABLISH STATEWIDE CYBER
GOVERNANCE. OUR STUDY PROVIDES
A SOLID OUTLINE FOR HOW TO GET
STARTED. THIS CONCLUDES MY
REMARKS I APPRECIATE YOUR TIME
AND ATTENTION I LOOK FORWARD TO
YOUR QUESTIONS. THANK YOU MR
DOING. OUR LAST PRESENTER TODAY
BEST BEST AND KRIEGER ATTORNEYS
AT LAW AND CO CHAIR OF B. B.
K.'S NEW PRIVACY AND
CYBERSECURITY PRACTICE GROUP-
WELCOME IS HOCKEY PROPERTY WE
LOOK FOR THE PRESENTATION.
THANK YOU VERY MUCH AND THANK
YOU- MEMBERS OF THE COMMITTEE
FOR THE OPPORTUNITY TO SPEAK
AND TO SERVE ON THIS PANEL
TODAY- OUR FIRM SERVICE PUBLIC
AGENCIES THROUGHOUT CALIFORNIA
AND I HAVE- WORKS IN THE AREA
OF DATA PRIVACY AND SECURITY-
PROBABLY THIRTY YEARS HAVING
WORK DONE AND- I STATE HEALTH
AGENCIES SO I COME FROM. A
LITTLE BIT OF OPERATIONAL
PERSPECTIVE AS WELL AS A LEGAL
PERSPECTIVE IN THESE SSUES.
AND WHAT I WOULD LIKE TO TALK
ABOUT TODAY ARE THE CHALLENGES
FACING LOCAL AGENCIES I'D LIKE
TO GET A COUPLE OF EXAMPLES OF
THE IMPACT OF CYBER SECURITY
ATTACKS ON LOCAL AGENCIES. AND
PROVIDE A FEW ADDITIONAL
RECOMMENDATIONS AND
CONSIDERATIONS WITH REGARDS TO-
EFFORTS TO ENSURE- IMPROVE
CYBER SECURITY ACROSS THE
STATE. TELL S. REFLECTED IN THE
DISCUSSIONS OF MY ESTEEMED
COLLEAGUES THE CYBER SECURITY
ENVIRONMENT IS EVOLVING AND HAS
BECOME INCREASINGLY HOSTILE AND
INCREASINGLY COMPLEX. AND ON
THE LEVEL OF THREAT IS NOT
FULLY RECOGNIZED. BY MANY LOCAL
GOVERNMENT ENTITIES. BUT
CHALLENGES FOR LOCAL
GOVERNMENTS BE IT CITIES
COUNTIES SPECIAL DISTRICTS
HOSPITAL DISTRICT'S EDUCATIONAL
DISTRICTS ARE OTHERS. OFTEN
HAVE TO DO WITH A LACK LACK OF
KNOWLEDGE OR EXPERTISE THEY
DON'T KNOW WHAT THEY DON'T
KNOW- AND A LACK OF RESOURCES
DEDICATED TO THEIR IT
INFRASTRUCTURE. LOCAL
GOVERNMENTAL ENTITIES- ARE
OFTEN OPERATING WITH OUTDATED
EQUIPMENT SERVERS COMPUTERS AND
SOFTWARE MAKING THEM HIGHLY
VULNERABLE TO CYBER SECURITY
ATTACKS AND IN ADDITION AS
NOTED THERE IS A KNOWLEDGE GAP
AND I NEED TO BRING SPECIALIZED
CYBERSECURITY RESOURCES TO BEAR.
ANOTHER MENTIONED EARLIER IS
THAT LOCAL GOVERNMENT ENTITIES
MAY BE UNDER INSURED AGAINST
CYBER RISKS. ACCORDING TO- AS
SURVEYED BY A RANSOMWARE
PROTECTION UNDER THE PUBLIC
SECTOR LAGS BEHIND OTHER IN THE
PERCENTAGE OF ENTITIES THAT
CARRY CYBER INSURANCE AND THE
PERCENTAGE OF ENTITIES THAT
CARRY RANSOMWARE COVERAGE WITH
ONLY ABOUT FIFTY PERCENT. HI
KAREN RANSOMWARE COVERAGE. THAT
WE'VE TALKED ABOUT THE COST OF
CYBER SECURITY INCIDENT AND
THAT IS BEFORE TAKING INTO
ACCOUNT THE LOST PRODUCTIVITY
RESULTING FROM A RANSOMWARE
ATTACK WHICH IN SEVERAL CASES
IN TWENTY TWENTY ONE HAND-
DISABLE THE CITY'S
INFRASTRUCTURE FOR FORTY SIX
WEEKS HERE IN CALIFORNIA. NOW
IF A LOCAL GOVERNMENT HAS
DEFINED THE CONCEPT RECOVERY
FROM THEIR OWN BUDGET THAT
CHALLENGE CAN BECOME
INSURMOUNTABLE IN PARTICULAR
FOR SMALLER MUNICIPALITIES OR
COUNTIES. THE ABILITY TO OBTAIN
CYBER INSURANCE IS BECOMING
MORE DIFFICULT- PREMIUMS ARE
INCREASING- THERE ARE REPORTS
INCREASED BY 25% TO TWENTY
TWENTY ONE AND ARE EXPECTED TO
RISE FURTHER AND AS NOTED
EARLIER INSURERS ARE REVIEWING
THE SECURITY PROFILES OF THE
ORGANIZATIONS THAT THEY ENSURE
AN EVENTUALLY- ENTITIES WITH AN
ADEQUATE SECURITY SIMPLY WILL
NOT BE INSURABLE. I GUESS THAT
CONTEXT LOCAL GOVERNMENT
ENTITIES ARE INCREASINGLY
BECOMING TARGETS OF ATTACKS-
ALTHOUGH- BRICKWORKS VERY
ACCORDING TO- SELF ALWAYS
AROUND MORE PROTECTION BENDER-
RANSOMWARE ATTACKS HAVE
INCREASED CLOSE 25100% SINCE
TWENTY SIXTEEN AND- DEPENDING
ON THE SOURCE YOU USE. NATIONAL
LEAGUE OF CITIES- REPORTS
HUNDREDS SEVENTY ATTACKS OTHER
REPORTS ON. FORD TYPE READ-
IDENTIFY FOUR HUNDRED ATTACKS
ON LOCAL GOVERNMENTS- SINCE
TWENTY SIXTEEN ALONG SH SOME OF
THESE ATTACKS CAN HAVE WIDE
RANGING IMPLICATIONS- AND
LOOKING AT WHAT'S GOING ON IN
CALIFORNIA SPECIFICALLY AND I
KNOW THAT THERE- TO THE EXTENT
THAT THERE IS NOT A DATA BREACH
MANY CYBER SECURITY ATTACKS ARE
NOT REPORTED. BECAUSE THERE IS
NO LAW THAT CURRENTLY REQUIRES
THEM TO BE RECORDED- THERE ARE
A HUNDRED AND TWENTY TWO
SEPARATE TAX IN CALIFORNIA
ACROSS THE PUBLIC SAFETY
GOVERNMENT MEDICAL AND
EDUCATION SECTORS SINCE TWENTY
SIXTEEN AND TWENTY TWO TWENTY
ONE BASED ON PUBLICLY AVAILABLE
DATA- THERE WERE THIRTY EIGHT
ATTACKS REPORTED I WANT TO
HIGHLIGHT IT SOME EXAMPLES OF
THE IMPLICATIONS OF THESE
ATTACKS. IN SOME CASES THERE
WERE RANSOMWARE ATTACKS THAT
INTRODUCE MALICIOUS SOFTWARE
THAT ENCRYPTED OR INFECTED ALL
OF THE COMPUTER SYSTEMS. I'M A
WAS REPORTED SEPTEMBER
THIRTIETH TWENTY TWENTY ONE
THAT TRUCK HE WAS THE VICTIM OF
RANSOMWARE ATTACK THAT INFECTED
AFFECTED THE FULL SCOPE. OF
CITY SERVICES- COMPUTERS WERE
INFECTED EMPLOYEES HAD TO BE
OUTFITTED WITH NEW COMPUTERS
AND HOT SPOTS FOR INTERNET
ACCESS. AND THE TOWN LOST ALL
OF ITS ARCHIVED EMAILS. IN
OTHER CASES THERE WERE ATTEMPTS
TO STEAL PUBLIC FUNDS ON JULY
SIX TWENTY TWENTY ONE IT WAS
REPORTED THAT AT SEBASTOPOL
WIRE TRANSFER INVOLVING SONOMA
COUNTY'S TREASURY OFFICE TURNED
OUT TO BE A SCAM. THAT BILKED
SEBASTOPOL OF ONE POINT TWO
MILLION AND PROPERTY TAXES.
THAT THAT WAS COMMITTED VIA
FRAUDULENT EMAIL. REQUESTING A
TRANSFER FROM- COOL- STRESSFUL
SOMETIMES HELD BY THE AUDITOR
CONTROLLER TREASURER TAX
COLLECTOR. IN OTHER CASES-
THERE ARE THREATS OF PERSONAL
INFORMATION HAS BEEN STOLEN AND
THE RANSOMWARE ATTACKERS
THREATENED TO RELEASE THAT AIR
FRANCE A MISTIMED HATE POLICE
DEPARTMENT FILES AND ALSO
HOSPITALS ARE OFTEN SUBJECT IF
THESE TYPES OF ATTACKS. SO IN
JUNE OF TWENTY TWENTY ONE IT
WAS REPORTED THAT A SENSE OF
PLACE SUFFERED A RANSOMWARE
ATTACKS. AND TO SEE IT CREDIT
TAX- ANNOUNCED THAT IT COPIED
HUGE AMOUNTS OF DATA AND WOULD
RELEASE IT ON THE DARK WEB. AS
SOON AS THEY DID NOT PAY THE
RANSOMWARE- WHICH WAS ABOUT A
HUNDRED THOUSAND DOLLARS- WHEN
THE RANSOMWARE DEADLINE PASSED
THE HACKERS PLACED SEVEN
GIGABYTES OF. DATA ONLINE AND
THESE WERE POLICE DEPARTMENT
RECORDS INCLUDING RECORDINGS
WITNESS INTERVIEWS I GAIN
DATABASE AN ARREST REPORT. AN
OFFICE TABLE DATA. I'M IN
ADDITION HAS BEEN MENTIONED AND
THIS AND- CREDIT HACKERS ARE
INCREASED TO. IS SERVICES- I'M
JANUARY FIFTEENTH TWO TWENTY
WAS REPORTED A HACKER TRIED TO
POISON THE WATER TREATMENT
PLANT THAT SERVES- PARTS OF SAN
FRANCISCO BAY AREA. BACKER HAD
THE USERNAME AND PASSWORD FOR A
FORMER EMPLOYEES TEAMVIEWER
ACCOUNT ACCORDING TO A PRIVATE
REPORT COMPILED BY THE-
NORTHERN CALIFORNIA REGIONAL
INTENT- INTELLIGENCE CENTER IN
FEBRUARY. AND SEEN BY THE N. B.
C. NEWS. AFTER LOGGING IN
ACTORS DELETED PROGRAMS THAT
THE WATER PLANT USED TO TREAT
DRINKING WATER. SO I'M WORKING
WITH LOCAL ENTITIES BUT I SEE
IS FINDS THAT AN ENTITY HAS
BEEN SUBJECT TO ATTACK IT
TYPICALLY WILL ACT TO ENHANCE
IT HARD IN ITS IT
INFRASTRUCTURE AND SECURITY
PRACTICES AND TO INVEST. IN IT
RESOURCES HOWEVER THE BETTER
APPROACH IS TO TAKE STEPS TO
PREVENT SUCH ATTACKS
PROACTIVELY THROUGH BEST
PRACTICES WHICH INCLUDE
ASSESSING CYBERSECURITY REST
ROBUST SECURITY EDUCATION AND
TRAINING OF PERSONNEL CYBER
SECURITY POLICIES AND
PROCEDURES BACKUP AND DISASTER
RECOVERY IS CRITICAL VENDOR
MANAGEMENT IS CRITICAL AND
INCIDENT RESPONSE PLANNING AND-
TESTING. ARE ALL CRITICAL
RESPONSE ELEMENTS OF CYBER
SECURITY PREPAREDNESS. IN
ADDITION AND CUTE CAT THIRD
PARTY AUDITS OR ASSESSMENTS TO
EVALUATE THE SECURITY SYSTEMS
AND LOCAL AGENCIES AND- AS
NOTED THERE'S OFTEN A NEED TO
SIGNIFICANTLY UPGRADE.
EQUIPMENT AND RESTARTS. SO IN I
STAYED. CAN A US AFTERWARDS-
ANSWER TO BETTER COORDINATE
DEVELOP L. T. INFORMATION AND
RESOURCES- AND A NUMBER OF WAYS
ONE OF WHICH IS BY FILLING
RESOURCE GAPS NOT MET BY
FEDERAL INITIATIVES AND- AS WE
KNOW THERE RECENTLY THE CYBER
RESPONSE AND RECOVERY ACTIVE
TWENTY TWENTY ONE- PROVIDE
SIGNIFICANT GRANT RESOURCES FOR
CYBERSECURITY PREPAREDNESS- ON
AN EVALUATION OF HOW THE STATES
CAN SUPPLEMENTS OR- BEST
UTILIZE THAT. IS IMPORTANT
PROVIDING STANDARDS FOR LOCAL
ENTITIES THAT WILL ENSURE THEY
ARE ABLE TO OBTAIN INSURANCE
AND PERHAPS PROVIDING EDUCATION
AND TECHNICAL ASSISTANCE AS
WELL ON TO- ASSIST. M. AND
UTILIZING THESE RESOURCES.
LOOKING AT THE AVAILABILITY OF
CYBER INSURANCE ARE SOME OTHER
TYPE OF RESTFUL FOR COVERAGE OF
SECURITY INCIDENTS WHICH CANNOT
ALWAYS BE PREVENTED. I'M OTHER
THINGS THAT HAVE BEEN MENTIONED
TO ME- IS TO ENSURE THAT ARE
UNIQUE TO LOCAL GOVERNMENT
ENTITIES ARE TO ENSURE THAT
THEY'RE CLEAR EXTENSIONS FROM
PUBLIC REPORTING OF ANY I. T.
SOFTWARE SECURITY INFORMATION-
AND ALSO TO CLARIFY. LABOUR'S
LOST SUCH AS AB FIVE AMENDED BY
AB. TWENTY TWO FIFTY SEVEN AS
IT RELATES TO I. T. SERVICES TO
ENSURE THE ABILITY OF LOCAL
GOVERNMENTS TO CONTRACT OUT FOR
I. T. SERVICES. THERE ARE
CERTAINLY- I NUMBER EXTINF
EXAMPLES OF WHAT OTHER STATES
ARE DOING TO- EMPLOYMENT
TRAINING AT. AND SUPPORTING
PROGRAMS AND INCENTIVES FOR
CYBER SECURITY EDUCATION AND
APPROPRIATIONS SO THANK YOU
VERY MUCH FOR THE OPPORTUNITY
TO- PRESENT MY THOUGHTS AT THIS
HEARING. THANK YOU SO MUCH MISS
HOPSON- SO BEFORE WE MOVE ON TO
THE NUMBERS QUESTIONS AND
COMMENTS I WANTED TO AGAIN
INVITE THE PUBLIC WANTING TO
PARTICIPATE TO CALL IN NOW
PLEASE DIAL THIS TOLL FREE
NUMBER. EIGHT FOUR FOUR TWO
NINE ONE FIVE FOUR NINE ZERO.
WHEN PROMPTED PLEASE USE THE
ACCESS CODE. SEVEN ONE SIX TWO
THREE FIVE THREE. WILL NOW
BRING THE DISCUSSION BACK TO
THE MEMBERS DO ANY OF OUR
MEMBERS HAVE QUESTIONS OR
COMMENTS. CENTER NUMBER. THANK
YOU MISTER CHAIR I SUPPOSE I
SHOULD NOTE AND CONGRATULATIONS
TO YOU- MISTER CHAIR THAT-
WHILE WE'RE HERE JUST A FIFTY
SEVEN MINUTES AGO I SEE- ALERT
SAYS THE JUSTICE DEPARTMENT ON
MONDAY ANNOUNCED ARRESTS AND
CHARGES AGAINST HACKERS
ALLEGEDLY AFFILIATED WITH MAJOR
RANSOMWARE ORGANIZATION. I
ASSUME THAT'S A CONSEQUENCE OF
THIS PARTICULAR HEARING NUMBER
ONE NUMBER TWO IS I WANT TO
THANK MR GILLIGAN AND WAS HAPPY
FOR YOUR EXCELLENT PRESENTATION
I VERY MUCH LOOK FORWARD TO
YOUR CONCRETE SUGGESTIONS AS
TO. WHAT RECOMMENDATIONS YOU
HAVE FOR US TO IMPLEMENT HERE-
AND THEN- BACK TO SOME
QUESTIONS I ASKED THE PREVIOUS
PANEL AS- TO- I. AS I
UNDERSTAND WHAT WE SHOULD BE
DOING HERE AND- TO PROTECT OUR
OWN GOVERNMENTAL ENTITIES LOCAL
STATE THE IT SECTOR. BUT ALSO
WHAT WHAT. SHOULD WE BE DOING-
WITH RESPECT TO PROTECTING
CONSUMERS. WHO MAY BE IMPACTED
BY- INFORMATION THAT APPEARS TO
BE- IT WAS LAST BEFORE APPEARS
TO BE LEGITIMATE BUT IT IS NOT
THAT DOES DO YOU BELIEVE
THERE'S ANYTHING WE SHOULD BE
DOING. TO SUGGEST OR REQUIRE
THAT- PRIVATE ENTITIES
PARTICULARLY FINANCIAL
INSTITUTIONS DO SOMETHING IN
ADDITION TO WHAT THEY'RE DOING
NOW TO PROTECT THEIR CONSUMERS.
WELL SENATOR THIS IS JOHN
GILLIGAN LET ME LET ME START
WITH. A COUPLE OF COMMENTS- I
THINK THAT- AS I MENTIONED IN
MY TESTIMONY- SEVERAL STATES
SHOULD MOVE FORWARD AND
PROVIDING LEGISLATION. THAT
DEFINES EXPECTATIONS FOR ALL
PRIVATE SECTOR ORGANIZATIONS
THAT DO BUSINESS WITHIN THE
STATE WITH REGARD TO YOU KNOW I
USE THE TERM ESSENTIAL CYBER
HYGIENE. YEAH I WAS VERY VERY
EACH OF THESE LAWS HAVE A
SOMEWHAT BROADER DEFINITION BUT
IT'S AN ABSENCE SORT OF BASIC-
CYBER SECURITY CONTROLS ARE
SAFEGUARDS. ARE HAND THE
MOTIVATION THAT IS PROVIDED IN
THE LEGISLATION IS IF IN FACT
YOU IMPLEMENT THE SAFEGUARDS.
IF THERE IS AN ARTIFACT OF AN
ATTACK OR BREACH MAN- YOU WILL
BE GIVEN SAFE HARBOR AND- AND-
AND THE RESPONSE IN THE
LAWSUITS THAT MAY ARISE FROM
THAT. AND THAT BECOMES A PRETTY
SIGNIFICANT MOTIVATOR IN THE
SHORT TERM. I THINK IN THE LONG
TERM AS WE TALKED ABOUT IN THE
PREVIOUS PANEL I THINK THE US
CYBER INSURANCE- COMMUNITY- CAN
PROVIDE AN ENORMOUS MOTIVATOR-
FOR THE PRIVATE SECTOR. BUT I
THINK AS WAS MENTIONED BY MR
AMERICAN ARMY. THE INTO WE GET
SOME BETTER DATA- IT'S GONNA BE
A LITTLE BIT DIFFICULT BUT I
THINK IN THE SHORT TERM.
LEGISLATION THAT- REINFORCES
THE IMPORTANCE AND PROVIDES IT
THIS POINT VOLUNTARY ADOPTION.
OF. YOUR WORK WERE OUT OR
SAFEGUARDS IS REALLY SORT OF A
PRUDENT WAY TO GET THE BALL
ROLLING SO TO SPEAK. R. THANK
YOU THANK YOU MR JULIAN THANK
YOU FOR YOUR SERVICE TO OUR
COUNTRY AS WELL- BESIDES EAT
ANYTHING ELSE YOU LIKE THAT.
YES I AGREE THAT THERE IS A
NEED TO ALIGN THE CYBER
SECURITY STANDARDS WITH
REQUIREMENTS OF INSURANCE
COMPANIES TO INSURE. SO THAT
LOCAL ENTITIES CAN IN FACT BE
INSURE I THINK THERE IS- ALSO I
NEED TO AND TO HAVE TECHNICAL
ASSISTANCE THERE ARE A LOT OF
STANDARDS OUT THERE YES AT THE
FEDERAL LEVEL. AND I I'M NOT.
CLEAR THAT THEY'RE TRULY MAKING
THEIR WAY DOWN TO LOCAL
AGENCIES AND TO BEING
IMPLEMENTED SO I THINK THERE'S
A NEED FOR- A ROLE- STATE
AGENCY AND PROVIDING TECHNICAL
ASSISTANCE AND FOR AND
ENCOURAGING- JOIN PURCHASING
AND OTHER COLLABORATIONS BY
BOTH. LOCAL GOVERNMENT ENTITIES
AND LOCAL AND PRIVATE SECTOR
ENTITIES TO ACTUALLY ACHIEVE
THE GOALS AND THIS PARTICULAR
SPACE. AND YOUR SECOND
QUESTION- I THINK THAT'S VERY
INTERESTING I ACTUALLY HAVE
RECENTLY SEEN SOME BANKS THAT
DO HAVE EDUCATION PROGRAMS FOR
SENIORS- ABOUT THEIR
INFORMATION AND- PERSONALLY I.
WHEN I REFINANCED THIS YEAR- I
RECEIVED THE EMAILS FROM THREE
DIFFERENT CLOSING COMPANIES
RIGHT DID NOT HAVE A
RELATIONSHIP WITH ASKING ME TO
CLICK ON IT BUT THEN AND-
FINALIZE MY CLOSING DOCUMENTS.
SO AND IT'S SOMETHING THAT ONE
HAS TO BE VERY CAREFUL AND. I
AM NOT ABSOLUTELY SURE HOW TO
INCENTIVIZE SENT IT TO THE
EXTENT THAT THE- COMMITTEE AND
THE AGENCY CAN LOOK AT WAYS TO
BETTER EDUCATE. THE COMMUNITY
ON- THE CYBER SECURITY RISKS I
THINK THAT'S A VERY VALUABLE
ROLE THANK YOU THANK YOU MUST
HAVE BEEN BY THE WAY THAT'S AN
EXCELLENT SEGUE TO OUR HEARING
TOMORROW THE JUDICIARY
COMMITTEE WITH RESPECT TO.
PRIVACY AND HOW IT WAS THAT
WHEN YOU WERE- DEALING WITH ONE
ENTITY YOU'VE GOT ADVERTISING
FROM THREE OTHER ENTITIES-
PARTICULARLY WHEN YOU WERE
SHARING BERRY I WOULD ASSUME
VERY PERSONAL FINANCIAL
INFORMATION ANYWAY THANK YOU
BOTH FOR YOUR TESTIMONY. SERVER
TO SEE IF ANY QUESTIONS OR
COMMENTS. OKAY I JUST HAD A
QUICK FOLLOW UP ON THEM. SAFE
HARBOR- QUESTION OR MAYBE THIS
IS ACTUALLY RELATED TO. THE
CARD I THINK THE COMMENTS MADE
BY- MISTER GILLIGAN. YES I HEAR
YOU AS FAR AS THAT HYGIENE AND
I KEEP GETTING TOLD BY EVERYONE
WHO KNOWS CYBERSECURITY THAT
GOOD HYGIENE IS THE BEST WAY TO
AVOID CYBER ATTACKS- BUT I
WONDER FOR LOOKING AHEAD TEN
YEARS IF THAT'S STILL GOING TO
BE THE CASE AND I JUST BE
INTERESTED IN EITHER YOUR
THOUGHTS ARE BOTH YOUR
THOUGHTS. ON THE QUESTION OF
SORT OF WHAT WE'RE THE CYBER
ATTACKS THE FUTURE GONNA COME
FROM IN PARTICULAR I REMEMBER
READING SOMETHING IN THE
FINANCIAL TIMES NOT SO LONG AGO
THAT JUST PORTENDED A LOT TO
DO- CHINA HAD WON THE A. I. WAR
I THINK IN A NUMBER OF UN
NAMED- PENTAGON FOLKS AND SAID-
AND- GIVEN THE INCREASING USE
OF A. I. IN IN INCREASING
SOPHISTICATED CYBER ATTACKS-
YOU KNOW HOW HOW BIG A ROLE
SECOND PLAY GOING FORWARD AND
WHAT. CAN WE DO AGAINST AGAINST
THOSE TYPES OF ATTACKS. SENATOR
THANK YOU- LET ME YEAH MAYBE
PROVIDE A LITTLE BIT OF CONTEXT
THAT MAY HELP YOU- WHEN YOU
TRYING TO MITIGATE AGAINST
CYBER ATTACKS- WHAT YOU FIND IS
THAT- THE ATTACKERS GO AGAINST
THE EASIEST ROUTE- AND SO. WHEN
WE TALK ABOUT THE IMPORTANCE OF
CYBER HYGIENE THIS IS SORT OF
THE BASICS THE FOUNDATIONS AND
SO I SENT ANOTHER WAY I'M
SPENDING LOTS OF MONEY ON FANCY
TOOLS AND TRYING TO ADDRESS
SOME OF THE MORE SOPHISTICATED
ATTACKS. IS USELESS IF IN FACT
YOU HAVEN'T DONE THE BASICS
BLOCKING AND TACKLING BECAUSE
WHAT YOU FIND IS. THE BASIC
BLOCKING AND TACKLING THE
HYGIENE AS WE DISCUSSED. IS
WHAT'S NECESSARY TO TAMP DOWN
THE GREAT MULTITUDE OF ATTACKS
AND IT'S ONLY WHEN YOU TAMP
THEM DOWN BUT YOU CAN KIND OF
LESSEN THE NOISE AND YOU CAN
START TO FOCUS ON THE MORE
SOPHISTICATED ATTACKS SO IT
REALLY IS A- REVOLUTION. BUT
YOU MUST START WITH HYGIENE IF
YOU DON'T HAVE HYGIENE AS I
SAID IT'S REALLY. NOT A GREAT
VALUE TO TRY TO ADDRESS THE
SOPHISTICATED ATTACKS BECAUSE
IN MANY CASES YOU'RE LOOKING
FOR A NEEDLE IN A HAYSTACK AND
IT'S A VERY NOISY ENVIRONMENT
WITH ALL THE ATTACKS- I THINK.
I DID I WOULD WANT TO HAVE ONE
COMMENT TO ABOUT ARTIFICIAL
INTELLIGENCE I THINK YOUR
OBSERVATION ABOUT YOUR MANAGER
IS A GOOD ONE- THERE HAVE BEEN
A LOT OF- EFFORTS AND- AND YOU
KNOW COMPANIES LIKE PALO ALTO
AND OTHERS ARE INCREASINGLY
USING. ARTIFICIAL INTELLIGENCE
BOTH TO HELP DEFEND- AND WE
KNOW THAT ATTACKERS ARE
STARTING TO BUT IT'S STILL A
BIT EARLY ARE STARTING TO USE
ARTIFICIAL INTELLIGENCE. ARE ON
THE OFFENSIVE SIDE. AND SO I
THIS IS AN AREA THAT. SERVED TO
ME SORT OF INDICATES THAT WE
GOTTA GET MOVING QUICKLY AND IN
DOING THE BASICS OF BLOCKING
AND TACKLING BECAUSE- AS
ARTIFICIAL INTELLIGENCE ISSUES-
IT WILL ADD BY THE ATTACKERS.
IT'S GOING TO MAKE IT EVEN MORE
DIFFICULT TO BE ABLE TO
IDENTIFY THEM. AND I THINK ON
THE POSITIVE SIDE AS COMPANIES-
PALO ALTO FIRE RIGHT-
CROWDSTRIKE CONSIDERING USING
ARTIFICIAL INTELLIGENCE.
THEY'RE ACTUALLY ABLE TO PICK
UP SOME OF THE MORE
SOPHISTICATED ATTACKS. THAT ARE
NOT BEING PICKED UP BY WHAT I
WOULD CALL BASIC CYBER HYGIENE
SOFTWARE I'VE BEEN- CLEARING IN
MY- MY RESPONSE TO YOUR
QUESTION. NO EXCELLENT RESPONSE
THANK YOU VERY MUCH- MR. GIVE
ME THE ANSWER. I WOULD JUST ADD
THAT I THINK IT'S CRITICAL TO
IT IS GOING TO BECOME
INCREASINGLY SPACE CAT IT AS
FREE AS WE NOW ON BOTH SIDES OF
THE AISLE BOTH THE CYBER
ATTACKERS AND ITS DEFENDERS-
THERE WILL BE ARTIFICIAL
INTELLIGENCE INVOLVED IN. ON
BOTH- FROM BOTH SIDES OF THE
AISLE AND I THEREFORE IT'S
CRITICAL I THINK TO PUT CENTER
HYGIENE IN PLACE NOW BECAUSE
WHEN WE LOOK AT THE FUTURE TEN
YEARS FROM NOW OUR CITIES ARE
GOING TO BE DIGITAL AND THE ALL
THE OPPORTUNITIES FOR ATTACK
AND THE IMPLICATIONS OF CYBER
ATTACKS ARE GOING TO BE EVEN
FAR MORE THAN WHAT WE SEE EACH
DAY. SO I COMMEND. THE WORK OF
THE COMMITTEE AND- RESTING THE
SISTER THANK YOU. FOR ONE LAST
FROM YOU YOU MENTIONED CYBER
INSURANCE AND CYBER SECURITY
INSURANCE AS A KEY. CONDUIT TO
TRYING TO GET A DIFFERENT
ACTORS IN OUR VERY DIVERSE
SOCIETY TO ADOPT WEATHER'S GOOD
HYGIENE PRACTICES OR OTHER- YOU
KNOW ACTUALLY BASED- PRACTICES
AGAINST CYBER ATTACKS- AND I
OTHER THAN DATA WHICH I THINK
YOU BOTH MENTIONED ISN'T AS
BEING IMPORTANT FOR DETERMINING
THE RISKS HERE. WHAT ELSE CAN
WE BE THINKING ABOUT AS FAR AS
STANDING UP MORE CYBER SECURITY
INSURANCE AND MAKING THIS MORE
OF A UBIQUITOUS- THING. DAVID
LET ME START AND- AND TRY TO
UNPACK A LITTLE BIT WHEN WE SAY
NEED MORE DATA WHAT DO WE NEED-
SO IN FACT- MY ORGANIZATION
CENTER FOR INTERNET SECURITY
HAS HAD ONGOING DISCUSSIONS
WITH RESILIENCE INSURERS- AND
OTHERS. BUT AND OUR OBJECTIVE
HAS BEEN AS WE'VE TALKED ABOUT
IN THIS HEARING. TO GET TO THE
POINT WHERE. THE INSURANCE
COMPANY IS ABLE TO OFFER
DISCOUNTS FOR ORGANIZATIONS
THAT IMPLEMENT CERTAIN- SUCH
CYBERSECURITY PRACTICES- WHEN
WE SAY THERE'S NO DATA- THE
CYBER SECURITY OR THE INSURANCE
INDUSTRY IS ALL ABOUT MANAGING
RISK AND SO THEY ARE VERY
WILLING. TO OFFER DISCOUNTS IF
THERE IS SOME EVIDENCE THAT
DOING A. B. C. AND D. E. R.
REDUCES RASK AND THEN WHAT THEY
HAVE TO DO IS UNDERSTAND TO
WHAT EXTENT. DOING YOU KNOW ABC
INDY SO FOR EXAMPLE
IMPLEMENTING CYBER HYGIENE
THAT'S SORT OF BEEN THE
DISCUSSION WE'VE HAD WITH
RESILIENCE. WHAT'S THE
PERCENTAGE OF DISCOUNT SHOULD
BE 10% 20% AT CENTER. IN ORDER
TO BE ABLE TO GET THE DATA AND
I THINK IT WAS MENTIONED IN THE
PREVIOUS PANEL. YOU NOT ONLY
NEED TO KNOW WHAT WAS-
IMPLEMENTED BUT YOU ALSO NEED
TO KNOW WHAT WAS THE STATE OF
THE SYSTEM. THAT WAS BREACHED-
IN ORDER TO BE ABLE TO DROP I'M
VERY FINE GRAINED CORRELATION
BETWEEN OKAY WAS THIS
PARTICULAR SO AN ORGANIZATION
MAY FOR EXAMPLE IMPLEMENTED
CYBER HYGIENE IN EIGHTY
PERCENT. BUT THEY MISSED 20%
AND SO WHAT WE ARE TRYING TO DO
IS TO WORK WITH IN PARTICULAR
SINCE WE HAVE A CLOSE
RELATIONSHIP WITH LOCAL
ORGANIZATIONS IS. AS THEY ARE
AND THEY HAVE A SUCCESSFUL
ATTACK OR BREACH MAY PROVIDE US
BASICALLY INFORMATION THAT
DESCRIBES WHAT WAS THE STATE OF
THE ENVIRONMENT WHAT CYBER
SECURITY SAFEGUARDS CONTROLS
WERE IN PLACE- WHAT WAS THE-
THE- THE- THE STATE OF THE
SOFTWARE ETCETERA. AND THROUGH
THAT ANALYSIS WORKING WITH THE
INSURANCE. COMPANY WE THINK AND
THE ROLE OF JIM FUTURE WE
SHOULD BE ABLE TO START TO
PROVIDE STUDENTS. AND I. AS WAS
MEANT BY MISS MAC- THE
INSURANCE OR INSURANCE INDUSTRY
RIGHT NOW FOR CYBER SECURITY IS
REALLY STRUGGLING BECAUSE- THE
SPATE OF RANSOMWARE ATTACKS IS
REALLY CHANGE THEIR BUSINESS
MODEL DRAMATICALLY- THAT'LL
SETTLE DOWN- BUT I THINK-
HOPEFULLY WHEN WE GET THAT
SETTLED DOWN WILL BE IN A
POSITION WHERE. THE INSURANCE
ORGANIZATIONS ONE WILL BE
MOTIVATED- AND BECAUSE I WILL
TELL YOU A LITTLE OVER A YEAR
AGO. WHEN I WENT TO INSURANCE
COMPANIES THEIR ANSWER WAS. YOU
KNOW DON'T TALK TO ME ABOUT
OFFERING DISCOUNTS RIGHT NOW
WE'RE SELLING SO MUCH CYBER
SECURITY INSURANCE AND IT'S THE
MOST PROFITABLE. PRODUCT WE
HAVE- BUT WE'RE NOT WE'RE NOT
GOING TO JEOPARDIZE IT BY
PUTTING ANY ROADBLOCKS IN THE
PROCESS WELL THE LAST YEAR AS
YOU PROGRAM THE HEARING TODAY.
THAT'S CHANGED DRAMATICALLY AND
SO A LOT OF COMPANIES ARE
GETTING OUT OF THE MARKET
BECAUSE OF THE- THE REST BUT I
THINK IS THAT SETTLES DOWN. I
THINK WE'RE ON A PATH TO BEING
ABLE TO GET TO THE TYPES OF
INFORMATION WE NEED TO BE ABLE
TO START TO OFFER DISCOUNTS.
AND I AND I THINK THAT'S GOING
TO BE ONE OF THE MOST POSITIVE
MOTIVATORS TO GET- BOTH
GOVERNMENT AND PRIVATE SECTOR
ORGANIZATIONS TO MOVE FORWARD
AGGRESSIVELY WITH SOME OF THE
NECESSARY IMPROVEMENTS. THANK
YOU SO MUCH- WILL NOW MOVE ON
TO ANYONE WANTING TO PROVIDE
PUBLIC COMMENT. NEW CONSTRAINTS
REGARDING LIKE THE HEARINGS
TECHNOLOGY CONSIDERATIONS
INCLUDING PROTOCOLS- TESTIMONY
LIMITED TO ONE MINUTE EACH. SO
LET'S BEGIN WITH ANY WITNESSES
HERE IN THE ROOM FORTY TWO OH
THREE. SEEING NO WITNESSES
LET'S MOVE TO ROOM TWENTY FORTY
ARE THERE ANY WITNESSES I'M
SORRY WE DO HAVE ONE I'M SORRY
BUT THAT. I'M SORRY WE AREN'T
ROOM FORTY TWO- THANK YOU
CHAIRMAN AND MEMBERS OF THE
COMMITTEE BY NAME IS ERIN AVERY
AND WITH THE CALIFORNIA SPECIAL
DISTRICTS ASSOCIATION. WE
REPRESENT- ONE THOUSAND
INDEPENDENT SPECIAL DISTRICTS
IN THE STATE. I WANT TO THANK
THE COMMITTEE FOR ITS IMPORTANT
WORK ON THIS TOPIC AND
ESPECIALLY FOR SEEKING OUT
LOCAL GOVERNMENT VOICES TODAY-
THIS IS ESPECIALLY IMPORTANT
FOR SPECIAL DISTRICTS. ARE FOR
NUMBER OF REASONS BUT
ESPECIALLY AROUND THE AREAS OF
INFRASTRUCTURE PROTECTION- WE
HAVE A NUMBER OF CRITICAL
INFRASTRUCTURE A SPECIAL
DISTRICTS IN THE STATE- AND
ALSO AFFORDABILITY AND
AVAILABILITY AVAILABILITY OF
INSURANCE. COVERED IT LIKE
TODAY A KEY ISSUE FOR SPECIAL
DISTRICTS. ONE OF THE COMMITTEE
AGAIN HAND CST IS HAPPY TO BE A
RESOURCE FOR THE COMMITTEE
REPORT THANK YOU. THANK YOU SO
MUCH. ARE THERE ANY OTHER
WITNESSES HERE IN ROOM FORTY
TWO OH THREE. A SING NONE LET'S
MOVE TO ROOM TWENTY FORTY.
PRICING NO WITNESSES THERE WILL
MOVE ON TO WITNESSES WAITING TO
PROVIDE PUBLIC COMMENT VIA
TELECONFERENCE ORVIS. MODERATOR
IF YOU COULD PLEASE PROMPT
INDIVIDUALS WAITING TO PROVIDE
PUBLIC COMMENT WE WILL BEGIN
AND COULD YOU GIVE ME THE
NUMBER TOTAL NUMBER OF PEOPLE-
WAITING TO TESTIFY. CERTAINLY
LADIES AND GENTLEMEN IF YOU
WISH TO MAKE A PUBLIC COMMENT
YOU MAY PRESS ONE ZERO AT THE
TIME. LONDON ZERO AT THIS TIME.
AND WE CURRENTLY HAVE NO ONE
WITH PUBLIC COMMENT THANK YOU
MODERATOR- HAVING HEARD ALL THE
PUBLIC TESTIMONY MEMBERS ARE
THERE ANY ADDITIONAL QUESTIONS
OR COMMENTS. ALL RIGHT THANK
YOU TO ALL THE PANELISTS AND
MEMBERS- FOR YOUR TIME AND
MONEY TODAY. THANK YOU TO ALL
THE INDIVIDUALS WHO CALLED IN
TO PARTICIPATE IN PUBLIC
TESTIMONY- IF YOU WERE NOT ABLE
TO TESTIFY VIA THE TEST
TELECONFERENCE SERVICE PLEASE
FEEL FREE TO SUBMIT YOUR
COMMENTS OR SUGGESTIONS IN
WRITING TO THE SENATE SELECT
COMMITTEE ON CYBER SECURITY.
AND IDENTITY THEFT PREVENTION
OR VISIT OUR WEBSITE YOUR
COMMENTS AND SUGGESTIONS ARE
IMPORTANT TO US AND WE WANT TO
INCLUDE YOUR TESTIMONY AND
COMMENTS AND OFFICIAL HEARING
RECORDS THANK YOU AND WE
PROTECT APPRECIATE YOUR
PARTICIPATION. I THANK YOU
EVERYONE FOR YOUR PATIENCE AND
COOPERATION- WE'VE CONCLUDED
THIS AGENDA AND THE SENATE
SELECT COMMITTEE ON CYBER
SECURITY AND IDENTITY THEFT
PREVENTION IS ADJOURNED.