The House Homeland Security Committee is about to start a hearing with industry representatives testifying about its draft cyber incident reporting bill.
homeland.house.gov/activities/hea…
homeland.house.gov/activities/hea…
As I've noted, the latest draft of the House bill pares back some of the language to accommodate industry concerns. For example, it now says CISA can't require reporting any sooner than 72 hours after an incident.
https://twitter.com/ericgeller/status/1431331181967167489
Industry witnesses will implicitly criticize the Senate bill.
BPI: 24-hr reporting deadline "would distract from critical work" & lead to "premature and likely erroneous" reports homeland.house.gov/imo/media/doc/…
ITI: Limit requirement to "verified" breaches homeland.house.gov/imo/media/doc/…
BPI: 24-hr reporting deadline "would distract from critical work" & lead to "premature and likely erroneous" reports homeland.house.gov/imo/media/doc/…
ITI: Limit requirement to "verified" breaches homeland.house.gov/imo/media/doc/…
House Homeland cyber subcmte chair Yvette Clarke, opening the hearing, says she's heard concerns about compliance challenges for small CI firms.
"We do not expect all [CI companies] to be subject to this reporting requirement. Rather, we expect it to apply only to a subset.”
"We do not expect all [CI companies] to be subject to this reporting requirement. Rather, we expect it to apply only to a subset.”
But Clarke adds, "I would certainly be happy to explore whether we need to add language directing CISA to provide additional compliance assistance to small businesses that are determined to be covered entities."
Subcommittee RM Andrew Garbarino: “I've been pleased to see our majority counterparts engage our members in productive conversations on this topic, and I hope we can continue the constructive dialogue here today.”
Since I rather abruptly mentioned the Senate bill in this tweet, here's the announcement of that bill for those who aren't familiar with it: warner.senate.gov/public/index.c…
It's stacked with powerful sponsors, but what we're seeing today is that industry prefers the House bill.
It's stacked with powerful sponsors, but what we're seeing today is that industry prefers the House bill.
https://twitter.com/ericgeller/status/1433098558627106823
FireEye's Ron Bushar says any reporting requirement should allow for agility and adjustment, given how quickly the cyber threat landscape can change.
Companies should have a "reasonable" amount of time to assess an attack before having to report it, he says.
Companies should have a "reasonable" amount of time to assess an attack before having to report it, he says.
Bushar also warns against punitive provisions of incident reporting bills, such as subpoena authority when companies don't report hacks.
Subpoenas and other compulsory measures, he says, don't make sense when dealing with what are essentially crime victims.
Subpoenas and other compulsory measures, he says, don't make sense when dealing with what are essentially crime victims.
Heather Hogsett from BPI praises the bill for its scope, its 72-hour minimum for a reporting deadline, its incorporation of privacy protections for shared information, the req to harmonize rules with existing regulations, and the req for govt to share more data w/ industry.
ITI's John Miller recommends: "feasible" timelines (≥72 hrs), confidentiality protections (says may need to update 2015 CISA law), harmonize w/ existing regs, "appropriate" reporting thresholds (limit to verified incidents), and limit reporting to impacted entities, not vendors.
On harmonization with existing regulations, Miller recommends encouraging CISA to collect incident information through existing channels and partnerships (e.g. FBI, SEC) whenever possible, rather than creating new reporting channels and processes.
USTelecom's Robert Mayer encourages the committee to let federal and industry experts collaborate on reporting thresholds rather than setting them in legislation, since it's "a highly technical exercise."
He also recommends provisions to prevent shared information from leaking.
He also recommends provisions to prevent shared information from leaking.
AGA's Kimberly Denbow recommends the bill require outreach to sector coordinating councils in developing regulations; ensure regular review of list of covered companies; ensure CISA has enough expert personnel to work w/ industry; and narrow exceptions to ban on info disclosure.
Clarke asks Bushar what info CISA needs from industry.
He cites examples such as IOCs, malware samples, info on targeted users and systems, and info on stolen data.
He cites examples such as IOCs, malware samples, info on targeted users and systems, and info on stolen data.
Clarke asks Bushar what info industry needs from CISA.
It's much the same as what CISA needs from industry, he says. Industry can combine CISA's insights with its own to better understand adversary behavior.
It's much the same as what CISA needs from industry, he says. Industry can combine CISA's insights with its own to better understand adversary behavior.
Garbarino asks what should be defined in legislation vs. rulemaking.
Denbow and Mayer says that most details should be left to CISA/industry consultations during the rulemaking process.
Denbow and Mayer says that most details should be left to CISA/industry consultations during the rulemaking process.
Witnesses are emphasizing the need for narrow rules about what info to share.
Hogsett says can't deluge CISA w/ info that it can't process.
Mayer says need to avoid “fog of more,” where short deadline prompts companies to quickly share too much info that makes analysis hard.
Hogsett says can't deluge CISA w/ info that it can't process.
Mayer says need to avoid “fog of more,” where short deadline prompts companies to quickly share too much info that makes analysis hard.
Jim Langevin: If companies only have to report confirmed breaches, how will we be better positioned to mitigate something like SolarWinds?
Mayer: If you have something on the scale of SW, “you’re going to know it when you see it.” And USG will likely already be aware of it.
Mayer: If you have something on the scale of SW, “you’re going to know it when you see it.” And USG will likely already be aware of it.
Bushar says companies won’t wait until they have a complete picture of an attack, but they do need time to confirm that a breach has happened.
Langevin says "a bit concerned about the gap I see" b/w how much CISA needs and how much it would get if companies only had to report confirmed breaches.
He says companies might not report staging activity that precedes a ransomware campaign, hampering CISA's response.
He says companies might not report staging activity that precedes a ransomware campaign, hampering CISA's response.
Sheila Jackson Lee: How important is it to have bidirectional information sharing?
Bushar: "Critical."
Denbow: "We feel like when we share with the government, it becomes a landfill of information, with nothing valuable coming back out to us in a timely fashion."
Bushar: "Critical."
Denbow: "We feel like when we share with the government, it becomes a landfill of information, with nothing valuable coming back out to us in a timely fashion."
It seems like most of the subcommittee isn't attending this hearing. We appear to have just finished the first round of questioning, and the only people who spoke were the subcommittee leaders, full committee chair Bennie Thompson, and three members.
Bushar tells Clarke that security firms like FireEye shouldn't be required to report incidents that they discover on their customers' networks.
He says it would betray the customer's trust and discourage companies from seeking security services.
Senate bill requires this.
He says it would betray the customer's trust and discourage companies from seeking security services.
Senate bill requires this.
The hearing has adjourned.
The industry testimony on the House bill showed that there will be plenty of resistance to the Senate bill if it moves forward. The question now is, will the Senate bill's sponsors accommodate industry concerns or double down on their approach?
The industry testimony on the House bill showed that there will be plenty of resistance to the Senate bill if it moves forward. The question now is, will the Senate bill's sponsors accommodate industry concerns or double down on their approach?
My story on today's House hearing:
"Industry support for House cyber incident reporting bill suggests trouble ahead for Senate version" subscriber.politicopro.com/article/2021/0…
"Industry support for House cyber incident reporting bill suggests trouble ahead for Senate version" subscriber.politicopro.com/article/2021/0…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
