Any time. Before i deliver my opening remarks, i want to note today the committee is meeting virtually and announce a couple of reminders to the members about conduct of this hearing. First, members should keep their video feed on as long as theyre present in the hearing and members are responsible for their own microphones. Please keep your microphones muted unless youre speaking. If members have documents they wish to submit for the record. Please email them to the Committee Clerk whose email address was committed prior to the hearing. Good morning, id like to welcome our distinguished panel of witnesses, members and those viewing remotely. Todays subcommittee hearing, cybering security at nasa. Ongoing challenges and increased telework during covid. In early 2020 the world was caught off guard with the rapid and dramatic onset of the coronavirus. Nasa and many agencies and consistent with the committee of budget. To ensure the health and safety of more than 17,000 Civil Servant employees and extensive contractor work force. For its credit nasa prepared for the transition having held an agencywide telework in early march, the expanded telework operations and today, 75 to 80 of nasas Civil Servants continue to work remotely, development work, engineering analysis and other activities. The shift to increased telework at nasa raises many questions, front and center Cyber Security. What is the increase and extended use of telework mean for protecting nasas intellectual property, identifiable information and how is does the cyber challenge affect the risk postures and what steps is nasa taken during the pandemic and beyond . These are some of the questions todays hearing will explore because whats clear is that nasa is a target and i want to pause here for a moment to note an article in the hill today, where the Justice Department has brought charges against iranian nationals for hacking u. S. Satellite companies, so, i think this is incredibly timely. In a recent nasa i. D. Report stated that given nasas mission and valuable technical and information it produces the information maintained in the i. T. Infrastructure is a target for hackers and individuals. And Jim Bridenstine stated at a town hall, nasa is the most attacked agency in the federal government when it comes to cybersecurity. Past data breaches and system intrusions at nasa and its facility have resulted in large apartments of stolen data. Installation is now aware, copying, modifying, and deleting Sensitive Files and accessing nasa servers, including those supporting missions. The department of homeland securitys Cybersecurity Security agencies, which is a mouthful of course, its related to telework and encouraging organizations to adopt a heightened state of cybersecurity. In june 2020, media articles reported that malicious actors congratulated nasa and spacex on a crude demonstration flight and then announced they had allegedly breached and infected a nasa contractor. Specifically one that provides Information Technology, cybersecurity, and cybersecurity information to the agency. If true, thats a concerning report and part of why were here today. Protecting nasas i. T. And data during the pandemic demands vigilance. However, nasas cybersecurity doesnt end with the crisis. Theyve identified weaknesses and ongoing concerns with nasas Information Security. Further, theyve ranked this as a top agency challenge. Ensuring cybersecurity at nasa becomes even more pressing, given Rapid Advances in the supply change risk. The open partnerships, and overall increase in space activity. Nasa is a national treasure. Its Missions Continue to inspire young and old and cutting edge space technology, research and space flight experiences are the envy of the world. Nasas accomplishments wouldnt be possible without computers, software, and Information Systems. Will nasa or any organization be 100 free from risk and cyber threat . Probably not. Is there room for improvement . There is. And the na the bottom line we need to ensure that nasa has the tools it needs to r and takes the necessary actions for success and safety and security during covid19 and beyond and i look forward to our witnesss testimony today. So i think we are there he is. Hey. Ranking member babin, im glaed you were able i know that technology can sometimes speaking of technology, be a little bit of a challenge, but glad you made it through so the chair now recognizes Ranking Member babin and my good friend from texas for an opening statements. Absolutely. Thank you. We have three computers here we couldnt get on, but i got on with my telephone. So any way we can do it, im glad to be with you. Innovation and ingenuity, i love it. Absolutely, okay, well, thank you so much. Nasa is one of the best known organizations in the entire world. Its successes with the mercury, gemini, apollo shuttle and International Space station programs along with its breathtaking scientific discoveries and jawdropping robotic probes attract worldwide attention. Unfortunately, that attention comes with many challenges. The technologies that nasa develops are also sought after by criminal entities, unscrupulous foreign governments and destructive and because they have civil and military applications these challenges are particularly grave. And this is a topic that this committee is focused on for decades. Mr. Martin testified before the excuse me, before the investigations and oversight subcommittee almost 10 years ago on the topic of Information Security. At that hearing he testified that an unencrypted laptop was stolen from nasa that resulted in the loss of the algorithms, quote, unquote, used to control at space station as well as personally identifiable information and intellectual property. Similarly, the u. S. China economic and Security Review Commission noted in its 2011 report to congress, that the terror and landset 7 satellites experienced at least two separate incidents of interference apparently Cyber Security with their command and control systems. Recently nasa ig released the yearly report that found that Information Systems throughout the agency faced an unnecessarily high level of risk that threatens the confidentiality, the integrity availability of nasas information, unquote. The report concluded that its imperative the agency continue its efforts to strengthen its Risk Management and governance practices to safeguard its data from Cyber Security threats. While these may seem startling, there are specific reasons that many of the recommendations remain open. For instance, agencywide guidelines and best practices are often general rules and principles that are not optimized to specific agencies unique capabilities, expertise and challenges. Her instance now sit is the world leader in designing, building, operating and communicating with spacecraft this expertise resides within the Mission Directorates and that the centers of cultivated this expertise over many decades. In some instances they develop the software, Information Systems that underlying technologies that industry and the rest of the government adopted and embraced. And even more extreme circumstances they continue to use one off operating systems that, while perhaps not compliant with omb derived governmentwide guidance, are arguably more secure because of their uniqueness and their obscurity. Efforts to bring the systems and technologies into compliance with a onesizefitsall cookiecutter approach developed for commercial enterprise systems could actually introduce more risk into the system. This isnt to excuse nasas cybersecurity shortcomings as identified by the ig and gao over the years. Lost laptops, and secure devices, unauthorized access to systems and lapsed acos alterations operate, and for Inventory Management all cause or concern. Which brings us to the situation that nasa currently faces. The covid19 challenge requires most of nasas employees and contractors to work remotely. While bass has embraced teleworking for years, the expansion of this practice introduces a larger target and more vulnerabilities from malicious actors to exploit. An addition to teleworking challenges i am interested in understanding what level of insight nasa has on contractor for cybersecurity as nasa moves more to publicprivate partnerships. And finally its worth noting that President Trump recently issued space policy directive number five, focus on Cybersecurity Principles for space systems. And while it is not focused is not covid focus specifically, it is particularly timely given todays hearing and demonstrates the administrations forwardlooking leadership on this very topic. I look forward to hearing more about these important issues, and what nasa plans to do to mitigate as well as what congress and the administration can do to help. With that, madam chair, i yield back. Iq, Ranking Member babin come for your opening statement. I think its safe to say we share many of the same concerns in this area, and excited and grateful for the opportunity for this hearing today. If there are any members who wish, at this point if there any of us who wish to submit additional statements, statements will be added to the record at this point. Now i would like to introduce our witnesses. Our first witness today is mr. Jeff seaton. In april 2020 mr. Seaton was named nasas chief acting chief information acting chief Information Officer. Lets see if i can get that outright. Prior to his position he served as nasas deputy chief Information Officer and spent seven years at the chief Information Officer at Nasas Langley research center. He began his career with nasa in 1991 as as a research engineer, designing robotic systems for spacebased applications and also served as lengthways chief Technology Officer and deputy cio. He received a bachelors degree and master degree in Electrical Engineering from firm from virginia. Ill compare were glad youre with us today. Our next witness is mr. Paul martin, specter general for the National Aeronautics and space administration. Mr. Martin has been the nasa Inspector General sense 2009 and pride his appointment at nasa he served as the deputy Inspector General at the department of justice. He also spent 13 years as you sent Commission Clean six years as the commissions deputy staff director. Mr. What received a bachelors degree in journalism from Pennsylvania State university at a juris doctorate from Georgetown University law center. Welcome, mr. Martin. Our third and final witness today is dr. Diana burley. In july 2020 dr. Burley was appointed as vice provost for research and professor of Public Administration at American University. Prior to her current position dr. Burley spent 13 years as a professor of human and organizational learning at George Washington university where she was the inaugural chair of the human and Organizational Learning Department and the direct of executive leadership doctoral program. Shes also managed a multimillion dollar Computer Science education and resource portfolio for the National Science foundation. Dr. Burley received a bachelors degree in economics from the Catholic University of america, a masters in Public Management and policy from Carnegie Mellon university, and a masters and doctoral degrees in organizational sites and information policy also been from Carnegie Mellon university. Welcome, dr. Burley. As our witnesses you should know you each have five minutes for your spoken testimony. Your written testimony will be included in the record for this hearing. When you have completed your spoken testimony will begin with questions and each member of what happened five minutes to question the panel. We will start today with mr. Seaton. Mr. Seaton, you are recognized for five minutes. Thank you, chairwoman horn, Ranking Member babin and members of the subcommittee on space and aeronautics. For allowing me to appear before you today talk but about nasas Information Technology infrastructure and efforts to manage and protect that infrastructure during the covid19 pandemic. Thankfully due to Strategic Investments made over the last several years nasa was wellpositioned to get our mission moving for by shifting the majority of the workforce to telework last march. Nasa has never been close and a workforce has continued to work remotely in a productive and often creative manner despite the highly contagious covid19 virus. With strict safety protocols in place nasa is no now graduate t more employees onsite based on factors such as local conditions and guides from the cdc and other federal partners. Let me assure you the safety of our workforce remains our top priority. At the same time, protecting a effectively operating our i. T. Infrastructure continues to be another top nasa focused. I keep plays a role in every aspect of nasas missions. However, effective i. T. Management is not an easy task. As nasas acting chief Information Officer is my job to balance implement Innovative Mission enabling i. T. Capabilities with Operational Efficiency and effective cybersecurity to guard against evolving threats. During the pandemic the demands and expectations placed on nasas i. T. Infrastructure been incredibly high and the threats of extra actors remain an ongoing concern. However, with hard work, dedication and innovation nasas cio team is risen to the challenge of keeping our missions moving forward. For example, we help rapidly to help software to exposure of also meeting all security and privacy requirements. Additionally, with help nasa can desire and onboard nucleus, contractors and interns with integrated approaches to provisioning and maintaining i. T. Systems and tools remotely. The pandemic has dramatically change the way we work. While many employees already telework at least occasionally before the pandemic, having 90 of employees teleworking at the same time has been game changing. Nasa employees have significantly increased their use of virtual Collaboration Tools such as webex and Microsoft Teams so we can interact with each other facetoface while sharing virtual collaborative workspaces. Employees are dependent on nasas Virtual Private Network to connect securely to internal networks and systems. Before the pandemic our highest vpn connection rate was about 12,000 users in a single day. Today are vpn is supporting almost 40,000 daily users within the availability of exceeding 99 . Thanks architectural and capacity improvements implemented over the past 24 months. Like other federal agencies nasas i. T. Infrastructure is under constant attack from well resourced and highly motivated domestic and foreign adversaries, and would remain a popular target today. Therefore the continued strength of our technical and procedural capabilities to proactively defend and protect our systems and data. While the reported number of attempted Cyber Incidents continue to increase part of because with greater visibility into our Network Today im confident nasa is appropriate addressing and strengthening our response to these threats. In fiscal year 2020 nasa develop a continuity of operation capability to further enhance our Security OperationsCenter Located at the Ames Research center. If stock operation would disrupt a read of limited bills identify and respond incidents. Today nasas stock operations allow us to maintain 24 x seven stock operations at all times even if there is an isolated disruption. With strength and the tools and capabilities nasa is transitioning from a largely reactive to a more proactive cybersecurity posture. As the pandemic worse and enablement nasa moved if stock remote operation suture employee safety and did so without negatively impacting our network or are cybersecurity capabilities. In closing i i want to personay thank natalie my staff and leadership but the entire nasa workforce for the hard work and the personal sacrifices theyve made during this challenging time. Our employees are finding new ways to keep missions moving forward, support each other, balance work and family pressures and even dedicate their expertise and personal time to developing technologies that are aiding in the National Response to the coronavirus. While no one is sure what the future holds, nasa Senior Leaders include myself are committed to keeping nasa workforce safe and providing them with the i. T. Tools and infrastructure they need to continue executing our missions. I want to assure you that protecting and evolving nasas i. T. Infrastructure is and will remain a top agency priority. Thank you for the opportunity to testify before you today, and i look forward to answering any of your questions. Thank you. Thank you very much, mr. Seaton. Mr. Martin, you are now recognized for your testimony. Thank you, chairwoman horn, Ranking Member babin and members of the subcommittee. The nasa office of Inspector General has conducted a significant amount of oversight work to look nasa improve its Information Technology governance while securing its networks and data from Cyber Attacks. Over the past five years we issued 16 on reports with 72 recommendation related to i. T. Governance and security. During this same time we conducted more than 120 investigations involving intrusions, denial of service attacks and data breaches on national networks. Several of which have resulted in criminal convictions. My testimony today is with informed by the body upon an investigative work. The sound is and security of its data and i. T. Systems essential to nasas success big the agency spends more than 2. 2 billion a year on a portfolio of i. T. Assets that include hundreds of Information Systems used to control spacecraft, collect and process fight to the gate and naval collaborate with colleagues around the world. Given the valuable technical and intellectual capital nasa produces, its i. T. Systems present a highvalue target for cyber criminals. The past six months in particular has tested the agency as more than 90 of nasas workforce moved from onsite to remote work due to the pandemic. During this time nasas experience an object in Cyber Threats phishing attempts doublet and Malware Attacks rising substantially. This morning i offered three observations about the state of nasas i. T. Security in governance to provide context to the scope of its challenges. First, our concerns with nasas i. T. Governance security are wideranging and longstanding. For more than two decades nasa has struggled to implement an effective i. T. Governance structure that aligns with authority and responsibility commensurate with the agencies overall mission. Specifically, the agency cio is limited oversight and influence over i. T. Purchases and security decisions within Mission Directorates and that nasa centers. It decentralized a major of nasas operations coupled with the store culture of autonomy have hindered the cio stability implement effective enterprisewide i. T. Governance. Moreover, nasas connectivity with educational institutions and other outside organizations and its vast Online Presence of 3000 web domains and more than 42,000 public accessible data sets offers cyber criminals a larger target than most other government agencies. Second, despite positive for the momentum of the agencies i. T. Practices continue to fall short of federal requirements. For example, in 2019 for the fourth year in a row nasas performance during our annual physical review remains at level two out of five. Meaning the agency has issued but is that consistently implemented important policies and procedures defining its i. T. Security program. And third, like many of the public and private organizations, nasa struggles to find the right balance between user flexibility and system security. For example, for years nasa permit a personally owned and partner owned mobile i. T. Devices to access nonpublic data even if those devices did not have a valid authorization. Today nasa employees and partners can use nonagency mobile devices to access email if the user installs Security Software known as mobile Device Management. However, and omg audit last month found that nasa was not adequately securing its email networks from unauthorized access by these personally own devices. All the nasa has deployed technologies to monitor unauthorized connections, it is not fully implement control to remove or block those devices. Moreover, the agencies december 2019 target for installing these controls were delayed due to technological issues and pending liquidated center closures. Until these enforcement controls are fully implemented, nasa faces an elevated risk of a breach. Finally, as part of its initiative nasa plans to centralize and consolidate i. T. Capabilities. The cios office expects to complete its assessment by marc. 2021. Implementation on institutional systems beginning later that year. As map unfolds we plan to assess whether this enterpriselevel alignment strengthen cybersecurity at nasa. I look forward to your question questions. Thank you, mr. Martin. Dr. Burley, you are recognized for your testimony. Thank you. Subcommittee chairwoman horn, Ranking Member babin and distinguished member of the committee, thank you for the opportunity to appear before you today. As a nation continues to navigate the complex and that certain environment of the Global Pandemic it is vital that we engage in a robust discussion on the challenges and emerging issues for increased telework during this time. At American University we are guided by our Strategic Plan for the change world. We navigate come shape in the future of work and researchers are pushing the boundaries of discovery in healthcare, data sites, social equity and security. In my remarks today which are shaped by decades long career leading cybersecurity initiative, i will highlight how the interplay of these areas supports the development of holistic strategy address cyberSecurity Issues surrounding the exponential growth and telework during this unprecedented time. Concerns over its exposure to covenanting has great mass migration from virtual city. While teleworking arrangements have existed for years, never before have we seen the range involving of Remote Workers or Remote Working environment. Employees across the demographic categories and tactical abilities are now working remotely and engaging with their employers come colleagues and customers through a digital interface and on a range of devices. Securing this activity necessitates that we recognize those technical needs and environmental factors that shape that behavior. Consider the following. Novice users and novice experiences create vulnerabilities. In the hurry to transition to remote work comp agencies did not have sufficient time to prepare novice user for the complexity of the newly virtually working fiber. Our overall security is more reliant upon individual decisions made by employees and nine employees alike. Even seasoned users had developed behaviors in accordance with onsite protections faced the challenges and can find themselves less prepared to avoid the vulnerabilities exposed by the Remote Working environment. Employees are working under duress. Covid19 continues to drive economic instability healthrelated concerns, anxiety and confusion. Employees who worry about beating their basic needs and are less likely to attend to lower priorities like cybersecurity. Cyber criminals exploit opportunities, a shift connectivity provides leads to more opportunities for cyber criminals to use social engineering techniques such as fraud, misdirection and disinformation to exploit those vulnerabilities. Users framed entire sells online. If we use Public Health analogy of treating we can strengthen efficacy of guides to engage in robust cyber hygiene activity. In Public Health practice, successful treatment is inextricably linked to the social and environmental conditions. Today in the midst of the covid19 pandemic we must recognize that while basic cyber hygiene practices relatively global under normal circumstances these are not normal times. Our workers are distracted, frightened and fatigue. This is especially true for the most vulnerable users. As such, strategies to strengthen the cybersecurity of teleworkers must consider the full spectrum of user experiences and address the complex reality of their needs. The points i have just outlined represent only a snapshot of the benefit of using a holistic approach to reduce the impact of cybersecurity related vulnerability. I have long advocated for this type of approach. Now and with a greater sense of urgency we must collaboratively develop interventions that address the dynamic interplay between technical and environmental variables that shape the cyber scaredy posture across the broad range of teleworkers as the navigate the covid19 environment. I look for to continued engagement with this esteemed committee to develop concrete strategies that raise awareness of the threat, encourage actions that increase the cybersecurity of the nations employees, and protect our most vulnerable citizens. Thank you. Thank you very much, dr. Burley. At this point we will begin our first come with a first round of questions and the chair recognizes herself for five minutes. Thank you to our witnesses today. It is clear these are important issues and theres lots of things to tackle. I want to start, mr. Seaton come with some questions about contractors and cybersecurity contractors, especially given the increased use and the significance of contractors within nasas workforce. I have a number of questions i would try to get through to asa kid. Some of them are just yes or no and they will get to a few other things. What we know and i mentioned the article today in the hill is that our systems, theres a lot of information that hackers are very interested in. The contractors that nasa works with our integral to our nation space agency. My first question is either federal Acquisition Regulation classes specifically refer to contractor cybersecurity requirements . Yes, there are and we include those in our agency contracts, that all providers follow the cybersecurity requirement. Let me follow up on that for a moment because, so those are nasa cybersecurity requirements. We asked earlier this year about associated bar language and nasas response was there are no far requirements, no far clauses but do this fall under nasa requirements in contracts . We have supplements and we can get specifics of what those in private are included. I can take that question for the record. Okay. Absolutely. When those clauses are included, is at nasa that signs off on the cybersecurity . Are there waivers . Who signed off on the requirements for cybersecurity that they had been met . We have automated tools to ensure that our contractors are complying with the requirements when theyre connecting to a nasa system just as any nasa employee would. As was mentioned in the earlier testimony, we put in place controls and are continuing to strengthen those controls to ensure that only authorized devices can connect to our networks and systems. And who is over a a set of contractor cybersecurity protocols . Is that the your office . Are you able to conduct oversight and out as of cybersecurity practices by contractors . Ultimately i and the acting chief Information Officer and so cybersecurity is my responsibility, and so it would be ensures compliance with the cybersecurity requirements. Do you feel like you have sufficient oversight and insight and ability to do that within your authorized within your authority . Yes, i would say i believe that within nasa ive been given the appropriate authority and support, but i will say that the environment is continuing to change and its the dynamic landscape, i. T. Is no longer just computer and a laptop on your desk but expensive Operation Technology where i. T. Is embedded within systems. I would say its challenging without evolving landscape, and so we continued continue to mar processes. Thank you. Stepping back to the challenges from this year during covid19, i will have a question for mr. Martin and mr. Seaton, and hope you to have time to get to dr. Burley. About broader. The memo or predecessor published on april 8 warned of increased attempts in Cyber Attacks and especially during covid19. My first question is to you actually come to mr. Martin, how has the rate of Cyber Attacks change since that memo in april, and what steps has the ocio taken to respond to those increased attempts . There has been an increase in phishing attacks, and a lower level from other attacks. But honestly the change to the pandemic operating model is consistent without nasa has operated happened after we supported a mobile workforce and so and put in place controls and technologies to mitigate against some of these threats, including automated prevention of phishing attacks. When it comes down to it, you are the most vulnerable part of our i. T. Security, its the people and so we try to put in place automated controls to make it easier for our employees and we have seen significant improvement in Phishing Protection over the last two years. Thank you. Quickly, mr. Martin, by time is coming to an end, but what is your confidence level in nasas ability is officially address the increase in Cyber Threats as reported by the u. S. Cio . Overall i think theyre making incremental improvements. Theyre heading in the right direction and i think theres a real new realization of the last couple years of expense and significance of the challenge. I think were very, very cautiously optimistic. Wonderful. Thank you very much. I never recognize Ranking Member babin for five minutes of questions. Thank you, madam chair. I think i am unmuted. Hopefully i am. I want to address this to the chief Information Officer mr. Seaton. Two weeks ago President Trump sign space policy directive number five which focus on Cybersecurity Principles for space systems. It states it is a policy of the United States that executive departments and agencies will foster practices within government Space Operations and across the commercial space industry that protects space assets and their supporting infrastructure from Cyber Threats, and ensure continuity of operations. My question is this. As nasa increase its use of publicprivate partnerships, how will it ensure that contractors comply with this policy without implementing regulations . Thank you for the question. As pb five, we appreciate the administration and congress focus on space cybersecurity because thats critically important to us. We are currently in the process of reviewing and analyzing number five but the good news is we see a lot of consistency with best practices that were already implement think and will continue to look to strengthen our cybersecurity both within our mission as well as with our contract partners. Absolutely. Thank you so much. My next question would be to Inspector General paul martin. Your Office Issued a report on jpl, jet propulsion laboratories cybersecurity management last year. Jpl, unlike other nasa centers, is managed a contractor, thats caltech. But the report highlights the fact nasas contract with caltech did not include relevant requirements from nasa i. T. Security policies. Has the oig conducted a review of other nasa contractors to determine if their contracts include necessary clauses pertaining to i. T. Security . And if so how many has your Office Conducted . Thank you here we have not conducted a separate audit looking at that specific issue. Although if i could double back, the concerns we had when nasa entered into a new fiveyear contract with caltech, that the contract was absent the significant i. T. Oversight provisions. We have since followed up and found out that jpl has issued aa nasa has accepted and we reviewed the criteria we were concerned about. So the federal oversight i. T. Oversight is going to happen at jpl so we are pleased with that. Thank you. And does the oig conducted compliance audits to determine if contractors are fulfilling their contracts obligations pertaining to Information Security . If so, how many has your offie conducted . Again, we conduct a significant number of Program Audits that look at the programs that are run by these contractors, and part of that review includes a detailed dive into the contract to make sure that the i. T. Security requirements are not only in the contract but there actually followed. Is this a more appropriate for the nasa cio or Procurement Office to conduct rather than the oig . I think certainly the cios office and procurement have to ensure of the outset that the appropriate Security Issues and safeguards are contained in the audit themselves and ongoing, good contract management which show we need to ensure they are being effective. Oig is limited capacity like most organizations, so well try to target the more high risk high value operations at the nasa has to do a deep dive audit. And then as this very hearing demonstrate nasa in the nation have adopted videoconferencing to adapt to social distancing requirements. Has nas identified any vulnerabilities with commercial videoconferencing platforms or certain videoconference platforms not about four nasa use based on technical characteristics or concerns over foreign influence . I which is see what everyone of you has to say come just a short and concise answer. I will start with that is a really Senate Approved told that a call to the appropriate Security Validation which include assessing any threats externally to those environments, and outside of that other tools are not approved for use in nasa. Okay. And then as oig is using those approved tools. Good. Dr. Burley, did you want to add to that at all . Those agencies and other organizations have their list of approved tools. Well, madam chair, i have spent all my time and so i will yield back and it what you think all the witnesses. We appreciate it very much. Yield back. Thank you very much, Ranking Member babin. Mr. Perlmutter, you are recognized for five minutes. Thank you, madam chair. I think one of the biggest problems with this remote stuff is when somebody like doctor babineaux is Walking Around with his phone and i feel like were in the blair witch project, thats a whole other problem. My questions are for you, dr. Burley. Mr. Seaton mentioned the most vulnerable spot for hacking and cybersecurity is the individual, the person. When you are testifying, you talked about novice users nothing they with equipment or security protocol, employees under duress, worried about the basic needs and not the more refined things like cybersecurity. You know, that folks are having trouble because they are distracted, frightened and fatigue, i think were your terms. It almost feels not, the cao should be involved but the Personnel Department is really one of the keys here. So what do you see, whether its nasa or generally across the agency being done to help the individuals kind of get through this very anxious period, and maintain cybersecurity . Thank you for your question. Youre absolutely right in that it needs to be a collaboration between the i. T. Department and the h. R. Department. So first every agency has a set of Cybersecurity Awareness programs that they have in place and really guide not only behavior within the organization, within the walls, but also outside. Those awareness programs need to be adapted, recognizing that employees are working in a definite vibrant, working remotely and working around other people. Its not just then. Its family members and others in their environment. We have to take a hard look at those awareness programs and recognize the need to be adapted based on the current realities. Second, yes, absolutely Human Resource professionals need to be involved, provide the kind of support to our employees at the needs of their able to focus on that only doing the work but by doing the work in a secure manner. I guess i hadnt even thought of it but obviously we should think of it, people are working from home. The kids are in the background or whoever might be in the background so it isnt like you in the office at nasa headquarters where everything is pretty safe and secure. I think, madam chair, im going to yield back but i do think this really is a cooperation certainly between the h. R. Department and all of the Technology Technology folks. All three of our speakers have focus on that but i, in this pandemic, thats critical. I just back. Thank you very much, mr. Perlmutter. Mr. Posey, you are recognized for five minutes. Thank you, madam chair probably this hearing on this important issue regarding cybersecurity that at nasa drink over that you just recap, in june 2020 nasas Inspector General stated nasas highprofile makes it a attractive target of computer hackers and other bad actors. As stated earlier, during the covid19 pandemic many contractor employees or teleworking possibly making agency bigger target. In june 2020 report the specter josette is finally agency develop a review of its Information Security programs, integrity and availability of its data systems and networks. This is not a new problem facing nasa. It was concluded back in 2014 at nasa networks are compromise and individuals are not being held accountable. Not a new concern for us either. I include language in the house passed nasa authorization bill back in 2015 to address this by requiring a report on a nasa will safeguard its networks and protect against control violation Inspector General also made nine recommendations including they ensure the risks Information Security systems and Compliance Systems are updated to keep the data secure. The Inspector General concluded that the threats are increasing and that it is imperative for nasas strengthen its mismanagement and government practices to safeguard its data from cybersecurity threats. So inspector martin, first, it was noted that the Inspector General that nasa is an attractive target for computer hackers and bad actors. Is china one of those bad actors and is china present a cybersecurity threat to nasa . And besides security is a Great Technology what steps is now seeking to secure supply chain from case involving china [inaudible] yes, yes, no. Im joking. That was a lot of questions. China is one of the foreign entities out there. Chine is not the sole entity, country out there that is seeking nasas very valuable intellectual property. Nasa is taking steps and has been to secure is intellectual property and its networks from attack both from china and from a series of other countries, and also local hackers. Because we have conducted a series of criminal investigations and work with the fbi and counterintelligence officials when we get leads on these issues. Thank you. To you and mr. Seaton. Cyberspace threats increasing as nasa taken the necessary action [inaudible] back in 2014 and the nine recommendations identified by Inspector General [inaudible] yes. Happy to report that we closed out all of the recommendations. There were quite a few in the report of those have been implemented. I do think they improved our security and our practices. Thank you. Dr. Burley, shouldnt the National Academy do another study to examine these vulnerabilities that teleworking present . The opportunity for associations and National Academy to do studies to assess an indepth look and so i would say yes. Thank you, madam chair. I yield back. Thank you, mr. Posey. The chair now recognizes mr. Beyer for five minutes. Thank you, madam chair, very much. Mr. Seaton, thank you very much for joining us today. In your tests when you mention in the course of the pandemic you are able to onboard new employees, new interns and amazingly our office hasnt been able to the same thing. Weve also been able to make sure all staff house house d equipment including laptops and phones. In the oig report i was surprised that personally own devices could connect to integral systems, and that oig was critical of your not monitoring or enforcing rose associate with gaining access to the nasa networks. How do you make sure employees are given the proper equipment and if the not giving nasa issued equipment, how do venture those personal devices are secure . Great question. We actually do require the use of nasa provided equipment for a new employees come interns so we do provide them with the tools they need. Recently within the last two years it was my office that change the policy that was referred to earlier were you asked present we get about personal devices to connect. That is no longer allowed by policy. The only allowance is for a mobile device that has a mobile Device Management software that we provide that creates a secure container at is your connection back to email and intelligencer system if an employee will consent to us managing the personal device without software. Thats the one case will be do about that. Where we do have opportunity to continue to strengthen our architecture, is implemented automated controls to ensure that that is whats happening. So Network Access control and the pandemic have actually impacted our implementation. Pushing up a schedule into nature but we made significant progress through dhs programs to know whats on our network and who is on a network, and have a look at more control there. Thats encouraging to know because im sure this stuff you have as much important than what is on my network. Mr. Martin, you talked about the malicious intrusion into the nasa systems of unauthorized access to deep space network. Other than the personally identifiable information, what are they after . How much of this is china, russia, the other nations that are interested in space . And will this the affect or cod this effect our lunar missions, our mars mission, james webb and some of the really big important things nasa is doing . Thank you, congressman. Nasa has vast troves of in important intellectual information, capital. It has spent decades amassing. Folks, country actors are active information, the innovation that nasa is so famous for around the world, everything from pii, contractual data on assistance. This is a vast and wide array and again we had a nasa onboard fleet is been under attack from both domestic and foreign cyber criminals. And so its just an ongoing, and clearly difficult issue to keep nasas defenses up. Great. Thanks very much. Professor burley, one of the challenges nasa has is pursuant so many of us have nasa facilities near or close. A one size fits all will be difficult. As examples of systems, federal systems that are similarly decentralize and to be able to effectively secure i. T. Systems . Anybody for nasa to imitate . I think that the cio from nasa would know better, but there are many difference in choices both inside and outside the federal government that could be used as a guide to at least begin to think about best practices and other strategies for securing the networks. I know Like Department of commerce had 13 different cios. Do you have the same challenge within nasa . There is one cio put our cio stop for to me. Strategy and for almost a a dee now we have been working to integrate and operate as a cohesive unit. Acknowledging there are some unique this is at our centers by diplomat inconsistent policies and moving towards Enterprise Services and contract so i think were moving into enterprise direction very significantly. Thank you very much. Madam chair, i yield back. Thank you very much, mr. Beyer. Mr. Garcia, you are recognized for five minutes. Trend thank you, madam chair. I appreciate the testing unwitnessed vapor very exciting time for nasa and challenging with unique dynamics in play. I guess ive got a few questions and probably directed to all of you, mr. Seaton, mr. Martin i dr. Burley. I come from a company where i was a Program Director for a large air breather program and was both classified and unclassified elements to it. One of the big challenges that we had was that the classified elements felt under requirements which i think would effectively what chairwoman horne was tight but on classified site as far as compliance and requirements. Those requirements led to owners costs to suppliers into the lowerlevel supply chain folks. What a be able to do, what is nasa doing i guess to make sure that the Small Businesses that are critical element of your supply chain are not necessarily getting overwhelmed with either cybersecurity requirements or Cybersecurity Development or Software Development work and therefore almost been dissuaded from entering into this industry and to the support chain . Are be able to provide gfi or government furnished ip to make sure and slow down flow down to the lowerlevel suppliers to making sure theyre baking and some of the saprocit elements in their respective programs . How do we communicate with those lower tier supply chain folks . I guess mr. Seaton, we can start with you. Sure. I will say that is a challenge, making sure all of our suppliers and providers appreciate the significance of cybersecurity after building that into the solutions they deliver is a requirement of doing business today. Today was supply chain Risk Management. Justin august section 889 requires us to certify that anybody with doing business with complies with supply chain restrictions that are found a wide. We are working with her providers and suppliers to make sure they understand and they build that into their practices. We have to make sure were balancing the Risk Mitigation efforts which are critical and essential we have to do with the cost elements and just is makie we are not driving some of these key suppliers out of business or out of our industry or out of your business. I i know thats a delicate balancing act as well. A cost of adding a compromise is significant to those come so youre right, it is a balancing act and will try to continue to work. Are the tier one suppliers actively looking to package up programs or software, you know, programs to download to the lowerlevel suppliers, or is it sort of ad hoc defendant with wt the threat is and what the mitigation, threat mitigation measure is . Unfortunately i i really cat speak to the individual practices of the suppliers. I guess just characterizing classified versus unclassified, are you able to speak to what percentage of her networks are on classified networks, and is there, is one of the sides liking the other . In other words, do you see more threats on the classified site or fewer threats but maybe more, you know, more critical impact to those networks, or how would you characterize between underclass versus the high side. Was my office responsible to unclassified sector we work with our office a a protective servs on the classified site. Carefully speaking this form to kind of division there but i wasnt oftentimes compromise on the unclassified side can be used to promulgate to other systems, and so thats a concern even on the unclassified side. Okay, great. Mr. Martin or dr. Burley, i dont know if you guys care to comment on either of those topics there . We have little or no work on the classified side at nasa. Okay. Thats good to know. Okay. I would just, we hosted a Small Business summit with Kevin Mccarthy as well and nasa with the nasa administrator brightest and a couple of weeks ago. The cost of administrator bridenstine. The cost for entry is pretty high for all of the small suppliers. I would just end with, lets try to enable them, make sure were giving them the tools to be successful and be able to defense defend not on the networks but yours as your suppliers as we navigate this challenge, and hopefully look to synergize Lessons Learned and down those those two contract requirements accordingly. Really appreciate your time and good luck with the upcoming launch as well. Thank you. I yield back. Thank you, mr. Garcia. I now for the honorary dinner of our subcommittee who is reliable and with us, mr. Weber, you are recognized for five minutes. If we can get you there you go. A lot of people who wanted to mutiny, but nonetheless. Think of that, chairwoman. I appreciate the opportunity being here. You asked the question of mr. Seaton early about how many attempts, intrusion attempts per month nasa didnt fit last year and about up on that by saying, how does that compare, mr. Seaton, to the intrusion attempts per month this year during covid . Are you make a distinction . Yes. Not that direct comparison and we see fluctuations based on the inside of the insight as a midget is increasing the sometimes that is costs are higher numbers. But we have seen a number an increase in phishing attacks are no attacks at various times throughout the pandemic. It hasnt been steady. Its been fluctuating. Any idea, 10 , 20 , i increase . At one time we saw doubling back of phishing attacks but again there been other weeks what it is been lower. I do think because of the pandemic people looking for the opportunity to attack and will continue to. Theres been a lot of discussion about having personal devices and being at home and those kinds of security firewalls, if you will. If it said it information, i know you said you worked with the fbi and some of the forces or task force, i forget the terminology you use, but if you could get that information to us that would be interesting for us to have because my staff, i want to follow up with your discussion with mr. Garcia. Youll talked about before do that let me go to mr. Martin real quick. Mr. Martin, understanding that this hearing is supposed to be nearly focus on Cyber Threats during covid, since youre here with us i thought it would be appropriate to discuss some of things weve been talking about with china, for example. During this intellectual property threat obvious to the aerospace u. S. Supply chain, youll talked about it with mr. Garcia. Drink this weeks air force association airspace on cyber conference it was revealed on time dod and nasa launch provider proactively identified and cut ties with the supplier that was a Security Risk due to chinese ownership. Were you aware of that, mr. Martin . I was not, congressman. Okay. In comments earlier i would go back to mr. Seaton with his exchange with darcy. He said he could speak to suppliers, or speak for the suppliers was that what you were saying to mr. Garcia . I said that i could not speak to how they were structuring their Business Operations to meet the federal requirements. Shouldnt that be something that were looking at . I dont mean to sound too skeptical, that shouldnt nasa and action all of our u. S. Defense company should be taking a proactive posture to know exactly what safeguards are in place across the supply chain . Totally agree. So how they go doing is what im saying that were not in their Business Operations. Validating that they are complying with requirements is something that we had been doing for years with our supply chain Risk Management efforts, ensuring the things that we buy are free of risk through coordination with the fbi and now making sure that even within their organization they do not have i. T. Equipment provided by prohibited providers. So yes, we are actively involved in ensuring the level of compliance. But you see how they go about it. Youre not essentially involved in, but shouldnt there be some level of protocol for lack of a better term, some threshold, some safeguards they have to meet minimum safeguards and somebody has to be looking over their shoulder in that regard, is that fair to say . Again, compliance with our cybersecurity requirements is critical and that is our responsibility. How their Business Practices is what im saying that were not getting in the middle of. Would you say in this instance where that supply was identified that would be worthwhile to go back and see exactly how that happened, have that supplier got the proverbial camels nose under the tent . I think its in the federal governments best interest to understand where vulnerabilities emanate from come so certainly. Whose responsibility is that . I think it is a shared responsibility. Between who . Between the federal agencies that are responsible for our cybersecurity policy as well as an agency that would be interacting with a specific provider. Is that something you could follow up with our office on an tell us who those agencies are and who has responsibility for the agency . Im talking about addressing this particular instance and how it was discovered and how we got there, and what steps will be taken to prevent similar occurrences. Can you follow up with us on that . We will take that as a question for the record, yes. I appreciate that. Madam chair, i yield back thank you very much, mr. Weber. Appreciate your questions and as always your participation in the subcommittee. I have a few more questions i want to follow up with and will have an opportunity for the numbers to do another round of questions if everyone is available to stay, since we still have time. I want to follow up on a couple of things going back to some of the earlier questions about, one about the unauthorized devices or personal devices, and dented you want to follow up on mr. Weber slanted questions all of it more. Mr. Martin, the august 2020 iq report on unauthorized devices which of course is this year on nasas network sites, cios office saying their score no authoritative way to obtain the number of partner owned i. T. Devices. And i know, mr. Seaton, you make in your not a it anymore but it seems as if theres stopping. Mr. Martin, i am wondering what the risks are not being able to identify and why that may be the case from your perspective in this report. And then what are they doing to address these updating issues . I think we have been a leader and implementing the hss continuous diagnostic program where phase i identifies what was on the