Response of

Red Hat, Inc. (“Red Hat”)

 

to the Inquiry: 

Cyber Security:  Critical National Infrastructure (“Inquiry”)

 

By the Joint Committee on the National Security Strategy (“Committee”)

 

  1. Red Hat appreciates the opportunity to provide comments on the above-referenced matter. We commend the Committee for undertaking its Inquiry on this important matter.  As Committee Chair Dame Beckett (MP) has commented, “[recent] incidents have highlighted the need for improved cyber security and the challenges involved in achieving this objective.  …. Critical national infrastructure must be prepared for these attacks --- the question is how.”

 

  1. Red Hat is a leading provider of open source software solutions, using a community-powered approach to deliver resilient and high-performing cloud, Linux, middleware, storage and virtualization technologies. Red Hat provides high-quality, trusted and affordable technology solutions that are found throughout mission-critical systems in the financial, transportation, telecommunication and government (civilian and defence) sectors in the UK and around the world. Red Hat is recognised as one of the world's most innovative companies.[1]

 

  1. As a leader in catalysing IT modernisation, we observe that it is especially important to recognise that the practice of cybersecurity takes effort, investment, coordination, and persistence. Individuals, businesses, industries, and governments must commit resources and work together to design strong and effective cybersecurity measures.

 

  1. The volume and diversity of cyber threats cannot be understated and underscores the importance of utilising a framework that is voluntary, flexible, and broadly adopted across organisations of all sizes, and stakeholders at all levels, focused on the resiliency of ICT systems.

 

RISK-BASED MANAGEMENT SHOULD

REMAIN THE CORE FOCUS OF THE UK STRATEGY

 

  1. To be able to respond adequately to the fast changing nature of threats and to promote consistency, the implementation of measures must be guided by a clear framework for managing cyber risk.  The importance of having a clear framework is included in the UK’s National Cyber Security strategy as well as a number of UK legal instruments and guidance such as the proposed NIS implementation and the National Cyber Security Centre (NSSC) guidance on risk management.[2]  For further information, we include a recent White Paper on Risk Management which we contributed to as part of the Cybersecurity Coalition.[3]

 

  1. In particular, the White Paper points out that governments should foster the development of appropriate tools for managing cyber risk in the form of a flexible framework. Such a framework should be (1) based on a national strategy; (2) developed with wide stakeholder input through voluntary, open, transparent, and participative processes; (3) flexible and adaptable so that it is both capable of being used across sectors but also of being impactful for specific threat profiles and for individual businesses; and (4) aligned with international, voluntary consensus standards.

 

  1. Second, the paper describes the optimal way for governments to consider use of such a framework to pursue effective cyber risk management in a dynamic threat environment without unduly interfering with further technology innovation.

 

  1. The challenges of mounting a defence against cyberattacks are complex and dynamic. Defence in cyberspace requires integrating a disparate array of people, information sources and technical capabilities to protect assets that can be distributed across many systems and physical locations. Yet careful preparation, a clear strategy, and faithful execution can go a long way.  Nations that invest the time, resources, and effort to develop a national cybersecurity framework are very well likely to reduce the frequency and severity of successful cyberattacks against critical infrastructure, government networks, and private sector assets.

 

 

ENHANCE THE EXISTING UK COMMITMENT

TO VOLUNTARY RISK-BASED MANAGEMENT

 

  1. As the Committee is well aware, the UK Government has been actively engaged in developing a national, voluntary cybersecurity framework for several years. In 2012, multiple entities in the UK Government together released a practical guidance document entitled “10 Steps to Cyber Security.” The steps, while not intended to be exhaustive, nonetheless covered a range of cyber issues, including malware protection, monitoring, secure configuration, and incident management.  Since its first issuance in 2012, the 10 Steps document has been updated several times and is now provided by the Government in a streamlined website and accompanied by a number of related materials designed for specialized advice for particular audiences.[4]

 

  1. For example, there is an accompanying paper entitled “10 Steps: A Board Level Responsibility,” as well as 10 Step technical documents for practitioners and specialists. The materials are provided now by a newly created government entity, the National Cyber Security Centre (“NCSC”), which was launched in October 2016 to replace and consolidate several cyber security functions in the UK Government.

 

  1. In 2014, the Government released a “Cyber Essential Scheme”, which complements the 10 Steps documents that the Government provided as part of its national approach to Cybersecurity.[5]     The Scheme provided a clear statement of the basic controls that all UK organisations were encouraged to implement to mitigate the risk from common Internet based threats, within the context of the 10 Steps. The five technical controls it sets forth to protect against “commodity threats” include access controls, boundary firewalls and Internet gateways, malware protection, patch management, and secure configuration, and were designed to address the vast majority of cyberattacks that use relatively simple methods to exploit basic vulnerabilities.

 

  1. Cyber Essentials is designed to be used alongside an “Assurance Framework” in order to offer a mechanism for organisations to demonstrate to customers, investors, insurers, and others that they have taken these precautions.  The UK’s voluntary framework applied to the private sector has the added benefit of improving the Government’s supply chain. Continued governmental commitment to this program would be well advised.

 

  1. In our view, the UK is among the countries have led the way in preparing its national cybersecurity framework that serve as models for how to develop effective frameworks for widespread adoption.

 

  1. The UK government has taken an approach which is based on both international and European frameworks related to cyber security.  To enhance both the leadership of the UK Government and serve as a concrete step to further its national strategy focused on risk-based management, the government should work with international (US, Canada, et al) and regional partners (via the cooperation group which has been created as part of the NIS Directive) in collaboration with its CNI partners and operators. 

 

  1. In this regard, focus on enhancing sectoral specific implementation and updates of voluntary, risk-based management frameworks -- based on industry sector evaluation of threats and vulnerabilities -- is warranted.  

 

  1. One approach would be for the UK Government and its CNI owners and operators to collaborate more directly with the appropriate sectors identified in other government efforts to build frameworks.  In 2013, U.S. Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which direct the U.S. Federal Government to coordinate with critical infrastructure owners and operators to improve information sharing and collaboratively develop and implement risk-based approaches to cybersecurity, the U.S. Government identified 16 ‘critical infrastructure sectors’ as a basis for this work.[6]

 

  1. Such a step would be consistent with the international nature of cyber threats and vulnerabilities, as well as responses. 

 

  1. It is also consistent with the fact that the UK government should look at cybersecurity and physical security as a means to an end—the safe and continuous operation of the critical functions we rely on. In order to achieve that end, we -- the wide ranging community of public and private sector actors involved in managing risks to critical infrastructure -- must build resilience into these systems and assets.

EFFECTIVE CYBERSECURITY REQUIRES

IT MODERNISATION, ESPECIALLY IN GOVERNMENTS

 

  1. The Committee’s Inquiry would be remiss if it did not recognise that effective cybersecurity and implementation of the UK’s cyber framework go hand-in-hand with encouraging IT modernisation, especially in government.

 

  1. It is essential that the UK Government continue to work to meet the objectives of other critical modernisation initiatives – for instance, by automating their manual processes, implementing new and diverse testing and scanning options, deploying patches both responsively and preventatively, and by stepping up the move away from legacy systems and unsupported software.

 

  1. In this regard, open source technology and open standards drive IT modernisation and should continue to be considered alongside proprietary solutions and be the default for use in UK government modernisation efforts.  One of the benefits of road-tested, commercially-supported open source is that it is commercial-off-the-shelf (COTS). It can be supported by a variety of vendors and offers an agile, reusable, modular approach to departments and executive agencies.

 

  1. IDC research finds that the vast majority of enterprises utilise open source software in a variety of ways, including for mission-critical enterprise initiatives. Specifically, many common components of enterprise IT systems, including network infrastructure, big data storage, cloud platforms and management tools, firewalls, mobile devices and desk phones (to name just a few) are open source software in commercial products and services.

 

  1. Similarly, the Committee should take note that departments and executive agencies moving parts of their workload into cloud computing should have a “cloud exit strategy” as a key component of IT modernisation. Avoiding the pitfalls of cloud lock-in will ensure that efforts to enable the next generation of government IT do not ultimately lead to a future problem of lock-in to ‘legacy clouds’ that prove more expensive for the taxpayer or less effective and potentially more vulnerable than available alternatives.

 

 

ENHANCE SKILL AND EXPERTISE

AVAILABILITY TO CNI OPERATORS AND GOVERNMENT

 

  1. As the Committee is well aware, there is a shortage of skilled cybersecurity professionals.  A robust initiative for education of future generations of experts in the field must continue to be a priority.

 

  1. It is important to note that it is not just three or four year course university graduates in Software Engineering or Computer Science who are needed.  A deeper strategy that focuses on those graduates coming out of Further Education can provide vital capabilities to support UK private and public organisations.  It is also essential that the key role of risk-based management in cybersecurity be incorporated into a wide range of relevant professional certifications, including diplomas, certificates, degrees and business management courses.

 

  1. The skills that Higher and Further Education institutions are teaching must not, however, be restricted to pure technical skills. Hiring institutions have noted for years that they need to be able to hire employees who are steeped in collaborative decision making and experienced in working on team projects. These are skills that can be taught and developed in the context of coursework, if properly refocused. Beyond these soft-type skills, encouragement of systems-type thinking and investigative skills are important to satisfy the needs of various different roles and disciplines.

 

  1. The growth in use of open source software and the rise of organisational involvement in large-scale consortia also highlights the benefits of a wide set of skills – both technical and soft. In order for UK organisations – public and private – to be able to influence the development of the open source software that they use, they need employees with experience in open source communities and projects. This experience is another area which Higher and Further Education institutions can develop.

 

  1. It is encouraging to see primary and secondary curriculum development around skills that will support cybersecurity professionals in the future, and the development of government policy for Further and Higher Education. We applaud these moves and encourage further targeted work through all stages of education.

 

  1. Corporations and non-governmental organisations also play an important role in developing digital skills and continued learning across industrial verticals in particular countries and regions. Indeed, Red Hat offers a range of globally recognised training and certification[7] as well as support services and hands-on innovation labs - the most recent of which opened in London in May 2017.[8]

 

 

AVOID USE OF GOVERNMENT-MANDATED

TECHNICAL STANDARDS

 

  1. The process of developing a national cybersecurity framework should be geared toward public-private collaboration to ensure broad-based input and stakeholder buy-in. In particular, the government should view its role as both a coordinator and a stakeholder, as well as in some cases, an author of the framework. Ideally, the department, agency or coalition that is leading the process of developing a framework should convene workshops with stakeholders for soliciting ideas and for educating about the elements of the framework that are being considered. The process of drafting the framework should be iterative, allowing for evolution of the framework’s substance and methodology and inclusion of new techniques and technologies as they develop and become available.

 

  1. A successful cybersecurity framework is one that provides a clear path for developing industry-specific profiles that drive member organisations to adopt and implement cybersecurity risk management programs and practices that are optimised for the set of issues that are unique to the industry.  In addition to developing industry profiles, stakeholders and can adopters also use a cybersecurity framework to develop specific threat profiles that can be applied by individual organisations that have identified the threat as a unique concern. In both cases—industry and threat profiles—the elements are drawn from the framework and given more contour and detail for customisation to the target state.

 

  1. The corollary is that governments should avoid mandating technical standards which are not developed in an open, transparent and industry-driven process, such as through established Standard Development Organisations (ISO/IEC,CEN/CENELEC/ETSI etc) or fora/consortia (OASIS, W3C, IETF etc). Indeed, this is an approach which is reflected in the UK’s open standards principles.[9]

 

  1. Previous attempts in this regard have fallen flat.[10]  Moreover, such attempts are likely to reduce the level of resiliency and trustworthiness of products, services and networks, making it easier for bad actors to penetrate and disrupt.[11]

 

  1. Red Hat looks forward to providing additional information both in writing and/or witness statements as the Committee sees fit.

                           

 

 

[1] See Forbes, “The World’s Most Innovative Companies”, 2017, found at: https://www.forbes.com/companies/red-hat/.

 

[2] See UK’s NCSC risk management guidance collection: https://www.ncsc.gov.uk/guidance/risk-management-collection

[3] See Coalition for Cybersecurity Policy & Law, a/ka/ The Cybersecurity Coaltion (“Coaltiion)”, “Building a National Cybersecurity Strategy: Voluntary, Flexible Frameworks”, 2017, found at:  https://www.cybersecuritycoalition.org/cybernextdc2017-whitepaper.

[4] See National Cyber Security Centre, 10 Steps to Cyber Security (2016), https://www.ncsc.gov.uk/guidance/10-steps-cyber-security.

[5] See HM GOVERNMENT, CYBER ESSENTIALS SCHEME SUMMARY (2014), https://www.cyberaware.gov.uk/cyberessentials/files/scheme-summary.pdf.

[6] U.S. Department of Homeland Security, NIPP 2013: Partnering for Critical Infrastructure Security and Resilience, 2013, found at: https://www.dhs.gov/sites/default/files/publications/NIPP%202013_Partnering%20for%20Critical%20Infrastructure%20Security%20and%20Resilience_508_0.pdf.

[7] https://www.redhat.com/en/services/training

[8] https://www.redhat.com/en/engage/open-innovation-labs-20170905?sc_cid=7016000000126T9AAI

[9] https://www.gov.uk/government/publications/open-standards-principles/open-standards-principles

[10] “The US government bids adieu to Clipper Chip”, found at:  https://opensource.com/government/15/2/us-government-retires-clipper-chip, 04 Feb 2015.

[11] “Encryption back doors: Is there more to this debate?”, found at:  https://opensource.com/government/15/9/encryption-back-doors-debate, 25 Sept 2015.