SELECT COMMITTEE ON CYBER
SECURITY IS CALLED TO ORDER
WELCOME TO THIS INFORMATIONAL
HEARING OF THE ASSEMBLY SELECT
COMMITTEE ON CYBER SECURITY
WHETHER YOU ARE HERE IN PERSON
WATCHING VIRTUALLY OR ON THE
PHONE LINES- WE ARE VERY HAPPY
TO HAVE YOU JOIN US HERE TODAY
THIS IS OUR FIRST HEARING OF
THE TWENTY TWENTY ONE
LEGISLATIVE SESSION AND I'M
EXCITED TO GET BACK TO THE
IMPORTANT WORK ON SECURING
CALIFORNIA'S NETWORKS AND
CONNECTED CRITICAL
INFRASTRUCTURE. BEFORE WE BEGIN
TO HEAR FROM OUR THREE PANELS I
WILL GO OVER SOME OF THE KEY
ELEMENTS OF THE STRUCTURE OF
TODAY'S HEARING WE HAVE A
STRICT MASK MANDATE FOR THOSE
ATTENDING IN PERSON TODAY- HERE
IN THE CAPITAL WELL ALL OF OUR
PANELISTS WILL TO BE JOINING US
THROUGH VIDEO CONFERENCING
SOFTWARE THERE WILL BE A FEW
DIFFERENT OPTIONS FOR PUBLIC
TESTIMONY TODAY AT THE END OF
THE HEARING IF ANY MEMBER OF
THE PUBLIC IN HE ROOM WOULD
LIKE TO PROVIDE PUBLIC COMMENT
PLEASE RAISE YOUR HAND. WHEN I
CALL FOR PUBLIC COMMENT AND I
WILL ASK YOU TO APPROACH THE
MICROPHONE AT THE APPROPRIATE
TIME IN ADDITION TO BEING ABLE
TO TESTIFY FROM INSIDE THE
HEARING ROOM WILL WE WILL ALSO
BE USING AN AT&T MODERATED
TELEPHONE SERVICE THROUGH WHICH
ANY WITNESS CAN PROVIDE PUBLIC
COMMENT THERE MAY BE A SLIGHT
DELAY SO AGAIN I SK THAT ALL
INVOLVED TO REMAIN PATIENT
THERE IS ALSO A REMOTE
TESTIMONY STATION AVAILABLE ON
THE NORTH STEPS OF THE CAPITOL.
THE PUBLIC TOLL FREE CALL IN
NUMBER FOR THIS HEARING IS.
1-877-692-8957 AND THE ACCESS
CODE IS. ONE THREE ONE FIVE
FOUR TWO OH TWO YOU CAN ALSO
FIND THIS NUMBER ON THE
ASSEMBLY WEBSITE ASSEMBLY DOT
CA DOT GOV AS WELL AS ON YOUR
TV OR MONITOR SCREEN. IF YOU'RE
CALLING AND PLEASE PLAN TO DO
SO AS WE BEGIN THE COMMITTEE
MEMBER COMMENTS AT THE END OF
THE LAST PANEL THE OPERATOR ON
THE LINE WILL GIVE YOU
INSTRUCTIONS ABOUT HOW TO BE
PLACED IN THE QUEUE PLEASE NOTE
THAT WE ARE ACCEPTING. WRITTEN
PUBLIC COMMENT AND YOU CAN
CONTACT MY CAPITOL OFFICE AT
NINE ONE SIX THREE ONE NINE TWO
OH FOUR FOUR. TO GET THE
APPROPRIATE EMAIL ADDRESS.
THANK YOU FOR YOUR PATIENCE
AND- PARTICIPATION. AND NOW
ONTO TODAY'S HEARING STATE
COORDINATION AND CRITICAL
INFRASTRUCTURE PROTECTION LOCAL
GOVERNMENT AND UTILITIES
CRITICAL INFRASTRUCTURE CONTROL
SYSTEMS. THIS TOPIC IS NOT A
NEW ONE AS A COMMITTEE FIRST
BEGAN DISCUSSIONS ON CRITICAL
INFRASTRUCTURE IN TWENTY
FIFTEEN WITH THE HEARING WHERE
WE HEARD FROM BOTH GOVERNMENT
AND INDUSTRY EXPERTS. WITH
STORIES OF A SUCCESSFUL ATTACKS
ON CRITICAL INFRASTRUCTURE
BECOMING MORE AND MORE FREQUENT
AND DESTRUCTIVE ACROSS THE
UNITED STATES. AND ESPECIALLY
IN CALIFORNIA. THE NEED FOR THE
LEGISLATURE TO RECEIVE AN
UPDATED ASSESSMENT HAS BECOME
APPARENT. MY HOPE IS THAT THIS
HEARING WILL PROVIDE THE
COMMITTEE WITH A BETTER
UNDERSTANDING OF THE RISKS
POSED TO OUR LOCAL GOVERNMENTS
AND UTILITIES. WHAT IS ALREADY
BEING DONE TO PROTECT THESE
CRITICAL INFRASTRUCTURE SYSTEMS
AND HOW THE STATE IS-
SUPPORTING THESE ENTITIES.
CALIFORNIA'S RAPID RECOVERY HE
IS PRECARIOUSLY BUILT UPON A
VIBRANT AND FUNCTIONING CIVIC
INFRASTRUCTURE OF ELECTORS
ELECTRICITY GAS AND WATER. THE
LEGISLATURE NEEDS TO BE READY
TO FILL GAPS WHERE THEY MAY
EXIST PROVIDE SUPPORT. WHERE
THERE IS NOT ENOUGH AND REMOVE
BARRIERS TO COORDINATION WHERE
THEY DO NOT EXIST THE PAELISTS
TODAY. ARE FROM ACROSS THE
STATE AND AROUND THE COUNTRY TO
PROVIDE US WITH THE KNOWLEDGE
TO DO JUST THAT. AND I AM VERY
EXCITED TO GET RIGHT TO THEIR
TESTIMONY. SO FOR OUR FIRST
PANEL WE HAVE TO READ THE
LANDSCAPE FOR LOCAL GOVERNMENTS
AND UTILITIES. WE HAVE JOINING
US TODAY. VERY IMPRESSIVE A
GROUP OF FOLKS RANDY ROSE A
SENIOR DIRECTOR AT THE CYBER
THREAT INTELLIGENCE FROM THE
MULTI STATE ISAC WHICH IS THE
INFORMATION SHARING AND
ANALYSIS CENTER. MANY CANCEL AS
SENIOR VICE PRESIDENT NORTH
AMERICAN ELECTRIC RELIABILITY
CORPORATION AND ALSO WITH THE
C. E. O. OF THE ELECTRICITY
ISAC. RYAN COBRAR A
DISTINGUISHED SECURITY
STRATEGIST FROM SPLUNK. AND RON
BUSHER THE SENIOR VICE
PRESIDENT AND GOVERNMENT CTO AT
FIRESIDE THANK YOU FOR JOINING
US GENTLEMEN WE WILL LISTEN TO
YOUR PRAMERICA PREPARED REMARKS
AND- AND WE WILL FOLLOW WITH A
FEW QUESTIONS IF THERE'S TIME
SO WHY DON'T WE START WITH.
RANDY. SURE MARYLAND- EVERY THE
COMMITTEE THANK YOU FOR
INVITING ME HERE TODAY- TO THIS
HEARING MY NAME IS RANDY ROSE-
AND I SERVE AS THE SENIOR
DIRECTOR OF CYBER THREAT
INTELLIGENCE THE NONPROFIT
CENTER FOR INTERNET SECURITY
INK OR CIS- I PERSONALLY
DIRECTLY SUPPORT THE MULTI
STATE ISAC INFORMATION SHARING
AND ANALYSIS CENTER THE MS ISAC
DIVISION OF CIS WHICH SERVES AS
THE FOCAL POINT FOR CYBER
THREAT PREVENTION PROTECTION
AND RESPONSE FOR THE NATION'S
SLT TWO GOVERNMENTS THAT STATE
LOCAL TRIBAL AND TERRITORIAL
GOVERNMENTS. I SPEND MOST MY
CAREER IN THAT- TO THE
GOVERNMENT STATE FEDERAL LEVELS
AND FIFTY YEARS OF THE
DEPARTMENT DEPENDS I HAVE SOME
EXPENSIVE EXPERIENCE WITH LOCAL
GOVERNMENTS UTILITIES UP TO
WORK WITH THE NEW YORK STATE
COMPTROLLER'S OFFICE. HELPED
DEVELOP THE FIRST CYBER
SECURITY. AUDIT AND ASSESSMENT
PROGRAM FOR MUNICIPAL OPERATE
UTILITIES. I REALLY APPRECIATE
THE TIME TO OUT TO SPEAK WITH
YOUR TODAY HOW QUICKLY-
INTRODUCED BY ORGANIZATIONS
YEAH YES AND THEN- TALK ABOUT
THE THREATS FACING LOCAL
GOVERNMENTS AND UTILITIES THAT
WE SEE. FROM OUR PERSPECTIVE
AND RESPECTFULLY MAKE FOUR
RECOMMENDATIONS. YEAH YES WAS.
IN TWO THOUSAND AS A
INDEPENDENT NOT FOR PROFIT
ORGANIZATION. WITH THE MISSION
TO ADVANCE CYBERSECURITY
READINESS AND RESPONSE. WE
PROVIDE CYBER EXPERTISE IN IN
THREE MAIN AREAS THE FIRST IS
THE CIS BENCHMARKS. THE
BENCHMARKS PROVIDE HIGHLY
DETAILED SECURITY SETTING
RECOMMENDATIONS FOR HARDENED
IMAGES ACROSS A LARGE NUMBER.
OF COMMERCIAL I. T. PRODUCTS
SUCH AS OPERATING SYSTEMS
NETWORK DEVICES. THE SECOND IS
THAT CRITICAL SECURITY CONTROLS
THOSE ARE THE SORT OF
INTERNATIONALLY RECOGNIZED
EXPERT DEVELOP PRIORITIZE
ACTIONS THAT REALLY FORM THE
FOUNDATION OF BASIC CYBER
HYGIENE AND HELP BUILD
DEFENDABLE NETWORKS. THOSE ARE
AVAILABLE FOR FREE TO THE
PUBLIC AND THEY HAVE BEEN
IMPLEMENTED BY A NUMBER OF THE
GOVERNMENT AND PRIVATE SECTOR
ORGANIZATIONS AROUND THE WORLD
INCLUDING CALIFORNIA. AND A TWO
THOUSAND SIXTEEN CALIFORNIA'S
DATA BREACH REPORT PUBLISHED BY
THEN ATTORNEY GENERAL KAMALA
HARRIS. WHICH WARNS THAT
FAILING TO IMPLEMENT RELEVANT
CONTROLS IN CALIFORNIA QUOTE
CONSTITUTES A LACK OF
REASONABLE SECURITY. THAT
REPORT ACTIVELY CONSTITUTES THE
WORLD'S FIRST MINIMUM LEVEL OF
INFORMATION SECURITY ENTRY CAN
BE APPLIED TO CRITICAL
INFRASTRUCTURE TODAY. AND WE
ALSO RUN TO ICE AXE THE MULTI
STATE ISAC WHICH WE MENTIONED
AND MORE RECENTLY THE ELECTIONS
INFRASTRUCTURE I SAT. ABOUT THE
STATE ISAC IS ACTUALLY THE
LARGEST ICE PACK IN THE WORLD
WITH MEMBERS ACROSS ALL FIFTY
SIX STATES AND TERRITORIES AND
MORE THAN ELEVEN THOUSAND OTHER
LTT GOVERNMENT ENTITIES IN THE
U. S. INCLUDING CITIES
COUNTIES. SCHOOLS PUBLIC
HOSPITALS. PUBLIC SAFETY
ORGANIZATIONS AND. MUNICIPAL
RUN IN PUBLIC ON UTILITIES. WE
RUN A TWENTY FOUR BY SEVEN TWO
OPERATIONS CENTER. AND THAT
PROVIDE THE NUMBER OF SERVICES
INCLUDING CHARACTER
SECURITY MONITORING. AND
INCIDENT RESPONSE SUPPORT ALL
AT NO COST TO SLT TEAM MEMBERS.
AND THEN SINCE TWO THOUSAND
EIGHTEEN WE HAVE ALSO DONE THE
SAME FOR ELECTIONS- THE- THE
STATE'S I'M SORRY THE COUNTRY
ELECTIONS COMMITTEE. AND THAT
ORGANIZATION IS NOW IDEA
ASPECTS NOT THREE THOUSAND
MEMBERS. INCLUDING ALL FIFTY
STATES. SO ON THE SCOPE OF
CYBER THREATS YOU HAVE TAX ON
ON CRITICAL INFRASTRUCTURE HAD
BEEN MUCH LESS COMMON
HISTORICALLY. BEEN ATTACKS ON
STANDARD BUSINESS NETWORKS IS
DIFFICULT WITH THE DATA THAT WE
HAVE AT THE END OF SIZE ACTED
CONFIDENTLY STATE. THAT THERE
IS AN INCREASE IN THE NUMBER OF
TARGETED ATTACKS. BUT
NONETHELESS A RECENT EXAMPLES
HAVE BECOME MAJOR NEWS STORIES
TO THEIR WIDESPREAD IMPACT.
INTO MOST OBVIOUS EXAMPLES ARE
THE COLONIAL PIPELINE IN JBS
FOODS NEITHER OF WHICH ARE
THOUGHT HE T. RUN BUT THE THIRD
SECOND THIRD ORDER EFFECTS OF
THOSE. I DID IMPACTOF. STATE
LOCAL TRIBAL TERRITORIAL
GOVERNMENTS. GOOD NEWS IS THAT
YOU. FOR TO OR SOME. ENOUGH TO
ADD. IMPACT THE OPERATE TECH
ITSELF. THE BAD NEWS IS THAT
THEY DON'T HAVE TO TARGET THAT
TECHNOLOGY ITSELF- TO HAVE A
SIGNIFICANT IMPACT CAN
POTENTIALLY COMPROMISE THE
INTEGRITY OF THE INDUSTRIAL
ENVIRONMENT. AND THERE ARE
CERTAINLY CASES WHERE THE
OPERATIONAL TECHNOLOGY IS THE
TARGET OF AN ATTACK SUCH AS
WHAT HAPPENED IN OLD BALTIMORE
FLORIDA. IN FEBRUARY THIS YEAR
WHEN THE PACKER TEMPTED TO
POISON THE WATER SUPPLY. AND
WHILE IT'S CERTAINLY
FRIGHTENING AND THEN WE SHOULD
BE CONCERNED ABOUT THAT. MOST
OF THE INSTANCES OF ATTACKS ON
CRITICAL INFRASTRUCTURE NOT
THIS WAY FOR. IN BOTH THE
COLONIAL PIPELINE IN JBS FOODS
ATTACKS. AS WELL AS A TACK ON
HONDA IN TWENTY TWENTY. NORSK
HYDRO TWENTY NINETEEN THE
SYSTEMS AFFECTED WERE NOT
CONTROL SYSTEMS BUT STANDARD
BUSINESS SYSTEMS ARE SYSTEMS
USUALLY BUSINESS OPERATIONS.
LIKEWISE ALL THESE ATTACKS WERE
CONDUCTED BY CRIMINAL ACTORS.
LOOKING FOR A BIG PAYDAY. ALL
FOUR OF THOSE ATTACKS INVOLVED
RANSOMWARE WHICH IS ARGUABLY
THE FASTEST GROWING TRUCK
ACROSS ALL SECTORS TODAY AND
CERTAINLY WHAT WE SEE THE MOST
OF AT THE NSIC. MY CURRENT SELF
ESTEEM ALONG WITH DHS'S
INTELLIGENCE ANALYSIS RECENTLY
COMPLETED A JOINT ASSESSMENT
IRAN'S MORE TRENDS. BASED ON
GLOBAL CONDITIONS AND WHAT WERE
THE DATA THAT WE'RE COLLECTING.
FOR THE FOLLOWING STATEMENT WE
ASSESS THAT RANSOMWARE ATTACKS
TARGETING US NETWORKS. ARE
LIKELY TO INCREASE IN THE NEAR
AND LONG TERM. BECAUSE CYBER
CRIMINALS HAVE DEVELOPED
EFFECTIVE BUSINESS MODELS.
INCREASE THEIR FINANCIAL GAIN.
LIKELY HAD PROPER RACIAL
SUCCESS. AND ANONYMITY. ANOTHER
NUMBER OF FACTORS AT PLAY IN
HERE. ACCORDING LARGELY
UNREGULATED CRYPTOCURRENCY
MARKET AND ESPECIALLY THE
WILLINGNESS OF VICTIMS TO PAY
RANSOMS. DESPITE SOME GROUPS
CLAIMING THEY WILL NOT TARGET
CRITICAL INFRASTRUCTURE
NETWORKS CONTINUE TO BE
ATTRACTIVE TARGETS WE SHOULD BE
OF GREAT CONCERN TO THOSE
DEFENDING SLT P. OWNED AND
OPERATED CRITICAL
INFRASTRUCTURE. FOR A FEW
REASONS THE FIRST. IS THAT YOUR
AIR GAPPING A CRITICAL
INFRASTRUCTURE IS NO LONGER
PRACTICAL. FOR A SECOND THAT
RANSOMWARE ON THESE NETWORKS
WILL DENY ACCESS TO SYSTEMS
THAT COULD BE ESSENTIAL AND
MONITORING ADMINISTERING AND
CONTROLLING. OR AT LEAST
TRANSLATING BETWEEN STANDARD
TECHNOLOGY AND OPERATIONAL
TECHNOLOGY. CRITICALITY THE
SYSTEM'S PUTS PRESSURE ON CHECK
DOWNS TO PAY THE RANSOM GENDER
PAY THEM QUICKLY AND DUE TO THE
EVOLUTION OF THE RANSOMWARE
BUSINESS MODEL. HANG AROUND
SOME DOES NOT NECESSARILY
CONSTITUTE APRIL DEPARTURE OF
CRIMINAL ACTORS FROM THE VICTIM
ENVIRONMENT WITH REGARD TO
CRITICAL INFRASTRUCTURES
SPECIFICALLY IN RANSOMWARE WE
EXPECT TO SEE MORE TARGETING OF
THE TOP CRITICAL NETWORKS AND
OPERATIONAL TECHNOLOGY AS A
GOAL BECAUSE THE GOAL OF THESE
ACTORS IS A QUICK PAYDAY. IF
YOU ORGANIZATIONS HAVE THE
UPTIME REQUIREMENTS. FOR THOSE
WHO OPERATE CRITICAL
INFRASTRUCTURE. WE'RE THINKING
BEYOND RANSOMWARE THERE ARE
NATION STATE ACTORS AND OTHER
CRIMINAL ACTORS WHO HAVE
SPECIFIC INTERESTING CRITICAL
INFRASTRUCTURE. IN OPERATIONAL
TECHNOLOGY FOR A VARIETY OF
REASONS THAT CAN INCLUDE
ESPIONAGE DESTRUCTION. AWAY AND
EVEN INFLUENCE OPERATIONS. BUT
NO MATTER THE REASON IT'S
IMPORTANT FOR US TO RECOGNIZE
THAT MALICIOUS CYBER ACTORS
WILL INCREASINGLY TARGET
NETWORKS THAT. ARE SPECIFIC
INTEREST TO US GOVERNMENT
ENTITIES AT THE FEDERAL STATE
AND LOCAL LEVEL ESPECIALLY
THOSE NETWORKS DEEMED AS
CRITICAL INFRASTRUCTURE. THAT
ALLOWS ME TO GAIN AN ECONOMIC
OR FINANCIAL POLITICAL SOCIAL
OR EVEN MILITARY ADVANTAGE.
BECAUSE CRITICAL INFRASTRUCTURE
IS BECOMING INCREASINGLY
CONNECTED TO THE INTERNET OR
RELIANT UPON INTERNET CONNECTED
DEVICES- WE SHOULD EXPECT TO
SEE AN INCREASE IN SUCCESSFUL
TAX AND WITH THAT. I WOULD LIKE
TO RECOMMEND FOR- GET RIGHT FOR
RECORD. IMPORTANT TO YOUR LIFE
AND I SUBSTATIONS
RECOMMENDATIONS TO THE STATE
THAT NEARLY A QUARTER OF ALL
NON DEFENSE CRITICAL
INFRASTRUCTURE IN THE U. S. IS
OWNED AND OPERATED BY SLT PIECE.
SO THERE'S WORK THAT NEEDS TO
BE DONE HERE AND THE FOLLOWING
RECOMMENDATIONS ARE DESIGNED TO
BE IMPLEMENTED. WITH NO
ADDITIONAL COSTS USING THE
PEOPLE CAPABILITIES ALREADY
AVAILABLE. THE FIRST IS FOR
CALIFORNIA TO RECOMMEND THAT
ALL S. O. T. T. IS WITHIN THE
STATE. R. L. A. SHE TO LD HE'S
IN THE STATE- ESPECIALLY THOSE
THAT OWN AND OPERATE CRITICAL
INFRASTRUCTURE JOINING MS ISAC.
IT'S NO COST. MEMBERSHIP IS
ENTIRELY FREE AND MEMBERS GAIN
ACCESS TO A PLETHORA OF
BENEFITS INCLUDING THAT AROUND
THE CLOCK MONITORING SERVICE I
MENTIONED. GEORGIANS ARE
SPONSOR PORT. AND A NUMBER. OF
PREVENTIVE SERVICES THAT WE
PROVIDE. BUT SEE I HAVE CONTROL
IN ALL. OF THAT WORKS. BUYER TO
CRITICAL NEED FOR. OUR ANALYSIS
SHOWS THAT AND THE CAN. HELLO
WITH NO OTHER ACTIONS MITIGATES
APPROXIMATELY 83% OF ALL
TARGETED. ATTACK TECHNIQUES
FOUND IN INDUSTRY STANDARD
MITRE ATTACK FRAMEWORK. THE
THIRD IS TO DEPLOY HARDENED
IMAGES SUCH AS THE SEA ICE
BENCHMARKS ALTHOUGH THERE ARE
OTHER OPTIONS AND ALL
APPLICABLE SYSTEMS THE REASON
FOR THIS IS THAT IMPLEMENTING
BENCHMARK SYSTEMS ARE HARDENED
SYSTEMS ENSURES THAT SECURITY
IS BAKED INTO THE DEPLOYMENT OF
THOSE SYSTEMS. AND NOT TACKED
ON AS AN AFTERTHOUGHT. AND
FINALLY WE RECOMMEND THE SLT
TEAMS CONDUCT REGULAR AUDITS OF
OPERATIONAL TECHNOLOGY CAN
CONTROL SYSTEMS. TO ENSURE THAT
CONTROLS THAT ARE PUT IN PLACE
ARE NOT BEING BY PASSED. AND
THAT SYSTEM USAGE IS IN LINE
WITH EXPECTATIONS. SHARES FROM
EXISTING STATE LOCAL AGENCIES
CAN BE TRAINED IN WHAT NORMAL
LOOKS LIKE ON THE SYSTEMS. AND
THEY CAN QUICKLY FIND
DEVIATIONS FROM THE NORM. WITH
US FOR RECOMMENDATIONS I WOULD
LIKE TO THANK THE COMMITTEE AND
CALIFORNIA STATE ASSEMBLY FOR
LYING YEAH YES THEY OPPORTUNITY
TO TEST BY TODAY. AFTER
CONSIDERING OUR RECOMMENDATIONS
WERE SECURING CRITICAL
INFRASTRUCTURE. THANK YOU THANK
YOU VERY MUCH MR ROSE AND NEXT
WE HAVE- MANDY COUNCIL UP.
MORNING EVERYBODY AND- THANK
YOU FOR THE OPPORTUNITY TO- TO
TESTIFY THIS MORNING ON THIS
VERY IMPORTANT SUPPORT THE
TOPIC AND ARE SIMILAR TO MR
ROSE WILL GIVE YOU A LITTLE BIT
OF BACKGROUND ON THE ICE
BACKGROUND CHECKS OUT WHAT
WE'RE SEEING IN THE ELECTRICITY
SECTOR. AND ALSO PROVIDE SOME
RECOMMENDATIONS AS WELL- SO FOR
THOSE OF YOU THAT MAY NOT BE
FAMILIAR WITH THE E. ISAC- THE
ELECTRICITY INFORMATION SHARING
AND ANALYSIS CENTER- IT WAS
ESTABLISHED IN NINETEEN NINETY
NINE- WE ARE ESSENTIALLY AN
INFORMATION CLEARINGHOUSE
SECURITY CLEARINGHOUSE FOR-
CORRECT INFORMATION. AND
INTELLIGENCE TO THE ELECTRICITY
SECTOR ALL ACROSS THE UNITED
STATES AND CANADA- WE HAVE
APPROXIMATELY TWELVE HUNDRED
DONE ALMOST THIRTEEN HUNDRED
MEMBERS THAT ARE PART OF THE I.
SHAC. AND THAT REPRESENTS ABOUT
85% OF THE ELECTRICITY
INFRASTRUCTURE AND CUSTOMERS IN
THE UNITED STATES HERE. ALL
YOU. REALLY ARE FOCUSED ON
BEING A CLEARING HOUSE YOU KNOW
SO WHILE WE ARE FOCUSED ON
PROVIDING TIMELY AND ACTIONABLE
INFORMATION TO THE SECTOR SO WE
CAN MAINTAIN SITUATIONAL
AWARENESS- WE ALSO PROVIDE
CURATED ANALYSIS ON BOTH
PHYSICAL AND CYBER SECURITY
THREATS- AND WORK WITH OUR
STAKEHOLDERS AS WELL. I'M TO
MAKE SURE THAT WE'RE PROVIDING
VALUE IN THOSE AREAS. THE OTHER
THING THAT WE DO IS WE ACT AS A
CONDUIT TO THE FEDERAL
pSPECIFIC AGENCY THE DEPARTMENT
OF ENERGY. BUT ALSO WORK VERY
CLOSELY WITH THE DEPARTMENT OF
HOMELAND SECURITY AND OTHER ON
A CRITICAL GOVERNMENT AGENCIES
TO HELP ADVANCE THEIR PROGRAMS-
ELECTRICITY SECTOR AS WELL. AND
SO THAT IS A BIG PART OF WHAT
WE DO. ALL WE ARE HEADQUARTERED
IN WASHINGTON DC WE HAVE
RESOURCES ACROSS THE UNITED
STATES THAT. PROVIDE OUR
SERVICES AND SIMILAR TO THE
OTHER SIDE SACK AND I SHOULD
SAY WE ACTUALLY WORK VERY
CLOSELY WITH THE MS ISACAND-
VERY HAPPY- WITH THE
RELATIONSHIP A COLLABORATIVE
RELATIONSHIP THAT WE HAVE WITH
THEM- WE OPERATED TWENTY FOUR
BY SEVEN SECURITY OPERATIONS
CENTER- THAT. PUSHES. OUT
INFORMATION ON A DAILY BASIS.
SO I'LL- TO WHAT WERE SEEING A
THE STAR AND LIKE- ALL CRITICAL
INFRASTRUCTURES. SECTORS AND IS
MISTER ROSE POINTED OUT- THIS
IS CLEARLY AN UNPRECEDENTED
PERIOD YOU KNOW THE VOLUME
VELOCITY AND COMPLEXITY. OF THE
THREAT THAT WE'RE SEEING ARE
UNPRECEDENTED- AND IF YOU YOU
KNOW GO BACK TO SOME SOURCES SO
THE- THE DIRECTOR OF NATIONAL
INTELLIGENCE- WORLDWIDE THREAT
ASSESSMENT. AGAIN HAS
CONFIRMED. AND STATED THAT OUR
SOPHISTICATED NATION STATE
ADVERSARIES ABSOLUTELY HAVE THE
CAPABILITY TO DISRUPT CRITICAL
INFRASTRUCTURE. ALSO THAT'S
SOMETHING THAT WE NEED TO
MONITOR FOR AND ALSO THAT
ORGANIZED CRIME WILL CONTINUE
TO TRY TO TAKE ADVANTAGE OF US
RIGHT AND DISRUPT. BOB PUT
THEIR OWN MONETARY GAINS- AND-
ACTUALLY THESE TAXES WHILE- AND
TO THE POINT OF- VELOCITY AND
VOLUME. YOU KNOW MICROSOFT IN
THEIR ANNUAL- THREAT- BOULDER
ABILITY REPORT. CITED A 48%
INCREASE IN VULNERABILITIES
FROM TWENTY NINETEEN. TO TWENTY
TWENTY- SO THAT IS A STEP
CHANGE IN TERMS OF THE AMOUNT
OF- BALL THE BILL THESE THAT
COMPANIES NEED TO DEAL WITH-
AND WHETHER IT'S UTILITY OR ANY
OTHER CRITICAL INFRASTRUCTURE
SECTOR- BUT IT'S- YOU KNOW.
THAT ALSO GET SAMPLE FIVE WHEN
YOU THINK ABOUT OTHER SOFTWARE
PROVIDERS AND OTHER- QUICKENING
PROVIDERS RIGHT AND SO CLEARLY
THE NUMBER AND THE PACEOF THE
VULNERABILITIES- REALLY IS WE
ARE CONTINUING TO THE CLIPS YOU
KNOW ANY PRIOR- PATTERNS THAT
WE'VE HAD BEFORE- CERTAINLY WE
SEEN ENOUGH. INCREASE IN RATES.
AND SORTS USE THIS IN THE TO-
SO THE ATTACK ON CALL- AS WE AS
J. ASPECT THERE ARE BEEN RAN.
ATTACKS IN THE SECTOR IS- AGAIN
SO WITH END WE ARE ABSOLUTE
SENIOR INCREASE- IN IN THAT
ACTIVITY. I'M GOING FORWARD THE
SUPPLY CHAIN ATTACKS YOU KNOW
STARTING WITH THE SOLE WINDSOR
COMPROMISE IN DECEMBER- AND
THEN CONTINUING TO OTHER YOU
KNOW ENTERPRISE CLASS SUPPLY
CHAIN ATTACKS SUCH AS THE
MICROSOFT EXCHANGE SERVER TAX.
HEALTH CONNECTS WITH YOUR AND
EVEN MORE RECENTLY LAST WEEK TO
SAY- BSA ATTACKED- ALL
DEMONSTRATE THE SOPHISTICATION
THAT OUR ADVERSARIES HAVE THEY
ARE PERSISTENT. THEY ARE-
HIGHLY COMPETENT AND TECHNICAL
NAY OUR PATIENTS THEIR WILLING
TO WAIT AND YOU KNOW- CONDUCT
IN OUR SYSTEM DO SURVEILLANCE.
AND LEARN WHAT THEY CAN LEARN
AND YOU KNOW TRAVERSE LATERALLY
ACROSS NETWORKS. FOR THEIR GAIN
AND WHETHER IT'S FOR-
SURVEILLANCE ESPIONAGE. WHAT
MAY BE THE DISRUPTOR IS GOING
TO STRUCTURE IT AGAIN
UNDERSCORES THE NEED TO REMAIN.
VIGILANT ON THIS- SO AGAIN YOU
KNOW WE HAVE TO CONTINUE TO YOU
KNOW MAKE SURE THE SECT AWAY-
THE STATE- WE PUSH OUT
INDICATOR OF COMP- WE SHARE
INFORMATION REGARDING THE
IMPACT HOW TO ASSESS THE IMPACT
AND ALSO HELP MITIGATE- THE
STRETCHES WE GO FORWARD. DONALD
GUARDING- THE- THE QUESTION OF
SEGMENTATION WHICH IS YOU KNOW
HOW DO YOU PROTECT THESE
ENVIRONMENTS PARTICULARLY
OPERATIONAL TECHNOLOGY
ENVIRONMENTS- YOU KNOW WE STILL
BELIEVE THAT NETWORKS SHOULD BE
SEGMENTED STILL OPERATIONAL
TECHNOLOGY NETWORKS SHOULD BE
SEGMENTED FROM CORPORATE
NETWORKS. BUT MR ROSE POINTED
OUT THAT IS NOT THE ONLY
CONTROL AND AGAIN THEY HAVE TO
BE ON THE CONTROLS IN PLACE- TO
MAKE SURE THAT THESE NETWORKS
ARE NOT COMPROMISED AND SO THAT
INCLUDES BASIC CYBER HYGIENE
YOU KNOW- THINGS LIKE. STRONG
PASSWORD POLICIES THE USE OF
MULTI FACTOR AUTHENTICATION AS
YOU TRAVERSE ACROSS NETWORKS-
IMPLEMENTATION OF- TECHNOLOGIES
SUCH AS- USER BEHAVIOR
ANALYTICS AS WELL AS ENDPOINT
DETECTION AND PROTECTION AND
DETECTION ENDPOINT DETECTION
PROTECTION EXCUSE ME
TECHNOLOGIES THAT REALLY HELP
YOU TO NOW- IF SOMETHING ELSE
IS GOING ON IN YOUR NETWORK.
YOU KNOW ANOTHER OPPORTUNITY
THAT WE TRY TO REINFORCE IS
WHEN YOU LOOK AT WHAT ATTACHED
LIKE SO WHEN AND ALSO THE
REASON TO SAY ATTACK TOOK
ADVANTAGE JOB WAS
ADMINISTRATIVE PRIVILEGES IN
NETWORK AND AGAIN ENTERPRISE
CLASS TOOLS LIKE THAT REQUIRED
THOSE PRIVILEGES. BUT IT ALSO
PROVIDES AN OPPORTUNITY TO LOOK
AT HOW WE IMPLEMENT THOSE
TECHNOLOGIES GOING FORWARD AND
IDEALLY REDUCE THE- THE NUMBER
OF- IN THE MINISTRY OF
PRIVILEGE ACCOUNTS THAT WE HAVE
IN OUR ENVIRONMENTS YOUR.
ADVERSARIES CAN'T TAKE- VANTAGE
OF THE- I. THE OTHER THING IS
TO YOU KNOW WHEN- MISTER ROWE
BELIEVE TO THIS IS WELL AS THE
CONTINUE TO BE PREPARED TO
DRILL- YOU KNOW WHAT AN ATTACK
IN RESPONSE LOOKS LIKE ARE YOU
DON'T WANT TO FIGURE OUT- HOW
TO RESPOND TO A RANSOMWARE
ATTACK WHEN YOU'RE ACTUALLY
EXPERIENCING IT SO THINKING
ABOUT HOW YOU WOULD GO ABOUT-
DEALING WITH AN ATTACK MAKING
SURE THAT YOU KNOW WHO TO
NOTIFY INCLUDING LAW
ENFORCEMENT AND REGULATORY.
COMMISSIONS- AS WELL AS-
THINKING ABOUT WILL YOU PAY THE
RANSOM WHAT CONDITIONS WOULD
MAKE YOU THINK ABOUT PAYING THE
RANSOM AND AGAIN WE'RE NOT
ADVOCATE THAT PAYING THE RANSOM
BUT THE REALITY IS THAT YOU
KNOW YOU MAY NEED TO THINK
ABOUT THAT. AND ALSO IF YOU
NEED TO GET AN ACQUIRER CRYPTO
CURRENCY- AGAIN YOU DON'T
ACTUALLY WANT TO HAVE TO DO
THAT WHILE YOU'RE DOING
BECAUSE- YOU'RE IN THE MIDDLE
OF A- SITUATION LIKE THAT- LAST
WEEK PREPARING TO RECOVER YOU
KNOW SO MAKING SURE THAT YOU
CAN PREPARE FROM BACKUPS-
DRILLING THAT. AND MAKING SURE
THAT YOUR CRITICAL SYSTEMS THAT
COULD AFFECT YOUR OPERATIONAL
TECHNOLOGY SYSTEMS ARE UP AND
RUNNING AS WELL- ASSEMBLY TO
MISTER ROSE YOU KNOW- IN TERMS
OF RECOMMENDATIONS- WE WOULD
STRONGLY ENCOURAGE YOU TO JOIN
THE- WE ARE SHOCKED- IF YOU
HAVEN'T. IT IS LSO FREE- AND
AGAIN IT HELPS OF THE SECTOR AS
WELL AS OTHER CRITICAL
INFRASTRUCTURE SECTORS
MAINTAIN. OUR SITUATIONAL
AWARENESS- YOU KNOW WE ARE
SUPPORTER OF THE VARIOUS
PROGRAMS AT THE FEDERAL LEVEL-
INCLUDING BE- BY DIDN'T
MINISTRATIONS RECENT HUNDRED
DAY PLAN. WHICH THE I. TECH IS
ACTIVELY INVOLVED AND THIS IS
REALLY TALKS TO THE DEPLOYMENT
OF SENSOR TECHNOLOGIES. IN
OPERATIONAL TECHNOLOGY NETWORKS
SO WE CAN HAVE INCREASED
VISIBILITY. INTO THOSE
NETWORKS- AND THEN DO A BETTER
JOB OF THINKING ABOUT WHAT WE
CAN DO TO FURTHER MITIGATE OR
PROTECT AGAINST THESE RAPS. ON
SELECT INCLUDES. MY- INITIAL
TESTIMONY. I THANK YOU VERY
MUCH MAY. AT COUNCIL AND- WE
HAVE RYAN KHOBAR NEXT. MEMBERS
OF THE COMMITTEE THANK YOU FOR
INVITING ME TODAY TO APPEAR
BEFORE THIS COMMITTEE DISCUSSED
CYBER SECURITY AND RISK TO
CRITICAL INFRASTRUCTURE SUCH AS
UTILITIES AND LOCAL
GOVERNMENTS. I THERE'S A LOT OF
MATERIAL TO COVER AND MANY MY
PREVIOUS SPEAKERS VERY HIT ON
MAY THE HIGH NOTES WHICH I
MOSTLY AGREE WITH SOMEONE TO
TRY TO KEEP THIS SHORT AND
SWEET. MY NAME IS FRANCO
BARNETT SERVICES THING WITH
CYBERSECURITY STRATEGIST OF
SPOCK GLOBAL SOFTWARE COMPANY
BASED IN SAN FRANCISCO I HAVE
OVER TWENTY YEARS OF
CYBERSECURITY EXPERIENCE ACROSS
BOTH PUBLIC AND PRIVATE SECTORS
GLOBALLY. THANK AS A TRUSTED.
TO MORE THAN NINETY OF THE
FORTUNE ONE HUNDRED AND WE ARE
PROUD TO COUNT MANY LEADING
GOVERNMENTS AND EDUCATIONAL
INSTITUTIONS AND NONPROFITS AS
CUSTOMERS. SUBQUERY THREATS ARE
GROWING BOTH THE NUMBER AND
COMPLEXITY HIGH PROFILE ATTACKS
SUCH AS COLONIAL PIPELINE SOLAR
WINDS AND ATTACKS ON LOCAL
GOVERNMENTS SUCH AS ATLANTA AND
BALTIMORE. JOIN THE GROWING
LIST IN FRONT PAGE START
SECURITY COMPROMISES TO OR NOT
TIONAL IN CRITICAL
INFRASTRUCTURE. A COMBINATION
OF ACCELERATING TECHNOLOGY
TRENDS HAVE SIGNIFICANTLY
EXPANDED CYBERSECURITY TAX
SERVICES TO ORGANIZATIONS
CYBERSECURITY TEAMS ARE TASKED
WITH DEFENDING. THE CYBER
INCIDENTS WE SEE TODAY RANGE
FROM BASIC CONFIDENCE GAMES TO
MASSIVE DENIAL OF SERVICE
ATTACKS TO SOPHISTICATED
INTRUSIONS IN THE CRITICAL
INFRASTRUCTURE SYSTEMS THE
IMPACT CAN BE A MEDIA SUCH AS A
THEFT OF MONEY DISRUPTION OR
CRITICAL SERVICES WORK MORE
LONG TERM IT CAN RUIN AN
ORGANIZATION'S REPUTATION AND
FINANCES YOU CAN IMPACT
CITIZENS TRUST IN THEIR
GOVERNMENT'S ABILITY TO GIVE
OUT THOSE INDUSTRIES AND
UTILITIES. IN SOME CASES CYBER
ATTACKS EVEN CAUSE PHYSICAL
DAMAGE TO OUR CRITICAL
INFRASTRUCTURE SYSTEMS
JEOPARDIZING SAFETY AND
SECURITY OF OUR CITIZENS.
ATTACKER FROM THE GAMUT OF
HIGHLY ORGANIZED CRIMINAL
ENTERPRISES TO DISGRUNTLED
EMPLOYEES FROM SO CALLED
HACKTIVISTS TO WELL RESOURCE
STATE SPONSORED GROUPS. THE
MOTIVATION CAN VARY FROM PURELY
FINANCIAL GAME TO POLITICAL
CAUSES TO EVEN ASK YOU NOT.
ITALY'S THE LOCAL GOVERNMENTS
BASIS INSIDER THREATS BUT THE
LARGEST PRIVATE SECTOR TO
SECTOR COMPANIES IN THE WORLD
ARE FACING BUT WITH LIMITED
RESOURCES TO DEFEND THEMSELVES.
THEY'RE NOT CURRENTLY PREPARED
TO DEAL WITH THE ATTACKS BY
RANSOMWARE CRIMINAL GANGS ARE
TARGETING THEIR ORGANIZATIONS
FOR QUICK FINANCIAL PAYOUTS.
NOR ARE THEY READY TO DEFEND
AGAINST THE GROWING TREND OF
STATE SPONSORED ADVERSARIES WHO
UTILITIES AND LOCAL GOVERNMENTS
AS LEGITIMATE POLITICAL TARGETS.
A RECENT REPORT FROM THE
STARSKY FROM DRACO SAID
LICENSES SPECIALIZES IN ICS
DATA SHOWS A SIGNIFICANT
INCREASE IN CYBERATTACKS OVER
THE LAST TWO YEARS. SOME COULD
ARGUE THAT THIS IS ONLY BECAUSE
WE ARE NOW LOOKING FOR THEIR
THREATS BUT I WOULD DISAGREE. I
THINK THERE HAS BEEN
SIGNIFICANTLY MORE INTEREST IN
ATTACKING THE FABRIC OF OUR
NATION BOTH FROM CYBER WARFARE
OR POLITICAL EMBARRASSMENT
PERSPECTIVE. AND ALSO AS A WAY
TO CAUSE IMMEDIATE PAIN FOR
FINANCIAL REWARD. I BELIEVE THE
CRITICAL INFRASTRUCTURE ATTACKS
SUCH AS THE ONES AGAINST
COLONIAL PIPELINE AND THE
RECENT ATTACK AGAINST A FLORIDA
WATER TREATMENT PLANT ARE MORE
COMMON THAN POPULARLY KNOWN.
AND ARE UNDERFUNDED REPORTED.
IN MY EXPERIENCE DIRECTORS
HAVE. BREACHED THE TRADITIONAL
IT SYSTEMS OF THE STATE OF
THESE UTILITIES USUALLY DO NOT
MAKE THE MEDIA HOP TO THE
INDUSTRIAL CONTROL SYSTEMS. BUT
I OFTEN DO HAVE THAT
OPPORTUNITY BUT I'M SURE THIS
COMMITTEE IS AWARE IN TWO
THOUSAND EIGHTEEN THE LOS
ANGELES DEPARTMENT OF WATER AND
POWER CONDUCTED A PENETRATION
TEST. TO DETERMINE THEIR
SUSCEPTIBILITY TO BEING
ATTACKED IS PUBLICLY REPORTED
THAT ONLY TOOK SIX HOURS FOR
THE EVALUATOR SUCCESSFULLY
BREACHED THE NETWORK. BUT THERE
IS CLEAR AND. PRESENT YOUR
UTILITIES AROUND THE COUNTRY.
AND WHILE UTILITIES AT ERICA
SKATER JUST BEFORE. THE TWO
THOUSAND TEN SPREAD OF STUXNET
WHICH SUCCESSFULLY TARGETED
IRANIAN CENTRIFUGES PROOF THE
AIR GOT NETWORKS ARE NOT
INFALLIBLE. THEY DEVELOPER
PREVENT MANY NORMAL TAX. FOR
SOMEONE AT SOME POINT WE'LL
PLUG THEIR LAPTOP INTO BOTH
NETWORKS TO DO THEIR JOBS OR
THEY'LL TRANSFER THREAT B. R.
U. S. B. ROCK. WE HAVE TO BE
PREPARED FOR THIS TO HAPPEN
BECAUSE THAT HAS HAPPENED AND
IT WILL HAPPEN AGAIN. WITHOUT
THREAT ACTORS ARE TARGETING
THEIR ATTACKS WE'RE SEEING
BOTH. TRULY TARGETED ATTACKS
AND MORE COMMONLY TARGETS OF
OPPORTUNITY. I BELIEVE THE
MAJORITY OF ATTACKS SO WE SEE
ON U. S. UTILITIES AND LOCAL
GOVERNMENTS ARE THE SECOND
VARIETY TARGETS OF OPPORTUNITY.
BY USING INTERNET SCANNING
TOOLS SUCH A SHOWDOWN ATTACKERS
COMBINED VULNERABILITIES
EXPOSED TO THE INTERNET. AND A
TIME TO VARIETY OF DIFFERENT
LOGGINS USING COMMONLY KNOWN
PASSWORDS. OTHER TIMES CRITICAL
INFRASTRUCTURE TARGETS ARE JUST
PART OF A MUCH LARGER CAMPAIGN
TO IN FACT ANYONE WHO COLLECTS.
THE COLONIAL PIPELINE ATTACK
MAYBE SUCH AN EXAMPLE BASED ON
PUBLICLY VAILABLE INTELLIGENCE
IF POSSIBLE THE DARKSIDE RANSOM
GANG AFFILIATE THEY'RE NOT
PURPOSELY TARGET THE COLONIAL
PIPELINE. AS IT HAS APPARENTLY
EXPOSED HIM TO UNWANTED. FOCUS
FROM THE LAW ENFORCEMENT. WITH
SAID SOMETIME THESE ARE. TALK
TAX O'CONNOR. TO AND WHEN
ADVERSARIES DO A TACTICAL
INFRASTRUCTURE IT REPRESENTS A
SIGNIFICANT THREAT TO OUR
SAFETY AND NATIONAL SECURITY.
STARTED OUR CRITICAL
INFRASTRUCTURE COMPONENTS I
WOULD RECOMMEND THAT YOU BILL
THESE ADOPTING THE US ICS
SEARCH LIST AFFECT PROCESS BEST
PRACTICES. LOCAL GOVERNMENTS
SHOULD CONSIDER ADOPTING MISSED
I ASKED TO USE RISK BASED
CYBERSECURITY FRAMEWORK. IF
ORGANIZATIONS FALL THESE
PROTOCOLS AND CUSTOMER CONTROLS
ON A REGULAR BASIS. EVER IN THE
COUNTRY WOULD ACTUALLY BE MUCH
MORE SAFE AS A RESULT. IN
CONCLUSION UTILITIES AND LOCAL
GOVERNMENTS ARE UNDENIABLY
FACING A RISE IN THE RATE AND
SEVERITY OF CYBER SECURITY TAX.
AS A NETWORK DEFENDER WHO
REGULARLY WORKS WITH UTILITIES
AND LOCAL GOVERNMENTS AROUND
THE WORLD. I'M ALWAYS ASTOUNDED
BY THE DEDICATION AND
PROFESSIONALISM OF THE PEOPLE
ATTENDING THESE ORGANIZATIONS.
THEY'RE HAMPERED BY LOW BUDGETS
STAFFING CHALLENGES AND STATES
THAT ARE EXTREMELY HIGH. THEY
NEED IMPROVE SUPPORT MORE
RESOURCES AND MODERN IT INSIDE
SCRITTI TOOLS TO MEET THEIR
EVER EVOLVING CYBERSECURITY
THREATS THAT THEY FACE THAT'S
THE THRUST THE WORLD. THANK YOU
AND. I LOOK FORWARD TO
ANSWERING ANY QUESTIONS FROM
THE COMMITTEE. THANK YOU VERY
MUCH FOR COKER AND A- WEEK OF
THE FIRST PANEL. RON BOUCHARD.
Q- OF. COMMITTEE FOR THE
OPPORTUNITY- FROM BUT CERTAIN-
CTO FOR INSTALLATIONS THAT ARE
OUR GLOBAL SO SERVICE FIRM THAT
SPECIALIZES. IN RESPONDING TO.
AFTER IS- IN BOTH LOCAL AND
GOVERNMENT SECTOR ALL IS
MISSION CRITICAL AND CRITICAL
STRUCTURE AROUND THE WORLD I
EIGHT ECHO A NUMBER OF THE
POINTS THAT I MIGHT ANALYSTS
HAVE MADE A READY IN TERMS OF
BOTH RISKS AND EXPOSURES THAT
WERE OBSERVING- CROSSED A
CRITICAL INFRASTRUCTURE. YOUR
LETTERS AND FEDERAL AND WE WORK
CLOSE BUT I'M ASIDE ACT III
SKIN AND MANY OTHER BROKERS- IN
RECENT NATIONAL ELECTIONS BEGAN
TO DURING CRITICAL
INFRASTRUCTURE AGAINST-
INTERFERENCE AN INTRUSION AND
OF COURSE WE'RE CONTINUING TO
SEE EFFECTIVE OTHER TYPES OF
ATTACKS IMPACTING BOAT. OKAY
LET ME STRUCTURE AS BOTH OPEN.
BESIDES THIS OP IN THE COUNTRY
WELL IT'S. IN THAT LIST IS SOME.
BACK ON YOUR NEARLY ARE A
GLOBAL IS THERE IS THIS ONE KEY
FACTOR WE ARE MISTER BUSH HOW
ARE YOU- DO YOU CAN THAT- YOUR
BOTTOM LINE. WE DON'T HAVE
SIGNAL YOU TURN OFF YOUR VIDEO.
SEE IF THAT HELPS BECAUSE WE
CAN'T HEAR YOU THAT CLEARLY.
HOW DOES IT- BEING EIGHT OR-
THE ACT OF RANBIR STATED BY
SEVERAL OF THE PANELISTS CITY
IN A ONE YEAR. IN NINETEEN AND
TWENTY TWENTY RESULT IS 11%
INCREASE FROM. TWO FULL QUARTER
OF ARTISTIC AGENTS INVOLVED
RANSOMWARE TWENTY TWENTY WE
ANTICIPATE ANOTHER DOUBLE TO
INCREASE OF MASOCHISTIC IN
TWENTY ONE EIGHT IT IS
CERTAINLY A TREND THAT WE'RE
SEEING ON BOTH AT A- LEVEL BUT
ALSO FRANKLY DEPORTED BY. YES
BY STATE SPONSORED. COURT IF
HE'S OUT FOR ITS IT KEEPS.
ALIGHT COMMITTEE. I THAT HAVE
TO REACT TO THESE TYPES OF
TYPICALLY IN A NORMAL. ALL US
CYBER INTRUSION AND DEFENDER.
IF SERVER WHICH BERKELEY
WORKING ORDERED UNC RESPOND TO
THESE SORTS OF INCH. RIGHT TO
WEAR. AVERAGE ARE GLOBAL AT.
EVERY JOB IS A TIME FOR ACTIVE
DEPARTMENT THE TIME THAT THE-
LLOYD IS AROUND IT AT LEAST
VERY LOW. BYE TO RESPOND AND
REACT TO THE FOR THE ACT.
MOTIONS STATION I LOOKED I SAW
PANELLISTS THERE'S OTHER
REASONS ANTAGONISMS AT PLAY
HERE. WE FIVE PEOPLE GAIN ENTRY
AND NOT AND STATE SPONSORED
INTERFERENCE INTELLECTUAL
PROPERTY THEFT- AND JUST
OPPORTUNISTIC ADVANTAGE OF
VULNERABILITIES THAT THAT ARE
BEING FOUNDED INCREASING RATE-
BY- ADVERSARIES AND SHARED
FRANKLY ON THE BLACK MARKET IN
IN IN DARK. REFORMS AROUND THE
WORLD WHICH ALSO INCREASES BOTH
THE APERTURE AND- IMPACT OF
THESE SORTS OF ATTACKS ON
ORGANIZATIONS WORLDWIDE THE TOP
THE TOP INDUSTRIES THAT WE ARE
OBSERVING THAT ARE CURRENTLY
UNDER ATTACK CERTAINLY DO
INCLUDE GOVERNMENT. I DON'T
ALIGN ORGANISE BAKED I WOULD
HIGHLIGHT A FEW OTHER SECTORS
SECTORS THAT MAYBE HAVEN'T
ABOUT THROUGH TALK ABOUT IT
TODAY- INCLUDING HEALTHCARE WE
SAW A MASSIVE INCREASE THE
FOCUS ON THE- HEALTHCARE SECTOR
ESPECIALLY DURING THE COLD
ATTACK THAT MAKE. AGAIN BOTH AN
OPPORTUNISTIC AS WELL AS A
VITAL OPPORTUNITY FOR MANY-
ORGANIZATIONS ARE CRIMINAL-
ALIGNED ORGANIZATIONS AND THEN
I WOULD ALSO HIGHLIGHT A DECENT
BUSINESS A PROFESSIONAL SERVICE
ORGANIZATIONS THAT SUPPORT-
MANY OF THESE CRITICAL
INFRASTRUCTURE PARTNERS. THAT
ARE ALSO AN AVENUE FOR ACCESS
AND ATTACKED BY THREAT ACTORS
AROUND THE WORLD. WE DO
ANTICIPATE AND- IT CONCUR WITH
THE TREND LINES THAT WE'RE
SEEING IN TERMS OF BOTH THE
FOCUS THAT IT ATTACKS AND IF
FREQUENCY AND IMPACT OF THESE
SORTS OF- EACH. REASONS BOTH-
AND IN. STRUCTURE IN STATE OF
THE MONTHS AND YEARS TO COME I
UNDERSTAND MAYBE MIGHT
CONNECTION IS ABOUT SO I'LL SEE
IF I CONTACT THEM AND GET IT
BACK TO THE COMMITTEE THANK YOU.
ALL RIGHT- THANK YOU THANK YOU
VERY MUCH. AND I JUST WANT TO-
WELCOME BOTH ASSEMBLY MEMBER AT
CHAO AND ASSEMBLY MEMBER OF THE
APPROVED WIDE TO THE HEARING-
DO EITHER OF YOU HAVE ANY
QUESTIONS OR COMMENTS AFTER THE
FIRST A PANEL. ASSEMBLY MEMBER
CHAD THANK YOU VERY MUCH- MADAM
CHAIR OF LET ME START OFF BY
THANKING YOU FOR YOUR
LEADERSHIP ON THIS TOPIC- I
KNOW YOU'VE BEEN WORKING ON
THIS. FOR A LONG TIME SO I
TRULY APPRECIATE HI YOU KNOW
YOUR EFFORT AND YOUR LEADERSHIP
ON THIS TOPIC AND NOT HAVING TO
SATURDAY'S MEET MEETING
SOMETHING SO WE GOT THE LET ME
ALSO THANK ALL THE PRESENTERS
FOR SHARING YOUR INSIGHTS AND-
AND I ALL WALKED IN A LITTLE
BIT LATE SO I APOLOGIZE IF MY
QUESTIONS. HAVE ALREADY BEEN
ANSWERED I DO HAVE A COUPLE OF
QUESTIONS- I MADE A MANAGER OF
FIRST QUESTION- IT'S MY
UNDERSTANDING THAT- A LOT OF
THE CRITICAL. INFRASTRUCTURE
ASSETS. OR OTHERWISE AND MY
QUESTION IS WHETHER OR NOT- HI
YOU KNOW THAT PRESENTS A
PROBLEM WHEN IT COMES TO
NOTIFICATION OR WORKING WITH
THE STATE OR FEDERAL
GOVERNMENT- BECAUSE SOMETIMES
PRIVATE SECTORS OFF ARE
UNCOMFORTABLE SHARING CERTAIN
INFORMATION- PARTICULARLY UP
ABOUT CYBER SECURITY BREACHES
AND THE LIKE. AND YET WHETHER
OR NOT- YOU KNOW THAT FACT I
EAT- YOU KNOW THESE ASSETS ARE
BEING- OWN PRIVATELY- WOULD
PRESENT- ANY CHALLENGES IN AND
IF SO WHAT ARE SOME OF THE-
POSSIBLE SOLUTIONS- TO ADDRESS
THAT- WHY DON'T WE START WITH
MISTER A- CANCEL. AND THEN IF
ANYBODY ELSE HAS ANYTHING ELSE
TO ADD AND- SURE AND THANK YOU
FOR THAT QUESTION- SO- I.
PERSONALLY DO NOT BELIEVE THAT
THE PRESENTATION- YOU KNOW IN
HERE THAT'S- ON THE SHARING YOU
KNOW THE ELECTRICITY SECTOR HAS
A LONG TRACK RECORD OF TAKING
CYBERSECURITY RISK OR- SECURITY
RISK IN GENERAL VERY SERIOUSLY-
AND ACTUALLY HAS BEEN SHARING-
ON FOR. WELL OVER TWO DECADES
YOU KNOW INFORMATION ABOUT THIS
RATIONALE AND THAT CONTINUES TO
INCREASE THAT BEING SAID THE
OPPORTUNITY TO CONTINUE SHARING
AND MAINTAINING SITUATIONAL
AWARENESS. EXISTS AND SO WE TRY
TO DO THAT BY DEMONSTRATING THE
VALUE OF INFORMATION SHARING
WHICH IS REALLY MAINTAINING
SITUATIONAL AWARENESS RIGHT.
THAT'S WHAT HAPPENS TO ONE OF
US COULD HAPPEN TO ANOTHER ONE
OF OUR MEMBERS- AND THAT IS
REALLY WHAT THE ISAC FOCUSES ON
IN TERMS OF GETTING
INFORMATION. OUT TO THAT THAT
BEING SAID- YES THAT THERE IS
YOU KNOW OCCASIONALLY SOMEONE
LOCKED THEMSELVES THE PRICKLY
WHERE THERE'S CONCERNS ABOUT
ATTRIBUTION. OR PENALTY OR OR-
OTHER LIABILITIES THAT MADE HER
AND I THINK THAT'S THE
OPPORTUNITY IN FRONT OF US THAT
WE HAVE TO YOU KNOW GIVEN THE
SOPHISTICATION OF THE STRAP. WE
ACTING CAN ENCOURAGE. ALL THE
PARTIES IN THIS ECOSYSTEM TO
CONTINUE TO SHARE- OUR WITH AND
WITHOUT FEAR- ATTRIBUTION OR
PENALTY- AND REALLY TRY TO
FACILITATE THAT. SO ONE OF
THINGS WE DO TO THAT END OF THE
E. ISAC IS OUR MEMBERS CAN
ACTUALLY SHARE ANONYMOUSLY THEY
CAN POST INFORMATION ON OUR
PORTAL. AND THEY CAN ACTUALLY
CHOOSE WHO GETS SHARED WELL
RIGHT AND WE THINK THAT'S A
POWERFUL WAY OF AGAIN- GETTING
INFORMATION AND THEN ALLOWING
US TO- SHARE THAT INFORMATION
WITH OTHER MEMBERS OF THE
SECTOR. AND EVEN WITH OUR
GOVERNMENT PARTNERS AS WELL. HE
HAD COME YES YOU- NEXT QUESTION
I DEALS WITH BRANDS. AND I
THINK AS THE PANELISTS SO HAVE
POINTED OUT IN THE YOU KNOW
THAT THE FREQUENCY AND SEVERITY
OF THESE RANSOMWARE ATTACK SO-
ON ON ON THE RICE-
EXPONENTIALLY IN FACT. AND I
NOTICED ALSO THAT- A LOT OF
THESE RANSOMWARE SITUATIONS
INVOLVE. THE USE OF A
CRYPTOCURRENCY CAL THEY'RE
BEING T. PAY BY BITCOIN AND THE
LIKE. AND SO I'M WONDERING IN
ADDITION TO ALL THE SUGGESTIONS
THAT'S BEEN MADE OF FOR
EXAMPLE- HAVING- BEST PRACTICES
AND THE LIKE. BUT IN HAVING
BACKUP SO OBVIOUSLY. I'M
WONDERING WHETHER ONE OF THE-
POSSIBLE AVENUES TO PURSUE
WOULD BE TO LOOK AT THE YOU
KNOW THE INFRASTRUCTURE OF THE
CRYPTOCURRENCY- INFRASTRUCTURE
BASICALLY. AND YOUR DO
SOMETHING VERY IT YOU KNOW FOR
EXAMPLE WHATEVER THE CASE MAYBE
IT. WOULD BE DISCLOSURE OR
OTHERWISE SO IS THAT SOMETHING
THAT WE SHOULD BE LOOKING AT AS.
WELL EITHER THE STATE OR THE
FEDERAL LEVEL. AT AN- LET'S
SEE- THAT PERHAPS A- MISTER
CLARK MANY. YEAH. REGARDING THE
DESTRUCTION OF THE CRITICAL
INFRASTRUCTURE I WOULD SAY FROM
A RANSOMWARE POINTED TO DO
YOU'RE YOU'RE CERTAINLY CORRECT
YOUR PERSON THAT THE- OR SORRY
A SIMPLE PERSON. THAT THE-
RANSOMWARE PAYMENTS ARE
CURRENTLY BEING PAID
SIGNIFICANTLY WITH CRYPTO COIN
THE BERRIES VARIETIES HOWEVER I
CAN'T SAY THAT I'M EXPERT
ENOUGH TO COMMENT UPON THE
ABILITY DISRUPT THOSE MARKET
PLACES. ARE SPECIFICALLY
BECAUSE SOME OF THE CRYPTOCOIN
MARKETS ARE DESIGNED TO
SPECIFICALLY AVOID GOVERNMENT
REGULATION AND EVERYTHING ALONG
THOSE LINES SO IT BECOMES
DIFFICULT. BECAUSE THERE ARE A
VARIETY OF DIFFERENT TYPES OF
CRYPTO COINS THAT ARE USED ARE
THE MOST COMMON OF COURSE HAS
BEEN BIG POINT. WHICH WE CAN
SEE FROM THE- RECENT COLONIAL
PIPELINE AND THE DARK SIDE TAKE
DOWN BY THE US GOVERNMENT THAT
THEY WERE ACTUALLY ABLE TO
RECOVER SOME OF THAT- IT
APPEARS THAT MANY RANSOMWARE
OPERATORS ARE BEGINNING TO MOVE
AWAY FROM BITCOIN AS PRIMARY
PAYMENT METHOD BECAUSE OF THAT
DISRUPTION SO- THAT'S MOST PARK
ON COMFORTABLE GOING INTO
DETAILS BUT I CAN'T SAY FOR
SIGNIFICANT DIFFICULTIES WITH
DISRUPTING THAT MARKHAM. AS OF
MAYBE MR BOUCHARD HAS SOMETHING
TO ADD ON THAT. YES I MEAN FROM
OUR PERSPECTIVE WE WE'VE
ACTUALLY HAD SEVERAL
DISCUSSIONS- WITH CITY COUNCIL
AS WELL AS- YOUR CONGRESS ON
THIS TOPIC AND THERE IS. A
GROWING THOUGHT PROCESS THAT
THERE NEEDS TO BE SOME SORT OF-
BUT YOUR REGULATED OR NO
DISCLOSURE NOTIFICATION OF
PAYMENT THERE HAVE BEEN
DISCUSSED. SINS OF THE OF
BANNING FORMER IN SOMEWAY
OUTLAWING SOME PAYMENTS IN
ORDER TO CUT OFF THE FINANCE
BOB DOLE THAT SPENDING.
CREASING EXPONENTIAL WE- TALKED
ABOUT EARLIER THAT OF COURSE
PUTS A LOT OF VICTIMS IN
JEOPARDY WHEN IT COMES TO
RECOVERY OF. THEIR OPERATIONS
AND THEIR SYSTEMS UNFORTUNATELY
SO THIS IS INTELLIGENT THE
PROBLEM I DON'T KNOW THAT-
REGULATION OF THE CRYPTO MARKET
WILL NESSA'S DEARLY BEAR FRUIT
ESPECIALLY IN THE TIME FRAME
THAT WE'RE TALKING ABOUT MAYBE
THAT'S A- A LONGER TERM
ADDRESSABLE. PROBLEM SAID I
THINK IN THE SHORT TERM SOME
SORT OF POTENTIAL- LIABILITY
PROTECTION OR SHIELDING ALONG
WITH DISCLOSURE- EITHER PRIOR
TO OR IMMEDIATELY AFTER A
RANSOM PAYMENT IN ORDER TO
ENABLE LAW ENFORCEMENT TO
BETTER TRACK. AND PROSECUTE
THESE SORTS OF PAYMENTS MAY BE
A MIDDLE GROUND THAT- THAT
MAKES SENSE INTO TO STEM THE
TIDE. HE DOES THAT THE AND THE
FUNDING THAT'S FLOWING IN AND
FRANKLY ENABLING- THE
INCREASING AMOUNT OF CYBER- YOU
KNOW OPERATIONS. THAT WERE SEEN
AGAINST CRITICAL INFRASTRUCTURE.
THANK YOU VERY MUCH AND ONE
FINAL QUESTION AND I THINK ONE
OF THE PANELISTS- TALKED A
LITTLE BIT ABOUT SEGMENTATION
SO FOR CLARIFICATION PURPOSES
I'M JUST WONDERING IF DOT
CONCEPT REALLY. UP ENCOMPASSES
OR- SIMPLY MEANS THAT WE ARE
SECOND SEGMENTING VARIOUS PARTS
OF THIS OF THE NETWORK SO THAT.
A ONE IF INFECTED SEGMENT WOULD
NOT. AFFECT OTHER SEGMENTS OF
YOU KNOW OF THE OF THE SYSTEM-
WITHIN THE INFRASTRUCTURE JUST
A- CONVOCATION QUESTION. MAYBE
MR CANCEL ON THAT ONE. SURE-
SO- SEGMENTATION- IS AS YOU
POINT OUT IS CERTAINLY A- A
METHOD TO PREVENT FURTHER
INFECTIONS- YOU KNOW TO KEEP
INFECTIONS YOU KNOW WELL
LOCATED WHERE IT STARTED AND
NOT NECESSARILY TRAVERSING
LATTERLY WHEN YOU'RE ON THE
OTHER- Q. VANTAGE THE
SEGMENTATION IS REALLY RESTRICT
ACCESS RIGHT AND SO AGAIN IN
THE ELECTRICITY SECTOR THERE'S
BEEN A LONG TIME PRACTICE OF
SEGMENTING THE ENERGY DELIVERY
NETWORKS OF THE CONTROL THAT
WORKS. FROM THE ENTERPRISE
NETWORKS I'M SO THAT REMAINS A
BEST PRACTICE RIGHT ALL THE
CHALLENGED AREAS SO IT'S OUR
ADVERSARIES HAVE PROVEN IS THAT
THEY CAN GET BACK- GET PAST
THAT YOU KNOW WHAT YOU DID THEY
GET THROUGH MISCONFIGURED
SYSTEMS SO THEY AKE ADVANTAGE
OF VULNERABILITIES. THAT EXIST
IN THOSE PLATFORM SO THAT'S WHY
IT'S IMPORTANT TO MAINTAIN
SOFTWARE CURRENCY AND PATCH
SYSTEMS AS SOON AS POSSIBLE-
AND THAT'S WHAT ENABLED THEM TO
GET ACCESS THE OTHER THING AND
WE SAW THIS IN THE COLONIAL
PIPELINE ATTACK WHERE AGAIN BE
OPERATIONAL TECHNOLOGY SYSTEMS
WERE NOT COMPROMISED BY THE
RANSOMWARE BUT KEY ENTERPRISE
SYSTEMS THAT WERE YOU KNOW
CRITICAL TO THE OPERATION. OF
THOSE SYSTEMS WERE COMPROMISED
SO YOU KNOW WE WOULD ENCOURAGE
ENTERPRISES TO REALLY TAKE A
LOOK AT THEIR INVENTORY OF
APPLICATIONS IN THE SASH WHICH
APPLICATIONS ON THE CORPORATE
NETWORK OR ENTERPRISE NETWORKS
ARE CRITICAL TO THE OPERATION.
OF THE OPERATIONAL TECHNOLOGY
NETWORKS. THANK YOU GERMAN I
YOU MANAGER ALL RIGHT AND I
WANT TO ALL OUR PANELISTS FROM.
THE FIRST PANEL THANK YOU VERY
MUCH FOR US- TO AND FOR YOUR
PATIENCE BECAUSE OF COURSE
WE'RE INTO A DIFFERENT TIME- SO
WE ARE GOING TO MOVE ON TO THE
PANEL TO. AND WE HAVE. A LOT OF
GREAT SPEAKERS HERE AND I WILL
ASK YOU SINCE WE DO HAVE US SIX
PANELISTS SAID EVERYBODY MAKE
SURE TO. KEEP THEIR REMARKS TWO
OF FIVE MINUTES WE HAVE TO FROM
THE WATER SECTOR TO FROM- THE
ELECTRICITY AND GAS ONE FROM
ELECTRICITY AND ONE FROM GAS
AND- THAT WILL BE- NICK SANTA
LOW FROM CALIFORNIA AMERICAN
WATER DAVE PATTERSON THE
GENERAL MANAGER OF THE LAS
VIRGENES MUNICIPAL WATER
DISTRICT- MARTIN STRASBOURG OR
A SENIOR DIRECTOR OF CYBER
SECURITY AT PG&E. MISTER LAST
MUELLER THE DIRECTOR OF CYBER
SECURITY AND COMPLIANCE AT SAN
DIEGO GAS AND ELECTRIC KEVIN
GRANT THE A PRINCIPAL MANAGER
OF CYBERSECURITY AT SOCAL
EDISON. AND JORGE SILVA THE
OPERATIONS MANAGER FOR THE CITY
OF PALO ALTO- THE GAS
DEPARTMENT AND- YOU GUYS ARE AT
THE FOREFRONT SO WE'RE VERY
INTERESTED IN HEARING WHAT YOU
HAVE TO- SAY AND WHY DON'T WE
START WITH MR SENTHIL UP.
THANKS OKAY THAT IS YOUR CHANCE
ISN'T HERE YET I DO HAVE MISTER
PATTERSON. OKAY WHY DON'T WE
START WITH MR PATTERSON. GOOD
MORNING CHAIRWOMAN AND NOT
MEMBERS OF THE COMMITTEE HI MY
NAME IS DAVID PETERSON I'M THE
GENERAL MANAGER OF LAS VIRGENES
MUNICIPAL WATER DISTRICT AND
ALSO CHAIR OF THE AQUA
ASSOCIATION OF CALIFORNIA WATER
AGENCIES. OUR WATER MANAGEMENT
COMMITTEE- I REPRESENT A WHAT
WOULD BE CALLED THE SMALL TO
MEDIUM SIZED OUR WATER AND
WASTEWATER UTILITY WE ARE
PROVIDE SERVICE AT THE RETAIL
LEVEL AND SERVE THE WESTERNMOST
PORTION OF LOS ANGELES COUNTY.
OUR PUBLIC AGENCY AND COVERED
BY A FIVE MEMBER ELECTED BOARD%
OF DIRECTORS. WHAT I'LL DO IT
IN A VERY BRIEF WAY IF YOU
HAVE- GIVE YOU AN IDEA OF THREE
MAJOR TRENDS THAT I SEE HI IN
TERMS OF OUR CYBER SECURITY
POSTURE OF WATER AND WASTEWATER
UTILITIES ARE SIMILAR TO MINE.
HI AND- THAT MAY BE HELPFUL IN
FURTHERING THE DISCUSSION. THE
FIRST TREND THAT I WANTED TO
POINT OUT WHICH I WOULD SAY IS
A VERY POSITIVE ONE IS THAT- I
AM SEEING A SUBSTANTIAL
INCREASE IN FOCUS AMONG LEADERS
AND ELECTED OFFICIALS
RESPONSIBLE FOR WATER AND
WASTEWATER UTILITIES ON. CYBER
THREAT AND THE IMPORTANCE OF
INVESTMENT IN CYBER SECURITY
AND THAT'S REALLY EIGHT OF OUR
USUAL THING AND A HELPFUL
THING- AND I THINK THIS COMES
IN TWO FORMS ONE IN TERMS OF
LITERACY AND SO MYSELF I AM NOT
AN I. T. PROFESSIONAL- WATER
AGENCY MANAGER. BUT I SEE AN
INCREASE LITERACY AMONG MY
COLLEAGUES AND ALSO OUR ELECTED
BOARD. ON CYBER SECURITY. BOB
THE DAYS ARE CYPRUS. ARE BEING
I. T. FOR ARE ARE LONG. AND
CYPRUS NOW IS AN IMPORTANT
STRATEGIC PRIORITY OF ANY
UTILITY INCLUDING MY OWN- FOR
MY UTILITY WE CONSIDER. ARE
PREPARING AND RESPONDING FOR
THE THREAT OF CYBER ATTACK AS
RISING TO BE ON PAR WITH THOSE
FROM NATURAL DISASTER AND THOSE
WOULD BE FIRE EARTHQUAKE AND
FLOOD. AND I OPERATE IN AN AREA
OF THE STATE WHERE OP FIRES A
SIGNIFICANT THREAT. THERE'S
REALLY TWO DRIVERS ONE IS THAT
WERE SEEN AN INCREASED
FREQUENCY AND- THE CROWD. AND
IT'S REALLY AN OCCURRENCE
THAT'S ALMOST DAILY- DALY MAYBE
ON A SMALLER SCALE OF FISHING
AND THAT TYPE OF THING BUT
THESE ARE THREATS THAT ARE
ROUTINE NOW- AND RELATED TO- BE
TAKEN SERIOUSLY. AND ALSO WE'VE
SEEN INCREASED OUR FOCUS- AT
THE LEGISLATIVE AND REGULATORY
LEVEL ON ENSURING THAT
UTILITIES ARE I'M DOING A GOOD
JOB IN TERMS OF PREPARING BOB
THAT HAS HAPPENED AT THE
FEDERAL LEVEL- BEGINNING
FOLLOWING THE NINE ELEVEN
ATTACKS AND THAT WAS THE TWO
THOUSAND AND TWO. BIOTERRORISM
ACT AND I WOULD SAY IN THE TEN
YEARS THAT FOLLOWED THAT THERE
WASN'T A BIG FOCUS ON THE
PHYSICAL SECURITY. OF MORE
RECENTLY CONGRESS PASSED THE
TWENTY EIGHTEEN AMERICA'S WATER
INFRASTRUCTURE ACT. AND THAT
HAS REALLY. BROADENED THAT THE
FOCUS OF THE BIOTERRORISM ACT
TO INCLUDE- IN MORE EARNEST
CYBER SECURITY AND- WATER
AGENCIES ACROSS CALIFORNIA AND
ACROSS THE COUNTRY HAVE NOW.
INCORPORATED RISK ASSESSMENTS
AND EMERGENCY RESPONSE
PROCEDURES IN ORDER TO RESPOND
TO THOSE THREATS. SO THE SECOND
TREND- THAT I WANTED TO MENTION
IS A TREND OF MOVING. TOWARDS
INCREASED RELIANCE IN WATER
WASTEWATER UTILITIES ON
AUTOMATION. MORE SOPHISTICATED
INDUSTRIAL CONTROL. SYSTEMS ARE
CLOUDBASE AS COMPUTING AND THEN
MOST RECENTLY ARTISTS AND
MACHINE LEARNING. AND SO THIS
COMES WITH TWO PARTS IT COMES
IN NOT THE FORM OF NEW RISK. IN
THAT HOT ALL OF THESE SYSTEMS
PRESENT NEW POINTS OF ENTRY
POTENTIALLY TO- OUR SYSTEMS AND
CAN PRESENT NEW THREATS. BUT
ALSO PRESENTS OPPORTUNITIES TO
WORK WITH COMPANIES WHO ARE
INDUSTRY LEADERS AND WHO EMPLOY
MORE SOPHISTICATED SECURITY
SYSTEMS THEN WHAT WE WOULD.
NORMALLY BE ABLE TO IN OUR OWN
UTILITIES SO- IT COMES WITH-
BOTH POSITIVE AND NEGATIVE- IT
ALSO REALLY ELEVATES THE
IMPORTANCE OF SELECTING
PARTNERS AND CONSIDERING OUR
SECURITY. AND THE CAPABILITY OF
YOUR PARTNERS IN PROVIDING
SECURITY FOR BOTH YOUR
OPERATIONS AND YOUR SYSTEMS.
AND THEN I JUST WANTED TO ADD
THE THIRD MAJOR TREND- WHICH IS
A CHALLENGE IS THAT WE ARE
FACING IN THE INDUSTRY AND
INCREASED. INCREASING COST
ACROSS THE BOARD AND AT THE
SAME TIME AND INCREASED FOCUS
ON PROVIDING AFFORDABLE SERVICE
AND SO INVESTMENTS IN
CYBERSECURITY DO COME WITH THAT
CHALLENGE IN THE CONTEXT OF
RISING COSTS. TO PROVIDE YOU TO
UTILITY SERVICES IN GENERAL.
AND TRYING TO PROVIDE
AFFORDABLE SERVICE AND SO WHAT
I'M FINDING IS THAT- FREQUENTLY
UTILITIES LIKE MINE- WHEN WE DO
CONDUCT A RISK ASSESSMENT. WE
NEED TO EMPLOY AN EMPLOYMENT
THE RESPONSE MEASURES AND
IMPROVEMENTS TO SECURITY OVER A
PERIOD OF TIME. AND SOMETIMES
THOSE CAN BE COSTLY I
PARTICULARLY IN TERMS OF
HIRING- THE PEOPLE WHO HAVE
EXPERTISE IN THESE AREAS- AND-
IN THE CASE OF A SMALLER AGENCY
LIKE MINE THAT I CAN BE. A
CHALLENGE SO I THANK YOU FOR-
OPPORTUNITY TO PROVIDE
TESTIMONY AND LOOK FORWARD. TO
QUESTIONS THAT MAY FALL. THANK
YOU VERY MUCH AND WE WILL ON TO
OF MY STRASBOURG- YES THANK YOU
VERY MUCH MARTIN STRASBOURG
HERE I AM A SENIOR DIRECTOR AT
PACIFIC GAS ELECTRIC COMPANY.
IN IT GIGI NEED FOR TEN YEARS
AND THE LAST YOU I'VE BEEN.
RUNNING OUR CYBER SECURITY TEAM
PRIOR TO THAT IRAN OR SECURITY
INTELLIGENCE AND OPERATIONS
CENTER- SO. BEEN ABLE TO
OBSERVE THAT EVOLUTION OF CYBER
THREATS TO OUR SECTOR. OVER THE
LAST TEN YEARS AND I WILL SPEND
A LITTLE TIME HERE MAKING SOME-
COMMENTS AND I THINK IT ALL
DRESSED SOME OF THE QUESTIONS
THAT I'VE I'VE ALREADY HEARD.
OFTEN THE FOLKS THERE- FIRST
OFF- RIGHT RIGHT KNOW I SPEAK
FOR THE ENTIRE- UTILITY SECTOR
IN MY PEERS WHEN I SAY THAT- WE
ABSOLUTELY TAKE CYBERTHREATS
TO. GAS ELECTRIC GENERATION ARE
VERY SERIOUSLY- YES INDEED THAT
THAT THREAT HAS BEEN
INCREASING- OVER THE LAST
SEVERAL YEARS ATTY EVERY DAY
YOU LOOK IN THE PAPER YOU SEE
ANOTHER NUMBER REPORT TEST
SOMETHING SOMETHING HAPPENING
AND WE ABSOLUTELY TAKE THIS
RECORD SERIOUSLY I KNOW
LEADERSHIP AT OUR COMPANY-
INSURERS THAT WE HAVE
APPROPRIATE RESOURCES BUDGET-
FOCUS AT THE BOARD LEVEL TO YOU
TO DO THE THINGS WE NEED TO DO
TO PROTECT- REALLY ARE THE
SAFETY AND RELIABILITY OF GAS
ELECTRIC SERVICE IN THE- IN THE
STATE SO. WE TAKE IT VERY
SERIOUSLY SO WHAT ARE THE
COUPLE KEY POINTS THAT I'D LIKE
TO POINT OUT- FOUNDATION AB- WE
HAVE ADOPTED ACT STUPID GAS
ELECTRIC THE NIST'S
CYBERSECURITY FRAMEWORK. I KNOW
A LOT OF YOUR UTILITIES AS WELL
AS GOVERNMENT ENTITIES USE THE
NECESSARY SECURITY FRAMEWORK SO
STANDARDISATION ANA
COMPREHENSIVE FRAMEWORK THAT
HELPS YOU ENSURE YOU'VE GOT AA-
OB BROAD COMPREHENSIVE PROGRAM
COVERING. ALL THE ASPECTS THAT
YOU'D BE EXPECTED CHUJ POWER IN
THE CYBERSECURITY PROGRAM YES
IT'S VERY IMPORTANT JOB I'VE
BEEN HAPPY TO SEE OUR ADOPTION
THAT FRAMEWORK OVER THE LAST
FIVE YEARS- WE ALSO HAVE BEEN-
SPURRED ALONG BY. A REGULATION
COMING FROM THE FEDERAL LEVEL
YOUR ACCEPT REGULATION IS BEEN
AROUND FOR A LONG TIME AND-
WHILE ANY REGULATORY SCHEME-
YOU KNOW TAKES TIME AND EFFORT
TO COMPLY WITH THAT. THE REAL
INTENT BEHIND THAT NURSE IF
REGULATIONS ARE VERY IMPORTANT.
FOCUS ON YOUR MOST CRITICAL
SYSTEMS IN THIS CASE ELECTRIC
TRANSMISSION AND POWER YOUR
YOUR YOUR BEST SECURITY
CONTROLS FOCUSED ON PROTECTING
THOSE SYSTEMS WE'VE RECENTLY
SEEN- REALLY ON THE HEELS OF
THE COLONIAL PIPELINE INCIDENT
THAT'S BEEN TALKED ABOUT TODAY-
THAT DEPARTMENT OF HOMELAND
SECURITY- PUBLISHING. PIPELINE
OUR SECURITY DIRECTIVES TO WE
HAVE THE FIRST HI PLAN SECURITY
DIRECTIVE COME OUT AT THE
BEGINNING OF. JUNE I AND WE
UNDERSTAND AND HAVE BEEN ABLE
TO SEE IT DROPPED OUT MORE
STRINGENT- REGULATIONS. THAT
ARE COMING OUT SO- IT'S A GOOD
THING REASONABLE REGULAR. THAT
ARE REAL HELPED. OUT SICK
ORGANISED. NOW GAS PI- VERY
GOOD IDEA WE WILL DO EVERYTHING
WE CAN TO CHEW UP- MEET THOSE
STANDARDS- COUPLE MORE ITEMS-
WE HEAVILY RELY ON- OUR
PARTNERS ARE VENDORS THAT THAT
COMPANIES THAT MANUFACTURE IN
OUR CASE TRANSFORMERS
ELECTRONIC RELAYS ARM SOFTWARE
TO MANAGE OUR ENVIRONMENT SO-
IT'S NOT JUST US UTILITIES ARE
WHO REALLY NEED TO STEP UP TO
THE CHALLENGE IT'S- IT'S OUR
OUR PARTNERS ARE VENDORS THAT.
NEED TO ENSURE THAT THEY HAVE
VERY STRINGENT SUPPLY CHAIN
SECURITY CONTROLS SO THAT WHEN
WE DO PURCHASE FOR EXAMPLE A
NETWORK MONITORING SOLUTION- WE
HAVE A HIGH LEVEL OF CONFIDENCE
THAT THAT THAT SOFTWARE IS
GOING TO MAINTAIN ITS
INTEGRITY- UNFORTUNATELY WHAT
SOLAR WINDS AND WITH THAT THE
RECENT APPETITE ASSET TAX- THIS
ISN'T ANYTHING NEW BUT IT MADE
IT VERY. VERY OBVIOUS HOW
IMPORTANT SUPPLY CHAIN SECURITY
IS- AT THAT THE LEVEL I DO KNOW
THERE ARE A VARIETY OF
ACTIVITIES GOING ON RELATED TO
SUPPLY CHAIN SECURITY BUT- I
KNOW P. JEANNIE. DEFINITELY
SUPPORT SAT CONTINUED FOCUS ON
SUPPLY CHAIN SECURITY IN
ENSURING- THAT WE CAN TRUST
THAT THAT EQUIPMENT AND
SOFTWARE THAT THAT WE GET- I'M-
TRYING WE ALL SAY YOU KNOW-
AGAIN HEY THANKS FOR INVITING
US TO THIS OUR PANEL. WHAT WHAT
THE STATE COULD YOU TO HELP US
BE SUCCESSFUL- IS PLEASE
CONTINUE TO INVEST IN
EDUCATIONAL INSTITUTIONS ACROSS
THE STATE EVEN STARTING IN HIGH
SCHOOL BUT DEFINITELY IN OUR
UNIVERSITIES AND COMMUNITY
COLLEGES- SERVICE FUERTE
PROGRAMS THAT PRODUCE- FOLKS
WHO ARE READY TO STEP INTO
COMPANIES LIKE PG&E AND ****
ENTRY LEVEL CYBERSECURITY ROLES
THAT CAN TURN INTO. OUTSTANDING
PANELISTS AND THEN EVEN THE
NEXT SET OF LEADERS- IT'S VERY
IMPORTANT- WE NEED IN DETAIL
SECTOR CAN'T PAY WELL AS GOOGLE
FACEBOOK NETFLIX XCERRA- SO WE
ARE COMPETING FOR THE BEST
TALENT AND THE MORE TALENT IT
IS- BROUGHT UP THROUGH THE
RANKS OF OUR OUR EDUCATIONAL
SYSTEM. THE BETTER POSITION
MORE AND SO I THINK THAT'S YOU
KNOW MY FIVE MINUTES SOME KEY
POINTS THERE. THANKS FOR HAVING
ME AND WILL PASS IT ON TO THE
NEXT ANALYST. THANK YOU VERY
MUCH MR STRASBOURG OR AND WE
WILL MOVE ON TO. LANCE MUELLER.
THANK YOU GOOD MORNING
APPRECIATE THAT- MADAM CHAIR
AND COMMITTEE MEMBERS I REALLY
APPRECIATE THE OPPORTUNITY SO
MY NAME IS MATTHEW ARE UP ON
THE DIRECTOR OF CYBERSECURITY
FOR SOCAL GAS AS WELL AS ESTY
GENIE WE- SERVICE ABOUT TWENTY
FIVE MILLION CONSUMERS IN THE
GAS AND ELECTRIC- OF ENERGY
DELIVERY- YOU KNOW MOST OF THE
PANELISTS IT I AGREE WITH. ALL
OF WHAT THEY'VE HAD YOU KNOW
WAS MARTIN DESCRIBED CYBER
SECURITY IS- IT SPECIALLY IN
WITH OUR ORGANIZATION IS
TREATED AT THE SAME LEVEL AS
SAFETY RIGHT WHICH IS A TOP
HURRY AROUND KEEPING OUR OUR
CUSTOMERS IN OUR IN OUR
EMPLOYEES SAFE- AND INTEGRITY
HAS THAT SAME LEVEL OF
IMPORTANCE. AND THAT REALLY
STARTS AT THE TOP OF THEIR
EXECUTOR YOU KNOW LEADERSHIP
AND US SPONSORSHIP AND MAKING
SURE THAT WE HAVE THE RIGHT-
YOU KNOW BUDGET RESOURCES AND A
COMMITMENT AND WE CERTAINLY DO.
SO TO ECHO A LITTLE BIT AROUND
WHAT MARTIN- DESCRIBED YOU KNOW
A LOT OF UTILITIES ARE SIMILAR
IN IN THE FRAMEWORKS- THAT WE
THAT WE A DOCTOR THAT WE USE
AND NEST- SPECIFICALLY EIGHT
HUNDRED FIFTY THREE IS A VERY
SPECIFIC NEST FRAMEWORK ALONG
WITH THE NEW CYBERSECURITY
FRAMEWORK. ARE ARE VERY COMMON
TOOLS USED IN THE FEDERAL
GOVERNMENT IN A LOT OF ENTITIES
IN THE CRITICAL INFRASTRUCTURE
LIKE ENERGY DELIVERY. USE THOSE
FRAMEWORKS- TO GUIDE US- AROUND
THE THINGS THAT WE SHOULD BE
DOING AND MORE IMPORTANTLY HOW
TO TEST OURSELVES RIGHT HOW TO
BENCHMARK OURSELVES IN SO. YOU
KNOW PART OF THAT IS DOING
ROUTINE MATURITY ASSESSMENTS OF
OURSELVES I MEAN BRINGING IN
THIRD PARTIES TO DO THAT FOR US
TO YOU KNOW BENCH MARKETS
AGAINST THOSE STANDARDS IN AND
THAT HELPS US. IDENTIFY WAYS TO
IMPROVE OUR CAPABILITIES- AND
THEN YOU KNOW THE PREVIOUS
PANEL I THINK THE ONGOING
INFORMATION SHARING IS
ABSOLUTELY KEY I CAN'T STRESS
ENOUGH. HOW MANY TIMES WE HAVE
HER THIRD THING THREE THAT IN.
SHARE THAT HAS HELPED US KIND
OF UP OUR SHIELDS. IMPROPER FOR
SOMETHING BECAUSE ANOTHER
UTILITY OR ENERGY COMPANY SAW
IT. AND IT ALLOWS US TO QUICKLY
REACTING AND YOU KNOW BENEFIT
FROM KIND OF THAT CROWD
SOURCING OF INFORMATION- AS FAR
AS OUR SECURITY ASSESSMENTS
WEEK WE ARE. ENGAGE A BUNCH OF
DIFFERENT SERVICES WE USE A
EXTERNAL BUG BOUNTY PROGRAM
THAT IS OPERATIONAL TWENTY FOUR
SEVEN. WE USE OUR QUARTERLY
ADVERSARY EMULATIONS TO TEST
OUR SYSTEMS- AND THEN WE ALSO
ENGAGE WITH. FEDERAL PARTIES
LIKE DHS AND TSA TO COME IN AND
DO ASSESSMENTS WITHIN OUR
THOSE MUCH LIKE THE FRAMEWORK-
MATURITY ASSESSMENT THAT I
MENTIONED EARLIER TO ASSESS OUR
CAPABILITIES WHERE WE ALL ARE
IN THE MATURITY LEVEL AND HOW
DO WE GET TO THE NEXT LEVEL
RIGHT NOW WITH. WHAT WE NEED TO
DO NEXT TO GO UP FROM THERE-
MARTIN DESCRIBED YOU KNOW SOME
OF THE REGULATORY THINGS THAT
WE FOLLOW NEW YORK SEPT ON THE
ELECTRIC SIDE IS CLEARLY YOU
KNOW THE- THE OVER ARCHING-
REGULATORY BODY. THAT GOVERNS
OUR GENERATION. IN IN
TRANSMISSION AND IN SOME PARTS
OF DISTRIBUTION. ANYTHING ASIDE
FROM THAT WE ALSO HAVE THE NEXT
FRAMEWORK AGAIN IT'S NOT
REGULATORY HOWEVER IT'S
FOLLOWED LIKE IT IS REGULATORY.
AND WE HAVE SARBANES OXLEY AND
THEN- YOU KNOW TSA DIRECTIVE IT
JUST CAME OUT THAT MARTIN- FLEW
TO WE CLEARLY FOLLOW THAT. AND
THEN THE PREVIOUS PANEL
MENTIONED CIS BENCHMARKS AND
THEN THERE'S OTHERS LIKE THE
AUSTRALIAN ESSENTIAL EIGHT
WHICH ARE. ESSENTIALLY
RECOMMENDATIONS WRITING BEST
PRACTICES IN SO WE CONSTANTLY
LOOK AT ALL OF THOSE RIGHT WE
WE'RE WE DON'T FOCUS ON ONE
IT'S KIND OF LIKE A DEFENSE IN
AT ALL OF THOSE BEST PRACTICES
AND THEN TRY TO ADOPT. YOU KNOW
DOES. THAT MAKE SENSE FOR US AS
A BUSINESS. THIS AS YOU KNOW
WHAT WE'VE SEEN OVER THE LAST
YEAR OR TWO CERTAINLY FROM THE
PANDEMIC AS MANY PEOPLE WHAT
REMOTE. WE DIDN'T SEE A HUGE
INCREASE IN THREATS AGAINST OUR
USERS WE SAW A CHANGE IN THE
THREATS AGAINST OUR USERS.
BECAUSE PRIOR TO THE PANDEMIC
WE WERE SEEING LOTS OF SPAM
MALWARE THAT WAS COMING THROUGH
EMAIL IN CERTAINLY SINCE THE
PANDEMIC IN THE LAST YEAR WE'VE
SEEN A LOT OF THAT SHIFT INTO
CREDENTIAL HARVESTING RIGHT
WHERE. FISHING IN A TRYING TO
GET CREDENTIALS SO THAT THEY
CAN GAIN REMOTE ACCESS INTO
SOME OF OUR ENVIRONMENTS. AND
IN IN THE POTENTIALLY DO
FURTHER HARM FROM THEIR FROM
THEIR- ADDITIONAL YOU KNOW THE
THINGS THAT WE'VE SEEN IS YOU
KNOW ATTACKERS QUICKLY
LEVERAGING. VULNERABILITIES AS
THEY ARE DISCLOSED RIGHT THAT
HAS ALWAYS BEEN A PRACTICE
HOWEVER IN THE LAST YEAR OR TWO
WE CLEARLY SEEN VULNERABILITIES
THAT HAVE BEEN PUBLISHED
MEANING. THE PRODUCT
MANUFACTURERS COME OUT AND SAID
YOU KNOW THIS PRODUCT HAS A
VULNERABILITY WITHIN THE NEXT
TWENTY FOUR TO THIRTY SIX
HOURS. THERE IS A HUGE INCREASE
IN ATTACKER ACTIVITY TRYING TO
FIND COMPANIES WITH THAT
PARTICULAR OWN ABILITY TO TRY
TO GET THEIR FOOT IN THE DOOR.
BEFORE THAT ORGANIZATION
PATCHES THAT VULNERABILITY AND
THAT IS THAT IS WHAT LET HAS
LED TO SEVERAL MAJOR
COMPROMISES IN THE LAST. BOB
YOU KNOW SIX MONTHS WITH MANY
ORGANIZATIONS- MARTIN ALSO
DESCRIBED YOU KNOW. CYBER THIRD
PARTY SUPPLY CHAIN RISK HAS
BEEN A HUGE INCREASE ESPECIALLY
BECAUSE OF DUE TO THEIR
RANSOMWARE ATTACK. YOU KNOW AS
MANY OF YOUR WHERE YOU KNOW
RANSOMWARE TYPICALLY INVOLVES
AN EXTORTION TACTIC WHERE THEY
STEAL DATA AND EVEN THOUGH YOU
MIGHT HAVE THE ABILITY TO
RECOVER. THEY WILL THEY WILL
PUBLICLY DISCLOSE THAT DATA.
AND SO SUDDENLY NOW WE HAVE TO
PROTECT OURSELVES BUT ALSO OUR
VENDORS AND OUR THIRD PARTIES
WHO MIGHT GET TO BE A VICTIM OF
A OF A RANSOMWARE ATTACK. THEY
MIGHT HAVE SOME OF OUR DATA AND
THAT DATA GET STOLEN. AND THEN
THAT DATA BECOMES PART OF YOU
DISTORTION PACKED. SO SHE
INCREASE IN THIRD. SUPPLY CHAIN
RISK- AND THEN THE LAST ONE I
MENTION ABOUT IT IN INCREASES
IT IS THE DENIAL OF SERVICE
ATTACKS OVER THE LAST YEAR OR
SO WE'VE SEEN A HUGE INCREASE
ACROSS UTILITIES AS WELL AS
OTHER SECTORS LIKE FINANCIAL.
HEALTH CARE IT CONTINUES TO BE
A PROBLEM IN FACT THERE WAS ONE
TODAY AGAINST ANOTHER UTILITY-
AND IT'S ALL FOR MONEY IT'S AN
EXTORTION RANSOM TYPE OF THING
TO TRY TO KNOCK- YOU KNOW- THE
COMPANY OFFLINE FOR DATES AND
GET SOME SORT OF PAYMENTS- AND
THEN FINALLY I'LL JUST WRAP UP
WITH. YOU KNOW- WOULD MARTIN
DESCRIBED AROUND YOU KNOW
EDUCATION I WOULD EVEN GO AS
FAR TO SAY DOWN INTO THE MIDDLE
SCHOOL IS WHERE WE REALLY NEED
TO BE. YOU KNOW PROVIDING SOME
LEVEL OF CYBER SECURITY
AWARENESS AND EDUCATION SO AS
THEY MOVE UP INTO. HIGH SCHOOL
AND THEN UNIVERSITY RIGHT IT
BECOMES SECOND NATURE AND THEN
WE ARE ABLE TO INCREASE THAT
RESORT POOL BECAUSE THERE'S A
HUGE SHORTAGE THERE AND THE
MORE THAT WE CAN HELP BUILD
THAT THE BETTER THAT WE WILL
HAVE. SO WITH THAT I'LL TURN IT
BACK OVER IN THE FOURTEEN
QUESTIONS. THANK YOU MR MUELLER
AND FINALLY. WE HAVE- CAL GRANT.
TRYING TO GET A MINUTE HERE.
GOOD AFTERNOON CHAIRMAN
CHAIRWOMAN OR WOMEN MEMBERS OF
THE ASSEMBLY SELECT COMMITTEE
ON CYBER SECURITY MY NAME IS
KEVIN GRANT AND I'M THE
PRINCIPAL MANAGER SERVICE
CRITICS ON CALIFORNIA'S. THANK
YOU FOR THE OPPORTUNITY TO
PRESENT TO YOU TODAY. I THINK A
LOT OF SOME COMMON THEMES
AMONGST WHAT WE HAVE R. AS YOU
HEARD FROM MY COLLEAGUES. THE
ELECTRIC POWER SECTOR IN THE
UNITED STATES HAS A LONG
HISTORY OF FACING THREATS TO
INFRASTRUCTURE WHETHER THEY'RE
NATURAL AND MAN MADE. POSSIBLE
THREATS ARE INDEED MUCH MORE
COMPLEX PARTICULARLY WHEN YOU
CONSIDER THAT SOME OF ARTS I
REPRESENTATION ENGINE STATES.
INDUSTRIES A STRONG FOUNDATION
OF PREPAREDNESS RESILIENCE AND
RESPONSE. SO MUCH PROGRESS HAS
BEEN MADE. WE RECOGNIZE THAT
THE CAPABILITY OF CYBER
ADVERSARIES CONTINUES TO EVOLVE
AT A RAPID PACE. NOW REQUIRES A
MORE STRATEGIC APPROACH TO THIS
THREAT. I UNDERSTAND WE HAVE
THREE COLORS A CREEK FUNDACION
FOR STRONG SECURITY CULTURE.
FIRST WE DID QUITE MULTI
LAYERED DEFENSE IN DEPTH
STRATEGY FOR DETECTION AND
REMEDIATION AND RESPONSE. THIS
IS VALIDATED BY CONDUCTING
REGULAR PENETRATION TESTS AND
EXERCISING OUR INCIDENT
RESPONSE CAPABILITIES BOTH
COMPANYWIDE. AND PARTICIPATING
IN INDUSTRY WIDE EXERCISES SUCH
AS BRICKS. IN ADDITION THE
ELECTRIC POWER SECTOR HAS
MANDATORY REGULAR REGULATORY
REQUIREMENTS FOR CYBERSECURITY
WHICH ENSURE A CONSISTENT SET
OF STANDARDS REQUIREMENTS
ACROSS THE INDUSTRY. HOWEVER WE
APPRECIATE THE REGULATORY
REQUIREMENTS ONLY AT BASELINE
AND THEREFORE MANY OF US
LEVERAGE TOOLS SUCH AS- THE
NATIONAL INSTITUTE OF STANDARDS
AND TECHNOLOGY CYBERSECURITY
FRAMEWORK WHICH IS BEEN
MENTIONS. AND MATURITY MODEL
MODELS SUCH AS THE DEPARTMENT
OF ENERGY CYBERSECURITY
CAPABILITY MATURITY MODEL. TO
CONTINUALLY IMPROVE OUR EFFORTS
ACROSS THE BOARD. SECOND OUR
PARTNERSHIPS PLAY A CRITICAL
ROLE IN MITIGATING ONGOING
CYBER THREATS PROGRESS. THE KEY
TO OUR SUCCESS IN STRONG
INDUSTRY GOVERNMENT
COORDINATION BECAUSE INCREASING
INCREASINGLY SOPHISTICATED
CYBER THREATS FROM NATION
STATES THESE PARTNERSHIPS ARE
MORE IMPORTANT THAN EVER. S. C.
WE ARE CONTINUALLY FOCUSED ON
DEVELOPING PARTNERSHIPS THE
FEDERAL LEVEL AS WELL AS AT THE
LOCAL REGIONAL AND STATE LEVELS
INCLUDING ENGAGEMENT WITH
CALIFORNIA CYBERSECURITY TASK
FORCE AND THE FBI CYBER WHO
WATCHES. OUR GOAL IS TO ALWAYS
HAVE THE TOOLS AND RESOURCES IN
PLACE BEFORE MAJOR CYBER
ATTACKERS SO IF AND WHEN IT
DOES WE CAN FOCUS ON RESPONSE.
CUSTOMER PROTECTIONS AND
GREATER SECURITY RATHER THAN
DEVELOPING THIS PROCESS IS A
REAL TIME. TO BE AFFECTED
HOWEVER OUR WORK ON THE
STRATEGY MUST CONTINUE TO
EVOLVE AT A PACE FASTER THAN
THE THREATS WE'RE FACING NOW
AND INTO THE FUTURE. LASTLY WE
MANAGE THE HUMAN SIDE OF RISK
BY INVENTING SECURITY DOOR
PLEASE STAND. CONSIDERING 80%
OF BREACHES ARE CAUSED BY
FISHING OR HUMAN ERROR ALL THE
TOOLS IN THE WORLD WILL NOT
STOP COMPROMISED OR STAFF IS
NOT YOU KNOW WHAT TO DO IF THEY
RECEIVE A SUSPICIOUS EMAIL.
EDISON WE BELIEVE MUST BE
INSTINCTIVE AND SECOND NATURE
SO WE HAVE A ROBUST AWARENESS
PROGRAMS SUPPORT THIS GOAL.
FINALLY I WANT TO CLOSE BY
STATING THE CONCEPT OF
CONTINUOUS IMPROVEMENT IS THE
BEDROCK OF THE CHILI SECTOR
BECAUSE WE RECOGNIZE THE
TREMENDOUS RESPONSIBILITY TO
PROVIDE ELECTRIC POWER HOMES
BUSINESSES. AND OTHER CRITICAL
INFRASTRUCTURE SECTORS ACROSS
THE COUNTRY. THIS IS WHY IT'S
SO IMPORTANT THAT WE PARTNER
CLOSELY WITH FEDERAL STATE AND
LOCAL AGENCIES RECOGNIZING
ORCHID POWER. IS AN INSTRUMENT
OF NATIONAL AND ECONOMIC
SECURITY AND THEREFORE WE MUST
DO EVERYTHING WE CAN TO PROTECT
AGAINST CYBER ADVERSARIES THAT
WE WERE SCHOLAR IN WISCONSIN
ARE. THANK YOU AGAIN FOR THIS
OPPORTUNITY THANK YOU TODAY.
I'M A BILL QUESTIONS THAT YOU
HAVE. THANK YOU. THANK YOU VERY
MUCH MR GRANT IT APPEARS THAT
WE DON'T HAVE MR SENTHIL LOW OR
MR SILVA ON THE LINE SO- JUST
WANTED TO MAKE A COUPLE OF
COMMENTS I THINK MOST OF YOU
EXPRESSED THE IMPORTANCE OF-
INFORMATION SHARING. AND OF
DOING FIX THINGS LIKE SECURITY
AND- ASSESSMENTS CERTAINLY WE
HAVE A BIG FOCUS IN THE
LEGISLATURE ON EDUCATION AND I
THINK THAT THAT'S PROBABLY. OUR
BIGGEST ROLE- AS A MATTER OF
FACT THERE IS MONEY AND THE-
BUDGET RIGHT NOW HOPEFULLY THE
GOVERNOR WILL BE SIGNING FOR A
AND DIGITAL UPSKILLING AND I
APPRECIATE- THE IDEA THAT WE
REALLY NEED TO START IN THE
MIDDLE SCHOOLS. OF WITH- CYBER
AWARENESS BUT CERTAINLY- THERE
ARE A LOT OF VERY CAPABLE
PEOPLE AND OTHER SECTORS THAT
MIGHT BENEFIT FROM UPSKILLING
PROGRAMMES SO- WILL CONTINUE WE
WILL CONTINUE TO FOCUS ON THAT
BUT I DO HAVE ONE QUESTION FOR-
ANYBODY THAT WOULD LIKE TO
ANSWER DO YOU AND I THINK THE
ANSWER IS PROBABLY NO BUT- DO
YOU THINK THAT THERE IS ANY
ROLE FOR US. LEGISLATION HERE
IN CALIFORNIA TO MAKE SURE THAT
UTILITIES ARE AT THE BEST OF
CYBER STANCE THAT THEY COULDN'T
POSSIBLY BE AT AND LYFT I SEE
MISTER GRANT IS- YOU ARE STILL
ON THE SCREEN SO MAYBE- MAYBE
YOU WOULD LIKE TO ANSWER THAT
QUESTION AND ANYBODY ELSE THAT
MIGHT. LIKE TO JUMP IN AFTER
THAT. I IT'S IMPORTANT THAT-
ANY LEGISLATION STAYS ALIGNED
WITH THE FEDERAL LEGISLATION
AND- THAT'S THAT'S WHAT WE'LL
BE LOOKING AT I DON'T I DON'T.
THINK THAT IT'S REALLY
IMPORTANT THEY STILL LACKED
RIGHT THAT'S OTHERWISE WITH
WE'RE GONNA START TO CREATE
MORE NATIONAL BARRIERS. RIGHT
THANK IT IS THERE ANYBODY ELSE
THAT HAS A COMMENT ON THAT. I
WOULD AGREE WITH THIS IS LANCE-
I WOULD AGREE WITH WHAT KEVIN
DESCRIBED IN JUST MAKING SURE
THAT THERE'S YOU KNOW THE
ALIGNMENT WITH FEDERAL
REGULATIONS STANDARDS AND
GUIDELINES JUST TO NOT MAKE IT
DUPLICATE IT AND DIFFERENCE.
AND THEN THE OTHER THING I
WOULD HIGHLIGHT IS THAT YOU
KNOW AS THESE THREATS IN IN
CYBER RISK HAS INCREASED AS
WE'VE ALL DESCRIBED WE BECOME A
LOT MORE PROTECTIVE OF OUR DATA
AND I THINK I HEARD OF. ME
MEMBER CHILD MENTIONED YOU KNOW
COMPANIES BEING LEERY ABOUT
SHARING DATA. I DON'T THINK
IT'S IT WAS NOT IN OUR CASE I
DON'T THINK FOR A THE OTHER
PANELISTS IT'S THAT WE DON'T
WANT TO HEAR THE DATA IT'S WE
WANT TO MAKE SURE WE'RE DOES
THAT DATA GO BECAUSE WE GO TO
GREAT LENGTHS TO PROTECT THE
INSIDE OF OUR ORGANIZATION. AND
SO SUIT WHEN WE'RE ASKED TO
SHARE THAT WHICH IS VERY VERY
CONCERNED ABOUT THE CONTROLS
THAT ARE PUT ON THAT DATA ONCE
IT LEAVES OUR POSSESSION
BECAUSE SOME OF THE DATA IS
VERY VERY SENSITIVE FROM AN
ATTACKER PERSPECTIVE. AND SO
THE QUESTION AROUND WHAT CAN
THE STATE LEGISLATIVE- YOU KNOW
BODY DO YOU HAVE TO HELP THERE
IS YOU KNOW TO MAYBE TAKE A
LOOK AT THAT AND HELP GUIDE
THAT IN IN YOU KNOW- ENGAGING
AND YOU KNOW CONTINUING THE ARE
THE COLLABORATION PARTNERSHIPS
LIKE TIS ONE. TO TALK THROUGH
ALTERNATIVE WAYS TO DO THAT TO
GET THE INFORMATION TO THE
ORGANIZATIONS THE STATE
ORGANIZATIONS WITHOUT. WITHOUT
HAVING TO NECESSARILY SEND THAT
DATA INTO ENVIRONMENTS THAT WE
HAVE NO IDEA WHAT THE SECURITY
CONTROLS. ARE PROTECTING THAT
DATA. THANK YOU IS THERE ARE
THERE ANY OTHER COMMENTS FROM
THE PANEL BEFORE WE MOVE ON ON
THE ON THAT. LEGISLATIVE
QUESTION. ALL RIGHT WELL REALLY
APPRECIATE ALL OF YOU JOINING
US- THIS AFTERNOON AND WE WILL
GO ON GO ON AND MOVED TO THE
OUR THIRD AND FINAL PANEL.
WHICH IS A STATE RESOURCES FOR
LOCAL GOVERNMENT AND UTILITIES-
WE HAVE JOINING US TODAY TOM
OSBORNE WHO IS THE DEPUTY
DIRECTOR OF HOMELAND SECURITY
WITHIN THE GOVERNOR'S OFFICE OF
EMERGENCY SERVICES. JONATHAN
NUNEZ THE COMMANDER OF THE
CALIFORNIA CYBER. INTEGRATION
CENTER. THE TOLLY OF PANACHE.
OF THE CALIFORNIA STATE CHIEF
INFORMATION SECURITY OFFICER
VITALI SORRY ABOUT THAT I
SHOULD KNOW HOW TO PRONOUNCE
YOUR LAST NAME AND RACHEL
PETERSON THE EXECUTIVE DIRECTOR
OF THE C. P. WANNA THANK ALL OF
YOU FOR. JOINING US AND AGAIN
WE WILL LISTEN TO YOUR-
PREPARED REMARKS AND THEN SEE
IF WE HAVE ADDITIONAL QUESTIONS
SO WHY DON'T WE START WITH MR
OSBORNE. GOOD AFTERNOON MADAM
CHAIRMAN COMMITTEE MEMBERS MY
NAME IS TOM OSBORNE THE DEPUTY
DIRECTOR OF HOMELAND SECURITY
HERE AND BUT ABOUT THE
GOVERNOR'S OFFICE OF EMERGENCY
SERVICES. ONLY CHEERY DIVISION
INCLUDES BOTH THE CALIFORNIA
CENTER SECURITY INTEGRATION
CENTER OR OUR REFER TO IT AS
THE CAL SICK OR THAT THE KELSEY
SICK. AS WELL AS OUR CRITICAL
INFRASTRUCTURE PROTECTION
BRANCH SO THOSE TWO ENTITIES
ARE REALLY HELP US ONLINE AND
PROTECTING THE CRITICAL
INFRASTRUCTURE WHIMS IN
CALIFORNIA. AND CERTAINLY THANK
YOU FOR THE UPDATE IS BIG
BRIEFLY TODAY ON THE IMPORTANT
WORK THAT A COW SICK IS DOING
IN THE FUTURE CHALLENGES THAT
WE COLLECTIVELY FACE AND
PROTECTING THE STATE'S CRITICAL
INFRASTRUCTURE. FROM CYBER
INCIDENTS THE CYBER ATTACKS
THAT ARE COMING FROM ORGANIZED
CRIME GROUPS AS WELL AS STATE
SPONSORED- INTRODUCED BY WAY OF
BACKGROUND IN TWENTY FIFTEEN.
GOVERNOR CALIFORNIA SIGNED AN
EXECUTIVE ORDER WHICH
BASICALLY. CAL SICK IN TWENTY
EIGHTEEN THE GOVERNOR SIGNED
ASSEMBLY BILL TWENTY EIGHT
TWELVE TWENTY EIGHT THIRTEEN.
AUTHORED BY NOW CHAIR WHICH
CODIFIED IN THE PUT IN THE LAW
THAT THE CAL SICK. FROM
SUPPORTING CALIFORNIA'S
STATEWIDE CYBERSECURITY
STRATEGY AND THEN MOST RECENTLY
IN FISCAL YEARS TWENTY TWENTY
ONE THE GOVERNOR OF THE
LEGISLATURE SOMEONE WILL FIND
THE CAL SICK BY ALLOCATING
ELEVEN POINT ONE MILLION
DOLLARS OF GENERAL FUND DOLLARS
TO FURTHER. ENHANCE OUR SERVERS
EFFORTS- HERE IN. IN THE STATE
OF CALIFORNIA. THE HEALTH ARE
AS A ONE STOP. OF STATE GOT
CYBER. ACTIVE IN COURTNEY
STARTED IN THIS. RESPONSE AS
WELL- I YEAH CRITICAL SERVER
TELL WITH STATE LOCAL FEDERAL
TRIBAL GOVERNMENTS AS WELL AS
OUR CRITICAL INFRASTRUCTURE
PARTNERS- ACADEMIC INSTITUTIONS
AND OTHER NON GOVERNMENTAL.
AGENCIES SO WHAT I WANT TO TURN
OVER TO JONATHAN NUNEZ WHO
SERVES AS OUR COMMANDER OF THE
CELTIC TO REALLY TALK ABOUT THE
THINGS THAT WE ARE CURRENTLY
DOING. IT PROTECTING
CALIFORNIA'S CRITICAL
INFRASTRUCTURE AND SOME FUTURE
PLANS AND SO JOHNSON. WHICH YOU
THANK YOU TOM AND GOOD MORNING
MADAM CHAIR GOOD AFTERNOON
MANAGER AND COMMITTEE MEMBERS
THANK YOU FOR PROVIDING ME THIS
OPPORTUNITY. TO SHOW HOW
CALIFORNIA- MUST CONSTANTLY
ADAPT TO THE EMERGING THREATS
IN THE EMERGING CYBERTHREAT
LANDSCAPE- AS IT IS INCREASING
AT A RAPID PACE HOUSING HERE.
WE REALLY DO IN CONJUNCTION
WITH THE DEPARTMENT OF
TECHNOLOGY THE MILITARY
DEPARTMENT. CHP THE FBI. AND
THE CYBER SECURITY-
INFRASTRUCTURE. AND SECURITY
NEEDS YOUR SETS UP. BEING
REASONABLE RANSOMWARE ATTACK BY
SEVERAL. SPREAD OUT- ARE JUST
GROWING INCREASE. COMPLEX AND
REALLY DEVASTATING OUR
COMMUNITIES IF WE LOOK AT YOU
KNOW WHAT'S BEEN RECENTLY
MENTIONED HERE BY THE
PANELISTS. THE COLONIAL
PIPELINE IN- JBS- OF THE HOLDS
MORE WATER PLAN YOU KNOW HE'S A
REALLY IMPACTFUL. TO OUR
COMMUNITIES AND OUR ECONOMIES.
HELLO TO BE ARE NOT AWARE ON
MAY EIGHTH COLONIAL ANALYSIS UP
RENTS ATTACK. DISCONNECTING
IT'S I. T. SYSTEMS- TEMPORARILY
STOPPING ALL PIPELINE
OPERATIONS THE OUTAGE RESULTED
IN ICREASED GAS PRICES ON THE
EAST COAST HOWEVER HERE IN
CALIFORNIA WE DID NOT SEE A
SIGNIFICANT IMPACT. TO ADDRESS
THIS IN ALL OF THE OTHER
INCREASING INCIDENCE OF HOUSING
CONTINUES TO WORK. TO ENROLL A
HUNDRED AND TWENTY A HUNDRED
TWENTY CROSS SECTOR CRITICAL
INFRASTRUCTURE ENTITIES WITHIN
THE STATE. TO BOLSTER
CYBERSECURITY RESILIENCY. OUR
SERVICES ARE AIMED AT
PRACTICALLY REDUCING IMMINENT
CYBER RISK AS WELL AS
ADDRESSING SPREAD AWARENESS
THROUGH INTELLIGENCE SHARING.
AND BY PROVIDING EARLY WARNINGS.
DIFICIL TAPE AS THEY CALVET
WORK IN PARTNERSHIP WITH
MULTIPLE ENERGY SECTOR
PROVIDERS INCLUDING INVESTOR
OWNED UTILITIES SUCH AS P. G.
AND EAT IN FACT ACCOUNTS
BECAUSE THEY CAN CAUSE DON'T IN
SHIP OF AN OPERATIONAL
TECHNOLOGY LAB OR ELECTRICAL
SWITCHING INDUSTRIAL CONTROLS
SYSTEM- FROM P. JEANNIE. THE
LAB WILL SERVE AS THE
FOUNDATION OF A STATEWIDE. ICS
INDUSTRIAL CONTROL SYSTEM
SECURITY ANALYTICS PROGRAM
WHICH WOULD GENERATE ICS UP
RELATED TRANSFORMATION IN NEAR.
REAL TIME TO CRITICAL
STAKEHOLDERS. TO SUPPORT THIS
IMPROVE WE MADE A COUPLE OF OCT
KEY INVESTMENTS TOOLS. ASSEMBLY
TO SUPPORT THIS FIRST IS
REQUIRED IN INDUSTRIAL CONTROL
SYSTEM THREAT INTELLIGENCE-
DATA SOURCE WHICH WILL INCREASE
ACTION ABILITY OF THE
INTELLIGENCE WORSENING DOWNS
ICS OPERATORS IN THE STATE-
HELPING THEM MAKE BETTER FASTER
MORE ACCURATE DECISIONS WHEN IT
COMES TO CYBER ATTACK IN THE
WRITING IS THERE- THE SECOND
IS. REAL ESTABLISHED IN A TAX
SERVICE MANAGEMENT CAPABILITY
WHEREBY WE'RE LOOKING TO NARROW
THE APERTURE FOR THOSE CRITICAL
INFRASTRUCTURE ALL PARTNERS FOR
ATTACKERS LOOKING AT THEIR NO
REPORT TO EXPLOIT THEIR NETWORK
SO EFFECTIVELY WE WOULD BE
BOARD OF FLYING- OUR CRITICAL
INFRASTRUCTURE PARTNERS AND OR
SERVICES IN ADVANCE OF. A
SUCCESSFUL INTRUSION ATTEMPTS.
SIMILARLY THE HOUSING IS
DROPPING A CYBERSECURITY
ASSESSMENT FOR THE CALIFORNIA
ENERGY SECTOR THAT'S NATURAL
GAS THAT SPOILED AND THAT'S L.
TRICITY. THIS CMA OVER SOME
JOURNEY ASSESSMENT WILL OUTLINE
THE INDUSTRIES RIGHT AS LINE.
AS WELL AS PROVIDE
RECOMMENDATIONS TO COMBAT THOSE
VERY SAME CYBER. SOMEONE WILL
SAY WILL DRIVE FACTOR HOLDS
WITH THE GOAL DRIVING. RISK
DOWN IS RISK. UP. ADDITIONALLY
THE CAL CONTINUES SIX OUR REACH
AID FOR WITH STATE LOCAL
GOVERNMENT HELP MINIMIZE
IMPACTS AS A RESULT OF
CYBERATTACK. THESE MUTUAL AID
AGREEMENTS FOR THE COUNTY GIVE
NOBODY TO RAPIDLY DEPLOY CYBER
RESOURCES WHEREVER IN THE STATE
TO AFFECTED ENTITIES. OR THREAT
IDENTIFICATION AND DETECTION.
LASTLY AS A PROACTIVE MEASURE
WE ALSO CONDUCT CONTINUOUS
THREAT HUNTING OPERATIONS BASED
ON OUR- GLOBAL THREAT
INTELLIGENCE AND SPECIALIZED
PASSIVE NETWORK TELEMETRY. ARE
FRAGMENTING OPERATIONS. ARE
AIMED AT IDENTIFYING ADVANCED
PERSISTENT THREATS ATTEMPED TO
EXPLOIT DISRUPT AND ORGANIX
STORE. OUR CRITICAL
INFRASTRUCTURE PARTNERS AND
GOVERNMENT OPERATIONS
THROUGHOUT THE STATE OF
CALIFORNIA. BUSINESS OUR WE
HAPPY TO ANSWER ANY QUESTIONS
AT THE END OF THIS A PANEL
THANK YOU. THANK YOU VERY MUCH
AND ON TO THE NEXT WE HAVE THE
TOLLY PUNISH. GOOD AFTERNOON
MADAM CHAIR AND MEMBERS OF THE
COMMITTEE AND THANK YOU FOR
HAVING US TESTIFIED BEFORE YOU
GUYS TODAY. MY NAME IS VITALI
PENICHE AND I'M THE STATE CHIEF
INFORMATION SECURITY OFFICER
OVERSEEING THE EXECUTIVE BRANCH
OF THE STATE OF CALIFORNIA. SO
THE EXECUTIVE BRANCH CONSISTS
OF APPROXIMATELY ONE HUNDRED
THIRTY PLUS DIFFERENT
ORGANIZATIONS REPORTING TO THE
GOVERNOR'S OFFICE. SO MY
OFFICE. IMPLEMENTS AND
FACILITATES SECURITY RISK
MANAGEMENT AND GOVERNANCE FOR
OUR EXECUTIVE BRANCH PARTNERS
WE ARE A WE ARE A DISTRIBUTED
DECENTRALIZED ORGANIZATION SO
IT'S VITAL AND IMPORTANT TO SET
CONSISTENT. STANDARDS
GOVERNANCE PRACTICES AND
CAPABILITIES OUT OF MY OFFICE.
ANOTHER PIECE OF MY OFFICE IS
WE IMPLEMENT SECURITY
OPERATIONS- PRACTICES SO WE RUN
A TWENTY FOUR BY SEVEN SECURITY
OPERATIONS CENTER. ALONG WITH
THAT WE IMPLEMENT AUTOMATION
AND NETWORK SECURITY MONITORING
FOR OUR ON EXECUTIVE BRANCH
ORGANIZATIONS. WITH THE
COLLABORATION AND INTEGRATION
WITH THE CALIFORNIA CYBER
SECURITY INTEGRATION CENTER
CALSONIC WILL ALSO EXCHANGE AND
COOPERATE WITH THREAT
INTELLIGENCE AND INCIDENT
RESPONSE. FOR EXAMPLE AS WAS
MENTIONED EARLIER BY TOM
OSBORNE ADMINISTRATION ALONG
WITH THE LEGISLATIVE SUPPORT AS
FUNDED THE CAL SICK WITH OVER
ELEVEN MILLION DOLLARS AND
THIRTY. THIRTY POSITIONS THIRTY
POSITIONS CONSISTING OF OFFICE
OF EMERGENCY SERVICES STAFF THE
CALIFORNIA DEPARTMENT OF
TECHNOLOGY A SECURITY ANALYST
MILITARY DEPARTMENT AND THE
CALIFORNIA HIGHWAY PATROL. SO
IT'S A- FEDERATED BUT JOINT-
INCIDENT RESPONSE TEAM TO HELP
ANALYZE CYBER THREAT
INTELLIGENCE PREPARE FOR
RESPOND TO AND MITIGATE THREATS
TO THE CALIFORNIA CYBER
INFRASTRUCTURE. SO WE USE THIS
OPPORTUNITY IN THIS TEAM TO
HELP SCALE AND HELP SUPPORT THE
LTTE'S OUR LOCAL JURISDICTIONS
WITH WITHIN OUR STATE. TO DATE
WE HAVE BEEN DEPLOYED AS
JONATHAN UNIONS MENTIONED TO
VARIOUS HUNT TEAM EXERCISES
RESPONSE TO RANSOMWARE EVENTS
AS WELL AS- HELPING
ORGANIZATIONS RECOUP OVER FROM
FROM RANSOMWARE THE LOCAL
JURISDICTIONS. SO THAT HAS BEEN
A HIGHLY VITAL SUCCESS AND HOW
WE MODEL INVESTMENT TO THE
STATE OF CALIFORNIA WHICH WHICH
WE WILL WHICH WE WHO WE ARE
RECOMMENDING TO SCALE AND HELP
PREVAIL THESE TYPES OF EFFORTS
GOING FORWARD. ADDITIONALLY THE
CALIFORNIA DEPARTMENT OF
TECHNOLOGY. ALONG WITH THE
PARTNERSHIP WITH THE DEPARTMENT
OF GENERAL SERVICES WE
FACILITATE- LEVERAGE
PROCUREMENTS AND CONTRACTS FOR
THE STATE OF CALIFORNIA WHICH
ARE ALSO AVAILABLE TO LOCAL
JURISDICTIONS. INCLUDING MINT
MUNICIPAL DISTRICT. SO WE HAVE
THE SOFTWARE LICENSING PROGRAM
WE HAVE FACILITATED CLOUD
CONTRACT SPECIFICALLY CLOUD
SECURITY SERVICES AND TOOLS
UNDERNEATH OUR OUR STATE
PROCUREMENT VEHICLES. WE ALSO
FACILITATE INDEPENDENT SECURITY
ASSESSMENTS WITH THE PARK
PARTNERSHIP OF THE CALIFORNIA
MILITARY DEPARTMENT THEN THAT
IS ANOTHER EXAMPLE WHICH I
WOULD RECOMMEND TO SCALE AND
EXTENT TO THE LOCAL
JURISDICTIONS. SO WE LEVERAGE
THE INDEPENDENT SECURITY
ASSESSMENTS VULNERABILITY
ASSESSMENTS AND PENETRATION
TEST. THAT THE MILITARY
DEPARTMENT PROVIDES FOR OUR
STATE DEPARTMENT SO THAT KINDA
SUCKS THAT'S US IN OBJECTIVE.
STANCE THAT WE COULD THAT WE
COULD MEASURE THE MATURITY OF
OUR STATE ORGANIZATIONS AND
THEN MAP MAP IT TO THE NEXT
CASF IN THIS STATE HUNDRED
SERIES FRAMEWORKS SO THAT'S
KIND OF THE ACCOUNTABILITY
MECHANISM TO A BASELINE THAT WE
LEVERAGE. ALSO UNDERNEATH OUR
STATE PROCUREMENT CONTRACTING
NOW WE HAVE APPLICATION
SERVICES TESTING BE ONBOARDED
IN POINT PROTECTION PLATFORMS
AND EDR ENDPOINT DETECTION AND
RESPONSE. AWARENESS OF SWEETS
AND ANTI PHISHING TRAINING
SERVICES AS PART OF OUR
CONTRACTING VEHICLES THOSE ARE
I MIGHT ADD AGAIN HAND
EMPHASIZED THAT THEY THEY ARE
AVAILABLE TO OUR LOCAL SECTOR
PARTNERS AS WELL. SO WE WILL
CONTINUE DOING WORK IN NYC ON
THE CONTRACTUAL VEHICLE SIDE AS
WELL. DURING THE MONTH OF
OCTOBER THIS EDTA ALONG WITH
THE PARTNERSHIP WITH CELTIC WE
HOST THE ANNUAL CYBERSECURITY
EDUCATION SUMMIT WHICH IS ALSO
OPEN TO THE ACADEMIC SECTOR
INCLUDING MIDDLE SCHOOLS AND
HIGH SCHOOLS. IT'S ALSO OPEN TO
PRIVATE PRIVATE SECTOR AS WELL
SO WE USED AS AN OPPORTUNITY TO
FACILITATE AN INDUSTRY
CONVENING IF YOU WELL SIMILAR
TO THE NATURE OF THIS CONVENING
SO THIS IS ANOTHER OPPORTUNITY
THAT I WOULD ENCOURAGE LOCAL
STILL HEAVILY PARTICIPATE AND-
AS I MENTIONED- MY OFFICE
OFFICE OF INFORMATION SECURITY
WE- WE SIT WITHIN THE STATE
WIDE DATA CENTER. BABY THE
STATE BY DATA CENTER RUNS AND
MAINTAINS. THE CALIFORNIA
GOVERNMENT ENTERPRISE NETWORK
WHICH PROVIDES. CONNECTIVITY TO
OUR A LOOK TO OUR STATE LEVEL
ORGANIZATIONS BUT ALSO WE DO
SERVE ASK CUSTOMERS TO. VARIOUS
LOCAL COUNTIES AND CITIES AND
MISS MUNICIPALITIES. THREE
THROUGH THE C. CHEN THE
CALIFORNIA GOVERNMENT
ENTERPRISE NETWORK THIS IS
WHERE WE IN BED ARE TWENTY FOUR
BY SEVEN SECURITY OPERATIONS
CENTER PRACTICE. SO LEVERAGING
SUCH DATA CENTER SERVICES WILL
AID AND BENEFIT THE- SECURITY
MINUTE MITIGATION PRACTICES OR
SECURITY MITIGATIONS FOR OUR L.
LTT PARTNERS AS WELL. I MIGHT
ADD TO THAT WE DO LEVERAGE AND
INTEGRATE THAT STATEWIDE DATA
CENTERS WELL AS THE NETWORK
WITH THE MS ISAC AS MENTIONED
BY RANDY ROSE EARLIER.
THROUGHOUT FOCAL POINT WE
EXCHANGE THREAT INTELLIGENCE
INFORMATION WITH THE DENNIS I
SECOND BENEFIT FROM FROM A LOT
OF REALLY GREAT SERVICES THERE
AS WELL. SO DEFINITELY WOULD
ENCOURAGE THE LTTE COMMUNITY TO
PARK PARTNER WITH CDT ON ON
THAT FRONT AS IT IS A CONDUIT
AND FOCAL POINT. TO THE
WONDERFUL SERVICES MS ISAC
PROVIDES. AS I MENTIONED. WE DO
CREATE A POLICY AND GOVERNANCE
FRAMEWORK AVAILABLE TO OUR
STATE ORGANIZATIONS. WE PROVIDE
PACKAGED AND- CONCISE SECURITY
STANDARDS PROCEDURES AND
POLICIES. FOR OUR CUSTOMER BASE
AND THAT IS SOMETHING WE ARE
WILLING AND ABLE TO SHARE-
PRIMARILY THROUGH OUR OUTREACH
WITH THE CALIFORNIA COUNTIES.
INFORMATION SERVICES DIRECTORS
ASSOCIATION AND MUNICIPAL
INFORMATION SYSTEMS. CALIFORNIA
WHICH WE HAVE DONE OUTREACH
THROUGH ON IN THROUGHOUT THE
COURSE. COURSE OF THE LAST YEAR
SO I WOULD DEFINITELY ENCOURAGE
AND RECOMMEND TO REACH OUT. TO
MY OFFICE AND CAL SICK THE TO
EXPLORE FURTHER- COLLABORATION
EFFORTS ON THESE FRONTS. AND
I'M HAPPY TO ANSWER ANY
QUESTIONS AT THE END OF THIS
PANEL. THANK YOU VERY MUCH AND
THEN FOR OUR LAST SPEAKER ON
THE LAST PANEL WE HAVE RACHEL
UP PETERSON. GOOD AFTERNOON-
CHAIR OR WON AN HONORABLE
MEMBERS OF THE COMMITTEE THANK
YOU VERY MUCH MY NAME IS RACHEL
PETERSON. I'M THE EXECUTIVE
DIRECTOR OF THE CALIFORNIA
PUBLIC UTILITIES COMMISSION.
FIFTY PC REGULATES THE
PRIVATELY OWNED ELECTRIC GAS
WATER TELECOMMUNICATIONS AND
TRANSPORTATION UTILITIES IN
CALIFORNIA. WITH THE AIM OF
ENSURING THAT THEY DELIVER SAFE
RELIABLE AND AFFORDABLE
SERVICES OF DAILY LIFE HE
CALIFORNIANS. THIS INCLUDES
ENSURING THAT THE CRITICAL
INFRASTRUCTURE OPERATED BY THE
UTILITY. IS PROTECTED FROM
CYBER SECURITY THREATS. THANK
YOU FOR INVITING THE C. P. C.
TO JOIN THE PANEL I'M VERY GLAD
TO BE HERE WITH MY COLLEAGUES
FROM THE CALIFORNIA GOVERNOR'S
OFFICE OF EMERGENCY SERVICES
AND THE CALIFORNIA DEPARTMENT
OF TECHNOLOGY- ALL THROUGHOUT
THE PANELS TODAY YOU. I FELT
THAT THE PALETTE AND REALLY
LAID OUT WELL THE CYBER
SECURITY THREATS THAT THE WORLD
FACES TODAY. WHICH OF COURSE
ARE ONLY GROWING IN COMPLEXITY
AND SCALE. ON THE BASIS OF
OBSERVING THOSE EXPERIENCES I
AT THE TPC WE ARE ACUTELY AWARE
OF THE IMPACT. THAT A CRITICAL
INFRASTRUCTURE CYBER ATTACKS
CAN HAVE ON PEOPLE DAVID BY.
TODAY I WANT TO SPEAK A LITTLE
BIT ABOUT HOW WE USE THE PC
HAVE BEEN WORKING ON
CYBERSECURITY AS AN EMERGING
THREAT FOR UTILITIES. FOR ABOUT
A DECADE. AND TOUCH ON THE
FRAMING QUESTIONS THAT YOU POSE
TO OUR PANEL. OVERALL WE
PURSUED A THREE PRONGED
APPROACH CHURCH THAT FOSTERING
POLICY EXPERTISE. SECOND USING
THAT POLICY EXPERTISE TO BUILD
OUR UTILITY REGULATORY
FRAMEWORK AND THIRD SERVING IN
A SUPPORTING AND PARTNER ROLE
TO CAL- YES AND TO WORK WITH
YOUR AGENCIES DURING CYBER
INCIDENT AND DURING STEADY
STATE OPERATION. FIRST AS TO
FOSTERING POLICY EXPERTISE IN
TWENTY TWELVE THE CPUC
PUBLISHED A POLICY PAPER THAT
RECOGNIZED SORRY SIDE WITH THE
KERRY AT THE THEORY OF THE
EMERGING THREATS FOR UTILITIES.
THE PAPER ADDRESSED THE
IMPORTANCE OF THE FEDERAL
GOVERNMENT STANDARDS FOR
CYBERSECURITY REGULATIONS
SPECIFICALLY THE NORTH AMERICAN
ELECTRIC A LOT RELIABILITY
CRITICAL INFRASTRUCTURE AND-
CRITICAL INFRASTRUCTURE
PROTECTION REQUIREMENT OR
NURKIC. OF INTEREST I THINK TO
THIS COMMITTEE IN OUR PAPER WE
NOTICED WE NOTED THAT NURKIC
SHIP REQUIREMENTS ARE PRIMARILY
A COMPLIANCE BASED POLICY
COMPLIANCE IS AN IMPORTANT
COMPONENT OF ADDRESSING
CYBERSECURITY BUT IT'S NOT
ENOUGH AS YOU HEARD FROM OTHER
PANELISTS TODAY TO ENSURE THAT
THE RAPIDLY EVOLVING CYBER
RISKS ARE ADEQUATELY CONSIDERED
AND ACTED UPON EFFECTIVELY.
THEREFORE WE RECOMMENDED A RISK
MANAGEMENT AND RISK ASSESSMENT
BEACH BASED APPROACH FOR
UTILITIES AND REALLY WERE
LOOKING TO SERVE TWO PURPOSES
FIRST MAXIMIZE THE
RESPONSIVENESS TO CHANGING
THREATS AND SECOND WORK OVERALL
TOWARD A CRITICAL
INFRASTRUCTURE SYSTEM THAT IS
DESIGNED TO BE RESILIENT.
FOLLOWING THAT PAPER. AND. IN
TWENTY FIFTEEN THE BBC
INSTITUTED A RISK ASSESSMENT
AND RISK MANAGEMENT
REQUIREMENTS FOR ELECTRIC AND
GAS UTILITIES AND THE CRITICAL
INFRASTRUCTURE THAT THEY
OPERATE. IT'S GOING TO ONE OF
YOUR TRAINING QUESTIONS ABOUT
INCENTIVIZING ARCHAEOLOGY IN
THE NEED FOR PRIVATE UTILITY
TREND THAT THE INTEGRITY
CARRIED THE TO MAINTAIN
RELIABLE SERVICES. THE ANSWER
IS VERY MUCH YET. BEFORE EACH
UTILITY BEGAN ITS BUDGET KATIE
CORA WHICH THEY BRING TO US
EVERY FOUR YEARS THOSE ARE
CALLED THE GENERAL RATE CASES
AND WE ACTUALLY REQUIRE THEM TO
PRESENT A RISK ASSESSMENT AND
MITIGATION SAY TO US STARTING
WELL IN ADVANCE OF THEIR-
PRIMARY BUDGET KATE. DURING
THAT PHASE THE UTILITY MUST
IDENTIFY RISK ESTIMATE PROBABLY
PROBABILITIES AND CONSEQUENCES
OF THOSE TRIPS. AND PROPOSED
FUNDING FOR THE PACIFIC
MEDICATION. THIS INCLUDES
CYBERSECURITY BRETT. OUR TEAM
THEN EITHER ARE YOU WAIT THE
UTILITIES RISK ASSESSMENT AND
PROPOSED MITIGATION. AND THOSE
THAT EVALUATION FORMS PART OF
THE PROCESS OF DELIBERATING ON
THE UTILITIES PROPOSAL IN THEIR
PROJECTS. NEXT I'LL TURN TO OUR
GOVERNMENT PARTNERSHIPS AND OUR
UTILITY REGULATORY FRAMEWORK
BEYOND THAT BUDGET CASE. IN OUR
GOVERNMENT PARTNERSHIPS WE ARE
IN ACTIVE COMMUNICATION AND
COORDINATION WITH CAL- YEAH.
FIFTY P. THE U. S. DEPARTMENT
OF ENERGY'S OFFICE OF
CYBERSECURITY ENERGY SECURITY
AND EMERGENCY RESPONSE. AS WELL
AS THE NATIONAL ASSOCIATION OF
REGULATORY COMMISSIONS ARE
NEIGHBORS AND OTHER STATE AND
FEDERAL AGENCIES. WE EQUALLY
VIEW THAT LEVEL OF COORDINATION
AND PARTNERSHIP- EXCEEDINGLY
IMPORTANT IN THE THREE NOT AT-
MY CO PANELISTS POINTED OUT.
THEN WITH RESPECT TO THE
UTILITIES THAT ARE UNDER OUR
JURISDICTION WE ARE MONITORING-
THEIR CYBERSECURITY SAFEGUARDS
AND BOLSTERING THEIR OVERALL
RESILIENCY TO CYBER ATTACKS.
SOME OF THE PRIMARY AREAS OF
CONCERN THAT WE HAVE GOT- RIGHT
NOW INCLUDE HUMAN ERRORS THAT
YOU COURAGE AS WELL AS THE
GROWING ATTACK SURFACE WHICH IS
A RISK THAT IS EXPANDED AS WE-
HAVE CONTINUE TO DEPLOY NETWORK
AND FIBER ENABLED AND OPERATED
DISTRIBUTED ENERGY TECHNOLOGIES.
ANOTHER EMERGING CONCERN ARE
THE CYBER PHYSICAL SYSTEMS THAT
HAVE BLURRED THE BOUNDARIES
BETWEEN PHYSICAL SECURITY AND
CYBERSECURITY. SO THIS ALSO GO
TO ONE OF YOUR FRAMING
QUESTIONS ABOUT RESOURCES BEING
OFFERED TO UTILITIES- THAT
PROVIDE THESE ESSENTIAL
SERVICES TO CALIFORNIA. DURING
CYBER INCIDENTS THE- AND THAT
TYPE WITH THE KERRY TEAM WITHIN
THE CPC ACTIVELY COORDINATES
AND COLLABORATES WITH CAL- OH
YESS CAL THANK. YOU SERVE IN A
SUPPORT ROLE THERE AND TO THAT
END WE ARE CREDENTIALED CYBER
SECURITY STAFF PROVIDE DIRECT
SUPPORT AS REQUESTED BY CELTIC-
WE LOOK TO PROVIDE INDUSTRY
SPECIFIC INSIGHT AND ENSURE
THAT CELTIC RECEIVES THE
NECESSARY INFORMATION. FROM THE
UTILITIES UNDER OUR REGULATION
TO ADDRESS THAT FIBER
INCIDENTS. WE PLAYED THAT THE
COURT WELL RECENTLY DURING
SOLAR WHEN THE MICROSOFT
EXCHANGE ATTACK AND. THE
COLONIAL PIPELINE. AND ANOTHER
YOUR PRINTING QUESTION YES OUR
DO OTHER ALL FIVE MINUTES
FRAMEWORK FUNCTION IDENTIFY
PROTECT DETECT RESPOND AND
RECOVER. AGAIN THE UTILITIES
ARE RESPONSIBLE FOR ASSESSING
THEIR RISK IN THOSE FIVE AREAS
AND PRIORITIZING ACTIONS TO
MITIGATE THOSE RISKS. BUT WE
USE THAT SAME FRAMEWORK IN
ORDER TO EVALUATE THEIR
CAPABILITY. INCLUDING THE CITY
STATE IS HERE TO WORK AT
PARTNERED WITH CALORIE S. B. E.
T. THIS COMMITTEE THE
LEGISLATURE TO ADDRESS THE KEY
CHALLENGES THAT WE'RE FACING-
BOTH AS STATE REGULATORS OF
ESSENTIAL SERVICES. AND THAT'S
PARTNER STATE PARTNERS AND IT'S
IMPORTANT AFTER THANK YOU VERY
MUCH AGAIN FOR THE CHANCE TO
APPEAR AND I'M HAPPY TO ANSWER
ANY QUESTIONS. THANK YOU MISS
PETERSON AND- ONE OF THE THINGS
THAT WE HEARD FROM THE-
UTILITIES AND ESPECIALLY THE
SMALL WATER DISTRICT IS- THE
LACK OF FUNDING AND SO I WAS
WONDERING WHETHER YOU COULD
ANSWER OR- ANY OF OUR OTHER
THREE PANELISTS MAYBE TALK
ABOUT- APPLICABLES GRANTS OR
FUNDING STREAMS TO SHARE WITH.
A LOCAL GOVERNMENTS OR
UTILITIES FOR CYBER SECURITY
PURPOSES AND I ASSUME THAT THAT
WOULD REALLY BE. TOM. I WAS SET
UP THEIR FIRST SECOND YEAH
THERE'S DIFFERENT DIFFERENT
OPPORTUNITIES TO THAT HOME IS
PRETTY GRANT PROGRAM WE DON'T
INCREASING CYBERSECURITY AND
RESILIENCE OP THAT MONEY SLOW
DOWN THROUGH THE FENCE AND SO
TO THAT END- DIFFERENT GRANTS
CAN BE MADE AVAILABLE TO HELP.
AND LOCAL STATE GOVERNMENT
SOCKET IS THERE IS ONE AVENUE
AS WELL AS IN ROLLING. INTO
VARIOUS DIFFERENT PLATFORMS
THAT WE CURRENTLY HAVE- TODAY
THAT IS THAT LITTLE CHU CHU NO
COST SO MUCH- IS A SIMPLE AS
REACHING OUT TO US AND WE CAN
WORK- WHATEVER AGENCY YOU MAY
WANT YOU OUT PARTNER UP WITH
US. ARE ARE YOU DOING ANY OF A
PROACTIVE REACHING OUT TO THESE
SMALLER UTILITIES TO LET THEM
KNOW OR OR DO THEY REALLY NEED
TO- TAKE THE INITIATIVE ON THAT.
BOTH TO BE HONEST IS THAT YOU
KNOW IF YOU ARE CRITICAL OF THE
STRUCTURE- PROTECTION PROGRAM
THEY MAINTAINING YOU KNOW THE
RELATIONSHIPS THERE YOU KNOW ON
THE GROUND. I'M FROM A PHYSICAL
ASPECT AND NOW I'M SEEING NOW
WITH THE SAME SECURITY ASPECTS
SO THAT IS ONE- AVENUE. OF
APPROACH AND IN DIALOGUE EXISTS
THERE IF YOU ARE GRANT FUNDING
GROUP WHO HAVE- CONTACTS WITH
THE COUNTIES- IS ANOTHER WAY
ANOTHER AVENUE FOR RICH PEOPLE
CAN CONNECT. IN THAT REGARD SO
IT REALLY IS IN BOTH WAYS. OKAY
AND THEN THE- I'M I'M NOT SURE
I ASSUME YOU CAN ANSWER THIS TO
WHAT IT WHAT COORDINATION OR
OR- ONE OF THE STATE FOLKS.
WHAT IS THE- YOUR WHAT IS YOUR
COORDINATION LEVEL WITH THE
CYBERSECURITY AND
INFRASTRUCTURE. SECURITY AGENCY.
YEAH I'LL START. YOU KNOW JOHN
THINKING ADD OR EVEN MENTALITY
BUT THIS MOST RECENTLY- WE NOW
HAVE BEEN IN BAD WITH US SINCE
OUR STATE TIME ANALYST SO. THIS
PERSON- IS BASICALLY SITTING
WITH US TO BETTER CONNECTS-
WITH OUR FEDERAL PARTNERS ON
CYBER THREAT INTELLIGENCE
INCIDENT RESPONSE AND ALL THE
OTHER PROGRAMS THAT THE FEDERAL
GOVERNMENT CAN BRING TO. HELP
MITIGATE THE SPREAD SO GREAT
STRIDES IN SYSTEM AND ADDING
THE- RESOURCES TO. BE EMBEDDED
WITH WHAT THE CAL SIX. DO WE
HAVE ANY OTHER. COMMENTS ON
THAT ISSUE. NO NO I GO WHAT
WHAT TIME IS MENTIONED I WILL
EXPLORE THAT WE AREN'T EARLY
CONVERSATIONS WITH SYSTEM
AROUND ESTABLISHING INCIDENT
RESPONSE SUPPORT. SIMPLY FOR
THE STATE OF CALIFORNIA SO WE
CONTINUE THAT DIALOGUE AS WELL.
THANK YOU AND I REALLY WANT TO
THINK OF IF EVERYBODY THAT
JOINED US TODAY ON ALL THREE OF
THE PANELS AND UP. WE ARE GOING
TO MOVE TO THE PUBLIC COMMENT
PORTION OF THE AGENDA. AND I
WOULD LIKE TO REMIND ANYBODY
THAT MIGHT BE ON THE PHONE TO.
IDENTIFY YOUR NAME AFFILIATION
AND TO KEEP YOUR COMMENTS BRIEF
AS A REMINDER THE PUBLIC TOLL
FREE CALL IN NUMBER FOR THIS
HEARING IS ONE EIGHT SEVEN
SEVEN. SIX NINE TWO EIGHT NINE
FIVE SEVEN. AND THE ACCESS CODE
IS ONE THREE ONE FIVE FOUR. TWO
OH TWO. AND I WANTED TO ASK IF
THERE ARE ANY WITNESSES IN THE
HEARING ROOM OR IN THE GALLERY
THAT WOULD LIKE TO SPEAK.
SEEING NONE WHY DON'T WE MOVE
TO THE PHONE LINES AND ALL
ASKED THE MODERATOR IF THERE
ARE ANY OF THE CALLERS ON THE
PHONE FOR PUBLIC COMMENTS. IN
THE QUEUE. THANK YOU. THANK YOU
MADAM CHAIR OUR LADY GERMAN THE
PHONE LINES IF YOU WOULD LIKE
TO MAKE PUBLIC COMMENT AT THIS
TIME PLEASE PRESS ONE FOLLOWED
BY THIS ONE FILED BY ZERO DOWN
AT T. OPERATORS GOING TO GIVE
YOU YOUR LINE NUMBER OFFLINE
AND THEN PLACE IT BACK IN THE
QUEUE. ONCE AGAIN FOR PUBLIC
COMMENT PLEASE PRESS ONE
FOLLOWED BY ZERO AT THIS TIME.
AND THE FINAL REMINDER PLEASE
PRESS ONE ZERO FOR PUBLIC
QUEUING UP ALL RIGHT WELL IT
SOUNDS LIKE EVERYBODY'S
QUESTIONS WERE ANSWERED TODAY
SO- FIRST I WOULD LIKE TO THANK
THE MODERATOR- THIS WAS A TOUGH
PANEL A LOT OF PEOPLE SPEAKING
AND IT WENT VERY SMOOTHLY SO
THANK YOU THANK YOU MEMBERS OF
THE COMMITTEE FOR. JOINING
TODAY- AND ESPECIALLY OF THE
BIG THANKS TO ALL OUR PANELISTS
THE INFORMATION THAT WAS HERE
TODAY WAS IMPORTANT TO ENSURE
THAT WE'RE DOING EVERYTHING WE
CAN TO SAFEGUARD CALIFORNIA'S
CRITICAL INFRASTRUCTURE FROM.
CYBER THREATS AND I LOOK
FORWARD TO CONTINUE DIALOGUE
WITH ALL THE PANELISTS AS- WE
TURN THE INFORMATION THAT WE
LEARNED TODAY POTENTIALLY INTO
LEGISLATION OR BUDGETARY
ACTIONS AND- WITH THAT- TO PUT
TO DO YOU HAVE ANY. COMMENTS NO
I JUST WANTED TO THANK THE
CHAIR FOR THE SESSION. AND
THANK ALL THE PANELISTS FOR A
WELL- INFORM. I MEAN IS IT WAS
WELL PLANNED OUT AND- I
APPRECIATE I APPRECIATE THE
SESSION TODAY WE GET THANK YOU
THANK THANK YOU VERY MUCH
ASSEMBLY MEMBER AND- WITH THAT
THIS HEARING OF THE ASSEMBLY
SELECT COMMITTEE ON CYBER
SECURITY IS ADJOURNED.