CYBERSECURITY STRATEGY REPORT Prepared by the Energy and Commerce Committee, Majority Staff December 7, 2018 energycommerce.house.gov Table of Contents I. Introduction ............................................................................................................................ 2 A. The Subcommittee’s Cybersecurity Concepts and Priorities.............................................. 2 B. The Subcommittee’s Cybersecurity Work .......................................................................... 3 II. Coordinated Disclosure: Because There Will Always Be Unknown Unknowns ................ 11 A. Concept: There Will Always Be Unknown Unknowns .................................................... 11 B. Priority: Coordinated Disclosure ...................................................................................... 12 III. Software Bill of Materials: Because You Can’t Protect What You Don’t Know You Have .................................................................................................................................. 13 A. Concept: You Can’t Protect What You Don’t Know You Have ...................................... 13 B. Priority: Software Bill of Materials .................................................................................. 13 IV. Supporting Open-Source Software: Because Software Is No Longer Written, But Assembled ......................................................................................................................... 15 A. Concept: Software is No Longer Written, But Assembled ............................................... 15 B. Priority: Supporting Open-Source Software ..................................................................... 16 V. The CVE Program: Because There Must Be a Common Cybersecurity Language ............ 17 A. Concept: There Must Be a Common Cybersecurity Language ........................................ 17 B. Priority: The CVE Program .............................................................................................. 18 VI. Supported Lifetimes: Because Digital Assets Age Faster and Less Predictably Than Physical Ones .................................................................................................................... 19 A. Concept: Digital Assets Age Faster and Less Predictably Than Physical Ones ............... 19 B. Priority: Supported Lifetimes ........................................................................................... 19 VII. The Public-Private Partnership Model: Because Cybersecurity Requires a “Whole-of- Society” Approach ............................................................................................................ 21 A. Concept: Cybersecurity Requires a “Whole-of-Society” Approach ................................. 21 B. Priority: The Public-Private Partnership Model ............................................................... 21 VIII. Conclusion .......................................................................................................................... 23 1 I. Introduction A. The Subcommittee’s Cybersecurity Concepts and Priorities In today’s connected world, where nearly all devices—from the phones in our pockets, to the refrigerators in our kitchens, to the multi-million-dollar equipment that runs our electric grid— are linked together through the Internet, cybersecurity has at once become a household term and one of the most complicated, difficult issues facing society. Once a topic seen mostly as a nuisance, requiring the occasional password reset or new credit card, cybersecurity now regularly makes headlines as the Internet and connected technologies have become not only economic, diplomatic, and military tools, but integral parts of our daily lives. However, even as the Internet has rapidly developed to become a vital part of modern society, it appears that the integration of effective cybersecurity has not kept pace. Recognizing this reality, the Oversight and Investigations Subcommittee has spent the past several years analyzing certain cybersecurity issues with impacts across the Energy and Commerce Committee’s broad jurisdiction. Several patterns have emerged from the Subcommittee’s work. Regardless of industry, size, or sophistication, the cybersecurity challenges organizations face are largely the same. Further, traditional information technology (IT) strategies seem largely ineffective at stemming the growing tide of cybersecurity incidents—which now range from ransomware attacks that can hold an entire company hostage to hackers’ exploitation of a security vulnerability in the latest cellphone model. These observations raise two important questions for the Subcommittee: (1) What are the common, root-cause origins of cybersecurity incidents? (2) If traditional IT strategies have proven ineffective, what can organizations do to better strengthen their cybersecurity capabilities? With regard to the first question, through dozens of briefings, hearings, letters, reports, and roundtables, the Subcommittee identified six interrelated, core cybersecurity concepts that contribute to cybersecurity incidents: Concept 1: There will always be unknown unknowns. Concept 2: You can’t protect what you don’t know you have. Concept 3: Software is no longer written, but assembled. Concept 4: There must be a common cybersecurity language. Concept 5: Digital assets age faster and less predictably than physical ones. Concept 6: Cybersecurity takes a “whole-of-society” approach. 2 The identification of these principles shaped the Subcommittee’s approach to cybersecurity and guided subsequent work. As each of these concepts emerged, the Subcommittee began exploring and analyzing possible strategies for addressing them. This effort allowed the Subcommittee to answer the second question, and culminated in six priorities: Priority 1: The widespread adoption of coordinated disclosure programs. Priority 2: The implementation of software bills of materials across connected technologies. Priority 3: The support and stability of the open-source software ecosystem. Priority 4: The health of the Common Vulnerabilities and Exposures (CVE) program. Priority 5: The implementation of supported lifetimes strategies for technologies. Priority 6: The strengthening of the public-private partnership model. Identifying these priorities was not enough; over the past several years, the Subcommittee has produced individual products related to each of these priorities that address each of their associated core cybersecurity concepts: B. The Subcommittee’s Cybersecurity Work The Oversight and Investigations Subcommittee’s work on these topics began in earnest in 2013, following two major IT-related incidents within the Energy and Commerce Committee’s jurisdiction: the data breach at Target that compromised nearly 110 million user records and the launch of healthcare.gov.1 These issues, along with several other massive data breaches and high- profile cybersecurity incidents across several sectors within the Committee’s jurisdiction— including in the automotive, medical, and commercial sectors—raised several questions about the efficiency and efficacy of IT and cybersecurity practices.2 At the same time, complex legal issues were arising at the intersection of technology and the justice system, to which the Committee responded by participating in the Joint Encryption Working Group with the Committee on the Judiciary.3 As this work continued, the Subcommittee began to hone in on the common concepts and priorities identified above, and began producing work related to each. 1 Brian Krebs, The Target Breach, By the Numbers, KREBS ON SECURITY (May 6, 2014), https://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/; Sean Gallagher, The seven deadly sins of HealthCare.gov, ARS TECHNICA (OCT. 29, 2013), https://arstechnica.com/information-technology/2013/10/the- seven-deadly-sins-of-healthcare-gov/. 2 Taylor Armerding, The 17 biggest data breaches of the 21st century, CSO (Jan. 26, 2018), https://www.csoonline.com/article/2130877/data-breach/the-biggest-data-breaches-of-the-21st-century.html; Dan Goodin, Newly discovered flaw undermines HTTPS connections for almost 1,000 sites, ARS TECHNICA (Feb. 9, 2017), https://arstechnica.com/information-technology/2017/02/newly-discovered-flaw-undermines-https- connections-for-almost-1000-sites/; Andy Greeberg, Hackers Remotely Kill a Jeep on the Highway—With Me In It, WIRED (July 21, 2015), https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/; Hospital drug pumps are hackable, experts warn, BBC (June 9, 2015), https://www.bbc.com/news/technology-33063345. 3 Encryption Working Group Year-End Report, H. COMM. ON ENERGY & COMMERCE, H. COMM. ON THE JUDICIARY (Dec. 20, 2016), https://judiciary.house.gov/wp-content/uploads/2016/12/20161220EWGFINALReport.pdf. 3 1. Subcommittee Work Related to Coordinated Disclosure The Oversight and Investigations Subcommittee’s work on coordinated disclosure was prompted by both progress and controversy in the public and private sectors on the topic, including guidance for industry released by the Food and Drug Administration released in October 2014 regarding management of cybersecurity in medical devices and media reports regarding vulnerabilities in medical devices and automobiles.4 In November 2015, the Subcommittee held a staff-level roundtable attended by private sector stakeholders to examine coordinated disclosure and its challenges and opportunities.5 Focused specifically on coordinated disclosure within safety critical sectors like automotive and medical devices, it brought together experts to discuss how standard coordinated disclosure practices can or should be evolved to better address these sectors’ equities and risks. Following a high-profile, non-coordinated disclosure involving a medical device in 2016, the Subcommittee held a second roundtable in February 2017 to encourage further engagement with and development of the topic.6 In January 2018, the Energy and Commerce Committee sent letters to seven information technology companies—Amazon, AMD, Apple, ARM, Google, Intel, and Microsoft—involved with the largest known coordinated vulnerability disclosure to date: the discovery and disclosure of cybersecurity vulnerabilities Spectre and Meltdown, which could enable the unauthorized disclosure of sensitive information relying on modern chipsets.7 The letters commended the stakeholders’ embrace of coordinated disclosure while also highlighting potential concerns and the need for continuous evolution and improvement. For example, the Committee was concerned that the information embargo imposed by some letter recipients may have disadvantaged other affected companies that needed to respond to both vulnerabilities. In addition, the Committee was concerned that critical infrastructure equities may not have been fully considered during the letter recipients’ decisions regarding disclosure timelines due to the fact that critical infrastructure owners and operators must often test patches for weeks or months before implementation, rather than the hours or days provided during the Spectre and Meltdown disclosure. Each recipient of the letter provided a written response and a briefing to Committee 4 Content of Premarket Submissions for Management of Cybersecurity in Medical Devices: Guidance for Industry and Food and Drug Administration Staff, THE FOOD & DRUG ADMIN. (Oct. 2, 2014), https://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm356190.pdf (FDA embrace of coordinated disclosure for medical devices); Charlie Osborne, Hackers control medical pumps to administer fatal doses, ZD NET (June 9, 2015), https://www.zdnet.com/article/hackers-can-control-medical-pumps- to-administer-fatal-doses/ (public disclosure of cybersecurity flaw after disagreement between researcher and company); Andy Greeberg, Hackers Remotely Kill a Jeep on the Highway—With Me In It, WIRED (July 21, 2015), https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/; Hospital drug pumps are hackable, experts warn, BBC (June 9, 2015), https://www.bbc.com/news/technology-33063345 (hackers disable car engine driven by report on public highway). 5 U.S. Committee on Energy & Commerce, Roundtable on Coordinated Disclosure, November 2015. 6 Sean Gallagher, Trading in stock of medical device paused after hackers team with short seller, ARS TECHNICA (Aug. 26, 2016), https://arstechnica.com/information-technology/2016/08/trading-in-stock-of-medical-device- paused-after-hackers-team-with-short-seller/; U.S. Committee on Energy & Commerce, Roundtable on Coordinated Disclosure, February 2017. 7 Letters from the Hon. Greg Walden, Hon. Tim Murphy, Hon. Marsha Blackburn, and Hon. Robert E. Latta, H. Comm. on Energy and Commerce, to Apple, Inc., Amazon, Advanced Micro Devices, Inc., ARM Holdings, PLC, Google, Inc., Intel Corp., and Microsoft Corp. (Jan. 24, 2018). 4 staff. The recipients acknowledged the Committee’s concerns and provided additional insight and context into their decision-making processes, and pledged to continue working to improve coordinated vulnerability disclosure practices. In July 2018, along with the Senate Committee on Commerce, Science, and Transportation, the Committee sent a letter to CERT Coordination Center following up on concerns raised about coordinated vulnerability disclosure (CVD) practices in the wake of Spectre and Meltdown.8 The letter raised two potential gaps in the CVD process here based on the Committees’ work involving this vulnerability: (1) whether the CVD process was adequately coordinated to ensure that companies, particularly those providing critical infrastructure, had enough time to test and implement patches prior to public disclosure of the vulnerabilities and that the U.S. government received timely notice of the CVD process; and (2) whether companies used precise terminology in describing the availability, not application, of patches. This latter distinction remains important with regard to patching issues, as a patch may be “available” without an affected user having “applied” it, which leaves the user unprotected. By using the two terms interchangeably, the Committees were concerned that organizations providing patches may have provided a false sense of security to users and the general public. In October 2018, the Committee released a white paper entitled “The Criticality of Coordinated Disclosure in Modern Cybersecurity.”9 This white paper announced the Committee’s support for coordinated vulnerability disclosure, explaining that such programs are a necessity for organizations in a society so heavily dependent on massively complex information systems and networks like the Internet and other connected technologies. It made two recommendations: that Congress clarify the legal environment in which coordinated vulnerability disclosures take place and that it find ways to support and encourage organizations to adopt such programs. 2. Subcommittee Work Related to Software Bill of Materials In March 2017, an outbreak of the type of file-encrypting malware known as “ransomware” spread quickly across the globe, infecting hundreds of thousands of devices in dozens of countries in a matter of hours.10 Dubbed “WannaCry,” this strain of ransomware leveraged a powerful and widespread flaw in a popular computing operating system to spread quickly from device to device.11 Most notably, the flaw was not a “zero-day,” or unknown flaw, but one for which a patch had been available for months. However, many organizations were unaware of their exposure to the flaw due to the “black-box” nature of many medical technologies. 8 Letter from the Hon. Greg Walden, H. Comm. on Energy & Commerce, and the Hon. John Thune, Sen. Comm. on Commerce, Science, & Transportation, to CERT/CC. (July 17, 2018). 9 The Criticality of Coordinated Disclosure in Modern Cybersecurity, H. Comm. on Energy & Commerce (Oct 23, 2018), https://energycommerce.house.gov/wp-content/uploads/2018/10/10-23-18-CoDis-White-Paper.pdf. 10 See Memorandum to Members, Subcommittee on Oversight and Investigations, Hearing on “Examining the Role of the Department of Health and Human Services in Health Care Cybersecurity,” June 6, 2017, available at https://docs.house.gov/meetings/IF/IF02/20170608/106078/HHRG-115-IF02-20170608-SD011.pdf. 11 Id. 5 WannaCry thus lent additional weight and urgency to a recommendation in a joint report from the public and private healthcare sectors, “Report on Improving Cybersecurity in the Health Care Industry”, that was released in June 2017. The report made a series of recommendations for how the healthcare sector could better prepare for cybersecurity threats, including on software bill of materials, which directly addresses the type of challenge highlighted by WannaCry. The Task Force explained this recommendation, stating: Having a “bill of materials” is key for organizations to manage their assets because they must first understand what they have on their systems before determining whether these technologies are impacted by a given threat or vulnerability. Moreover, this transparency enables health care providers to assess the risk of medical devices on their networks, confirm components are assessed against the same cybersecurity baseline requirements as the medical device, and implement mitigation strategies when patches are not available.12 In response to the outbreak, report, and other related Subcommittee work, the Energy and Commerce Committee held a roundtable in August 2017 to discuss the opportunities and challenges presented by the recommendation to begin leveraging “bills of materials” in the healthcare sector.13 Following that initial conversation, in November 2017, the Committee sent a letter to the Department of Health and Human Services (HHS) requesting that HHS convene an industry-wide process to find ways to develop, implement, and leverage software bill-of- materials (SBOM) across the health care sector.14 In its response to the Committee, HHS set out their timetable to launch such a process:15 By July 30, 2018: Announce the software BOM effort work stream to be conducted under the Healthcare Sector Coordinating Council (HSCC) MedTech Cyber Security Risk Management Task Group 1B. By November 30, 2018: Publish Federal Register notice for public meeting By January 26, 2019: Publish proposed agenda for public meeting February 25, 2019: Hold public meeting (draft deliverables will be vetted in a public setting) 12 Report on Improving Cybersecurity in the Health Care Industry, HEALTH CARE INDUSTRY CYBERSECURITY TASK FORCE, June 2017, https://www.phe.gov/preparedness/planning/cybertf/documents/report2017.pdf. 13 U.S. Committee on Energy & Commerce, Roundtable on Software Bills of Materials, August 2017. 14 Letter from the Hon. Greg Walden, Hon. Tim Murphy, Hon. Marsha Blackburn, and Hon. Robert E. Latta, H. Comm. On Energy and Commerce, to the Hon. Eric D. Hargan, Deputy Secretary, Dept. of Health & Human Services (Nov. 16, 2017), https://energycommerce.house.gov/wp-content/uploads/2017/11/20171116HHS.pdf. 15 Letter from Matthew D. Bassett, Assistant Secretary for Legislation, Dept. of Health & Human Services, to the Hon. Greg Walden, Hon. Frank Pallone, Jr., and Hon. Diana DeGette, H. Comm. on Energy & Commerce (Sept. 18, 2018), https://energycommerce.house.gov/wp-content/uploads/2018/09/091718-HHS-Reply-to-Chairman- Walden.pdf. 6 By August 24, 2019: Publish meeting summary to include responses to any recommendations made at the meeting or in the docket for the meeting 3. Subcommittee Work Related to Open-Source Software As modern information systems and products have continued to grow in scale, sophistication, and complexity, the Subcommittee’s work recognized the critical importance that open-source software (OSS) plays. The Energy and Commerce Committee sent a letter in April 2018 to the Linux Foundation, which leads an organization dedicated to the health and stability of OSS, requesting additional information on how OSS may be better supported.16 The letter acknowledged that OSS has become “critical cyber infrastructure” and that, consequently, “the sustainability and stability of the OSS ecosystem is essential to the sustainability and stability of organizations’ cybersecurity generally.”17 The Linux Foundation responded on April 23, 2018, agreeing with the Committee’s assessment and stating “it is the collective responsibility—and imperative—for business, industry, academic and technology leaders to work together to ensure that OSS is written, maintained and deployed as securely as possible” and “[i]t is essential that the corresponding OSS communities are supported and properly enabled to be proactive enough to manage future security challenges that will arise over time.”18 4. Subcommittee Work Related to the Common Vulnerabilities and Exposures Program While cybersecurity strategies, policies, and procedures remain largely individualized from organization to organization, there exist some foundational cornerstones that all such programs require. One of those cornerstones is the Common Vulnerabilities and Exposures (CVE) program, the standardized naming scheme for cybersecurity vulnerabilities the world over. In 2016, public reports emerged that the CVE program was struggling to fulfill its purpose and meet stakeholder needs.19 In response, beginning in March 2017 and culminating in August 2018, the Energy and Commerce Committee investigated the health and stability of the CVE program. In March 2017, the Committee requested documentation from the program’s responsible organizations, DHS and 16 Letter to Mr. Jim Zemlin, Executive Director, the Linux Foundation, from the Hon. Greg Walden and Hon. Gregg Harper, H. Comm. on Energy and Commerce (Apr. 2, 2018), https://energycommerce.house.gov/wp- content/uploads/2018/04/040218-Linux-Evaluation-of-OSS-Ecosystem.pdf. 17 Id. 18 Id. 19 Catalin Cimpanu, CVE System Sees Huge Backlog, Researchers Propose Alternative, SOFTPEDIA, Mar. 12, 2016, http://news.softpedia.com/news/cve-system-sees-huge-backlog-researchers-propose-alternative-501665.shtml; Sean Sposito, CVE, a key cybersecurity resource, is at risk inside and out, SAN FRANCISCO CHRONICLE, Mar. 25, 2016, http://www.sfchronicle.com/business/article/CVE-a-key-cybersecurity-resource-is-at-risk-7107509.php; CSO, Over 6,000 vulnerabilities went unassigned by MITRE’s CVE project in 2015, CSO ONLINE, Sep. 22, 2016, http://www.csoonline.com/article/3122460/techology-business/over-6000-vulnerabilities-went-unassigned-by- mitres-cve-project-in-2015.html. 7 MITRE, including all contracts associated with the CVE program and any timelines, analyses, or other relevant documentation detailing the oversight both organizations had performed throughout the program’s lifetime.20 In August 2018, the Committee sent a second letter to DHS and MITRE summarizing the findings of the investigation, including that the contract vehicle for the CVE program was awarded or modified 30 times in nearly seven years, that funding for the program varied acutely, and that neither DHS nor MITRE conducted substantial oversight of the program.21 The second letter made recommendations to both organizations based on the produced documentation, mainly that DHS should transition the CVE program to a dedicated Program, Project, or Activity funding model, and that DHS and MITRE should perform biennial reviews of the CVE program to ensure its effectiveness and stability.22 In September 2018, the Cyber Threat Alliance and the Cybersecurity Coalition, two groups comprised of cybersecurity companies and experts dedicated to advancing and improving robust cybersecurity practices and policies, expressed agreement with the recommendations made to DHS and MITRE. In a letter to the Committee, the groups wrote, “The Committee’s August 27th letters noted the CVE program’s importance, referring to it as ‘critical cyber infrastructure.’ We concur with the Committee’s assessment.”23 5. Subcommittee Work Related to Supported Lifetimes The ransomware outbreak known as WannaCry, followed closely by an outbreak of an even more destructive strain of malware known as NotPetya, highlighted the cybersecurity risks that the use of old, outdated technologies pose. In recognition of both that fact, and that addressing such risks is a complex, multi-faceted problem, the Committee on Energy and Commerce in April 2018 released a Request for Information (RFI) seeking input on how to address legacy technology and related issues in the health care sector. The RFI stated that “[t]he challenges created by legacy technologies are, by definition, decades in the making. They implicate dozens of diverse stakeholders with different and at times competing equities, and they have no clear solutions . . . [t]o understand the full scope of the challenge and potential paths to 20 Letter from the Hon. Greg Walden, Hon. Tim Murphy, Hon. Marsha Blackburn, and Hon. Robert E. Latta, H. Comm. On Energy and Commerce, to Mr. Jason Providakes, President and Chief Executive Officer, MITRE Corp. (March 31, 2017); Letter from the Hon. Greg Walden, Hon. Tim Murphy, Hon. Marsha Blackburn, and Hon. Robert E. Latta, H. Comm. On Energy and Commerce, to the Hon. General John F. Kelly, Sec’y, U.S. Dep’t of Homeland Security (March 31, 2017). 21 Letter from the Hon. Greg Walden, Hon. Tim Murphy, Hon. Marsha Blackburn, and Hon. Robert E. Latta, H. Comm. On Energy and Commerce, to Mr. Jason Providakes, President and Chief Executive Officer, MITRE Corp. (Aug. 27, 2018); Letter from the Hon. Greg Walden, Hon. Tim Murphy, Hon. Marsha Blackburn, and Hon. Robert E. Latta, H. Comm. On Energy and Commerce, to the Hon. Kristjen Nielsen, Sec’y, U.S. Dep’t of Homeland Security (Aug. 27, 2018). 22 Id. 23 Letter from Cybersecurity Coalition and Cyber Threat Alliance to Hon. Greg Walden, Hon. Gregg Harper, Hon. Marsha Blackburn, and Hon. Robert E. Latta (Sept. 11, 2018), https://www.cyberthreatalliance.org/wp- content/uploads/2018/09/Joint-Coalition-CTA-Letter-to-House-EC-on-CVE-9112018.pdf. 8 address it, [the Committee requires] insight from stakeholders of all sizes, from all parts of the health care sector.”24 In response, the Committee received nearly 300 pages worth of comments. For example, many stakeholders agreed with two of the Committee’s existing priorities, coordinated vulnerability disclosure and software bill of materials, while raising many additional complex issues to be considered. Following the RFI’s release and the receipt of comments, the Committee continues to explore supported lifetimes challenges and opportunities, including a staff-level roundtable in October 2018 with members of the healthcare sector to discuss how to improve transparency and clarity with regards to legacy technology risks, roles and responsibilities, and strategies.25 6. Subcommittee Work Related to The Public-Private Partnership Model While the nation is experienced at responding to threats to critical infrastructure from natural and man-made disasters, both the public and private sectors continue to explore and evolve their strategies for addressing cybersecurity threats. Throughout the first half of 2017, the Subcommittee on Oversight and Investigations held several events focused on the public-private partnership model established under current law that provides a framework for responding critical infrastructure threats caused by cybersecurity incidents. At the first event, a roundtable discussion, Committee Members and representatives from public-private partnership organizations discussed current challenges and opportunities. On April 4, 2017, the Subcommittee held a hearing entitled “Cybersecurity in the Health Care Sector: Strengthening Public-Private Partnerships” at which members heard testimony from Denise Anderson, President, National Health Information Sharing and Analysis Center, Michael McNeil, Global Product Security and Services Officer, Phillips, and Terry Rice, Vice President, IT Risk Management and Chief Information Security Officer, Merck & Company, Inc. At that hearing, both Members and the witnesses focused on the fact that modern heath care cybersecurity is no longer just about protecting patient data or information, but that it has become a patient safety issue.26 On June 8, 2017, the Subcommittee held a hearing entitled “Examining the Role of the Department of Health and Human Services in Health Care Cybersecurity” at which members heard testimony from Emery Csulak, Chief Information Security Officer and Senior Privacy Official, Centers for Medicare and Medicaid Services and co-chair, Health Care Industry Cybersecurity Task Force, Steve Curren, Director, Division of Resilience, Office of Emergency Management, Office of the Assistant Secretary for Preparedness and Response, and Leo Scanlon, Deputy Chief Information Security Officer, U.S. Department of Health and Human Services. At 24 Supported Lifetimes Request for Information, H. Comm. on Energy & Commerce (Apr. 20, 2018), https://energycommerce.house.gov/wp-content/uploads/2018/04/20180420Supported_Lifetimes_RFI.pdf. 25 U.S. Committee on Energy & Commerce, Roundtable on Supported Lifetimes, October 2018. 26 Cybersecurity in the Health Care Sector: Strengthening Public-Private Partnerships Before the Subcomm. On Oversight & Investigations, 115th Cong. (Apr. 4, 2017), https://energycommerce.house.gov/hearings/cybersecurity- heath-care-sector-strengthening-public-private/. 9