*HomeU.S. Government Accountability Office*
Menu

      close


          
          
                          	
				
				
	
	
					Reports & Testimonies
									
																				
				
				
	
	
								Reports & Testimonies
													
																												
																						
							
																Recommendations Database
							
																												
																						
							
																Month in Review
							
																												
																						
							
																Order Copies
							
																												
																						
							
																Restricted Reports
							
																												
																						
							
																View Topics
							
																												
																						
							
																View Agencies
							
																												
																						
							
																Bid Protests & Appropriations Law
									
																				
				
				
	
	
								Bid Protests & Appropriations Law
													
																												
																						
							
																Bid Protests
							
																												
																						
							
																Appropriations Law
							
																												
																						
							
																Federal Vacancies Reform Act
							
																												
																						
							
																Other Legal
							
																												
																						
							
																About
									
																				
				
				
	
	
								About
													
																												
																						
							
																What GAO Does
							
																												
																						
							
																U.S. Comptroller General
							
																												
																						
							
																Careers
							
																												
																						
							
																Contact UsFor Congress
                                
                          
        
                Press Center
                                
                          
        
                Careers
                                
                          
        
                BlogSearch Breadcrumb
        Home
                            Reports & Testimonies
                            Cybersecurity High-Risk Series: Challenges In Protecting Cyber Critical Infrastructure
    Cybersecurity High-Risk Series:
                          Challenges in Protecting Cyber Critical Infrastructure **GAO-23-106441**
        Published: Feb 07, 2023. Publicly Released: Feb 07, 2023.Jump To:
    Jump ToElder Abuse
          Services for Older Adults
          State and Local-Level Drivers and Trends
          State and Local Fiscal Projections
          Federal Borrowing
          Managing the Debt
          Summary of Funding Provisions
          Auditing the Government's Books
          Unpacking the Financial Report
          Highlights
          Recommendations
          Background
          About This Work
          About This Work
          Trends
          About the Center
          Why It's High Risk
          What Remains To Be Done
          Key Reports
          Newest COVID-Related Reports
          AI Use Cases
          Flood Insurance
          Past Pandemic-Related Reports
          CARES Act Oversight Reports
          All COVID-19 Reports
          Report Suspected Fraud
          Subjects
          How to Get Notified
          Past Reports
          Public Health Threats
          Explore the FY 2022 and 2023 Funds
          Lessons Learned
          Agency Reports
          Recent Reports
          Recommendations
          Supplemental Material
          Full Report
          Additional Data
          View Decision
          Downloads
          Previously Identified Actions
          Related Pages
          Associated Agencies
          Tough Choices and Opportunities Ahead
          Americas Fiscal Future Key Areas
          Retirement Security Key Areas
          Current List
          About The High Risk List
          Area Ratings
          Previous High Risk Products
          Search Federal Vacancies
          Past Federal Vacancies
          Violation Letters
          About the Yellow Book
          Advisory Council
          Related Resources
          Comment Letters
          Related Publications
          Contacts and Resources
          Major Issues Facing the Nation
          Meeting Strategic Challenges
          Additional Resources
          Resources
          GAO Contacts
          Mission Teams
          Operations and Staff Offices
          Organization Chart
          Why a Career at GAO?
          Am I Qualified?
          Company Culture
          Reasonable Accommodations
          Video Gallery
          Paid Internships
          Student Volunteers
          Professional Development Program
          Advancement
          Executive Candidate Program
          Summer Associates
          Externships
          Benefits
          Contacts
                    Fast Facts
              Federal systems are vulnerable to cyberattacks. Our High Risk report identified 10 critical actions for addressing federal cybersecurity challenges.

In this report, the third in a series of four, we cover the action related to protecting cyber critical infrastructure—specifically, strengthening the federal role in cybersecurity for critical infrastructure. For example, the Department of Energy needs to address cybersecurity risks to the U.S. power grid.

We've made 106 public recommendations in this area since 2010. Nearly 57% of those recommendations had not been implemented as of December 2022.

computer motherboard with the image of an open red padlock in the center
Skip to Highlights
Highlights
  Overview

We have made 106 recommendations in public reports since 2010 with respect to protecting cyber critical infrastructure. Until these are fully implemented, federal agencies will be more limited in their ability to protect private and sensitive data entrusted to them. For more information on this report, visit https://www.gao.gov/cybersecurity.

Strengthen the Federal Role in Protecting Cyber Critical Infrastructure

The U.S. grid’s distribution systems—which carry electricity from transmission systems to consumers and are regulated primarily by states—are increasingly at risk from cyberattacks. Distribution systems are growing more vulnerable, in part because of industrial control systems’ increasing connectivity. As a result, threat actors can use multiple techniques to access those systems and potentially disrupt operations.

**Examples of Techniques for Gaining Initial Access to Industrial Control Systems**

Fig03-75_v4-ITC-106441-corporate net_cgb

We reported in March 2021 that DOE, as the lead federal agency for the energy sector, developed plans to help combat these threats and implement the national cybersecurity strategy for the grid. However, DOE’s plans do not address distribution systems’ vulnerabilities related to supply chains. By not having plans that address the improvement to grid distribution systems’ cybersecurity, DOE’s plans will likely be of limited use in prioritizing federal support to states and industry.

➢ **We recommended that**, in developing plans to implement the national cybersecurity strategy for the grid, DOE coordinate with DHS, states, and industry to more fully address risks to the grid’s distribution systems from cyberattacks.

The communications sector is an integral component of the U.S. economy and faces serious physical, cyber-related, and human threats that could affect the operations of local, regional, and national level networks, according to CISA and sector stakeholders. In addition to managing federal coordination during incidents impacting the communications sector, CISA shares information with sector stakeholders to enhance their cybersecurity and improve interoperability, situational awareness, and preparedness for responding to and managing incidents.

**Examples of Potential Security Threats to the Communications Sector**

Fig02-75_v3-ITC-106441-potentials_cgb

In November 2021, we reported that CISA had not assessed the effectiveness of its programs and services supporting the security and resilience of the communications sector. By completing such an assessment, CISA would be better positioned to determine which programs and services are most useful or relevant in supporting the sector’s security and resilience. We also reported that CISA had not updated its 2015 *Communications Sector-Specific Plan*. Developing and issuing a revised plan would help CISA to address emerging threats and risks to the communications sector.

➢ **We recommended** that CISA assess the effectiveness of its programs and services to support the communications sector and, in coordination with public and private communications sector stakeholders, produce a revised *Communications Sector-Specific Plan*.

Ransomware is a form of malicious software that threat actors use in a multistage attack to encrypt files on a device and render data and systems unusable. These threat actors then demand ransom payments in exchange for restoring access to the locked data and systems.

**Four Stages of a Common Ransomware Attack**

U:\Work in Process\Teams\FY23 Reports\ITC\106441\Graphics\Figure04-537_v2-ITC-106441-intrusions_cgb.png

In September 2022, we reported that CISA, FBI, and Secret Service provide assistance in preventing and responding to ransomware attacks on tribal, state, local, and territorial government organizations. However, the agencies could improve their efforts by fully addressing six of seven key practices for interagency collaboration in their ransomware assistance to state, local, tribal, and territorial governments. For instance, existing interagency collaboration on ransomware assistance to tribal, state, local, and territorial governments was informal and lacked detailed procedures.

➢ **We recommended** that DHS and the Department of Justice address identified challenges and incorporate key collaboration practices in delivering services to state, local, tribal, and territorial governments.

For more information about this Snapshot, contact: Marisol Cruz Cain, Director, Information Technology & Cybersecurity, cruzcainm@gao.gov, (202) 512-5017.

Full Report
    Full Report (6 pages)
              Accessible PDF (6 pages)
GAO Contacts
    
      Marisol Cruz Cain
            
            Director
      
            cruzcainm@gao.gov
      
            (202) 512-5017
Office of Public Affairs
    
      Chuck Young
            
            Managing Director
      
            youngc1@gao.gov
      
            (202) 512-4800
Topics
    
      Information SecurityCritical infrastructureCritical infrastructure protectionCritical infrastructure vulnerabilitiesCyber attacksCybersecurityHigh-risk seriesInformation securityPersonally identifiable informationCommunicationsFederal agencies
 Receive GAO Updates
  Stay informed as we add new reports & testimonies.

    GAO Logo
      U.S. Government Accountability Office


                                   Column 1
                            Press Center
                              Contact Us
                              Inspector General
                              Restricted Reports
                              Column 2
                            Copyright & Terms of Use
                              Privacy Policy
                              Accessibility
                              Sitemap
                              Column 3
                            FOIA Requests
                              Scam Alerts
                              No FEAR Act Data
                              Health Care Advisory Committees