Information Security: Progress Made, But Challenges Remain to Protect Federal Systems and the Nation's Critical Infrastructures
Published: 2003-04-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Protecting the computer systems that support federal agencies' operations and our nation's critical infrastructures--such as power distribution, telecommunications, water supply, and national defense--is a continuing concern. These concerns are well-founded for a number of reasons, including the dramatic increases in reported computer security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks. GAO first designated computer security as high risk in 1997, and in 2003 expanded this high-risk area to include protecting the systems that support our nation's critical infrastructures, referred to as cyber critical infrastructure protection or cyber CIP. GAO has made previous recommendations and periodically testified on federal information security weaknesses--including agencies' progress in implementing key legislative provisions on information security--and the challenges that the nation faces in protecting our nation's critical infrastructures. GAO was asked to provide an update on the status of federal information security and CIP.
section_title: What GAO Found
paragraphs: With the enactment of the Federal Information Security Management Act of 2002, the Congress continued its efforts to improve federal information security by permanently authorizing and strengthening key information security requirements. The administration has also made progress through a number of efforts, among them the Office of Management and Budget's emphasis of information security in the budget process. However, significant information security weaknesses at 24 major agencies continue to place a broad array of federal operations and assets at risk of fraud, misuse, and disruption. Although recent reporting by these agencies showed some improvements, GAO found that agencies still have not established information security programs consistent with the legal requirements. For example, periodic testing of security controls is essential to security program management, but for fiscal year 2002, 14 agencies reported they had tested the controls of less than 60 percent of their systems. Further information security improvement efforts are also needed at the governmentwide level, and these efforts need to be guided by a comprehensive strategy in which roles and responsibilities are clearly delineated, appropriate guidance is given, adequate technical expertise is obtained, and sufficient agency information security resources are allocated. Although improvements have been made in protecting our nation's critical infrastructures and continuing efforts are in progress, further efforts are needed to address critical challenges that GAO has identified over the last several years. These challenges include: (1) developing a comprehensive and coordinated national CIP plan; (2) improving information sharing on threats and vulnerabilities between the private sector and the federal government, as well as within the government itself; (3) improving analysis and warning capabilities for both cyber and physical threats; and (4) encouraging entities outside the federal government to increase their CIP efforts.

section_title: Letter
paragraphs: Protecting the computer systems  that support federal agencies’  operations and our nation’s critical  infrastructures—such as power  distribution, telecommunications,  water supply, and national  defense—is a continuing concern.  These concerns are well-founded  for a number of reasons, including  the dramatic increases in reported  computer security incidents, the  ease of obtaining and using hacking  tools, the steady advance in the  sophistication and effectiveness of  attack technology, and the dire  warnings of new and more  destructive attacks. GAO first  designated computer security as  high risk in 1997, and in 2003  expanded this high-risk area to  include protecting the systems that  support our nation’s critical  infrastructures, referred to as cyber  critical infrastructure protection or  cyber CIP.
With the enactment of the Federal Information Security Management Act of  2002, the Congress continued its efforts to improve federal information  security by permanently authorizing and strengthening key information  security requirements. The administration has also made progress through a  number of efforts, among them the Office of Management and Budget’s  emphasis of information security in the budget process.
GAO has made previous  recommendations and periodically  testified on federal information  security weaknesses—including  agencies’ progress in implementing  key legislative provisions on  information security—and the  challenges that the nation faces in  protecting our nation’s critical  infrastructures. GAO was asked to  provide an update on the status of  federal information security and  CIP. developing a comprehensive and coordinated national CIP plan;  improving information sharing on threats and vulnerabilities between the private sector and the federal government, as well as within the  government itself;  improving analysis and warning capabilities for both cyber and physical  threats; and  encouraging entities outside the federal government to increase their  CIP efforts.
Percentage of systems with security controls tested during fiscal year 2002  www.gao.gov/cgi-bin/getrpt?GAO-03-564T.
To view the full testimony, click on the link  above. For more information, contact   Robert F. Dacey at (202) 512-3317 or  daceyr@gao.gov.
Mr. Chairman and Members of the Subcommittee:  I am pleased to be here today to discuss the challenges that our nation  faces concerning federal information security and critical infrastructure  protection (CIP). Federal agencies and other public and private entities  rely extensively on computerized systems and electronic data to support  their missions. CIP involves activities that enhance the security of the  cyber and physical public and private infrastructures that are essential to  our national security, national economic security, and/or national public  health and safety. Accordingly, the security of these systems and data is  essential to avoiding disruptions in critical operations, data tampering,  fraud, and inappropriate disclosure of sensitive information. Further,  protecting against computer-based attacks on critical infrastructures is an  important aspect of homeland security.
The Congress has continued to hold important hearings and has passed  legislation that the President has signed into law to strengthen information  security practices throughout the federal government and to better  address threats to the nation’s critical computer-dependent  infrastructures. Such legislation includes Government Information  Security Reform provisions (commonly known as “GISRA”), which  established information security program, evaluation, and reporting  requirements for federal agencies; the recently enacted Federal  Information Security Management Act of 2002 (“FISMA”), which  permanently authorized and strengthened GISRA; and the Homeland  Security Act of 2002, which, among other things, consolidated certain  essential CIP functions and organizations in the Department of Homeland  Security.
In my testimony today, I will provide an overview of the increasing nature  of cyber security threats and vulnerabilities and of the continuing  pervasive weaknesses that led GAO to initially begin reporting information  security as a governmentwide high-risk issue in 1997. I will then discuss  the status of actions taken by the Office of Management and Budget  (OMB) to address overall weaknesses and challenges identified through its  GISRA analyses, as well as the federal government’s continuing need to be  guided by a comprehensive improvement strategy. I will also discuss the  results of our evaluation of efforts by 24 of the largest federal agencies to  implement the requirements of GISRA and to identify and correct their  information security weaknesses. Finally, I will discuss the federal  government’s evolving approach to and current strategies for protecting  our nation’s critical infrastructures. In this discussion, I will highlight the  challenges, identified in prior GAO work that the nation continues to face  in implementing CIP. These challenges include developing a  comprehensive and coordinated national CIP plan, implementing better  information sharing on threats and vulnerabilities, improving analysis and  warning capabilities, and ensuring appropriate incentives to encourage  nonfederal CIP efforts. In January 2003, GAO expanded its information  security high-risk issue to include cyber CIP.
As agreed, this testimony incorporates the preliminary results of our  analyses of federal agencies’ efforts to implement GISRA information  security requirements during fiscal year 2002, which was originally  requested by the chair and ranking minority member of a former  subcommittee of the House Government Reform Committee. In  conducting this review, we analyzed (1) executive summaries and reports  that summarized management reviews by the 24 agencies for their  information security programs, (2) inspector general (IG) summaries and  reports on their independent evaluations of these agencies’ programs, and  (3) agency plans to correct their identified information security  weaknesses. We did not validate the accuracy of the data provided in these  summaries, reports, and plans. We also discussed with OMB officials the  status of their actions and initiatives to improve and provide additional  guidance for federal information security. We performed our work from  September 2002 to April 2003 in accordance with generally accepted  government auditing standards.
subsections: section_title: Incidents, Threats, and Potential Attack Consequences are Significantly Increasing
paragraphs: Dramatic increases in computer interconnectivity, especially in the use of  the Internet, continue to revolutionize the way our government, our  nation, and much of the world communicate and conduct business. The  benefits have been enormous. Vast amounts of information are now  literally at our fingertips, facilitating research on virtually every topic  imaginable; financial and other business transactions can be executed  almost instantaneously, often 24 hours a day; and electronic mail, Internet  Web sites, and computer bulletin boards allow us to communicate quickly  and easily with a virtually unlimited number of individuals and groups.
However, in addition to such benefits, this widespread interconnectivity  poses significant risks to the government’s and our nation’s computer  systems and, more important, to the critical operations and infrastructures  they support. For example, telecommunications, power distribution, water  supply, public health services, national defense (including the military’s  warfighting capability), law enforcement, government services, and  emergency services all depend on the security of their computer  operations. The speed and accessibility that create the enormous benefits  of the computer age on the other hand, if not properly controlled, allow  individuals and organizations to inexpensively eavesdrop on or interfere  with these operations from remote locations for mischievous or malicious  purposes, including fraud or sabotage. Table 1 summarizes the key threats  to our nation’s infrastructures, as observed by the Federal Bureau of  Investigation (FBI).
Government officials are increasingly concerned about attacks from  individuals and groups with malicious intent, such as crime, terrorism,  foreign intelligence gathering, and acts of war. According to the FBI,  terrorists, transnational criminals, and intelligence services are quickly  becoming aware of and using information exploitation tools such as  computer viruses, Trojan horses, worms, logic bombs, and eavesdropping  sniffers that can destroy, intercept, degrade the integrity of, or deny access  to data. In addition, the disgruntled organization insider is a significant  threat, since these individuals often have knowledge that allows them to  gain unrestricted access and inflict damage or steal assets without  possessing a great deal of knowledge about computer intrusions. As  greater amounts of money are transferred through computer systems, as  more sensitive economic and commercial information is exchanged  electronically, and as the nation’s defense and intelligence communities  increasingly rely on commercially available information technology (IT),  the likelihood increases that information attacks will threaten vital  national interests.
As the number of individuals with computer skills has increased, more  intrusion or “hacking” tools have become readily available and relatively  easy to use. A hacker can literally download tools from the Internet and  “point and click” to start an attack. Experts also agree that there has been  a steady advance in the sophistication and effectiveness of attack  technology. Intruders quickly develop attacks to exploit vulnerabilities  discovered in products, use these attacks to compromise computers, and  share them with other attackers. In addition, they can combine these  attacks with other forms of technology to develop programs that  automatically scan the network for vulnerable systems, attack them,  compromise them, and use them to spread the attack even further.
Along with these increasing threats, the number of computer security  incidents reported to the CERT® Coordination Center has also risen  dramatically from 9,859 in 1999 to 52,658 in 2001 and 82,094 in 2002. And  these are only the reported attacks. The Director of CERT Centers stated  that he estimates that as much as 80 percent of actual security incidents  goes unreported, in most cases because (1) the organization was unable to  recognize that its systems had been penetrated or there were no  indications of penetration or attack, or (2) the organization was reluctant  to report. Figure 1 shows the number of incidents reported to the CERT  Coordination Center from 1995 through 2002.
According to the National Security Agency, foreign governments already  have or are developing computer attack capabilities, and potential  adversaries are developing a body of knowledge about U.S. systems and  methods to attack these systems. Since the terrorist attacks of September  11, 2001, warnings of the potential for terrorist cyber attacks against our  critical infrastructures have also increased. For example, in February 2002,  the threat to these infrastructures was highlighted by the Special Advisor  to the President for Cyberspace Security in a Senate briefing when he  stated that although to date none of the traditional terrorists groups, such  as al Qaeda, have used the Internet to launch a known assault on the  United States’ infrastructure, information on water systems was  discovered on computers found in al Qaeda camps in Afghanistan. Also, in  his February 2002 statement for the Senate Select Committee on  Intelligence, the director of central intelligence discussed the possibility of  cyber warfare attack by terrorists. He stated that the September 11  attacks demonstrated the nation’s dependence on critical infrastructure  systems that rely on electronic and computer networks. Further, he noted  that attacks of this nature would become an increasingly viable option for  terrorists as they and other foreign adversaries become more familiar with  these targets and the technologies required to attack them.
Since September 11, 2001, the critical link between cyberspace and  physical space has been increasingly recognized. In his November 2002  congressional testimony, the Director of the CERT Centers at Carnegie- Mellon University noted that supervisory control and data acquisition  (SCADA) systems and other forms of networked computer systems have  been used for years to control power grids, gas and oil distribution  pipelines, water treatment and distribution systems, hydroelectric and  flood control dams, oil and chemical refineries, and other physical  systems, and that these control systems are increasingly being connected  to communications links and networks to reduce operational costs by  supporting remote maintenance, remote control, and remote update  functions. These computer-controlled and network-connected systems  are potential targets for individuals bent on causing massive disruption  and physical damage, and the use of commercial, off-the-shelf  technologies for these systems without adequate security enhancements  can significantly limit available approaches to protection and may increase  the number of potential attackers.
The risks posed by this increasing and evolving threat are demonstrated in  reports of actual and potential attacks and disruptions. For example:    On February 11, 2003, the National Infrastructure Protection Center  (NIPC) issued an advisory to heighten the awareness of an increase in  global hacking activities as a result of the increasing tensions between the  United States and Iraq. This advisory noted that during a time of  increased international tension, illegal cyber activity often escalates, such  as spamming, Web page defacements, and denial-of-service attacks.  Further, this activity can originate within another country that is party to  the tension; can be state sponsored or encouraged; or can come from  domestic organizations or individuals independently. The advisory also  stated that attacks may have one of several objectives, including political  activism targeting Iraq or those sympathetic to Iraq by self-described  “patriot” hackers, political activism or disruptive attacks targeting United  States systems by those opposed to any potential conflict with Iraq, or  even criminal activity masquerading or using the current crisis to further  personal goals.
According to a preliminary study coordinated by the Cooperative  Association for Internet Data Analysis (CAIDA), on January 25, 2003, the  SQL Slammer worm (also known as “Sapphire”) infected more than 90  percent of vulnerable computers worldwide within 10 minutes of its  release on the Internet, making it the fastest computer worm in history. As  the study reports, exploiting a known vulnerability for which a patch has  been available since July 2002, Slammer doubled in size every 8.5 seconds  and achieved its full scanning rate (55 million scans per second) after  about 3 minutes. It caused considerable harm through network outages  and such unforeseen consequences as canceled airline flights and  automated teller machine (ATM) failures. Further, the study emphasizes  that the effects would likely have been more severe had Slammer carried a  malicious payload, attacked a more widespread vulnerability, or targeted a  more popular service.
In November 2002, news reports indicated that a British computer  administrator was indicted on charges that he broke into 92 U.S. computer  networks in 14 states; these networks belonged to the Pentagon, private  companies, and the National Aeronautics and Space Administration during  the past year, causing some $900,000 in damage to computers. According  to a Justice Department official, these attacks were one of the biggest  hacks ever against the U.S. military. This official also said that the attacker  used his home computer and automated software available on the Internet  to scan tens of thousands of computers on U.S. military networks looking  for ones that might suffer from flaws in Microsoft Corporation’s Windows  NT operating system software.
On October 21, 2002, NIPC reported that all the 13 root-name servers that  provide the primary roadmap for almost all Internet communications were  targeted in a massive “distributed denial of service” attack. Seven of the  servers failed to respond to legitimate network traffic, and two others  failed intermittently during the attack. Because of safeguards, most  Internet users experienced no slowdowns or outages.
In July 2002, NIPC reported that the potential for compound cyber and  physical attacks, referred to as “swarming attacks,” is an emerging threat  to the U.S. critical infrastructure. As NIPC reports, the effects of a  swarming attack include slowing or complicating the response to a  physical attack. For example, cyber attacks can be used to delay the  notification of emergency services and to deny the resources needed to  manage the consequences of a physical attack. In addition, a swarming  attack could be used to worsen the effects of a physical attack. For  instance, a cyber attack on a natural gas distribution pipeline that opens  safety valves and releases fuels or gas in the area of a planned physical  attack could enhance the force of the physical attack. Consistent with this  threat, NIPC also released an information bulletin in April 2002 warning  against possible physical attacks on U.S. financial institutions by  unspecified terrorists.
In August 2001, we reported to a subcommittee of the House Government  Reform Committee that the attacks referred to as Code Red, Code Red II,  and SirCam had affected millions of computer users, shut down Web sites,  slowed Internet service, and disrupted business and government  operations. Then in September 2001, the Nimda worm appeared using  some of the most significant attack profile aspects of Code Red II and  1999’s infamous Melissa virus that allowed it to spread widely in a short  amount of time. Security experts estimate that Code Red, Sircam, and  Nimda have caused billions of dollars in damage.
section_title: Significant Weaknesses Persist in Federal Information Security
paragraphs: For the federal government, we have reported since 1996 that poor  information security is a widespread problem with potentially devastating  consequences. Although agencies have taken steps to redesign and  strengthen their information system security programs, our analyses of  information security at major federal agencies have shown that federal  systems were not being adequately protected from computer-based  threats, even though these systems process, store, and transmit enormous  amounts of sensitive data and are indispensable to many federal agency  operations. For the past several years, we have analyzed audit results for  24 of the largest federal agencies and found that all 24 had significant  information security weaknesses. Further, we have identified information  security as a governmentwide high-risk issue in reports to the Congress  since 1997—most recently in January 2003.
As we reported in November 2002, our analyses of reports issued from  October 2001 through October 2002, continued to show significant  weaknesses in federal computer systems that put critical operations and  assets at risk. Weaknesses continued to be reported in each of the 24  agencies included in our review, and they covered all six major areas of  general controls—the policies, procedures, and technical controls that  apply to all or a large segment of an entity’s information systems and help  ensure their proper operation. These six areas are (1) security program  management, which provides the framework for ensuring that risks are  understood and that effective controls are selected and properly  implemented; (2) access controls, which ensure that only authorized  individuals can read, alter, or delete data; (3) software development and  change controls, which ensure that only authorized software programs are  implemented; (4) segregation of duties, which reduces the risk that one  individual can independently perform inappropriate actions without  detection; (5) operating systems controls, which protect sensitive  programs that support multiple applications from tampering and misuse;  and (6) service continuity, which ensures that computer-dependent  operations experience no significant disruptions. Figure 2 illustrates the  distribution of weaknesses for the six general control areas across the 24  agencies.
Although our analyses showed that most agencies had significant  weaknesses in these six control areas, as in past years’ analyses,  weaknesses were most often identified for security program management  and access controls.
For security program management, we identified weaknesses for all 24  agencies in 2002—the same as reported for 2001, and compared to 21 of  the 24 agencies (88 percent) in 2000. Security program management, which  is fundamental to the appropriate selection and effectiveness of the other  categories of controls, covers a range of activities related to understanding  information security risks; selecting and implementing controls  commensurate with risk; and ensuring that controls, once implemented,  continue to operate effectively.
For access controls, we found weaknesses for 22 of 24 agencies (92  percent) in 2002 (no significant weaknesses were found for one agency,  and access controls were not reviewed for another). This compares to  access control weaknesses found in all 24 agencies for both 2000 and 2000.  Weak access controls for sensitive data and systems make it possible for  an individual or group to inappropriately modify, destroy, or disclose  sensitive data or computer programs for purposes such as personal gain or  sabotage. In today’s increasingly interconnected computing environment,  poor access controls can expose an agency’s information and operations  to attacks from remote locations all over the world by individuals with  only minimal computer and telecommunications resources and expertise.
Our analyses also showed service-continuity-related weaknesses at 20 of  the 24 agencies (83 percent) with no significant weaknesses found for 3  agencies (service continuity controls were not reviewed for another). This  compares to 19 agencies with service continuity weaknesses found in 2001  and 20 agencies found in 2000. Service continuity controls are important in  that they help ensure that when unexpected events occur, critical  operations will continue without undue interruption and that crucial,  sensitive data are protected. If service continuity controls are inadequate,  an agency can lose the capability to process, retrieve, and protect  electronically maintained information, which can significantly affect an  agency’s ability to accomplish its mission. Further, such controls are  particularly important in the wake of the terrorist attacks of September 11,  2001.
These analyses of information security at federal agencies also showed  that the scope of audit work performed has continued to expand to more  fully cover all six major areas of general controls at each agency. Not  surprisingly, this has led to the identification of additional areas of  weakness at some agencies. These increases in reported weaknesses do  not necessarily mean that information security at federal agencies is  getting worse. They more likely indicate that information security  weaknesses are becoming more fully understood—an important step  toward addressing the overall problem. Nevertheless, the results leave no  doubt that serious, pervasive weaknesses persist. As auditors increase  their proficiency and the body of audit evidence expands, it is probable  that additional significant deficiencies will be identified.
Most of the audits represented in figure 2 were performed as part of  financial statement audits. At some agencies with primarily financial  missions, such as the Department of the Treasury and the Social Security  Administration, these audits covered the bulk of mission-related  operations. However, at agencies whose missions are primarily  nonfinancial, such as DOD and the Department of Justice, the audits may  provide a less complete picture of the agency’s overall security posture  because the audit objectives focused on the financial statements and did  not include evaluations of individual systems supporting nonfinancial  operations. However, in response to congressional interest, beginning in  fiscal year 1999, we expanded our audit focus to cover a wider range of  nonfinancial operations—a trend we expect to continue. Audit coverage  for nonfinancial systems has also increased as agencies and their IGs  reviewed and evaluated their information security programs as required by  GISRA.
To fully understand the significance of the weaknesses we identified, it is  necessary to link them to the risks they present to federal operations and  assets. Virtually all federal operations are supported by automated systems  and electronic data, and agencies would find it difficult, if not impossible,  to carry out their missions and account for their resources without these  information assets. Hence, the degree of risk caused by security  weaknesses is extremely high.
The weaknesses identified place a broad array of federal operations and  assets at risk. For example,  resources, such as federal payments and collections, could be lost or  stolen;   computer resources could be used for unauthorized purposes or to launch    sensitive information, such as taxpayer data, social security records,  medical records, and proprietary business information, could be  inappropriately disclosed, browsed, or copied for purposes of espionage  or other types of crime;    critical operations, such as those supporting national defense and  emergency services, could be disrupted;   data could be modified or destroyed for purposes of fraud or disruption;    agency missions could be undermined by embarrassing incidents that  result in diminished confidence in their ability to conduct operations and  fulfill their fiduciary responsibilities.
section_title: Congress Consolidates and Strengthens Federal Information Security Requirements
paragraphs: Concerned with accounts of attacks on commercial systems via the  Internet and reports of significant weaknesses in federal computer  systems that make them vulnerable to attack, on October 30, 2000,  Congress enacted GISRA, which became effective November 29, 2000, for  a period of 2 years. GISRA supplemented information security  requirements established in the Computer Security Act of 1987, the  Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996 and  was consistent with existing information security guidance issued by the  Office of Management and Budget (OMB) and the National Institute of  Standards and Technology (NIST), as well as audit and best practice  guidance issued by GAO.
Most importantly, however, GISRA consolidated these separate  requirements and guidance into an overall framework for managing  information security and established new annual review, independent  evaluation, and reporting requirements to help ensure agency  implementation and both OMB and congressional oversight. GISRA  assigned specific responsibilities to OMB, agency heads and chief  information officers (CIOs), and IGs. OMB was responsible for  establishing and overseeing policies, standards, and guidelines for  information security. This included the authority to approve agency  information security programs, but delegated OMB’s responsibilities  regarding national security systems to national security agencies. OMB  was also required to submit an annual report to the Congress summarizing  results of agencies’ evaluations of their information security programs.  GISRA does not specify a date for this report, and OMB released its fiscal  year 2001 report in February 2002. It has not yet released its fiscal year  2002 report.
GISRA required each agency, including national security agencies, to  establish an agencywide risk-based information security program to be  overseen by the agency CIO and ensure that information security is  practiced throughout the life cycle of each agency system. Specifically,  this program was to include    periodic risk assessments that consider internal and external threats to the  integrity, confidentiality, and availability of systems, and to data  supporting critical operations and assets; the development and implementation of risk-based, cost-effective policies  and procedures to provide security protections for information collected  or maintained by or for the agency; training on security responsibilities for information security personnel and  on security awareness for agency personnel;   periodic management testing and evaluation of the effectiveness of  policies, procedures, controls, and techniques;   a process for identifying and remediating any significant deficiencies;    procedures for detecting, reporting, and responding to security incidents;    an annual program review by agency program officials.
In addition to the responsibilities listed above, GISRA required each  agency to have an annual independent evaluation of its information  security program and practices, including control testing and compliance  assessment. The evaluations of non-national-security systems were to be  performed by the agency IG or an independent evaluator, and the results  of these evaluations were to be reported to OMB. For the evaluation of  national security systems, special provisions included having national  security agencies designate evaluators, restricting the reporting of  evaluation results, and having the IG or an independent evaluator perform  an audit of the independent evaluation. For national security systems, only  the results of each audit of an evaluation are to be reported to OMB.
With GISRA expiring on November 29, 2002, on December 17, 2002, FISMA  was enacted as title III of the E-Government Act of 2002. This act  permanently authorizes and strengthens the information security program,  evaluation, and reporting requirements established by GISRA. In addition,  among other things, FISMA requires NIST to develop, for systems other  than national security systems, (1) standards to be used by all agencies to  categorize all of their information and information systems based on the  objectives of providing appropriate levels of information security  according to a range of risk levels; (2) guidelines recommending the types  of information and information systems to be included in each category;  and (3) minimum information security requirements for information and  information systems in each category. In addition, FISMA requires each  agency to develop, maintain, and annually update an inventory of major  information systems (including major national security systems) operated  by the agency or under its control. This inventory is also to include an  identification of the interfaces between each system and all other systems  or networks, including those not operated by or under the control of the  agency.
section_title: Agencies Show Progress in Implementing Security Requirements, but Further Improvement Needed
paragraphs: In our March 2002 testimony, we reported that the initial implementation  of GISRA was a significant step in improving federal agencies’ information  security programs and addressing their serious, pervasive information  security weaknesses. Agencies also noted benefits of this first-year  implementation, including increased management attention to and  accountability for information security, and the administration undertook  other important actions to address information security, such as  integrating information security into the President’s Management Agenda  Scorecard. However, along with these benefits, agencies’ reviews of their  information security programs showed that agencies had not established  information security programs consistent with the legislative requirements  and that significant weaknesses existed. We also noted that although  agency actions were under way to strengthen information security and  implement these requirements, significant improvement would require  sustained management attention and OMB and congressional oversight.
Our analysis of second-year or fiscal year 2002 implementation of GISRA  showed progress in several areas, including the types of information being  reported and made available for oversight, governmentwide efforts to  improve information security, and agencies’ implementation of  information security requirements. Despite this progress, our analyses of  agency and IG reports showed that the 24 agencies have not yet  established information security programs consistent with legislative  requirements and that corrective action plans did not always include all  identified weaknesses and need independent validation to ensure that  weaknesses are corrected.
subsections: section_title: OMB Includes New Reporting Requirements to Improve Information Available for Oversight
paragraphs: For fiscal year 2002 GISRA reporting, OMB provided the agencies with  updated reporting instructions and guidance on preparing and submitting  plans of action and milestones (corrective action plans). Like instructions  for fiscal year 2001, this updated guidance listed specific topics that the  agencies were to address, many of which were referenced back to  corresponding requirements of GISRA. However, in response to agency  requests and recommendations we made to OMB as a result of our review  of fiscal year 2001 GISRA implementation, this guidance also  incorporated several significant changes to help improve the consistency  and quality of information being reported for oversight by OMB and the  Congress. These changes included the following:    Reporting instructions provided new high-level management performance  measures that the agencies and IGs were required to use to report on  agency officials’ performance. According to OMB, most agencies did not  provide performance measures or actual levels of performance where  asked to do so for fiscal year 2001 reporting, and the agencies requested  that OMB develop such measures. These required performance measures  include, for example, the number and percentage of systems that have  been assessed for risk, the number of contractor operations or facilities  that were reviewed, and the number of employees with significant security  responsibilities that received specialized training.
Instructions confirmed that agencies were expected to review all systems  annually. OMB explained that GISRA requires senior agency program  officials to review each security program for effectiveness at least  annually, and that the purpose of the security programs discussed in  GISRA is to ensure the protection of the systems and data covered by the  program. Thus, a review of each system is essential to determine the  program’s effectiveness, and only the depth and breadth of such system  reviews are flexible.
Agencies were generally required to use all elements of NIST Special  Publication 800-26, Security Self-Assessment Guide for Information  Technology Systems, to review their systems. This guide accompanies  NIST’s Security Assessment Framework methodology, which agency  officials can use to determine the current status of their security  programs. The guide itself uses an extensive questionnaire containing  specific control objectives and techniques against which an unclassified  system or group of interconnected systems can be tested and measured.  For the fiscal year 2001 reporting period, OMB encouraged agencies to use  this guide, but did not require its use because it was not completed until  well into the reporting period. NIST finalized the guide in November 2001,  and for fiscal year 2002 reporting, OMB required its use unless an agency  and its IG confirmed that any agency-developed methodology captured all  elements of the guide. To automate the completion of the questionnaire,  NIST also developed a tool that can be found at its Computer Security  Resource Center Web site: http://csrc.nist.gov/asset/.
OMB requested IGs to verify that agency corrective action plans identify  all known security weaknesses within an agency, including components,  and are used by the IG and the agency, major components, and program  officials within them, as the authoritative agency management mechanism  to prioritize, track, and manage all agency efforts to close security  performance gaps.
OMB authorized agencies to release certain information from their  corrective action plans to assist the Congress in its oversight  responsibilities. Agencies could release this information, as requested,  excluding certain elements, such as estimated funding resources and the  scheduled completion dates for resolving a weakness.
section_title: OMB Initiatives to Improve Federal Information Security Show Progress
paragraphs: OMB’s report to the Congress on fiscal year 2001 GISRA implementation  provided an overview of OMB and agencies’ implementation efforts,  summarized the overall results of OMB’s analyses, and included individual  agency summaries for the 24 of the largest federal departments and  agencies. Overall, OMB reported that although examples of good security  exist in many agencies, and others were working very hard to improve  their performance, many agencies had significant deficiencies in every  important area of security. In particular, the report highlighted six  common security weaknesses. These weaknesses are listed below along  with an update of the activities under way to address them.  1.  Lack of senior management attention to information security—Last  year, OMB reported that, to address this issue, it was working through  the President’s Management Council and the Critical Infrastructure  Protection Board to promote sustained attention to security as part of  its work on the President’s Management Agenda and the integration of  security into the Scorecard. OMB also reported that it included  security instructions in budget passback guidance and sent security  letters to each agency highlighting the lack of senior management  attention and describing specific actions OMB is taking to assist the  agency. According to OMB officials, although the President’s Critical  Infrastructure Protection Board was recently dissolved, OMB  continues to coordinate security issues with the President’s Homeland  Security Council and the Department of Homeland Security. These  officials also said that they are continuing to work with the agencies  and that security is an integral part of assessing agencies’ performance  for the E-Government component of the Scorecard.  2.  Inadequate accountability for job and program performance related  to IT security—OMB reported that it was working with the agencies  and other entities to develop workable measures of job and program  performance to hold federal employees accountable for their security  responsibilities. As discussed previously, OMB instructions to federal  agencies for fiscal year 2002 GISRA reporting included high-level  management performance measures. Related to this initiative, in  October 2002, NIST also issued an initial public draft of a security  metrics guide for IT systems to provide guidance on how an  organization, through the use of metrics, can determine the adequacy  of in-place security controls, policies, and procedures. The draft also  explains the metric development and implementation process and how  it can also be used to adequately justify security control investments.  3.  Limited security training for general users, IT professionals, and  security professionals—OMB reported that along with federal  agencies, it was working through the Critical Infrastructure Protection  Board’s education committee and the CIO Council’s Workforce  Committee to address this issue. OMB also reported that work was  under way to identify and disseminate security training best practices  through NIST’s Federal Agency Security Practices Web site and that  one of the administration’s electronic government initiatives is to  establish and deliver electronic-training on a number of mandatory  topics, including security, for use by all federal agencies, along with  state and local governments. As an example of progress on this  initiative, OMB officials pointed to an online training initiative,  www.golearn.gov. Launched in July 2002 by the Office of Personnel  Management (OPM), this site offers training in an online environment,  including IT security courses, such as security awareness,  fundamentals of Internet security, and managing network security.  Other activities for this area include NIST’s July 2002 issuance of draft  guidance on designing, developing, implementing, and maintaining an  awareness and training program within an agency’s IT security  program.  4.  Inadequate integration of security into the capital planning and  investment control process—OMB reported that it was integrating  security into the capital planning and investment control process to  ensure that adequate security is incorporated directly into and funded  over the life cycle of all systems and programs before funding is  approved. Specifically, OMB established criteria that agencies must  report security costs for each major and significant IT investment,  document in their business cases that adequate security controls have  been incorporated into the life cycle planning and funding of each IT  investment, and tie their corrective action plans for a system directly  to the business case for that IT investment. Another criterion was that  agency security reports and corrective action plans were presumed to  reflect the agency’s security priorities and, thus, would be a central  tool for OMB in prioritizing funding for systems. OMB officials  confirmed that these activities were continuing and included providing  additional guidance in OMB Circular A-11 on identifying security costs.  In addition, they said that draft NIST guidelines for federal IT systems  would help to ensure that agencies consider security throughout the  system life cycle. Under OMB policy, responsible federal officials are  required to make a security determination (called accreditation) to  authorize placing IT systems into operation. In order for these officials  to make sound, risk-based decisions, a security evaluation (known as  certification) of the IT system is needed. The NIST guidelines are to  establish a standard process, general tasks and specific subtasks to  certify and accredit systems and provide a new approach that uses the  standardized process to verify the correctness and effectiveness of  security controls employed in a system. The guidelines will also  employ the use of standardized, minimum security controls and  standardized verification techniques and procedures that NIST  indicates will be provided in future guidance.  5.  Poor security for contractor-provided services—OMB reported last  year that under the guidance of the OMB-led security committee  established by Executive Order 13231 (since eliminated), an issue  group would develop recommendations to include addressing how  security is handled in contracts. OMB also reported that it would work  with the CIO Council and the Procurement Executives Council to  establish a training program that ensures appropriate contractor  training in security. OMB officials stated that these activities are  continuing and the issue group had made recommendations to the  Federal Acquisition Regulation Council. In addition, in October 2002,  NIST issued a draft guide on security considerations in federal IT  procurements, which includes specifications, clauses, and tasks for  areas such as IT security training and awareness, personnel security,  physical security, and security features in systems.  6.  Limited capability to detect, report, and share information on  vulnerabilities or to detect intrusions, suspected intrusions, or virus  infections—OMB reported that the Federal Computer Incident  Response Center (FedCIRC) reports to it on a quarterly basis on the  federal government’s status on IT security incidents. OMB also  reported that under OMB and Critical Infrastructure Protection Board  guidance, GSA was exploring methods to disseminate patches to all  agencies more effectively. OMB officials pointed to the Patch  Authentication and Dissemination Capability Program, which FedCIRC  introduced in January 2003 as a free service to federal civilian  agencies. According to FedCIRC, this service provides a trusted  source of validated patches and notifications on new threats and  vulnerabilities that have potential to disrupt federal government  mission critical systems and networks. It is a Web-enabled service that  obtains patches from vendors, validates that the patch only does what  it states that it was created to correct, and provides agencies  notifications based on established profiles. We also noted that in  August 2002, NIST published procedures for handling security patches  that provided principles and methodologies for establishing an explicit  and documented patching and vulnerability policy and a systematic,  accountable, and documented process for handling patches.
In addition to activities identified for these specific weaknesses, in last  year’s report, OMB reported that it would direct all large agencies to  undertake a Project Matrix review to more clearly identify and prioritize  the security needs for government assets. Project Matrix is a methodology  developed by the Critical Infrastructure Assurance Office (CIAO) (recently  transferred to the Department of Homeland Security) that identifies the  critical assets within an agency, prioritizes them, and then identifies  interrelationships with other agencies or the private sector. OMB  reported that once reviews have been completed at each large agency, it  would identify cross-government activities and lines of business for  Project Matrix reviews so that it will have identified both vertically and  horizontally the critical operations and assets of the federal government’s  critical enterprise architecture and their relationship beyond government.
As of July 2002, a CIAO official reported that of 31 agencies targeted for  Project Matrix reviews, 18 had begun their reviews; and of those, 5 had  completed the first step of the methodology to identify their critical assets,  2 found no candidate assets to undergo a process to identify critical assets,  5 had begun the second step to identify other federal government assets,  systems, and networks upon which their critical assets depend to operate,  and none had begun the third step to identify all associated dependencies  on private-sector owned and operated critical infrastructures. According  to a CIAO official in December 2003, the office’s goal was to complete  Project Matrix reviews for 24 of the 31 identified agencies by the end of  fiscal year 2004 and for the remaining 7 in fiscal year 2005. However, this  official also said that at the request of the Office of Homeland Security,  CIAO was revising and streamlining its Project Matrix methodology to be  less labor intensive for the agencies and reduce the time needed to identify  critical assets. In our recent discussions with OMB officials, they said they  were requiring Project Matrix reviews for 24 large departments and  agencies and that as part of their GISRA reporting, agencies were required  to report on the status of their efforts to identify critical assets and their  dependencies. However, they acknowledged that OMB did not establish  any deadlines for the completion of Project Matrix reviews. In our  February 2003 report, we also reported that neither the administration nor  the agencies we reviewed had milestones for the completion of Project  Matrix analyses and recommended that agencies coordinate with CIAO to  set these milestones.
Finally, in February 2002, OMB reported that a number of efforts were  under way to address security weaknesses in industry software  development, and that chief among them were national policy-level  activities of the Critical Infrastructure Protection Board (since  eliminated). At the technical product-level, OMB reported that the  National Information Assurance Partnership, operated jointly by NIST and  the National Security Agency, was certifying private-sector laboratories to  which product vendors may submit their software for analysis and  certification, but that this certification process was a lengthy one and  often cannot accommodate the “time-to-market” imperative that the  technology industry faces. According to recent discussions with OMB  officials, the National Information Assurance Partnership efforts are still  under way.
section_title: Agency GISRA Reporting Shows Progress, but Highlights Continued Weaknesses
paragraphs: Fiscal year 2002 GISRA reporting by CIOs and independent evaluations by  IGs for the 24 agencies provided an improved baseline for measuring  improvements in federal information security not only because of  performance measures that OMB now requires, but also because of  agencies’ increased review coverage and use of consistent methodologies.  For example, 16 agencies reported that they had reviewed the security of  60 percent or more of their systems and programs for their fiscal year 2002  GISRA reporting, with 10 of these reporting that they reviewed from 90 to  100 percent. Further, 13 agencies reported that coverage of agency  systems and programs increased for fiscal year 2002 compared to fiscal  year 2001. However, with 8 agencies reporting that they reviewed less than  half of their systems, improvements are still needed. Regarding their  methodologies, 21 agencies reported that, as required by OMB, they used  NIST’s Security Self-Assessment Guide for Information Technology  Systems or developed their own methodology that addressed all elements  of the guide, and only 3 agencies reported that they did not. By not  following the NIST guide, agencies may not identify all weaknesses. For  example, one agency reported that the methodology it used incorporated  many of the elements of NIST’s self-assessment guide, but the IG reported  that the methodology did not call for the detailed level of system reviews  required by the NIST guide nor did it include the requirement to test and  evaluate security controls.
In performing our analyses, we summarized and categorized the reported  information including data provided for the OMB-prescribed performance  measures. There were several instances where agency reports either did  not address or provide sufficient data for a question or measure. In  addition, IGs’ independent evaluations sometimes showed different results  than CIO reporting or identified data inaccuracies. Further, IG reporting  also did not always include comparable data, particularly for the  performance measures. In part, this was because although OMB  instructions said that the IGs should use the performance measures to  assist in evaluating agency officials’ performance, the IG was not required  to review the agency’s reported measures. Summaries of our analyses for  key requirements follow below.
subsections: section_title: Many Systems Still Do Not Have Risk Assessments or Up- to-Date Security Plans
paragraphs: GISRA required agencies to perform periodic threat-based risk  assessments for systems and data. Risk assessments are an essential  element of risk management and overall security program management  and, as our best practice work has shown, are an integral part of the  management processes of leading organizations. Risk assessments help  ensure that the greatest risks have been identified and addressed, increase  the understanding of risk, and provide support for needed controls. Our  reviews of federal agencies, however, frequently show deficiencies related  to assessing risk, such as security plans for major systems that are not  developed on the basis of risks. As a result, the agencies had accepted an  unknown level of risk by default rather than consciously deciding what  level of risk was tolerable.
As one of its performance measures for this requirement, OMB required  agencies to report the number and percentage of their systems that have  been assessed for risk during fiscal year 2001 and fiscal year 2002. Our  analyses of reporting for this measure showed some overall progress. For  example, of the 24 agencies we reviewed, 13 reported an increase in the  percentage of systems assessed for fiscal year 2002 compared to fiscal  year 2001. In addition, as illustrated in figure 3 below, for fiscal year 2002,  11 agencies reported that they had assessed risk for 90 to 100 percent of  their systems. However, it also shows that further efforts are needed by  other agencies, including the 9 that reported less than 60 percent of their  systems had been assessed for risk.
GISRA also required the agency head to ensure that the agency’s  information security plan is practiced throughout the life cycle of each  agency system. In its reporting instructions, OMB required agencies to  report whether the agency head had taken specific and direct actions to  oversee that program officials and the CIO are ensuring that security plans  are up to date and practiced throughout the life cycle. They also had to  report the number and percentage of systems that have an up-to-date  security plan. Our analyses showed that although most agencies reported  that they had taken such actions, IG reports disagreed for a number of  agencies, and many systems do not have up-to-date security plans.  Specifically, 21 agencies reported that the agency head had taken actions  to oversee that security plans are up to date and practiced throughout the  life cycle compared to the IGs reporting that only 9 agencies had taken  such actions. One IG reported that the agency’s security plan guidance  predates revisions to NIST and OMB guidance and, as a result, does not  contain key elements, such as the risk assessment methodology used to  identify threats and vulnerabilities. In addition, another IG reported that  although progress had been made, security plans had not been completed  for 62 percent of the agency’s systems. Regarding the status of agencies’  security plans, as shown in figure 4, half of the 24 agencies reported that  they had up-to-date security plans for 60 percent or more of their systems  for fiscal year 2002, including 7 that reported these plans for 90 percent or  more.
GISRA required agencies to provide training on security awareness for  agency personnel and on security responsibilities for information security  personnel. Our studies of best practices at leading organizations have  shown that they took steps to ensure that personnel involved in various  aspects of their information security programs had the skills and  knowledge they needed. They also recognized that staff expertise had to  be frequently updated to keep abreast of ongoing changes in threats,  vulnerabilities, software, security techniques, and security monitoring  tools. However, our past information security reviews at individual  agencies have shown that they have not provided adequate computer  security training to their employees, including contractor staff.
Among the performance measures for these requirements, OMB required  agencies to report the number and percentage of employees including  contractors that received security training during fiscal years 2001 and  2002 and the number of employees with significant security  responsibilities that received specialized training. For agency  employee/contractor security training, our analyses showed 16 agencies  reported that they provided security training to 60 percent or more of their  employees and contractors for fiscal year 2002, with 9 reporting 90 percent  or more. Of the remaining 8 agencies, 4 reported that such training was  provided for less than half of their employees/contractors, 1 reported that  none were provided this training, and 3 provided insufficient data for this  measure.
For specialized training for employees with significant security  responsibilities, some progress was indicated, but additional training is  needed. As indicated in figure 5, our analyses showed 11 agencies reported  that 60 percent or more of their employees with significant security  responsibilities had received specialized training for fiscal year 2002, with  5 reporting 90 percent or more. Of the remaining 13 agencies, 4 reported  less than 30 percent and one reported that none had received such  training.
Under GISRA, the agency head was responsible for ensuring that the  appropriate agency officials, evaluated the effectiveness of the information  security program, including testing controls. The act also required that the  agencywide information security program include periodic management  testing and evaluation of the effectiveness of information security policies  and procedures. Periodically evaluating the effectiveness of security  policies and controls and acting to address any identified weaknesses are  fundamental activities that allow an organization to manage its  information security risks cost effectively, rather than reacting to  individual problems ad hoc only after a violation has been detected or an  audit finding has been reported. Further, management control testing and  evaluation as part of the program reviews can supplement control testing  and evaluation in IG and GAO audits to help provide a more complete  picture of the agencies’ security postures.
As a performance measure for this requirement, OMB required the  agencies to report the number and percentage of systems for which  security controls have been tested and evaluated during fiscal years 2001  and 2002. Our analyses of the data agencies reported for this measure  showed that although 15 agencies reported an increase in the overall  percentage of systems being tested and evaluated for fiscal year 2002,  most agencies are not testing essentially all of their systems. As shown in  figure 6, our analyses showed that 14 agencies reported that they had  tested the controls of less than 60 percent of their systems for fiscal year  2002. Of the remaining 10 agencies, 4 reported that they had tested and  evaluated controls for 90 percent or more of their systems.
As another measure, OMB also required agencies to report the number and  percentage of systems that have been authorized for processing following  certification and accreditation. According to NIST’s draft Guidelines for  the Security Certification and Accreditation (C&A) of Federal  Information Technology Systems (Special Publication 800-37),  accreditation is the authorization of an IT system to process, store, or  transmit information, granted by a management official that provides a  form of quality control and challenges managers and technical staff to find  the best fit for security, given technical constraints, operational  constraints, and mission requirements. Certification is the comprehensive  evaluation of the technical and non-technical security controls of an IT  system to support the accreditation process that establishes the extent to  which a particular design and implementation meets a set of specified  security requirements. Certification provides the necessary information to  a management official to formally declare that an IT system is approved to  operate at an acceptable level of risk. The accreditation decision is based  on the implementation of an agreed upon set of management, operational,  and technical controls, and by accrediting the system, the management  office accepts the risk associated with it.
Our analysis of agencies’ reports showed mixed progress for this measure.  For example, 10 agencies reported increases in the percentage of systems  authorized for processing following certification and accreditation  compared to fiscal year 2001, but 8 reported decreases and 3 did not  change (3 others did not provide sufficient data). In addition, as shown in  figure 7, 8 agencies reported that for fiscal year 2002, 60 percent or more  of their systems had been authorized for processing following certification  and accreditation with only 3 of these reporting from 90 to 100 percent.  And of the remaining 16 agencies reporting less than 60 percent, 3  reported that none of their systems had been authorized.
In addition to this mixed progress, IG reports identified instances where  agencies’ certification and accreditation efforts were inadequate. For  example, one agency reported that 43 percent of its systems were  authorized for processing following certification and accreditation. IG  reporting agreed, but also noted that over a fourth of the systems  identified as authorized had been operating with an interim authorization  and did not meet all of the security requirements to be granted  accreditation. The IG also stated that, due to the risk posed by systems  operating without certification and full accreditation, the department  should consider identifying this deficiency as a material weakness.
section_title: Incident-Handling Capabilities Established, but Implementation Incomplete
paragraphs: GISRA required agencies to implement procedures for detecting,  reporting, and responding to security incidents. Although even strong  controls may not block all intrusions and misuse, organizations can reduce  the risks associated with such events if they promptly take steps to detect  intrusions and misuse before significant damage can be done. In addition,  accounting for and analyzing security problems and incidents are effective  ways for an organization to gain a better understanding of threats to its  information and of the cost of its security-related problems. Such analyses  can also pinpoint vulnerabilities that need to be addressed to help ensure  that they will not be exploited again. In this regard, problem and incident  reports can provide valuable input for risk assessments, help in prioritizing  security improvement efforts, and be used to illustrate risks and related  trends in reports to senior management. Our information security reviews  also confirm that federal agencies have not adequately (1) prevented  intrusions before they occur, (2) detected intrusions as they occur,  (3) responded to successful intrusions, or (4) reported intrusions to staff  and management. Such weaknesses provide little assurance that  unauthorized attempts to access sensitive information will be identified  and appropriate actions taken in time to prevent or minimize damage.
OMB included a number of performance measures in agency reporting  instructions that were related to detecting, reporting, and responding to  security incidents. These included the number of agency components with  an incident-handling and response capability, whether the agency and its  major components share incident information with FedCIRC in a timely  manner, and the numbers of incidents reported. OMB also required that  agencies report on how they confirmed that patches have been tested and  installed in a timely manner. Our analyses of agencies’ reports showed that  although most agencies reported that they have established incident  response capabilities, implementation of these capabilities is still not  complete. For example, 12 agencies reported that for fiscal year 2002, 90  percent or more of their components had incident handling and response  capabilities and 8 others reported that they provided these capabilities to  components through a central point within the agency. However, although  most agencies report having these capabilities for most components, in at  least two instances, the IGs’ evaluations identified instances where  incident response capabilities were not always implemented. For example,  one IG reported that the department established and implemented its  computer security incident-response capability on August 1, 2002, but had  not enforced procedures to ensure that components comply with a  consistent methodology to identify, document, and report computer  security incidents. Another IG reported that the agency had released  incident-handling procedures and established a computer incident  response team, but had not formally assigned members to the team or  effectively communicated procedures to employees.
Our analyses also showed that for fiscal year 2002, 13 agencies reported  they had oversight procedures to verify that patches have been tested and  installed in a timely manner and 10 reported they did not. Of those that did  not have procedures, several specifically mentioned that they planned to  participate in FedCIRC’s patch management process.
section_title: Agencies Show Progress in Identifying Critical Assets, but Most Have Not Identified Interdependencies
paragraphs: GISRA required that each agencywide information security program  ensure the integrity, confidentiality, and availability of systems and data  supporting the agency’s critical operations and assets. In addition, as  mentioned previously, OMB directed 24 of the largest agencies to undergo  a Project Matrix review to identify and characterize the operations and  assets and these assets’ associated infrastructure dependencies and  interdependencies that are most critical to the nation. For example, as part  of its GISRA reporting, OMB required the agencies to report whether they  had undergone a Project Matrix review or used another methodology to  identify their critical assets and their interdependencies and  interrelationships. Our analyses of agencies’ reports showed some overall  process in identifying critical assets, but limited progress in identifying  interdependencies. As shown in figure 8, a total of 14 agencies reported  they had identified their critical assets and operations—10 using Project  Matrix and 4 using other methodologies. In addition, five more agencies  reported that they were in some stage of identifying their critical assets  and operations, and three more planned to do so in fiscal year 2003.
Our analyses also showed that three agencies reported they had identified  the interdependencies for their critical assets, and four others reported  that they were in some stage of undertaking this   process.
section_title: Lack of Contingency Plan Testing Is a Major Weakness
paragraphs: Contingency plans provide specific instructions for restoring critical  systems, including such things as arrangements for alternative processing  facilities in case the usual facilities are significantly damaged or cannot be  accessed. At many of the agencies we have reviewed, we found incomplete  plans and procedures to ensure that critical operations can continue when  unexpected events occur, such as a temporary power failure, accidental  loss of files, or a major disaster. These plans and procedures were  incomplete because operations and supporting resources had not been  fully analyzed to determine which were most critical and would need to be  restored first. Further, existing plans were not fully tested to identify their  weaknesses. As a result, many agencies have inadequate assurance that  they can recover operational capability in a timely, orderly manner after a  disruptive attack.
As another of its performance measures, OMB required agencies to report  the number and percentage of systems for which contingency plans have  been tested in the past year. As shown in figure 9, our analyses showed  that for fiscal year 2002, only 2 agencies reported they had tested  contingency plans for 90 percent or more of their systems, while 20 had  tested contingency plans for less than 60 percent of their systems. One  reported that none had been tested.
GISRA requires agencies to develop and implement risk-based, cost- effective policies and procedures to provide security protection for  information collected or maintained either by the agency or for it by  another agency or contractor. In its fiscal year 2001 GISRA report to the  Congress, OMB identified poor security for contractor-provided services  as a common weakness and for fiscal year 2002 reporting, included  performance measures to help indicate whether the agency program  officials and CIO used appropriate methods, such as audits and  inspections, to ensure that service provided by a contractor are adequately  secure and meet security requirements. Our analyses showed that a  number of agencies reported that they have reviewed a large percentage of  services provided by a contractor, but others have reviewed only a small  number.
For operations and assets under the control of agency program officials,  16 agencies reported that for fiscal year 2002 they reviewed 60 percent or  more of contractor operations or facilities, with 7 of these reporting that  they reviewed 90 percent or more; and 4 reported that they reviewed less  than 30 percent.
For operations and assets under the control of the CIO, 11 agencies  reported that for fiscal year 2002 they reviewed 60 percent or more of  contractor operations or facilities, with 7 of these reporting they reviewed  90 percent or more; 3 reported that they reviewed less than 30 percent;  and 5 agencies reported that they had no services provided by a contractor  or another agency.
section_title: Reporting of Security Costs Shows Improvement
paragraphs: GISRA requires that each agency examine the adequacy and effectiveness  of information security policies, procedures, and practices in plans and  reports related to annual agency budgets and other statutory performance  reporting requirements. The act also requires each agency to describe the  resources, including budget, staffing, and training, that are necessary to  implement its agencywide information security program. For GISRA  reporting, OMB required agencies to report information on total security  funding included in their fiscal year 2002 budget request, fiscal year 2002  budget enacted, and the President’s fiscal year 2003 budget and to include  (1) a breakdown of security costs by each major operating division or  bureau and (2) CIP costs that apply to the protection of government  operations and assets.
Most agencies (21) reported total security funding for these budgets,  although 13 did not show costs by major operating division or bureau  and/or for CIP. Further, most agencies reported including security costs in  their budget requests and justifications. For example:    For the fiscal year 2003 budget, 16 agencies reported that they had  submitted capital asset plans and justifications to OMB with all requisite  security information, and of the remaining 8 agencies, 5 reported that less  than 30 percent of their capital asset plans and justifications did not  include this information. Last year, 19 agencies reported that they had not  included security requirements and costs on every fiscal year 2002 capital  asset plan submitted to OMB.
For fiscal year 2003, 18 agencies reported that security costs were  reported on the Exhibit 53 for all agency systems, with 5 reporting that  these costs were not reported for all agency systems.
section_title: Corrective Action Plans Provide Potential Tool for Monitoring Agency Progress
paragraphs: GISRA required that agencies develop a process for ensuring that remedial  action is taken to address significant deficiencies. As a result, OMB  required the agency head to work with the CIO and program officials to  provide a strategy to correct security weaknesses identified through  annual GISRA program reviews and independent evaluations, as well as  other reviews or audits performed throughout the reporting period by the  IG or GAO. Agencies were required to submit a corrective action plan for  all programs and systems where a security weakness had been identified  plus quarterly updates on the plan’s implementation. OMB guidance  required that these plans list the identified weaknesses and for each  identify a point of contact, the resources required to resolve the weakness,  the scheduled completion date, key milestones with completion dates for  the milestones, milestone changes, the source of the weakness (such as a  program review, IG audit, or GAO audit), and the status (ongoing or  completed). Agencies were also required to submit quarterly updates of  these plans that list the total number of weaknesses identified at the  program and system level, as well as the numbers of weaknesses for which  corrective actions were completed on time, ongoing and on schedule, or  delayed. Updates were also to include the number of new weaknesses  discovered subsequent to the last corrective action plan or quarterly  update.
Our analyses of agencies’ fiscal year 2002 corrective action plans and IGs’  evaluations of these plans showed that most agencies followed the OMB- prescribed format, but also that several used an existing tracking system  to meet this requirement. In theory, these plans could prove to be a useful  tool for the agencies in correcting their information security weaknesses.  However, their usefulness could be impaired to the extent that they do not  identify all weaknesses or provide realistic completion estimates. For  example, for the 24 agencies, only 5 IGs reported that their agency’s  corrective action plan addressed all identified significant weaknesses and  9 specifically reported that their agency’s plan did not. Our analyses also  showed that in several instances, corrective action plans did not indicate  the current status of weaknesses identified or include information  regarding whether actions were on track as originally scheduled.
Plan progress must be appropriately monitored and the actual correction  of weaknesses may require independent validation. Our analyses showed  that three IGs reported that their agencies did not have a centralized  tracking system to monitor the status of corrective actions. Also, one IG  specifically questioned the accuracy of unverified, self-reported corrective  actions reported in the agency’s plan.
section_title: Further Action Needed to Improve Federal Information Security
paragraphs: Recent audits and reviews, including annual GISRA program reviews and  independent evaluations, show that although agencies have made progress  in addressing GAO and IG recommendations to improve the effectiveness  of their information security, further action is needed. In particular, overall  security program management continues to be an area marked by  widespread and fundamental problems. Many agencies have not developed  security plans for major systems based on risk, have not documented  security policies, and have not implemented a program for testing and  evaluating the effectiveness of the controls they rely on. As a result, they  could not ensure that the controls they had implemented were operating  as intended and they could not make informed judgments as to whether  they were spending too little or too much of their resources on security.
Further information security improvement efforts are also needed at the  governmentwide level, and it is important that these efforts are guided by  a comprehensive strategy and, as development of this strategy continues,  that certain key issues be addressed. These issues and actions currently  under way are as follows.
First, the federal strategy should delineate the roles and responsibilities of  the numerous entities involved in federal information security and  describe how the activities of these organizations interrelate, who should  be held accountable for their success or failure, and whether these  activities will effectively and efficiently support national goals.
Second, more specific guidance to agencies on the controls that they need  to implement could help ensure adequate protection. Currently, agencies  have wide discretion in deciding which computer security controls to  implement and the level of rigor with which to enforce these controls. In  essence, one set of specific controls will not be appropriate for all types of  systems and data. Nevertheless, our studies of best practices at leading  organizations have shown that more specific guidance is important. In  particular, specific mandatory standards for varying risk levels can clarify  expectations for information protection, including audit criteria; provide a  standard framework for assessing information security risk; help ensure  that shared data are appropriately protected; and reduce demands for  limited resources to independently develop security controls. FISMA  requires NIST to develop standards that provide mandatory minimum  information security requirements.
Third, ensuring effective implementation of agency information security  and CIP plans will require active monitoring by the agencies to determine  whether milestones are being met and testing is being performed to  determine whether policies and controls are operating as intended. With  routine periodic evaluations, such as those required by GISRA and now  FISMA, performance measurements can be more meaningful. In addition,  the annual evaluation, reporting, and monitoring process established  through these provisions is an important mechanism, previously missing,  to hold agencies accountable for implementing effective security and to  manage the problem from a governmentwide perspective.
Fourth, the Congress and the executive branch can use audit results,  including the results of GISRA and FISMA reporting, to monitor agency  performance and take whatever action is deemed advisable to remedy  identified problems. Such oversight is essential for holding agencies  accountable for their performance, as was demonstrated by OMB and  congressional efforts to oversee the Year 2000 computer challenge.
Fifth, agencies must have the technical expertise they need to select,  implement, and maintain controls that protect their information systems.  Similarly, the federal government must maximize the value of its technical  staff by sharing expertise and information. As highlighted during the Year  2000 challenge, the availability of adequate technical and audit expertise is  a continuing concern to agencies.
Sixth, agencies can allocate resources sufficient to support their  information security and infrastructure protection activities. In our review  of first-year GISRA implementation, we reported that many agencies  emphasized the need for adequate funding to implement security  requirements, and that security funding varied widely across the agencies.  Funding for security is already embedded to some extent in agency  budgets for computer system development efforts and routine network  and system management and maintenance. However, additional amounts  are likely to be needed to address specific weaknesses and new tasks. At  the same time, OMB and congressional oversight of future spending on  information security will be important for ensuring that agencies are not  using the funds they receive to continue ad hoc, piecemeal security fixes  that are not supported by a strong agency risk-management process.  Further, we agree with OMB that much can be done to cost-effectively  address common weaknesses, such as limited security training, across  government rather than individually by agency.
Seventh, expanded research is needed in the area of information systems  protection. Although a number of research efforts are under way, experts  have noted that more is needed to achieve significant advances. In this  regard, the Congress recently passed and the President signed into law the  Cyber Security Research and Development Act to provide $903 million  over 5 years for cybersecurity research and education programs. This law  directs the National Science Foundation to create new cybersecurity  research centers, program grants, and fellowships. It also directs NIST to  create new program grants for partnerships between academia and  industry.
section_title: CIP Policy Has Continued to Evolve Since the Mid-1990s
paragraphs: CIP involves activities that enhance the security of our nation’s cyber and  physical public and private infrastructure that are critical to national  security, national economic security, and/or national public health and  safety. Federal awareness of the importance of securing our nation’s  critical infrastructures has continued to evolve since the mid-1990s. Over  the years, a variety of working groups has been formed, special reports  written, federal policies issued, and organizations created to address the  issues that have been raised. The following sections summarize key  developments in federal CIP policy to provide historical perspective.
subsections: section_title: President’s Commission Studied Critical Infrastructure Protection
paragraphs: In October 1997, the President’s Commission on Critical Infrastructure  Protection issued a report describing the potentially devastating  implications of poor information security for the nation. The report  recommended measures to achieve a higher level of CIP that included  industry cooperation and information sharing, a national organization  structure, a revised program of research and development, a broad  program of awareness and education, and a reconsideration of related  laws. It further stated that a comprehensive effort would need to “include  a system of surveillance, assessment, early warning, and response  mechanisms to mitigate the potential for cyberthreats.” The report also  urged the FBI to continue its efforts to develop warning and threat  analysis capabilities, which would enable it to serve as the preliminary  national warning center for infrastructure attacks and to provide law  enforcement, intelligence, and other information needed to ensure the  highest quality analysis possible.
section_title: Presidential Decision Directive 63 Established Initial CIP National Strategy
paragraphs: In 1998, the President issued Presidential Decision Directive 63 (PDD 63),  which described a strategy for cooperative efforts by government and the  private sector to protect the physical and cyber-based systems essential to  the minimum operations of the economy and the government. PDD 63  called for a range of actions intended to improve federal agency security  programs, improve the nation’s ability to detect and respond to serious  computer-based and physical attacks, and establish a partnership between  the government and the private sector. The directive called on the federal  government to serve as a model of how infrastructure assurance is best  achieved and designated lead agencies to work with private-sector and  government organizations. Further, it established CIP as a national goal  and stated that, by the close of 2000, the United States was to have  achieved an initial operating capability to protect the nation’s critical  infrastructures from intentional destructive acts and, by 2003, have  developed the ability to protect the nation’s critical infrastructures from  intentional destructive attacks.
To accomplish its goals, PDD 63 established and designated organizations  to provide central coordination and support, including  the Critical Infrastructure Assurance Office (CIAO), an interagency office  housed in the Department of Commerce, which was established to develop  a national plan for CIP on the basis of infrastructure plans developed by  the private sector and federal agencies; the National Infrastructure Protection Center (NIPC), an organization  within the FBI, which was expanded to address national-level threat  assessment, warning, vulnerability, and law enforcement  investigation/response; and the National Infrastructure Assurance Council (NIAC), which was  established to enhance the partnership of the public and private sectors in  protecting our critical infrastructures.
To ensure coverage of critical sectors, PDD 63 also identified eight private- sector infrastructures and five special functions. For each of the  infrastuctures and functions, the directive designated lead federal  agencies, referred to as sector liaisons, to work with their counterparts in  the private sector, referred to as sector coordinators. To facilitate private- sector participation, PDD 63 also encouraged the voluntary creation of  information sharing and analysis centers (ISACs) to serve as mechanisms  for gathering, analyzing, and appropriately sanitizing and disseminating  information to and from infrastructure sectors and the federal government  through NIPC. Figure 3 displays a high-level overview of the organizations  with CIP responsibilities, as outlined by PDD 63.
PDD 63 called for a range of activities intended to establish a partnership  between the public and private sectors to ensure the security of our  nation’s critical infrastructures. The sector liaison and the sector  coordinator were to work with each other to address problems related to  CIP for their sector. In particular, PDD 63 stated that they were to  (1) develop and implement vulnerability awareness and education  programs and (2) contribute to a sectoral National Infrastructure  Assurance Plan by    assessing the vulnerabilities of the sector to cyber or physical attacks;  recommending a plan to eliminate significant vulnerabilities;   proposing a system for identifying and preventing major attacks; and    developing a plan for alerting, containing, and rebuffing an attack in  progress and then, in coordination with FEMA as appropriate, rapidly  reconstituting minimum essential capabilities in the aftermath of an  attack.
PDD 63 also required every federal department and agency to be  responsible for protecting its own critical infrastructures, including both  cyber-based and physical assets. To fulfill this responsibility, PDD 63  called for agencies’ CIOs to be responsible for information assurance, and  it required every agency to appoint a chief infrastructure assurance officer  to be responsible for the protection of all other aspects of an agency’s  critical infrastructure. Further, it required federal agencies to:    develop, implement, and periodically update a plan for protecting its    determine its minimum essential infrastructure that might be a target of    conduct and periodically update vulnerability assessments of its minimum    develop a recommended remedial plan based on vulnerability assessments  that identifies time lines for implementation, responsibilities, and funding;  and    analyze intergovernmental dependencies, and mitigate those  dependencies.
Other PDD 63 requirements for federal agencies are that they provide  vulnerability awareness and education to sensitize people regarding the  importance of security and to train them in security standards, particularly  regarding cybersystems; that they establish a system for responding to a  significant infrastructure attack while it is under way, to help isolate and  minimize damage; and that they establish a system for rapidly  reconstituting minimum required capabilities for varying levels of  successful infrastructure attacks.
subsections: section_title: National Plan for Information Systems Protection Provided Plan for Federal Government
paragraphs: In January 2000, the White House issued its National Plan for Information  Systems Protection. The national plan provided a vision and framework  for the federal government to prevent, detect, respond to, and protect the  nation’s critical cyber-based infrastructure from attack and reduce existing  vulnerabilities by complementing and focusing existing federal computer  security and information technology requirements. Subsequent versions of  the plan were expected to (1) define the roles of industry and of state and  local governments working in partnership with the federal government to  protect physical and cyber-based infrastructures from deliberate attack  and (2) examine the international aspects of CIP.
section_title: Executive Order 13228 Established the Office of Homeland Security
paragraphs: In October 2001, the President issued Executive Order (EO)  13228,establishing the Office of Homeland Security within the Executive  Office of the President and the Homeland Security Council. It stated that  the Office of Homeland Security was “to develop and coordinate the  implementation of a comprehensive national strategy to secure the United  States from terrorist threats or attacks.” In addition, EO 13228 stated that,  among other things, the Office of Homeland Security was to coordinate  efforts to protect critical public and privately owned information systems  within the United States from terrorist attacks. Further, it established the  Homeland Security Council to advise and assist the President with respect  to all aspects of homeland security, to serve as the mechanism for  ensuring coordination of homeland security-related activities of executive  departments and agencies, and to develop and implement homeland  security policies.
section_title: Executive Order 13231 Established the CIP Board
paragraphs: In October 2001, President Bush signed EO13231, establishing the  President’s Critical Infrastructure Protection Board to coordinate cyber- related federal efforts and programs associated with protecting our  nation’s critical infrastructures. Executive Order 13231 tasked the board  with recommending policies and coordinating programs for protecting  CIP-related information systems. The Special Advisor to the President for  Cyberspace Security chaired the board. The executive order also  established 10 standing committees to support the board’s work on a wide  range of critical information. According to EO 13231, the board’s  responsibilities were to recommend policies and coordinate programs for  protecting information systems for critical infrastructures, including  emergency preparedness communications and the physical assets that  support such systems. The Special Advisor reported to the Assistant to the  President for National Security Affairs and to the Assistant to the  President for Homeland Security and coordinated with the Assistant to the  President for Economic Policy on issues relating to private-sector systems  and economic effects and with the Director of OMB on issues relating to  budgets and the security of federal computer systems. Executive Order  13231 emphasized the importance of CIP and the ISACs, but neither order  identified additional requirements for agencies to protect their critical  infrastructures or suggested additional activities for the ISACs.
section_title: National Strategy for Homeland Security Included CIP Components
paragraphs: In July 2002, the President issued the National Strategy for Homeland  Security, with strategic objectives to (1) prevent terrorist attacks within  the United States, (2) reduce America’s vulnerability to terrorism, and  (3) minimize the damage and recovery from attacks that do occur. To  ensure coverage of critical infrastructure sectors, this strategy identified  13 industry sectors, expanded from the 8 originally identified in PDD 63, as  essential to our national security, national economic security, and/or  national public health and safety. Lead federal agencies were identified  and directed to work with their counterparts in the private sector to assess  sector vulnerabilities and to develop plans to eliminate vulnerabilities. The  sectors and their lead agencies are listed in table 2.
section_title: The Homeland Security Act Created the Department of Homeland Security
paragraphs: The Homeland Security Act of 2002 (signed by the President on November  25, 2002) established the Department of Homeland Security (DHS).  Regarding CIP, the new department is responsible for, among other things,  (1) developing a comprehensive national plan for securing the key  resources and critical infrastructure of the United States;  (2) recommending measures to protect the key resources and critical  infrastructure of the United States in coordination with other federal  agencies and in cooperation with state and local government agencies and  authorities, the private sector, and other entities; and (3) disseminating, as  appropriate, information analyzed by the department both within the  department and to other federal agencies, state and local government  agencies, and private-sector entities to assist in the deterrence, prevention,  preemption of, or response to terrorist attacks. To help accomplish these  functions, the act created the Information Analysis and Infrastructure  Protection Directorate within the new department and transferred to it the  functions, personnel, assets, and liabilities of several existing  organizations with CIP responsibilities, including NIPC (other than the  Computer Investigations and Operations Section) and the CIAO.
The National Strategy for Homeland Security called for the Office of  Homeland Security and the President’s Critical Infrastructure Protection  Board to complete cyber and physical infrastructure protection plans,  which would serve as the baseline for later developing the comprehensive  national infrastructure protection plan. Such a plan was subsequently  required by the Homeland Security Act of 2002. On February 14, 2003, the  President released the National Strategy to Secure Cyberspace and the  complementary National Strategy for the Physical Protection of Critical  Infrastructures and Key Assets. These two strategies identify priorities,  actions, and responsibilities for the federal government, including lead  agencies and DHS, as well as for state and local governments and the  private sector.
section_title: The National Strategy to Secure Cyberspace Provided Initial Framework for Cyber CIP
paragraphs: The National Strategy to Secure Cyberspace is intended to provide an  initial framework for both organizing and prioritizing efforts to protect our  nation’s cyberspace. It is also to provide direction to federal departments  and agencies that have roles in cyberspace security and to identify steps  that state and local governments, private companies and organizations,  and individual Americans can take to improve our collective  cybersecurity. The strategy reiterates the critical infrastructure sectors  and the related lead federal agencies as identified in The National  Strategy for Homeland Security. In addition, the strategy identifies DHS  as the central coordinator for cyberspace efforts. As such, DHS is  responsible for coordinating and working with other federal entities  involved in cybersecurity. This strategy is organized according to five  national priorities, with major actions and initiatives identified for each:  1.  A National Cyberspace Security Response System—Coordinated  by DHS, this system is described as a public/private architecture for  analyzing and warning, managing incidents of national significance,  promoting continuity in government systems and private-sector  infrastructures, and increasing information sharing across and  between organizations to improve cyberspace security. The system is  to include governmental entities and nongovernmental entities, such as  private-sector ISACs. Major actions and initiatives identified for  cyberspace security response include providing for the development of  tactical and strategic analysis of cyber attacks and vulnerability  assessments; expanding the Cyber Warning and Information Network  to support the role of DHS in coordinating crisis management for  cyberspace security; coordinating processes for voluntary  public/private participation in the development of national  public/private continuity and contingency plans; exercising  cybersecurity continuity plans for federal systems; and improving and  enhancing public/private information sharing involving cyber attacks,  threats, and vulnerabilities.  2.  A National Cyberspace Security Threat and Vulnerability  Reduction Program—This priority focuses on reducing threats and  deterring malicious actors through effective programs to identify and  punish them; identifying and remediating those existing vulnerabilities  that, if exploited, could create the most damage to critical systems;  and developing new systems with less vulnerability and assessing  emerging technologies for vulnerabilities. Other major actions and  initiatives include creating a process for national vulnerability  assessments to better understand the potential consequences of  threats and vulnerabilities, securing the mechanisms of the Internet by  improving protocols and routing, fostering the use of trusted digital  control and supervisory control and data acquisition systems,  understanding infrastructure interdependencies and improving the  physical security of cybersystems and telecommunications, and  prioritizing federal cybersecurity research and development agendas.  3.  A National Cyberspace Security Awareness and Training  Program—This priority emphasizes promoting a comprehensive  national awareness program to empower all Americans—businesses,  the general workforce, and the general population—to secure their  own parts of cyberspace. Other major actions and initiatives include  fostering adequate training and education programs to support the  nation’s cybersecurity needs; increasing the efficiency of existing  federal cybersecurity training programs; and promoting private-sector  support for well-coordinated, widely recognized professional  cybersecurity certification.  4.  Securing Governments’ Cyberspace—To help protect, improve, and  maintain governments’ cybersecurity, major actions and initiatives for  this priority include continuously assessing threats and vulnerabilities  to federal cyber systems; authenticating and maintaining authorized  users of federal cyber systems; securing federal wireless local area  networks; improving security in government outsourcing and  procurement; and encouraging state and local governments to consider  establishing information technology security programs and  participating in ISACs with similar governments.  5.  National Security and International Cyberspace Security  Cooperation—This priority identifies major actions and initiatives to  strengthen U.S. national security and international cooperation. These  include strengthening cyber-related counterintelligence efforts,  improving capabilities for attack attribution and response, improving  coordination for responding to cyber attacks within the U.S. national  security community, working with industry and through international  organizations to facilitate dialogue and partnerships among  international public and private sectors focused on protecting  information infrastructures, and fostering the establishment of  national and international watch-and-warning networks to detect and  prevent cyber attacks as they emerge.
section_title: The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets Provided National Policy for Physical CIP
paragraphs: The National Strategy for the Physical Protection of Critical  Infrastructures and Key Assets provides a statement of national policy to  remain committed to protecting critical infrastructures and key assets  from terrorist attacks. Although the strategy does not explicitly mention  PDD 63, it builds on the directive with its sector-based approach that  includes the 13 sectors defined in the National Strategy for Homeland  Security, identifies federal departments and agencies as sector liaisons,  and calls for expanding the capabilities of ISACs. The strategy is based on  eight guiding principles, including establishing responsibility and  accountability, encouraging and facilitating partnering among all levels of  government and between government and industry, and encouraging  market solutions wherever possible and government intervention when  needed. The strategy also establishes three strategic objectives. The first is  to identify and assure the protection of the most critical assets, systems,  and functions, in terms of national-level public health and safety,  governance, and economic and national security and public confidence.  This would include establishing a uniform methodology for determining  national-level criticality. The second strategic objective is to assure the  protection of infrastructures and assets facing specific, imminent threats;  and the third is to pursue collaborative measures and initiatives to assure  the protection of other potential targets that may become attractive over  time. Under this strategy, DHS will provide overall cross-sector  coordination and serve as the primary liaison and facilitator for  cooperation among federal agencies, state and local governments, and the  private sector. The strategy states that the private sector generally remains  the first line of defense for its own facilities and should reassess and  adjust their planning, assurance, and investment programs to better  accommodate the increased risk presented by deliberate acts of violence.  In addition, the Office of Homeland Security will continue to act as the  President’s principal policy adviser staff and coordinating body for major  interagency policy issues related to homeland security.
section_title: Executive Order 13286 Reflected Establishment of DHS
paragraphs: On February 28, 2003, Executive Order (EO) 13231 was amended in its  entirety by Executive Order 13286. Although EO 13286 maintained the  same national policy statement regarding the protection against disruption  of information systems for critical infrastructures, it dissolved the  President’s Critical Infrastructure Protection Board that was to coordinate  cyber-related federal efforts and programs associated with protecting our  nation’s critical infrastructures, and the board’s chair— the Special  Advisor to the President for Cyberspace Security—and related staff, along  with the 10 standing committees established to support the board’s work  on a wide range of critical information infrastructure efforts. According to  EO 13286, the NIAC is to continue to provide the President with advice on  the security of information systems for critical infrastructures supporting  other sectors of the economy. However, NIAC will provide its advice  through the Secretary of Homeland Security. Regarding the functions of  the standing committees, an OMB official stated that OMB will continue to  oversee the federal information security committee functions. Further,  recent media reports state that efforts are underway to ensure the  transition of certain other functions to DHS.
section_title: Other Developments
paragraphs: On March 1, 2003, DHS assumed certain essential information and analysis  and infrastructure protection functions and organizations, including NIPC  (other than the Computer Investigation and Operations Section) and the  CIAO. Currently, according a Department of Homeland Security official,  the department is continuing to carry out the activities previously  performed by NIPC and the other transferred functions and organizations.  Further, the official stated that the department is enhancing those  activities as they are integrated within the new department and are  developing a business plan. The DHS official stated that the department is  continuing previously established efforts to maintain and build  relationships with other federal entities, including the FBI and other NIPC  partners, and with the private sector. In addition, the department plans to  provide staff to work at the proposed Terrorist Threat Integration Center.  Although NIPC experienced the loss of certain senior leadership prior to  transition to the new department and have identified some staffing needs,  the DHS official stated that the department is able to provide the functions  previously performed by NIPC.
section_title: The Nation Faces Ongoing CIP Challenges
paragraphs: Although the actions taken to date are major steps to more effectively  protect our nation’s critical infrastructures, we have made numerous  recommendations over the last several years concerning CIP challenges  that still need to be addressed. For each of these challenges,  improvements have been made and continuing efforts are in progress.  However, even greater efforts are needed to address them. These  challenges include developing a comprehensive and coordinated national  CIP plan, improving information sharing on threats and vulnerabilities,  improving analysis and warning capabilities, and ensuring appropriate  incentives to encourage entities outside of the federal government to  increase their CIP efforts. It is also important that CIP efforts be  appropriately integrated with DHS.
subsections: section_title: A Comprehensive and Coordinated National CIP Plan Needs to Be Developed
paragraphs: An underlying issue in the implementation of CIP is that no national plan  yet exists that clearly delineates the roles and responsibilities of federal  and nonfederal CIP entities, defines interim objectives and milestones,  sets timeframes for achieving objectives, and establishes performance  measures. Such a clearly defined plan is essential for defining the  relationships among all CIP organizations to ensure that the approach is  comprehensive and well coordinated. Since 1998, we have reported on the  need for such a plan and made numerous related recommendations.
In September 1998, we reported that developing a governmentwide  strategy that clearly defined and coordinated the roles of federal entities  was important to ensure governmentwide cooperation and support for  PDD 63. At that time, we recommended that OMB and the Assistant to  the President for National Security Affairs ensure such coordination.
In January 2000, the President issued Defending America’s Cyberspace:  National Plan for Information Systems Protection: Version 1.0: An  Invitation to a Dialogue as a first major element of a more comprehensive  effort to protect the nation’s information systems and critical assets from  future attacks. The plan proposed achieving the twin goals of making the  U.S. government a model of information security and developing a  public/private partnership to defend our national infrastructures.
However, this plan focused largely on federal cyber CIP efforts, saying  little about the private-sector role.
In September 2001, we reported that agency questions had surfaced  regarding specific roles and responsibilities of entities involved in cyber  CIP and the timeframes within which CIP objectives were to be met, as  well as guidelines for measuring progress. Accordingly, we made several  recommendations to supplement those we had made in the past.  Specifically, we recommended that the Assistant to the President for  National Security Affairs ensure that the federal government’s strategy to  address computer-based threats define    specific roles and responsibilities of organizations involved in CIP and  related information security activities; interim objectives and milestones for achieving CIP goals and a specific  action plan for achieving these objectives, including implementing  vulnerability assessments and related remedial plans; and   performance measures for which entities can be held accountable.
In July 2002 we issued a report identifying at least 50 organizations that  were involved in national or multinational cyber CIP efforts, including 5  advisory committees, 6 Executive Office of the President organizations, 38  executive branch organizations associated with departments, agencies, or  intelligence organizations, and 3 other organizations. Although our  review did not cover organizations with national physical CIP  responsibilities, the large number of organizations that we did identify as  involved in CIP efforts presents a need to clarify how these entities  coordinate their activities with each other. Our report also stated that PDD  63 did not specifically address other possible critical sectors and their  respective federal agency counterparts. Accordingly, we recommended  that the federal government’s strategy also  include all relevant sectors and define the key federal agencies’ roles and  responsibilities associated with each of these sectors, and    define the relationships among the key CIP organizations.
In July 2002, the National Strategy for Homeland Security called for  interim cyber and physical infrastructure protection plans that DHS would  use to build a comprehensive national infrastructure plan. According to  the National Strategy for Homeland Security, the national plan is to  provide a methodology for identifying and prioritizing critical assets,  systems, and functions, and for sharing protection responsibility with state  and local government and the private sector. The plan is to establish  standards and benchmarks for infrastructure protection and provide a  means to measure performance. The strategy also states that DHS is to  unify the currently divided responsibilities for cyber and physical security.  In November 2002, as mentioned previously, the Homeland Security Act of  2002 created DHS and, among other things, required it to develop a  comprehensive national plan.
In February 2003, the President issued the interim strategies—The  National Strategy to Secure Cyberspace and The National Strategy for  the Physical Protection of Critical Infrastructures and Key Assets  (hereafter referred to in this testimony as the cyberspace security strategy  and the physical protection strategy). Both define strategic objectives for  protecting our nation’s critical assets. These strategies identify priorities,  actions, and responsibilities for the federal government, including federal  lead departments and agencies and DHS, as well as for state and local  governments and the private sector. The two do not (1) clearly indicate  how the physical and cyber efforts will be coordinated; (2) define the  roles, responsibilities, and relationships among the key CIP organizations,  including state and local governments and the private sector; (3) indicate  time frames or milestones for their overall implementation or for  accomplishing specific actions or initiatives; or (4) establish performance  measures for which entities can be held responsible. Until a  comprehensive and coordinated plan is completed that unifies the  responsibilities for cyber and physical infrastructures; identifies roles,  responsibilities, and relationships for all CIP efforts; establish time frames  or milestones for implementation; and establishes performance measures,  our nation risks not having a consistent and appropriate framework to  deal with growing threats to its critical infrastructure.
section_title: Better Information Sharing on Threats and Vulnerabilities Must Be Implemented
paragraphs: Information sharing is a key element in developing comprehensive and  practical approaches to defending against cyber attacks, which could  threaten the national welfare. Information on threats, vulnerabilities, and  incidents experienced by others can help identify trends, better  understand the risks faced, and determine what preventive measures  should be implemented. However, as we have reported in recent years,  establishing the trusted relationships and information-sharing protocols  necessary to support such coordination can be difficult. In addition, the  private sector has expressed concerns about sharing information with the  government and the difficulty of obtaining security clearances.
In October 2001, we reported on information sharing practices that could  benefit CIP. These practices include    establishing trust relationships with a wide variety of federal and  nonfederal entities that may be in a position to provide potentially useful  information and advice on vulnerabilities and incidents;   developing standards and agreements on how shared information will be    establishing effective and appropriately secure communications  taking steps to ensure that sensitive information is not inappropriately  disseminated, which may require statutory changes.
A number of activities have been undertaken to build relationships  between the federal government and the private sector, such as InfraGard,  the Partnership for Critical Infrastructure Security, efforts by the CIAO,  and efforts by lead agencies to establish ISACs. For example, the  InfraGard Program, which provides the FBI and NIPC with a means of  securely sharing information with individual companies, has expanded  substantially. By early January 2001, 518 entities were InfraGard  members—up from 277 members in October 2000. Members include  representatives from private industry, other government agencies, state  and local law enforcement, and the academic community. As of February  2003, InfraGard members totaled over 6,700.
As stated above, PDD 63 encouraged the voluntary creation of ISACs to  serve as the mechanism for gathering, analyzing, and appropriately  sanitizing and disseminating information between the private sector and  the federal government through NIPC. ISACs are critical since private- sector entities control over 80 percent of our nation’s critical  infrastructures. Their activities could improve the security posture of the  individual sectors, as well as provide an improved level of communication  within and across sectors and all levels of government.
While PDD 63 encouraged the creation of ISACs, it left the actual design  and functions of the ISACs, along with their relationship with NIPC, to be  determined by the private sector in consultation with the federal  government. PDD 63 did provide suggested activities which the ISACs  could undertake, including:    establishing baseline statistics and patterns on the various infrastructures;    serving as a clearinghouse for information within and among the various    providing a library for historical data for use by the private sector and  reporting private-sector incidents to NIPC.
In April 2001, we reported that NIPC and other government entities had  not developed fully productive information-sharing relationships but that  NIPC had undertaken a range of initiatives to foster information sharing  relationships with ISACs, as well as with government and international  entities. We recommended that NIPC formalize relationships with ISACs  and develop a plan to foster a two-way exchange of information between  them.
In response to our recommendations, NIPC officials told us in July 2002  that an ISAC development and support unit had been created, whose  mission was to enhance private-sector cooperation and trust so that it  would result in a two-way sharing of information. DHS now reports that  there are currently 16 ISACs, including ISACs established for sectors not  identified as critical infrastructure sectors. Table 3 lists the current ISACs  identified by DHS and the lead agencies. DHS officials stated that they  have formal agreements with most of the current ISACs.
In spite of progress made in establishing ISACs, additional efforts are  needed. All sectors do not have a fully established ISAC, and of those  sectors that do, there is mixed participation. The amount of information  being shared between the federal government and private-sector  organizations also varies. Specifically, the five ISACs we recently  reviewed showed different levels of progress in implementing the PDD 63  suggested activities. Specifically, four of the five reported that efforts to  establish baseline statistics were still in progress. Also, while all five  reported that they serve as the clearinghouse for their own sectors, only  three of the five reported that they are also coordinating with other  sectors. Only one of the five ISACs reported that it provides a library of  incidents and historical data that is available to both the private sector and  the federal government, and although three additional ISACs do maintain a  library, it is available only to the private sector. The one remaining ISAC  reported that they had yet to develop a library but have plans to do so.  Finally, four of the five stated that they report incidents to NIPC on a  regular basis.
Some in the private sector have expressed concerns about voluntarily  sharing information with the government. Specifically, concerns have been  raised that industry could potentially face antitrust violations for sharing  information with other industry partners, have their information subject to  the Freedom of Information Act (FOIA), or face potential liability  concerns for information shared in good faith. For example, neither the  information technology nor the energy or the water ISACs share their  libraries with the federal government because of concerns that  information could be released under FOIA. And, officials of the energy  ISAC stated that they have not reported incidents to NIPC because of  FOIA and antitrust concerns.
Other obstacles to information sharing, previously mentioned in  congressional testimony, include difficulty obtaining security clearances  for ISAC personnel and the reluctance to disclose corporate information.  In July 2002 congressional testimony, the Director of Information  Technology for the North American Electric Reliability Council stated that  the owners of critical infrastructures need access to more specific threat  information and analysis from the public sector and that this may require  either more security clearances or declassifying information.
There will be continuing debate as to whether adequate protection is being  provided to the private sector as these entities are encouraged to disclose  and exchange information on both physical and cyber security problems  and solutions that are essential to protecting our nation’s critical  infrastructures. The National Strategy for Homeland Security, which  outlines 12 major legislative initiatives, includes “enabling critical  infrastructure information sharing.” It states that the nation must meet this  need by narrowly limiting public disclosure of information relevant to  protecting our physical and cyber critical infrastructures in order to  facilitate its voluntary submission. It further states that the Attorney  General will convene a panel to propose any legal changes necessary to  enable sharing of essential homeland security related information between  the federal government and the private sector.
Actions have already been taken by the Congress and the administration to  strengthen information sharing. For example, the USA PATRIOT Act  promotes information sharing among federal agencies, and numerous  terrorism task forces have been established to coordinate investigations  and improve communications among federal and local law enforcement.  Moreover, the Homeland Security Act of 2002 includes provisions that  restrict federal, state, and local government use and disclosure of critical  infrastructure information that has been voluntarily submitted to the DHS.  These restrictions include exemption from disclosure under FOIA, a  general limitation on use to CIP purposes, and limitations on use in civil  actions and by state or local governments. The act also provides penalties  for any federal employee who improperly discloses any protected critical  infrastructure information. At this time, it is too early to tell what impact  the new law will have on the willingness of the private sector to share  critical infrastructure information.
Information sharing within the government also remains a challenge. In  April 2001, we reported that NIPC and other government entities had not  developed fully productive information sharing and cooperative  relationships. For example, federal agencies had not routinely reported  incident information to NIPC, at least in part because guidance provided  by the federal Chief Information Officers Council, which is chaired by the  Office of Management and Budget, directs agencies to report such  information to the General Services Administration’s FedCIRC. Further,  NIPC and DOD officials agreed that their information-sharing procedures  needed improvement, noting that protocols for reciprocal exchanges of  information had not been established. In addition, the expertise of the U.S.  Secret Service regarding computer crime had not been integrated into  NIPC efforts. The NIPC director stated in July 2002 that the relationship  between NIPC and other government entities had significantly improved  since our review, and the quarterly meetings with senior government  leaders were instrumental in improving information sharing. In addition, in  testimony subsequent to our work, officials from the FedCIRC and the U.S.  Secret Service discussed the collaborative and cooperative relationships  that had since been formed between their agencies and NIPC.
The private sector has also expressed its concerns about the value of  information being provided by the government. For example, in July 2002  the President for the Partnership for Critical Infrastructure Security stated  in congressional testimony that information sharing between the  government and private sector needs work, specifically, in the quality and  timeliness of cyber security information coming from the government.
The cyberspace security strategy reiterates that the federal government  encourages the private sector to continue to establish ISACs and to  enhance the analytical capabilities of existing ISACs. It states that ISACs  will play an increasingly important role in the national cyberspace security  response system and the overall missions of homeland security. In  addition, the physical protection strategy states that the overall  management of information sharing activities among government agencies  and between public and private sectors has lacked proper coordination  and facilitation. The physical protection strategy also establishes specific  initiatives for creating more effective and efficient information sharing,  including defining protection-related information sharing requirements  and promoting the development and operation of critical sector ISACs,  and implementing the statutory authorities and powers of the Homeland  Security Act of 2002.
section_title: Analysis and Warning Capabilities Need to Be Improved
paragraphs: Another key CIP challenge is to develop more robust analysis and warning  capabilities to identify threats and provide timely warnings, including an  effective methodology for strategic analysis and a framework for  collecting needed threat and vulnerability information. Such capabilities  need to address both cyber and physical threats.
NIPC was established in PDD 63 as “a national focal point” for gathering  information on threats and facilitating the federal government’s response  to computer-based incidents. Specifically, the directive assigned NIPC the  responsibility for providing comprehensive analyses on threats,  vulnerabilities, and attacks; issuing timely warnings on threats and attacks;  facilitating and coordinating the government’s response to computer- based incidents; providing law enforcement investigation and response,  monitoring reconstitution of minimum required capabilities after an  infrastructure attack; and promoting outreach and information sharing.  This responsibility requires obtaining and analyzing intelligence, law  enforcement, and other information to identify patterns that may signal  that an attack is under way or imminent. Similar activities are also called  for in DHS’s Information Analysis and Infrastructure Protection  Directorate, which has absorbed NIPC.
In April 2001, we reported on NIPC’s progress in developing national  capabilities for analyzing threat and vulnerability data, issuing warnings,  and responding to attacks, among other issues. Overall, we found that  while progress in developing these capabilities was mixed, NIPC had  initiated a variety of CIP efforts that had laid a foundation for future  governmentwide efforts. In addition, NIPC had provided valuable support  and coordination related to investigating and otherwise responding to  attacks on computers. However, at the close of our review, the analytical  capabilities that PDD 63 asserted were needed to protect the nation’s  critical infrastructures had not yet been achieved, and NIPC had  developed only limited warning capabilities. Developing such capabilities  is a formidable task that experts say will take an intense interagency  effort.
At the time of our review, NIPC had issued a variety of analytical products,  most of which have been tactical analyses pertaining to individual  incidents. In addition, it had issued a variety of publications, most of  which were compilations of information previously reported by others  with some NIPC analysis. We reported that the use of strategic analysis to  determine the potential broader implications of individual incidents had  been limited. Such analysis looks beyond one specific incident to consider  a broader set of incidents or implications that may indicate a potential  threat of national importance. Identifying such threats assists in  proactively managing risk, including evaluating the risks associated with  possible future incidents and effectively mitigating the impact of such  incidents.
We also reported that three factors hindered NIPC’s ability to develop  strategic analytical capabilities:    First, there was no generally accepted methodology for analyzing strategic  cyber-based threats. For example, there was no standard terminology, no  standard set of factors to consider, and no established thresholds for  determining the sophistication of attack techniques. According to officials  in the intelligence and national security community, developing such a  methodology would require an intense interagency effort and dedication of  resources.
Second, NIPC had sustained prolonged leadership vacancies and did not  have adequate staff expertise, in part because other federal agencies had  not provided the originally anticipated number of detailees. For example,  at the close of our review in February 2001, the position of Chief of the  Analysis and Warning Section, which was to be filled by the Central  Intelligence Agency, had been vacant for about half of NIPC’s 3-year  existence. In addition, NIPC had been operating with only 13 of the 24  analysts that NIPC officials estimated were needed to develop analytical  capabilities.
Third, NIPC did not have industry-specific data on factors such as critical  system components, known vulnerabilities, and interdependencies. Under  PDD 63, such information is to be developed for each of eight industry  segments by industry representatives and the designated federal lead  agencies. However, at the close of our work, only three industry  assessments had been partially completed, and none had been provided to  NIPC. In September 2001, we reported that although outreach efforts had  raised awareness and improved information sharing, substantive,  comprehensive analysis of infrastructure sector interdependencies and  vulnerabilities had been limited.
To provide a warning capability, NIPC had established a Watch and  Warning Unit that monitors the Internet and other media 24 hours a day to  identify reports of computer-based attacks. While some warnings were  issued in time to avert damage, most of the warnings, especially those  related to viruses, pertained to attacks under way. We reported that  NIPC’s ability to issue warnings promptly was impeded because of (1) a  lack of a comprehensive governmentwide or nationwide framework for  promptly obtaining and analyzing information on imminent attacks; (2) a  shortage of skilled staff; (3) the need to ensure that NIPC does not raise  undue alarm for insignificant incidents; and (4) the need to ensure that  sensitive information is protected, especially when such information  pertains to law enforcement investigations under way.
In addition, NIPC’s own plans for further developing its analysis and  warning capabilities were fragmented and incomplete. The relationships  between the Center, the FBI, and the National Coordinator for Security,  Infrastructure Protection, and Counter-Terrorism at the National Security  Council were unclear regarding who had direct authority for setting NIPC  priorities and procedures and providing NIPC oversight. As a result, no  specific priorities, milestones, or program performance measures existed  to guide NIPC’s actions or provide a basis for evaluating its progress.
In our report, we recognized that the administration was reviewing the  government’s infrastructure protection strategy and recommended that, as  the administration proceeds, the Assistant to the President for National  Security Affairs, in coordination with pertinent executive agencies,    establish a capability for strategically analyzing computer-based threats,  including developing related methodology, acquiring staff expertise, and  obtaining infrastructure data;  require the development of a comprehensive data collection and analysis  framework and ensure that national watch and warning operations for  computer-based attacks are supported by sufficient staff and resources;  and   clearly define the role of NIPC in relation to other government and private- sector entities.
In July 2002, NIPC’s director stated that, in response to our report’s  recommendations, NIPC had developed a plan with goals and objectives to  improve its analysis and warning capabilities and had made considerable  progress in this area. The plan establishes and describes performance  measures both for its analysis and warning section and for other issues  relating to staffing, training, investigations, outreach, and warning. In  addition, the plan describes the resources needed to reach the specific  goals and objectives for the analysis and warning section. The director  also stated that the analysis and warning section had created two  additional teams to bolster its analytical capabilities: (1) the critical  infrastructure assessment team to focus efforts on learning about  particular infrastructures and coordinating with respective infrastructure  efforts and (2) the collection operations intelligence liaison team to  coordinate with various entities within the intelligence community. The  director added that NIPC (1) started holding a quarterly meeting with  senior government leaders of entities that it regularly works with to better  coordinate its analysis and warning capabilities; (2) had developed close  working relationships with other CIP entities involved in analysis and  warning activities, such as FedCIRC, DOD’s Joint Task Force for  Computer Network Operations, Carnegie Mellon’s CERT Coordination  Center, and the intelligence and anti-virus communities; and (3) had  developed and implemented procedures to more quickly share relevant  CIP information, while separately continuing any related law enforcement  investigation.
The director also stated in July 2002 that NIPC had received sustained  leadership commitment from key entities, such as the CIA and the  National Security Agency, and that it continued to increase its staff  primarily through reservists and contractors. However, the director  acknowledged that our recommendations were not fully implemented and  that despite the accomplishments to date, much more had to be done to  create the robust analysis and warning capabilities needed to adequately  address cyberthreats.
Another challenge confronting the analysis and warning capabilities of our  nation is that, historically, our national CIP attention and efforts have been  focused on cyber threats. In April 2001, we reported that while PDD 63  covers both physical and computer-based threats, federal efforts to meet  the directive’s requirements have pertained primarily to computer-based  threats, since this was an area that the leaders of the administration’s CIP  strategy view as needing attention. In July 2002, NIPC reported that the  potential for concurrent cyber and physical attacks, referred to as  “swarming attacks,” is an emerging threat to the U.S. critical  infrastructure. In July 2002, the director of NIPC told us that NIPC had  begun to develop some capabilities for identifying physical CIP threats.  For example, NIPC had developed thresholds with several ISACs for  reporting physical incidents and, since January 2002, has issued several  information bulletins concerning physical CIP threats. However, NIPC’s  director acknowledged that fully developing this capability will be a  significant challenge. The physical protection strategy states that DHS will  maintain a comprehensive, up to date assessment of vulnerabilities across  sectors and improve processes for domestic threat data collection,  analysis, and dissemination to state and local government and private  industry.
Another critical issue in developing effective analysis and warning  capabilities is to ensure that appropriate intelligence and other threat  information, both cyber and physical, is received from the intelligence and  law enforcement communities. For example, there has been considerable  public debate regarding the quality and timeliness of intelligence data  shared between and among relevant intelligence, law enforcement, and  other agencies. Also, as the transfer of NIPC to DHS organizationally  separated NIPC from the FBI’s law enforcement activities, including the  Counterterrorism Division and NIPC field agents, it will be critical to  establish mechanisms for continued communication to occur. Further, it  will be important that the relationships between the law enforcement and  intelligence communities and the new DHS are effective and that  appropriate information is exchanged on a timely basis.
In January 2003, the President announced the creation of a multi-agency  Terrorist Threat Integration Center (TTIC) to merge and analyze terrorist- related information collected domestically and abroad in order to form the  most comprehensive possible threat picture. The center will be formed  from elements of the Department of Homeland Security, the FBI’s  Counterterrorism Division, the Director of Central Intelligence’s  Counterterrorist Center, and the Department of Defense. Specifically, the  President stated that it would:    optimize the use of terrorist threat-related information, expertise, and  capabilities to conduct threat analysis and inform collection strategies;   create a structure that ensures information sharing across agency lines in  a way consistent with our national values of privacy and civil liberties;  integrate terrorist-related information collected domestically and abroad  in order to form the most comprehensive possible threat picture; and   be responsible and accountable for providing terrorist threat assessments  for our national leadership.
The TTIC is scheduled to begin operations within the CIA’s facilities on  May 1, 2003, but will eventually move to a new, independent facility. The  center is to receive $50 million in fiscal year 2004. The TTIC will fuse  international threat-related information from the CIA with domestic threat- related information collected by the FBI’s Joint Terrorism Task Forces and  analyzed by a separate FBI information-analysis center.
In addition, according to NIPC’s director, as of July 2002, a significant  challenge in developing a robust analysis and warning function is the  development of the technology and human capital capacities to collect and  analyze substantial amounts of information. Similarly, the Director of the  FBI testified in June 2002 that implementing a more proactive approach to  preventing terrorist acts and denying terrorist groups the ability to operate  and raise funds require a centralized and robust analytical capacity that  did not exist in the FBI’s Counterterrorism Division. He also stated that  processing and exploiting information gathered domestically and abroad  during the course of investigations requires an enhanced analytical and  data mining capacity that was not then available. Furthermore, NIPC’s  director stated that multiagency staffing, similar to NIPC, is a critical  success factor in establishing an effective analysis and warning function  and that appropriate funding for such staff is important.
The National Strategy for Homeland Security identified intelligence and  warning as one of six critical mission areas and called for major initiatives  to improve our nation’s analysis and warning capabilities. The strategy  also stated that no government entity was then responsible for analyzing  terrorist threats to the homeland, mapping these threats to our  vulnerabilities, and taking protective action. The Homeland Security Act  gives such responsibility to the new DHS. Further, the Act gives DHS  broad statutory authority to access intelligence information, as well as  other information, relevant to the terrorist threat and to turn this  information into useful warnings. For example, according to a White  House fact sheet, DHS’s Information Analysis and Infrastructure  Protection Directorate is to receive and analyze terrorism-related  information from the TTIC.
An important aspect of improving our nation’s analysis and warning  capabilities is having comprehensive vulnerability assessments. The  President’s National Strategy for Homeland Security also stated that  comprehensive vulnerability assessments of all of our nation’s critical  infrastructures are important from a planning perspective in that they  enable authorities to evaluate the potential effects of an attack on a given  sector and then invest accordingly to protect it. The strategy stated that  the U.S. government does not perform vulnerability assessments of the  nation’s entire critical infrastructure. The Homeland Security Act of 2002  stated DHS’s Under Secretary for Information Analysis and Infrastructure  Protection is to carry out comprehensive assessments of the  vulnerabilities of key resources and critical infrastructures of the United  States.
section_title: Additional Incentives Are Needed to Encourage Increased Nonfederal Efforts
paragraphs: The President’s fiscal year 2004 budget request for the new DHS includes  $829 million for information analysis and infrastructure protection, a  significant increase from the estimated $177 million for fiscal year 2003. In  particular, the requested funding for protection includes about $500  million to identify key critical infrastructure vulnerabilities and support  the necessary steps to ensure that security is improved at these sites.
Although it also includes almost $300 million for warning advisories, threat  assessments, a communications system, and outreach efforts to state and  local governments and the private sector, additional incentives may still be  needed to encourage nonfederal entities to increase their CIP efforts.
PDD 63 also stated that sector liaisons should identify and assess  economic incentives to encourage the desired sector behavior in CIP.  Further, to facilitate private-sector participation, it encouraged the  voluntary creation of information sharing and analysis centers (ISACs)  that could serve as mechanisms for gathering, analyzing, and appropriately  sanitizing and disseminating information to and from infrastructure  sectors and the federal government through NIPC. Consistent with the  original intent of PDD 63, the National Strategy for Homeland Security  states that, in many cases, sufficient incentives exist in the private market  for addressing the problems of CIP. However, the strategy also discusses  the need to use policy tools to protect the health, safety, or well-being of  the American people. It mentions federal grants programs to assist state  and local efforts, legislation to create incentives for the private sector, and,  in some cases, regulation. The physical security strategy reiterates that  additional regulatory directives and mandates should only be necessary in  instances where the market forces are insufficient to prompt the necessary  investments to protect critical infrastructures and key assets. The  cyberspace security strategy also states that the market is to provide the  major impetus to improve cyber security and that regulation will not  become a primary means of securing cyberspace.
Last year, the Comptroller General testified on the need for strong  partnerships with those outside the federal government and that the new  department would need to design and manage tools of public policy to  engage and work constructively with third parties. We have previously  testified on the choice and design of public policy tools that are available  to governments. These public policy tools include grants, regulations, tax  incentives, and regional coordination and partnerships to motivate and  mandate other levels of government or the private sector to address  security concerns. Some of these tools are already being used. For  example, as the lead agency for the water sector, the EPA reported  providing approximately 449 grants totaling $51 million to assist large  drinking water utilities in developing vulnerability assessments,  emergency response/operating plans, security enhancement plans and  designs, or a combination of these efforts.
In a different approach, the American Chemistry Council, the ISAC for the  chemical sector, requires as a condition for membership that its members  perform enhanced security activities, including vulnerability assessments.  However, because a significant percentage of companies that operate  major hazardous chemical facilities do not perform these voluntary  security activities, the physical security strategy recognized that  mandatory measures may be required. The strategy stated that EPA, in  consultation with DHS and other federal, state, and local agencies, will  review current laws and regulations pertaining to the sale and distribution  of highly toxic substances to determine whether additional measures are  necessary. Moreover, the strategy also stated that DHS, in concert with  EPA, will work with Congress to enact legislation requiring certain  facilities, particularly those that maintain large quantities of hazardous  chemicals in close proximity to large populations, to enhance site security.
Without appropriate consideration of public policy tools, private sector  participation in sector-related CIP efforts may not reach its full potential.  For example, we reported in January 2003 on the efforts of the financial  services sector to address cyber threats, including industry efforts to share  information and to better foster and facilitate sectorwide efforts. We also  reported on the efforts of federal entities and regulators to partner with  the financial services industry to protect critical infrastructures and to  address information security. We found that although federal entities had a  number of efforts ongoing, Treasury, in its role as sector liaison, had not  undertaken a comprehensive assessment of the potential public policy  tools to encourage the financial services sector in implementing CIP- related efforts. Because of the importance of considering public policy  tools to encourage private sector participation, we recommended that  Treasury assess the need for public policy tools to assist the industry in  meeting the sector’s goals. In addition, in February 2003, we reported on  the mixed progress five ISACs had made in accomplishing the activities  suggested by PDD 63. We recommended that the responsible lead agencies  assess of the need for public policy tools to encourage increased private- sector CIP activities and greater sharing of intelligence and incident  information between the sectors and the federal government.