Communications Networks: Outcome-Based Measures Would Assist DHS in Assessing Effectiveness of Cybersecurity Efforts
Published: 2013-04-03T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Ensuring the effectiveness and reliability of communications networks is essential to national security, the economy, and public health and safety. The communications networks (including core and access networks) can be threatened by both natural and human-caused events, including increasingly sophisticated and prevalent cyber-based threats. GAO has identified the protection of systems supporting the nation's critical infrastructure--which includes the communications sector--as a government-wide high-risk area.
GAO was asked to (1) identify the roles of and actions taken by key federal entities to help protect communications networks from cyber-based threats, (2) assess what is known about the extent to which cyber incidents affecting the communications networks have been reported to the FCC and DHS, and (3) determine if Defense's pilot programs to promote cybersecurity in the defense industrial base can be used in the communications sector. To do this, GAO focused on core and access networks that support communication services, as well as critical components supporting the Internet. GAO analyzed federal agency policies, plans, and other documents; interviewed officials; and reviewed relevant reports.
section_title: What GAO Found
paragraphs: While the primary responsibility for protecting the nation's communications networks belongs to private-sector owners and operators, federal agencies also play a role in support of their security, as well as that of critical components supporting the Internet. Specifically, private-sector entities are responsible for the operational security of the networks they own, but the Federal Communications Commission (FCC) and the Departments of Homeland Security (DHS), Defense, and Commerce have regulatory and support roles, as established in federal law and policy, and have taken a variety of related actions. For example, FCC has developed and maintained a system for reporting network outage information; DHS has multiple components focused on assessing risk and sharing threat information; Defense and DHS serve as co-chairs for a committee on national security and emergency preparedness for telecommunications functions; and Commerce has studied cyber risks facing the communications infrastructure and participates in standards development. However, DHS and its partners have not yet initiated the process for developing outcome-based performance measures related to the cyber protection of key parts of the communications infrastructure. Outcome-based metrics related to communications networks and critical components supporting the Internet would provide federal decision makers with additional insight into the effectiveness of sector protection efforts.
No cyber-related incidents affecting core and access networks have been recently reported to FCC and DHS through established mechanisms. Specifically, both FCC and DHS have established reporting mechanisms to share information on outages and incidents, but of the outages reported to FCC between January 2010 and October 2012, none were related to common cyber threats. Officials within FCC and the private sector stated that communication networks are less likely to be targeted themselves because they provide the access and the means by which attacks on consumer, business, and government systems can be facilitated.
Attributes of two pilot programs established by Defense to enhance the cybersecurity of firms in the defense industrial base (the industry associated with the production of defense capabilities) could be applied to the communications sector. The department's pilot programs involve partnering with firms to share information about cyber threats and responding accordingly. Considering these attributes can inform DHS as it develops procedures for expanding these pilot programs to all critical infrastructure sectors, including the communications sector.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS collaborate with its partners to develop outcome-oriented measures for the communications sector. DHS concurred with GAO's recommendation.

section_title: Letter
paragraphs: Effective, reliable communications are essential to our nation’s security,  economy, and public health and safety. Communications networks have  grown increasingly important to American business and consumers, and  provide the medium for hundreds of billions of dollars of commerce each  year. Further, applications and services (such as telephone calls, e-mail,  text messages, chat, file transfers, and video) depend on effectively  operating communications networks. The 9/11 terrorist attacks and  Hurricanes Katrina and Sandy, in 2005 and 2012, respectively,  significantly disrupted communications capabilities and underscore the  risks to our nation’s complex communications infrastructure. Additionally,  such events highlight the need to ensure the availability of  communications capabilities for leaders responsible for functions critical  to the management of and response to national security and emergency  situations. Since 2003, we have identified protecting systems supporting  our nation’s critical infrastructure (which includes the communications  networks)—referred to as cyber-critical infrastructure protection, or cyber  CIP—as a government-wide high-risk area, and we continue to do so in  the most recent update to our high-risk list.
In light of the importance of the security of the nation’s communications  infrastructure, you asked us to (1) identify the roles of and actions taken  by key federal entities to help protect the communications networks from  cyber-based threats, (2) assess what is known about the extent to which  cyber-incidents affecting the communications networks have been  reported to the Federal Communications Commission (FCC) and the  Department of Homeland Security (DHS), and (3) determine if the  Department of Defense’s (DOD) pilot programs to promote cybersecurity  in the defense industrial base can be used in the communications sector.  To identify the roles and actions taken by key federal agencies, we  focused on two of the main functional components of the communications  networks that facilitate communications services for the nation as well as  critical components supporting the Internet. Further, we focused on  agencies with primary responsibility for supporting the cybersecurity of  the communications networks: FCC and the Departments of Commerce,  Homeland Security, and Defense. For each agency, we analyzed policy,  strategic plans, guidance, and related performance metrics and  interviewed officials. Additionally, we reviewed documents from and  conducted interviews with officials from the Communications Information  Sharing and Analysis Center to assess federal efforts to fulfill roles and  responsibilities.
To assess what is known about the extent to which cyber-incidents  affecting the communications networks have been reported to the federal  government, we reviewed evidence regarding incidents in the  communications sector reported through established mechanisms at FCC  and DHS from January 2010 to October 2012. This enabled us to identify  any cyber-related incidents related to the two main functional components  of the communications networks. We also reviewed publicly published  reports by information security firms and communications network  companies to determine if communications network-related cyber  incidents were reported.
To determine if DOD’s pilot can be used to inform the communications  sector, we reviewed our August 2012 report on DOD efforts to enhance  the cybersecurity of the defense industrial base critical infrastructure  sector. We then identified and summarized attributes of the program that  could be publicly reported and that were potentially applicable to the  communications sector.
We conducted this performance audit from April 2012 to April 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix I contains additional  details on the objectives, scope, and methodology of our review.
subsections: section_title: Background
paragraphs: The national information and communications networks consist of a  collection of mostly privately owned networks that are critical to the  nation’s security, economy, and public safety. The communications sector  operates these networks and is comprised of public- and private-sector  entities that have a role in, among other things, the use, protection, or  regulation of the communications networks and associated services  (including Internet routing). For example, private companies, such as  AT&T and Verizon, function as service providers, offering a variety of  services to individual and enterprise end users or customers.
The Internet is a vast network of interconnected networks. It is used by governments,  businesses, research institutions, and individuals around the world to communicate,  engage in commerce, do research, educate, and entertain. customers that are positioned at the ends of the network, or the “last  mile,” as referred to by industry.
The core networks transport a high volume of aggregated traffic substantial distances or between different service providers or  “carriers.” These networks connect regions within the United States as  well as all continents except Antarctica, and use submarine fiber optic  cable systems, land-based fiber and copper networks, and satellites.  In order to transmit data, service providers manage and control core  infrastructure elements with numerous components, including  signaling systems, databases, switches, routers, and operations  centers. Multiple service providers, such as AT&T and Verizon,  operate distinct core networks traversing the nation that interconnect  with each other at several points. End users generally do not connect  directly with the core networks.
Access networks are primarily local portions of the network that  connect end users to the core networks or directly to each other and  enable them to use services such as local and long distance phone  calling, video conferencing, text messaging, e-mail, and various  Internet-based services. These services are provided by various  technologies such as satellites, including fixed and portable systems;  wireless, including cellular base stations; cable, including video, data,  and voice systems, and cable system end offices; and wireline,  including voice and data systems and end offices. Communications  traffic between two locations may originate and terminate within an  access network without connecting to core networks (e.g., local phone  calling within the wireline network). Communications traffic between  different types of access networks (e.g., between the wireline and  wireless networks) may use core networks to facilitate the  transmission of traffic. Individual and enterprise users connect to  access networks through various devices (e.g., wired phones, cell  phones, and computers). Figure 1 depicts the interconnection of user  devices and services, access networks, and core networks. Figure 2  depicts the path that a single communication can take to its final  destination.
Aggregate traffic is normally the multimedia (voice, data, video) traffic combined from  different service providers, or carriers, to be transported over high-speed through the core  networks.
Roll over each          below to view more information.
subsections: section_title: Critical Protocols Supporting the Internet
paragraphs: The nation’s communications infrastructure also provides the networks  that support the Internet. In order for data to move freely across  communications networks, the Internet network operators employ  voluntary, self-enforcing rules called protocols. Two sets of protocols—  the Domain Name System (DNS) and the Border Gateway Protocol  (BGP)—are essential for ensuring the uniqueness of each e-mail and  website address and for facilitating the routing of data packets between  autonomous systems, respectively.
DNS provides a globally distributed hierarchical database for mapping  unique names to network addresses. It links e-mail and website  addresses with the underlying numerical addresses that computers use to  communicate with each other. It translates names, such as  http://www.house.gov, into numerical addresses, such as 208.47.254.18,  that computers and other devices use to identify each other on the  network and back again in a process invisible to the end user. This  process relies on a hierarchical system of servers, called domain name  servers, which store data linking address names with address numbers.  These servers are owned and operated by many public and private sector  organizations throughout the world. Each of these servers stores a limited  set of names and numbers. They are linked by a series of root servers  that coordinate the data and allow users’ computers to find the server that  identifies the sites they want to reach. Domain name servers are  organized into a hierarchy that parallels the organization of the domain  names (such as “.gov”, “.com”, and “.org”). Figure 3 below provides an  example of how a DNS query is turned into a number.
BGP is used by routers located at network nodes to direct traffic across  the Internet. Typically, routers that use this protocol maintain a routing  table that lists all feasible paths to a particular network. They also  determine metrics associated with each path (such as cost, stability, and  speed) and follow a set of constraints (e.g., business relationships) to  choose the best available path for forwarding data. This protocol is  important because it binds together many autonomous networks that  comprise the Internet (see fig. 4).
Like those affecting other cyber-reliant critical infrastructure, threats to the  communications infrastructure can come from a wide array of sources.  These sources include corrupt employees, criminal groups, hackers, and  foreign nations engaged in espionage and information warfare. These  threat sources vary in terms of the capabilities of the actors, their  willingness to act, and their motives, which can include monetary gain or  political advantage, among others. Table 1 describes the sources in more  detail.
These sources may make use of various cyber techniques, or exploits, to  adversely affect communications networks, such as denial-of-service  attacks, phishing, passive wiretapping, Trojan horses, viruses, worms,  and attacks on the information technology supply chains that support the  communications networks. Table 2 provides descriptions of these cyber  exploits.
In addition to cyber-based threats, the nation’s communications networks  also face threats from physical sources. Examples of these threats  include natural events (e.g., hurricanes or flooding) and man-made  disasters (e.g., terrorist attacks), as well as unintentional man-made  outages (e.g., a backhoe cutting a communication line).
section_title: Agencies Have Taken Action to Address Security of Communications Networks
paragraphs: While the private sector owns and operates the nation’s communications  networks and is primarily responsible for protecting these assets, federal  law and policy establish regulatory and support roles for the federal  government in regard to the communications networks. In this regard,  federal law and policy call for critical infrastructure protection activities  that are intended to enhance the cyber and physical security of both the  public and private infrastructures that are essential to national security,  national economic security, and public health and safety. The federal role  is generally limited to sharing information, providing assistance when  asked by private-sector entities, and exercising regulatory authority when  applicable.
As part of their efforts in support of the security of communications  networks, FCC, DHS, DOD, and Commerce have taken a variety of  actions, including ones related to developing cyber policy and standards,  securing Internet infrastructure, sharing information, supporting national  security and emergency preparedness (NS/EP), and promoting sector  protection efforts.
subsections: section_title: Federal Communications Commission
paragraphs: FCC is a U.S. government agency that regulates interstate and  international communications by radio, television, wire, satellite, and  cable throughout the United States.for certain communications providers to report on the reliability and  security of communications infrastructures. These include disruption- reporting requirements for outages that are defined as a significant  degradation in the ability of an end user to establish and maintain a   Its regulations include requirements  channel of communications as a result of failure or degradation in the  performance of a communications provider’s network.
The Commission’s Public Safety and Homeland Security Bureau has  primary responsibility for assisting providers in ensuring the security and  availability of the communications networks. The bureau also serves as  a clearinghouse for public safety communications information and  emergency response issues. In addition, its officials serve as Designated  Federal Officers on the Communications Security, Reliability, and  Interoperability Council.
The Communications Security, Reliability, and Interoperability Council is a  federal advisory committee whose mission is to provide recommendations  to FCC to help ensure, among other things, secure and reliable  communications systems, including telecommunications, media, and  public safety systems. The council has provided recommendations in the  form of voluntary best practices that provide companies with guidance  aimed at improving the overall reliability, interoperability, and security of  networks. Specifically, it is composed of 11 working groups that consist of  experts from industry and other federal agencies. The working groups  focus on various related topics, including those related to network security  management, as well the security of the Border Gateway Protocol and the  Domain Name System. The working groups develop recommendations  through industry cooperation and voluntary agreements. For example, in  March 2012, the commission announced the voluntary commitments by  the nation’s largest Internet service providers, including AT&T and  Verizon, to adopt the council’s recommendations aimed at better securing  their communications networks. The recommendations covered a variety  of security practices, including those related to the security of the Domain  Name System and BGP.
The key FCC and council efforts related to the security of the  communications sector are detailed in table 3 below.
DHS is the principal federal agency to lead, integrate, and coordinate the  implementation of efforts to protect cyber-critical infrastructures. DHS’s  role in critical infrastructure protection is established by law and policy.  The Homeland Security Act of 2002, Homeland Security Presidential  Directive 7, and the National Infrastructure Protection Plan establish a  cyber protection approach for the nation’s critical infrastructure sectors— including communications—that focuses on the development of public- private partnerships and establishment of a risk management framework.  These policies establish critical infrastructure sectors, including the  communications sector; assign agencies to each sector (sector-specific  agencies), including DHS as the sector lead for the communications and  information technology sectors; and encourage private sector involvement  through the development of sector coordinating councils, such as the  Communications Sector Coordinating Council, and information-sharing  mechanisms, such as the Communications Information Sharing and  Analysis Center.
Additionally, DHS has a role, along with agencies such as DOD, in regard  to national security and emergency preparedness (NS/EP)  communications that are intended to increase the likelihood that essential  government and private-sector individuals can complete critical phone  calls and organizations can quickly restore service during periods of  disruption and congestion resulting from natural or man-made disasters.  In particular, Executive Order No.13618 established an NS/EP  Communications Executive Committee to serve as an interagency forum  to address such communications matters for the nation. Among other  things, the committee is to advise and make policy recommendations to  the President on enhancing the survivability, resilience, and future  architecture for NS/EP communications. The Executive Committee is  composed of Assistant Secretary-level or equivalent representatives  designated by the heads of the Departments of State, Defense, Justice,  Commerce, and Homeland Security, the Office of the Director of National  Intelligence, the General Services Administration, and the Federal  Communications Commission, as well as such additional agencies as the  Executive Committee may designate. The committee is chaired by the  DHS Assistant Secretary for the Office of Cybersecurity and  Communications and the DOD Chief Information Officer, with  administrative support for the committee provided by DHS.
To fulfill DHS’s cyber-critical infrastructure protection and NS/EP-related  missions, the Office of Cybersecurity and Communications within the  National Protection and Programs Directorate is responsible for, among other things, ensuring the security, resiliency, and reliability of the nation’s  cyber and communications infrastructure, implementing a cyber-risk  management program for protection of critical infrastructure, and planning  for and providing national security and emergency preparedness  communications to the federal government.
The office is made up of the following five subcomponents that have  various responsibilities related to DHS’s overarching cybersecurity  mission:
Stakeholder Engagement and Cyber Infrastructure Resilience  division, among other things, is responsible for managing the  agency’s role as the sector-specific agency for the communications  sector.
Office of Emergency Communications is responsible for leading  NS/EP and emergency communications in coordination and  cooperation with other DHS organizations.
National Cybersecurity and Communications Integration Center is the  national 24-hours-a-day, 7-days-a-week operations center that is to  provide situational awareness, multiagency incident response, and  strategic analysis for issues related to cybersecurity and NS/EP  communications. The center is comprised of numerous co-located,  integrated elements including the National Coordinating Center for  Telecommunications, the U.S. Computer Emergency Readiness  Team (US-CERT), and the Industrial Control Systems Cyber  Emergency Response Team.
Federal Network Resilience division is responsible for collaborating  with departments and agencies across the federal government to  strengthen the operational security of the “.gov” networks. As part of  those efforts, the division leads the DHS initiative related to DNSSEC.
Network Security Deployment division is responsible for designing,  developing, acquiring, deploying, sustaining, and providing customer  support for the National Cybersecurity Protection System.
Four of these subcomponents have taken specific actions with respect to  the communications networks, which are detailed in table 4 below.
Under the National Infrastructure Protection Plan, DHS’s Office of  Cybersecurity and Communications, as the sector-specific agency for the  communications and information technology sectors, is responsible for  leading federal efforts to support sector protection efforts. As part of the  risk management process for protecting the nation’s critical infrastructure,  including the protection of the cyber information infrastructure, the  National Infrastructure Protection Plan recommends that outcome- oriented metrics be established that are specific and clear as to what they  are measuring, practical or feasible in that needed data are available,  built on objectively measureable data, and align to sector priorities. These  metrics are to be used to determine the health and effectiveness of sector  efforts and help drive future investment and resource decisions.
DHS and its partners have previously identified the development of  outcome-oriented metrics as part of the process to be used to manage  risks to the nation’s critical communications infrastructure. For example,  in 2010, DHS and its communications sector partners identified  preserving the overall health of the core network as the sector’s first  priority at the national level. They also defined a process for developing  outcome-oriented sector metrics that would map to their identified goals  and would yield quantifiable information (when available). Additionally,  DHS and its information technology sector partners stated that they would  measure their cyber protection efforts related to DNS and BGP in terms of  activities identified in 2009 to assist sector partners in mitigating risks to  key sector services, such as providing DNS functionality and Internet  routing services. In 2010, they noted that implementation plans would  be developed for each of the activities and outcome-based metrics would  be used to monitor the status and effectiveness of the activities.
However, DHS and its partners have not yet developed outcome-based  metrics related to the cyber-protection activities for the core and access  networks, DNS functionality, and Internet routing services. For the  communications sector, DHS officials stated that the sector had recently  completed the first part of a multiphased risk assessment process that  included identification of cyber risks. The officials further stated that  efforts are under way to prioritize the identified risks and potentially  develop actions to mitigate them. However, DHS officials stated that  outcome-oriented metrics had not yet been established and  acknowledged that time frames for developing such metrics had not been  agreed to with their private sector partners. For the information  technology sector, DHS officials noted that the information technology  sector’s private sector partners had decided to focus on progress-related  metrics (which report the status of mitigation development activities as  well as implementation decisions and progress) to measure the  effectiveness of sector activities to reduce risk across the entire sector  and periodically re-examine their initial risk evaluation based on perceived  threats facing the sector. While these progress-related metrics are part of  the information technology sector’s planned measurement activities, the  sector’s plans acknowledge that outcome-based metrics are preferable to  demonstrate effectiveness of efforts.
Until metrics related to efforts to protect core and access networks, DNS,  and BGP are fully developed, implemented, and tracked by DHS, federal  decision makers will have less insight into the effectiveness of sector  protection efforts.
section_title: Department of Defense
paragraphs: Within DOD, the Office of the Chief Information Officer (CIO) has been  assigned the responsibility for implementing Executive Order 13618  requirements related to NS/EP communication functions. As previously  described, the CIO (along with the Assistant Secretary for Cybersecurity  and Communications in DHS) co-chairs the NS/EP Communications  Executive Committee established in Executive Order 13618. The CIO  directs, manages, and provides policy guidance and oversight for DOD’s  information and the information enterprise, including matters related to  information technology, network defense, network operations, and  cybersecurity. Table 5 describes the department’s efforts in relation to this  executive order.
Federal law and policy also establish a role for the Department of  Commerce (Commerce) related to the protection of the nation’s  communications networks. For example, Commerce conducts industry  studies assessing the capabilities of the nation’s industrial base to  support the national defense. In addition, the department’s National  Telecommunications and Information Administration (NTIA) was  established as the principal presidential adviser on telecommunications  and information policies. Further, Commerce’s National Institute of  Standards and Technology (NIST) is to, among other things, cooperate  with other federal agencies, industry, and other private organizations in  establishing standard practices, codes, specifications, and voluntary  consensus standards.
Commerce also has a role in ensuring the security and stability of DNS.  Prompted by concerns regarding who has authority over DNS, along with  the stability of the Internet as more commercial interests began to rely on  it, the Clinton administration issued an electronic commerce report in July  1997 that identified the department as the lead agency to support private  efforts to address Internet governance. In June 1998, NTIA issued a  policy statement (known as the White Paper) that stated it would enter  into an agreement with a not-for-profit corporation formed by private  sector Internet stakeholders for the technical coordination of DNS.
In addition, Commerce created the Internet Policy Task Force in August  2011 to, among other things, develop and maintain department-wide  policy proposals on a range of global issues that affect the Internet,  including cybersecurity. While NIST has been identified as the Commerce  lead bureau for cybersecurity, the task force is to leverage the expertise  of other Commerce bureaus, such as the Bureau of Industry and Security  and NTIA.
Commerce components also carry out functions related to the security of  the nation’s communications networks. The Bureau of Industry and  Security conducted an industrial study to examine the operational and  security practices employed by network operators in the nation’s  communications infrastructure. In addition, NTIA manages agreements  with the Internet Corporation for Assigned Names and Numbers (ICANN)  and VeriSign, Inc., through which changes are made to the authoritative  root zone file. Also, NIST participates in open, voluntary, industry-led,  consensus-based, standards-setting bodies that design and develop  specifications for network security technologies, including those used in  the nation’s communications networks (such as DNS and BGP) as well as  in industry technical forums for the purpose of promulgating the  deployment of such new technologies. Table 6 describes some of the key  efforts of Commerce as they relate to the cybersecurity of the nation’s  communications networks.
section_title: Though Reporting Mechanisms Are in Place, FCC and DHS Have Not Received Reports of Cyber- Related Incidents Affecting the Nation’s Core and Access Networks
paragraphs: No cyber incidents affecting the core and access networks have been  reported by communications networks owners and operators through  three established reporting mechanisms from January 2010 to October  2012. To report incidents involving the core and access communications  networks to the federal government, communication networks operators  can use reporting mechanisms established by FCC and DHS to share  information on outages and incidents:
FCC’s Network Outage Reporting System is a web-based filing  system that communications providers use to submit detailed outage  reports to FCC. In turn, FCC officials stated that the agency uses the  reported outage data to develop situational awareness of commercial  network performance as well as to aid the commission in influencing  and developing best practices regarding incidents.
DHS’s Network Security Information Exchange is an information- sharing forum comprised of representatives from the communications  and information technology sectors that meet bimonthly to voluntarily  share communications-related incidents, among other things.
DHS’s National Cybersecurity and Communications Integration  Center, which includes the National Coordinating Center, US-CERT,  and the Industrial Control Systems Cyber Emergency Response  Team, is used to share information about threats, vulnerabilities, and  intrusions related to communications networks and the sector as a  whole. Communications and information technology providers can  voluntarily report threats, vulnerabilities, and intrusions to the center.
Although these mechanisms for reporting exist, available information  showed that no cyber-based incidents involving the core and access  communication networks had been reported using these mechanisms to  the federal government from January 2010 to October 2012. Specifically,  of the over 35,000 outages reported to FCC during this time period, none  were related to traditional cyber threats (e.g., botnets, spyware, viruses,  and worms). FCC officials stated that there could be an increase in the  presence of cyber-related outages reported in the future as the Voice- over-Internet-Protocol reporting requirements are enforced. Further,  DHS Office of Cybersecurity and Communications officials stated that no  cyber incidents related to the core and access networks were reported to  them during January 2010 to October 2012. For example, although  several incidents attributed to the communications sector were reported  to DHS’s Industrial Control Systems Cyber Emergency Response Team  in fiscal year 2012, none of these incidents involved core and access  networks. Our review of reports published by information security firms  and communication network companies also indicated that no cyber  incidents related to the core and access networks were publicly reported  from January 2010 to October 2012.
Officials within FCC and the private sector attributed the lack of incidents  to the fact that the communications networks provide the medium for  direct attacks on consumer, business, and government systems—and  thus these networks are less likely to be targeted by a cyber attack  themselves. In addition, Communications Information Sharing and  Analysis Center officials expressed greater concern about physical  threats (such as natural and man-made disasters, as well as unintentional  man-made outages) to communications infrastructure than cyber threats.
section_title: Attributes of Defense Industry Cybersecurity Pilot Programs Could Be Applied to the Communications Sector
paragraphs: DOD, in its role as the sector-specific agency for the defense industrial  base critical infrastructure sector, established two pilot programs to  enhance the cybersecurity of sector companies and better protect  unclassified department data residing on those company networks. The  Deputy Secretary of Defense established the Cyber Security/Information  Assurance program under the department’s Office of the Chief  Information Officer to address the risk posed by cyber attacks against  sector companies. The Opt-In Pilot was designed to build upon the Cyber  Security/Information Assurance Program and, according to department  officials, established a voluntary information-sharing process for the  department to provide classified network security indicators to Internet  service providers.
In August 2012, we reported on these pilot programs as part of our study  to identify DOD and private sector efforts to protect the defense industrial  base from cybersecurity threats. Our report described these programs in  detail, including challenges to their success. For example, one challenge  noted by defense industrial base company officials was that the quality of  the threat indicators provided by the federal government as part of the  Opt-In pilot had not met their needs. In addition, the quality of the pilot  was affected by the lack of a mechanism for information sharing among  government and private stakeholders. The report also made  recommendations to DOD and DHS to better protect the defense  industrial base from cyber threats. (The August 2012 report was  designated as official use only and is not publicly available.)
Using information in that report, we identified six attributes that were  implemented to varying extents as part of the pilot programs (see table  7). These attributes were utilized by DOD and the defense industrial  base companies to protect their sector from cyber threats and could  inform the cyber protection efforts of the communications sector.
Agreements: Eligible defense industrial base companies who wanted  to participate in these pilots enter into an agreement with the federal  government. This agreement establishes the bilateral cyber- information-sharing process that emphasizes the sensitive, nonpublic  nature of the information shared which must be protected from  unauthorized use. The agreement does not obligate the participating  company to change its information system environment or otherwise  alter its normal conduct of cyber activities.
Government sharing of unclassified and classified cyber threat  information: DOD provides participating defense industrial base  companies with both unclassified and classified threat information,  and in return, the companies acknowledge receipt of threat  information products. For any intrusions reported to DOD by the  participating companies under the program, the department can  develop damage assessment products, such as incident-specific and  trend reports, and provide them to participating companies and DOD  leadership.
Feedback mechanism on government services: When a participating  company receives cyber threat information from DOD, it has the  option of providing feedback to the department on, among other  things, the quality of the products.
Government cyber analysis, mitigation, and digital forensic support: A  participating company can also optionally report intrusion events.  When this occurs, DOD can conduct forensic cyber analysis and  provide mitigation and digital forensic support. The department can  also provide on-site support to the company that reported the  intrusion.
Government reporting of voluntarily reported incidents: In addition to  providing cyber analysis, mitigation, and cyber forensic support, DOD  can report the information to other federal stakeholders, law  enforcement agencies, counterintelligence agencies, and the DOD  program office that might have been affected.
Internet service providers deploying countermeasures based on  classified threat indicators for organizations: Each Cyber  Security/Information Assurance program participating company can  voluntarily allow its Internet service providers to deploy  countermeasures on its behalf, provided the Internet service provider  has been approved to receive classified network security indicators  from the U.S. government. For those providers, US-CERT collects  classified threat indicators from multiple sources and provides them to  the companies’ participating Internet service providers. If the Internet  service provider identifies a cyber intrusion, it will alert the company  that was the target of the intrusion. Providers can also voluntarily  notify US-CERT about the incident, and US-CERT will share the  information with DOD.
In May 2012, DOD issued an interim final rule to expand the Cyber  Security/Information Assurance program to all eligible defense industrial  base sector companies. Additionally, the Defense Industrial Base Opt-In  Pilot became the Defense Industrial Base Enhanced Cybersecurity  Service (DECS) Program, and is now jointly managed by DHS and  DOD.
In addition, on February 12, 2013, the President signed Executive Order  13636, which requires the Secretary of Homeland Security to establish  procedures to expand DECS (referred to as the Enhanced Cybersecurity  Services program) to all critical infrastructure sectors, including the  communications sector. Considering these attributes and challenges  could inform DHS’s efforts as it develops these new procedures.
section_title: Conclusions
paragraphs: Securing the nation’s networks is essential to ensuring reliable and  effective communications within the United States. Within the roles  prescribed for them by federal law and policy, the Federal  Communications Commission and the Departments of Homeland  Security, Defense, and Commerce have taken actions to support the  communications and information technology sectors’ efforts to secure the  nation’s communications networks from cyber attacks. However, until  DHS and its sector partners develop appropriate outcome-oriented  metrics, it will be difficult to gauge the effectiveness of efforts to protect  the nation’s core and access communications networks and critical  support components of the Internet from cyber incidents. While no cyber  incidents have been reported affecting the nation’s core and access  networks, communications networks operators can use reporting  mechanisms established by FCC and DHS to share information on  outages and incidents.
The pilot programs undertaken by DOD with its defense industrial base  partners exhibit several attributes that could apply to the communications  sector and help private sector entities more effectively secure the  communications infrastructure they own and operate. As DHS develops  procedures for expanding this program, considering these attributes could  inform DHS’s efforts.
section_title: Recommendation for Executive Action
paragraphs: To help assess efforts to secure communications networks and inform  future investment and resource decisions, we recommend that the  Secretary of Homeland Security direct the appropriate officials within DHS  to collaborate with its public and private sector partners to develop,  implement, and track sector outcome-oriented performance measures for  cyber protection activities related to the nation’s communications  networks.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Departments of Commerce  (including the Bureau of Industry and Security, NIST, and NTIA),  Defense, and Homeland Security and FCC for their review and comment.
DHS provided written comments on our report (see app. II), signed by  DHS’s Director of Departmental GAO-OIG Liaison Office. In its  comments, DHS concurred with our recommendation and stated that it is  working with industry to develop plans for mitigating risks that will  determine the path forward in developing outcome-oriented performance  measures for cyber protection activities related to the nation’s core and  access communications networks. Although the department did not  specify an estimated completion date for developing and implementing  these measures, we believe the prompt implementation of our  recommendation will assist DHS in assessing efforts to secure  communication networks and inform future investment and resource  decisions.
We also received technical comments via e-mail from officials responsible  for cybersecurity efforts related to communication networks at Defense,  DHS, FCC, and Commerce's Bureau of Industry and Security and NTIA.  We incorporated these comments where appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 7 days from the  report date. At that time, we will send copies to interested congressional  committees; the Secretaries of the Departments of Commerce, Defense,  and Homeland Security; the Chairman of the Federal Communications  Commission; the Director of the Office of Management and Budget; and  other interested parties. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions regarding this report, please  contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be   found on the last page of this report. Key contributors to this report are  listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) identify the roles of and actions taken by key  federal entities to help protect the communications networks from cyber- based threats, (2) assess what is known about the extent to which cyber- incidents affecting the communications networks have been reported to  the Federal Communications Commission (FCC) and Department of  Homeland Security (DHS), and (3) determine if the Department of  Defense’s (DOD) pilot programs to promote cybersecurity in the defense  industrial base can be used in the communications sector. Our audit  focused on the core and access networks of the communication network.  These networks include wireline, wireless, cable, and satellite. We did not  address broadcast access networks because they are responsible for a  smaller volume of traffic than other networks. Additionally, we focused on  the Internet support components that are critical for delivering services:  the Border Gateway Protocol (BGP) and Domain Name System (DNS).
To identify the roles of federal entities, we collected, reviewed, and  analyzed relevant federal law, policy, regulation, and critical infrastructure  protection-related strategies. Sources consulted include statutes such as  the Communications Act of 1934, Homeland Security Act of 2002, and the  Defense Production Act of 1950, as well as other public laws; the Code of  Federal Regulations; National Communication System Directive 3-10; the  National Infrastructure Protection Plan; the Communications Sector- Specific Plan; the Information Technology Sector-Specific Plan; the  Communications Sector Risk Assessment; the Information Technology  Sector Risk Assessment; Homeland Security Presidential Directives;  selected executive orders; and related GAO products. Using these  materials, we selected the Departments of Commerce, Defense, and  Homeland Security, and FCC to review their respective roles and actions  related to the security of the privately owned communications network  because they were identified as having the most significant roles and  organizations for addressing communications cybersecurity.
To identify the actions taken by federal entities we collected, reviewed,  and analyzed relevant policies, plans, reports, and related performance  metrics and interviewed officials at each of the four agencies. For  example, we reviewed and analyzed Department of Commerce  agreements detailing the process for how changes are to be made to the  authoritative root zone file and Internet Policy Task Force reports on  cybersecurity innovation and the Internet. In addition, we analyzed and  identified current and planned actions outlined in DOD’s National  Security/Emergency Preparedness Executive Committee Charter. Also,  we analyzed reports issued by the Communications Security, Reliability,  and Interoperability Council on a variety of issues, including the security  of the Domain Name System and the Border Gateway Protocol. Further,  we reviewed and analyzed the risk assessments and sector-specific plans  for both the communications and information technology critical  infrastructure sectors, as well DHS’s plans for realignment in response to  Executive Order 13618.
In addition, we interviewed agency officials regarding authority, roles,  policies, and actions created by their department or agency, and actions  taken by their departments and agencies to encourage or enhance the  protection of communications networks, BGP, and DNS, and fulfill related  roles. For Commerce, we interviewed officials from the Bureau of Industry  and Security, National Telecommunications and Information  Administration, and the National Institute of Standards and Technology.  For DOD, we interviewed officials from the Office of the Chief Information  Officer, including those from the National Leadership Command  Capability Management Office and the Trusted Mission Systems and  Networks Office. We also interviewed officials from the Office of the  Under Secretary of Defense for Policy. For DHS, we interviewed officials  from the National Protection and Programs Directorate’s Office of  Cybersecurity and Communications. For FCC, we interviewed officials  from the International, Media, Public Safety and Homeland Security,  Wireless Telecommunications, and Wireline Competition Bureaus. Based  on our analysis and the information gathered through interviews, we  created a list of actions taken by each agency. Additionally, we reviewed  documents (including the communications sector risk assessment) from  and conducted interviews with officials from the Communications  Information Sharing and Analysis Center to assess federal efforts to fulfill  roles and responsibilities.
To assess what is known about the extent to which cyber-incidents  affecting the communications networks have been reported to FCC and  DHS, we analyzed FCC policy and guidance related to its Network  Outage Reporting System. Additionally, we conducted an analysis of  outage reports submitted from January 2010 to October 2012 to  determine the extent to which they were related to cybersecurity threats,  such as botnets, spyware, viruses, and worms affecting the core and  access networks. To assess the reliability of FCC outage reports, we (1)  discussed data quality control procedures with agency officials, (2)  reviewed relevant documentation, (3) performed testing for obvious  problems with completeness or accuracy, and (4) reviewed related  internal controls. We determined that the data were sufficiently reliable for  the purposes of this report. We also interviewed officials from FCC’s  Public Safety and Homeland Security Bureau to understand incident  reporting practices of its regulated entities, and how reported incident  data were used by FCC to encourage improvement or initiate  enforcement actions. Further, we interviewed officials from DHS’s United  States Computer Emergency Readiness Team regarding the extent to  which incidents were reported to it that affected core and access  communications networks. We also conducted an analysis of information  security reports from nonfederal entities, to determine if cyber incidents  on the core and access communications networks had been reported to  nonfederal entities. Additionally, we interviewed Communications  Information Sharing and Analysis Center officials to identify the  mechanisms and processes used to report cyber-related incidents in the  communications sector to the center and then to the federal government.
To determine if DOD’s pilot can be used to inform the communications  sector, we reviewed our August 2012 report on DOD efforts to enhance  the cybersecurity of the defense industrial base critical infrastructure  sector. We then identified and summarized attributes of the program that  could be publicly reported and that were potentially applicable to the  communications sector. The information used to compile the attributes  from the August 2012 report was determined by DOD at that time not to  be considered official use only. We also interviewed officials from DHS’s  Office of Cybersecurity and Communications to ascertain the current  status of the pilot programs and efforts to determine the applicability of  the pilots to all critical infrastructures, including the communications  sector.
We conducted this performance audit from April 2012 to April 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: GAO staff who made significant contributions to this report include  Michael W. Gilmore, Assistant Director; Thomas E. Baril, Jr; Bradley W.  Becker; Cortland Bradford; Penney Harwell Caramia; Kush K. Malhotra;  Lee A. McCracken; David Plocher; and Adam Vodraska.