Critical Infrastructure Protection: Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain
Published: 2007-09-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Control systems--computer-based systems that monitor and control sensitive processes and physical functions--perform vital functions in many of our nation's critical infrastructures, including electric power, oil and gas, water treatment, and chemical production. The disruption of control systems could have a significant impact on public health and safety, which makes securing them a national priority. GAO was asked to (1) determine cyber threats, vulnerabilities, and the potential impact of attacks on critical infrastructure control systems; (2) determine the challenges to securing these systems; (3) identify private sector initiatives to strengthen the cybersecurity of control systems; and (4) assess the adequacy of public sector initiatives to strengthen the cybersecurity of control systems. To address these objectives, we met with federal and private sector officials to identify risks, initiatives, and challenges. We also compared agency plans to best practices for securing critical infrastructures.
section_title: What GAO Found
paragraphs: Critical infrastructure control systems face increasing risks due to cyber threats, system vulnerabilities, and the serious potential impact of attacks as demonstrated by reported incidents. Threats can be intentional or unintentional, targeted or nontargeted, and can come from a variety of sources. Control systems are more vulnerable to cyber attacks than in the past for several reasons, including their increased connectivity to other systems and the Internet. Further, as demonstrated by past attacks and incidents involving control systems, the impact on a critical infrastructure could be substantial. For example, in 2003, a computer virus was blamed for shutting down train signaling systems throughout the East Coast and in 2006, a foreign hacker was reported to have planted malicious software capable of affecting a water filtering plant's treatment operations. Critical infrastructure owners face both technical and organizational challenges to securing control systems. Technical challenges--including control systems' limited processing capabilities, real-time operations, and design constraints--hinder an infrastructure owner's ability to implement traditional information technology security processes, such as strong user authentication and patch management. Organizational challenges include difficulty in developing a compelling business case for investing in control systems security and differing priorities of information security personnel and control systems engineers. Multiple private sector entities such as trade associations and standards setting organizations are working to help secure control systems. Their efforts include developing standards, providing guidance to members, and hosting workshops on control systems security. For example, the electricity industry has recently developed standards for cybersecurity of control systems and a gas trade association is developing guidance for members to use encryption to secure control systems. Federal agencies also have multiple initiatives under way to help secure critical infrastructure control systems, but more remains to be done to coordinate these efforts and to address specific shortfalls. Over the past few years, federal agencies--including the Department of Homeland Security, the Department of Energy, and the Federal Energy Regulatory Commission (FERC)--have initiated efforts to improve the security of critical infrastructure control systems. However, there is as yet no overall strategy to coordinate the various activities across federal agencies and the private sector. Further, DHS lacks processes needed to address specific weaknesses in sharing information on control system vulnerabilities. Until public and private sector security efforts are coordinated by an overarching strategy and specific information sharing shortfalls are addressed, there is an increased risk that multiple organizations will conduct duplicative work and miss opportunities to fulfill their critical missions.

section_title: Letter
paragraphs: Control systems are computer-based systems that are used in many  industries to monitor and control sensitive processes and physical  functions. Control systems perform vital functions in many of our nation’s  critical infrastructures, including electric power generation, transmission,  and distribution; oil and gas refining and pipelines; water treatment and  distribution; chemical production and processing; railroads and mass  transit; and manufacturing. Ten years ago, the President’s Commission on  Critical Infrastructure Protection highlighted the risk of cyber attacks on  critical infrastructures, stating that “the widespread and increasing use of  supervisory control and data acquisition systems for control of energy  systems provides increasing ability to cause serious damage and  disruption by cyber means.”
In 2003, the National Strategy to Secure Cyberspace (often called the  cyberspace strategy) stated that the disruption of control systems could  have significant consequences for public health and safety, and made  securing these systems a national priority. The cyberspace strategy further  states that both the private and public sectors have roles in securing  control systems. The strategy directs the Department of Homeland  Security (DHS), in coordination with the Department of Energy (DOE) and  other agencies, to work in partnership with private industry in increasing  awareness of the importance of efforts to secure control systems,  developing standards, and improving policies with respect to control  systems security.
Given the importance of this issue, you asked us to (1) determine cyber  threats, vulnerabilities, and the potential impact of attacks on critical  infrastructure control systems; (2) determine the challenges to securing  critical infrastructure control systems; (3) identify private sector initiatives  to strengthen the cybersecurity of control systems; and (4) assess the  adequacy of public sector initiatives to strengthen the cybersecurity of  control systems.
To accomplish these objectives, we assessed documentation of control  system security incidents and analyzed research studies and reports, as  well as our prior reports and testimonies on control systems, critical  infrastructure protection (CIP), and national preparedness, among others.  We analyzed reports by, and met with, private sector and federal officials  who had expertise in control systems and their security. Our work was  performed from March 2007 to July 2007 in accordance with generally  accepted government auditing standards. Appendix I contains further  details on our objectives, scope, and methodology.
subsections: section_title: Background
paragraphs: Critical infrastructures are physical or virtual systems and assets so vital  to the nation that their incapacitation or destruction would have a  debilitating impact on national and economic security, public health, and  safety. These systems and assets—such as the electric power grid,  chemical plants, and water treatment facilities—are essential to the  operations of the economy and the government. Recent terrorist attacks  and threats have underscored the need to protect our nation’s critical  infrastructures. If vulnerabilities in these infrastructures are exploited, our  nation’s critical infrastructures could be disrupted or disabled, possibly  causing loss of life, physical damage, and economic losses.
Although the vast majority of our nation’s critical infrastructures are  owned by the private sector, the federal government owns and operates  key facilities that use control systems, including oil, gas, water, energy,  and nuclear facilities (see fig. 1).
subsections: section_title: Control Systems Are Used in Many Critical Infrastructures
paragraphs: Control systems are computer-based systems that are used within many  infrastructures and industries to monitor and control sensitive processes  and physical functions. Typically, control systems collect sensor  measurements and operational data from the field, process and display  this information, and relay control commands to local or remote  equipment. Control systems perform functions that range from simple to  complex. They can be used to simply monitor processes—for example, the  environmental conditions in a small office building—or to manage the  complex activities of a municipal water system or a nuclear power plant.
In the electric power industry, control systems can be used to manage and  control the generation, transmission, and distribution of electric power  (see fig. 2). For example, control systems can open and close circuit  breakers and set thresholds for preventive shutdowns. The oil and gas  industry uses integrated control systems to manage refining operations at  plant sites, remotely monitor the pressure and flow of gas pipelines, and  control the flow and pathways of gas transmission. Water utilities can  remotely monitor well levels and control the wells’ pumps; monitor flows,  tank levels, or pressure in storage tanks; monitor water quality  characteristics such as pH, turbidity, and chlorine residual; and control the  addition of chemicals to the water. Control systems are also used in  manufacturing and chemical processing. Chemical reactors may use  control systems to produce chemicals or regulate temperatures within the  production process.
Installing and maintaining control systems requires a substantial financial  investment. DOE cites research estimating the value of the control  systems used to monitor and control the electric grid and the oil and  natural gas infrastructure at $3 billion to $4 billion. The thousands of  remote field devices represent an additional investment of $1.5 billion to  $2.5 billion. Each year, the energy sector alone spends over $200 million  for control systems, networks, equipment, and related components and at  least that amount in personnel costs.
section_title: Control Systems: Types and Components
paragraphs: There are two primary types of control systems: distributed control  systems and supervisory control and data acquisition (SCADA) systems.  Distributed control systems typically are used within a single processing  or generating plant or over a small geographic area, while SCADA systems  typically are used for large, geographically dispersed operations. For  example, a utility company may use a distributed control system to  manage power generation and a SCADA system to manage its distribution.
A SCADA system is generally composed of six components: instruments,  operating equipment, local processors, short-range communication, host  computers, and long-range communications.
Instruments sense conditions such as pH, temperature, pressure,  power level, and flow rate.
Operating equipment includes pumps, valves, conveyors, and  substation breakers that can be controlled by energizing actuators or  relays.
Local processors communicate with the site’s instruments and  operating equipment. Local processors go by several different names,  including programmable logic controller, remote terminal unit,  intelligent electronic device, and process automation controller. A  single local processor may be responsible for dozens of inputs from  instruments and outputs to operating equipment. Local processors can  collect instrument data; turn on and off operating equipment; translate  protocols so different controllers, instruments, and equipment can  communicate; and identify alarm conditions.
Short-range communication consists of the relatively short cables or  wireless connections that carry analog and discrete signals between  the local processors and the instruments and operating equipment. The  communication uses electrical characteristics such as voltage and  current or other established industrial communications protocols.
Host computers are the central point of monitoring and control. The  host computer is where a human operator can supervise the process,  receive alarms, review data, and exercise control. In some cases the  host computer has logic programmed into it to provide control over the  local processors. The host computer may be called the master terminal  unit, the SCADA server, or a personal computer.
Long-range communication consists of the communication between  the local processors and host computers. This communication typically  covers miles using methods such as leased phone lines, satellite,  microwave, and cellular packet data.
Figure 3 illustrates the major components of a SCADA system and Figure 4  illustrates how these components would be distributed in a typical water  utility.
These components can be adapted to perform specific functions in many  industrial sectors. For example, the following graphic shows the  application of these components in a water treatment and distribution  system.
section_title: The Federal Government Plays a Critical Role in Helping Secure Critical Infrastructures and Their Control Systems
paragraphs: Federal law and policies call for critical infrastructure protection activities  to enhance the cyber and physical security of both public and private  infrastructures that are essential to national security, national economic  security, and national public health and safety. Federal policy designates  certain federal agencies as lead points of contact for each key critical  infrastructure sector (see table 1). Further, it assigns agencies  responsibility for infrastructure protection activities in their assigned  sectors and for coordination with other relevant federal agencies, state  and local governments, and the private sector. In addition, federal policy  establishes DHS as the focal point for the security of cyberspace— including analysis, warning, information sharing, vulnerability reduction,  mitigation, and recovery efforts for public and private critical  infrastructure information systems. To accomplish this mission, DHS is to  work with other federal agencies, state and local governments, and the  private sector.
Several key federal plans focus on securing critical infrastructure control  systems. The cyberspace strategy  calls for DHS and DOE to work in  partnership with industry to develop best practices and new technology to  increase the security of critical infrastructure control systems, to  determine the most critical control systems-related sites, and to develop a  prioritized plan for short-term cybersecurity improvements for those sites.  In addition, DHS’s National Infrastructure Protection Plan specifically  identifies control systems as part of the cyber infrastructure, establishes  an objective of reducing vulnerabilities and minimizing severity of attacks  on these systems, and identifies programs directed at protecting control  systems. Further, in May 2007, the critical infrastructure sectors issued  sector-specific plans to supplement the National Infrastructure  Protection Plan. Twelve sectors, including the chemical, energy, water,  information technology, postal, emergency services, and  telecommunications sectors, identified control systems within their  respective sectors. Of these, most identified control systems as critical to  their sector and listed efforts under way to help secure them.
section_title: Critical Infrastructure Control Systems Face Increasing Risks Due to Cyber Threats, Vulnerabilities, and the Potentially Serious Impact of an Attack
paragraphs: Critical infrastructure control systems face increasing risks due to cyber  threats, system vulnerabilities, and the potentially serious impact of an  attack as demonstrated by reported incidents. Cyber threats can be  unintentional or intentional, targeted or nontargeted, and can come from a  foreign, domestic, or inside source. Control systems can have  vulnerabilities that make them susceptible to cyber attacks, including the  increased connectivity of control systems to other systems and the  Internet. Further, based on past events, the impact of a control systems  incident on a critical infrastructure could be substantial.
subsections: section_title: Critical Infrastructures Face Multiple Cyber Threats
paragraphs: Cyber threats can be unintentional and intentional, targeted or  nontargeted, and can come from a variety of sources. Unintentional  threats can be caused by software upgrades or maintenance procedures  that inadvertently disrupt systems. Intentional threats include both  targeted and nontargeted attacks. A targeted attack is when a group or  individual specifically attacks a critical infrastructure system. A  nontargeted attack occurs when the intended target of the attack is  uncertain, such as when a virus, worm, or malware is released on the  Internet with no specific target.
There is increasing concern among both government officials and industry  experts regarding the potential for a cyber attack on a national critical  infrastructure, including the infrastructure’s control systems. The Federal  Bureau of Investigation has identified multiple sources of threats to our  nation’s critical infrastructures, including foreign nation states engaged in  information warfare, domestic criminals and hackers, and disgruntled  employees working within an organization. Table 2 summarizes those  groups or individuals that are considered to be key sources of threats to  our nation’s infrastructures.
section_title: Control Systems Are Vulnerable to Cyber Attacks
paragraphs: Control systems are vulnerable to flaws or weaknesses in system security  procedures, design, implementation, and internal controls. When these  weaknesses are accidentally triggered or intentionally exploited, they  could result in a security breach. Vulnerabilities could occur in control  systems’ policies, platform (including hardware, operating systems, and  control system applications), or networks.
Federal and industry experts believe that critical infrastructure control  systems are more vulnerable today than in the past. Reasons include the  increased standardization of technologies, the increased connectivity of  control systems to other computer networks and the Internet, insecure  connections, and the widespread availability of technical information  about control systems. Further, it is not uncommon for control systems to  be configured with remote access through either a dial-up modem or over  the Internet to allow remote maintenance or around-the-clock monitoring.  If control systems are not properly secured, individuals and organizations  may eavesdrop on or interfere with these operations from remote  locations.
section_title: Reported Control Systems Incidents Reveal the Potential for Substantial Impact
paragraphs: Reported attacks and unintentional incidents involving critical  infrastructure control systems demonstrate that a serious attack could be  devastating. Although there is not a comprehensive source for incident  reporting, the following attacks, reported in government and media  sources, demonstrate the potential impact of an attack.
Worcester air traffic communications. In March 1997, a teenager in  Worcester, Massachusetts, disabled part of the telephone network using a  dial-up modem connected to the system. This disabled phone service to  the airport control tower, airport security, the airport fire department, the  weather service, and the carriers that use the airport. Also, the tower’s  main radio transmitter and another transmitter that activates runway  lights were shut down, as well as a printer that controllers use to monitor  flight progress. The attack also disrupted phone service to 600 homes in a  nearby town.
Maroochy Shire sewage spill. In the spring of 2000, a former employee  of an Australian organization that develops manufacturing software  applied for a job with the local government, but was rejected. Over a 2- month period, this individual reportedly used a radio transmitter on as  many as 46 occasions to remotely break into the controls of a sewage  treatment system. He altered electronic data for particular sewerage  pumping stations and caused malfunctions in their operations, ultimately  releasing about 264,000 gallons of raw sewage into nearby rivers and  parks.
Los Angeles traffic lights. According to several published reports, in  August 2006, two Los Angeles city employees hacked into computers  controlling the city’s traffic lights and disrupted signal lights at four  intersections, causing substantial backups and delays. The attacks were  launched prior to an anticipated labor protest by the employees.
In addition, the following incidents illustrate the consequences of  nontargeted attacks and unintentional incidents on critical infrastructure  control systems. According to experts, incidents such as these could also  be triggered by a targeted attack.
CSX train signaling system. In August 2003, the Sobig computer virus  was blamed for shutting down train signaling systems throughout the East  Coast of the United States. The virus infected the computer system at CSX  Corporation’s Jacksonville, Florida, headquarters, shutting down signaling,  dispatching, and other systems. According to an Amtrak spokesman, 10  Amtrak trains were affected. Train service was either shut down or  delayed up to 6 hours.
Davis-Besse power plant. The Nuclear Regulatory Commission  confirmed that in January 2003, the Microsoft SQL Server worm known as  Slammer infected a private computer network at the idled Davis-Besse  nuclear power plant in Oak Harbor, Ohio, disabling a safety monitoring  system for nearly 5 hours. In addition, the plant’s process computer failed,  and it took about 6 hours for it to become available again.
Northeast power blackout. In August 2003, failure of the alarm  processor in the control system of FirstEnergy, an Ohio-based electric  utility, prevented control room operators from having adequate situational  awareness of critical operational changes to the electrical grid. This  problem was compounded when the state estimating program at the  Midwest Independent System Operator failed due to incomplete  information on the electric grid. When several key transmission lines in  northern Ohio tripped due to contact with trees, they initiated a cascading  failure of 508 generating units at 265 power plants across eight states and a  Canadian province.
Zotob worm. In August 2005, a round of Internet worm infections  knocked 13 of DaimlerChrysler’s U.S. automobile manufacturing plants  offline for almost an hour, leaving workers idle as infected Microsoft  Windows systems were patched. Zotob and its variations also caused  computer outages at heavy-equipment maker Caterpillar Inc., aircraft  maker Boeing, and several large U.S. news organizations.
Taum Sauk Water Storage Dam failure. In December 2005, the Taum  Sauk Water Storage Dam, approximately 100 miles south of St. Louis,  Missouri, suffered a catastrophic failure, releasing a billion gallons of  water. According to the dam’s operator, the incident may have occurred  because the gauges at the dam read differently than the gauges at the  dam’s remote monitoring station.
Bellingham, Washington, gasoline pipeline failure. In June 1999,  237,000 gallons of gasoline leaked from a 16-inch pipeline and ignited an  hour and a half later, causing three deaths, eight injuries, and extensive  property damage. The pipeline failure was exacerbated by poorly  performing control systems that limited the ability of the pipeline  controllers to see and react to the situation.
Harrisburg, Pennsylvania, water system. In October 2006, a foreign  hacker penetrated security at a water filtering plant. The intruder planted  malicious software that was capable of affecting the plant’s water  treatment operations. The infection occurred through the Internet and did  not seem to be an attack that directly targeted the control system.
Browns Ferry power plant. In August 2006, two circulation pumps at  Unit 3 of the Browns Ferry, Alabama, nuclear power plant failed, forcing  the unit to be shut down manually. The failure of the pumps was traced to  excessive traffic on the control system network, possibly caused by the  failure of another control system device.
As control systems become increasingly interconnected with other  networks and the Internet, and as the system capabilities continue to  increase, so do the threats, potential vulnerabilities, types of attacks, and  consequences of compromising these critical systems.
section_title: Critical Infrastructure Owners Face Technical and Organizational Challenges to Securing Control Systems
paragraphs: Critical infrastructure owners face both technical and organizational  challenges in securing their control systems. Technical challenges— including control systems’ limited processing capabilities and their real- time operations—hinder infrastructure owners’ ability to implement  traditional information security technologies and practices. Organizational  challenges include the lack of a compelling business case to improve  security and a reluctance to share information regarding incidents.
subsections: section_title: Technical Challenges Hinder Use of Traditional Information Security Measures for Control Systems
paragraphs: According to industry experts, existing information security technologies  and practices—such as strong user authentication and patch  management—are generally not implemented in control systems due to  several technical issues, including limited computational processing  capabilities, the need for real-time operation, and the lack of consideration  of cybersecurity in the original design of the system. These challenges are  described here in more detail.
Limited computational capabilities. Existing security technologies— such as authorization, authentication, encryption, intrusion detection, and  filtering of network traffic and communications—require more bandwidth,  processing power, and memory than control system components typically  have. Controller stations are generally designed to do specific tasks, and  they often use low-cost, resource-constrained microprocessors. In  addition, passwords and other data from control systems are often  transmitted in a plain, unencrypted format. Encrypting this data could  overload the processing abilities of the control system.
Need for real-time operations. Complex passwords and other strong  password practices are not always used to prevent unauthorized access to  control systems, in part because they could hinder the operator’s ability to  respond rapidly during an emergency. As a result, according to security  experts, weak passwords that are easy to guess, and shared and  infrequently changed, are common in control systems. Some even use  default passwords or no password at all.
Design limitations. Historically, control systems vendors did not design  their products with security in mind, although recently vendors have  begun including more security-related features in their products. In  addition, although modern control systems are based on standard  operating systems, they are typically customized to support control system  applications. Consequently, software patches may either be incompatible  with the customized version of the operating system or difficult to  implement without compromising service by shutting down “always-on”  systems or affecting interdependent operations.
Table 3 illustrates the technical challenges in securing control systems by  contrasting them with conventional information technology (IT) systems.
section_title: Organizational Issues Pose Challenges to Securing Control Systems
paragraphs: In addition to the technical challenges of securing control systems, critical  infrastructure owners face organizational challenges in securing control  systems, including difficulty in developing a compelling business case for  improving control systems security, a reluctance to share information on  control system incidents (which could help build a business case), and the  division of technical responsibilities within an organization.
Experts and industry representatives reported that organizations may be  reluctant to devote resources to securing control systems. These resources  include money, personnel, training, and the early replacement of  equipment that may have been originally designed to last 20 years or more.  Until industry users of control systems have a business case to justify why  additional security is needed, there may be little market incentive for the  private sector to develop and implement more secure control systems.
Another challenge is the reluctance to share information on control  systems incidents and the resulting lack of attention to this risk. While  incidents and attacks on critical infrastructure control systems have  occurred, to date there is no authoritative, centralized process for  collecting and analyzing information about control systems incidents.  Experts we interviewed stated that companies are reluctant to share  details of incidents due to factors such as legal liability and impact on their  reputation. Several experts stated that they believed incidents were  occurring, but are not being reported by industry. One expert suggested  that since there have been no reports of significant disruptions caused by  cyber attacks on U.S. control systems, industry representatives may  believe the threat of such an attack is low. We have previously  recommended that the government work with the private sector to  improve the quality and quantity of information being shared among  industries and government about attacks on the nation’s critical  infrastructures.
Another challenge involves the way security responsibilities are structured  within organizations that use control systems. Several experts and  industry representatives stated that two separate groups often have  responsibility for securing control systems: (1) IT security personnel and  (2) control system engineers and operators. IT security personnel focus on  securing enterprise systems, while control system engineers and operators  focus on the reliable performance of their control systems. Because each  has a different focus, the two groups face challenges in collaborating to  implement secure control systems. For example, IT security personnel  may be unaware of the special requirements of a control system and the  control systems personnel may be unaware of the full range of security  technologies that may be available.
Certain challenges are inherent to control systems. However, according to  experts, many of these challenges can be addressed by both the private  and public sectors through proper implementation of existing technology,  development of new technologies, and implementation of organizational  policies and procedures and training.
section_title: The Private Sector Has Multiple Initiatives Under Way to Help Secure Control Systems
paragraphs: Industry-specific organizations in various sectors, including the electricity,  chemical, oil and gas, and water sectors, have initiatives under way to help  improve control system security. These initiatives include developing  standards, publishing guidance, and hosting workshops.
subsections: section_title: Electricity
paragraphs: The electricity system of the United States and Canada has more than $1  trillion in asset value, more than 200,000 miles of transmission lines, and  more than 800,000 megawatts of generating capability serving over 300  million people. The effective functioning of this infrastructure is highly  dependent on control systems. As a result, private sector organizations in  the electricity sector have several activities under way related to control  systems security, including establishing mandatory reliability standards,  developing guidelines for compliance with these standards, hosting  workshops, and other activities. See table 4 for a description of key  control systems security initiatives in the electricity sector. performs research on policies and procedures for securing control systems, but has  not been able to develop security technology for control systems given current  funding levels (the institute’s security research has included various reviews of  SCADA systems, determining how to secure certain products that are being used by  the electric power industry, reviewing how a facility could recognize and recover from  a control systems attack, and studying the use of wireless technology for SCADA  systems and the inherent security risks); and  has worked on control systems-related projects with the national laboratories, and  has collaborated with DOE. For example, in 2006, the institute worked with the  Pacific Northwest National Laboratory to identify the risks and vulnerabilities  associated with using broadband communications for control systems and to develop  mitigation strategies. According to a laboratory official, the institute and the laboratory  are currently working on a project on electric power utilities’ use of wireless  technologies. The project is to produce two papers addressing best practices for  wireless deployment in the electric sector, and guidelines for securing wireless  networks, training personnel, and securely integrating wireless and wired networks.
The institute is responsible for developing  international standards for  telecommunications, IT, and power  generation products and services.
The Institute of Electrical and Electronics Engineers has several working groups that  address issues related to control systems security in the electric power industry. Some of  these work groups are developing standards for defining, specifying, and analyzing  control systems. For example, the institute is developing P1689, a standard for retrofitting  cybersecurity to various communications links in a control system, and P1711, a  cryptographic standard for the same links. The institute is also developing P1686, which  will define the functions and features to be provided in substation intelligent electronic  devices to accommodate critical infrastructure protection programs.
The commission prepares and publishes  international standards for all electrical,  electronic, and related technologies. World  Trade Organization agreements permit  use of these standards in international  trade.
The commission’s Technical Committee 57 is working to develop standards for control  systems and control system components of power transmission and distribution systems,  including communications and end devices called remote terminal units. It is also  establishing data and communications security and communications standards for  substations.
The commission’s Technical Committee 65 is chartered to produce standards in the area  of industrial process measurement and control. Working Group 10 of the committee is  developing commission standard 62443, which is a three-part standard that will address  network and system cybersecurity of industrial process measurement and control  systems.
section_title: Chemical
paragraphs: Control systems are used to monitor and control processes within the  chemical industry. A $460 billion critical infrastructure sector, the  chemical industry contributes nearly 3 percent of the U.S. gross domestic  product and generates 6.2 million jobs. Chemical reactors may use control  systems to produce chemicals or regulate temperatures within the  production process.
The American Chemistry Council is a trade association that represents  major companies in the U.S. chemical manufacturing sector. The council  supports research and initiatives related to federal regulation on health,  safety, security, and the environment.
The council established a Chemical Sector Cyber Security Program in 2002  to facilitate implementation of the Chemical Sector Cyber Security  Strategy. Updated in 2006, the strategy, as well as the Guidance for  Addressing Cyber Security in the Chemical Industry, addresses  manufacturing and control system security efforts and guidance on how to  secure these systems. Further, within the cybersecurity program, the  Manufacturing and Control Systems Security Work Team was developed  to collect, identify, and facilitate the use of practices for securing  manufacturing and control systems and to establish a network of  manufacturing and control systems subject matter experts.
section_title: Oil and Gas
paragraphs: The United States has more than 2 million miles of pipelines delivering oil  and natural gas. In 2005, the consumption of natural gas totaled about  22,000 billion cubic feet, and in the United States, 20,802,000 barrels of  petroleum were consumed per day. Both the gas and oil industries use  control systems for process management and monitoring purposes.  Employing integrated control systems, these industries can control the  refining operations at a plant site, remotely monitor the pressure and flow  of gas pipelines, and control the flow and pathways of gas transmissions.  The sector-specific plan for the energy sector (which includes oil and gas)  includes a discussion of selected control systems security efforts within  the sector. The oil and gas sector has multiple control systems security  activities under way, in particular, standards relating to security of control  systems. See table 6 for a description of key control systems security  efforts in the oil and gas sector.
section_title: Water
paragraphs: The water sector includes drinking water and water treatment systems.  The sector’s infrastructures are diverse, complex, and distributed, ranging  from systems that serve a few customers to those that serve millions. The  sector includes about 150,000 water, wastewater, and storm water  organizations; federal water offices at the national, regional, and state  levels belonging to several agencies; some 100 state water agency  organizations; and many other local government water organizations.  Members of the water sector have worked with the Environmental  Protection Agency on development of the Water Sector-Specific Plan,  which includes some efforts on control systems security. Members of the  water sector are also participating in the Process Control Security Forum’s  activities. See table 7 for a list of key control system security initiatives by  various organizations in the water sector.
section_title: Other Organizations
paragraphs: Other organizations are working on efforts to improve control systems  security that are not sector-specific. The organization formerly known as  the Instrumentation, Systems, and Automation Society, and now called  ISA, is currently working on control systems security efforts, and  InfraGard, a nonprofit organization associated with the Federal Bureau of  Investigation, has recently started a control systems-related effort. See  table 8 for a description of these initiatives.
section_title: Federal Agencies Have Multiple Initiatives to Help Secure Critical Infrastructure Control Systems, but More Remains to Be Done
paragraphs: Over the past few years, federal agencies—including DHS, DOE, NIST,  FERC, and others—have initiated efforts to improve the security of critical  infrastructure control systems. However, DHS has not yet established a  strategy to coordinate the various control systems activities across federal  agencies and the private sector. Further, more can be done to address  specific weaknesses in DHS’s ability to share information on control  systems vulnerabilities. Until DHS develops an overarching strategy, there  is an increased risk that the federal government and private sector will  invest in duplicative initiatives and miss opportunities to learn from other  organization’s activities. Further, until DHS addresses specific weaknesses  in sharing information, there is an increased risk that the agency will not  be able to effectively carry out its responsibility for sharing information on  vulnerabilities, and that there could be a disruption to our nation’s critical  infrastructures.
subsections: section_title: Federal Agencies Have Many Initiatives Under Way, but DHS Lacks a Comprehensive Strategy that Delineates Responsibilities and Coordinates Activities
paragraphs: There are many federal efforts under way to help improve the security of  critical infrastructure control systems. For example, DHS is sponsoring  multiple control systems security initiatives across critical infrastructure  sectors, including a program to improve control systems cybersecurity  that includes vulnerability reporting and response, activities to promote  security awareness within the control systems community, and efforts to  build relationships with control systems vendors and infrastructure asset  owners. See appendix II for a detailed description of DHS’s key initiatives  and projects involving control systems security.
Additionally, DOE sponsors control systems security efforts within the  electric, oil, and natural gas industries. These efforts include the National  SCADA Test Bed Program, which funds testing, assessments, and training  in control systems security and the development of a road map for  securing control systems in the energy sector. Also, several of DOE’s  national laboratories play an important role in implementing many DHS  and DOE efforts and provide support directly to asset owners and  vendors. For example, the national laboratories perform site assessments,  test vendor equipment, and conduct outreach and awareness activities for  infrastructure asset owners and vendors. See appendix III for more  information on DOE’s initiatives.
Other federal agencies, such as NIST and FERC, have also undertaken  efforts to help secure control systems. For example, NIST is working with  federal and industry stakeholders to develop standards, guidelines,  checklists, and test methods to help secure critical control systems, while  FERC is working to implement electricity reliability standards that address  control systems. See appendix IV for more information on these and other  initiatives.
Several industry experts we spoke with stated that many federal programs  in control systems security have been helpful. For example, experts stated  that developing the road map was a positive step for the energy sector. An  official who participated in the development of DOE’s road map stated  that the process succeeded in identifying industry needs and was a  catalyst for bringing agencies and government coordinating councils  together and that it was a good idea for other industries to develop plans  similar to the road map. In addition, experts we interviewed said the  testing and site assessments conducted by the national laboratories for  DHS and DOE made individual products more secure and helped improve  overall attention to control systems security.
However, the federal government does not yet have an overall strategy for  guiding and coordinating control systems security efforts across the  multiple agencies and sectors. To evaluate activities related to critical  infrastructure protection, we developed a risk management framework for  protecting critical infrastructures based on the standards and practices of  leading organizations. The first phase of this framework is the  development of a strategy that includes the goals, objectives, constraints,  specific activities, milestones, and performance measures needed to  achieve a particular end result. In 2004, we reported that federal agencies,  standards organizations, and the private sector were leading various  initiatives on control systems security, but lacked coordination and  oversight to effectively improve the cybersecurity of the nation’s control  systems. We recommended that DHS develop and implement a strategy  for coordinating control systems security efforts among government  agencies and the private sector.
DHS agreed with our recommendation to develop a control systems  security strategy and, in 2004, issued a strategy that focuses primarily on  DHS’s initiatives. However, the strategy does not include ongoing work by  DOE, FERC, NIST, and others. Further, it does not include the various  agencies’ responsibilities, goals, milestones, or performance measures.  Agency officials stated they have convened a federal working group that  will develop a list of control systems security activities across the  government. Further, in commenting on a draft of this report, DHS  officials stated that this baseline list of activities will serve as the  foundation for a comprehensive strategy across the public and private  sectors. However, they did not provide a date for when the baseline and  the comprehensive strategy would be completed. In addition, they did not  state whether the list or the strategy would include responsibilities, goals,  milestones, or performance measures.
Until DHS develops an overarching strategy that delineates various public  and private entities’ roles and responsibilities and uses it to guide and  coordinate control systems security activities, the federal government and  private sector risk investing in duplicative activities and missing  opportunities to learn from other organization’s activities.
section_title: DHS Faces Challenges in Sharing Sensitive Information on Control Systems Vulnerabilities
paragraphs: DHS is responsible for sharing information with critical infrastructure  owners on control systems vulnerabilities, but faces challenges in doing  so. In 2006, DHS developed a formal process for managing control systems  vulnerabilities reported to the U.S. Computer Emergency Readiness Team  (US-CERT). DHS gathers this information and works with vendors and  others to identify mitigation strategies. It then releases this information to  critical infrastructure owners and operators, control systems vendors, and  the public.
However, DHS’s sharing of sensitive information on control systems to  date has been limited. As of June 2007, US-CERT has issued only nine  notices related to control systems security since the inception of the  control systems security program in 2003. DHS’s information sharing is  limited in part because of reluctance by those in the private sector to  inform the agency of vulnerabilities they have identified and in part  because of weaknesses in DHS’s ability to disseminate potentially  sensitive information to the private sector. We previously reported on  difficulties DHS has had in collecting information from, and sharing it  with, the private sector. Industry officials stated that they are reluctant to  share information about incidents because of uncertainties about how the  information will be used and the value of reporting such incidents.
In addition, DHS lacks a rapid, efficient process for disseminating sensitive  information to private industry owners and operators of critical  infrastructures. An agency official noted that sharing information with the  private sector can be slowed by staff turnover and vacancies at DHS, the  need to brief agency and executive branch officials and congressional staff  before briefing the private sector, and difficulties in determining the  appropriate classification level for the information. DHS’s control systems  security program manager acknowledged the need to share information  more quickly. In commenting on a draft of this report, DHS officials stated  that after the start of our review, the agency began developing a process to  formalize and improve information sharing. However, this process was not  evident during our review. Further, DHS did not provide evidence of this  process or examples of how the process had actually been used to share  information.
Until DHS establishes an approach for rapidly assessing the sensitivity of  vulnerability information and disseminating it—and thereby demonstrates  the value it can provide to critical infrastructure owners—the agency’s  ability to effectively serve as a focal point in the collection and  dissemination of sensitive vulnerability information will continue to be  limited. Without a trusted focal point for sharing sensitive information on  vulnerabilities, there is an increased risk that attacks on control systems  could cause a significant disruption to our nation’s critical infrastructures.
section_title: Conclusions
paragraphs: Control systems are an essential component of our nation’s critical  infrastructure. Past incidents involving control systems, system  vulnerabilities, and growing threats from a wide variety of sources  highlight the risk facing these systems. The public and private sectors have  begun numerous activities to improve the cybersecurity of these systems.  However, the federal government lacks an overall strategy for  coordinating public and private sector efforts. DHS also lacks an efficient  process for sharing sensitive information on vulnerabilities with private  sector critical infrastructure owners. Until an overarching strategy is in  place, public and private sectors risk undertaking duplicative efforts. Also,  without a streamlined process for advising private sector infrastructure  owners of vulnerabilities, DHS is unable to fulfill its responsibility as a  focal point for disseminating this information. If key vulnerability  information is not in the hands of those who can mitigate its potentially  severe consequences, there is an increased risk that attacks on control  systems could cause a significant disruption to our nation’s critical  infrastructures.
section_title: Recommendations for Executive Action
paragraphs: To improve federal government efforts to secure control systems  governing critical infrastructure, we recommend that the Secretary of the  Department of Homeland Security implement the following two actions:    develop a strategy to guide efforts for securing control systems,  including agencies’ responsibilities, as well as overall goals, milestones,  and performance measures, and    establish a rapid and secure process for sharing sensitive control  system vulnerability information with critical infrastructure control  system stakeholders, including vendors, owners, and operators.
section_title: Agency Comments and Our Evaluation
paragraphs: We received comments via e-mail on a draft of this report from DHS  officials, including the Deputy Director of the National Cyber Security  Division. In the comments, agency officials neither agreed nor disagreed  with our recommendations. Instead, they stated that DHS would take the  recommendations under advisement. Additionally, officials stated that the  agency has recently begun working with its partners in the Federal Control  System Security Working Group to establish a baseline of ongoing  activities. This baseline is to serve as a foundation for developing a  comprehensive strategy that will encompass the public and private  sectors, set a vision to secure control systems, describe roles and  responsibilities, and identify future requirements for resources and action.  Moreover, officials stated that the agency has recently developed a  process to formalize the sharing of sensitive information related to control  systems vulnerabilities. The officials reported that this process describes  the information flow from vulnerability discovery, to validation, public and  private coordination, and outreach and awareness. Further, it identifies  the deliverables and outcomes expected at each step in the process.
While DHS’s intention to develop a comprehensive public/private strategy  is consistent with our recommendation, the agency did not provide a date  by which this strategy will be completed. Until DHS completes the  comprehensive strategy, the public and private sectors risk undertaking  duplicative efforts.
Additionally, while DHS officials stated that the agency had developed a  process for sharing sensitive information on control system vulnerabilities,  it did not have such a process in place during our review. Further, the  agency has not provided evidence of its process for sharing control system  vulnerability information or evidence that this process has been used to  share information. Until such a process is formalized and implemented,  key vulnerability information may not be available to those who can  mitigate its potentially severe consequences, therefore increasing the risk  that attacks on control systems could cause a significant disruption to our  nation’s critical infrastructures.
DHS officials and officials from other agencies who contributed to this  report provided technical comments, which we have incorporated as  appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the report date. At that time, we will send copies of this report to  interested congressional committees, the Secretary of the Department of  Homeland Security, and other interested parties. In addition, this report  will be available at no charge on GAO’s Web site at www.gao.gov.
If you have any questions on matters discussed in this report, please  contact Dave Powner at (202) 512-9286 or Keith Rhodes at (202) 512-6412,  or by e-mail at pownerd@gao.gov and rhodesk@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made major contributions to  this report are listed in appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) determine cyber threats, vulnerabilities, and the  potential impact of attacks on critical infrastructure control systems;  (2) determine the challenges to securing critical infrastructure control  systems; (3) identify private sector initiatives to strengthen the  cybersecurity of control systems; and (4) assess the adequacy of public  sector initiatives to strengthen the cybersecurity of control systems.
To determine the cyber threats, vulnerabilities, and the potential impact of  attacks on critical infrastructure control systems, we reviewed prior GAO  reports on control systems as well as reports prepared by other  government agencies and private organizations, including documentation  of prior control system security incidents. We conducted interviews with  individuals in the private sector, including representatives of private  companies that operate control systems. These individuals were selected  based on their knowledge of and participation in both private and public  sector control system security activities. We also met with representatives  from trade associations and federal agencies. On the basis of the  information and documentation we received from these individuals, and  information we collected during site visits to three of the national  laboratories, we were able to compile information on the cyber threats,  vulnerabilities, and the potential impact of attacks on critical  infrastructure control systems.
To determine the challenges to securing critical infrastructure control  systems, we reviewed prior GAO reports and testimonies and materials  written by other public and private organizations on control systems  security, critical infrastructure protection, and national preparedness. We  conducted interviews with experts and industry representatives, including  managers of federal control systems programs at the Department of  Homeland Security (DHS) and Department of Energy (DOE), experts from  the national laboratories, vendors, owners and operators, and standards  and trade associations.
To identify the private sector initiatives to strengthen cybersecurity of  control systems, we researched current standards and accepted trade  practices and analyzed current efforts to better secure control systems.  We spoke to private sector owners and operators, vendors, trade  associations, industry experts, and standards associations. These  organizations included the North American Electric Reliability  Corporation (NERC), the American Gas Association, and ISA.
To assess the adequacy of public sector initiatives to strengthen the  cybersecurity of control systems, we researched relevant federal laws and  regulations and initiatives by federal agencies to better secure control  systems, and reviewed documentation and project plans on federal control  systems efforts. We also reviewed GAO’s prior work analyzing best  practices from leading organizations and interviewed private sector and  other experts in control systems security for their perspectives on federal  efforts. We interviewed officials from federal agencies including DHS,  DOE, the National Institute of Standards and Technology (NIST), and the  Federal Energy Regulatory Commission (FERC). In addition, we visited  three of the national laboratories that are leading control systems security  research and outreach efforts. These labs were selected because of their  extensive participation in DOE and DHS control systems security  programs. We then compared the activities of federal agencies with best  practices and the perspectives of experts.
Our work was conducted from March 2007 to July 2007 at agencies’  headquarters in Washington, D.C., and at national laboratories in Idaho,  New Mexico, and Washington state in accordance with generally accepted  government auditing standards.
section_title: Appendix II: The Department of Homeland Security’s Control Systems Security Initiatives
paragraphs: DHS supports multiple control systems security initiatives across  government and the private sector. Table 9 lists key initiatives and projects  conducted by DHS in control system security.
section_title: Appendix III: The Department of Energy’s Initiatives to Support Control Systems Security within the Energy Sector
paragraphs: Since 2003, the Department of Energy’s Office of Electricity Delivery and  Energy Reliability has led control systems security efforts within the  electric, oil, and natural gas industries by establishing the National SCADA  Test Bed Program and developing a 10-year strategic framework for  securing control systems in the energy sector. DOE’s national laboratory  facilities also play an important role in control systems security research.  In particular, the Idaho National Laboratory, Sandia National Laboratories,  and the Pacific Northwest National Laboratory lead key efforts in control  systems security research for DOE, DHS, and other public and private  organizations.
subsections: section_title: The National SCADA Test Bed Program
paragraphs: In 2004, DOE launched the National SCADA Test Bed Program, a  multilaboratory effort to identify control systems vulnerabilities, conduct  control systems research and development, and provide cybersecurity  training and outreach to industry. The test bed program includes five DOE  laboratories and has a budget of $10 million for fiscal year 2007. To date,  the test bed program has completed 12 control systems vulnerability  assessments in cooperation with control systems vendors and energy  sector owners and operators. As a result of these assessments, the test bed  team has provided vendors with recommendations to improve control  systems security, and owners and operators with strategies for mitigating  existing system security risks. The test bed program also has 10 ongoing  control systems research and development projects that are peer-reviewed  biannually to ensure they meet the needs of the government and the end  users. In addition to its testing and research efforts, the program has led  training workshops on control systems security for over 1,500 industry  personnel, and has established a working group to evaluate control  systems security standards in the energy sector.
section_title: Strategic Framework for Securing Control Systems in the Energy Sector
paragraphs: In January 2006, DOE released the Roadmap to Secure Control Systems in  the Energy Sector, a collaborative public-private strategy for securing  control systems infrastructures over the next 10 years. Developed jointly  by energy owners and operators, researchers, vendors, and the  government, the road map links near-, mid-, and long-term security needs  with four main goals: (1) measure and assess the current security posture;  (2) develop and integrate protective measures; (3) detect intrusion and  implement response strategies; and (4) sustain security improvements.
The road map outlines the energy sector’s top control systems security  concerns and existing mitigation efforts, and is serving as a model for  other sectors to develop similar plans. For example, in January 2007,  DHS’s National Infrastructure Advisory Council recommended that DHS  and the sector-specific agencies develop plans using DOE’s road map as a  model. DOE has used the road map to align its test bed projects with  strategic goals. In addition, DOE has created an online road map that uses  the strategic framework to track public and private sector control systems  security projects.
section_title: National Laboratories Are Leading Significant Portions of Control Systems Security Work
paragraphs: DOE owns 17 laboratories and research facilities around the country that  play an important role in control systems security research. In particular,  the Idaho National Laboratory, the Sandia National Laboratories, and the  Pacific Northwest National Laboratory manage and conduct key efforts in  control systems security research for DOE, DHS, and other public and  private organizations. Using their research facilities, the laboratories are  able to conduct work for DHS, DOE, and other organizations.
subsections: section_title: Research Facilities
paragraphs: The laboratories are able to use a number of unique research facilities to  test control systems equipment. For example, Idaho National Laboratory  operates its own electrical power transmission facility, which consists of  61 miles of high-voltage transmission lines, feeders, transformers, and  independent substations (see fig. 5). According to laboratory officials,  because portions of the transmission facility are easy to separate from the  overall power grid, control systems equipment can be tested on the grid  without fear of effects on the larger power grid.
The Pacific Northwest National Laboratory has the Electricity  Infrastructure Operations Center, which is a replica of a typical operations  center used in the electric industry, with consoles, displays, hardware, and  software that can be used for control of electricity transmission (see fig.  6). The center receives live transmission data from actual utility control  systems, and is used as a platform for research, development, and  demonstration.
The national laboratories manage key efforts for DHS related to control  systems security. For example, the Idaho National Laboratory is the lead  laboratory to support and execute the DHS Control Systems Security  Program. According to laboratory officials, the laboratories coordinate  activities funded through DHS with those funded through the National  SCADA Test Bed of the Department of Energy. For example, Idaho  National Laboratory has conducted five vendor assessments and six site  assessments using DHS funds and eight vendor assessments and four site  assessments using DOE funds.
Additionally, the Idaho, Pacific Northwest, and Sandia National  Laboratories developed training for asset owners and operators. The Idaho  National Laboratory has developed 4- and 8-hour classes on control  systems security that it has given to approximately 1,500 industry  personnel since 2005. In 2006, the Pacific Northwest National Laboratory  developed online control systems security awareness training that has  been published on US-CERT’s Web site. In 2007, Sandia National  Laboratories developed training to educate owners and operators on how  to effectively use red teaming to improve the security posture of their  control systems. Further, the Idaho National Laboratory has worked with  George Mason University and New York University to develop a draft  master’s level course curriculum on critical infrastructure and control  systems security.
section_title: DOE’s National SCADA Test Bed Sponsors Laboratory Activities
paragraphs: Under DOE’s National SCADA Test Bed Program, the national laboratories  have worked both independently and collaboratively on performing  vendor vulnerability assessments, conducting control systems research  and development, and leading industry training and outreach. For  example, between 2004 and 2007, the Idaho National Laboratory  conducted assessments of eight different control systems for the  electricity sector. According to laboratory officials, vendors provide the  lab with the hardware, software, and training necessary to run the control  system; this represents a $1 million to $1.5 million investment by the  vendor. Largely on the basis of the results of these assessments, vendors  have chosen to develop system patches, reconfigure system architectures,  and build enhanced systems, which have been retested by the laboratory.  Furthermore, according to an agency official, the results of the vendor  assessments have helped inform other federal control systems efforts,  such as the development of the control system self assessment tool. In  addition, the Idaho National Laboratory has conducted four on-site control  system assessments for electricity sector owners and operators.
In addition to vendor assessments, the laboratories are engaged in 10  research projects that are to help industry stakeholders analyze control  systems operations and improve the security and reliability of  architectures for control systems. For example, the Pacific Northwest  National Laboratory has developed a technology to encapsulate control  systems communications between two devices with a unique identifier and  authenticator. This technology enables the devices to verify that the  communication has not been tampered with. Unlike comparable  technologies for standard information technology (IT) systems, the  authentication technology does not require substantial amounts of  bandwidth or processing power. Importantly, this technology has the  potential to be applied to both new systems and older control systems. In  addition, the Idaho, Pacific Northwest, and Sandia National Laboratories  are working on identifying vulnerabilities in the current communications  protocol used between control centers, testing mitigation techniques, and,  ultimately, assisting industry in implementing a secure version of the  protocol.
section_title: Other Organizations Sponsor Laboratory Activities
paragraphs: In addition to work for DHS and DOE, the laboratories have conducted  control systems security work for other public and private organizations,  including research, security assessments, and training. For example, the  laboratories have performed security assessments of control systems for  federal operators of critical infrastructure, including the Bureau of  Reclamation, Tennessee Valley Authority, Bonneville Power  Administration, and the Strategic Petroleum Reserve, as well as private  sector utility companies. Moreover, the Pacific Northwest National  Laboratory worked with the Nuclear Regulatory Commission and the  Nuclear Energy Institute to develop a self-assessment methodology for  nuclear plants to determine compliance with standards.
section_title: Appendix IV: Other Agencies’ Initiatives to Help Secure Critical Infrastructure Control Systems
paragraphs: In addition to DHS and DOE, multiple other federal agencies and entities  are working to help secure critical infrastructure control systems.  Initiatives undertaken by the Federal Energy Regulatory Commission, the  National Institute of Standards and Technology, the Environmental  Protection Agency, and others are described here.
subsections: section_title: Federal Energy Regulatory Commission
paragraphs: Under the Energy Policy Act of 2005, the Federal Energy Regulatory  Commission (FERC) was authorized to (1) appoint an electricity reliability  organization to develop and enforce mandatory electricity reliability  standards, including cybersecurity, and (2) approve, remand, or require  modification to each proposed standard. The agency may also direct the  reliability organization to develop a new standard or modify existing  standards. Both the agency and the reliability organization have the  authority to enforce approved standards, investigate incidents, and impose  penalties (up to $1 million a day) on noncompliant electricity asset users,  owners, or operators.
FERC has conducted several activities to begin implementing the  requirements of the act. In July 2006, FERC certified the North American  Electric Reliability Corporation (NERC) as the electric reliability  organization. In December 2006, FERC released a staff assessment of  NERC’s eight Critical Infrastructure Protection (CIP) reliability standards,  which include standards for control systems security. FERC found that  while the standards were a good start, there were a number of items that  required improvement, including ambiguous language for standards  requirements, measurability, and degrees of compliance; insufficient  technical requirements to ensure grid reliability; and the use of “fill-in-the- blank standards,” which are not enforceable. NERC agreed that the  standards represented a starting point and has proposed a work plan to  address the deficiencies. In July 2007, FERC issued a notice of public  rulemaking in which it proposed to approve eight CIP reliability standards  while directing NERC to modify the areas of these standards that require  improvement. After considering public comments on the notice of public  rulemaking, which are due in late September 2007, FERC plans to issue its  final rule on the CIP reliability standards.
section_title: The National Institute of Standards and Technology Is Developing Standards and Guidance to Improve Control Systems Security
paragraphs: The National Institute of Standards and Technology (NIST) is working  with federal and industry stakeholders to develop standards, guidelines,  checklists, and test methods to help secure critical control systems. For  example, NIST is currently developing guidance for federal agencies that  own or operate control systems to comply with federal information system  security standards and guidelines. The guidance identifies issues and  modifications to consider in applying information security standards and  guidelines to control systems. Table 10 lists key NIST efforts.
section_title: Other Federal Agencies Are Working with DHS, DOE, and NIST on Control Systems Security Initiatives
subsections: section_title: Environmental Protection Agency
paragraphs: The Environmental Protection Agency (EPA) assisted DHS in developing a  control systems self-assessment tool, a software program that assists  owners and operators in identifying control systems vulnerabilities and  mitigation strategies for addressing these vulnerabilities. EPA began work  on a water security assessment tool in response to the Public Health  Security and Bioterrorism Preparedness and Response Act of 2002, which  required the agency to conduct vulnerability assessments of community  water systems serving more than 3,300 individuals. EPA’s preliminary  work in this area served as the foundation for DHS’s Control Systems  Cyber Security Self Assessment Tool project. The agency initially launched  the tool within the water sector in July 2007.
In addition, EPA actively participates in control systems security  information sharing activities through the Water Information Sharing and  Analysis Center and DHS’s Homeland Infrastructure Threat and Risk  Analysis Center, and has been involved with control systems standards  development efforts.
section_title: Federal Bureau of Investigation
paragraphs: The Federal Bureau of Investigation’s Cyber Crime division participates in  DHS’s US-CERT program and coordinates with DHS’s National Cyber  Security Division on general cybersecurity issues. According to an agency  official, the Cyber Crime division is in the process of establishing a control  systems work group within its Intelligence and Information Sharing group.
In addition, since 1996, the bureau’s cyber division has sponsored  InfraGard, a cooperative government and private sector program to  exchange information about infrastructure threats and vulnerabilities. As  previously mentioned, SCADAGard, a special interest group within  InfraGard, is to be used to share information with control systems owners  and operators who have been vetted by the bureau.
section_title: Nuclear Regulatory Commission
paragraphs: The Nuclear Regulatory Commission has conducted several activities  related to enhancing the cybersecurity of control systems. The  commission, which has regulatory authority over nuclear power plant  safety control systems, completed a cybersecurity self-assessment project  with technical assistance from the Pacific Northwest National Laboratory  in October 2004 and documented the results in two technical reports  published in 2004 and 2005. According to agency officials, on the basis of  the information in these reports, a nuclear industry task force developed  NEI 04-04, Cyber Security Program for Power Reactors, to provide  nuclear power reactor licensees a means for developing and maintaining  effective cybersecurity programs at their sites. In December 2005, the  commission’s staff accepted this document as an acceptable method for  establishing and maintaining cybersecurity programs at nuclear power  plants.
In January 2006, the commission issued a revision to Regulatory Guide  1.152, Criteria for Use of Computers in Safety Systems of Nuclear Power  Plants, which provides cybersecurity-related guidance for the design of  nuclear power plant safety systems. In addition, the commission has  initiated a rulemaking process providing security requirements for digital  computer and communication networks, including systems that are  needed for safety, security, or emergency response. The public comment  period for this rulemaking closed in March 2007.
According to agency officials, in May 2007, all nuclear plants had  completed an inventory and assessment of their critical digital systems.  Agency officials stated that the commission staff is planning to conduct  oversight inspections after completion of ongoing security-related  rulemaking that will clearly establish the requirements for nuclear power  plant cybersecurity programs.
section_title: Appendix V: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to those named above, Scott Borre, Heather A. Collins, Neil J.  Doherty, Vijay D’Souza, Nancy Glover, Sairah Ijaz, Patrick Morton, and  Colleen M. Phillips (Assistant Director) made key contributions to this  report.