Cybersecurity: Continued Attention Needed to Protect Our Nation's Critical Infrastructure
Published: 2011-07-26T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Increasing computer interconnectivity, such as the growth of the Internet, has revolutionized the way our government, our nation, and much of the world communicate and conduct business. However, this widespread interconnectivity poses significant risks to the government's and the nation's computer systems, and to the critical infrastructures they support. These critical infrastructures include systems and assets--both physical and virtual--that are essential to the nation's security, economic prosperity, and public health, such as financial institutions, telecommunications networks, and energy production and transmission facilities. Because most of these infrastructures are owned by the private sector, establishing effective public-private partnerships is essential to securing them from pervasive cyber-based threats. Federal law and policy call for federal entities, such as the Department of Homeland Security (DHS), to work with private-sector partners to enhance the physical and cyber security of these critical infrastructures. GAO is providing a statement describing (1) cyber threats facing cyber-reliant critical infrastructures; (2) recent actions the federal government has taken, in partnership with the private sector, to identify and protect cyber-reliant critical infrastructures; and (3) ongoing challenges to protecting these infrastructures. In preparing this statement, GAO relied on its previously published work in the area.
section_title: What GAO Found
paragraphs: The threats to systems supporting critical infrastructures are evolving and growing. In a February 2011 testimony, the Director of National Intelligence noted that there has been a dramatic increase in cyber activity targeting U.S. computers and systems in the last year, including a more than tripling of the volume of malicious software since 2009. Varying types of threats from numerous sources can adversely affect computers, software, networks, organizations, entire industries, or the Internet itself. These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, hostile nations, or terrorists. The interconnectivity between information systems, the Internet, and other infrastructures can amplify the impact of these threats, potentially affecting the operations of critical infrastructure, the security of sensitive information, and the flow of commerce. Recent reported incidents include hackers accessing the personal information of hundreds of thousands of customers of a major U.S. bank and a sophisticated computer attack targeting control systems used to operate industrial processes in the energy, nuclear, and other critical sectors. Over the past 2 years, the federal government, in partnership with the private sector, has taken a number of steps to address threats to cyber critical infrastructure. In early 2009, the White House conducted a review of the nation's cyberspace policy that addressed the missions and activities associated with the nation's information and communications infrastructure. The results of the review led, among other things, to the appointment of a national Cybersecurity Coordinator with responsibility for coordinating the nation's cybersecurity policies and activities. Also in 2009, DHS updated its National Infrastructure Protection Plan, which provides a framework for addressing threats to critical infrastructures and relies on a public-private partnership model for carrying out these efforts. DHS has also established a communications center to coordinate national response efforts to cyber attacks and work directly with other levels of government and the private sector and has conducted several cyber attack simulation exercises. Despite recent actions taken, a number of significant challenges remain to enhancing the security of cyber-reliant critical infrastructures, such as (1) implementing actions recommended by the president's cybersecurity policy review; (2) updating the national strategy for securing the information and communications infrastructure; (3) reassessing DHS's planning approach to critical infrastructure protection; (4) strengthening public-private partnerships, particularly for information sharing; (5) enhancing the national capability for cyber warning and analysis; (6) addressing global aspects of cybersecurity and governance; and (7)securing the modernized electricity grid, referred to as the "smart grid." In prior reports, GAO has made many recommendations to address these challenges. GAO also continues to identify protecting the nation's cyber critical infrastructure as a governmentwide high-risk area.

section_title: Letter
paragraphs: Thank you for the opportunity to testify at today’s hearing on the  cybersecurity risks to the nation’s critical infrastructure.
Increasing computer interconnectivity—most notably growth in the use of  the Internet—has revolutionized the way that our government, our nation,  and much of the world communicate and conduct business. From its  origins in the 1960s as a research project sponsored by the U.S.  government, the Internet has grown increasingly important to both  American and foreign businesses and consumers, serving as the medium  for hundreds of billions of dollars of commerce each year. The Internet  has also become an extended information and communications  infrastructure, supporting vital services such as power distribution, health  care, law enforcement, and national defense.
While the benefits have been enormous, this widespread interconnectivity  also poses significant risks to the government’s and our nation’s  computer systems and, more importantly, to the critical operations and  infrastructures they support. The speed and accessibility that create the  enormous benefits of the computer age, if not properly controlled, can  allow unauthorized individuals and organizations to inexpensively  eavesdrop on or interfere with these operations from remote locations for  mischievous or malicious purposes, including fraud or sabotage. Recent  cyber-based attacks have further underscored the need to manage and  bolster the cybersecurity of our nation’s critical infrastructures.
Mr. Chairman, in February, GAO issued its biennial high-risk list of  government programs that have greater vulnerability to fraud, waste,  abuse, and mismanagement or need transformation to address economy,  efficiency, or effectiveness challenges. Once again, we identified  protecting the federal government’s information systems and the nation’s  cyber critical infrastructure as a governmentwide high-risk area. We have  designated federal information security as a high-risk area since 1997; in  2003, we expanded this high-risk area to include protecting systems  supporting our nation’s critical infrastructure, referred to as cyber critical  infrastructure protection or cyber CIP.
In my testimony today, I will describe (1) cyber threats facing cyber-reliant  critical infrastructures; (2) recent actions the federal government has  taken, in partnership with the private sector, to identify and protect cyber- reliant critical infrastructures; and (3) ongoing challenges to protecting  cyber critical infrastructure. In preparing this statement in July 2011, we  relied on our previous work in these areas (please see the related GAO  products page at the end of this statement). These products contain  detailed overviews of the scope of our reviews and the methodology we  used. The work on which this statement is based was performed in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform audits to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions. We believe that the evidence obtained provided  a reasonable basis for our findings and conclusions based on our audit  objectives.
subsections: section_title: Background
paragraphs: Critical infrastructures are systems and assets, whether physical or  virtual, so vital to our nation that their incapacity or destruction would  have a debilitating impact on national security, economic well-being,  pubic health or safety, or any combination of these. Critical infrastructure  includes, among other things, banking and financial institutions,  telecommunications networks, and energy production and transmission  facilities, most of which are owned by the private sector. As these critical  infrastructures have become increasingly dependent on computer  systems and networks, the interconnectivity between information  systems, the Internet, and other infrastructures creates opportunities for  attackers to disrupt critical systems, with potentially harmful effects.
Because the private sector owns most of the nation’s critical  infrastructures, forming effective partnerships between the public and  private sectors is vital to successfully protect cyber-reliant critical assets  from a multitude of threats, including terrorists, criminals, and hostile  nations. Federal law and policy have established roles and  responsibilities for federal agencies to work with the private sector and  other entities in enhancing the cyber and physical security of critical  public and private infrastructures. These policies stress the importance of  coordination between the government and the private sector to protect  the nation’s computer-reliant critical infrastructure. In addition, they  establish the Department of Homeland Security (DHS) as the focal point  for the security of cyberspace—including analysis, warning, information  sharing, vulnerability reduction, mitigation efforts, and recovery efforts for  public and private critical infrastructure and information systems. Federal  policy also establishes critical infrastructure sectors, assigns federal  agencies to each sector (known as sector lead agencies), and  encourages private sector involvement. Table 1 shows the 18 critical  infrastructure sectors and the lead agencies assigned to each sector.
In May 1998, Presidential Decision Directive 63 (PDD-63) established  critical infrastructure protection as a national goal and presented a  strategy for cooperative efforts by the government and the private sector  to protect the physical and cyber-based systems essential to the  minimum operations of the economy and the government. Among other  things, this directive encouraged the development of information sharing  and analysis centers (ISAC) to serve as mechanisms for gathering,  analyzing, and disseminating information on cyber infrastructure threats  and vulnerabilities to and from owners and operators of the sectors and  the federal government. For example, the Financial Services, Electricity  Sector, IT, and Communications ISACs represent sectors or  subcomponents of sectors.
The Homeland Security Act of 2002 created the Department of Homeland  Security. Among other things, DHS was assigned with the following  critical infrastructure protection responsibilities: (1) developing a  comprehensive national plan for securing the key resources and critical  infrastructures of the United States, (2) recommending measures to  protect those key resources and critical infrastructures in coordination  with other groups, and (3) disseminating, as appropriate, information to  assist in the deterrence, prevention, and preemption of or response to  terrorist attacks.
In 2003, the National Strategy to Secure Cyberspace was issued, which  assigned DHS multiple leadership roles and responsibilities in protecting  the nation’s cyber critical infrastructure. These include (1) developing a  comprehensive national plan for critical infrastructure protection; (2)  developing and enhancing national cyber analysis and warning  capabilities; (3) providing and coordinating incident response and  recovery planning, including conducting incident response exercises; (4)  identifying, assessing, and supporting efforts to reduce cyber threats and  vulnerabilities, including those associated with infrastructure control  systems; and (5) strengthening international cyberspace security.
PDD-63 was superseded in December 2003 when Homeland Security  Presidential Directive 7 (HSPD-7) was issued. HSPD-7 defined  additional responsibilities for DHS, sector-specific agencies, and other  departments and agencies. The directive instructs sector-specific  agencies to identify, prioritize, and coordinate the protection of critical  infrastructures to prevent, deter, and mitigate the effects of attacks. It also  makes DHS responsible for, among other things, coordinating national  critical infrastructure protection efforts and establishing uniform policies,  approaches, guidelines, and methodologies for integrating federal  infrastructure protection and risk management activities within and across  sectors.
As part of its implementation of the cyberspace strategy and other  requirements to establish cyber analysis and warning capabilities for the  nation, DHS established the United States Computer Emergency  Readiness Team (US-CERT) to help protect the nation’s information  infrastructure. US-CERT is the focal point for the government’s interaction  with federal and private-sector entities 24 hours a day, 7 days a week,  and provides cyber-related analysis, warning, information-sharing, major  incident response, and national-level recovery efforts.
section_title: Cyber-Reliant Critical Infrastructures Face a Proliferation of Threats
paragraphs: Threats to systems supporting critical infrastructure are evolving and  growing. In February 2011, the Director of National Intelligence testified  that, in the past year, there had been a dramatic increase in malicious  cyber activity targeting U.S. computers and networks, including a more  than tripling of the volume of malicious software since 2009. Different  types of cyber threats from numerous sources may adversely affect  computers, software, networks, organizations, entire industries, or the  Internet itself. Cyber threats can be unintentional or intentional.  Unintentional threats can be caused by software upgrades or  maintenance procedures that inadvertently disrupt systems. Intentional  threats include both targeted and untargeted attacks from a variety of  sources, including criminal groups, hackers, disgruntled employees,  foreign nations engaged in espionage and information warfare, and  terrorists.
The potential impact of these threats is amplified by the connectivity  between information systems, the Internet, and other infrastructures,  creating opportunities for attackers to disrupt telecommunications,  electrical power, and other critical services. For example, in May 2008,  we reported that the Tennessee Valley Authority’s (TVA) corporate  network contained security weaknesses that could lead to the disruption  of control systems networks and devices connected to that network. We  made 19 recommendations to improve the implementation of information  security program activities for the control systems governing TVA’s critical  infrastructures and 73 recommendations to address specific weaknesses  in security controls. TVA concurred with the recommendations and has  taken steps to implement them. As government, private sector, and  personal activities continue to move to networked operations, the threat  will continue to grow.
Recent reports of cyber attacks illustrate that the cyber-based attacks on  cyber-reliant critical infrastructures could have a debilitating impact on  national and economic security.
In June 2011, a major bank reported that hackers broke into its  systems and gained access to the personal information of hundreds of  thousands of customers. Through the bank’s online banking system,  the attackers were able to view certain private customer information.
In March 2011, according to the Deputy Secretary of Defense, a cyber  attack on a defense company’s network captured 24,000 files  containing Defense Department information. He added that nations  typically launch such attacks, but there is a growing risk of terrorist  groups and rogue states developing similar capabilities.
In March 2011, a security company reported that it had suffered a  sophisticated cyber attack that removed information about its two- factor authentication tool. According to the company, the extracted  information did not enable successful direct attacks on any of its  customers; however, the information could potentially be used to  reduce the effectiveness of a current two-factor authentication  implementation as part of a broader attack.
In February 2011, media reports stated that computer hackers broke  into and stole proprietary information worth millions of dollars from the  networks of six U.S. and European energy companies.
In July 2010, a sophisticated computer attack, known as Stuxnet, was  discovered. It targeted control systems used to operate industrial  processes in the energy, nuclear, and other critical sectors. It is  designed to exploit a combination of vulnerabilities to gain access to  its target and modify code to change the process.
In January 2010, it was reported that at least 30 technology  companies—most in Silicon Valley, California—were victims of  intrusions. The cyber attackers infected computers with hidden  programs allowing unauthorized access to files that may have  included the companies’ computer security systems, crucial corporate  data, and software source code.
section_title: The Federal Government Has Taken Steps to Address Cyber Threats to Cyber Critical Infrastructure
paragraphs: Over the past 2 years, the federal government has taken a number of  steps aimed at addressing cyber threats to critical infrastructure.
In early 2009, the President initiated a review of the nation’s cyberspace  policy that specifically assessed the missions and activities associated  with the nation’s information and communication infrastructure and issued  the results in May of that year. The review resulted in 24 near- and mid- term recommendations to address organizational and policy changes to  improve the current U.S. approach to cybersecurity. These included,  among other things, that the President appoint a cybersecurity policy  official for coordinating the nation’s cybersecurity policies and activities. In  December 2009, the President appointed a Special Assistant to the  President and Cybersecurity Coordinator to serve in this role and act as  the central coordinator for the nation’s cybersecurity policies and  activities. Among other things, this official is to chair the primary policy  coordination body within the Executive Office of the President responsible  for directing and overseeing issues related to achieving a reliable global  information and communications infrastructure.
Also in 2009, DHS issued an updated version of its National Infrastructure  Protection Plan (NIPP). The NIPP is intended to provide the framework  for a coordinated national approach to addressing the full range of  physical, cyber, and human threats and vulnerabilities that pose risks to  the nation’s critical infrastructures. The NIPP relies on a sector  partnership model as the primary means of coordinating government and  private-sector critical infrastructure protection efforts. Under this model,  each sector has both a government council and a private sector council to  address sector-specific planning and coordination. The government and  private-sector councils are to work in tandem to create the context,  framework, and support for the coordination and information-sharing  activities required to implement and sustain each sector’s infrastructure  protection efforts. The council framework allows for the involvement of  representatives from all levels of government and the private sector, to  facilitate collaboration and information-sharing in order to assess events  accurately, formulate risk assessments, and determine appropriate  protective measures. The establishment of private-sector councils is  encouraged under the NIPP model, and these councils are to be the  principal entities for coordinating with the government on a wide range of  CIP activities and issues. Using the NIPP partnership model, the private  and public sectors coordinate to manage the risks related to cyber CIP  by, among other things, sharing information, providing resources, and  conducting exercises.
In October 2009, DHS established its National Cybersecurity and  Communications Integration Center (NCCIC) to coordinate national  response efforts and work directly with federal, state, local, tribal, and  territorial governments and private-sector partners. The NCCIC integrates  the functions of the National Cyber Security Center, US-CERT, the  National Coordinating Center for Telecommunications, and the Industrial  Control Systems CERT into a single coordination and integration center  and co-locates other essential public and private sector cybersecurity  partners.
In September 2010, DHS issued an interim version of its national cyber  incident response plan. The purpose of the plan is to establish the  strategic framework for organizational roles, responsibilities, and actions  to prepare for, respond to, and begin to coordinate recovery from a cyber  incident. It aims to tie various policies and doctrine together into a single  tailored, strategic, cyber-specific plan designed to assist with operational  execution, planning, and preparedness activities and to guide short-term  recovery efforts.
DHS has also coordinated several cyber attack simulation exercises to  strengthen public and private incident response capabilities. In  September 2010, DHS conducted the third of its Cyber Storm exercises,  which are large-scale simulations of multiple concurrent cyber attacks.  (DHS previously conducted Cyber Storm exercises in 2006 and 2008.)  The third Cyber Storm exercise was undertaken to test the National  Cyber Incident Response Plan, and its participants included  representatives from federal departments and agencies, states, ISACs,  foreign countries, and the private sector.
section_title: Challenges in Protecting Cyber Critical Infrastructure Persist
paragraphs: Despite the actions taken by several successive administrations and the  executive branch agencies, significant challenges remain to enhancing  the protection of cyber-reliant critical infrastructures.
Implementing actions recommended by the president’s cybersecurity  policy review. In October 2010, we reported that of the 24 near- and  mid-term recommendations made by the presidentially initiated policy  review to improve the current U.S. approach to cybersecurity, only 2  had been implemented and 22 were partially implemented. Officials  from key agencies involved in these efforts (e.g., DHS, the  Department of Defense, and the Office of Management and Budget)  stated that progress had been slower than expected because  agencies lacked assigned roles and responsibilities and because  several of the mid-term recommendations would require action over  multiple years. We recommended that the national Cybersecurity  Coordinator designate roles and responsibilities for each  recommendation and develop milestones and plans, including  measures, to show agencies’ progress and performance.    Updating the national strategy for securing the information and  communications infrastructure. In March 2009, we testified on the  needed improvements to the nation’s cybersecurity strategy. In  preparation for that testimony, we convened a panel of experts that  included former federal officials, academics, and private-sector  executives. The panel highlighted 12 key improvements that, in its  view, were essential to improving the strategy and our national  cybersecurity postures, including (1) the development of a national  strategy that clearly articulates objectives, goals, and priorities; (2)  focusing more actions on prioritizing assets and functions, assessing  vulnerabilities, and reducing vulnerabilities than on developing plans;  and (3) bolstering public-private partnerships though an improved  value proposition and use of incentives.    Reassessing the cyber sector-specific planning approach to critical  infrastructure protection. In September 2009, we reported that, among  other things, sector-specific agencies had yet to update their  respective sector-specific plans to fully address key DHS cyber  security criteria. In addition, most agencies had not updated the  actions and reported progress in implementing them as called for by  DHS guidance. We noted that these shortfalls were evidence that the  sector planning process has not been effective and thus leaves the  nation in the position of not knowing precisely where it stands in  securing cyber critical infrastructures. We recommended that DHS (1)  assess whether existing sector-specific planning processes should  continue to be the nation’s approach to securing cyber and other  critical infrastructure and consider whether other options would  provide more effective results and (2) collaborate with the sectors to  develop plans that fully address cyber security requirements. DHS  concurred with the recommendations and has taken action to address  them. For example, the department reported that it undertook a study  in 2009 that determined that the existing sector-specific planning  process, in conjunction with other related efforts planned and  underway, should continue to be the nation’s approach. In addition, at  about this time, the department met and worked with sector officials to  update sector plans with the goal of fully addressing cyber-related  requirements.    Strengthening the public-private partnerships for securing cyber- critical infrastructure. The expectations of private sector stakeholders  are not being met by their federal partners in areas related to sharing  information about cyber-based threats to critical infrastructure. In July  2010, we reported that federal partners, such as DHS, were taking  steps that may address the key expectations of the private sector,  including developing new information-sharing arrangements. We  also reported that public sector stakeholders believed that  improvements could be made to the partnership, including improving  private sector sharing of sensitive information. We recommended,  among other things, that the national Cybersecurity Coordinator and  DHS work with their federal and private-sector partners to enhance  information-sharing efforts, including leveraging a central focal point  for sharing information among the private sector, civilian government,  law enforcement, the military, and the intelligence community. DHS  concurred with this recommendation and officials stated that they  have made progress in addressing the recommendation. We will be  determining the extent of that progress as part of our audit follow-up  efforts.    Enhancing cyber analysis and warning capabilities. DHS’s US-CERT  has not fully addressed 15 key attributes of cyber analysis and  warning capabilities that we identified. As a result, we  recommended in July 2008 that the department address shortfalls  associated with the 15 attributes in order to fully establish a national  cyber analysis and warning capability as envisioned in the national  strategy. DHS agreed in large part with our recommendations and has reported that it is taking steps to implement them. We are currently  working with DHS officials to determine the status of their efforts to  address these recommendations.    Addressing global cybersecurity and governance. Based on our  review, the U.S. government faces a number of challenges in  formulating and implementing a coherent approach to global aspects  of cyberspace, including, among other things, providing top-level  leadership, developing a comprehensive strategy, and ensuring  cyberspace-related technical standards and policies do not pose  unnecessary barriers to U.S. trade. Specifically, we determined that  the national Cybersecurity Coordinator’s authority and capacity to  effectively coordinate and forge a coherent national approach to  cybersecurity were still under development. In addition, the U.S.  government had not documented a clear vision of how the  international efforts of federal entities, taken together, support  overarching national goals. Further, we learned that some countries  had attempted to mandate compliance with their indigenously  developed cybersecurity standards in a manner that risked  discriminating against U.S. companies. We recommended that,  among other things, the Cybersecurity Coordinator develop with other  relevant entities a comprehensive U.S. global cyberspace strategy  that, among other things, addresses technical standards and policies  while taking into consideration U.S. trade. In May 2011, the White  House released the International Strategy for Cyberspace: Prosperity,  Security, and Openness in a Networked World. We will be  determining the extent that this strategy addresses our  recommendation as part of our audit follow-up efforts.    Securing the modernized electricity grid. In January 2011, we reported  on progress and challenges in developing, adopting, and monitoring  cybersecurity guidelines for the modernized, IT-reliant electricity grid  (referred to as the “smart grid”). Among other things, we identified  six key challenges to securing smart grid systems. These included,  among others,    a lack of security features being built into certain smart grid    a lack of an effective mechanism for sharing information on  cybersecurity within the electric industry, and    a lack of electricity industry metrics for evaluating cybersecurity.
We also reported that the Department of Commerce’s National  Institute for Standards and Technology (NIST) had developed and  issued a first version of its smart grid cybersecurity guidelines. While  NIST largely addressed key cybersecurity elements that it had  planned to include in the guidelines, it did not address an important  element essential to securing smart grid systems that it had planned  to include—addressing the risk of attacks that use both cyber and  physical means. NIST officials said that they intend to update the  guidelines to address the missing elements, and have drafted a plan  to do so. While a positive step, the plan and schedule were still in  draft form. We recommended that NIST finalize its plan and schedule  for updating its cybersecurity guidelines to incorporate missing  elements; NIST agreed with this recommendation.
In addition to the challenges we have previously identified, we have  ongoing work in two key areas related to the protection of cyber critical  infrastructures. The first is to identify the extent to which cybersecurity  guidance has been specified within selected critical infrastructure sectors  and to identify areas of commonality and difference between sector- specific guidance and guidance applicable to federal agencies. The  second is a study of risks associated with the supply chains used by  federal agencies to procure IT equipment, software, or services, along  with the extent to which national security-related agencies are taking risk- based approaches to supply-chain management. We plan to issue the  results of this work in November 2011 and early 2012, respectively.
In summary, the threats to information systems are evolving and growing,  and systems supporting our nation’s critical infrastructure are not  sufficiently protected to consistently thwart the threats. While actions have  been taken, the administration and executive branch agencies need to  address the challenges in this area to improve our nation’s cybersecurity  posture, including enhancing cyber analysis and warning capabilities and  strengthening the public-private partnerships for securing cyber-critical  infrastructure. Until these actions are taken, our nation’s cyber critical  infrastructure will remain vulnerable. Mr. Chairman, this completes my  statement. I would be happy to answer any questions you or other  members of the Subcommittee have at this time.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other  key contributors to this statement include Michael Gilmore (Assistant  Director), Bradley Becker, Kami Corbett, and Lee McCracken.
section_title: Related GAO Products
paragraphs: Cybersecurity: Continued Attention Needed to Protect Our Nation’s  Critical Infrastructure and Federal Information Systems. GAO-11-463T.  Washington, D.C.: March 16, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  2011.
Electricity Grid Modernization: Progress Being Made on Cybersecurity  Guidelines, but Key Challenges Remain to be Addressed. GAO-11-117.  Washington, D.C.: January 12, 2011.
Information Security: Federal Agencies Have Taken Steps to Secure  Wireless Networks, but Further Actions Can Mitigate Risk. GAO-11-43.  Washington, D.C.: November 30, 2010.
Cyberspace Policy: Executive Branch Is Making Progress Implementing  2009 Policy Review Recommendations, but Sustained Leadership Is  Needed. GAO-11-24. Washington, D.C.: October 6, 2010.
Information Security: Progress Made on Harmonizing Policies and  Guidance for National Security and Non-National Security Systems.  GAO-10-916. Washington, D.C.: September 15, 2010.
Information Management: Challenges in Federal Agencies’ Use of Web  2.0 Technologies. GAO-10-872T. Washington, D.C.: July 22, 2010.
Critical Infrastructure Protection: Key Private and Public Cyber  Expectations Need to Be Consistently Addressed. GAO-10-628.  Washington, D.C.: July 15, 2010.
Cyberspace: United States Faces Challenges in Addressing Global  Cybersecurity and Governance. GAO-10-606. Washington, D.C.: July 2,  2010.
Cybersecurity: Continued Attention Is Needed to Protect Federal  Information Systems from Evolving Threats. GAO-10-834T. Washington,  D.C.: June 16, 2010.
Cybersecurity: Key Challenges Need to Be Addressed to Improve  Research and Development. GAO-10-466. Washington, D.C.: June 3,  2010.
Information Security: Federal Guidance Needed to Address Control  Issues with Implementing Cloud Computing. GAO-10-513. Washington,  D.C.: May 27, 2010.
Cybersecurity: Progress Made but Challenges Remain in Defining and  Coordinating the Comprehensive National Initiative. GAO-10-338.  Washington, D.C.: March 5, 2010.
Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington,  D.C.: September 9, 2008.
Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.