Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed
Published: 2010-07-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pervasive and sustained computer-based attacks pose a potentially devastating impact to systems and operations and the critical infrastructures they support. Addressing these threats depends on effective partnerships between the government and private sector owners and operators of critical infrastructure. Federal policy, including the Department of Homeland Security's (DHS) National Infrastructure Protection Plan, calls for a partnership model that includes public and private councils to coordinate policy and information sharing and analysis centers to gather and disseminate information on threats to physical and cyber-related infrastructure. GAO was asked to determine (1) private sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met and (2) public sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met. To do this, GAO conducted surveys and interviews of public and private sector officials and analyzed relevant policies and other documents.
section_title: What GAO Found
paragraphs: Private sector stakeholders reported that they expect their federal partners to provide usable, timely, and actionable cyber threat information and alerts; access to sensitive or classified information; a secure mechanism for sharing information; security clearances; and a single centralized government cybersecurity organization to coordinate government efforts. However, according to private sector stakeholders, federal partners are not consistently meeting these expectations. For example, less than one-third of private sector respondents reported that they were receiving actionable cyber threat information and alerts to a great or moderate extent. Federal partners are taking steps that may address the key expectations of the private sector, including developing new information-sharing arrangements. However, while the ongoing efforts may address the public sector's ability to meet the private sector's expectations, much work remains to fully implement improved information sharing. Public sector stakeholders reported that they expect the private sector to provide a commitment to execute plans and recommendations, timely and actionable cyber threat information and alerts, and appropriate staff and resources. Four of the five public sector councils that GAO held structured interviews with reported that their respective private sector partners are committed to executing plans and recommendations and providing timely and actionable information. However, public sector council officials stated that improvements could be made to the partnership, including improving private sector sharing of sensitive information. Some private sector stakeholders do not want to share their proprietary information with the federal government for fear of public disclosure and potential loss of market share, among other reasons. Without improvements in meeting private and public sector expectations, the partnerships will remain less than optimal, and there is a risk that owners of critical infrastructure will not have the information necessary to thwart cyber attacks that could have catastrophic effects on our nation's cyber-reliant critical infrastructure.
section_title: What GAO Recommends
paragraphs: GAO recommends that the national Cybersecurity Coordinator and DHS work with their federal and private sector partners to enhance information-sharing efforts. The national Cybersecurity Coordinator provided no comments on a draft of this report. DHS concurred with GAO's recommendations.

section_title: Letter
paragraphs: Recent cyber attacks on corporations of the United States and federal  agencies highlight the threats posed by the worldwide connection of our  networks. Because the private sector owns most of the nation’s critical  infrastructure—such as banking and financial institutions,  telecommunications networks, and energy production and transmission  facilities—it is vital that the public and private sectors form effective  partnerships to successfully protect these cyber-reliant critical assets from  a multitude of threats including terrorists, criminals, and hostile nations.
Federal policy establishes various mechanisms for the development of  public-private partnerships. The National Infrastructure Protection Plan  (NIPP) describes a partnership model as the primary means of  coordinating government and private sector efforts to protect critical  infrastructure. For each sector, the model requires formation of  government coordinating councils (government councils)—composed of  federal, state, local, or tribal agencies with purview over critical sectors— and encourages voluntary formation of sector coordinating councils  (sector councils)—composed of owner-operators of these critical assets  (some of which may be state or local agencies) or their respective trade  associations. These councils create the structure through which  representative groups from all levels of government and the private sector  are to collaborate in planning and implementing efforts to protect critical  infrastructure. The sector councils are envisioned to be policy-related and  to represent a primary point of contact for government to plan the entire  range of infrastructure protection activities, including those associated  with mitigating cyber threats. The councils’ functions are distinct from  those of the private sector information-sharing and analysis centers (ISAC)  that were established to serve an operational role such as providing  mechanisms for gathering, analyzing, and disseminating information on  physical and cyber-related infrastructure threats and vulnerabilities to and  from private infrastructure sectors and the government.
Our objectives were to determine (1) private sector stakeholders’  expectations for cyber-related, public-private partnerships and to what  extent these expectations are being met and (2) public sector  stakeholders’ expectations for cyber-related, public-private partnerships  and to what extent these expectations are being met.
To determine private sector expectations and to what extent these  expectations are being met, we collected and analyzed documents related  to the formation of public-private partnerships and their actions,  conducted structured interviews, and surveyed 56 private sector  representatives from the following cyber-reliant critical infrastructure  sectors: (1) banking and finance, (2) communications, (3) defense  industrial base (DIB), (4) energy, and (5) information technology (IT). The  surveyed representatives were members of the ISACs and sector councils  and were solicited by the leadership of those organizations to participate  in our survey. To determine public sector stakeholders’ expectations for  cyber-related, public-private partnerships and to what extent these  expectations are being met, we collected and analyzed various documents  and conducted structured interviews with government councils’  representatives associated with the same cyber-reliant critical sectors  mentioned above. We also interviewed several additional individuals with  specialized expertise in the cyber-critical infrastructure protection public- private partnership model. Our findings and conclusions are based on  information gathered from the five cyber-reliant critical sectors and are  not generalizable to a larger population. Further details of our objectives,  scope, and methodology are provided in appendix I.
We conducted this performance audit from June 2009 to July 2010, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: Public and private organizations rely on computer systems to transfer  increasing amounts of money; sensitive, proprietary economic and  commercial information; and classified and sensitive but unclassified  defense and intelligence information. The increased transfer of critical  information increases the risk that malicious individuals will attempt to  disrupt or disable our nation’s critical infrastructures and obtain sensitive  and critical information for malicious purposes. To address the threats to  the nation’s cyber-reliant critical infrastructure, federal policy emphasizes  the importance of public-private coordination.
subsections: section_title: Cyber Threats and Incidents Adversely Affect the Nation’s Critical Infrastructure
paragraphs: Different types of cyber threats from numerous sources may adversely  affect computers, software, a network, an agency’s operations, an  industry, or the Internet itself. Cyber threats can be unintentional or  intentional. Unintentional threats can be caused by software upgrades or  maintenance procedures that inadvertently disrupt systems. Intentional  threats include both targeted and untargeted attacks. Attacks can come  from a variety of sources, including criminal groups, hackers, and  terrorists. Table 1 lists sources of threats that have been identified by the  U.S. intelligence community and others.
Different types of cyber threats can use various cyber exploits that may  adversely affect computers, software, a network, an agency’s operations,  an industry, or the Internet itself (see table 2). Groups or individuals may  intentionally deploy cyber exploits targeting a specific cyber asset or  attack through the Internet using a virus, worm, or malware with no  specific target.
Recent reports of cyber attacks illustrate that such attacks could have a  debilitating impact on national and economic security and on public health  and safety.
In May 2007, Estonia was the reported target of a denial-of-service cyber  attack with national consequences. The coordinated attack created mass  outages of its government and commercial Web sites.
In March 2008, the Department of Defense (DOD) reported that, in 2007,  computer networks operated by the department, other federal agencies,  and defense-related think tanks and contractors were targets of computer  network intrusion. Although those responsible were not definitively  identified, the attacks appeared to have originated in China.
In January 2010, it was reported that at least 30 technology companies— most in Silicon Valley, California—were victims of intrusions. The cyber  attackers gained unauthorized access to files that may have included the  companies’ computer security systems, crucial corporate data, and  software source code.
In January 2010, a California-based company filed suit alleging that two  Chinese companies stole software code and then distributed it to tens of  millions of end users as part of Chinese government-sponsored filtering  software. The company is seeking more than $2.2 billion dollars. Academic  researchers found that portions of the company’s software code had been  copied and used in initial versions of the Chinese software.
Based on an 8-month investigation, researchers reported that computer  systems in India were attacked. The suspected cyberattackers remotely  connected to Indian computers using social networks to install bot- networks that infiltrated and infected Indian computers with malware. The  incidents were reported to have been traced back to an underground  espionage organization that was able to steal sensitive national security  and defense information.
section_title: Critical Infrastructure Protection Policy Emphasizes Private and Public Sector Coordination
paragraphs: Federal law and policy call for critical infrastructure protection activities  that are intended to enhance the cyber and physical security of both the  public and private infrastructures that are essential to national security,  national economic security, and national public health and safety. Federal  policies address the importance of coordination between the government  and the private sector to protect the nation’s computer-reliant critical  infrastructure. These policies establish critical infrastructure sectors,  assign agencies to each sector (sector lead agencies), and encourage  private sector involvement. For example, the Department of the Treasury  is responsible for the banking and finance sector, while the Department of  Energy (DOE) is responsible for the energy sector. Table 3 lists agencies  and their assigned sector.
In May 1998, Presidential Decision Directive 63 (PDD-63) established  critical infrastructure protection (CIP) as a national goal and presented a  strategy for cooperative efforts by the government and the private sector  to protect the physical and cyber-based systems essential to the minimum  operations of the economy and the government. Among other things, this  directive encouraged the development of ISACs to serve as mechanisms  for gathering, analyzing, and disseminating information on cyber  infrastructure threats and vulnerabilities to and from owners and  operators of the sectors and the federal government. For example, the  Financial Services, Electricity Sector, IT, and Communications ISACs  represent sectors or subcomponents of sectors. However, not all sectors  have ISACs. For example, according to private sector officials, the DIB  sector and the subcomponents of the energy sector, besides electricity, do  not have established ISACs.
The Homeland Security Act of 2002 created the Department of Homeland  Security (DHS). In addition, among other things, it assigned the  department the following CIP responsibilities: (1) developing a  comprehensive national plan for securing the key resources and critical  infrastructures of the United States; (2) recommending measures to  protect the key resources and critical infrastructures of the United States  in coordination with other groups; and (3) disseminating, as appropriate,  information to assist in the deterrence, prevention, and preemption of or  response to terrorist attacks.
In 2003, The National Strategy to Secure Cyberspace was issued, which  assigned DHS multiple leadership roles and responsibilities in this CIP  area. They include (1) developing a comprehensive national plan for CIP,  including cybersecurity; (2) developing and enhancing national cyber  analysis and warning capabilities; (3) providing and coordinating incident  response and recovery planning, including conducting incident response  exercises; (4) identifying, assessing, and supporting efforts to reduce cyber  threats and vulnerabilities, including those associated with infrastructure  control systems; and (5) strengthening international cyberspace security.
PDD-63 was superseded in December 2003 when Homeland Security  Presidential Directive 7 (HSPD-7) was issued. HSPD-7 defined additional  responsibilities for DHS, federal agencies focused on specific critical  infrastructure sectors (sector-specific agencies), and other departments  and agencies. HSPD-7 instructs these sector-specific agencies to identify,  prioritize, and coordinate the protection of critical infrastructure to  prevent, deter, and mitigate the effects of attacks. HSPD-7 makes DHS  responsible for, among other things, coordinating national CIP efforts and  establishing uniform policies, approaches, guidelines, and methodologies  for integrating federal infrastructure protection and risk management  activities within and across sectors.
As part of its implementation of the cyberspace strategy and other  requirements to establish cyber analysis and warning capabilities for the  nation, DHS established the United States Computer Emergency  Readiness Team (US-CERT) to help protect the nation’s information  infrastructure. US-CERT is the focal point for the government’s interaction  with federal and private-sector entities 24-hours-a-day, 7-days-a-week, and  provides cyber-related analysis, warning, information-sharing, major  incident response, and national-level recovery efforts. It is charged with  aggregating and disseminating cybersecurity information to improve  warning of and response to incidents, increasing coordination of response  information, reducing vulnerabilities, and enhancing prevention and  protection. In addition, the organization is to collect incident reports from  all federal agencies and assist agencies in their incident response efforts. It  is also to accept incident reports when voluntarily submitted by other  public and private entities and assist them in their response efforts, as  requested.
In addition, as part of its responsibilities, DHS first issued the NIPP in 2006  and then updated it in 2009. The NIPP is intended to provide the  framework for a coordinated national approach to address the full range  of physical, cyber, and human threats and vulnerabilities that pose risks to  the nation’s critical infrastructure. The NIPP relies on a sector partnership  model as the primary means of coordinating government and private  sector CIP efforts. Under this model, each sector has both a government  council and a private sector council to address sector-specific planning  and coordination. The government and private sector councils are to work  in tandem to create the context, framework, and support for coordination  and information-sharing activities required to implement and sustain that  sector’s CIP efforts. The council framework allows for the involvement of  representatives from all levels of government and the private sector, so  that collaboration and information-sharing can occur to assess events  accurately, formulate risk assessments, and determine appropriate  protective measures.
The government councils are to coordinate strategies, activities, policies,  and communications across government entities within each sector. Each  government council is to be composed of representatives from various  levels of government (i.e., federal, state, local, and tribal) as appropriate to  the security needs of each individual sector. In addition, a representative  from the sector-specific agency is to chair the council and is to provide  cross-sector coordination with each of the member governments. For  example, DOE in its role as the sector-specific agency for the energy  sector has established and chairs a government council.
The establishment of private sector councils (sector councils) is  encouraged under the NIPP model, and these councils are to be the  principal entities for coordinating with the government on a wide range of  CIP activities and issues. Under the model, critical asset owners and  operators are encouraged to be involved in the creation of sector councils  that are self-organized, self-run, and self-governed, with a spokesperson  designated by the sector membership. Specific membership can vary from  sector to sector but should be representative of a broad base of owners,  operators, associations, and other entities—both large and small—within  the sector. For example, the banking and finance sector has established  the Financial Services Sector Coordinating Council for Critical  Infrastructure Protection and Homeland Security, which is made up of  over 40 entities, including banks, insurance companies, and industry  associations.
Most recently, the White House issued the Cyberspace Policy Review that,  among other things, recommended that the White House appoint a  cybersecurity policy official for coordinating the nation’s cybersecurity  policies and activities. Subsequently, in December 2009, the President  appointed a Special Assistant to the President and Cybersecurity  Coordinator, referred to as the Cybersecurity Coordinator in this report, to  be the central coordinator of federal government cybersecurity-related  activities.
Using the NIPP partnership model, the private and public sectors  coordinate to manage the risks related to cyber CIP. This coordination  includes sharing information, conducting exercises, and providing  resources.
Sharing information. Information sharing enables both government and  private sector partners to assess events accurately, formulate risk  assessments, and determine appropriate courses of action. This includes  sharing information on cyber threats and vulnerabilities, providing alerts  or warnings about such threats, and recommending mitigation steps.
Conducting exercises. Building and maintaining organizational and sector  expertise requires comprehensive exercises to test the interaction  between stakeholders in the context of serious cyber attacks, terrorist  incidents, natural disasters, and other emergencies. Exercises are  conducted by private sector owners and operators, and across all levels of  government.
Providing resources. Maximizing the efficient use of resources is a key  part of protecting the nation’s critical infrastructure. This includes  providing technical and policy expertise, training, commitment of people,  and financial aid through grants.
section_title: Previous GAO Work Made Recommendations to DHS and Identified Best Practices to Improve Public-Private Partnerships
paragraphs: Over the last several years, we have reported and made recommendations  regarding various aspects of cyber CIP, including identifying information- sharing practices and bolstering the public-private partnership. In 2001, we  identified the information-sharing practices of leading organizations and  the factors they deemed critical to their success in building successful  information-sharing relationships. All of the organizations identified trust  as the essential underlying element to successful relationships and said  that trust could be built only over time and, primarily, through personal  relationships. Other critical success factors identified included  (1) establishing effective and appropriately secure communication  mechanisms, such as regular meetings and secure Web sites; (2) obtaining  the support of senior managers at member organizations regarding the  sharing of potentially sensitive member information and the commitment  of resources; and (3) ensuring organizational leadership continuity. In  addition, to be successful, information-sharing organizations provided  identifiable membership benefits, such as current information about  threats, vulnerabilities, and incidents. Without such benefits, according to  the representatives we met with, members would not continue  participating.
Over the last several years, we have also made about 30 recommendations  in key cybersecurity areas to help bolster private-public partnerships. In  2008, we reported on US-CERT and found that it faced a number of  challenges that impeded it from fully implementing a cyber analysis and  warning capability and thus being able to coordinate the national efforts to  prepare for, prevent, and respond to cyber threats. The challenges  included creating warnings that are consistently actionable and timely and  employing predictive analysis. We made 10 recommendations to DHS to  improve the department’s cyber analysis and warning capabilities. These  included, among others, addressing deficiencies in its monitoring efforts,  including establishing a comprehensive baseline understanding of the  nation’s critical information infrastructure and engaging appropriate  private-sector stakeholders to support a national-level cyber monitoring  capability. We also recommended that DHS address the challenges that  impeded it in fully implementing cyber analysis and warning, including  developing close working relationships with federal and private-sector  entities to allow the free flow of information and ensuring consistent  notifications that are actionable and timely. DHS agreed with most of  these recommendations and initiated related actions.
In 2007 and 2009, we determined the extent to which sector plans for CIP  fully addressed DHS’s cyber security requirements and assessed whether  these plans and related reports provided for effective implementation.  We found, among other things, that although DHS reported many efforts  under way and planned to improve the cyber content of sector-specific  plans, sector-specific agencies had yet to update their respective sector- specific plans to fully address key DHS cybersecurity criteria. The lack of  complete updates and progress reports was further evidence that the  sector planning process had not been effective, thus leaving the nation in  the position of not knowing precisely where it stands in securing cyber- critical infrastructures. Not following up to address these conditions also  showed DHS was not making sector planning a priority. We recommend that DHS assess whether the existing sector-specific planning process  should continue to be the nation’s approach to securing cyber and other  ed  critical infrastructure and, if so, make the process an agency priority and  manage it accordingly. DHS concurred with the recommendations. In  addition, due to concerns about DHS’s efforts to fully implement its CIP  responsibilities, as well as known security risks to critical infrastructu re  systems, we added cyber CIP as part of our federal IT systems security  high-risk area in 2003 and have continued to report on its status s time.
Most recently, we testified in 2009 on the results of expert panels that  identified the importance of bolstering public-private partnershi discussions with us, the panel identified 12 key areas requiring  improvement. One of the key strategies was to bolster public-private  partnerships by providing adequate economic and other incentives for  greater investment and partnering in cybersecurity.
section_title: Private Sector Stakeholders Ex Information on Threats, Alerts, and Other Related Services but Believe Federal Partners A Not Consistently Providing
paragraphs: Private sector stakeholders reported that they expect their federal  partners to provide usable, timely, and actionable cyber threat information  and alerts, access to sensitive or classified information, a secure  mechanism for sharing information, security clearances, and a single  centralized government cybersecurity organization to coordinate federal  efforts. Some other services were less important, such as penetration  testing of networks and financial support. Table 4 summarizes the extent  to which the 56 private sector survey respondents expect to receive  certain services from the federal government in order of most to least  expected.
The two most expected services private sector stakeholders want from  their federal partners are timely and actionable cyber threat and alert  information—providing the right information to the right persons or  groups as early as possible to give them time to take appropriate action.  The percentages of private sector survey respondents reporting that they  expect timely and actionable cyber threat and alert information to a great  or moderate extent were 98 and 96, respectively. Private sector council  representatives stated that they expect their federal partners to provide  timely and actionable intelligence on cyber-related issues that they can  share within their membership. For example, one private sector official  told us that time is of the essence when passing information to their  members and that sector members expect to get a response within  minutes so they can take appropriate actions as soon as possible.
Private sector stakeholders also identified access to sensitive government  information, a secure information-sharing mechanism, and obtaining  security clearances as key expectations. The percentages of survey  respondents reporting that they expect these services to a great or  moderate extent were 87, 78, and 74, respectively. Private sector officials  stated that they need access to greater amounts of sensitive and classified  government information. However, a private sector official indicated that  access to classified information is not valuable because it can not be  shared. This official stated that they would prefer information that is  unclassified and actionable that can be shared. A private sector council  member stated that their federal partners take too long to vet sensitive  cyber information before private sector partners can receive and share it.
In addition, private sector officials and cyber experts stated that having a  single or centralized government source for cyber-related information is  important to (1) avoid confusion about who is the authoritative source,  (2) have a consistent message communicated, and (3) coordinate a  national response. Similarly, in March 2009, we testified that a panel of  cyber security experts identified that creating an accountable, operational  cybersecurity organization would be essential to improving our national  cybersecurity posture. The experts told us that there needs to be an  independent cybersecurity organization that leverages and integrates the  capabilities of the private sector, civilian government, law enforcement,  the military, the intelligence community, and the nation’s international  allies to address incidents against the nation’s critical cyber systems and  functions.
Conversely, private sector survey respondents stated that they expect  some services to a lesser extent from their federal partners, including  policy expertise, financial support, and penetration testing of their  networks. The percentages of survey respondents reporting that they  expect these services to a great or moderate extent were only 29, 26, and  25, respectively. In addition, government officials stated that having the  government perform penetration testing could be construed as  inappropriate by private entities and their customers whose information is  stored on those systems.
subsections: section_title: Private Sector Stakeholders Believe That Critical Expectations Are Not Being Fully Met, Despite Federal Efforts
paragraphs: Federal partners are not consistently meeting private sector expectations,  including providing timely and actionable cyber threat information and  alerts, according to private sector stakeholders. Table 5 illustrates the  degree to which the 56 private sector survey respondents reported that  they are receiving services from the public sector in order of most to least  expected. For example, only 27 percent of private sector survey  respondents reported that they were receiving timely and actionable cyber  threat information and alerts to a great or moderate extent. In addition,  ISAC officials stated that the federal partners are not providing enough  cyber threat information that is tailored to their sector’s needs or  analytical alert information that provides the tactics and techniques being  used by cyber threats. According to these ISAC officials, this more specific  information is needed to understand what actions will likely protect their  networks. Another private sector council official said that a lot of the  information they receive does not have enough detail to be useful.
Private sector stakeholders also reported a lack of access to classified  information, a secure information-sharing mechanism, security clearances,  and a single centralized government cyber-information source. Private  sector survey respondents reported receiving access to actionable  classified information, having access to a secure information sharing  mechanism, and having adequate security clearances to a great or  moderate extent at only 16, 21, and 33 percent, respectively. The private  sector councils reported that they are not getting classified intelligence  information that they perceive as being valuable to their efforts to defend  their cyber resources from sophisticated attacks and that they do not have  enough members with security clearances to receive classified  information. Regarding the lack of a centralized source, an ISAC official  stated that too many Internet-based information-sharing portals exist in  the current cyber-related, public-private partnership and that the  partnership could benefit from a “one-stop” portal. Another official  suggested that one federal agency should be the clearing house for  information and assigning tasks because there are too many government  agencies working independently with their own unique missions. Further,  a sector council official stated that there is too much duplication of  projects and that it is not uncommon to work with six different groups  doing almost the same thing and that these groups are not always aware of  each other.
Federal partners are not meeting private sector stakeholders’  expectations, in part, because of restrictions on the type of information  that can be shared with the private sector. According to DHS officials, US- CERT’s ability to provide information is impacted by restrictions that do  not allow individualized treatment of one private sector entity over  another private sector entity—making it difficult to formally share specific  information with entities that are being directly impacted by a cyber  threat. In addition, because US-CERT serves as the nation’s cyber analysis  and warning center, it must ensure that its warnings are accurate.  Therefore, US-CERT’s products are subjected to a stringent review and  revision process that can adversely affect the timeliness of its products— potentially adding days to the release if classified or law enforcement  information must be removed from the product. In addition, federal  officials are restricted to sharing classified information with only cleared  private sector officials. Federal officials are also hesitant to share sensitive  information with private sector stakeholders, in part, due to the fear that  sensitive information shared with corporations could be shared openly on  a global basis. By contrast, DOE officials stated that they are willing to  share sensitive information with their energy sector member entities due  to the long-standing nature of their relationships with the sector and the  type of information being shared. In addition, according to federal  officials, the limited number of private sector personnel with national  security clearances makes it difficult to share classified information.
Another issue having an adverse affect on the federal partners’ ability to  meet private sector expectations is that federal officials do not have an  adequate understanding of the specific private sector information  requirements. Multiple private sector officials stated that federal partners  could improve their methods of acquiring the type of information needed  by the private sector. For example, more specific threat information would  be focused on the technology being used by a particular entity or specify  that a threat intends to target a particular entity, rather than including just  broad threat information and alerts. In addition, this more specific  information would focus on the specific needs for each sector rather than  all of the sectors getting the same information. A private sector official  also stated that the federal government often approaches the private  sector on issues that are not a priority to the private sector but are issues  the federal government thinks the private sector is interested in. Further, a  cyber expert suggested that the partnership can improve if the government  articulates what it needs from the private sector and assists the critical  infrastructure sectors in understanding the direct benefit of their  participation.
DOD and DHS have started pilot programs that are intended to improve  the sharing of timely, actionable, and sensitive information with their  private sector partners. Specifically, DOD’s Defense Critical Infrastructure  Program has a pilot program with some of its private sector DIB  contractors to improve sharing of information on cyber threat, alerts, and  sensitive data by establishing a new partnership model. This new program  is known as the DIB Cyber Security/Information Assurance Program and is  to facilitate the sharing of sensitive cyber information between the public  and private sector. According to an agency official, this program involves a  voluntary agreement between DOD and cleared DIB partners. DOD shares  classified and unclassified cyber threat information and best practices. In  return, the private sector partners agree to share cyber intrusion  information with the DOD Cyber Crime Center, which is to serve as the  focal point for information-sharing and digital forensics analysis activities  related to protecting unclassified information on DIB information systems  and networks. DOD’s goal is to transition from pilot to program status and  expand the program to all qualified cleared contractors. In addition, the  officials stated that they expect to eventually modify DOD contractual  language to encourage contractors to increase cybersecurity in their  networks.
In addition, DHS, in conjunction with DOD and the financial services  sector, has developed an information sharing pilot program which began  in December 2009. To date, this program has resulted in the federal  government sharing 494 of its products, including sensitive information,  with the Financial Services ISAC, and the Financial Services ISAC sharing  135 of its products with the government. According to DHS officials, DHS  and the Financial Services ISAC are sharing sensitive information they did  not share before the agreement. Both of these pilot programs are intended  to improve federal partners’ ability to share information over a secure  mechanism. For example, DHS is using its US-CERT portal, and DOD is  developing a DIB Net to communicate with its partners.
DHS and DOE have initiatives that specifically address sharing classified  information with their partners. DHS officials stated that DHS has a  process for clearing individual sector officials at the top secret and  sensitive compartmented information levels. Further, in November 2009,  DHS issued the Cybersecurity Partner Local Access Plan to improve the  sharing of sensitive information between the public and private sectors.  According to DOE officials, DOE also has an effort under way to increase  the number of private officials from the energy sector with security  clearances.
DHS has recently developed an integration center known as the National  Cybersecurity and Communications Integration Center that is composed  of the US-CERT and the National Coordinating Center for  Telecommunications. This center is to provide a central place for the  various federal and private-sector organizations to coordinate efforts to  address cyber threats and to respond to cyber attacks. However, this  center was only established in October 2009, is still in development, and  does not currently have representation from all relevant federal agencies  and private entities as envisioned. In addition, DHS officials stated that  they have taken steps to improve US-CERT’s cyber analysis and warning  capabilities in response to our previous recommendations.
While the ongoing efforts may address the public sector’s ability to meet  the private sector’s expectations, much work remains, and it is unclear if  the efforts will focus on fulfilling the private sector’s most expected  services related to information-sharing. If the government does not  improve its ability to meet the private sector’s expectations, the  partnerships will remain less than optimal, and the private sector  stakeholders may not have the appropriate information and mechanisms  needed to thwart sophisticated cyber attacks that could have catastrophic  effects on our nation’s cyber-reliant critical infrastructure.
section_title: Public Sector Stakeholders Expect Threat Information and Commitment, Which the Private Sector Is Generally Providing
paragraphs: Public sector stakeholders reported that they expect the private sector to  provide a commitment to execute plans and recommendations, timely and  actionable cyber threat information, and appropriate staff and resources.  Four of the five government councils reported that the private sector is  committed to executing plans and recommendations and providing timely  and actionable threat information to a “great” or “moderate” extent.  However, government council officials stated that improvements could be  made to the partnership.
subsections: section_title: Public Sector Stakeholders Expect Usable Threat Information, Commitment, and Appropriate Staff and Resources
paragraphs: Public sector stakeholders reported that they expect a commitment to  execute plans and recommendations, timely and actionable cyber threat  information, and appropriate staff and resources to be provided by private  sector stakeholders. All five government councils we met with stated that  they expected these services from their private sector partners to a “great”  or “moderate” extent.
Further, most government council representatives stated that they expect  better communications and increasing trust between them and their  private sector counterparts. For example, they would like the private  sector to develop a strong dialogue with the government and keep the  government informed about suspicious activities on private sector  networks. Table 6 shows the government councils’ expected services.
section_title: Private Sector Is Primarily Meeting Several Public Sector Expectations, but Some Gaps Exist
paragraphs: While many government councils reported that the private sector is mostly  meeting their expectations in several areas, they also reported that  improvements could be made. Four of the five government councils stated  that they are receiving commitment to execute plans and  recommendations and timely and actionable cyber threat information to a  great or moderate extent. However, only two of the five government  councils reported that the private sector is providing appropriate staff and  resources. In addition, the extent to which the private sector is fulfilling  the public sector’s expectations varies by sector. Of the five councils, the  communications government council reported most positively on whether  the private sector was providing expected services. Specifically, it  reported that its private sector partners were providing 8 of 10 expected  services to a great or moderate extent. By contrast, the IT sector council  reported that the private sector was providing only 1 of 10 expected  services to a great or moderate extent and 5 of 10 expected services to  only some extent. Table 7 shows the extent to which the private sector is  providing government councils’ expected services.
Although, in general, the private sector is meeting the expectations of the  federal partners, there are still improvements that can be made. For  example, while the government coordinating councils reported receiving  timely and actionable cyber threat and alert information from the private  sector, there are limits to the depth and specificity of the information  provided, according to federal officials. One issue is that private sector  stakeholders do not want to share their sensitive, proprietary information  with the federal government. In addition, information security companies  could lose a competitive advantage by sharing information with the  government which, in turn, could share it with those companies’  competitors. In addition, according to DHS officials, despite special  protections and sanitization processes, private sector stakeholders are  unwilling to agree to all of the terms that the federal government or a  government agency requires to share certain information. Further, in some  cases, the lack of private sector commitment has had an adverse affect on  the partnership.
section_title: Conclusions
paragraphs: The private-public partnership remains a key part of our nation’s efforts to  secure and protect its critical cyber-reliant infrastructure. For more than a  decade, this private-public partnership has been evolving. While both  private and public sector stakeholders report finding value in the  partnership, the degree to which expectations are being met varies. Private  sector stakeholders expect their federal partners to consistently provide  usable, timely, actionable cyber threat information and alerts and, to a  lesser extent, other related services. However, private sector stakeholders  are not consistently receiving their expected services from their federal  partners because, in part, federal partners are restricted in the type of  information that can be shared with the private sector and lack an  understanding about each sector’s specific information requirements. In  addition, many private sector stakeholders interact with multiple federal  entities and multiple information sources, which can result in duplication  of efforts and inconsistent information being shared.
In turn, federal partners primarily expect their private sector partners to  provide commitment to execute plans and recommendations, timely and  actionable cyber threat and alert information, and appropriate staff and  resources, which the private sector is primarily providing; however, while  most federal partners stated that these expectations are mostly being met,  they identified difficulties with the private sector sharing their sensitive  information and the need for private sector partners to improve their  willingness to engage and provide support to partnership efforts. Federal  and private sector partners have initiated efforts to improve the  partnerships; however, much work remains to fully implement improved  information sharing. Without improvements in meeting private and public  sector expectations, the partnerships will remain less than optimal, and  there is a risk that owners of critical infrastructure will not have the  appropriate information and mechanisms to thwart sophisticated cyber  attacks that could have catastrophic effects on our nation’s cyber-reliant  critical infrastructure.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Special Assistant to the President and  Cybersecurity Coordinator and the Secretary of Homeland Security, in  collaboration with the sector lead agencies, coordinating councils, and the  owners and operators of the associated five critical infrastructure sectors,  take two actions: (1) use the results of this report to focus their  information-sharing efforts, including their relevant pilot projects, on the  most desired services, including providing timely and actionable threat  and alert information, access to sensitive or classified information, a  secure mechanism for sharing information, and providing security  clearance and (2) bolster the efforts to build out the National  Cybersecurity and Communications Integration Center as the central focal  point for leveraging and integrating the capabilities of the private sector,  civilian government, law enforcement, the military, and the intelligence  community.
We are not making new recommendations regarding cyber-related analysis  and warning at this time because our previous recommendations directed  to DHS, the central focal point for such activity, in these areas have not yet  been fully implemented.
section_title: Agency Comments and Our Evaluation
paragraphs: The national Cybersecurity Coordinator provided no comments on a draft  of our report. DHS provided written comments on a draft of the report  (see app. II), signed by DHS’s Director of the Departmental GAO/OIG  Liaison Office. In its comments, DHS concurred with our  recommendations and described steps underway to address them.  Regarding our first recommendation, DHS provided an additional example  of and further detail about several pilot programs it has initiated to enable  the mutual sharing of cybersecurity information at various classification  levels. In addition, regarding our second recommendation, DHS stated that  it is integrating government components and private sector partners into  its National Cybersecurity and Communications Integration Center.
DHS also provided general comments. First, DHS noted that it is important  to distinguish between actionable information and classified, contextual  threat information. Specifically, DHS stated that sharing classified  information with the private sector can pose a risk to national security  and, consequently, such information is generally non-actionable. While we  found that the private-sector stakeholders we surveyed and interviewed  expect such information, we do not state that the federal government  should share classified information with uncleared individuals. We  distinguish in this report between sharing timely and actionable threat and  alert information and providing access to classified information. In  addition, we discuss US-CERT’s review and revision process and identify  DHS, DOD, and DOE efforts to provide clearances to private sector  partners in order to share such information.
Second, DHS stated that the report makes generalizations about private- sector stakeholders which could be seen to suggest that such views were  held across the entire cross-sector community. We acknowledge that our  findings cannot be generalized across the sectors and clearly articulate  that the scope of our review is limited to representatives from five critical  infrastructure sectors.
Third, DHS also stated that the report focuses on surveyed participants  “expectations,” while the survey itself focused on “needs.” DHS further  stated that these two terms are not interchangeable for the concept of  information sharing. During our review, we held numerous structured  interviews with private and government stakeholders and surveyed  private-sector stakeholders and asked separate questions on their  expectations and needs. We acknowledge that the terms are not  interchangeable and therefore appropriately reported on and distinguished  both private and public sectors’ expectations and needs.
Finally, DHS provided comments on the progress it has made in its sector  planning approach and its clearance process.
DHS and DOD also provided technical comments, which we incorporated  as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to interested  congressional committees, the national Cybersecurity Coordinator, the  Secretary of Homeland Security, and other interested parties. The report  also is available at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. GAO staff who made major contributions to this  report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine (1) private sector stakeholders’  expectations for cyber-related, public-private partnerships and to what  extent these expectations are being met and (2) public sector  stakeholders’ expectations for cyber-related public-private partnerships  and to what extent expectations are being met. We focused our efforts on  five critical infrastructure sectors: Communications, Defense Industrial  Base, Energy, Banking and Finance, and Information Technology. We  selected these five sectors because of their extensive reliance on cyber- based assets to support their operations. This determination was based on  our analysis and interviews with cybersecurity experts and agency  officials. Our findings and conclusions are based on information gathered  from the five cyber-reliant critical sectors and are not generalizable to a  larger population.
To determine private sector stakeho public-private partnerships and to what extent these expectations are  being met, we collected and analyzed various government and private  sector reports and conducted structured interviews with sector  coordinating councils representatives from the five critical infrastructure  sectors. In addition, we interviewed additional experts in critical  infrastructure protection from academia and information technology and  security companies to gain a greater understanding of how the partnership  should be working. We also interviewed representatives from the  Communications, Electricity Sector, Financial Services, Information  Technology, and Multi-State Information Sharing and Analysis Centers to  understand their information-sharing needs. Finally, we conducted a  survey of private sector representatives from the infrastructure sectors.  The surveyed representatives were members of the information sharing  and analysis centers, sector coordinating councils, associations within a  sector, and/or owner/operators within a sector. These surveyed  representatives were solicited by the leadership of those organizations to  participate in our survey in order for them to fulfill their responsibility to  protect the identity of their members. We administered the survey  respondents’ use of the electronic survey tool. We received 56 survey  responses from across the five sectors. The survey results were used to  determine the expectations of private sector stakeholders and the extent  to which those expectations were being met.  lders’ expectations for cyber-related  To determine public sector stakeholders’ expectations for cyber-related  public-private partnerships and to what extent these expectations are  being met, we collected and analyzed various government and private  sector reports and conducted structured interviews with government  coordinating councils representatives familiar with the cyber partnership  from the Banking and Finance, Communications, Defense Industri Energy, and Information Technology critical infrastructure sectors. We  also met with representatives from DHS’s National Cyber Security Division  and Office of Infrastructure Protection to verify and understand the public  sector’s role in partnering with the private sector and encouraging the  protection of the nation’s cyber critical infrastructure.
We conducted this performance audit from June 2009 to July 2010 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Michael W. Gilmore, Assistant  Director; Rebecca E. Eyler; Wilfred B. Holloway; Franklin D. Jackson;  Barbarol J. James; Lee A. McCracken; Dana R. Pon; Carl M. Ramirez;  Jerome T. Sandau; Adam Vodraska; and Eric D. Winter made key  contributions to this report.