Information Security: Cyber Threats and Vulnerabilities Place Federal Systems at Risk
Published: 2009-05-05T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where maintaining the public's trust is essential. The need for a vigilant approach to information security has been demonstrated by the pervasive and sustained computerbased (cyber) attacks against the United States and others that continue to pose a potentially devastating impact to systems and the operations and critical infrastructures that they support. GAO was asked to describe (1) cyber threats to federal information systems and cyberbased critical infrastructures and (2) control deficiencies that make these systems and infrastructures vulnerable to those threats. To do so, GAO relied on its previous reports and reviewed agency and inspectors general reports on information security.
section_title: What GAO Found
paragraphs: Cyber threats to federal information systems and cyber-based critical infrastructures are evolving and growing. These threats can be unintentional and intentional, targeted or nontargeted, and can come from a variety of sources, such as foreign nations engaged in espionage and information warfare, criminals, hackers, virus writers, and disgruntled employees and contractors working within an organization. Moreover, these groups and individuals have a variety of attack techniques at their disposal, and cyber exploitation activity has grown more sophisticated, more targeted, and more serious. As government, private sector, and personal activities continue to move to networked operations, as digital systems add ever more capabilities, as wireless systems become more ubiquitous, and as the design, manufacture, and service of information technology have moved overseas, the threat will continue to grow. In the absence of robust security programs, agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices. These developments have led government officials to become increasingly concerned about the potential for a cyber attack. According to GAO reports and annual security reporting, federal systems are not sufficiently protected to consistently thwart cyber threats. Serious and widespread information security control deficiencies continue to place federal assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. For example, over the last several years, most agencies have not implemented controls to sufficiently prevent, limit, or detect access to computer networks, systems, and information, and weaknesses were reported in such controls at 23 of 24 major agencies for fiscal year 2008. Agencies also did not always configure network devices and service properly, segregate incompatible duties, or ensure that continuity of operations plans contained all essential information. An underlying cause for these weaknesses is that agencies have not yet fully or effectively implemented key elements of their agencywide information security programs. To improve information security, efforts have been initiated that are intended to strengthen the protection of federal information and information systems. For example, the Comprehensive National Cybersecurity Initiative was launched in January 2008 and is intended to improve federal efforts to protect against intrusion attempts and anticipate future threats. Until such opportunities are seized and fully exploited and GAO recommendations to mitigate identified control deficiencies and implement agencywide information security programs are fully and effectively implemented, federal information and systems will remain vulnerable.

section_title: Letter
paragraphs: Thank you for the opportunity to participate in today’s hearing on  the threats, vulnerabilities, and challenges in securing federal  information systems. Information security is a critical consideration  for any organization that depends on information systems and  computer networks to carry out its mission or business. It is  especially important for government agencies, where maintaining  the public’s trust is essential. The need for a vigilant approach to  information security has been demonstrated by the pervasive and  sustained computer-based (cyber) attacks against the United States  and others that continue to pose a potentially devastating impact to  systems and the operations and critical infrastructures that they  support.
In my testimony today, I will describe (1) cyber threats to federal  information systems and cyber-based critical infrastructures and  (2) control deficiencies that make these systems and infrastructures  vulnerable to those threats. In preparing for this testimony, we  relied on our previous reports on federal information security.  These reports contain detailed overviews of the scope and  methodology we used. We also reviewed inspectors general (IG)  reports on information security, analyzed performance and  accountability reports for 24 major federal agencies, and examined  information provided by the U.S. Computer Emergency Readiness  Team (US-CERT) on reported security incidents.
We conducted our work in support of this testimony during April  and May 2009, in the Washington, D.C. area. The work on which this  testimony is based was performed in accordance with generally  accepted government auditing standards. Those standards require  that we plan and perform audits to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the  evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: As computer technology has advanced, federal agencies have  become dependent on computerized information systems to carry  out their operations and to process, maintain, and report essential  information. Virtually all federal operations are supported by  automated systems and electronic data, and agencies would find it  difficult, if not impossible, to carry out their missions, deliver  services to the public, and account for their resources without these  information assets. Information security is thus especially important  for federal agencies to ensure the confidentiality, integrity, and  availability of their information and information systems.  Conversely, ineffective information security controls can result in  significant risk to a broad array of government operations and  assets. For example:  ●  Resources, such as federal payments and collections, could be lost  or stolen.  ●  Computer resources could be used for unauthorized purposes or to  launch attacks on other computer systems.  ●  Sensitive information, such as taxpayer data, Social Security  records, medical records, intellectual property, and proprietary  business information, could be inappropriately disclosed, browsed,  or copied for purposes of identity theft, espionage, or other types of  crime.  ●  Critical operations, such as those supporting critical infrastructure,  national defense, and emergency services, could be disrupted.  ●  Data could be added, modified, or deleted for purposes of fraud,  subterfuge, or disruption.  ●  Agency missions could be undermined by embarrassing incidents  that result in diminished confidence in the ability of federal  organizations to conduct operations and fulfill their responsibilities.
section_title: Federal Systems and Infrastructures Face Increasing Cyber Threats
paragraphs: Cyber threats to federal information systems and cyber-based  critical infrastructures are evolving and growing. In September 2007,  we reported that these threats can be unintentional and intentional,  targeted or nontargeted, and can come from a variety of sources.  Unintentional threats can be caused by inattentive or untrained  employees, software upgrades, maintenance procedures, and  equipment failures that inadvertently disrupt systems or corrupt  data. Intentional threats include both targeted and nontargeted  attacks. A targeted attack is when a group or individual attacks a  specific system or cyber-based critical infrastructure. A nontargeted  attack occurs when the intended target of the attack is uncertain,  such as when a virus, worm, or other malicious software is released  on the Internet with no specific target.
Government officials are concerned about attacks from individuals  and groups with malicious intent, such as criminals, terrorists, and  adversarial foreign nations. For example, in February 2009, the  Director of National Intelligence testified that foreign nations and  criminals have targeted government and private sector networks to  gain a competitive advantage and potentially disrupt or destroy  them, and that terrorist groups have expressed a desire to use cyber  attacks as a means to target the United States.  The Federal Bureau  of Investigation has identified multiple sources of threats to our  nation’s critical information systems, including foreign nations  engaged in espionage and information warfare, domestic criminals,  hackers, virus writers, and disgruntled employees and contractors  working within an organization. Table 1 summarizes those groups or  individuals that are considered to be key sources of cyber threats to  our nation’s information systems and cyber infrastructures.
These groups and individuals have a variety of attack techniques at  their disposal. Furthermore, as we have previously reported, the  techniques have characteristics that can vastly enhance the reach  and impact of their actions, such as the following:  ●  Attackers do not need to be physically close to their targets to  perpetrate a cyber attack.  ●  Technology allows actions to easily cross multiple state and national  borders.  ●  Attacks can be carried out automatically, at high speed, and by  attacking a vast number of victims at the same time.  ●  Attackers can more easily remain anonymous.
Table 2 identifies the types and techniques of cyber attacks that are  commonly used.
Government officials are increasingly concerned about the potential  for a cyber attack. According to the Director of National  Intelligence, the growing connectivity between information  systems, the Internet, and other infrastructures creates  opportunities for attackers to disrupt telecommunications, electrical  power, and other critical infrastructures. As government, private  sector, and personal activities continue to move to networked  operations, as digital systems add ever more capabilities, as wireless  systems become more ubiquitous, and as the design, manufacture,  and service of IT have moved overseas, the threat will continue to  grow. Over the past year, cyber exploitation activity has grown more  sophisticated, more targeted, and more serious. For example, the  Director of National Intelligence also stated that, in August 2008, the  Georgian national government’s Web sites were disabled during  hostilities with Russia, which hindered the government’s ability to  communicate its perspective about the conflict. The director  expects disruptive cyber activities to become the norm in future  political and military conflicts.
subsections: section_title: Reported Security Incidents Are on the Rise
paragraphs: Perhaps reflective of the evolving and growing nature of the threats  to federal systems, agencies are reporting an increasing number of  security incidents.  These incidents put sensitive information at risk.  Personally identifiable information about Americans has been lost,  stolen, or improperly disclosed, thereby potentially exposing those  individuals to loss of privacy, identity theft, and financial crimes.  Reported attacks and unintentional incidents involving critical  infrastructure systems demonstrate that a serious attack could be  devastating. Agencies have experienced a wide range of incidents  involving data loss or theft, computer intrusions, and privacy  breaches, underscoring the need for improved security practices.
When incidents occur, agencies are to notify the federal information  security incident center—US-CERT. As shown in figure 1, the  number of incidents reported by federal agencies to US-CERT has  increased dramatically over the past 3 years, increasing from 5,503  incidents reported in fiscal year 2006 to 16,843 incidents in fiscal  year 2008 (about a 206 percent increase).
Incidents are categorized by US-CERT in the following manner:   ●  Unauthorized access: In this category, an individual gains logical or  physical access without permission to a federal agency’s network,  system, application, data, or other resource.   ●  Denial of service: An attack that successfully prevents or impairs the  normal authorized functionality of networks, systems, or  applications by exhausting resources. This activity includes being  the victim or participating in a denial of service attack.   ●  Malicious code: Successful installation of malicious software (e.g.,  virus, worm, Trojan horse, or other code-based malicious entity)  that infects an operating system or application. Agencies are not  required to report malicious logic that has been successfully  quarantined by antivirus software.   ●  Improper usage: A person violates acceptable computing use  policies.  ●  Scans/probes/attempted access: This category includes any activity  that seeks to access or identify a federal agency computer, open  ports, protocols, service, or any combination of these for later  exploit. This activity does not directly result in a compromise or  denial of service.   ●  Investigation: Unconfirmed incidents that are potentially malicious  or anomalous activity deemed by the reporting entity to warrant  further review.
As noted in figure 2, the three most prevalent types of incidents  reported to US-CERT during fiscal years 2006 through 2008 were  unauthorized access, improper usage, and investigation.
section_title: Vulnerabilities Pervade Federal Information Systems
paragraphs: The growing threats and increasing number of reported incidents,  highlight the need for effective information security policies and  practices. However, serious and widespread information security  control deficiencies continue to place federal assets at risk of  inadvertent or deliberate misuse, financial information at risk of  unauthorized modification or destruction, sensitive information at  risk of inappropriate disclosure, and critical operations at risk of  disruption.
In their fiscal year 2008 performance and accountability reports, 20  of 24 major agencies indicated that inadequate information system  controls over financial systems and information were either a  significant deficiency or a material weakness for financial statement  reporting (see fig. 3).
Similarly, our audits have identified control deficiencies in both  financial and nonfinancial systems, including vulnerabilities in  critical federal systems. For example:   ●  We reported in September 2008 that although the Los Alamos  National Laboratory (LANL)—one of the nation’s weapons  laboratories—implemented measures to enhance the information  security of its unclassified network, vulnerabilities continued to  exist in several critical areas, including (1) identifying and  authenticating users of the network, (2) encrypting sensitive  information, (3) monitoring and auditing compliance with security  policies, (4) controlling and documenting changes to a computer  system’s hardware and software, and (5) restricting physical access  to computing resources. As a result, sensitive information on the  network—including unclassified controlled nuclear information,  naval nuclear propulsion information, export control information,  and personally identifiable information—were exposed to an  unnecessary risk of compromise. Moreover, the risk was heightened  because about 300 (or 44 percent) of 688 foreign nationals who had  access to the unclassified network as of May 2008 were from  countries classified as sensitive by the Department of Energy, such  as China, India, and Russia.   ●  In May 2008 we reported that the Tennessee Valley Authority  (TVA)— a federal corporation and the nation’s largest public power  company that generates and transmits electricity using its 52 fossil,  hydro, and nuclear power plants and transmission facilities—had  not fully implemented appropriate security practices to secure the  control systems used to operate its critical infrastructures. Both its  corporate network infrastructure and control systems networks and  devices at individual facilities and plants were vulnerable to  disruption. In addition, the interconnections between TVA’s control  system networks and its corporate network increased the risk that  security weaknesses, on the corporate network could affect control  systems networks and we determined that the control systems were  at increased risk of unauthorized modification or disruption by both  internal and external threats. These deficiencies placed TVA at  increased and unnecessary risk of being unable to respond properly  to a major disruption resulting from an intended or unintended  cyber incident, which could then, in turn, affect the agency’s  operations and its customers.
subsections: section_title: Weaknesses Persist in All Major Categories of Controls
paragraphs: Vulnerabilities in the form of inadequate information system  controls have been found repeatedly in our prior reports as well as  IG and agency reports. These weaknesses fall into five major  categories of information system controls: (1) access controls,  which ensure that only authorized individuals can read, alter, or  delete data; (2) configuration management controls, which provide  assurance that security features for hardware and software are  identified and implemented and that changes to that configuration  are systematically controlled; (3) segregation of duties, which  reduces the risk that one individual can independently perform  inappropriate actions without detection; (4) continuity of operations  planning, which provides for the prevention of significant  disruptions of computer-dependent operations; and (5) an  agencywide information security program, which provides the  framework for ensuring that risks are understood and that effective  controls are selected and properly implemented. Figure 4 shows the  number of major agencies with weaknesses in these five areas.
Over the last several years, most agencies have not implemented  controls to sufficiently prevent, limit, or detect access to computer  networks, systems, or information. Our analysis of IG, agency, and  our own reports uncovered that agencies did not have adequate  controls in place to ensure that only authorized individuals could  access or manipulate data on their systems and networks. To  illustrate, weaknesses were reported in such controls at 23 of 24  major agencies for fiscal year 2008. For example, agencies did not  consistently (1) identify and authenticate users to prevent  unauthorized access, (2) enforce the principle of least privilege to  ensure that authorized access was necessary and appropriate,  (3) establish sufficient boundary protection mechanisms, (4) apply  encryption to protect sensitive data on networks and portable  devices, and (5) log, audit, and monitor security-relevant events. At  least nine agencies also lacked effective controls to restrict physical  access to information assets. We previously reported that many of  the data losses occurring at federal agencies over the past few years  were a result of physical thefts or improper safeguarding of systems,  including laptops and other portable devices.
In addition, agencies did not always configure network devices and  services to prevent unauthorized access and ensure system integrity,  patch key servers and workstations in a timely manner, or segregate  incompatible duties to different individuals or groups so that one  individual does not control all aspects of a process or transaction.  Furthermore, agencies did not always ensure that continuity of  operations plans contained all essential information necessary to  restore services in a timely manner. Weaknesses in these areas  increase the risk of unauthorized use, disclosure, modification, or  loss of information.
An underlying cause for information security weaknesses identified  at federal agencies is that they have not yet fully or effectively  implemented key elements for an agencywide information security  program. An agencywide security program, required by the Federal  Information Security Management Act, provides a framework and  continuing cycle of activity for assessing and managing risk,  developing and implementing security policies and procedures,  promoting security awareness and training, monitoring the  adequacy of the entity’s computer-related controls through security  tests and evaluations, and implementing remedial actions as  appropriate. Our analysis determined that 23 of 24 major federal  agencies had weaknesses in their agencywide information security  programs.
Due to the persistent nature of these vulnerabilities and associated  risks, we continued to designate information security as a  governmentwide high-risk issue in our most recent biennial report  to Congress; a designation we have made in each report since 1997.
section_title: Opportunities Exist for Enhancing Federal Information Security
paragraphs: Over the past several years, we and the IGs have made hundreds of  recommendations to agencies for actions necessary to resolve prior  significant control deficiencies and information security program  shortfalls. For example, we recommended that agencies correct  specific information security deficiencies related to user  identification and authentication, authorization, boundary  protections, cryptography, audit and monitoring, physical security,  configuration management, segregation of duties, and contingency  planning. We have also recommended that agencies fully implement  comprehensive, agencywide information security programs by  correcting shortcomings in risk assessments, information security  policies and procedures, security planning, security training, system  tests and evaluations, and remedial actions. The effective  implementation of these recommendations will strengthen the  security posture at these agencies.
In addition, the White House, the Office of Management and Budget  (OMB), and certain federal agencies have continued or launched  several governmentwide initiatives that are intended to enhance  information security at federal agencies. These key initiatives are  discussed below.   ●  Comprehensive National Cybersecurity Initiative: In January 2008,  President Bush began to implement a series of initiatives aimed  primarily at improving the Department of Homeland Security and  other federal agencies’ efforts to protect against intrusion attempts  and anticipate future threats. While these initiatives have not been  made public, the Director of National Intelligence stated that they  include defensive, offensive, research and development, and  counterintelligence efforts, as well as a project to improve  public/private partnerships.  ●  The Information Systems Security Line of Business: The goal of  this initiative, led by OMB, is to improve the level of information  systems security across government agencies and reduce costs by  sharing common processes and functions for managing information  systems security. Several agencies have been designated as service  providers for IT security awareness training and FISMA reporting.   ●  Federal Desktop Core Configuration: For this initiative, OMB  directed agencies that have Windows XP deployed and plan to  upgrade to Windows Vista operating systems to adopt the security  configurations developed by the National Institute of Standards and  Technology, Department of Defense, and Department of Homeland  Security. The goal of this initiative is to improve information  security and reduce overall IT operating costs.   ●  SmartBUY: This program, led by the General Services  Administration, is to support enterprise-level software management  through the aggregate buying of commercial software  governmentwide in an effort to achieve cost savings through volume  discounts. The SmartBUY initiative was expanded to include  commercial off-the-shelf encryption software and to permit all  federal agencies to participate in the program. The initiative is to  also include licenses for information assurance.  ●  Trusted Internet Connections Initiative: This is an effort designed  to optimize individual agency network services into a common  solution for the federal government. The initiative is to facilitate the  reduction of external connections, including Internet points of  presence, to a target of 50.
We currently have ongoing work that addresses the status, planning,  and implementation efforts of several of these initiatives.
In summary, the threats to federal information systems are evolving  and growing, and federal systems are not sufficiently protected to  consistently thwart the threats. Unintended incidents and attacks  from individuals and groups with malicious intent, such as  criminals, terrorists, and adversarial foreign nations, have the  potential to cause significant damage to the ability of agencies to  effectively perform their missions, deliver services to constituents,  and account for their resources. Opportunities exist to improve  information security at federal agencies. The White House, OMB,  and certain federal agencies have initiated efforts that are intended  to strengthen the protection of federal information and information  systems. Until such opportunities are seized and fully exploited, and  agencies fully and effectively implement the hundreds of  recommendations by us and by IGs to mitigate information security  control deficiencies and implement agencywide information  security programs, federal information and systems will remain  vulnerable.
Chairwoman Watson, this concludes my statement. I would be  happy to answer questions at the appropriate time.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions regarding this report, please contact  Gregory C. Wilshusen, Director, Information Security Issues, at  (202) 512-6244 or wilshuseng@gao.gov. Other key contributors to  this report include Charles Vrabel (Assistant Director), Larry  Crosland, Neil Doherty, Rebecca LaPaze, and Jayne Wilson.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.