Cybersecurity: Continued Efforts Are Needed to Protect Information Systems from Evolving Threats
Published: 2009-11-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the federal government. In recent months, federal officials have cited the continued efforts of foreign nations and criminals to target government and private sector networks; terrorist groups have expressed a desire to use cyber attacks to target the United States; and press accounts have reported attacks on the Web sites of government agencies. The ever-increasing dependence of federal agencies on computerized systems to carry out essential, everyday operations can make them vulnerable to an array of cyber-based risks. Thus it is increasingly important for the federal government to have effective information security controls in place to safeguard its systems and the information they contain. GAO was asked to provide a statement describing (1) cyber threats to federal information systems and cyber-based critical infrastructures, (2) control deficiencies at federal agencies that make these systems and infrastructures vulnerable to cyber threats, and (3) opportunities that exist for improving federal cybersecurity. In preparing this statement, GAO relied on its previously published work in this area.
section_title: What GAO Found
paragraphs: Cyber-based threats to federal systems and critical infrastructure are evolving and growing. These threats can be unintentional or intentional, targeted or non-targeted, and can come from a variety of sources, including criminals, terrorists, and adversarial foreign nations, as well as hackers and disgruntled employees. These potential attackers have a variety of techniques at their disposal, which can vastly enhance the reach and impact of their actions. For example, cyber attackers do not need to be physically close to their targets, their attacks can easily cross state and national borders, and cyber attackers can more easily preserve their anonymity. Further, the growing interconnectivity between information systems, the Internet, and other infrastructure presents increasing opportunities for such attacks. In addition, reports of security incidents from federal agencies are on the rise, increasing by over 200 percent from fiscal year 2006 to fiscal year 2008. Compounding the growing number and kinds of threats, GAO--along with agencies and their inspectors general--has identified significant weaknesses in the security controls on federal information systems, resulting in pervasive vulnerabilities. These include deficiencies in the security of financial systems and information and vulnerabilities in other critical federal information systems. GAO has identified weaknesses in all major categories of information security controls at federal agencies. For example, in fiscal year 2008, weaknesses were reported in such controls at 23 of 24 major agencies. Specifically, agencies did not consistently authenticate users to prevent unauthorized access to systems; apply encryption to protect sensitive data; and log, audit, and monitor security-relevant events, among other actions. An underlying cause of these weaknesses is agencies' failure to fully or effectively implement information security programs, which entails assessing and managing risk, developing and implementing security policies and procedures, promoting security awareness and training, monitoring the adequacy of security controls, and implementing appropriate remedial actions. Multiple opportunities exist to enhance cybersecurity. In light of weaknesses in agencies' information security controls, GAO and inspectors general have made hundreds of recommendations to improve security, many of which agencies are implementing. In addition, the White House and the Office of Management and Budget, collaborating with other agencies, have launched several initiatives aimed at improving aspects of federal cybersecurity. The Department of Homeland Security, which plays a key role in coordinating cybersecurity activities, also needs to fulfill its responsibilities, such as developing capabilities for protecting cyber-reliant critical infrastructures and implementing lessons learned from a major cyber simulation exercise. Finally, a panel of experts convened by GAO made several recommendations for improving the nation's cybersecurity strategy. Realizing these opportunities for improvement can help ensure that the federal government's systems, information, and critical cyber-reliant infrastructure are effectively protected.

section_title: Letter
paragraphs: Thank you for the opportunity to submit this statement for the  record for today’s hearing on public and private sector efforts to  prevent and disrupt terrorist cyber attacks against computer  networks.
Pervasive and sustained cyber attacks against the United States  continue to pose a potentially devastating impact on federal systems  and operations. In February 2009, the Director of National  Intelligence testified that foreign nations and criminals had targeted  government and private sector networks to gain a competitive  advantage and potentially disrupt or destroy them, and that terrorist  groups had expressed a desire to use cyber attacks as a means to  target the United States. As recently as July 2009, press accounts  reported that a widespread and coordinated attack over the course  of several days targeted Web sites operated by major government  agencies, including the Departments of Homeland Security and  Defense, the Federal Aviation Administration, and the Federal Trade  Commission, causing disruptions to the public availability of  government information. Such attacks highlight the importance of  developing a concerted response to safeguard federal information  systems.
In this statement we will describe (1) cyber threats to federal  information systems and cyber-based critical infrastructures,  (2) control deficiencies that make these systems and infrastructures  vulnerable to those threats, and (3) opportunities that exist for  improving federal cybersecurity. In preparing this statement, we  relied on our previous reports on federal information security.  These reports contain detailed overviews of the scope and  methodology we used. The work on which this statement is based  was performed in accordance with generally accepted government  auditing standards. Those standards require that we plan and  perform audits to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provided a  reasonable basis for our findings and conclusions based on our  audit objectives.
subsections: section_title: Background
paragraphs: As computer technology has advanced, federal agencies have  become dependent on computerized information systems to carry  out their operations and to process, maintain, and report essential  information. Virtually all federal operations are supported by  automated systems and electronic data, and agencies would find it  difficult, if not impossible, to carry out their missions, deliver  services to the public, and account for their resources without these  information assets. Information security is thus especially important  for federal agencies to ensure the confidentiality, integrity, and  availability of their information and information systems.  Conversely, ineffective information security controls can result in  significant risk to a broad array of government operations and  assets. Examples of such risks include the following:  ●  Resources, such as federal payments and collections, could be lost  or stolen.  ●  Computer resources could be used for unauthorized purposes or to  launch attacks on other computer systems.  ●  Sensitive information, such as taxpayer data, Social Security  records, medical records, intellectual property, and proprietary  business information, could be inappropriately disclosed, browsed,  or copied for purposes of identity theft, espionage, or other types of  crime.  ●  Critical operations, such as those supporting critical infrastructure,  national defense, and emergency services, could be disrupted.  ●  Data could be added, modified, or deleted for purposes of fraud,  subterfuge, or disruption.  ●  Agency missions could be undermined by embarrassing incidents  that result in diminished confidence in the ability of federal  organizations to conduct operations and fulfill their responsibilities.
section_title: Federal Systems and Infrastructures Face Increasing Cyber Threats
paragraphs: Cyber threats to federal information systems and cyber-based  critical infrastructures are evolving and growing. In September 2007,  we reported that these threats can be unintentional and intentional,  targeted or nontargeted, and can come from a variety of sources.  Unintentional threats can be caused by inattentive or untrained  employees, software upgrades, maintenance procedures, and  equipment failures that inadvertently disrupt systems or corrupt  data. Intentional threats include both targeted and nontargeted  attacks. A targeted attack is when a group or individual attacks a  specific system or cyber-based critical infrastructure. A nontargeted  attack occurs when the intended target of the attack is uncertain,  such as when a virus, worm, or other malicious software is released  on the Internet with no specific target.
Government officials are concerned about attacks from individuals  and groups with malicious intent, such as criminals, terrorists, and  adversarial foreign nations.  The Federal Bureau of Investigation has  identified multiple sources of threats to our nation’s critical  information systems, including foreign nations engaged in espionage  and information warfare, domestic criminals, hackers, virus writers,  and disgruntled employees and contractors working within an  organization. Table 1 summarizes those groups and types of  individuals that are considered to be key sources of cyber threats to  our nation’s information systems and cyber infrastructures.
These groups and individuals have a variety of attack techniques at  their disposal. Furthermore, as we have previously reported, the  techniques have characteristics that can vastly enhance the reach  and impact of their actions, such as the following:  ●  Attackers do not need to be physically close to their targets to  perpetrate a cyber attack.  ●  Technology allows actions to easily cross multiple state and national  borders.  ●  Attacks can be carried out automatically, at high speed, and by  attacking a vast number of victims at the same time.  ●  Attackers can more easily remain anonymous.
The growing connectivity between information systems, the  Internet, and other infrastructures creates opportunities for  attackers to disrupt telecommunications, electrical power, and other  critical services. As government, private sector, and personal  activities continue to move to networked operations, as digital  systems add ever more capabilities, as wireless systems become  more ubiquitous, and as the design, manufacture, and service of  information technology have moved overseas, the threat will  continue to grow. Over the past year, cyber exploitation activity has  grown more sophisticated, more targeted, and more serious. For  example, the Director of National Intelligence stated that, in August  2008, the Georgian national government’s Web sites were disabled  during hostilities with Russia, which hindered the government’s  ability to communicate its perspective about the conflict. The  director expects disruptive cyber activities to become the norm in  future political and military conflicts.
subsections: section_title: Reported Security Incidents Are on the Rise
paragraphs: Consistent with the evolving and growing nature of the threats to  federal systems, agencies are reporting an increasing number of  security incidents. These incidents put sensitive information at risk.  Personally identifiable information about Americans has been lost,  stolen, or improperly disclosed, thereby potentially exposing those  individuals to loss of privacy, identity theft, and financial crimes.  Reported attacks and unintentional incidents involving critical  infrastructure systems demonstrate that a serious attack could be  devastating. Agencies have experienced a wide range of incidents  involving data loss or theft, computer intrusions, and privacy  breaches, underscoring the need for improved security practices.
When incidents occur, agencies are to notify the federal information  security incident center—the United States Computer Emergency  Readiness Team (US-CERT). As shown in figure 1, the number of  incidents reported by federal agencies to US-CERT has increased  dramatically over the past 3 years, increasing from 5,503 incidents  reported in fiscal year 2006 to 16,843 incidents in fiscal year 2008  (about a 206 percent increase).
The three most prevalent types of incidents reported to US-CERT  during fiscal years 2006 through 2008 were unauthorized access  (where an individual gains logical or physical access to a system  without permission), improper usage (a violation of acceptable  computing use policies), and investigation (unconfirmed incidents  that are potentially malicious or anomalous activity deemed by the  reporting entity to warrant further review).
section_title: Vulnerabilities Pervade Federal Information Systems
paragraphs: The growing threats and increasing number of reported incidents  highlight the need for effective information security policies and  practices. However, serious and widespread information security  control deficiencies continue to place federal assets at risk of  inadvertent or deliberate misuse, financial information at risk of  unauthorized modification or destruction, sensitive information at  risk of inappropriate disclosure, and critical operations at risk of  disruption.
In their fiscal year 2008 performance and accountability reports, 20  of 24 major agencies indicated that inadequate information system  controls over financial systems and information were either a  significant deficiency or a material weakness for financial statement  reporting (see fig. 2).
Similarly, our audits have identified control deficiencies in both  financial and nonfinancial systems, including vulnerabilities in  critical federal systems. For example, we reported in September  2008 that, although the Los Alamos National Laboratory—one of  the nation’s weapons laboratories—implemented measures to  enhance the information security of its unclassified network,  vulnerabilities continued to exist in several critical areas. In  addition, in May 2008 we reported that the Tennessee Valley  Authority (TVA)—a federal corporation and the nation’s largest  public power company that generates and transmits electricity us its 52 fossil, hydro, and nuclear power plants and transmission  facilities—had not fully implemented appropriate security practice to secure the control systems used to operate its critical  s  infrastructures. Similarly, in October 2009 we reported that the  National Aeronautics and Space Administration (NASA)—the  civilian agency that oversees U.S. aeronautical and space  activities—had not always implemented appropriate controls to  sufficiently protect the confidentiality, integrity, and availability of  the information and systems supporting its mission directorates.
subsections: section_title: Weaknesses Persist in All Major Categories of Controls
paragraphs: Over the last several years, most agencies have not implemented  controls sufficiently to prevent, limit, or detect unauthorized access  to computer networks, systems, or information. Our analysis of  inspectors general, agency, and our own reports determined that  agencies did not have adequate controls in place to ensure that only  authorized individuals could access or manipulate data on their  systems and networks. To illustrate, weaknesses were reported in  such controls at 23 of 24 major agencies for fiscal year 2008. For  example, agencies did not consistently (1) identify and authenticate  users to prevent unauthorized access; (2) enforce the principle of  least privilege to ensure that authorized access was necessary and  appropriate; (3) establish sufficient boundary protection  mechanisms; (4) apply encryption to protect sensitive data on  networks and portable devices; and (5) log, audit, and monitor  security-relevant events. At least nine agencies also lacked effective  controls to restrict physical access to information assets. We  previously reported that many of the data losses occurring at federal  agencies over the past few years were a result of physical thefts or  improper safeguarding of systems, including laptops and other  portable devices.
An underlying cause of information security weaknesses identified  at federal agencies is that they have not yet fully or effectively  implemented key elements for an agencywide information security  program. An agencywide security program, required by the Federal  Information Security Management Act (FISMA), is intended to  provide a framework and continuing cycle of activities, including  assessing and managing risk, developing and implementing security  policies and procedures, promoting security awareness and training,  monitoring the adequacy of the entity’s computer-related controls  through security tests and evaluations, and implementing remedial  actions as appropriate. Our analysis determined that 23 of 24 major  federal agencies had weaknesses in their agencywide information  security programs.
Due to the persistent nature of these vulnerabilities and associated  risks, we continued to designate information security as a  governmentwide high-risk issue in our most recent biennial report  to Congress, a designation we have made in each report since 1997.
section_title: Opportunities Exist for Enhancing Federal Cybersecurity
paragraphs: Over the past several years, we and inspectors general have made  hundreds of recommendations to agencies for actions necessary to  resolve prior significant control deficiencies and information  security program shortfalls. For example, we recommended that  agencies correct specific information security deficiencies related to  user identification and authentication, authorization, boundary  protections, cryptography, audit and monitoring, physical security,  configuration management, segregation of duties, and contingency  planning. We have also recommended that agencies fully implement  comprehensive, agencywide information security programs by  correcting weaknesses in risk assessments, information security  policies and procedures, security planning, security training, system  tests and evaluations, and remedial actions. The effective  implementation of these recommendations will strengthen the  security posture at these agencies. Agencies have implemented or  are in the process of implementing many of our recommendations.
In June 2009 we proposed a list of suggested actions that could  improve FISMA and its associated implementing guidance, including  (1) clarifying requirements for testing and evaluating security  controls; (2) requiring agency heads to provide an assurance  statement on the overall adequacy and effectiveness of the agency’s  information security program; (3) enhancing independent annual  evaluations; and (4) strengthening annual reporting mechanisms.
In addition, the White House, OMB, and certain federal agencies  have undertaken several governmentwide initiatives that are  intended to enhance information security at federal agencies. These  key initiatives are discussed below.   ●  Comprehensive National Cybersecurity Initiative: In January 2008,  President Bush began to implement a series of initiatives aimed  primarily at improving the Department of Homeland Security’s  (DHS) and other federal agencies’ efforts to protect against  intrusion attempts and anticipate future threats. While details of  these initiatives have not been made public, the Director of National  Intelligence stated that they include defensive, offensive, research  and development, and counterintelligence efforts, as well as a  project to improve public-private partnerships.  ●  The Information Systems Security Line of Business: The goal of  this initiative, led by OMB, is to improve the level of information  systems security across government agencies and reduce costs by  sharing common processes and functions for managing information  systems security. Several agencies have been designated as service  providers for computer security awareness training and FISMA  reporting.   ●  Federal Desktop Core Configuration: For this initiative, OMB  directed agencies that have Windows XP and/or Windows Vista  operating systems deployed to adopt the security configurations  developed by the National Institute of Standards and Technology,  the Department of Defense, and DHS. The goal of this initiative is to  improve information security and reduce overall information  technology operating costs.   ●  Einstein: This is a computer network intrusion detection system  that analyzes network flow information from participating federal  agencies. The system is to provide a high-level perspective from  which to observe potential malicious activity in computer network  traffic of participating agencies’ computer networks.  ●  Trusted Internet Connections Initiative: This is an effort designed  to optimize individual agency network services into a common  solution for the federal government. The initiative is to facilitate the  reduction of external connections, including Internet points of  presence.
We currently have ongoing work that addresses the status, planning,  and implementation efforts of several of these initiatives.
subsections: section_title: DHS Needs to Fully Satisfy Its Cybersecurity Responsibilities
paragraphs: Federal law and policyto protect our nation’s computer-reliant critical infrastructures—a  practice known as cyber critical infrastructure protection, or cyber  CIP. We have reported since 2005 that DHS has yet to fully satisfy its   establish DHS as the focal point for efforts  key responsibilities for protecting these critical infrastructures. Our  reports included recommendations that are essential for DHS to  address in order to fully implement its responsibilities. We  summarized these recommendations into key areas listed in table 2.
DHS has since developed and implemented certain capabilities to  satisfy aspects of its responsibilities, but the department still has not  fully implemented our recommendations, and thus further action  needs to be taken to address these areas.  For example, in July 2008,  we reported that DHS’s US-CERT did not fully address 15 key  attributes of cyber analysis and warning capabilities related to (1)  monitoring network activity to detect anomalies, (2) analyzing  information and investigating anomalies to determine whether they  are threats, (3) warning appropriate officials with timely and  actionable threat and mitigation information, and (4) responding to  the threat. For example, US-CERT provided warnings by developing  and distributing a wide array of notifications; however, these  notifications were not consistently actionable or timely. As a result,  we recommended that the department address shortfalls associated  with the 15 attributes in order to fully establish a national cyber  analysis and warning capability as envisioned in the national  strategy. DHS agreed in large part with our recommendations.
Similarly, in September 2008, we reported that since conducting a  major cyber attack exercise, called Cyber Storm, DHS had  demonstrated progress in addressing eight lessons it had learned  from these efforts. However, its actions to address the lessons had  not been fully implemented. Specifically, while it had completed 42  of the 66 activities identified, the department had identified 16  activities as ongoing and 7 as planned for the future. Consequently,  we recommended that DHS schedule and complete all of the  corrective activities identified in order to strengthen coordination  between public and private sector participants in response to  significant cyber incidents. DHS concurred with our  recommendation. Since that time, DHS has continued to make  progress in completing some identified activities but has yet to do so  for others.
section_title: Improving the National Cybersecurity Strategy
paragraphs: Because the threats to federal information systems and critical  infrastructure have persisted and grown, efforts have recently been  undertaken by the executive branch to review the nation’s  cybersecurity strategy.  As we previously stated, in January 2008 the  Comprehensive National Cybersecurity Initiative was established  with its primary aim to improve federal agencies’ efforts to protect  against intrusion attempts and anticipate future threats. In February  2009, President Obama directed the National Security Council and  Homeland Security Council to conduct a comprehensive review to  assess the United States’ cybersecurity-related policies and  structures. The resulting report, “Cyberspace Policy Review:  Assuring a Trusted and Resilient Information and  Communications Infrastructure,” recommended, among other  things, appointing an official in the White House to coordinate the  nation’s cybersecurity policies and activities, creating a new  national cybersecurity strategy, and developing a framework for  cyber research and development. We recently initiated a review to  assess the progress made by the executive branch in implementing  the policy’s recommendations.
We also testified in March 2009 on needed improvements to the  nation’s cybersecurity strategy. In preparation for that testimony,  we obtained the views of experts (by means of panel discussions)  on critical aspects of the strategy, including areas for improvement.  The experts, who included former federal officials, academics, and  private sector executives, highlighted 12 key improvements that are,  in their view, essential to improving the strategy and our national  cybersecurity posture. The key strategy improvements identified by  cybersecurity experts are listed in table 3.
These recommended improvements to the national strategy are in  large part consistent with our previous reports and extensive  research and experience in this area. Until they are addressed, our  nation’s most critical federal and private sector cyber infrastructure  remain at unnecessary risk to attack from our adversaries.
In summary, the threats to federal information systems are evolving  and growing, and federal systems are not sufficiently protected to  consistently thwart the threats. Unintended incidents and attacks  from individuals and groups with malicious intent, such as  criminals, terrorists, and adversarial foreign nations, have the  potential to cause significant damage to the ability of agencies to  effectively perform their missions, deliver services to constituents,  and account for their resources. To help in meeting these threats,  opportunities exist to improve information security throughout the  federal government. The White House, OMB, and certain federal  agencies have initiated efforts that are intended to strengthen the  protection of federal information and information systems. In  addition, the prompt and effective implementation of the hundreds  of recommendations by us and by agency inspectors general to  mitigate information security control deficiencies and fully  implement agencywide security programs would also strengthen the  protection of federal information systems, as would efforts by DHS  to develop better capabilities to meets its responsibilities, and the  implementation of recommended improvements to the national  cybersecurity strategy. Until agencies fully and effectively  implement these recommendations, federal information and systems  will remain vulnerable.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or  David A. Powner at (202) 512-9286 or pownerd@gao.gov. Other key  contributors to this statement include John de Ferrari (Assistant  Director), Matthew Grote, Nick Marinos, and Lee McCracken.
section_title: Related GAO Products
paragraphs: Information Security: NASA Needs to Remedy Vulnerabilities in Key  Networks. GAO-10-4. Washington, D.C.: October 15, 2009.
Information Security: Concerted Effort Needed to Improve Federal  Performance Measures. GAO-09-617. Washington, D.C.: September 14,  2009.
Information Security: Agencies Continue to Report Progress, but Need to  Mitigate Persistent Weaknesses. GAO-09-546. Washington, D.C.: July 17,  2009.
Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical  Systems and Information. GAO-09-835T. Washington, D.C.: June 25, 2009.
Privacy and Security: Food and Drug Administration Faces Challenges  in Establishing Protections for Its Postmarket Risk Analysis System.  GAO-09-355. Washington, D.C.: June 1, 2009.
Aviation Security: TSA Has Completed Key Activities Associated with  Implementing Secure Flight, but Additional Actions Are Needed to  Mitigate Risks. GAO-09-292. Washington, D.C.: May 13, 2009.
Information Security: Cyber Threats and Vulnerabilities Place Federal  Systems at Risk. GAO-09-661T. Washington, D.C.: May 5, 2009.
Freedom of Information Act: DHS Has Taken Steps to Enhance Its  Program, but Opportunities Exist to Improve Efficiency and Cost- Effectiveness. GAO-09-260. Washington, D.C.: March 20, 2009.
Information Security: Securities and Exchange Commission Needs to  Consistently Implement Effective Controls. GAO-09-203. Washington,  D.C.: March 16, 2009.
National Cyber Security Strategy: Key Improvements Are Needed to  Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.: March  10, 2009.
Information Security: Further Actions Needed to Address Risks to Bank  Secrecy Act Data. GAO-09-195. Washington, D.C.: January 30, 2009.
Information Security: Continued Efforts Needed to Address Significant  Weaknesses at IRS. GAO-09-136. Washington, D.C.: January 9, 2009.
Nuclear Security: Los Alamos National Laboratory Faces Challenges in  Sustaining Physical and Cyber Security Improvements. GAO-08-1180T.  Washington, D.C.: September 25, 2008.
Critical Infrastructure Protection: DHS Needs to Better Address Its  Cyber Security Responsibilities. GAO-08-1157T. Washington, D.C.:  September 16, 2008.
Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington,  D.C.: September 9, 2008.
Information Security: Actions Needed to Better Protect Los Alamos  National Laboratory’s Unclassified Computer Network. GAO-08-1001.  Washington, D.C.: September 9, 2008.
Cyber Analysis and Warning: DHS Faces Challenges in Establishing a  Comprehensive National Capability. GAO-08-588. Washington, D.C.: July  31, 2008.
Information Security: Federal Agency Efforts to Encrypt Sensitive  Information Are Under Way, but Work Remains. GAO-08-525.  Washington, D.C.: June 27, 2008.
Information Security: FDIC Sustains Progress but Needs to Improve  Configuration Management of Key Financial Systems. GAO-08-564.  Washington, D.C.: May 30, 2008.
Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
Information Security: TVA Needs to Enhance Security of Critical  Infrastructure Control Systems and Networks. GAO-08-775T. Washington,  D.C.: May 21, 2008.
Information Security: Progress Reported, but Weaknesses at Federal  Agencies Persist. GAO-08-571T. Washington, D.C.: March 12, 2008.
Information Security: Securities and Exchange Commission Needs to  Continue to Improve Its Program. GAO-08-280. Washington, D.C.:  February 29, 2008.
Information Security: Although Progress Reported, Federal Agencies  Need to Resolve Significant Deficiencies. GAO-08-496T. Washington, D.C.:  February 14, 2008.
Information Security: Protecting Personally Identifiable Information.  GAO-08-343. Washington, D.C.: January 25, 2008.
Information Security: IRS Needs to Address Pervasive Weaknesses. GAO- 08-211. Washington, D.C.: January 8, 2008.
Veterans Affairs: Sustained Management Commitment and Oversight  Are Essential to Completing Information Technology Realignment and  Strengthening Information Security. GAO-07-1264T. Washington, D.C.:  September 26, 2007.
Critical Infrastructure Protection: Multiple Efforts to Secure Control  Systems Are Under Way, but Challenges Remain. GAO-07-1036.  Washington, D.C.: September 10, 2007.
Information Security: Sustained Management Commitment and  Oversight Are Vital to Resolving Long-standing Weaknesses at the  Department of Veterans Affairs. GAO-07-1019. Washington, D.C.:  September 7, 2007.
Information Security: Selected Departments Need to Address Challenges  in Implementing Statutory Requirements. GAO-07-528. Washington, D.C.:  August 31, 2007.
Information Security: Despite Reported Progress, Federal Agencies Need  to Address Persistent Weaknesses. GAO-07-837. Washington, D.C.: July 27,  2007.
Information Security: Homeland Security Needs to Immediately Address  Significant Weaknesses in Systems Supporting the US-VISIT Program.  GAO-07-870. Washington, D.C.: July 13, 2007.
Information Security: Homeland Security Needs to Enhance  Effectiveness of Its Program. GAO-07-1003T. Washington, D.C.: June 20,  2007.
Information Security: Agencies Report Progress, but Sensitive Data  Remain at Risk. GAO-07-935T. Washington, D.C.: June 7, 2007.
Information Security: Federal Deposit Insurance Corporation Needs to  Sustain Progress Improving Its Program. GAO-07-351. Washington, D.C.:  May 18, 2007.
This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  The  published  product  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary if you wish to reproduce this material separately.