Cybersecurity: Actions Needed to Strengthen U.S. Capabilities
Published: 2017-02-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Cyber-based intrusions and attacks on federal systems and systems supporting our nation's critical infrastructure, such as communications and financial services, are evolving and becoming more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.
This statement (1) provides an overview of GAO's work related to cybersecurity of the federal government and the nation's critical infrastructure and (2) identifies areas of consistency between GAO recommendations and those recently made by the Cybersecurity Commission and CSIS. In preparing this statement, GAO relied on previously published work and its review of the two recent reports issued by the Commission and CSIS.
section_title: What GAO Found
paragraphs: GAO has consistently identified shortcomings in the federal government's approach to ensuring the security of federal information systems and cyber critical infrastructure as well as its approach to protecting the privacy of personally identifiable information (PII). While previous administrations and agencies have acted to improve the protections over federal and critical infrastructure information and information systems, the federal government needs to take the following actions to strengthen U.S. cybersecurity:
Effectively implement risk-based entity-wide information security programs consistently over time . Among other things, agencies need to (1) implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices; (2) patch vulnerable systems and replace unsupported software; (3) develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis; and (4) strengthen oversight of contractors providing IT services.
Improve its cyber incident detection, response, and mitigation capabilities . The Department of Homeland Security needs to expand the capabilities and support wider adoption of its government-wide intrusion detection and prevention system. In addition, the federal government needs to improve cyber incident response practices, update guidance on reporting data breaches, and develop consistent responses to breaches of PII.
Expand its cyber workforce planning and training efforts . The federal government needs to (1) enhance efforts for recruiting and retaining a qualified cybersecurity workforce and (2) improve cybersecurity workforce planning activities.
Expand efforts to strengthen cybersecurity of the nation's critical infrastructures . The federal government needs to develop metrics to (1) assess the effectiveness of efforts promoting the National Institute of Standards and Technology's (NIST) Framework for Improving Critical Infrastructure Cybersecurity and (2) measure and report on effectiveness of cyber risk mitigation activities and the cybersecurity posture of critical infrastructure sectors.
Better oversee protection of personally identifiable information . The federal government needs to (1) protect the security and privacy of electronic health information, (2) ensure privacy when face recognition systems are used, and (3) protect the privacy of users' data on state-based health insurance marketplaces.
Several recommendations made by the Commission on Enhancing National Cybersecurity (Cybersecurity Commission) and the Center for Strategic & International Studies (CSIS) are generally consistent with or similar to GAO's recommendations in several areas including: establishing an international cybersecurity strategy, protecting cyber critical infrastructure, promoting use of the NIST cybersecurity framework, prioritizing cybersecurity research, and expanding cybersecurity workforces.
section_title: What GAO Recommends
paragraphs: Over the past several years, GAO has made about 2,500 recommendations to federal agencies to enhance their information security programs and controls. As of February 2017, about 1,000 recommendations had not been implemented.

section_title: Letter
paragraphs: Thank you for the opportunity to appear before you to discuss issues  related to strengthening U.S. cybersecurity capabilities. As recent  cyberattacks have illustrated, the need for robust and effective  cybersecurity has never been greater.
Today, I will provide an overview of our work related to the cybersecurity  posture of the federal government and the nation’s critical infrastructure,  and federal efforts to protect the privacy of personally identifiable  information (PII). At your request, I will also identify areas of consistency  between our cybersecurity-related recommendations and those made in  recent reports by the President’s Commission on Enhancing National  Cybersecurity (Cybersecurity Commission) and the Center for Strategic  & International Studies (CSIS).
My statement is based on our previously published work addressing  cybersecurity efforts and our review of the two recent reports issued by  the Cybersecurity Commission and CSIS. The GAO reports cited in this  statement contain detailed discussions of the scope of the work and the  methodology used to carry it out.
The work on which this statement is based was conducted in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform audits to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
Federal agencies and our nation’s critical infrastructures—such as  energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and  electronic data to carry out operations and to process, maintain, and  report essential information. The security of these systems and data is  vital to public confidence and the nation’s safety, prosperity, and well- being. Virtually all federal operations are supported by computer systems  and electronic data, and agencies would find it difficult, if not impossible,  to carry out their missions and account for their resources without these  information assets. Hence, ineffective controls could have a significant  impact on a broad array of government operations and assets. For  example,  resources, such as payments and collections, could be lost or stolen;  computer resources could be used for unauthorized purposes,  including the launching of attacks on others;  sensitive information, such as intellectual property, national security  data, and PII such as taxpayer data, Social Security records, and  medical records could be inappropriately added, deleted, read,  copied, disclosed, or modified for purposes such as espionage,  identity theft, or other types of crime;  critical operations, such as those supporting national defense and  emergency services, could be disrupted; data could be modified or destroyed for purposes of fraud or entity missions could be undermined by embarrassing incidents that  result in diminished confidence in the entity’s ability to conduct  operations and fulfill its responsibilities.
Federal information systems and networks are inherently at risk. They are  highly complex and dynamic, technologically diverse, and often  geographically dispersed. This complexity increases the difficulty in  identifying, managing, and protecting the myriad of operating systems,  applications, and devices comprising the systems and networks.  Compounding the risk, systems used by federal agencies are often  riddled with security vulnerabilities—both known and unknown. For  example, the national vulnerability database maintained by the National  Institute of Standards and Technology (NIST) has identified 82,384  publicly known cybersecurity vulnerabilities and exposures as of February  9, 2017, with more being added each day. Federal systems and  networks are also often interconnected with other internal and external  systems and networks including the Internet, thereby increasing the  number of avenues of attack and expanding their attack surface.
In addition, cyber threats to systems supporting the federal government  and critical infrastructure are evolving and becoming more sophisticated.  These threats come from a variety of sources and vary in terms of the  types and capabilities of the actors, their willingness to act, and their  motives. For example, foreign nations—where adversaries possess  sophisticated levels of expertise and significant resources to pursue their  objectives—pose increasing risks.
Risks to cyber assets can originate from unintentional and intentional  threats. These include insider threats from disaffected or careless  employees and business partners, escalating and emerging threats from  around the globe, the steady advances in the sophistication of attack  technology, and the emergence of new and more destructive attacks.  Ineffectively protecting cyber assets can facilitate security incidents and  cyberattacks that disrupt critical operations; lead to inappropriate access  to and disclosure, modification, or destruction of sensitive information;  and threaten national security, economic well-being, and public health  and safety.
Until fiscal year 2016, the number of information security incidents  reported by federal agencies to the Department of Homeland Security’s  (DHS) U.S. Computer Emergency Readiness Team (US-CERT) had  steadily increased each year. From fiscal year 2006 through fiscal year  2015, reported security incidents increased from 5,503 to 77,183, an  increase of 1,303 percent. However, the number of reported incidents  decreased by 56 percent in fiscal year 2016 to 33,632, as shown in figure  1.
An official from DHS’s National Cybersecurity and Communications  Integration Center stated that the decrease in reported incidents for fiscal  year 2016 was likely due to revised incident reporting requirements that  no longer require agencies to report non-cyber incidents or attempted  scans or probes of agency networks. The official also cited the expanded  use of the National Cybersecurity Protection System to detect or block  potentially malicious network traffic entering networks at federal agencies  as another possible reason for fewer reported incidents.
Safeguarding federal computer systems and the systems that support  critical infrastructures—referred to as cyber critical infrastructure  protection—has been a long-standing concern. GAO first designated information security as a government-wide high-risk area in 1997; it then  expanded this high risk area to include the protection of critical cyber  infrastructure in 2003 and protecting the privacy of PII in 2015.
Over the last several years, GAO has made about 2,500  recommendations to agencies aimed at improving the security of federal  systems and information. These recommendations identified actions for  agencies to take to strengthen technical security controls over their  computer networks and systems. They also include recommendations for  agencies to fully implement aspects of their information security  programs, as mandated by the Federal Information Security  Modernization Act (FISMA) of 2014 and its predecessor, the Federal  Information Security Management Act of 2002, as well as to protect the  privacy of PII held on their systems. Nevertheless, many agencies  continue to be challenged in safeguarding their information systems and  information, in part because many of these recommendations have not  been implemented. As of February 2017, about 1,000 of our information  security-related recommendations had not been implemented.
subsections: section_title: Action Is Needed to Address Ongoing Cybersecurity and Privacy Challenges
paragraphs: Our work has identified the need for improvements in the federal  government’s approach to cybersecurity of its systems and those  supporting the nation’s critical infrastructures and in protecting the privacy  of PII. While previous administrations and agencies have acted to  improve the protections over the information and information systems  supporting federal operations and U.S. critical infrastructure, additional  actions are needed.
Federal agencies need to effectively implement risk-based entity- wide information security programs consistently over time. Since the  first FISMA was enacted in 2002, agencies have been challenged to fully  and effectively develop, document, and implement the entity-wide  information security program required by FISMA to protect the information  and information systems that support their operations and assets,  including those provided or managed by another agency or contractor.  For example, as of February 7, 2017, 19 of 23 federal agencies covered  by the Chief Financial Officers Act (CFO Act) that had issued their  required annual financial reports for fiscal year 2016 reported that  information security control deficiencies were either a material weakness  or significant deficiency in internal controls over financial reporting for  fiscal year 2016. In addition, inspectors general at 20 of the 23 agencies  identified information security as a major management challenge for their  agencies.
Further, in light of these challenges, we have identified a number of  actions to assist agencies in implementing their information security  programs.
Enhance capabilities to effectively identify cyber threats to agency  systems and information. A key activity for assessing cybersecurity  risk and selecting appropriate mitigating controls is the identification of  cyber threats to computer networks, systems, and information. In  2016, we reported on several factors that agencies identified as  impairing their ability to identify these threats to a great or moderate  extent. The impairments included an inability to recruit and retain  personnel with the appropriate skills, rapidly changing threats,  continuous changes in technology, and a lack of government-wide  information sharing mechanisms. Addressing these impairments will  enhance the ability of agencies to identify the threats to their systems  and information and be in a better position to select and implement  appropriate countermeasures.
Implement sustainable processes for securely configuring operating  systems, applications, workstations, servers, and network devices.  We routinely determine that agencies do not enable key information  security capabilities of their operating systems, applications,  workstations, servers, and network devices. Agencies were not  always aware of the insecure settings that introduced risk to the  computing environment. Establishing strong configuration standards  and implementing sustainable processes for monitoring and enabling  configuration settings will strengthen the security posture of federal  agencies.
Patch vulnerable systems and replace unsupported software. Federal  agencies consistently fail to apply critical security patches on their  systems in a timely manner, sometimes doing so years after the patch  becomes available. We also consistently identify instances where  agencies use software that is no longer supported by their vendors.  These shortcomings often place agency systems and information at  significant risk of compromise, since many successful cyberattacks  exploit known vulnerabilities associated with software products. Using  vendor-supported and patched software will help to reduce this risk.
Develop comprehensive security test and evaluation procedures and  conduct examinations on a regular and recurring basis. Federal  agencies we reviewed often did not test or evaluate their information  security controls in a comprehensive manner. The evaluations were  sometimes based on interviews and document reviews, limited in  scope, and did not identify many of the security vulnerabilities that our  examinations identified. Conducting in-depth security evaluations that  examine the effectiveness of security processes and technical  controls is essential for effectively identifying system vulnerabilities  that place agency systems and information at risk.
Strengthen oversight of contractors providing IT services. As  demonstrated by the OPM data breach of 2015, cyber attackers can  sometimes gain entry to agency systems and information through the  agency’s contractors or business partners. Accordingly, agencies  need to assure that their contractors and partners are adequately  protecting the agency’s information and systems. In August 2014, we  reported that five of six selected agencies were inconsistent in  overseeing the execution and review of security assessments that  were intended to determine the effectiveness of contractor  implementation of security controls, resulting in security lapses. In  2016, agency chief information security officers (CISOs) we surveyed  reported that they were challenged to a large or moderate extent in  overseeing their IT contractors and receiving security data from the  contractors. This challenge diminished their ability to assess how well  agency information maintained by the contractors is protected.  Effectively overseeing and reviewing the security controls  implemented by contractors and other parties is essential to ensuring  that the agency’s information is properly safeguarded.
We have several ongoing and planned audit engagements that will  continue to assess the effectiveness of agency actions to implement  information security programs. These engagements include in-depth  assessments of information security programs at individual agencies  including OPM and the Centers for Disease Control and Prevention as  well as our biennial review of the adequacy of agencies’ information  security policies and practices and their compliance with the provisions of  FISMA.
Also, on an annual basis, we evaluate information security controls over  financial systems and information at seven agencies and incorporate the  audit results of agency offices of inspector general during our annual  audit of the consolidated financial statements of the federal government.  In addition, we are currently conducting an assessment of the Federal  Risk Authorization and Management Program and have plans to review  cyber risk management practices and continuous monitoring programs at  federal agencies.
The federal government needs to improve its cyber incident  detection, response, and mitigation capabilities. Even agencies or  organizations with strong security can fall victim to information security  incidents due to the existence of previously unknown vulnerabilities that  are exploited by attackers to intrude into an agency’s information  systems. Accordingly, agencies need to have effective mechanisms for  detecting, responding to, and recovering from such incidents. We have  previously identified various actions that could assist the federal  government in building its capabilities for detecting, responding to, and  recovering from security incidents.
Expand capabilities, improve planning, and support wider adoption of  the government-wide intrusion detection and prevention system. In  January 2016, we reported that DHS’s National Cybersecurity  Protection System (NCPS) had limited capabilities for detecting and  preventing intrusions, conducting analytics, and sharing information.  In addition, adoption of these capabilities at federal agencies was  limited. We noted that expanding NCPS’s capabilities for detecting  and preventing malicious traffic, defining requirements for future  capabilities, and developing network routing guidance could increase  assurance of the system’s effectiveness in detecting and preventing  computer intrusions and support wider adoption by agencies.
Improve cyber incident response practices at federal agencies. In  April 2014 we reported that 24 major federal agencies did not  consistently demonstrate that they had effectively responded to cyber  incidents. For example, six agencies reviewed had not determined  the impact of incidents or taken actions to address the underlying  control weaknesses that allowed the incidents to occur, in part  because they had not developed comprehensive policies, plans, and  procedures for responding to security incidents, and had not tested  their incident response capabilities. By developing comprehensive  incident response policies, plans, and procedures for responding to  incidents and effectively overseeing response activities, agencies will  have increased assurance that they will effectively respond to cyber  incidents.
Update federal guidance on reporting data breaches and develop  consistent responses to breaches of PII. As we reported in December  2013, eight agencies that we reviewed did not consistently implement  policies and procedures for responding to breaches of PII. For  example, none of the agencies had documented the evaluation of  incidents and lessons learned. In addition, we noted that OMB  guidance calling for agencies to report each PII-related incident— even those with inherently low risk to the individuals affected—within  1 hour of discovery may cause agencies to expend resources to meet  reporting requirements that provide little value and divert time and  attention from responding to breaches. We recommended that OMB  update it guidance on federal agencies’ responses to a PII-related  data breach and that the agencies we reviewed take steps to improve  their response to data breaches involving PII. Updating guidance and  consistently implementing breach response practices will improve the  effectiveness of governmentwide and agency data breach response  programs.
GAO routinely evaluates agencies’ intrusion detection, response, and  mitigation activities during audits of agency information security controls  and programs. We plan to continue to do so during ongoing and future  engagements. In addition, the Cybersecurity Act of 2015 contains a  provision for us to study and publish a report by December 2018 on the  effectiveness of the approach and strategy of the federal government to  secure agency information systems, including the intrusion detection and  prevention capabilities and the government’s intrusion assessment plan.
The federal government needs to expand its cyber workforce  planning and training efforts. Ensuring that the government has a  sufficient number of cybersecurity professionals with the right skills and  that its overall workforce is aware of information security responsibilities  remains an ongoing challenge.
Enhance efforts for recruiting and retaining a qualified cybersecurity  workforce. This has been a long-standing dilemma for the federal  government. In 2013, agency chief information officers and experts  we surveyed cited weaknesses in education, awareness, and  workforce planning as a root cause in hindering improvements in the  nation’s cybersecurity posture. Several experts also noted that the  cybersecurity workforce was inadequate, both in numbers and  training. They cited challenges such as the lack of role-based  qualification standards and difficulties in retaining cyber professionals.  In 2016, agency chief information security officers we surveyed cited  difficulties related to having sufficient staff; recruiting, hiring, and  retaining security personnel; and ensuring that security personnel  have appropriate skills and expertise as posing challenges to their  abilities to carry out their responsibilities effectively.
Improve cybersecurity workforce planning activities at federal  agencies. In November 2011, we reported that only five of eight  selected agencies had developed workforce plans that addressed  cybersecurity. Further, all eight agencies reported challenges with  filling cybersecurity positions, and only three of the eight had a  department-wide training program for their cybersecurity workforce.
GAO has two current engagements to further review cybersecurity  workforce issues in the federal government. The Homeland Security  Cybersecurity Workforce Assessment Act of 2014 contains a provision  for us to monitor, analyze, and report by December 2017 on the  Department of Homeland Security’s implementation of the National  Cybersecurity Workforce Measurement Initiative. In addition, the  Cybersecurity Act of 2015 calls for us to monitor, analyze, and submit a  report by December 2018 on the implementation of this initiative and the  identification of cyber-related work roles of critical need by federal  agencies.
The federal government needs to expand efforts to strengthen  cybersecurity of the nation’s critical infrastructures. U.S. critical  infrastructures such as financial institutions, energy production and  transmission facilities, and communications networks, are vital to the U.S.  security, economy, and public health and safety. Similar to federal systems, the systems supporting critical infrastructures face an evolving  array of cyber-based threats. To help secure infrastructure cyber assets— most of which is owned and operated by the private sector—federal policy  and the National Infrastructure Protection Plan provide for a public- private partnership in which federal agencies support or assist their  private sector partners in securing systems supporting critical  infrastructure. We have identified the following actions that can assist  agencies in performing these vital services.
Develop metrics to assess the effectiveness of efforts promoting the  NIST cybersecurity framework. In December 2015, we reported that  NIST and other agencies had promoted the adoption of the  Framework for Improving Critical Infrastructure Cybersecurity to  critical infrastructure owners and operators and other organizations.  Toward this end, DHS established the Critical Infrastructure Cyber  Community Voluntary Program to encourage entities to adopt the  framework. However, DHS had not developed metrics to measure the  success of its activities and programs. In addition, DHS and the  General Services Administration had not determined whether to  develop tailored guidance for implementing the framework in  government facilities sector as other agencies had done for their  respective sectors. DHS concurred with our recommendation to  develop metrics, but has not indicated that it has taken action, and  DHS and the General Services Administration concurred with our  recommendation to determine whether tailored guidance was needed.
Develop metrics to measure and report on the effectiveness of cyber  risk mitigation activities and the cybersecurity posture of critical  infrastructure sectors. In November 2015, we reported that all eight  sector-specific agencies reviewed had determined the significance of  cyber risk to the nation’s critical infrastructures and had taken actions  to mitigate cyber risks and vulnerabilities for their respective sectors.  However, not all sector-specific agencies had metrics to measure and  report on the effectiveness of all their activities to mitigate cyber risks  or their sectors’ cybersecurity posture. We recommended that  agencies lacking metrics develop them and determine how to  overcome any challenges to reporting the results of their activities to  mitigate cyber risks. Four of the agencies explicitly agreed with our  recommendations and identified planned or on-going efforts to  implement performance metrics; however, they have not yet provided  metrics or reports of outcomes.
GAO has several ongoing and planned engagements that will touch on  the cybersecurity of national critical infrastructures. Among these  engagements, our study of the “Internet of things” addresses the security  and privacy implications of this phenomenon. In addition, the  Cybersecurity Enhancement Act of 2014 contains a provision for us to  assess the extent to which critical infrastructure sectors have adopted a  voluntary cybersecurity framework to reduce cyber risks and the success  of such a framework for protecting critical infrastructure against cyber  threats. We also plan to review the cybersecurity of oil and gas pipeline  control systems and the Department of Homeland Security’s efforts to  share cyber information with federal and non-federal entities.
The federal government needs to better oversee protection of PII.  Regarding PII, advancements in technology, such as new search  technology and data analytics software for searching and collecting  information, have made it easier for individuals and organizations to  correlate data and track it across large and numerous databases. In  addition, lower data storage costs have made it less expensive to store  vast amounts of data. Also, ubiquitous Internet and cellular connectivity  make it easier to track individuals by allowing easy access to information  pinpointing their locations. These advances—combined with the  increasing sophistication of hackers and others with malicious intent, and  the extent to which both federal agencies and private companies collect  sensitive information about individuals—have increased the risk of PII  being exposed and compromised. Our work has identified the following  actions that need to be taken to better protect the privacy of personal  information.
Protect the security and privacy of electronic health information. In  August 2016, we reported that guidance for securing electronic health  information issued by Department of Health and Human Services  (HHS) did not address all key controls called for by other federal  cybersecurity guidance. In addition, this department’s oversight  efforts did not always offer pertinent technical guidance and did not  always follow up on corrective actions when investigative cases were  closed. HHS generally concurred with the five recommendations we  made and stated that it would take actions to implement them.
Ensure privacy when face recognition systems are used. In May 2016,  we reported that the Department of Justice had not been timely in  publishing and updating privacy documentation for the Federal  Bureau of Investigation’s (FBI) use of face recognition technology.  Publishing such documents in a timely manner would better assure  the public that the FBI is evaluating risks to privacy when  implementing systems. Also, the FBI had taken limited steps to  determine whether the face recognition system it was using was  sufficiently accurate. We recommended that the department ensure  required privacy-related documents are published and that the FBI  test and review face recognition systems to ensure that they are  sufficiently accurate. Of the six recommendations we made, the  Department of Justice agreed with one, partially agreed with two, and  disagreed with three. The agency has not yet provided information  about the actions it has taken to address the recommendations.
Protect the privacy of users’ data on state-based marketplaces. In  March 2016, we reported on weaknesses in technical controls for the  “data hub” that the Centers for Medicare and Medicaid Services  (CMS) uses to exchange information between its health insurance  marketplace and external partners. We also identified significant  weaknesses in the controls in place at three selected state-based  marketplaces established to carry out provisions of the Patient  Protection and Affordable Care Act. We recommended that CMS  define procedures for overseeing the security of state-based  marketplaces and require continuous monitoring of state marketplace  controls. HHS concurred with our recommendations and stated it has  taken or plans to take actions to address these recommendations.
GAO has several ongoing and planned reviews that address actions  intended to protect the privacy of PII. For example, we are assessing  agency efforts and government-wide initiatives to reduce or eliminate the  use of Social Security numbers. In addition, the Cybersecurity Act of 2015  calls for us to review and report by December 2018 on agency policies  and actions taken by the federal government to remove PII from shared  cyber threat indicators or defensive measures. Further, the 21st Century  Cures Act of 2016 requires us to review and report by December 2018 on  the policies and activities of the Office of the National Coordinator for  Health Information Technology to ensure appropriate matching to protect  patient privacy and security with respect to electronic health records.
section_title: Several Recommendations Made by the Cybersecurity Commission and CSIS Are Generally Consistent with GAO’s Recommendations for Improving Cybersecurity
paragraphs: Recent reports by the Cybersecurity Commission and CSIS identify  topical areas and numerous recommendations for the new administration  to consider as it develops and implements cybersecurity strategy and  policy. In its study, the Commission focused on 10 cybersecurity topics  including international issues, critical infrastructure, cybersecurity  research and development, cybersecurity workforce, and the Internet of  Things. CSIS addressed similar topics and identified five major issues  related to international strategy, securing government agencies and  critical infrastructure, cybersecurity research and workforce development,  cybercrime, and defending cyberspace.
Over the last several years, GAO has reviewed many of the areas  covered by the Commission and CSIS reports. Our conclusions and  recommendations are generally directed to specific agencies and may be  more limited in scope than the recommendations of the Commission and  CSIS. Nevertheless, several of our recommendations are generally  consistent with or similar to recommendations made by the Commission  and CSIS in the following areas:  International cybersecurity strategy. In July 2010, we identified a  number of challenges confronting U.S. involvement in global  cybersecurity and governance. These include developing a  comprehensive national strategy; ensuring international standards  and policies do not pose unnecessary barriers to U.S. trade;  participating in international cyber-incident response and appropriately  sharing information without jeopardizing national security;  investigating and prosecuting transnational cybercrime; and  contending with differing laws and norms of behavior. We made five  recommendations to the administration’s cybersecurity coordinator to  address these challenges, to include developing a comprehensive  national global cyberspace strategy and defining cyberspace norms.  In their recent reports, the Commission and CSIS also identified  actions for enhancing international cybersecurity strategy and policies  and agreeing on norms of behavior with like-minded nations.
Protecting cyber critical infrastructure. In November 2015, we reported  that sector specific agencies—federal agencies that are responsible  for collaborating with their private sector counterparts in their assigned  critical infrastructure sectors—were acting to address sector cyber risk  by sharing information, supporting incident response activities, and  providing technical assistance. However, they had not developed  metrics to measure and improve the effectiveness of their cyber risk  mitigation activities or their sectors’ cybersecurity posture. We  recommended that the agencies develop performance metrics to  monitor and improve the effectiveness of their cyber risk mitigation  activities. In their recent reports, the Commission and CSIS also  identified actions for enhancing the public-private partnership,  including improving information sharing, incident response  capabilities, and cyber risk management practices.
Promoting Use of the NIST Cybersecurity Framework. In December  2015, we reported that NIST had developed a set of voluntary  standards and procedures for enhancing cybersecurity of critical  infrastructure, known as the Framework for Improving Critical  Infrastructure Cybersecurity. We also reported that although DHS had  established a program dedicated to encouraging the framework’s  adoption, it had not established metrics to assess the effectiveness of  these efforts. We recommended that DHS develop metrics for  measuring the effectiveness of efforts to promote and support the  framework. Similarly, both the Commission and CSIS have  recommended actions to promote and measure use of the framework.
Prioritizing cybersecurity research and development (R&D). In June  2010, we reported that the federal government lacked a prioritized  national R&D agenda and a data repository to track research and  development projects and funding, as required by law. We  recommended that the Office of Science and Technology Policy  (OSTP) take several steps, including developing a comprehensive  national R&D agenda that identifies priorities for short-term, mid-term,  and long-term complex R&D projects and is guided by input from the  public and private sectors. Similarly, in its report, the Commission  stated that OSTP, as part of an overall R&D agenda, should lead the  development of an integrated government-private-sector cybersecurity  roadmap for developing defensible systems.
Expanding cybersecurity workforce capabilities. As discussed earlier  in this statement, we have reported that ensuring that the government  has a sufficient number of cybersecurity professionals with the right  skills and that its overall workforce is aware of information security  responsibilities remains an ongoing challenge. Consistent with this  view, the Commission and CSIS have identified actions to address  improving the nation’s cybersecurity workforce, including increasing  the number of cybersecurity practitioners; implementing a range of  education and training programs at the federal, state, and local levels;  providing incentives for individuals to enter the workforce; and  allocating additional funds at key departments for cybersecurity  education and training programs.
Combatting cybercrime. In June 2007, we identified a number of  challenges impeding public and private entities efforts in mitigating  cybercrime, including working in a borderless environment with laws  of multiple jurisdictions. We stated that efforts to investigate and  prosecute cybercrime are complicated by the multiplicity of laws and  procedures that govern in the various nations and states where  victims may be found, and the conflicting priorities and varying  degrees of expertise of law enforcement authorities in those  jurisdictions. In addition, laws used to address cybercrime differ  across states and nations. For example, an act that is illegal in the  United States may be legal in another nation or not directly addressed  in the other nation’s laws. Developing countries, for example, may  lack cybercrime laws and enforcement procedures. In its recent  report, CSIS stated that many countries still do not have adequate  cybercrime laws and recommended that (1) countries that refuse to  cooperate with law enforcement should be penalized in some way and  (2) methods be found to address the concerns of countries not willing  to sign an existing treaty addressing cybercrime.
In summary, the dependence of the federal government and the nation’s  critical infrastructure on computerized information systems and electronic  data makes them potentially vulnerable to a wide and evolving array of  cyber-based threats. Securing these systems and data is vital to the  nation’s security, prosperity, and well-being. Nevertheless, the security  over these systems is inconsistent and additional actions are needed to  address ongoing cybersecurity and privacy challenges. Specifically,  federal agencies need to address control deficiencies and fully implement  organization-wide information security programs, cyber incident response  and mitigation efforts needs to be improved across the government,  maintaining a qualified cybersecurity workforce needs to be a priority,  efforts to bolster the cybersecurity of the nation’s critical infrastructure  needs to be strengthened, and the privacy of PII needs to be better  protected. Several recommendations made by the Commission and CSIS  are generally consistent with previous recommendations made by GAO  and warrant close consideration.
Chairwoman Comstock, Ranking Member Lipinski, and Members of the  Subcommittee, this concludes my statement. I would be happy to respond  to your questions.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you or your staff have any questions about this testimony, please  contact Gregory C. Wilshusen at (202) 512-6244 or  wilshuseng@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. GAO staff who made key contributions to this testimony are  Michael Gilmore, Nancy Glover, and Kush Malhotra.
section_title: Related GAO Products
paragraphs: GAO, Cybersecurity: DHS’s National Integration Center Generally  Performs Required Functions but Needs to Evaluate Its Activities More  Completely, GAO-17-163 (Washington, D.C.: Feb. 1, 2017).
GAO, Federal Information Security: Actions Needed to Address  Challenges, GAO-16-885T (Washington, D.C.: Sept. 19, 2016).
GAO, Federal Chief Information Security Officers: Opportunities Exist to  Improve Roles and Address Challenges to Authority, GAO-16-686.  (Washington, D.C.: Aug. 26, 2016).
GAO, Electronic Health Information: HHS Needs to Strengthen Security  and Privacy Guidance and Oversight, GAO-16-771 (Washington, D.C.:  Aug. 26, 2016).
GAO, Face Recognition Technology: FBI Should Better Ensure Privacy  and Accuracy, GAO-16-267 (Washington, D.C.: May 16, 2016) (Reissued  August 3, 2016).
GAO, Information Security: Agencies Need to Improve Controls over  Selected High-Impact Systems, GAO-16-501 (Washington, D.C.: May 18,  2016).
GAO, Healthcare.gov: Actions Needed to Enhance Information Security  and Privacy Controls, GAO-16-265 (Washington, D.C.: Mar. 23, 2016).
GAO, Information Security: DHS Needs to Enhance Capabilities, Improve  Planning, and Support Greater Adoption of Its National Cybersecurity  Protection System, GAO-16-294 (Washington, D.C.: Jan. 28, 2016).
GAO, Critical Infrastructure Protection: Measures Needed to Assess  Agencies’ Promotion of the Cybersecurity Framework, GAO-16-152  (Washington, D.C.: Dec. 17, 2015).
GAO, Critical Infrastructure Protection: Sector-Specific Agencies Need to  Better Measure Cybersecurity Progress, GAO-16-79, (Washington, D.C.:  Nov. 19, 2015).
GAO, Cybersecurity: National Strategy, Roles, and Responsibilities Need  to Be Better Defined and More Effectively Implemented, GAO-13-187  (Washington, D.C.: Feb. 14, 2013).
GAO, Cybersecurity Human Capital: Initiatives Need Better Planning and  Coordination, GAO-12-8 (Washington, D.C.: Nov. 29, 2011).
GAO, Cyberspace: United States Faces Challenges in Addressing Global  Cybersecurity and Governance, GAO-10-606 (Washington, D.C.: July 2,  2010).
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.