Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical Systems and Information
Published: 2009-06-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal laws and policy have assigned important roles and responsibilities to the Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST) for securing computer networks and systems. DHS is charged with coordinating the protection of computer-reliant critical infrastructure--much of which is owned by the private sector--and securing its own computer systems, while NIST is responsible for developing standards and guidelines for implementing security controls over information and information systems. GAO was asked to describe cybersecurity efforts at DHS and NIST--including partnership activities with the private sector--and the use of cybersecurity performance metrics in the federal government. To do so, GAO relied on its reports on federal information security and federal efforts to fulfill national cybersecurity responsibilities.
section_title: What GAO Found
paragraphs: Since 2005, GAO has reported that DHS has yet to comprehensively satisfy its key cybersecurity responsibilities, including those related to establishing effective partnerships with the private sector. Shortcomings exist in key areas that are essential for DHS to address in order to fully implement its cybersecurity responsibilities. DHS has since developed and implemented certain capabilities, but still has not fully satisfied aspects of these responsibilities and needs to take further action to enhance the public/private partnerships needed to adequately protect cyber critical infrastructure. GAO has also previously reported on significant security weaknesses in systems supporting two of the department's programs, one that tracks foreign nationals entering and exiting the United States, and one for matching airline passenger information against terrorist watch-list records. DHS has corrected information security weaknesses for systems supporting the terrorist watch-list, but needs to take additional actions to mitigate vulnerabilities associated with systems tracking foreign nationals. NIST plays a key role in providing important information security standards and guidance. Pursuant to its responsibilities under the Federal Information Security Management Act (FISMA), NIST has developed standards specifying minimum security requirements for federal information and information systems; and provided corresponding guidance that details the controls necessary for securing those systems. It has also been working with both public and private sector entities to enhance information security requirements. The resulting guidance and tools provided by NIST serve as important resources for federal agencies that can be applied to information security programs. As GAO recently testified in May, opportunities exist to improve the metrics used to assess agency information security programs. According to the performance metrics established by the Office of Management and Budget (OMB), agencies reported increased compliance in implementing key information security control activities. However, GAO and agency inspectors general continue to report significant weaknesses in controls. This dichotomy exists in part because the OMB-defined metrics generally do not measure how well controls are implemented. As a result, reported metrics may provide an incomplete picture of an agency's information security program.

section_title: Letter
paragraphs: Thank you for the opportunity to participate in today’s hearing on  computer-based (cyber) security activities at the Department of Homeland  Security (DHS) and the National Institute of Standards and Technology  (NIST). Cybersecurity is a critical consideration for any organization that  depends on information systems and computer networks to carry out its  mission or business. The need for a vigilant approach to cybersecurity has  been demonstrated by the pervasive and sustained cyber attacks against  the United States and others that continue to pose significant risks to  computer systems and networks and the operations and critical  infrastructures that they support.
In my testimony today, I will describe cybersecurity activities at DHS and  NIST, including those activities related to establishing public/private  partnerships with the owners of critical infrastructure. In addition, I will  discuss the use of cybersecurity-related metrics in the federal government.  In preparing for this testimony, we relied on our previous reports on  federal information security and on DHS’s efforts to fulfill its national  cybersecurity responsibilities. We also relied on a draft report of our  review of agencies’ implementation of the Federal Information Security  Management Act (FISMA). These reports contain detailed overviews of  the scope of our work and the methodology we used.
The work on which this testimony is based was performed in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform audits to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on our  audit objectives.
subsections: section_title: Background
paragraphs: As computer technology has advanced, federal agencies have become  dependent on computerized information systems to carry out their  operations and to process, maintain, and report essential information.
Virtually all federal operations are supported by computer systems and  electronic data, and agencies would find it difficult, if not impossible, to  carry out their missions, deliver services to the public, and account for  their resources without these cyber assets. Information security is thus  especially important for federal agencies to ensure the confidentiality,  integrity, and availability of their systems and data. Conversely, ineffective  information security controls can result in significant risk to a broad array  of government operations and assets, as the following examples illustrate:    Computer resources could be used for unauthorized purposes or to launch  attacks on other computer systems.
Sensitive information, such as personally identifiable information,  intellectual property, and proprietary business information could be  inappropriately disclosed, browsed, or copied for purposes of identity  theft, espionage, or other types of crime.
Critical operations, such as those supporting critical infrastructure,  national defense, and emergency services, could be disrupted.
Data could be added, modified, or deleted for purposes of fraud,  subterfuge, or disruption.
Government officials are increasingly concerned about attacks from  individuals and groups with malicious intent, such as criminals, terrorists,  and adversarial foreign nations. For example, in February 2009, the  Director of National Intelligence testified that foreign nations and  criminals have targeted government and private sector networks to gain a  competitive advantage and potentially disrupt or destroy them, and that  terrorist groups have expressed a desire to use cyber attacks as a means to  target the United States.  The growing connectivity between information  systems, the Internet, and other infrastructures creates opportunities for  attackers to disrupt telecommunications, electrical power, and other  critical infrastructures. As government, private sector, and personal  activities continue to move to networked operations, digital systems add  ever more capabilities, wireless systems become more ubiquitous, and the  design, manufacture, and service of information technology have moved  overseas, the threat will continue to grow.
subsections: section_title: DHS Is a Focal Point for National Cybersecurity Efforts
paragraphs: Federal law and policy establish DHS as the focal point for efforts to  protect our nation’s computer-reliant critical infrastructures —a practice  known as cyber critical infrastructure protection, or cyber CIP. In this  capacity, the department has multiple cybersecurity-related roles and  responsibilities. In 2005, we identified, and reported on, 13 key  cybersecurity responsibilities. They include, among others, (1) developing  a comprehensive national plan for CIP, including cybersecurity; (2)  developing partnerships and coordinating with other federal agencies,  state and local governments, and the private sector; (3) developing and  enhancing national cyber analysis and warning capabilities; (4) providing  and coordinating incident response and recovery planning, including  conducting incident response exercises; and (5) identifying, assessing, and  supporting efforts to reduce cyber threats and vulnerabilities, including  those associated with infrastructure control systems. Within DHS, the  National Protection and Programs Directorate has primary responsibility  for assuring the security, resiliency, and reliability of the nation’s cyber  and communications infrastructure.
DHS is also responsible for securing its own computer networks, systems,  and information. FISMA requires the department to develop and  implement an agencywide information security program to provide  security for the information and information systems that support the  operations and assets of the agency. Within DHS, the Chief Information  Officer is responsible for ensuring departmental compliance with federal  information security requirements.
section_title: NIST Is Responsible for Establishing Federal Standards and Guidance for Information Security
paragraphs: FISMA tasks NIST—a component within the Department of Commerce— with responsibility for developing standards and guidelines, including  minimum requirements, for (1) information systems used or operated by  an agency or by a contractor of an agency or other organization on behalf  of the agency and (2) providing adequate information security for all  agency operations and assets, except for national security systems. The  act specifically required NIST to develop, for systems other than national  security systems, (1) standards to be used by all agencies to categorize all  their information and information systems based on the objectives of  providing appropriate levels of information security, according to a range  of risk levels; (2) guidelines recommending the types of information and  information systems to be included in each category; and (3) minimum  information security requirements for information and information  systems in each category. NIST also is required to develop a definition of  and guidelines for detection and handling of information security incidents  as well as guidelines developed in conjunction with the Department of  Defense and the National Security Agency for identifying an information  system as a national security system. Within NIST, the Computer Security  Division of the Information Technology Laboratory is responsible for  developing information security related standards and guidelines.
FISMA also requires NIST to take other actions that include:    conducting research, as needed, to determine the nature and extent of  information security vulnerabilities and techniques for providing cost- effective information security;    developing and periodically revising performance indicators and measures  for agency information security policies and practices;    evaluating private sector information security policies and practices and  commercially available information technologies, to assess potential  application by agencies to strengthen information security; and    assisting the private sector, in using and applying the results of its  activities required by FISMA.
In addition, the Cyber Security Research and Development Act required  NIST to develop checklists to minimize the security risks for each  hardware or software system that is, or likely to become, widely used  within the federal government.
section_title: Metrics Established to Evaluate Information Security Programs
paragraphs: FISMA also requires the Office of Management and Budget (OMB) to  develop policies, principles, standards, and guidelines on information  security and to report annually to Congress on agency compliance with the  requirements of the act. OMB has provided instructions to federal agencies  and their inspectors general for preparing annual FISMA reports. These  instructions focus on metrics related to the performance of key control  activities such as developing a complete inventory of major information  systems, providing security training to personnel, testing and evaluating  security controls, testing contingency plans, and certifying and accrediting  systems. FISMA reporting provides valuable information on the status and  progress of agency efforts to implement effective security management  programs.
section_title: Recent Efforts to Improve National Cybersecurity Strategy
paragraphs: Because the threats to federal information systems and critical  infrastructure have persisted and grown, President Bush in January 2008  began to implement a series of initiatives—commonly referred to as the  Comprehensive National Cybersecurity Initiative aimed primarily at  improving DHS’s and other federal agencies’ efforts to protect against  intrusion attempts and anticipate future threats. Since then, President  Obama (in February 2009) directed the National Security Council and  Homeland Security Council to conduct a comprehensive review to assess  the United States’ cyber security related policies and structures. The  resulting report, “Cyberspace Policy Review: Assuring a Trusted and  Resilient Information and Communications Infrastructure,” recommended,  among other things, appointing an official in the White House to  coordinate the nation’s cybersecurity policies and activities, creating a  new national cybersecurity strategy, and developing a framework for  cyber research and development. In addition, we testified in March 2009  that a panel of experts identified 12 key areas of the national cybersecurity  strategy requiring improvement, such as developing a national strategy  that clearly articulates strategic objectives, goals, and priorities; bolstering  the public/private partnership; and placing a greater emphasis on  cybersecurity research and development.
section_title: DHS Has Yet to Fully Satisfy Its Cybersecurity Responsibilities
paragraphs: We have reported since 2005 that DHS has yet to comprehensively satisfy  its key responsibilities for protecting computer-reliant critical  infrastructures. Our reports included about 90 recommendations that we  summarized into key areas, including those listed in table 1, that are  essential for DHS to address in order to fully implement its  responsibilities. DHS has since developed and implemented certain  capabilities to satisfy aspects of its responsibilities, but the department  still has not fully implemented our recommendations, and thus further  action needs to be taken to address these areas.
In July 2008, we identified that cyber analysis and warning capabilities  included (1) monitoring network activity to detect anomalies, (2)  analyzing information and investigating anomalies to determine whether  they are threats, (3) warning appropriate officials with timely and  actionable threat and mitigation information, and (4) responding to the  threat. These four capabilities are comprised of 15 key attributes,  including establishing a baseline understanding of the nation’s critical  network assets and integrating analysis work into predictive analyses of  broader implications or potential future attacks.
We concluded that while DHS’s United States Computer Emergency  Readiness Team (US-CERT) demonstrated aspects of each of the key  attributes, it did not fully incorporate all of them. For example, as part of  its monitoring, US-CERT obtained information from numerous external  information sources; however, it had not established a baseline of the  nation’s critical network assets and operations. In addition, while it  investigated whether identified anomalies constituted actual cyber threats  or attacks as part of its analysis, it did not integrate its work into  predictive analyses of broader implications or potential future attacks, nor  did it have the analytical or technical resources to analyze multiple,  simultaneous cyber incidents. The organization also provided warnings by  developing and distributing a wide array of attack and other notifications;  however, these notifications were not consistently actionable or timely—  i.e., providing the right information to the right persons or groups as early  as possible to give them time to take appropriate action. Further, while the  team responded to a limited number of affected entities in its efforts to  contain and mitigate an attack, recover from damages, and remediate  vulnerabilities, it did not possess the resources to handle multiple events  across the nation.
We also concluded that without fully implementing the key attributes, US- CERT did not have the full complement of cyber analysis and warning  capabilities essential to effectively perform its national mission. As a  result, we made 10 recommendations to the department to address  shortfalls associated with the 15 attributes in order to fully establish a  national cyber analysis and warning capability. DHS concurred and agreed  to implement 9 of our 10 recommendations.
subsections: section_title: Improving Cybersecurity of Infrastructure Control Systems
paragraphs: In a September 2007 report and October 2007 testimony, we reported that  DHS was sponsoring multiple control systems security initiatives,  including an effort to improve control systems cybersecurity using  vulnerability evaluation and response tools. However, DHS had not  established a strategy to coordinate the various control systems activities  across federal agencies and the private sector, and it did not effectively  share information on control system vulnerabilities with the public and  private sectors. Accordingly, we recommended that DHS develop a  strategy to guide efforts for securing control systems and establish a rapid  and secure process for sharing sensitive control system vulnerability  information. In response, DHS recently began developing a strategy and a  process to share sensitive information.
section_title: Strengthening DHS’s Ability to Help Recovery from Internet Disruption
paragraphs: We reported and later testified in 2006 that the department had begun a  variety of initiatives to fulfill its responsibility for developing an integrated  public/private plan for Internet recovery in case of a major disruption.  However, we determined that these efforts were not comprehensive or  complete. As such, we recommended that DHS implement nine actions to  improve the department’s ability to facilitate public/private efforts to  recover the Internet.
In October 2007, we testified that the department had made progress in  implementing our recommendations; however, seven of the nine had not  been completed. For example, it revised key plans in coordination with  private industry infrastructure stakeholders, coordinated various Internet  recovery-related activities, and addressed key challenges to Internet  recovery planning. However, it has not, among other things, finalized  recovery plans and defined the interdependencies among DHS’s various  working groups and initiatives. In other words, it has not completed an  integrated private/public plan for Internet recovery. As a result, we  concluded that the nation lacked direction from the department on how to  respond in such a contingency. We also noted that these incomplete  efforts indicated that DHS and the nation were not fully prepared to  respond to a major Internet disruption. To date, an integrated  public/private plan for Internet recovery does not exist.
section_title: Reducing Organizational Inefficiencies
paragraphs: In June 2008, we reported on the status of DHS’s efforts to establish an  integrated operations center that it agreed to adopt per recommendations  from a DHS-commissioned expert task force. We determined that while  DHS had taken the first step towards integrating two operations centers— the National Coordination Center Watch and US-CERT, it had yet to  implement the remaining steps, complete a strategic plan, or develop  specific tasks and milestones for completing the integration. We  concluded that until the two centers were fully integrated, DHS was at risk  of being unable to efficiently plan for and respond to disruptions to  communications infrastructure and the data and applications that travel  on this infrastructure, increasing the probability that communications will  be unavailable or limited in times of need. As a result, we recommended  that the department complete its strategic plan and define tasks and  milestones for completing remaining integration steps so that we are  better prepared to provide an integrated response to disruptions to the  communications infrastructure. DHS concurred with our first  recommendation and stated that it would address the second  recommendation as part of finalizing its strategic plan.
section_title: Completing Corrective Actions Identified During a Cyber Exercise
paragraphs: In September 2008, we reported on a major DHS-coordinated cyber  attack exercise called Cyber Storm, which occurred in 2006 and included  large-scale simulations of multiple concurrent attacks involving the federal  government, states, foreign governments, and private industry. We  determined that DHS had identified eight lessons learned from this  exercise, such as the need to improve interagency coordination groups  and the exercise program. We also concluded that while DHS had  demonstrated progress in addressing the lessons learned, more needed to  be done. Specifically, while the department completed 42 of the 66  activities identified to address the lessons learned, it identified 16  activities as ongoing and 7 as planned for the future. In addition, DHS  provided no timetable for the completion dates of the ongoing activities.  We noted that until DHS scheduled and completed its remaining activities,  it was at risk of conducting subsequent exercises that repeated the lessons  learned during the first exercise. Consequently, we recommended that  DHS schedule and complete the identified corrective activities so that its  cyber exercises can help both public and private sector participants  coordinate their responses to significant cyber incidents. DHS agreed with  the recommendation. To date, DHS has continued to make progress in  completing some identified activities but has yet to do so for others.
section_title: Developing Sector Specific Plans that Fully Address All of the Cyber-Related Criteria
paragraphs: In 2007, we reported and testified on the cybersecurity aspects of CIP  plans for 17 critical infrastructure sectors, referred to as sector-specific  plans. Lead federal agencies, referred to as sector-specific agencies, are  responsible for coordinating critical infrastructure protection efforts with  the public and private stakeholders in their respective sectors. DHS  guidance requires each of the sector-specific agencies to develop plans to  address how the sectors’ stakeholders would implement the national plan  and how they would improve the security of their assets, systems,  networks, and functions.
We determined that none of the plans fully addressed the 30 key  cybersecurity-related criteria described in DHS guidance. Further, while  several sectors’ plans fully addressed many of the criteria, others were less  comprehensive. In addition to the variations in the extent to which the  plans covered aspects of cybersecurity, there was also variance among the  plans in the extent to which certain criteria were addressed. Consequently,  we recommended that DHS request that the sector-specific agencies,  fully address all cyber-related criteria by September 2008 so that  stakeholders within the infrastructure sectors will effectively identify,  prioritize, and protect the cyber aspects of their CIP efforts. We are  currently reviewing the progress made in the sector specific plans.
We testified in March 2009 regarding the need to bolster public/private  partnerships associated with cyber CIP. According to panel members,  there are not adequate economic and other incentives (i.e. a value  proposition) for greater investment and partnering with owners and  operators of critical cyber assets and functions. Accordingly, panelists  stated that the federal government should provide valued services (such as  offering useful threat or analysis and warning information) or incentives  (such as grants or tax reductions) to encourage action by and effective  partnerships with the private sector. They also suggested that public and  private sector entities use means such as cost-benefit analyses to ensure  the efficient use of limited cybersecurity-related resources. We are also  currently initiating a review of the status of the public/private partnerships  in cyber CIP.
section_title: Securing Internal Information Systems
paragraphs: Besides weaknesses relating to external cybersecurity responsibilities,  DHS had not secured its own information systems. In July 2007, we  reported that DHS systems supporting the US-VISIT program were  riddled with significant information security control weaknesses that  place sensitive information—including personally identifiable  information—at increased risk of unauthorized and possibly undetected  disclosure and modification, misuse, and destruction, and place program  operations at increased risk of disruption. Weaknesses existed in all  control areas and computing device types reviewed. For example, DHS  had not implemented controls to effectively prevent, limit, and detect  access to computer networks, systems, and information. To illustrate, it  had not (1) adequately identified and authenticated users in systems  supporting US-VISIT, (2) sufficiently limited access to US-VISIT  information and information systems, and (3) ensured that controls  adequately protected external and internal network boundaries. In  addition, it had not always ensured that responsibilities for systems  development and system production had been sufficiently segregated, and  had not consistently maintained secure configurations on the application  servers and workstations at a key data center and ports of entry. As a  result, intruders, as well as government and contractor employees, could  potentially bypass or disable computer access controls and undertake a  wide variety of inappropriate or malicious acts. These acts could include  tampering with data; browsing sensitive information; using computer  resources for inappropriate purposes, such as launching attacks on other  organizations; and disrupting or disabling computer-supported operations.  According to the department, it has started remediation activities to  strengthen security over these systems and implement our  recommendations.
In January 2009, we briefed congressional staff on security weaknesses  associated with the development of systems supporting the Transportation  Security Administration’s (TSA) Secure Flight program. Specifically, TSA  had not taken sufficient steps to ensure that operational safeguards and  substantial security measures were fully implemented to minimize the risk  that the systems will be vulnerable to abuse and unauthorized access from  hackers and other intruders. For example, TSA had not completed testing  and evaluating key security controls, performed disaster recovery tests, or  corrected high- and moderate-risk vulnerabilities. Accordingly, we  recommended that TSA take steps to complete security testing, mitigate  known vulnerabilities, and update key security documentation prior to  initial operations. TSA subsequently undertook a number of actions to  complete these activities. In May 2009, we concluded that TSA had  generally met its requirements related to systems information security and  satisfied our recommendations.
section_title: NIST Has Developed Important Federal Information Security Standards and Guidelines
paragraphs: NIST has taken steps to address its FISMA-mandated responsibilities by  developing a suite of required security standards and guidelines as well as  other publications that are intended to assist agencies in developing and  implementing information security programs and effectively managing  risks to agency operations and assets. In addition to developing specific  standards and guidelines, NIST developed a set of activities to help  agencies manage a risk-based approach for an effective information  security program. These activities are known as the NIST Risk  Management Framework. Several special publications support this  framework and collectively provide guidance that agencies can apply to  their information security programs for selecting the appropriate security  controls for information systems—including the minimum controls  necessary to protect individuals and the operations and assets of the  organization.
NIST has developed and issued the following documents to meet its  FISMA mandated responsibilities:    Federal Information Processing Standards Publication 199, Standards for  Security Categorization of Federal Information and Information  Systems, February 2004. This standard addresses NIST’s requirement for  developing standards for categorizing information and information  systems. It requires agencies to categorize their information systems as  low-impact, moderate-impact, or high-impact for the security objectives of  confidentiality, integrity, and availability. The security categories are  based on the harm or potential impact to an organization should certain  events occur which jeopardize the information and information systems  needed by the organization to accomplish its assigned mission, protect its  assets, fulfill its legal responsibilities, maintain its day-to-day functions,  and protect individuals. Security categories are to be used in conjunction  with vulnerability and threat information in assessing the risk to an  organization.
Special Publication 800-60 Volume I, revision 1, Volume I: Guide for  Mapping Types of Information and Information Systems to Security  Categories, August 2008. This guide is to assist federal government  agencies with categorizing information and information systems. It is  intended to help agencies consistently map security impact levels to types  of (1) information (e.g., privacy, medical, proprietary, financial,  investigation); and (2) information systems (e.g., mission critical, mission  support, administrative). Furthermore, it is intended to facilitate  application of appropriate levels of information security according to a  range of levels of impact or consequences that might result from the  unauthorized disclosure, modification, or use of the information or  information system.
Federal Information Processing Standards Publication 200, Minimum  Security Requirements for Federal Information and Information  Systems, March 2006. This is the second of the mandatory security  standards and specifies minimum security requirements for information  and information systems supporting the executive agencies of the federal  government and a risk-based process for selecting the security controls  necessary to satisfy the minimum security requirements. Specifically, this  standard specifies minimum security requirements for federal information  and information systems in 17 security-related areas. Federal agencies are  required to meet the minimum security requirements through the use of  the security controls in accordance with NIST Special Publication 800-53.
Special Publication 800-61, revision 1, Computer Security Incident  Handling Guide, March 2008. This publication is intended to assist  organizations in establishing computer security incident response  capabilities and handling incidents efficiently and effectively. It provides  guidelines for organizing a computer security incident response capability;  handling incidents from initial preparation through post-incident lessons  learned phase; and handling specific types of incidents, such as denial of  service, malicious code, unauthorized access, and inappropriate usage.
Special Publication 800-59, Guideline for Identifying an Information  System as a National Security System, August 2003. The purpose of this  guide is to assist agencies in determining which, if any, of their systems  are national security systems as defined by FISMA and are to be governed  by applicable requirements for such systems.
Special Publication 800-55, revision 1, Performance Measurement Guide  for Information Security, July 2008. The purpose of this guide is to assist  in the development, selection, and implementation of measures to be used  at the information system and program levels. These measures indicate the  effectiveness of security controls applied to information systems and  supporting information security programs.
Special Publication 800-30, Risk Management Guide for Information  Technology Systems, July 2002. This guide provides a foundation for the  development of an effective risk management program, containing both  the definitions and the practical guidance necessary for assessing and  mitigating risks identified within IT systems. It also provides information  on the selection of cost-effective security controls that can be used to  mitigate risk for the better protection of mission-critical information and  the IT systems that process, store, and carry this information.
Special Publication 800-18, revision 1, Guide for Developing Security Plans  for Federal Information Systems, February 2006. This guide provides basic  information on how to prepare a system security plan and is designed to  be adaptable in a variety of organizational structures and used as a  reference by those having assigned responsibility for activities related to  security planning.
NIST is also in the process of developing, updating, and revising a number  of special publications related to information security, including the  following:    Special Publication 800-37, revision 1, Guide for Security Authorization  of Federal Information Systems, August 2008. This publication is intended  to, among other things, support the development of a common security  authorization process for federal information systems. According to NIST,  the new security authorization process changes the traditional focus from  the stove-pipe, organization-centric, static-based approaches and provides  the capability to more effectively manage information system-related  security risks in highly dynamic environments of complex and  sophisticated cyber threats, ever increasing system vulnerabilities, and  rapidly changing missions. The process is designed to be tightly integrated  into enterprise architectures and ongoing system development life cycle  processes, promote the concept of near real-time risk management, and  capitalize on current and previous investments in technology, including  automated support tools.
Special Publication 800-39, second public draft, Managing Risk from  Information Systems An Organizational Perspective, April 2008. The  purpose of this publication is to provide guidelines for managing risk to  organizational operations and assets, individuals, other organizations, and  the nation resulting from the operation and use of information systems.  According to NIST, the risk management concepts described in the  publication are intentionally broad-based, with the specific details of  assessing risk and employing appropriate risk mitigation strategies  provided by supporting NIST security standards and guidelines.
Special Publication 800-53, revision 3, Recommended Security Controls  for Federal Information Systems and Organizations, June 2009. This  publication has been updated from the previous versions to include a  standardized set of management, operational, and technical controls  intended to provide a common specification language for information  security for federal information systems processing, storing, and  transmitting both national security and non national security information.
Draft IR-7502, The Common Configuration Scoring System (CCSS):  Metrics for Software Security Configuration Vulnerabilities. This  publication defines proposed measures for the severity of software  security configuration issues and provides equations that can be used to  combine the measures into severity scores for each configuration issue.
In addition, NIST has other ongoing and planned activities that are  intended to enhance information security programs, processes, and  controls. For example, it is supporting the development of a program for  credentialing public and private sector organizations to provide security  assessment services for federal agencies. To support implementation of  the credentialing program and aid security assessments, NIST is  participating or will participate in the following initiatives:    Training includes development of training courses, NIST publication  quick start guides, and frequently asked questions to establish a common  understanding of the standards and guidelines supporting the NIST Risk  Management Framework.
Product and Services Assurance Assessment includes defining criteria  and guidelines for evaluating products and services used in the  implementation of controls outlined in NIST SP 800-53.
Support Tools includes identifying or developing common protocols,  programs, reference materials, checklists, and technical guides supporting  implementation and assessment of SP 800-53-based security controls in  information systems.
Mapping initiative includes identifying common relationships and the  mappings of FISMA standards, guidelines, and requirements with  International Organization for Standardization (ISO) standards for  information security management, quality management, and laboratory  testing and accreditation.
These planned efforts include implementing a program for validating  security tools.
subsections: section_title: Other Collaborative Activities Undertaken by NIST
paragraphs: NIST collaborated with a broad constituency—federal and nonfederal—to  develop documents to assist information security professionals. For  example, NIST worked with the Office of the Director of National  Intelligence, the Department of Defense, and the Committee on National  Security Systems to develop a common process for authorizing federal  information systems for operation. This resulted in a major revision to  NIST Special Publication 800-37, currently issued as an initial public draft.  NIST also collaborated with these organizations on Special Publication  800-53 and Special Publication 800-53A to provide guidelines for selecting  and specifying security controls for federal government information  systems and to help agencies develop plans and procedures for assessing  the effectiveness of these controls. NIST also interacted with the DHS to  incorporate guidance on safeguards and countermeasures for federal  industrial control systems in Special Publication 800-53.
NIST is also working with public and private sector entities to establish  specific mappings and relationships between the security standards and  guidelines developed by NIST and the ISO and International  Electrotechnical Commission Information Security Management System  standard. For example, the latest draft of Special Publication 800-53  introduces a three-part strategy for harmonizing the FISMA security  standards and guidelines with international security standards including  an updated mapping table for security controls.
NIST also undertook other information security activities, including    developing Federal Desktop Core Configuration checklists and    continuing a program of outreach and awareness through organizations  such as the Federal Computer Security Program Managers’ Forum and the  Federal Information Systems Security Educators’ Association.
Through NIST’s efforts, agencies have access to additional tools and  guidance that can be applied to their information security programs.
section_title: Opportunities for Improving Information Security Metrics
paragraphs: Despite federal agencies reporting increased compliance in implementing  key information security control activities for fiscal year 2008,  opportunities exist to improve the metrics used in annual reporting. The  information security metrics developed by OMB focus on compliance with  information security requirements and the implementation of key control  activities. OMB requires federal agencies to report on key information  security control activities as part of the FISMA-mandated annual report on  federal information security. To facilitate the collection and reporting of  information from federal agencies, OMB developed a suite of information  security metrics, including the following:    percentage of employees and contractors receiving security awareness    percentage of employees with significant security responsibilities  receiving specialized security training,    percentage of systems tested and evaluated annually,    percentage of systems with tested contingency plans,    percentage of agencies with complete inventories of major systems, and    percentage of systems certified and accredited.
In May 2009, we testified that federal agencies generally reported  increased compliance in implementing most of the key information  security control activities for fiscal year 2008, as illustrated in figure 1.
However, reviews at 24 major federal agencies continue to highlight  deficiencies in their implementation of information security policies and  procedures. For example, in their fiscal year 2008 performance and  accountability reports, 20 of 24 major agencies noted that their  information system controls over their financial systems and information  were either a material weakness or a significant deficiency. In addition,  23 of the 24 agencies did not have adequate controls in place to ensure  that only authorized individuals could access or manipulate data on their  systems and networks. We also reported that agencies did not consistently  (1) identify and authenticate users to prevent unauthorized access; (2)  enforce the principle of least privilege to ensure that authorized access  was necessary and appropriate; (3) establish sufficient boundary  protection mechanisms; (4) apply encryption to protect sensitive data on  networks and portable devices; and (5) log, audit, and monitor security- relevant events. Furthermore, those agencies also had weaknesses in their  agencywide information security programs.
An underlying reason for the apparent dichotomy of increased compliance  with security requirements and continued deficiencies in security controls  is that the metrics defined by OMB and used for annual information  security reporting do not generally measure the effectiveness of the  controls and processes that are key to implementing an agencywide  security program. Results of our prior and ongoing work indicated that, for  example, annual reporting did not always provide information on the  quality or effectiveness of the processes agencies use to implement  information security controls. Providing information on the effectiveness  of controls and processes could further enhance the usefulness of the data  for management and oversight of agency information security programs.
In summary, DHS has not fully satisfied aspects of its key cybersecurity  responsibilities, one of which includes its efforts to protect our nation’s  cyber critical infrastructure and still needs to take further action to  address the key areas identified in our recent reports, including enhancing  partnerships with the private sector. In addition, although DHS has taken  actions to remedy security weaknesses in its Secure Flight program, it still  needs to address our remaining recommendations for strengthening  controls for systems supporting the US-VISIT program. In taking these  actions, DHS can improve its own information security as well as increase  its credibility to external parties in providing leadership on cybersecurity.  NIST has developed a significant number of standards and guidelines for  information security and continues to assist organizations in implementing  security controls over their systems and information. While NIST’s role is  to develop guidance, it remains the responsibility of federal agencies to  effectively implement and sustain sufficient security over their systems.  Developing and using metrics that measure how well agencies implement  security controls can contribute to increased focus on the effective  implementation of federal information security.
Chairman Wu, this concludes my statement. I would be happy to answer  questions at the appropriate time.
section_title: Contact and Acknowledgements
paragraphs: If you have any questions regarding this report, please contact Gregory C.  Wilshusen, Director, Information Security Issues at (202) 512-6244 or by e- mail at wilshuseng@gao.gov. Other key contributors to this report include  Michael Gilmore (Assistant Director), Charles Vrabel (Assistant Director),  Bradley Becker, Larry Crosland, Lee McCracken, and Jayne Wilson.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.