Critical Infrastructure Protection: Observations on Key Factors in DHS's Implementation of Its Partnership Approach
Released: 2014-03-26T00:00:00

Letter

Background

Federal law and policy have established roles and responsibilities for federal agencies to work with industry in enhancing the physical and cyber-security of critical government and industry infrastructures. For example, consistent with law, presidential policies stress the importance of coordination between the government and industry to protect the nation’s cyber critical infrastructure. In addition, policies establish DHS as the focal point for the security of cyberspace—including analysis, warning, information sharing, vulnerability reduction, mitigation efforts, and recovery efforts for government and industry critical infrastructure and information systems. Federal policy also establishes critical infrastructure sectors, assigns federal agencies responsibilities over each sector (known as sector-specific agencies), and encourages industry involvement.

A fundamental component of DHS’s efforts to protect and secure our nation’s infrastructure is its partnership approach, whereby it engages in partnerships among government and industry stakeholders. In 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which provides the overarching approach for integrating the nation’s critical infrastructure protection and resilience activities into a single national effort. The NIPP also outlines the roles and responsibilities of DHS with regard to critical infrastructure protection and resilience and sector-specific agencies— federal departments and agencies responsible for critical infrastructure protection and resilience activities in 16 critical infrastructure sectors— such as the dams, energy, and transportation sectors. Appendix I lists the 16 critical infrastructure sectors and their sector-specific agencies. The NIPP emphasizes the importance of collaboration, partnering, and voluntary information sharing among DHS and industry owners and operators, and state, local, and tribal governments. The NIPP also stresses a partnership approach between the federal and state governments, and industry stakeholders for developing, implementing, and maintaining a coordinated national effort to manage the risks to critical infrastructure.

Specific laws and directives have guided DHS’s role in critical infrastructure protection, including the Homeland Security Act of 2002, as amended; Homeland Security Presidential Directive/HSPD-7; Presidential Policy Directive/PPD-21, which was issued on February 12, 2013; and Executive Order 13636, which was also issued on February 12, 2013. PPD-21 directs DHS to, among other things, coordinate the overall federal effort to promote the security and resilience of the nation’s critical infrastructure. PPD-21 also recognizes that DHS, in carrying out its responsibilities under the Homeland Security Act, evaluates national capabilities, opportunities, and challenges in protecting critical infrastructure; analyzes threats to, vulnerabilities of, and potential consequences from all hazards on critical infrastructure; identifies security and resilience functions that are necessary for effective stakeholder engagement with all critical infrastructure sectors; integrates and coordinates federal cross-sector security and resilience activities; and identifies and analyzes key interdependencies among critical infrastructure sectors, among other things. Executive Order 13636 directs DHS to, among other things, develop a voluntary cybersecurity framework; promote and incentivize the adoption of cybersecurity practices; increase the volume, timeliness, and quality of cyber threat information sharing; and incorporate privacy and civil liberties protections into every initiative to secure our critical infrastructure.

Within DHS, the National Protection and Programs Directorate (NPPD) is responsible for working with public and industry infrastructure partners and leads the coordinated national effort to mitigate risk to the nation’s infrastructure through the development and implementation of the infrastructure protection program. Using a partnership approach, NPPD works with owners and operators of the nation’s infrastructure to develop, facilitate, and sustain strategic relationships and information sharing, including the sharing of best practices. NPPD also works with government and industry partners to coordinate efforts to establish and operate various councils intended to protect infrastructure and provide infrastructure functions to strengthen incident response.

Observations on Key Factors in DHS Implementation of Its Partnership Approach

Our prior work has found that DHS and its partners have taken a number of steps intended to improve the security of our critical infrastructure. However, we have also identified a number of additional steps DHS could take to further improve its partnerships aimed at protecting our critical infrastructure. Specifically, our work has identified three key factors that can affect the implementation of the partnership approach used by DHS: (1) recognizing and addressing barriers to sharing information; (2) sharing the results of DHS assessments with industry and other stakeholders; and (3) measuring and evaluating the performance of DHS’s partnership efforts.

Recognizing and Addressing Barriers to Sharing Information

Addressing pervasive and sustained computer-based and physical attacks to systems and operations and the critical infrastructures they support depends on effective partnerships between the government and industry owners and operators of critical infrastructure. Recognizing and addressing barriers to information sharing includes, among other things, identifying barriers to sharing information with partners, understanding information requirements, and determining partners’ reasons for participating in voluntary programs.

Identifying barriers to industry sharing information with federal partners. In a July 2010 report examining, among other things, government stakeholders’ expectations for cyber-related, public- private partnerships we identified some barriers to industry’s sharing of cyber threat information with federal partners.of the government entities we contacted reported that industry partners were mostly meeting their expectations in several areas, including sharing timely and actionable cyber threat information, though the extent to which this was happening varied by sector. However, we found that federal officials also reported that improvements could be made. For example, while timely and actionable cyber threat and alert information was being received from industry partners, federal officials noted there were limits to the depth and specificity of the information provided by industry partners. Among other issues, we found that industry partners did not want to share their sensitive, proprietary information with the federal government. For example, information security companies had concerns that they could lose a competitive advantage by sharing information with the government if, in turn, this information was shared with those companies’ competitors. In addition, despite special protections and sanitization processes, we found that industry partners were unwilling to agree to all of the terms that the federal government or a government agency requires to share certain information. On the basis of our findings, we recommended, among other things, that DHS, in collaboration with industry partners, use the results of our July 2010 report to continue to focus its information- sharing efforts on the most desired services. DHS concurred with this recommendation and described steps underway to address it, including the initiation of several pilot programs intended to enable the mutual sharing of cybersecurity information at various classification levels.

Identifying barriers to the government’s sharing information with industry partners. Federal efforts to meet the information-sharing expectations of industry partners are equally important in managing effective public-private partnerships to successfully protect cyber- reliant critical assets from a multitude of threats. In July 2010, we also examined industry partners’ expectations for cyber-related, public- private partnerships and identified some barriers to the federal government’s sharing of cyber threat information with its industry partners. We reported that federal partners were not consistently meeting industry’s information sharing expectations, including providing timely and actionable cyber threat information and alerts, according to industry partners we contacted at the time. We found that this was, in part, due to restrictions on the type of information that can be shared with industry partners. We reported that according to federal officials, DHS’s ability to provide information is affected by restrictions that do not allow individualized treatment of one industry partner over another industry partner—making it difficult to formally share specific information with entities that are being directly affected by a cyber threat. In addition, we reported in July 2010 that because DHS has responsibility for serving as the nation’s cyber analysis and warning center, it must ensure that its warnings are accurate.

DHS vulnerability assessments are conducted during site visits at individual assets and are used to identify security gaps and provide options for consideration to mitigate these identified gaps. DHS security surveys are intended to gather information on an asset’s current security posture and overall security awareness. Security surveys and vulnerability assessments are generally asset-specific and are conducted at the request of asset owners and operators. assets crucial to national security, public health and safety, and the economy. We recommended, and DHS concurred, that it design and implement a mechanism for systematically assessing why owners and operators of high-priority assets decline to participate, and develop a road map, with time frames and milestones, for completing this effort. DHS stated that it had implemented a tracking system in October 2013 to capture data on the reason for declinations by owners and operators.

Although DHS reports that it has taken or begun to take action on the open recommendations discussed above, we have not verified DHS’s progress implementing all of our recommendations. We will continue to monitor DHS’s efforts to implement these recommendations.

Sharing Results of DHS Assessments with Industry and Other Stakeholders

Another important factor for DHS’s implementation of its partnership approach is sharing information on the results of its security assessments and surveys with industry partners and other stakeholders.

Timely sharing of assessment results at the asset level. DHS security surveys and vulnerability assessments can provide valuable insights into the strengths and weaknesses of assets and can help asset owners and operators that participate in these programs make decisions about investments to enhance security and resilience. In our May 2012 report, we found that, among other things, DHS shares the results of security surveys and vulnerability assessments with asset owners or operators.security survey and vulnerability assessment results could be enhanced by the timely delivery of these products to the owners and operators and that the inability to deliver these products in a timely manner could undermine the relationship DHS was attempting to develop with these industry partners. Specifically, we reported that, based on DHS data from fiscal year 2011, DHS was late meeting its (1) 30-day time frame—as required by DHS guidance—for delivering the results of its security surveys 60 percent of the time and (2) 60- day time frame—expected by DHS managers for delivering the results of its vulnerability assessments—in 84 percent of the instances. DHS officials acknowledged the late delivery of survey and assessment results and said they were working to improve processes and However, we also found that the usefulness of protocols. However, DHS had not established a plan with time frames and milestones for managing this effort consistent with standards for project management. We recommended, and DHS concurred, that it develop time frames and specific milestones for managing its efforts to ensure the timely delivery of the results of security surveys and vulnerability assessments to asset owners and operators. DHS stated that, among other things, it deployed a web-based information-sharing system for facility-level information in February 2013, which, according to DHS, has since resulted in a significant drop in overdue deliveries.

Sharing information with critical infrastructure partners at the sector level. Critical infrastructures rely on networked computers and systems, thus making them susceptible to cyber-based risks. Managing such risk involves the use of cybersecurity guidance that promotes or requires actions to enhance the confidentiality, integrity, and availability of computer systems. In December 2011, we reported on cybersecurity guidance and its implementation and we found, among other things, that DHS and the other sector-specific agencies have disseminated and promoted cybersecurity guidance among and within sectors. However, we also found that DHS and the other sector-specific agencies had not identified the key cybersecurity guidance applicable to or widely used in each of their critical infrastructure sectors. In addition, we reported that most of the sector- specific critical infrastructure protection plans for the sectors we reviewed did not identify key guidance and standards for cybersecurity because doing so was not specifically suggested by DHS guidance. Therefore, we concluded that given the plethora of guidance available, individual entities within the sectors could be challenged in identifying the guidance that is most applicable and effective in improving their security and that improved knowledge of the available guidance could help both federal and industry partners better coordinate their efforts to protect critical cyber-reliant assets. We recommended that DHS, in collaboration with government and industry partners, determine whether it is appropriate to have cybersecurity guidance listed in sector plans. DHS concurred with our recommendation and stated that it will work with its partners to determine whether it is appropriate to have cybersecurity guidance drafted for each sector and, in addition, would explore these issues with the cross-sector community.

Sharing certain information with critical infrastructure partners at the regional level. Our work has shown that over the past several years, DHS has recognized the importance of and taken actions to examine critical infrastructure asset vulnerabilities, threats, and potential consequences across regions. In a July 2013 report, we examined DHS’s management of its Regional Resiliency Assessment Program (RRAP)—a voluntary program intended to assess regional resilience of critical infrastructure by analyzing a region’s ability to adapt to changing conditions, and prepare for, withstand, and rapidly recover from disruptions—and found that DHS has been working with states to improve the process for conducting RRAP projects, including more clearly defining the scope of these projects. We also reported that DHS shares the project results of each RRAP project report with the primary stakeholders—officials representing the state where the RRAP was conducted—and that each report is generally available to certain staff, such as sector-specific agencies and protective security advisors within DHS. However, we found that DHS did not share individual RRAP reports more widely with others in similar industry lines, including other stakeholders and sector-specific agencies outside of DHS. We also reported that DHS had been working to conceptualize how it can develop a product or products using multiple sources—including RRAP reports—to more widely share resilience lessons learned to its critical infrastructure partners, including federal, state, local, and tribal officials. DHS further reported using various forums, such as regional conferences or during daily protective security advisor contacts, to solicit input from critical infrastructure partners to gauge their resilience information needs. Due to DHS’s ongoing efforts, we did not make a related recommendation in the report. However, we noted that through continued outreach and engagement with its critical infrastructure partners, DHS should be better positioned to understand their needs for information about resilience practices, which would in turn help clarify the scope of work needed to develop and disseminate a meaningful resilience information–sharing product or products that are useful across sectors and assets.

Sharing information with sector-specific agencies and state and local governments. Federal sector-specific agencies and state and local governments are key partners that can provide specific expertise and perspectives in federal efforts to identify and protect critical infrastructure. In a March 2013 report, we reviewed DHS’s management of the National Critical Infrastructure Prioritization Program (NCIPP)—which identifies and prioritizes a list of nationally significant critical infrastructure each year—to include how DHS worked with states and sector-specific agencies to develop the list. We reported that DHS had taken actions to improve its outreach to sector-specific agencies and states in an effort to address challenges associated with providing input on nominations and changes to the NCIPP list. For example, in 2009, we reported that DHS revised its list development process to be more transparent and provided states with additional resources and tools for developing their NCIPP nominations. Furthermore, DHS provided on-site assistance from subject matter experts to assist states with identifying infrastructure, disseminated a lessons-learned document providing examples of successful nominations to help states improve justifications, and was more proactive in engaging sector-specific agencies in ongoing dialog on proposed criteria changes, among other efforts. However, we also found that most state officials we contacted continued to experience challenges with nominating assets to the NCIPP list using the consequence-based criteria developed by DHS. We reported that DHS officials told us that they recognized that some states are facing challenges participating in the NCIPP program and have taken additional steps to address the issue, including working to minimize major changes to the consequence-based NCIPP criteria; enhancing state participation; and working collaboratively with the State, Local, Tribal and Territorial Government Coordinating Council to develop a guide to assist states with their efforts to identify and prioritize their critical infrastructure.

Furthermore, in our January 2014 report reviewing the extent to which federal agencies coordinated with state and local governments regarding enhancing cybersecurity within public safety entities, we determined that DHS shared cybersecurity-related information, such as threats and hazards, with state and local governments through various entities. For example, we found that DHS collected, analyzed, and disseminated cyber threat and cybersecurity-related information to state and local governments through its National Cybersecurity and Communications Integration Center and through its relationship with the Multi-State Information Sharing and Analysis Center. In addition, we reported that DHS’s State, Local, Tribal, and Territorial Engagement Office’s Security Clearance Initiative facilitated the granting of security clearances to state chief information officers and chief information security officers which allowed these personnel to receive classified information about current and recent cyber attacks and threats. For example, we reported that, according to DHS officials, they have issued secret clearances to 48 percent of state chief information officers and 84 percent of state chief information security officers. Moreover, we reported that DHS provides unclassified intelligence information to fusion centers, which then share the information on possible terrorism and other threats and issue alerts to state and local governments. For example, in March 2013, a fusion center issued a situational awareness bulletin specific to public safety entities.

Although DHS reports that it has taken or begun to take action on the open recommendations discussed above, we have not verified DHS’s progress implementing all of our recommendations. We will continue to monitor DHS’s efforts to implement these recommendations.

Measuring and Evaluating Performance of DHS Partnerships

Measuring and evaluating the performance of DHS partnerships—by among other things, obtaining and assessing feedback, evaluating why certain improvements are made, and measuring the effectiveness of partnerships and assessment—is another important factor in DHS’s implementation of its partnership approach.

Obtaining and assessing feedback from industry partners. Taking a systematic approach to gathering feedback from industry owners and operators and measuring the results of these efforts could help focus greater attention on targeting potential problems and areas needing improvement. In April 2013, we examined DHS’s Chemical Facility Anti-Terrorism Standards (CFATS) program and assessed, among other things, the extent to which DHS has communicated and worked with owners and operators to improve security. Specifically, we reported that DHS had increased its efforts to communicate and work with industry owners and operators to help them enhance security at their facilities since 2007. We found that as part of their outreach program, DHS consulted with external stakeholders, such as private industry and state and local government officials to discuss issues that affect the program and facility owners and operators. However, despite increasing its efforts to communicate with industry owners and operators, we also found that DHS had an opportunity to obtain systematic feedback on its outreach. We recommended that DHS explore opportunities and take action to systematically solicit and document feedback on facility outreach. DHS concurred with this recommendation and has actions underway to explore such opportunities to make CFATS-related outreach efforts more effective for all stakeholders.

Evaluating why facility-level improvements are made or not made. According to the NIPP, the use of performance measures is a critical step in the risk management process to enable DHS to objectively and quantitatively assess improvement in critical infrastructure protection and resiliency at the sector and national levels. In our May 2012 report on DHS’s efforts to conduct surveys and assessments of high-priority infrastructure assets and share the results, we found that, consistent with the NIPP, DHS has taken action to follow up with participants to gather feedback from asset owners and operators that participated in the program regarding the effect these programs have had on asset security. However, we also found that DHS could consider using this follow-up tool to capture key information that could be used to understand why certain improvements were or were not made by asset owners and operators that have received surveys and assessments. For example, the follow-up tool could ask asset representatives what factors—such as cost, vulnerability, or perception of threat—influenced the decision to implement changes, either immediately or over time, if they chose to make improvements. We concluded that obtaining this information would be valuable to understanding the obstacles asset owners or operators face when making security investments. We recommended, and DHS concurred, that it consider the feasibility of expanding the follow-up program to gather and act upon data, as appropriate, on (1) security enhancements that are ongoing and planned that are attributable to DHS security surveys and vulnerability assessments and (2) factors, such as cost and perceptions of threat, that influence asset owner and operator decisions to make, or not make, enhancements based on the results of DHS security surveys and vulnerability assessments. DHS reported that it had modified the follow-up program to capture data on whether ongoing and planned security enhancements are attributable to security surveys and vulnerability assessments. Furthermore, DHS stated that it had also completed additional modifications to the follow-up tools to more accurately capture all improvements to resilience as well as information on factors influencing owner and operator decisions to make or not make enhancements.

Measuring the effectiveness of sector-level partnerships.

Ensuring the effectiveness and reliability of communications networks is essential to national security, the economy, and public health and safety. In an April 2013 report, we found that while DHS has multiple components focused on assessing risk and sharing threat information, DHS and its sector partners do not consistently measure the outcome of efforts to improve cybersecurity at the sector level. For example, we found that DHS and its partners had not developed outcome- based performance measures related to the cyber protection of key parts of the communications infrastructure sector. We concluded that outcome-based metrics related to communications networks and critical components supporting the Internet would provide federal decision makers with additional insight into the effectiveness of partner protection efforts at the sector level. We recommended that DHS collaborate with its partners to develop outcome-oriented measures for the communications sector. DHS concurred with our recommendation and stated that it is working with industry to develop plans for mitigating risks that will determine the path forward in developing outcome-oriented performance measures for cyber protection activities related to the nation’s core and access communications networks.

Measuring the effectiveness of regional-level assessments.

Similarly, in our July 2013 report examining DHS’s management of its RRAP program, we found that DHS had taken action to measure efforts to enhance security and resilience among facilities that participated in these regional-level assessments, but faced challenges measuring the results associated with these projects. Consistent with the NIPP, DHS performs periodic follow-ups among industry partners that participate in these regional assessments with the intent of measuring their efforts to make enhancements arising out of these surveys and assessments. However, we found that DHS did not measure how industry partners made enhancements at individual assets that participate in a RRAP project contribute to the overall results of the project. DHS officials stated at the time that they faced challenges measuring performance within and across RRAP projects because of the unique characteristics of each, including geographic diversity and differences among assets within projects. However, we concluded that DHS could better position itself to gain insights into projects’ effects if it were to develop a mechanism to compare facilities that have participated in a RRAP project with those that have not, thus establishing building blocks for measuring its efforts to conduct RRAP projects. We recommended that DHS develop a mechanism to assess the extent to which individual projects influenced partners to make RRAP-related enhancements. DHS concurred with our recommendation and reported that it had actions underway to review alternatives, including possibly revising its security survey and vulnerability assessment follow-up tool, to address this recommendation.

Although DHS reports that it has taken or begun to take action on the open recommendations discussed above, we have not verified DHS’s progress implementing all of our recommendations. We will continue to monitor DHS’s efforts to implement these recommendations.

In closing, the federal government has taken a variety of actions that are intended to enhance critical infrastructure cybersecurity. Improving federal capabilities—through partnerships with industry, among other things—is a step in the right direction, and effective implementation can enhance federal information security and the cybersecurity and resilience of our nation’s critical infrastructure. However, more needs to be done to accelerate the progress made in bolstering the cybersecurity posture of the nation. The administration and executive branch agencies need to fully implement the hundreds of recommendations made by GAO and agency inspectors general to address cyber challenges. Until then, the nation’s most critical federal and private sector infrastructure systems will remain at increased risk of attack from our adversaries.

Chairman Carper, Ranking Member Coburn, and members of the committee, this completes my prepared statement. I would be happy to respond to any questions you may have at this time.

GAO Contact and Staff Acknowledgments

For information about this statement please contact Stephen L. Caldwell, at (202) 512-9610 or CaldwellS@gao.gov, or Gregory C. Wilshusen, at (202) 512-6244 or WilshusenG@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work included Edward J. George, Jr., Assistant Director; Michael W. Gilmore, Assistant Director; Hugh Paquette, Analyst-in-Charge; Jose Cardenas; Tom Lombardi; and Erin McLaughlin.

Appendix I: Critical Infrastructure Sectors

This appendix provides information on the 16 critical infrastructure (CI) sectors and the federal agencies responsible for sector security. The National Infrastructure Protection Plan (NIPP) outlines the roles and responsibilities of the Department of Homeland Security (DHS) and its partners—including other federal agencies. Within the NIPP framework, DHS is responsible for leading and coordinating the overall national effort to enhance protection via 16 critical infrastructure sectors. Consistent with the NIPP, Presidential Decision Directive/PPD-21 assigned responsibility for the critical infrastructure sectors to sector-specific agencies (SSAs). As an SSA, DHS has direct responsibility for leading, integrating, and coordinating efforts of sector partners to protect 10 of the 16 critical infrastructure sectors. Seven other federal agencies have sole or coordinated responsibility for the remaining 6 sectors. Table 1 lists the SSAs and their sectors.