Communications Networks: Outcome-Based Measures Would Assist DHS in Assessing Effectiveness of Cybersecurity Efforts
Released: 2013-04-10T00:00:00

Letter

Background

The national information and communications networks consist of a collection of mostly privately owned networks that are critical to the nation’s security, economy, and public safety. The communications sector operates these networks and is comprised of public- and private-sector entities that have a role in, among other things, the use, protection, or regulation of the communications networks and associated services (including Internet routing). For example, private companies, such as AT&T and Verizon, function as service providers, offering a variety of services to individual and enterprise end users or customers.

The Internet is a vast network of interconnected networks. It is used by governments, businesses, research institutions, and individuals around the world to communicate, engage in commerce, do research, educate, and entertain. customers that are positioned at the ends of the network, or the “last mile,” as referred to by industry.

The core networks transport a high volume of aggregated traffic substantial distances or between different service providers or “carriers.” These networks connect regions within the United States as well as all continents except Antarctica, and use submarine fiber optic cable systems, land-based fiber and copper networks, and satellites. In order to transmit data, service providers manage and control core infrastructure elements with numerous components, including signaling systems, databases, switches, routers, and operations centers. Multiple service providers, such as AT&T and Verizon, operate distinct core networks traversing the nation that interconnect with each other at several points. End users generally do not connect directly with the core networks.

Access networks are primarily local portions of the network that connect end users to the core networks or directly to each other and enable them to use services such as local and long distance phone calling, video conferencing, text messaging, e-mail, and various Internet-based services. These services are provided by various technologies such as satellites, including fixed and portable systems; wireless, including cellular base stations; cable, including video, data, and voice systems, and cable system end offices; and wireline, including voice and data systems and end offices. Communications traffic between two locations may originate and terminate within an access network without connecting to core networks (e.g., local phone calling within the wireline network). Communications traffic between different types of access networks (e.g., between the wireline and wireless networks) may use core networks to facilitate the transmission of traffic. Individual and enterprise users connect to access networks through various devices (e.g., wired phones, cell phones, and computers). Figure 1 depicts the interconnection of user devices and services, access networks, and core networks. Figure 2 depicts the path that a single communication can take to its final destination.

Aggregate traffic is normally the multimedia (voice, data, video) traffic combined from different service providers, or carriers, to be transported over high-speed through the core networks.

Roll over each below to view more information.

Critical Protocols Supporting the Internet

The nation’s communications infrastructure also provides the networks that support the Internet. In order for data to move freely across communications networks, the Internet network operators employ voluntary, self-enforcing rules called protocols. Two sets of protocols— the Domain Name System (DNS) and the Border Gateway Protocol (BGP)—are essential for ensuring the uniqueness of each e-mail and website address and for facilitating the routing of data packets between autonomous systems, respectively.

DNS provides a globally distributed hierarchical database for mapping unique names to network addresses. It links e-mail and website addresses with the underlying numerical addresses that computers use to communicate with each other. It translates names, such as http://www.house.gov, into numerical addresses, such as 208.47.254.18, that computers and other devices use to identify each other on the network and back again in a process invisible to the end user. This process relies on a hierarchical system of servers, called domain name servers, which store data linking address names with address numbers. These servers are owned and operated by many public and private sector organizations throughout the world. Each of these servers stores a limited set of names and numbers. They are linked by a series of root servers that coordinate the data and allow users’ computers to find the server that identifies the sites they want to reach. Domain name servers are organized into a hierarchy that parallels the organization of the domain names (such as “.gov”, “.com”, and “.org”). Figure 3 below provides an example of how a DNS query is turned into a number.

BGP is used by routers located at network nodes to direct traffic across the Internet. Typically, routers that use this protocol maintain a routing table that lists all feasible paths to a particular network. They also determine metrics associated with each path (such as cost, stability, and speed) and follow a set of constraints (e.g., business relationships) to choose the best available path for forwarding data. This protocol is important because it binds together many autonomous networks that comprise the Internet (see fig. 4).

Like those affecting other cyber-reliant critical infrastructure, threats to the communications infrastructure can come from a wide array of sources. These sources include corrupt employees, criminal groups, hackers, and foreign nations engaged in espionage and information warfare. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. Table 1 describes the sources in more detail.

These sources may make use of various cyber techniques, or exploits, to adversely affect communications networks, such as denial-of-service attacks, phishing, passive wiretapping, Trojan horses, viruses, worms, and attacks on the information technology supply chains that support the communications networks. Table 2 provides descriptions of these cyber exploits.

In addition to cyber-based threats, the nation’s communications networks also face threats from physical sources. Examples of these threats include natural events (e.g., hurricanes or flooding) and man-made disasters (e.g., terrorist attacks), as well as unintentional man-made outages (e.g., a backhoe cutting a communication line).

Agencies Have Taken Action to Address Security of Communications Networks

While the private sector owns and operates the nation’s communications networks and is primarily responsible for protecting these assets, federal law and policy establish regulatory and support roles for the federal government in regard to the communications networks. In this regard, federal law and policy call for critical infrastructure protection activities that are intended to enhance the cyber and physical security of both the public and private infrastructures that are essential to national security, national economic security, and public health and safety. The federal role is generally limited to sharing information, providing assistance when asked by private-sector entities, and exercising regulatory authority when applicable.

As part of their efforts in support of the security of communications networks, FCC, DHS, DOD, and Commerce have taken a variety of actions, including ones related to developing cyber policy and standards, securing Internet infrastructure, sharing information, supporting national security and emergency preparedness (NS/EP), and promoting sector protection efforts.

Federal Communications Commission

FCC is a U.S. government agency that regulates interstate and international communications by radio, television, wire, satellite, and cable throughout the United States.for certain communications providers to report on the reliability and security of communications infrastructures. These include disruption- reporting requirements for outages that are defined as a significant degradation in the ability of an end user to establish and maintain a Its regulations include requirements channel of communications as a result of failure or degradation in the performance of a communications provider’s network.

The Commission’s Public Safety and Homeland Security Bureau has primary responsibility for assisting providers in ensuring the security and availability of the communications networks. The bureau also serves as a clearinghouse for public safety communications information and emergency response issues. In addition, its officials serve as Designated Federal Officers on the Communications Security, Reliability, and Interoperability Council.

The Communications Security, Reliability, and Interoperability Council is a federal advisory committee whose mission is to provide recommendations to FCC to help ensure, among other things, secure and reliable communications systems, including telecommunications, media, and public safety systems. The council has provided recommendations in the form of voluntary best practices that provide companies with guidance aimed at improving the overall reliability, interoperability, and security of networks. Specifically, it is composed of 11 working groups that consist of experts from industry and other federal agencies. The working groups focus on various related topics, including those related to network security management, as well the security of the Border Gateway Protocol and the Domain Name System. The working groups develop recommendations through industry cooperation and voluntary agreements. For example, in March 2012, the commission announced the voluntary commitments by the nation’s largest Internet service providers, including AT&T and Verizon, to adopt the council’s recommendations aimed at better securing their communications networks. The recommendations covered a variety of security practices, including those related to the security of the Domain Name System and BGP.

The key FCC and council efforts related to the security of the communications sector are detailed in table 3 below.

DHS is the principal federal agency to lead, integrate, and coordinate the implementation of efforts to protect cyber-critical infrastructures. DHS’s role in critical infrastructure protection is established by law and policy. The Homeland Security Act of 2002, Homeland Security Presidential Directive 7, and the National Infrastructure Protection Plan establish a cyber protection approach for the nation’s critical infrastructure sectors— including communications—that focuses on the development of public- private partnerships and establishment of a risk management framework. These policies establish critical infrastructure sectors, including the communications sector; assign agencies to each sector (sector-specific agencies), including DHS as the sector lead for the communications and information technology sectors; and encourage private sector involvement through the development of sector coordinating councils, such as the Communications Sector Coordinating Council, and information-sharing mechanisms, such as the Communications Information Sharing and Analysis Center.

Additionally, DHS has a role, along with agencies such as DOD, in regard to national security and emergency preparedness (NS/EP) communications that are intended to increase the likelihood that essential government and private-sector individuals can complete critical phone calls and organizations can quickly restore service during periods of disruption and congestion resulting from natural or man-made disasters. In particular, Executive Order No.13618 established an NS/EP Communications Executive Committee to serve as an interagency forum to address such communications matters for the nation. Among other things, the committee is to advise and make policy recommendations to the President on enhancing the survivability, resilience, and future architecture for NS/EP communications. The Executive Committee is composed of Assistant Secretary-level or equivalent representatives designated by the heads of the Departments of State, Defense, Justice, Commerce, and Homeland Security, the Office of the Director of National Intelligence, the General Services Administration, and the Federal Communications Commission, as well as such additional agencies as the Executive Committee may designate. The committee is chaired by the DHS Assistant Secretary for the Office of Cybersecurity and Communications and the DOD Chief Information Officer, with administrative support for the committee provided by DHS.

To fulfill DHS’s cyber-critical infrastructure protection and NS/EP-related missions, the Office of Cybersecurity and Communications within the National Protection and Programs Directorate is responsible for, among other things, ensuring the security, resiliency, and reliability of the nation’s cyber and communications infrastructure, implementing a cyber-risk management program for protection of critical infrastructure, and planning for and providing national security and emergency preparedness communications to the federal government.

The office is made up of the following five subcomponents that have various responsibilities related to DHS’s overarching cybersecurity mission:

Stakeholder Engagement and Cyber Infrastructure Resilience division, among other things, is responsible for managing the agency’s role as the sector-specific agency for the communications sector.

Office of Emergency Communications is responsible for leading NS/EP and emergency communications in coordination and cooperation with other DHS organizations.

National Cybersecurity and Communications Integration Center is the national 24-hours-a-day, 7-days-a-week operations center that is to provide situational awareness, multiagency incident response, and strategic analysis for issues related to cybersecurity and NS/EP communications. The center is comprised of numerous co-located, integrated elements including the National Coordinating Center for Telecommunications, the U.S. Computer Emergency Readiness Team (US-CERT), and the Industrial Control Systems Cyber Emergency Response Team.

Federal Network Resilience division is responsible for collaborating with departments and agencies across the federal government to strengthen the operational security of the “.gov” networks. As part of those efforts, the division leads the DHS initiative related to DNSSEC.

Network Security Deployment division is responsible for designing, developing, acquiring, deploying, sustaining, and providing customer support for the National Cybersecurity Protection System.

Four of these subcomponents have taken specific actions with respect to the communications networks, which are detailed in table 4 below.

Under the National Infrastructure Protection Plan, DHS’s Office of Cybersecurity and Communications, as the sector-specific agency for the communications and information technology sectors, is responsible for leading federal efforts to support sector protection efforts. As part of the risk management process for protecting the nation’s critical infrastructure, including the protection of the cyber information infrastructure, the National Infrastructure Protection Plan recommends that outcome- oriented metrics be established that are specific and clear as to what they are measuring, practical or feasible in that needed data are available, built on objectively measureable data, and align to sector priorities. These metrics are to be used to determine the health and effectiveness of sector efforts and help drive future investment and resource decisions.

DHS and its partners have previously identified the development of outcome-oriented metrics as part of the process to be used to manage risks to the nation’s critical communications infrastructure. For example, in 2010, DHS and its communications sector partners identified preserving the overall health of the core network as the sector’s first priority at the national level. They also defined a process for developing outcome-oriented sector metrics that would map to their identified goals and would yield quantifiable information (when available). Additionally, DHS and its information technology sector partners stated that they would measure their cyber protection efforts related to DNS and BGP in terms of activities identified in 2009 to assist sector partners in mitigating risks to key sector services, such as providing DNS functionality and Internet routing services. In 2010, they noted that implementation plans would be developed for each of the activities and outcome-based metrics would be used to monitor the status and effectiveness of the activities.

However, DHS and its partners have not yet developed outcome-based metrics related to the cyber-protection activities for the core and access networks, DNS functionality, and Internet routing services. For the communications sector, DHS officials stated that the sector had recently completed the first part of a multiphased risk assessment process that included identification of cyber risks. The officials further stated that efforts are under way to prioritize the identified risks and potentially develop actions to mitigate them. However, DHS officials stated that outcome-oriented metrics had not yet been established and acknowledged that time frames for developing such metrics had not been agreed to with their private sector partners. For the information technology sector, DHS officials noted that the information technology sector’s private sector partners had decided to focus on progress-related metrics (which report the status of mitigation development activities as well as implementation decisions and progress) to measure the effectiveness of sector activities to reduce risk across the entire sector and periodically re-examine their initial risk evaluation based on perceived threats facing the sector. While these progress-related metrics are part of the information technology sector’s planned measurement activities, the sector’s plans acknowledge that outcome-based metrics are preferable to demonstrate effectiveness of efforts.

Until metrics related to efforts to protect core and access networks, DNS, and BGP are fully developed, implemented, and tracked by DHS, federal decision makers will have less insight into the effectiveness of sector protection efforts.

Department of Defense

Within DOD, the Office of the Chief Information Officer (CIO) has been assigned the responsibility for implementing Executive Order 13618 requirements related to NS/EP communication functions. As previously described, the CIO (along with the Assistant Secretary for Cybersecurity and Communications in DHS) co-chairs the NS/EP Communications Executive Committee established in Executive Order 13618. The CIO directs, manages, and provides policy guidance and oversight for DOD’s information and the information enterprise, including matters related to information technology, network defense, network operations, and cybersecurity. Table 5 describes the department’s efforts in relation to this executive order.

Federal law and policy also establish a role for the Department of Commerce (Commerce) related to the protection of the nation’s communications networks. For example, Commerce conducts industry studies assessing the capabilities of the nation’s industrial base to support the national defense. In addition, the department’s National Telecommunications and Information Administration (NTIA) was established as the principal presidential adviser on telecommunications and information policies. Further, Commerce’s National Institute of Standards and Technology (NIST) is to, among other things, cooperate with other federal agencies, industry, and other private organizations in establishing standard practices, codes, specifications, and voluntary consensus standards.

Commerce also has a role in ensuring the security and stability of DNS. Prompted by concerns regarding who has authority over DNS, along with the stability of the Internet as more commercial interests began to rely on it, the Clinton administration issued an electronic commerce report in July 1997 that identified the department as the lead agency to support private efforts to address Internet governance. In June 1998, NTIA issued a policy statement (known as the White Paper) that stated it would enter into an agreement with a not-for-profit corporation formed by private sector Internet stakeholders for the technical coordination of DNS.

In addition, Commerce created the Internet Policy Task Force in August 2011 to, among other things, develop and maintain department-wide policy proposals on a range of global issues that affect the Internet, including cybersecurity. While NIST has been identified as the Commerce lead bureau for cybersecurity, the task force is to leverage the expertise of other Commerce bureaus, such as the Bureau of Industry and Security and NTIA.

Commerce components also carry out functions related to the security of the nation’s communications networks. The Bureau of Industry and Security conducted an industrial study to examine the operational and security practices employed by network operators in the nation’s communications infrastructure. In addition, NTIA manages agreements with the Internet Corporation for Assigned Names and Numbers (ICANN) and VeriSign, Inc., through which changes are made to the authoritative root zone file. Also, NIST participates in open, voluntary, industry-led, consensus-based, standards-setting bodies that design and develop specifications for network security technologies, including those used in the nation’s communications networks (such as DNS and BGP) as well as in industry technical forums for the purpose of promulgating the deployment of such new technologies. Table 6 describes some of the key efforts of Commerce as they relate to the cybersecurity of the nation’s communications networks.

Though Reporting Mechanisms Are in Place, FCC and DHS Have Not Received Reports of Cyber- Related Incidents Affecting the Nation’s Core and Access Networks

No cyber incidents affecting the core and access networks have been reported by communications networks owners and operators through three established reporting mechanisms from January 2010 to October 2012. To report incidents involving the core and access communications networks to the federal government, communication networks operators can use reporting mechanisms established by FCC and DHS to share information on outages and incidents:

FCC’s Network Outage Reporting System is a web-based filing system that communications providers use to submit detailed outage reports to FCC. In turn, FCC officials stated that the agency uses the reported outage data to develop situational awareness of commercial network performance as well as to aid the commission in influencing and developing best practices regarding incidents.

DHS’s Network Security Information Exchange is an information- sharing forum comprised of representatives from the communications and information technology sectors that meet bimonthly to voluntarily share communications-related incidents, among other things.

DHS’s National Cybersecurity and Communications Integration Center, which includes the National Coordinating Center, US-CERT, and the Industrial Control Systems Cyber Emergency Response Team, is used to share information about threats, vulnerabilities, and intrusions related to communications networks and the sector as a whole. Communications and information technology providers can voluntarily report threats, vulnerabilities, and intrusions to the center.

Although these mechanisms for reporting exist, available information showed that no cyber-based incidents involving the core and access communication networks had been reported using these mechanisms to the federal government from January 2010 to October 2012. Specifically, of the over 35,000 outages reported to FCC during this time period, none were related to traditional cyber threats (e.g., botnets, spyware, viruses, and worms). FCC officials stated that there could be an increase in the presence of cyber-related outages reported in the future as the Voice- over-Internet-Protocol reporting requirements are enforced. Further, DHS Office of Cybersecurity and Communications officials stated that no cyber incidents related to the core and access networks were reported to them during January 2010 to October 2012. For example, although several incidents attributed to the communications sector were reported to DHS’s Industrial Control Systems Cyber Emergency Response Team in fiscal year 2012, none of these incidents involved core and access networks. Our review of reports published by information security firms and communication network companies also indicated that no cyber incidents related to the core and access networks were publicly reported from January 2010 to October 2012.

Officials within FCC and the private sector attributed the lack of incidents to the fact that the communications networks provide the medium for direct attacks on consumer, business, and government systems—and thus these networks are less likely to be targeted by a cyber attack themselves. In addition, Communications Information Sharing and Analysis Center officials expressed greater concern about physical threats (such as natural and man-made disasters, as well as unintentional man-made outages) to communications infrastructure than cyber threats.

Attributes of Defense Industry Cybersecurity Pilot Programs Could Be Applied to the Communications Sector

DOD, in its role as the sector-specific agency for the defense industrial base critical infrastructure sector, established two pilot programs to enhance the cybersecurity of sector companies and better protect unclassified department data residing on those company networks. The Deputy Secretary of Defense established the Cyber Security/Information Assurance program under the department’s Office of the Chief Information Officer to address the risk posed by cyber attacks against sector companies. The Opt-In Pilot was designed to build upon the Cyber Security/Information Assurance Program and, according to department officials, established a voluntary information-sharing process for the department to provide classified network security indicators to Internet service providers.

In August 2012, we reported on these pilot programs as part of our study to identify DOD and private sector efforts to protect the defense industrial base from cybersecurity threats. Our report described these programs in detail, including challenges to their success. For example, one challenge noted by defense industrial base company officials was that the quality of the threat indicators provided by the federal government as part of the Opt-In pilot had not met their needs. In addition, the quality of the pilot was affected by the lack of a mechanism for information sharing among government and private stakeholders. The report also made recommendations to DOD and DHS to better protect the defense industrial base from cyber threats. (The August 2012 report was designated as official use only and is not publicly available.)

Using information in that report, we identified six attributes that were implemented to varying extents as part of the pilot programs (see table 7). These attributes were utilized by DOD and the defense industrial base companies to protect their sector from cyber threats and could inform the cyber protection efforts of the communications sector.

Agreements: Eligible defense industrial base companies who wanted to participate in these pilots enter into an agreement with the federal government. This agreement establishes the bilateral cyber- information-sharing process that emphasizes the sensitive, nonpublic nature of the information shared which must be protected from unauthorized use. The agreement does not obligate the participating company to change its information system environment or otherwise alter its normal conduct of cyber activities.

Government sharing of unclassified and classified cyber threat information: DOD provides participating defense industrial base companies with both unclassified and classified threat information, and in return, the companies acknowledge receipt of threat information products. For any intrusions reported to DOD by the participating companies under the program, the department can develop damage assessment products, such as incident-specific and trend reports, and provide them to participating companies and DOD leadership.

Feedback mechanism on government services: When a participating company receives cyber threat information from DOD, it has the option of providing feedback to the department on, among other things, the quality of the products.

Government cyber analysis, mitigation, and digital forensic support: A participating company can also optionally report intrusion events. When this occurs, DOD can conduct forensic cyber analysis and provide mitigation and digital forensic support. The department can also provide on-site support to the company that reported the intrusion.

Government reporting of voluntarily reported incidents: In addition to providing cyber analysis, mitigation, and cyber forensic support, DOD can report the information to other federal stakeholders, law enforcement agencies, counterintelligence agencies, and the DOD program office that might have been affected.

Internet service providers deploying countermeasures based on classified threat indicators for organizations: Each Cyber Security/Information Assurance program participating company can voluntarily allow its Internet service providers to deploy countermeasures on its behalf, provided the Internet service provider has been approved to receive classified network security indicators from the U.S. government. For those providers, US-CERT collects classified threat indicators from multiple sources and provides them to the companies’ participating Internet service providers. If the Internet service provider identifies a cyber intrusion, it will alert the company that was the target of the intrusion. Providers can also voluntarily notify US-CERT about the incident, and US-CERT will share the information with DOD.

In May 2012, DOD issued an interim final rule to expand the Cyber Security/Information Assurance program to all eligible defense industrial base sector companies. Additionally, the Defense Industrial Base Opt-In Pilot became the Defense Industrial Base Enhanced Cybersecurity Service (DECS) Program, and is now jointly managed by DHS and DOD.

In addition, on February 12, 2013, the President signed Executive Order 13636, which requires the Secretary of Homeland Security to establish procedures to expand DECS (referred to as the Enhanced Cybersecurity Services program) to all critical infrastructure sectors, including the communications sector. Considering these attributes and challenges could inform DHS’s efforts as it develops these new procedures.

Conclusions

Securing the nation’s networks is essential to ensuring reliable and effective communications within the United States. Within the roles prescribed for them by federal law and policy, the Federal Communications Commission and the Departments of Homeland Security, Defense, and Commerce have taken actions to support the communications and information technology sectors’ efforts to secure the nation’s communications networks from cyber attacks. However, until DHS and its sector partners develop appropriate outcome-oriented metrics, it will be difficult to gauge the effectiveness of efforts to protect the nation’s core and access communications networks and critical support components of the Internet from cyber incidents. While no cyber incidents have been reported affecting the nation’s core and access networks, communications networks operators can use reporting mechanisms established by FCC and DHS to share information on outages and incidents.

The pilot programs undertaken by DOD with its defense industrial base partners exhibit several attributes that could apply to the communications sector and help private sector entities more effectively secure the communications infrastructure they own and operate. As DHS develops procedures for expanding this program, considering these attributes could inform DHS’s efforts.

Recommendation for Executive Action

To help assess efforts to secure communications networks and inform future investment and resource decisions, we recommend that the Secretary of Homeland Security direct the appropriate officials within DHS to collaborate with its public and private sector partners to develop, implement, and track sector outcome-oriented performance measures for cyber protection activities related to the nation’s communications networks.

Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of Commerce (including the Bureau of Industry and Security, NIST, and NTIA), Defense, and Homeland Security and FCC for their review and comment.

DHS provided written comments on our report (see app. II), signed by DHS’s Director of Departmental GAO-OIG Liaison Office. In its comments, DHS concurred with our recommendation and stated that it is working with industry to develop plans for mitigating risks that will determine the path forward in developing outcome-oriented performance measures for cyber protection activities related to the nation’s core and access communications networks. Although the department did not specify an estimated completion date for developing and implementing these measures, we believe the prompt implementation of our recommendation will assist DHS in assessing efforts to secure communication networks and inform future investment and resource decisions.

We also received technical comments via e-mail from officials responsible for cybersecurity efforts related to communication networks at Defense, DHS, FCC, and Commerce's Bureau of Industry and Security and NTIA. We incorporated these comments where appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 7 days from the report date. At that time, we will send copies to interested congressional committees; the Secretaries of the Departments of Commerce, Defense, and Homeland Security; the Chairman of the Federal Communications Commission; the Director of the Office of Management and Budget; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify the roles of and actions taken by key federal entities to help protect the communications networks from cyber- based threats, (2) assess what is known about the extent to which cyber- incidents affecting the communications networks have been reported to the Federal Communications Commission (FCC) and Department of Homeland Security (DHS), and (3) determine if the Department of Defense’s (DOD) pilot programs to promote cybersecurity in the defense industrial base can be used in the communications sector. Our audit focused on the core and access networks of the communication network. These networks include wireline, wireless, cable, and satellite. We did not address broadcast access networks because they are responsible for a smaller volume of traffic than other networks. Additionally, we focused on the Internet support components that are critical for delivering services: the Border Gateway Protocol (BGP) and Domain Name System (DNS).

To identify the roles of federal entities, we collected, reviewed, and analyzed relevant federal law, policy, regulation, and critical infrastructure protection-related strategies. Sources consulted include statutes such as the Communications Act of 1934, Homeland Security Act of 2002, and the Defense Production Act of 1950, as well as other public laws; the Code of Federal Regulations; National Communication System Directive 3-10; the National Infrastructure Protection Plan; the Communications Sector- Specific Plan; the Information Technology Sector-Specific Plan; the Communications Sector Risk Assessment; the Information Technology Sector Risk Assessment; Homeland Security Presidential Directives; selected executive orders; and related GAO products. Using these materials, we selected the Departments of Commerce, Defense, and Homeland Security, and FCC to review their respective roles and actions related to the security of the privately owned communications network because they were identified as having the most significant roles and organizations for addressing communications cybersecurity.

To identify the actions taken by federal entities we collected, reviewed, and analyzed relevant policies, plans, reports, and related performance metrics and interviewed officials at each of the four agencies. For example, we reviewed and analyzed Department of Commerce agreements detailing the process for how changes are to be made to the authoritative root zone file and Internet Policy Task Force reports on cybersecurity innovation and the Internet. In addition, we analyzed and identified current and planned actions outlined in DOD’s National Security/Emergency Preparedness Executive Committee Charter. Also, we analyzed reports issued by the Communications Security, Reliability, and Interoperability Council on a variety of issues, including the security of the Domain Name System and the Border Gateway Protocol. Further, we reviewed and analyzed the risk assessments and sector-specific plans for both the communications and information technology critical infrastructure sectors, as well DHS’s plans for realignment in response to Executive Order 13618.

In addition, we interviewed agency officials regarding authority, roles, policies, and actions created by their department or agency, and actions taken by their departments and agencies to encourage or enhance the protection of communications networks, BGP, and DNS, and fulfill related roles. For Commerce, we interviewed officials from the Bureau of Industry and Security, National Telecommunications and Information Administration, and the National Institute of Standards and Technology. For DOD, we interviewed officials from the Office of the Chief Information Officer, including those from the National Leadership Command Capability Management Office and the Trusted Mission Systems and Networks Office. We also interviewed officials from the Office of the Under Secretary of Defense for Policy. For DHS, we interviewed officials from the National Protection and Programs Directorate’s Office of Cybersecurity and Communications. For FCC, we interviewed officials from the International, Media, Public Safety and Homeland Security, Wireless Telecommunications, and Wireline Competition Bureaus. Based on our analysis and the information gathered through interviews, we created a list of actions taken by each agency. Additionally, we reviewed documents (including the communications sector risk assessment) from and conducted interviews with officials from the Communications Information Sharing and Analysis Center to assess federal efforts to fulfill roles and responsibilities.

To assess what is known about the extent to which cyber-incidents affecting the communications networks have been reported to FCC and DHS, we analyzed FCC policy and guidance related to its Network Outage Reporting System. Additionally, we conducted an analysis of outage reports submitted from January 2010 to October 2012 to determine the extent to which they were related to cybersecurity threats, such as botnets, spyware, viruses, and worms affecting the core and access networks. To assess the reliability of FCC outage reports, we (1) discussed data quality control procedures with agency officials, (2) reviewed relevant documentation, (3) performed testing for obvious problems with completeness or accuracy, and (4) reviewed related internal controls. We determined that the data were sufficiently reliable for the purposes of this report. We also interviewed officials from FCC’s Public Safety and Homeland Security Bureau to understand incident reporting practices of its regulated entities, and how reported incident data were used by FCC to encourage improvement or initiate enforcement actions. Further, we interviewed officials from DHS’s United States Computer Emergency Readiness Team regarding the extent to which incidents were reported to it that affected core and access communications networks. We also conducted an analysis of information security reports from nonfederal entities, to determine if cyber incidents on the core and access communications networks had been reported to nonfederal entities. Additionally, we interviewed Communications Information Sharing and Analysis Center officials to identify the mechanisms and processes used to report cyber-related incidents in the communications sector to the center and then to the federal government.

To determine if DOD’s pilot can be used to inform the communications sector, we reviewed our August 2012 report on DOD efforts to enhance the cybersecurity of the defense industrial base critical infrastructure sector. We then identified and summarized attributes of the program that could be publicly reported and that were potentially applicable to the communications sector. The information used to compile the attributes from the August 2012 report was determined by DOD at that time not to be considered official use only. We also interviewed officials from DHS’s Office of Cybersecurity and Communications to ascertain the current status of the pilot programs and efforts to determine the applicability of the pilots to all critical infrastructures, including the communications sector.

We conducted this performance audit from April 2012 to April 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

GAO staff who made significant contributions to this report include Michael W. Gilmore, Assistant Director; Thomas E. Baril, Jr; Bradley W. Becker; Cortland Bradford; Penney Harwell Caramia; Kush K. Malhotra; Lee A. McCracken; David Plocher; and Adam Vodraska.