Critical Infrastructure Protection: DHS Needs to Better Address Its Cybersecurity Responsibilities
Released: 2008-09-16T00:00:00

Letter

Background

The same speed and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with computer operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. In recent years, the sophistication and effectiveness of cyberattacks have steadily advanced.

Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as criminals, terrorists, and nation-states. As we reported in June 2007, cybercrime has significant economic impacts and threatens U.S. national security interests. Various studies and experts estimate the direct economic impact from cybercrime to be in the billions of dollars annually. In addition, there is continued concern about the threat that our adversaries, including nation-states and terrorists, pose to our national security. For example, intelligence officials have stated that nation-states and terrorists could conduct a coordinated cyber attack to seriously disrupt electric power distribution, air traffic control, and financial sectors. In May 2007, Estonia was the reported target of a denial-of-service cyber attack with national consequences. The coordinated attack created mass outages of its government and commercial Web sites.

To address threats posed against the nation’s computer-reliant infrastructures, federal law and policy establishes DHS as the focal point for cyber CIP. For example, within DHS, the Assistant Secretary of Cyber Security and Communications is responsible for being the focal point for national cyber CIP efforts. Under the Assistant Secretary is NCSD which interacts on a day-to-day basis with federal and nonfederal agencies and organizations (e.g., state and local governments, private-sector companies) regarding, among other things, cyber-related analysis, warning, information sharing, major incident response, and national-level recovery efforts. Consequently, DHS has multiple cybersecurity-related roles and responsibilities. In May 2005, we identified, and reported on, 13 key cybersecurity responsibilities called for in law and policy. These responsibilities are described in appendix I.

Since then, we have performed detailed work and made recommendations on DHS’s progress in fulfilling specific aspects of the responsibilities, as discussed in more detail later in this statement.

In addition to DHS efforts to fulfill its cybersecurity responsibilities, the President in January 2008 issued HSPD 23—also referred to as National Security Presidential Directive 54 and the President’s “Cyber Initiative”—to improve DHS and the other federal agencies’ cybersecurity efforts, including protecting against intrusion attempts and better anticipating future threats. While the directive has not been made public, DHS officials stated that the initiative includes steps to enhance cyber analysis related efforts, such as requiring federal agencies to implement a centralized network monitoring tool and reduce the number of connections to the Internet.

DHS Needs to Address Several Key Areas Associated with Its Cybersecurity Responsibilities

Over the last several years, we have reported that DHS has yet to comprehensively satisfy its key cybersecurity responsibilities. These reports included about 30 recommendations that we summarized into the following key areas that are essential for DHS to address in order to fully implement its cybersecurity responsibilities.

Bolstering Cyber Analysis and Warning Capabilities

In July 2008, we identified that cyber analysis and warning capabilities included (1) monitoring network activity to detect anomalies, (2) analyzing information and investigating anomalies to determine whether they are threats, (3) warning appropriate officials with timely and actionable threat and mitigation information, and (4) responding to the threat. These four capabilities are comprised of 15 key attributes, which are detailed in appendix II.

We concluded that while US-CERT demonstrated aspects of each of the key attributes, it did not fully incorporate all of them. For example, as part of its monitoring, US-CERT obtained information from numerous external information sources; however, it had not established a baseline of our nation’s critical network assets and operations. In addition, while it investigated if identified anomalies constitute actual cyber threats or attacks as part of its analysis, it did not integrate its work into predictive analyses of broader implications or potential future attacks, nor does it have the analytical or technical resources to analyze multiple, simultaneous cyber incidents. The organization also provided warnings by developing and distributing a wide array of attack and other notifications; however, these notifications were not consistently actionable or timely—providing the right information to the right persons or groups as early as possible to give them time to take appropriate action. Further, while it responded to a limited number of affected entities in their efforts to contain and mitigate an attack, recover from damages, and remediate vulnerabilities, the organization did not possess the resources to handle multiple events across the nation.

We also concluded that without the key attributes, US-CERT did not have the full complement of cyber analysis and warning capabilities essential to effectively perform its national mission. As a result, we made 10 recommendations to the department to address shortfalls associated with the 15 attributes in order to fully establish a national cyber analysis and warning capability. DHS concurred with 9 of our 10 recommendations.

Reducing Organizational Inefficiencies

In June 2008, we reported on the status of DHS’s efforts to establish an integrated operations center that it agreed to adopt per recommendations from a DHS-commissioned expert task force. The two operations centers that were to be integrated were within the department’s National Communication System and National Cyber Security Division. We determined that DHS had taken the first of three steps towards integrating the operations centers—called the National Coordination Center Watch and US-CERT—it uses to plan for and monitor voice and data network disruptions. While DHS completed the first integration step by locating the two centers in adjacent space, it had yet to implement the remaining two steps. Specifically, although called for in the task force’s recommendations, the department had not organizationally merged the two centers or involved key private sector critical infrastructure officials in the planning, monitoring, and other activities of the proposed joint operations center. In addition, the department lacked a strategic plan and related guidance that provides overall direction in this area and has not developed specific tasks and milestones for achieving the two remaining integration steps.

We concluded that until the two centers were fully integrated, DHS was at risk of being unable to efficiently plan for and respond to disruptions to communications infrastructure and the data and applications that travel on this infrastructure, increasing the probability that communications will be unavailable or limited in times of need. As a result, we recommended that the department complete its strategic plan and define tasks and milestones for completing remaining integration steps so that we are better prepared to provide an integrated response to disruptions to the communications infrastructure. DHS concurred with our first recommendation and stated that it would address the second recommendation as part of finalizing its strategic plan.

DHS has recently made organizational changes to bolster its cybersecurity focus. For example, in response to the President’s January 2008 Cyber Initiative, the department established a National Cybersecurity Center to ensure coordination among cyber-related efforts across the federal government. DHS placed the center at a higher organizational level than the Assistant Secretary of Cyber Security and Communications. As we previously reported, this placement raises questions about, and may in fact, diminish the Assistant Secretary’s authority as the focal point for the federal government’s cyber CIP efforts. It also raises similar questions about NCSD’s role as the primary federal cyber analysis and warning organization.

Completing Corrective Actions Identified During A Cyber Exercise

In September 2008, we reported on a 2006 major DHS-coordinated cyber attack exercise, called Cyber Storm, that included large scale simulations of multiple concurrent attacks involving the federal government, states, foreign governments, and private industry. We determined that DHS had identified eight lessons learned from this exercise, such as the need to improve interagency coordination groups and the exercise program. We also concluded that while DHS had demonstrated progress in addressing the lessons learned, more needed to be done. Specifically, while the department completed 42 of the 66 activities identified to address the lessons learned, it identified 16 activities as ongoing and 7 as planned for the future. In addition, DHS provided no timetable for the completion dates of the ongoing activities. We noted that until DHS scheduled and completed its remaining activities, it was at risk of conducting subsequent exercises that repeated the lessons learned during the first exercise. Consequently, we recommended that DHS schedule and complete the identified corrective activities so that its cyber exercises can help both public and private sector participants coordinate their responses to significant cyber incidents. DHS agreed with the recommendation.

Developing Sector-Specific Plans That Fully Address All of the Cyber-Related Criteria

In 2007, we reported and testified on the cybersecurity aspects of CIP plans for 17 critical infrastructure sectors, referred to as sector- specific plans. Specifically, we found that none of the plans fully addressed the 30 key cybersecurity-related criteria described in DHS guidance. We also determined that while several sectors’ plans fully addressed many of the criteria, others were less comprehensive. In addition to the variations in the extent to which the plans covered aspects of cybersecurity, there was also variance among the plans in the extent to which certain criteria were addressed. For example, fewer than half of the plans fully addressed describing (1) a process to identify potential consequences of cyber attack or (2) any incentives used to encourage voluntary performance of risk assessments. We noted that without complete and comprehensive plans, stakeholders within the infrastructure sectors may not adequately identify, prioritize, and protect their critical assets. Consequently, we recommended that DHS request that the lead federal agencies, referred to as sector-specific agencies, that are responsible for the development of CIP plans for their sectors fully address all cyber-related criteria by September 2008 so that stakeholders within the infrastructure sectors will effectively identify, prioritize, and protect the cyber aspects of their CIP efforts. The updated plans are due this month.

Improving Cybersecurity of Infrastructure Control Systems

In a September 2007 report and October 2007 testimony, we identified that federal agencies had initiated efforts to improve the security of critical infrastructure control systems—computer-based systems that monitor and control sensitive processes and physical functions. For example, DHS was sponsoring multiple control systems security initiatives, including efforts to (1) improve control systems cybersecurity using vulnerability evaluation and response tools and (2) build relationships with control systems vendors and infrastructure asset owners. However, the department had not established a strategy to coordinate the various control systems activities across federal agencies and the private sector. Further, it lacked processes needed to address specific weaknesses in sharing information on control system vulnerabilities. We concluded that until public and private sector security efforts are coordinated by an overarching strategy and specific information sharing shortfalls are addressed, there was an increased risk that multiple organizations would conduct duplicative work and miss opportunities to fulfill their critical missions.

Consequently, we recommended that DHS develop a strategy to guide efforts for securing control systems and establish a rapid and secure process for sharing sensitive control system vulnerability information to improve federal government efforts to secure control systems governing critical infrastructure. In response, DHS officials took our recommendations under advisement and more recently have begun developing a Federal Coordinating Strategy to Secure Control Systems, which is still a work in process. In addition, while DHS began developing a process to share sensitive information; it has not provided any evidence that the process has been implemented or that it is an effective information sharing mechanism.

Strengthening DHS’s Ability to Help Recovery from Internet Disruptions

We reported and later testified in 2006 that the department had begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery. However, we determined that these efforts were not comprehensive or complete. As such, we recommended that DHS implement nine actions to improve the department’s ability to facilitate public/private efforts to recover the Internet in case of a major disruption.

In October 2007, we testified that the department had made progress in implementing our recommendations; however, seven of the nine have not been completed. For example, it revised key plans in coordination with private industry infrastructure stakeholders, coordinated various Internet recovery-related activities, and addressed key challenges to Internet recovery planning. However, it had not, among other things, finalized recovery plans and defined the interdependencies among DHS’s various working groups and initiatives. In other words, it has not completed an integrated private/public plan for Internet recovery. As a result, we concluded that the nation lacked direction from the department on how to respond in such a contingency. We also noted that these incomplete efforts indicated DHS and the nation were not fully prepared to respond to a major Internet disruption.

In summary, DHS has developed and implemented capabilities to satisfy aspects of key cybersecurity responsibilities. However, it still needs to take further action to fulfill all of these responsibilities. In particular, it needs to fully address the key areas identified in our recent reports. Specifically, it will have to bolster cyber analysis and warning capabilities, address organizational inefficiencies by integrating voice and data operations centers, enhance cyber exercises by completing the identified activities associated with the lessons learned, ensure that cyber-related sector-specific critical infrastructure plans are completed, improve efforts to address the cybersecurity of infrastructure control systems by completing a comprehensive strategy and ensuring adequate mechanisms for sharing sensitive information, and strengthen its ability to help recover from Internet disruptions by finalizing recovery plans and defining interdependencies. Until these steps are taken, our nation’s computer-reliant critical infrastructure remains at unnecessary risk of significant cyber incidents.

Mr. Chairman, this concludes my statement. I would be happy to answer any questions that you or members of the subcommittee may have at this time.

If you have any questions on matters discussed in this testimony, please contact me at (202) 512-9286, or by e-mail at pownerd@gao.gov. Other key contributors to this testimony include Camille Chaires, Michael Gilmore, Rebecca LaPaze, Kush Malhotra, and Gary Mountjoy.

Appendix I: DHS’s Key Cybersecurity Responsibilities

Developing a comprehensive national plan for securing the key resources and critical infrastructure of the United States, including information technology and telecommunications systems (including satellites) and the physical and technological assets that support such systems. This plan is to outline national strategies, activities, and milestones for protecting critical infrastructures.

Fostering and developing public/private partnerships with and among other federal agencies, state and local governments, the private sector, and others. DHS is to serve as the “focal point for the security of cyberspace.” Improving and enhancing information sharing with and among other federal agencies, state and local governments, the private sector, and others through improved partnerships and collaboration, including encouraging information sharing and analysis mechanisms. DHS is to improve sharing of information on cyber attacks, threats, and vulnerabilities.

Providing cyber analysis and warnings, enhancing analytical capabilities, and developing a national indications and warnings architecture to identify precursors to attacks.

Providing crisis management in response to threats to or attacks on critical information systems. This entails coordinating efforts for incident response, recovery planning, exercising cybersecurity continuity plans for federal systems, planning for recovery of Internet functions, and assisting infrastructure stakeholders with cyber-related emergency recovery plans.

Leading efforts by the public and private sector to conduct a national cyber threat assessment, to conduct or facilitate vulnerability assessments of sectors, and to identify cross-sector interdependencies. Leading and supporting efforts by the public and private sector to reduce threats and vulnerabilities. Threat reduction involves working with the law enforcement community to investigate and prosecute cyberspace threats. Vulnerability reduction involves identifying and remediating vulnerabilities in existing software and systems.

Collaborating and coordinating with members of academia, industry, and government to optimize cybersecurity-related research and development efforts to reduce vulnerabilities through the adoption of more secure technologies. Establishing a comprehensive national awareness program to promote efforts to strengthen cybersecurity throughout government and the private sector, including the home user.

Improving cybersecurity-related education, training, and certification opportunities. Partnering with federal, state, and local governments in efforts to strengthen the cybersecurity of the nation’s critical information infrastructure to assist in the deterrence, prevention, preemption of, and response to terrorist attacks against the United States.

Working in conjunction with other federal agencies, international organizations, and industry in efforts to promote strengthened cybersecurity on a global basis.

Coordinating and integrating applicable national preparedness goals with its National Infrastructure Protection Plan.

Appendix II: Key Attributes of Cyber Analysis and Warning Capabilities

Attribute Establish a baseline understanding of network assets and normal network traffic volume and flow Assess risks to network assets Obtain internal information on network operations via technical tools and user reports Obtain external information on threats, vulnerabilities, and incidents through various relationships, alerts, and other sources Detect anomalous activities Verify that an anomaly is an incident (threat of attack or actual attack) Investigate the incident to identify the type of cyber attack, estimate impact, and collect evidence Identify possible actions to mitigate the impact of the incident Integrate results into predictive analysis of broader implications or potential future attack Develop attack and other notifications that are targeted and actionable Provide notifications in a timely manner Distribute notifications using appropriate communications methods Contain and mitigate the incident Recover from damages and remediate vulnerabilities Evaluate actions and incorporate lessons learned This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.