Critical Infrastructure Protection: Challenges in Addressing Cybersecurity
Released: 2005-07-19T00:00:00

Letter

Background

The same speed and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with computer operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. In recent years, the sophistication and effectiveness of cyberattacks have steadily advanced. These attacks often take advantage of flaws in software code, circumvent signature-based tools that commonly identify and prevent known threats, and use social engineering techniques designed to trick the unsuspecting user into divulging sensitive information or propagating attacks. These attacks are becoming increasingly automated with the use of botnets— compromised computers that can be remotely controlled by attackers to automatically launch attacks. Bots (short for robots) have become a key automation tool used to speed the infection of vulnerable systems.

Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as crime, terrorism, foreign intelligence-gathering, and acts of war. As greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests.

Recent attacks and threats have further underscored the need to bolster the cybersecurity of our government’s and our nation’s computer systems and, more importantly, of the critical operations and infrastructures they support. Recent examples of attacks include the following: In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to U.S. utilities’ electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had “caused an impact.” While officials stated that hackers had not caused serious damage to the systems that feed the nation’s power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified their defenses against a potential catastrophic strike.

In January 2005, a major university reported that a hacker had broken into a database containing 32,000 student and employee Social Security numbers, potentially compromising their identities and finances. In similar incidents during 2003 and 2004, it was reported that hackers had attacked the systems of other universities, exposing the personal information of over 1.8 million people.

In June 2003, the U.S. government issued a warning concerning a virus that specifically targeted financial institutions. Experts said the BugBear.b virus was programmed to determine whether a victim had used an e-mail address for any of the roughly 1,300 financial institutions listed in the virus’s code. If a match was found, the software attempted to collect and document user input by logging keystrokes and then provided this information to a hacker, who could use it in attempts to break into the banks’ networks.

In November 2002, a British computer administrator was indicted on charges that he accessed and damaged 98 computers in 14 states between March 2001 and March 2002, causing some $900,000 in damage. These networks belonged to the Department of Defense, the National Aeronautics and Space Administration, and private companies. The indictment alleges that the attacker was able to gain administrative privileges on military computers, copy password files, and delete critical system files. The attacks rendered the networks of the Earle Naval Weapons Station in New Jersey and the Military District of Washington inoperable.

In May 2005, we reported that federal agencies are facing a set of emerging cybersecurity threats that are the result of increasingly sophisticated methods of attack and the blending of once distinct types of attack into more complex and damaging forms. Examples of these threats include spam (unsolicited commercial e-mail), phishing (fraudulent messages used to obtain personal or sensitive data), and spyware (software that monitors user activity without the user’s knowledge or consent). Spam consumes significant resources and is used as a delivery mechanism for other types of cyberattacks; phishing can lead to identity theft, loss of sensitive information, and reduced trust and use of electronic government services; and spyware can capture and release sensitive data, make unauthorized changes, and decrease system performance.

DHS’s Responsibilities for Cybersecurity in Support of Critical Infrastructure Protection Are Many and Varied

Federal law and policies call for critical infrastructure protection (CIP) activities that are intended to enhance the cyber and physical security of both the public and private infrastructures that are essential to national security, national economic security, and national public health and safety. Federal policy designates certain federal agencies as lead federal points of contact for the critical infrastructure sectors and assigns them responsibility for infrastructure protection activities in their assigned sectors and for coordination with other relevant federal agencies, state and local governments, and the private sector to carry out related responsibilities (see app. 1). In addition, federal policy establishes the Department of Homeland Security (DHS) as the focal point for the security of cyberspace—including analysis, warning, information sharing, vulnerability reduction, mitigation, and recovery efforts for public and private critical infrastructure information systems. To accomplish this mission, DHS is to work with other federal agencies, state and local governments, and the private sector.

Among the many CIP responsibilities established for DHS and identified in federal law and policy are 13 key cybersecurity-related responsibilities. These include general CIP responsibilities that have a cyber element (such as developing national plans, building partnerships, and improving information sharing) as well as responsibilities that relate to the five priorities established by the National Strategy to Secure Cyberspace. The five priorities are (1) developing and enhancing national cyber analysis and warning, (2) reducing cyberspace threats and vulnerabilities, (3) promoting awareness of and training in security issues, (4) securing governments’ cyberspace, and (5) strengthening national security and international cyberspace security cooperation. Table 1 provides a description of each of these responsibilities.

In June 2003, DHS established the National Cyber Security Division (NCSD), under its Information Analysis and Infrastructure Protection Directorate, to serve as a national focal point for addressing cybersecurity issues and to coordinate implementation of the cybersecurity strategy. NCSD also serves as the government lead on a public/private partnership supporting the U.S. Computer Emergency Response Team (US-CERT) and as the lead for federal government incident response. NCSD is headed by the Office of the Director and includes a cybersecurity partnership program as well as four branches: US-CERT Operations, Law Enforcement and Intelligence, Outreach and Awareness, and Strategic Initiatives.

DHS Has Initiated Efforts That Begin to Address Its Responsibilities, but More Work Remains

DHS has initiated efforts that begin to address each of its 13 key responsibilities for cybersecurity; however, the extent of progress varies among these responsibilities, and more work remains to be done on each. For example, DHS (1) has recently issued an interim plan for infrastructure protection that includes cybersecurity plans, (2) is supporting a national cyber analysis and warning capability through its role in US-CERT, and (3) has established forums to build greater trust and to encourage information sharing among federal officials with information security responsibilities and among various law enforcement entities. However, DHS has not yet developed a national cyber threat assessment and sector vulnerability assessments—or the identification of cross-sector interdependencies—that are called for in the cyberspace strategy. The importance of such assessments is illustrated in our recent reports on vulnerabilities in infrastructure control systems and in wireless networks. Further, the department has not yet developed and exercised government and government/industry contingency recovery plans for cybersecurity, including a plan for recovering key Internet functions. The department also continues to have difficulties in developing partnerships, as called for in federal policy, with other federal agencies, state and local governments, and the private sector. Without such partnerships, it is difficult to develop the trusted, two-way information sharing that is essential to improving homeland security.

Table 2 provides an overview of the steps that DHS has taken related to each of its 13 key responsibilities and identifies the steps that remain.

DHS Continues to Face Challenges in Establishing Itself as a National Focal Point for Cyberspace Security

DHS faces a number of challenges that have impeded its ability to fulfill its cyber CIP responsibilities. Key challenges include achieving organizational stability, gaining organizational authority, overcoming hiring and contracting issues, increasing awareness about cybersecurity roles and capabilities, establishing effective partnerships with stakeholders (other federal, state, and local governments and the private sector), achieving two-way information sharing with these stakeholders, and providing and demonstrating the value DHS can provide.

Organizational stability: Over the last year, multiple senior DHS cybersecurity officials—including the NCSD Director, the Deputy Director responsible for Outreach and Awareness, and the Director of the US-CERT Control Systems Security Center, the Under Secretary for the Information Analysis and Infrastructure Protection Directorate and the Assistant Secretary responsible for the Information Protection Office—have left the department. Infrastructure sector officials stated that the lack of stable leadership has diminished NCSD’s ability to maintain trusted relationships with its infrastructure partners and has hindered its ability to adequately plan and execute activities. According to one private-sector representative, the importance of organizational stability in fostering strong partnerships cannot be over emphasized.

Organizational authority: NCSD does not have the organizational authority it needs to effectively serve as a national focal point for cybersecurity. Accordingly, its officials lack the authority to represent and commit DHS to efforts with the private sector. Infrastructure and cybersecurity officials, including the chairman of the sector coordinators and representatives of the cybersecurity industry, have expressed concern that the cybersecurity division’s relatively low position within the DHS organization hinders its ability to accomplish cybersecurity-related goals. NCSD’s lack of authority has led to some missteps, including DHS’s cancellation of an important cyber event without explanation and its taking almost a year to issue formal responses to private sector recommendations that resulted from selected National Cyber Security Summit task forces—even though responses were drafted within months.

A congressional subcommittee also expressed concern that DHS’s cybersecurity office lacks the authority to effectively fulfill its role. In 2004 and again in 2005, the subcommittee proposed legislation to elevate the head of the cybersecurity office to an assistant secretary position. Among other benefits, the subcommittee reported that such a change could provide more focus and authority for DHS’s cybersecurity mission, allow higher level input into national policy decisions, and provide a single visible point of contact within the federal government for improving interactions with the private sector.

To try to address these concerns, DHS recently announced that it would elevate responsibility for cybersecurity to an assistant secretary position.

Hiring and contracting: Ineffective DHS management processes have impeded the department’s ability to hire employees and maintain contracts. We recently reported that since DHS’s inception, its leadership has provided a foundation for maintaining critical operations while it undergoes transformation. However, in managing its transformation, we noted that the department still needed to overcome a number of significant challenges, including addressing systemic problems in human capital and acquisition systems. Federal and nonfederal officials expressed concerns about its hiring and contracting processes. For example, an NCSD official reported that the division has had difficulty in hiring personnel to fill vacant positions. These officials stated that once they found qualified candidates, some candidates decided not to apply and another one withdrew his acceptance because he felt that DHS’s hiring process had taken too long. In addition, a cybersecurity division official stated that there had been times when DHS did not renew NCSD contracts in a timely manner, requiring that key contractors work without pay until approvals could be completed and payments could be made. In other cases, NCSD was denied services from a vendor because the department had repeatedly failed to pay this vendor for its services. External stakeholders, including an ISAC representative, also noted that NCSD is hampered by how long it takes DHS to award a contract.

Awareness of DHS roles and capabilities: Many infrastructure stakeholders are not yet aware of DHS’s cybersecurity roles and capabilities. Department of Energy critical infrastructure officials stated that the roles and responsibilities of DHS and the sector- specific agencies need to be better clarified in order to improve coordination. In addition, during a regional cyber exercise, private- sector and state and local government officials reported that the mission of NCSD and the capabilities that DHS could provide during a serious cyber-threat were not clear to them. NCSD’s manager of cyber analysis and warning operations acknowledged that the organization has not done an adequate job reaching out to the private sector regarding the department’s role and capabilities.

Effective partnerships: NCSD is responsible for leveraging the assets of key stakeholders, including other federal, state, and local governments and the private sector, in order to facilitate effective protection of cyber assets. The ability to develop partnerships greatly enhances the agency’s ability to identify, assess, and reduce cyber threats and vulnerabilities, establish strategic analytical capabilities, provide incident response, enhance government cybersecurity, and improve international efforts. According to one infrastructure sector representative, effective partnerships require building relationships with mutually developed goals; shared benefits and responsibilities; and tangible, measurable results. However, this individual reported that DHS has not typically adopted these principles in pursuing partnerships with the private sector, which dramatically diminishes cybersecurity gains that government and industry could otherwise achieve. For example, it has often informed the infrastructure sectors about government initiatives or sought input after most key decisions have been made. Also, the department has not demonstrated that it recognizes the value of leveraging existing private sector mechanisms, such as information-sharing entities and processes that are already in place and working. In addition, the instability of NCSD’s leadership positions to date has led to problems in developing partnerships. Representatives from two ISACs reported that turnover at the cybersecurity division has hindered partnership efforts. Additionally, IT sector representatives stated that NCSD needs continuity of leadership, regular communications, and trusted policies and procedures in order to build the partnerships that will allow the private sector to share information.

Information sharing: We recently identified information sharing in support of homeland security as a high-risk area, and we noted that establishing an effective two-way exchange of information to help detect, prevent, and mitigate potential terrorist attacks requires an extraordinary level of cooperation and perseverance among federal, state, and local governments and the private sector. However, such effective communications are not yet in place in support of our nation’s cybersecurity. Representatives from critical infrastructure sectors stated that entities within their respective sectors still do not openly share cybersecurity information with DHS. As we have reported in the past, much of the concern is that the potential release of sensitive information could increase the threat to an entity. In addition, sector representatives stated that when information is shared, it is not clear whether the information will be shared with other entities—such as other federal entities, state and local entities, law enforcement, or various regulators—and how it will be used or protected from disclosure. Representatives from the banking and finance sector stated that the protection provided by the Critical Infrastructure Information Act and the subsequently established Protected Critical Infrastructure Information Program is not clear and has not overcome the trust barrier. Sector representatives have expressed concerns that DHS is not effectively communicating information to them. According to one infrastructure representative, DHS has not matched private sector efforts to share valuable information with a corresponding level of trusted information sharing. An official from the water sector noted that when representatives called DHS to inquire about a potential terrorist threat, they were told that DHS could not share any information and that they should “watch the news.”

Providing value: According to sector representatives, even when organizations within their sectors have shared information with NCSD, the entities do not consistently receive useful information in return. They noted that without a clear benefit, they are unlikely to pursue further information sharing with DHS. Federal officials also noted problems in identifying the value that DHS provides. According to Department of Energy officials, the department does not always provide analysis or reports based on the information that agencies provide. Federal and nonfederal officials also stated that most of US-CERT’s alerts have not been useful because they lack essential details or are based on already available information. Further, Treasury officials stated that US-CERT needed to provide relevant and timely feedback regarding the incidents that are reported to it.

Clearly, these challenges are not mutually exclusive. That is, addressing challenges in organizational stability and authority will help NCSD build the credibility it needs in order to establish effective partnerships and achieve two-way information sharing. Similarly, effective partnerships and ongoing information sharing with its stakeholders will allow DHS to better demonstrate the value it can add.

DHS has identified steps in its strategic plan for cybersecurity that can begin to address these challenges. Specifically, it has established goals and plans for improving human capital management that should help stabilize the organization. Further, the department has developed plans for communicating with stakeholders that are intended to increase awareness of its roles and capabilities and to encourage information sharing. Also, it has established plans for developing effective partnerships and improving analytical and watch and warning capabilities that could help build partnerships and begin to demonstrate added value. However, until it begins to address these underlying challenges, DHS cannot achieve significant results in coordinating cybersecurity activities, and our nation will lack the effective focal point it needs to better ensure the security of cyberspace for public and private critical infrastructure systems.

Implementation of GAO Recommendations Should Enhance Cybersecurity of Critical Infrastructures

Over the last several years, we have made a series of recommendations to enhance the cybersecurity of critical infrastructures, focusing on the need to (1) develop a strategic analysis and warning capability for identifying potential cyberattacks, (2) protect infrastructure control systems, (3) enhance public/private information sharing, and (4) conduct important threat and vulnerability assessments and address other challenges to effective cybersecurity. These recommendations are summarized below.

Strategic Analysis and Warnings: In 2001, we reported on the analysis and warnings efforts within DHS’s predecessor, the National Infrastructure Protection Center, and identified several challenges that were impeding the development of an effective strategic analysis and warning capability. We reported that a generally accepted methodology for analyzing strategic cyber-based threats did not exist. Specifically, there was no standard terminology, no standard set of factors to consider, and no established thresholds for determining the sophistication of attack techniques. We also reported that the Center did not have the industry-specific data on factors such as critical systems components, known vulnerabilities, and interdependencies.

We therefore recommended that the responsible executive-branch officials and agencies establish a capability for strategic analysis of computer-based threats, including developing a methodology, acquiring expertise, and obtaining infrastructure data. However, officials have taken little action to establish this capability, and therefore our recommendations remain open today.

Control Systems: In March 2004, we reported that several factors—including the adoption of standardized technologies with known vulnerabilities and the increased connectivity of control systems to other systems—contributed to an escalation of the risk of cyber-attacks against control systems. We recommended that DHS develop and implement a strategy for coordinating with the private sector and with other government agencies to improve control system security, including an approach for coordinating the various ongoing efforts to secure control systems. DHS concurred with our recommendation and, in December 2004, issued a high- level national strategy for control systems security. This strategy includes, among other things, goals to create a capability to respond to attacks on control systems and to mitigate vulnerabilities, bridge industry and government efforts, and develop control systems security awareness. However, the strategy does not yet include underlying details and milestones for completing activities.

Information Sharing: In July 2004, we recommended actions to improve the effectiveness of DHS’s information-sharing efforts. We recommended that officials within the Information Analysis and Infrastructure Protection Directorate (1) proceed with and establish milestones for developing an information-sharing plan and (2) develop appropriate DHS policies and procedures for interacting with ISACs, sector coordinators (groups or individuals designated to represent their respective infrastructure sectors’ CIP activities), and sector-specific agencies and for coordination and information sharing within the Information Analysis and Infrastructure Protection Directorate and other DHS components. These recommendations remain open today. Moreover, we recently designated establishing appropriate and effective information- sharing mechanisms to improve homeland security as a new high- risk area. We reported that the ability to share security-related information can unify the efforts of federal, state, and local government agencies and the private sector in preventing or minimizing terrorist attacks.

Threat and Vulnerability Assessments and Other Challenges: Most recently, in May 2005, we reported that while DHS has made progress in planning and coordinating efforts to enhance cybersecurity, much more work remains to be done to fulfill its basic responsibilities—including conducting important threat and vulnerability assessments and recovery plans. Further, we reported that DHS faces key challenges in building its credibility as a stable, authoritative, and capable organization and in leveraging private/public assets and information in order to clearly demonstrate the value it can provide. We made recommendations to strengthen the department’s ability to implement key cybersecurity responsibilities by prioritizing and completing critical activities and resolving underlying challenges.

We recently met with DHS’s acting director for cybersecurity who told us that DHS agreed with our findings and has initiated plans to address our recommendations. He acknowledged that DHS has not adequately leveraged their public and private stakeholders in a prioritized manner and it plans to begin its prioritized approach by focusing stakeholders on information sharing, preparedness, and recovery. He also added that NCSD is attempting to prioritize its major activities consistent with the secretary’s vision of risk management and the National Infrastructure Protection Plan approach.

In summary, as our nation has become increasingly dependent on timely, reliable information, it has also become increasingly vulnerable to attacks on the information infrastructure that supports the nation’s critical infrastructures (including the energy, banking and finance, transportation, telecommunications, and drinking water infrastructures). Federal law and policy acknowledge this by establishing DHS as the focal point for coordinating cybersecurity plans and initiatives with other federal agencies, state and local governments, and private industry. DHS has made progress in planning and coordinating efforts to enhance cybersecurity, but much more work remains to be done for the department to fulfill its basic responsibilities—including conducting important threat and vulnerability assessments and recovery plans.

As DHS strives to fulfill its mission, it faces key challenges in building its credibility as a stable, authoritative, and capable organization and in leveraging private and public assets and information in order to clearly demonstrate the value it can provide. Until it overcomes the many challenges it faces and completes critical activities, DHS cannot effectively function as the cybersecurity focal point intended by law and national policy. As such, there is increased risk that large portions of our national infrastructure are either unaware of key areas of cybersecurity risks or unprepared to effectively address cyber emergencies. Over the last several years, we have made a series of recommendations to enhance the cybersecurity of critical infrastructures. These include (1) developing a strategic analysis and warning capability for identifying potential cyberattacks, (2) protecting infrastructure control systems, (3) enhancing public/private information sharing, and (4) conducting important threat and vulnerability assessments and address other challenges to effective cybersecurity. Effectively implementing these recommendations could greatly improve our nation’s cybersecurity posture.

Mr. Chairman, this concludes my statement. I would be happy to answer any questions that you or members of the subcommittee may have at this time.

If you have any questions on matters discussed in this testimony, please contact me at (202) 512-9286 or by e-mail at pownerd@gao.gov. Other key contributors to this report include Joanne Fiorino, Michael Gilmore, Barbarol James, Colleen Phillips, and Nik Rapelje.

Appendix I: Infrastructure Sectors and Lead Agencies Identified by Federal Policies on Critical Infrastructure Protection

Provides for the fundamental need for food. The infrastructure includes supply chains for feed and crop production. Provides the financial infrastructure of the nation. This sector consists of commercial banks, insurance companies, mutual funds, government- sponsored enterprises, pension funds, and other financial institutions that carry out transactions, including clearing and settlement. Transforms natural raw materials into commonly used products benefiting society’s health, safety, and productivity. The chemical industry produces more than 70,000 products that are essential to automobiles, pharmaceuticals, food supply, electronics, water treatment, health, construction, and other necessities. Includes prominent commercial centers, office buildings, sports stadiums, theme parks, and other sites where large numbers of people congregate to pursue business activities, conduct personal commercial transactions, or enjoy recreational pastimes. Comprises approximately 80,000 dam facilities, including larger and nationally symbolic dams that are major components of other critical infrastructures that provide electricity and water. Supplies the military with the means to protect the nation by producing weapons, aircraft, and ships and providing essential services, including information technology and supply and maintenance. Sanitizes the water supply through about 170,000 public water systems. These systems depend on reservoirs, dams, wells, treatment facilities, pumping stations, and transmission lines. Saves lives and property from accidents and disaster. This sector includes fire, rescue, emergency medical services, and law enforcement organizations. Provides the electric power used by all sectors, including critical infrastructures, and the refining, storage, and distribution of oil and gas. The sector is divided into electricity and oil and natural gas. Carries out the post-harvesting of the food supply, including processing and retail sales.

Ensures national security and freedom and administers key public functions. Includes the buildings owned and leased by the federal government for use by federal entities. Provides communications and processes to meet the needs of businesses and government.

Includes key assets that are symbolically equated with traditional American values and institutions or U.S. political and economic power. Includes 104 commercial nuclear reactors; research and test nuclear reactors; nuclear materials; and the transportation, storage, and disposal of nuclear materials and waste.

Delivers private and commercial letters, packages, and bulk assets. The U.S. Postal Service and other carriers provide the services of this sector. Mitigates the risk of disasters and attacks and also provides recovery assistance if an attack occurs. The sector consists of health departments, clinics, and hospitals. Enables movement of people and of assets that are vital to our economy, mobility, and security via aviation, ships, rail, pipelines, highways, trucks, buses, and mass transit.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.