Cybersecurity: Continued Attention Needed to Protect Our Nation's Critical Infrastructure
Released: 2011-07-26T00:00:00

Letter

Background

Critical infrastructures are systems and assets, whether physical or virtual, so vital to our nation that their incapacity or destruction would have a debilitating impact on national security, economic well-being, pubic health or safety, or any combination of these. Critical infrastructure includes, among other things, banking and financial institutions, telecommunications networks, and energy production and transmission facilities, most of which are owned by the private sector. As these critical infrastructures have become increasingly dependent on computer systems and networks, the interconnectivity between information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt critical systems, with potentially harmful effects.

Because the private sector owns most of the nation’s critical infrastructures, forming effective partnerships between the public and private sectors is vital to successfully protect cyber-reliant critical assets from a multitude of threats, including terrorists, criminals, and hostile nations. Federal law and policy have established roles and responsibilities for federal agencies to work with the private sector and other entities in enhancing the cyber and physical security of critical public and private infrastructures. These policies stress the importance of coordination between the government and the private sector to protect the nation’s computer-reliant critical infrastructure. In addition, they establish the Department of Homeland Security (DHS) as the focal point for the security of cyberspace—including analysis, warning, information sharing, vulnerability reduction, mitigation efforts, and recovery efforts for public and private critical infrastructure and information systems. Federal policy also establishes critical infrastructure sectors, assigns federal agencies to each sector (known as sector lead agencies), and encourages private sector involvement. Table 1 shows the 18 critical infrastructure sectors and the lead agencies assigned to each sector.

In May 1998, Presidential Decision Directive 63 (PDD-63) established critical infrastructure protection as a national goal and presented a strategy for cooperative efforts by the government and the private sector to protect the physical and cyber-based systems essential to the minimum operations of the economy and the government. Among other things, this directive encouraged the development of information sharing and analysis centers (ISAC) to serve as mechanisms for gathering, analyzing, and disseminating information on cyber infrastructure threats and vulnerabilities to and from owners and operators of the sectors and the federal government. For example, the Financial Services, Electricity Sector, IT, and Communications ISACs represent sectors or subcomponents of sectors.

The Homeland Security Act of 2002 created the Department of Homeland Security. Among other things, DHS was assigned with the following critical infrastructure protection responsibilities: (1) developing a comprehensive national plan for securing the key resources and critical infrastructures of the United States, (2) recommending measures to protect those key resources and critical infrastructures in coordination with other groups, and (3) disseminating, as appropriate, information to assist in the deterrence, prevention, and preemption of or response to terrorist attacks.

In 2003, the National Strategy to Secure Cyberspace was issued, which assigned DHS multiple leadership roles and responsibilities in protecting the nation’s cyber critical infrastructure. These include (1) developing a comprehensive national plan for critical infrastructure protection; (2) developing and enhancing national cyber analysis and warning capabilities; (3) providing and coordinating incident response and recovery planning, including conducting incident response exercises; (4) identifying, assessing, and supporting efforts to reduce cyber threats and vulnerabilities, including those associated with infrastructure control systems; and (5) strengthening international cyberspace security.

PDD-63 was superseded in December 2003 when Homeland Security Presidential Directive 7 (HSPD-7) was issued. HSPD-7 defined additional responsibilities for DHS, sector-specific agencies, and other departments and agencies. The directive instructs sector-specific agencies to identify, prioritize, and coordinate the protection of critical infrastructures to prevent, deter, and mitigate the effects of attacks. It also makes DHS responsible for, among other things, coordinating national critical infrastructure protection efforts and establishing uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across sectors.

As part of its implementation of the cyberspace strategy and other requirements to establish cyber analysis and warning capabilities for the nation, DHS established the United States Computer Emergency Readiness Team (US-CERT) to help protect the nation’s information infrastructure. US-CERT is the focal point for the government’s interaction with federal and private-sector entities 24 hours a day, 7 days a week, and provides cyber-related analysis, warning, information-sharing, major incident response, and national-level recovery efforts.

Cyber-Reliant Critical Infrastructures Face a Proliferation of Threats

Threats to systems supporting critical infrastructure are evolving and growing. In February 2011, the Director of National Intelligence testified that, in the past year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, including a more than tripling of the volume of malicious software since 2009. Different types of cyber threats from numerous sources may adversely affect computers, software, networks, organizations, entire industries, or the Internet itself. Cyber threats can be unintentional or intentional. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled employees, foreign nations engaged in espionage and information warfare, and terrorists.

The potential impact of these threats is amplified by the connectivity between information systems, the Internet, and other infrastructures, creating opportunities for attackers to disrupt telecommunications, electrical power, and other critical services. For example, in May 2008, we reported that the Tennessee Valley Authority’s (TVA) corporate network contained security weaknesses that could lead to the disruption of control systems networks and devices connected to that network. We made 19 recommendations to improve the implementation of information security program activities for the control systems governing TVA’s critical infrastructures and 73 recommendations to address specific weaknesses in security controls. TVA concurred with the recommendations and has taken steps to implement them. As government, private sector, and personal activities continue to move to networked operations, the threat will continue to grow.

Recent reports of cyber attacks illustrate that the cyber-based attacks on cyber-reliant critical infrastructures could have a debilitating impact on national and economic security.

In June 2011, a major bank reported that hackers broke into its systems and gained access to the personal information of hundreds of thousands of customers. Through the bank’s online banking system, the attackers were able to view certain private customer information.

In March 2011, according to the Deputy Secretary of Defense, a cyber attack on a defense company’s network captured 24,000 files containing Defense Department information. He added that nations typically launch such attacks, but there is a growing risk of terrorist groups and rogue states developing similar capabilities.

In March 2011, a security company reported that it had suffered a sophisticated cyber attack that removed information about its two- factor authentication tool. According to the company, the extracted information did not enable successful direct attacks on any of its customers; however, the information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.

In February 2011, media reports stated that computer hackers broke into and stole proprietary information worth millions of dollars from the networks of six U.S. and European energy companies.

In July 2010, a sophisticated computer attack, known as Stuxnet, was discovered. It targeted control systems used to operate industrial processes in the energy, nuclear, and other critical sectors. It is designed to exploit a combination of vulnerabilities to gain access to its target and modify code to change the process.

In January 2010, it was reported that at least 30 technology companies—most in Silicon Valley, California—were victims of intrusions. The cyber attackers infected computers with hidden programs allowing unauthorized access to files that may have included the companies’ computer security systems, crucial corporate data, and software source code.

The Federal Government Has Taken Steps to Address Cyber Threats to Cyber Critical Infrastructure

Over the past 2 years, the federal government has taken a number of steps aimed at addressing cyber threats to critical infrastructure.

In early 2009, the President initiated a review of the nation’s cyberspace policy that specifically assessed the missions and activities associated with the nation’s information and communication infrastructure and issued the results in May of that year. The review resulted in 24 near- and mid- term recommendations to address organizational and policy changes to improve the current U.S. approach to cybersecurity. These included, among other things, that the President appoint a cybersecurity policy official for coordinating the nation’s cybersecurity policies and activities. In December 2009, the President appointed a Special Assistant to the President and Cybersecurity Coordinator to serve in this role and act as the central coordinator for the nation’s cybersecurity policies and activities. Among other things, this official is to chair the primary policy coordination body within the Executive Office of the President responsible for directing and overseeing issues related to achieving a reliable global information and communications infrastructure.

Also in 2009, DHS issued an updated version of its National Infrastructure Protection Plan (NIPP). The NIPP is intended to provide the framework for a coordinated national approach to addressing the full range of physical, cyber, and human threats and vulnerabilities that pose risks to the nation’s critical infrastructures. The NIPP relies on a sector partnership model as the primary means of coordinating government and private-sector critical infrastructure protection efforts. Under this model, each sector has both a government council and a private sector council to address sector-specific planning and coordination. The government and private-sector councils are to work in tandem to create the context, framework, and support for the coordination and information-sharing activities required to implement and sustain each sector’s infrastructure protection efforts. The council framework allows for the involvement of representatives from all levels of government and the private sector, to facilitate collaboration and information-sharing in order to assess events accurately, formulate risk assessments, and determine appropriate protective measures. The establishment of private-sector councils is encouraged under the NIPP model, and these councils are to be the principal entities for coordinating with the government on a wide range of CIP activities and issues. Using the NIPP partnership model, the private and public sectors coordinate to manage the risks related to cyber CIP by, among other things, sharing information, providing resources, and conducting exercises.

In October 2009, DHS established its National Cybersecurity and Communications Integration Center (NCCIC) to coordinate national response efforts and work directly with federal, state, local, tribal, and territorial governments and private-sector partners. The NCCIC integrates the functions of the National Cyber Security Center, US-CERT, the National Coordinating Center for Telecommunications, and the Industrial Control Systems CERT into a single coordination and integration center and co-locates other essential public and private sector cybersecurity partners.

In September 2010, DHS issued an interim version of its national cyber incident response plan. The purpose of the plan is to establish the strategic framework for organizational roles, responsibilities, and actions to prepare for, respond to, and begin to coordinate recovery from a cyber incident. It aims to tie various policies and doctrine together into a single tailored, strategic, cyber-specific plan designed to assist with operational execution, planning, and preparedness activities and to guide short-term recovery efforts.

DHS has also coordinated several cyber attack simulation exercises to strengthen public and private incident response capabilities. In September 2010, DHS conducted the third of its Cyber Storm exercises, which are large-scale simulations of multiple concurrent cyber attacks. (DHS previously conducted Cyber Storm exercises in 2006 and 2008.) The third Cyber Storm exercise was undertaken to test the National Cyber Incident Response Plan, and its participants included representatives from federal departments and agencies, states, ISACs, foreign countries, and the private sector.

Challenges in Protecting Cyber Critical Infrastructure Persist

Despite the actions taken by several successive administrations and the executive branch agencies, significant challenges remain to enhancing the protection of cyber-reliant critical infrastructures.

Implementing actions recommended by the president’s cybersecurity policy review. In October 2010, we reported that of the 24 near- and mid-term recommendations made by the presidentially initiated policy review to improve the current U.S. approach to cybersecurity, only 2 had been implemented and 22 were partially implemented. Officials from key agencies involved in these efforts (e.g., DHS, the Department of Defense, and the Office of Management and Budget) stated that progress had been slower than expected because agencies lacked assigned roles and responsibilities and because several of the mid-term recommendations would require action over multiple years. We recommended that the national Cybersecurity Coordinator designate roles and responsibilities for each recommendation and develop milestones and plans, including measures, to show agencies’ progress and performance.  Updating the national strategy for securing the information and communications infrastructure. In March 2009, we testified on the needed improvements to the nation’s cybersecurity strategy. In preparation for that testimony, we convened a panel of experts that included former federal officials, academics, and private-sector executives. The panel highlighted 12 key improvements that, in its view, were essential to improving the strategy and our national cybersecurity postures, including (1) the development of a national strategy that clearly articulates objectives, goals, and priorities; (2) focusing more actions on prioritizing assets and functions, assessing vulnerabilities, and reducing vulnerabilities than on developing plans; and (3) bolstering public-private partnerships though an improved value proposition and use of incentives.  Reassessing the cyber sector-specific planning approach to critical infrastructure protection. In September 2009, we reported that, among other things, sector-specific agencies had yet to update their respective sector-specific plans to fully address key DHS cyber security criteria. In addition, most agencies had not updated the actions and reported progress in implementing them as called for by DHS guidance. We noted that these shortfalls were evidence that the sector planning process has not been effective and thus leaves the nation in the position of not knowing precisely where it stands in securing cyber critical infrastructures. We recommended that DHS (1) assess whether existing sector-specific planning processes should continue to be the nation’s approach to securing cyber and other critical infrastructure and consider whether other options would provide more effective results and (2) collaborate with the sectors to develop plans that fully address cyber security requirements. DHS concurred with the recommendations and has taken action to address them. For example, the department reported that it undertook a study in 2009 that determined that the existing sector-specific planning process, in conjunction with other related efforts planned and underway, should continue to be the nation’s approach. In addition, at about this time, the department met and worked with sector officials to update sector plans with the goal of fully addressing cyber-related requirements.  Strengthening the public-private partnerships for securing cyber- critical infrastructure. The expectations of private sector stakeholders are not being met by their federal partners in areas related to sharing information about cyber-based threats to critical infrastructure. In July 2010, we reported that federal partners, such as DHS, were taking steps that may address the key expectations of the private sector, including developing new information-sharing arrangements. We also reported that public sector stakeholders believed that improvements could be made to the partnership, including improving private sector sharing of sensitive information. We recommended, among other things, that the national Cybersecurity Coordinator and DHS work with their federal and private-sector partners to enhance information-sharing efforts, including leveraging a central focal point for sharing information among the private sector, civilian government, law enforcement, the military, and the intelligence community. DHS concurred with this recommendation and officials stated that they have made progress in addressing the recommendation. We will be determining the extent of that progress as part of our audit follow-up efforts.  Enhancing cyber analysis and warning capabilities. DHS’s US-CERT has not fully addressed 15 key attributes of cyber analysis and warning capabilities that we identified. As a result, we recommended in July 2008 that the department address shortfalls associated with the 15 attributes in order to fully establish a national cyber analysis and warning capability as envisioned in the national strategy. DHS agreed in large part with our recommendations and has reported that it is taking steps to implement them. We are currently working with DHS officials to determine the status of their efforts to address these recommendations.  Addressing global cybersecurity and governance. Based on our review, the U.S. government faces a number of challenges in formulating and implementing a coherent approach to global aspects of cyberspace, including, among other things, providing top-level leadership, developing a comprehensive strategy, and ensuring cyberspace-related technical standards and policies do not pose unnecessary barriers to U.S. trade. Specifically, we determined that the national Cybersecurity Coordinator’s authority and capacity to effectively coordinate and forge a coherent national approach to cybersecurity were still under development. In addition, the U.S. government had not documented a clear vision of how the international efforts of federal entities, taken together, support overarching national goals. Further, we learned that some countries had attempted to mandate compliance with their indigenously developed cybersecurity standards in a manner that risked discriminating against U.S. companies. We recommended that, among other things, the Cybersecurity Coordinator develop with other relevant entities a comprehensive U.S. global cyberspace strategy that, among other things, addresses technical standards and policies while taking into consideration U.S. trade. In May 2011, the White House released the International Strategy for Cyberspace: Prosperity, Security, and Openness in a Networked World. We will be determining the extent that this strategy addresses our recommendation as part of our audit follow-up efforts.  Securing the modernized electricity grid. In January 2011, we reported on progress and challenges in developing, adopting, and monitoring cybersecurity guidelines for the modernized, IT-reliant electricity grid (referred to as the “smart grid”). Among other things, we identified six key challenges to securing smart grid systems. These included, among others,  a lack of security features being built into certain smart grid  a lack of an effective mechanism for sharing information on cybersecurity within the electric industry, and  a lack of electricity industry metrics for evaluating cybersecurity.

We also reported that the Department of Commerce’s National Institute for Standards and Technology (NIST) had developed and issued a first version of its smart grid cybersecurity guidelines. While NIST largely addressed key cybersecurity elements that it had planned to include in the guidelines, it did not address an important element essential to securing smart grid systems that it had planned to include—addressing the risk of attacks that use both cyber and physical means. NIST officials said that they intend to update the guidelines to address the missing elements, and have drafted a plan to do so. While a positive step, the plan and schedule were still in draft form. We recommended that NIST finalize its plan and schedule for updating its cybersecurity guidelines to incorporate missing elements; NIST agreed with this recommendation.

In addition to the challenges we have previously identified, we have ongoing work in two key areas related to the protection of cyber critical infrastructures. The first is to identify the extent to which cybersecurity guidance has been specified within selected critical infrastructure sectors and to identify areas of commonality and difference between sector- specific guidance and guidance applicable to federal agencies. The second is a study of risks associated with the supply chains used by federal agencies to procure IT equipment, software, or services, along with the extent to which national security-related agencies are taking risk- based approaches to supply-chain management. We plan to issue the results of this work in November 2011 and early 2012, respectively.

In summary, the threats to information systems are evolving and growing, and systems supporting our nation’s critical infrastructure are not sufficiently protected to consistently thwart the threats. While actions have been taken, the administration and executive branch agencies need to address the challenges in this area to improve our nation’s cybersecurity posture, including enhancing cyber analysis and warning capabilities and strengthening the public-private partnerships for securing cyber-critical infrastructure. Until these actions are taken, our nation’s cyber critical infrastructure will remain vulnerable. Mr. Chairman, this completes my statement. I would be happy to answer any questions you or other members of the Subcommittee have at this time.

Contact and Acknowledgments

If you have any questions regarding this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other key contributors to this statement include Michael Gilmore (Assistant Director), Bradley Becker, Kami Corbett, and Lee McCracken.

Related GAO Products

Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure and Federal Information Systems. GAO-11-463T. Washington, D.C.: March 16, 2011.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011.

Electricity Grid Modernization: Progress Being Made on Cybersecurity Guidelines, but Key Challenges Remain to be Addressed. GAO-11-117. Washington, D.C.: January 12, 2011.

Information Security: Federal Agencies Have Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate Risk. GAO-11-43. Washington, D.C.: November 30, 2010.

Cyberspace Policy: Executive Branch Is Making Progress Implementing 2009 Policy Review Recommendations, but Sustained Leadership Is Needed. GAO-11-24. Washington, D.C.: October 6, 2010.

Information Security: Progress Made on Harmonizing Policies and Guidance for National Security and Non-National Security Systems. GAO-10-916. Washington, D.C.: September 15, 2010.

Information Management: Challenges in Federal Agencies’ Use of Web 2.0 Technologies. GAO-10-872T. Washington, D.C.: July 22, 2010.

Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed. GAO-10-628. Washington, D.C.: July 15, 2010.

Cyberspace: United States Faces Challenges in Addressing Global Cybersecurity and Governance. GAO-10-606. Washington, D.C.: July 2, 2010.

Cybersecurity: Continued Attention Is Needed to Protect Federal Information Systems from Evolving Threats. GAO-10-834T. Washington, D.C.: June 16, 2010.

Cybersecurity: Key Challenges Need to Be Addressed to Improve Research and Development. GAO-10-466. Washington, D.C.: June 3, 2010.

Information Security: Federal Guidance Needed to Address Control Issues with Implementing Cloud Computing. GAO-10-513. Washington, D.C.: May 27, 2010.

Cybersecurity: Progress Made but Challenges Remain in Defining and Coordinating the Comprehensive National Initiative. GAO-10-338. Washington, D.C.: March 5, 2010.

Critical Infrastructure Protection: DHS Needs to Fully Address Lessons Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington, D.C.: September 9, 2008.

Information Security: TVA Needs to Address Weaknesses in Control Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.