Critical Infrastructure Protection (CIP) involves activities that enhance the cyber and physical security of the public and private infrastructures that are critical to national security, national economic security, and national public health and safety. Because a large percentage of the nation’s critical infrastructures is owned and operated by the private sector, public/private partnerships are crucial for successful critical infrastructure protection. Recent terrorist attacks and threats have further underscored the need to encourage and manage CIP activities. Vulnerabilities are being identified on a more frequent basis and, if these vulnerabilities are exploited, several of our nation’s critical infrastructures could be disrupted or disabled. Several types of organizations and individuals are capable of conducting attacks on our nation’s critical infrastructures. Historically, attacks on our infrastructures could be conducted only by a relatively small number of entities. However, with critical infrastructures’ increasing reliance on computers and networks, more organizations and individuals can cause harm using cyber attacks. Further, U.S. authorities are becoming increasingly concerned about the prospect of combined physical and cyber attacks, which could have devastating consequences. Table 1 lists sources of threats that have been identified by the U.S. intelligence community and others. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent—such as crime, terrorism, foreign intelligence gathering, and acts of war. For example, in February 2005, the Federal Bureau of Investigation Director testified before the Senate Select Committee on Intelligence about current threats—including cyber threats—to the United States. He stated that the cyber threat to the United States is serious, and the number of actors with both the ability and the desire to use computers for illegal and harmful purposes continues to rise. The Director added that individuals or groups from foreign states, including foreign governments, continue to pose threats to our national and economic security because they have the resources to support advanced network exploitation and attack. In addition, he stated that “terrorists show a growing understanding of the critical role of information technology in the day-to-day operations of our economy and national security and have expanded their recruitment to include people studying math, computer science and engineering.” The Director further stated that although individual hackers do not pose a great threat, hackers intent on stealing information or motivated by money are a concern—adding that “if this pool of talent is utilized by terrorists, foreign governments or criminal organizations, the potential for a successful cyber attack on our critical infrastructures is greatly increased.” Analyses by various organizations have also demonstrated the increasing threats that are faced by critical infrastructure sectors in the United States. For example, in May 2004, the E-Crime Watch™ survey of security and law enforcement executives found that 43 percent of the respondents reported “an increase in electronic crimes and intrusions over the previous year and 70 percent reported at least one electronic crime or intrusion being committed against their organization.” Regarding the source of the electronic crime or intrusion, 70 percent of respondents reported that they knew the source. The respondents most frequently identified hackers (40 percent), followed by current and former employees and contractors (31 percent), as the greatest threats to cybersecurity. Similarly, respondents to the 2003 Computer Security Institute and Federal Bureau of Investigation Computer Crime and Security Survey identified independent hackers as the most likely source of cyber attacks, as shown in table 2. As larger amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. According to the Federal Bureau of Investigation, terrorists, transnational criminals, and intelligence services are quickly becoming aware of and using tools such as computer viruses, Trojan horses, worms, logic bombs, and eavesdropping programs (“sniffers”) that can deny access, degrade the integrity of, intercept, or destroy data (see table 3). Viruses and worms are commonly used to launch denial-of-service attacks, which generally flood targeted networks and systems by transmitting so much data that regular traffic is either slowed or stopped. Such attacks have been used ever since the groundbreaking Morris worm, which brought 10 percent of the systems connected to the Internet to a halt in November 1988. In 2001, the Code Red worm used a denial-of-service attack to affect millions of computer users by shutting down Web sites, slowing Internet service and disrupting business and government operations. As the number of individuals with computer skills has increased, intrusion tools have become more readily available and relatively easy to use. Frequently, skilled hackers develop exploitation tools and post them on Internet hacking sites. These tools are then readily available for others to download, allowing even inexperienced programmers to create a computer virus or to literally point and click to launch an attack. According to the National Institute of Standards and Technology, 30 to 40 new attack tools are posted on the Internet every month. Experts also agree that there has been a steady advance in the sophistication and effectiveness of attack technologies. Intruders quickly develop attacks to exploit vulnerabilities that have been discovered in products, use these attacks to compromise computers, and share them with other attackers. In addition, they can combine these attacks with other forms of technology to develop programs that automatically scan the network for vulnerable systems, attack them, compromise them, and use them to spread the attack even further. In addition to the growing threat from terrorists, transnational criminals, foreign intelligence services, and hackers, there has been a growing number of software vulnerabilities. Flaws in software code that could cause a program to malfunction generally result from programming errors that occur during software development. The increasing complexity and size of software programs contribute to an increase in software flaws. For example, Microsoft Windows 2000 reportedly contains about 35 million lines of code, compared with about 15 million lines for Windows 95. As reported by the National Institute of Science and Technology, based on studies of code inspections, there can be as many as 20 flaws per thousand lines of software code. While most flaws do not create security vulnerabilities, the potential for these errors reflects the difficulty and complexity of delivering trustworthy code. By exploiting software vulnerabilities, hackers and others who spread malicious code can cause significant damage, ranging from defacing Web sites to taking control of entire systems and thereby being able to read, modify, or delete sensitive information; disrupt operations; launch attacks against other organizations’ systems; or destroy systems. Between 1995 and 2004, the Software Engineering Institute’s CERT® Coordination Center (CERT/CC) reported that 16,726 security vulnerabilities had resulted from software flaws. Figure 1 illustrates the increase in security vulnerabilities over these years. The growing number of known vulnerabilities increases the potential number of attacks. As vulnerabilities are discovered, attackers attempt to exploit them. Attacks can be launched against specific targets or widely distributed through viruses and worms. The risks posed by this increasing and evolving threat are demonstrated in media and other reports of actual and potential attacks and disruptions, such as those cited below. In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to U.S. utilities’ electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had “caused an impact.” While officials stated that hackers had not caused serious damage to the systems that feed the nation’s power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified their defenses against a potential catastrophic strike. In January 2005, a major university reported that a hacker had broken into a database containing 32,000 student and employee Social Security numbers, potentially compromising their finances and identities. In similar incidents during 2003 and 2004, it was reported that hackers had attacked the systems of other universities, exposing the personal information of over 1.8 million people. On August 11, 2003, the Blaster worm was launched, and it infected more than 120,000 computers in its first 36 hours. The worm was programmed to launch a denial-of-service attack against Microsoft’s Windows Update Web site, and it affected a wide range of systems and caused slowdowns and disruptions in users’ Internet services. For example, the Maryland Motor Vehicle Administration was forced to shut down its computer systems. In June 2003, the U.S. government issued a warning concerning a virus that specifically targeted financial institutions. Experts said the BugBear.b virus was programmed to determine whether a victim had used an e-mail address for any of the roughly 1,300 financial institutions listed in the virus’s code. If a match was found, the software attempted to collect and document user input by logging keystrokes and then provide this information to a hacker, who could use it in attempts to break into the banks’ networks. In May 2004, we reported that according to a preliminary study coordinated by the Cooperative Association for Internet Data Analysis, on January 25, 2003, the SQL Slammer worm (also known as “Sapphire” and “SQL Hell”) infected more than 90 percent of vulnerable computers worldwide within 10 minutes of its release on the Internet. As the study reports, exploiting a known vulnerability for which a patch had been available since July 2002, Slammer doubled in size every 8.5 seconds and achieved its full scanning rate (55 million scans per second) after about 3 minutes, causing considerable harm through network outages. Further, the study emphasized that the effects would likely have been more severe had Slammer carried a malicious payload, exploited a more widespread vulnerability, or targeted a more popular service. Despite its lack of malicious payload, Slammer caused significant damage, exacting a toll on several large companies and municipalities that found their internal networks deluged with data from the virus. Major financial institutions reported problems; for example, one reported that a majority of its automatic teller machines were unable to process customer transactions for several hours. The attack disrupted operations for several hours at a 911 call center that served two suburban police departments and at least 14 fire departments. A commercial airline had flights delayed or canceled because of online ticketing and electronic check-in problems. In November 2002, a British computer administrator was indicted on charges that he accessed and damaged 98 computers in 14 states between March 2001 and March 2002, causing some $900,000 in damage. These networks belonged to the Department of Defense, the National Aeronautics and Space Administration, and private companies. The indictment alleges that the attacker was able to gain administrative privileges on military computers, copy password files, and delete critical system files. The attacks rendered the networks of the Earle Naval Weapons Station in New Jersey and the Military District of Washington inoperable. The CERT/CC has noted that attacks that once took weeks or months to propagate over the Internet now take just hours—or even minutes— because automated tools are now available. For instance, while Code Red achieved an infection rate of over 20,000 systems within 10 minutes in July 2001, about a year and a half later, in January 2003, the Slammer worm successfully attacked at least 75,000 systems, infecting more than 90 percent of vulnerable systems within 10 minutes. According to CERT/CC, due to the widespread use of automated tools that have made attacks against Internet-connected systems so commonplace, it no longer publishes the number of incidents that are reported. For historical perspective, the number of computer security incidents reported to CERT/CC rose from just under 10,000 in 1999 to over 52,000 in 2001, to about 82,000 in 2002, and to 137,529 in 2003—when CERT/CC stopped reporting the number of incidents. Moreover, the Director of the CERT Centers stated that he estimates that as much as 80 percent of security incidents go unreported, in most cases because (1) the organization was unable to recognize that its systems had been penetrated or there were no indications of penetration or attack or (2) the organization was reluctant to report. Since September 11, 2001, the critical link between cyberspace and physical space has been increasingly recognized. In July 2002, the National Infrastructure Protection Center reported that the potential for compound cyber and physical attacks, referred to as “swarming attacks,” is an emerging threat to our nation’s critical infrastructures. Swarming attacks can slow down or complicate the response to a physical attack. For instance, a cyber attack that disabled the water supply or the electrical system, in conjunction with a physical attack, could deny emergency services the necessary resources to manage the consequences of the physical attack—such as controlling fires, coordinating actions, and generating light. There is a general consensus—and increasing concern—among government officials and experts on control systems, about potential cyber threats to the control systems that govern our critical infrastructures. In his November 2002 congressional testimony, the Director of the CERT Centers at Carnegie Mellon University noted that supervisory control and data acquisition systems and other forms of networked computer systems had been used for years to control power grids, gas and oil distribution pipelines, water treatment and distribution systems, hydroelectric and flood control dams, oil and chemical refineries, and other physical infrastructure systems. These control systems are increasingly being connected to communications links and networks to enhance performance and to reduce operational costs by supporting remote maintenance, remote control, and remote update functions. They are potential targets for individuals intent on causing massive disruption and physical damage. The use of commercial-off-the-shelf technologies for these systems—without adequate security enhancements—can significantly limit available approaches to protection and may increase the number of potential attackers. As components of control systems increasingly make critical decisions that were once made by humans, the potential effect of a cyber attack becomes more devastating. For example, a failed control system was a contributing factor in the widespread east coast electrical blackout of August 2003. While investigations later found that this incident was not the result of a deliberate attack, DHS officials stated that the significant involvement of a control system highlighted the fact that a physical system or location could be accessed through a cyber connection. Another example occurred in August 2003; the Nuclear Regulatory Commission confirmed that earlier that year the Slammer worm had infected a private computer network at a nuclear power plant, disabling a safety monitoring system for nearly 5 hours. The plant’s process computer failed, and it took about 6 hours for it to become available again. The worm reportedly also affected communications on the control networks of at least five other utilities by propagating so quickly that control system traffic was blocked. Looking ahead, 66 percent of the technology experts and scholars who responded to a 2004 survey on the future of the Internet believe that at least one devastating cyber attack will occur on the networked information infrastructure or the country’s power grid within the next 10 years. In March 2004, we reported on the significant challenges of securing controls systems, including technical limitations, perceived lack of economic justification, and conflicting organizational priorities. We recommended that the Secretary of DHS develop and implement a strategy for coordinating with the private sector and other government agencies to improve the security of control systems. This strategy was issued in December 2004. Over the years, the federal government and critical infrastructure representatives have sponsored working groups, written reports, issued policies, and created organizations to address CIP. To provide a historical perspective, table 4 summarizes the key developments in federal CIP policy since 1997. While policies and strategies for protecting our nation’s critical infrastructures have evolved over recent years, three key documents (a law, a national policy, and a national strategy) currently guide federal and nonfederal cybersecurity-related CIP efforts. The law establishes DHS’s responsibilities for critical infrastructure protection, a role that includes strengthening the security of our nation’s information infrastructure. The policy and strategy are consistent with the law, and reinforce and expand on it. Together, the three guiding documents contain numerous and varied requirements levied on DHS, of which 13 key responsibilities address cybersecurity. To fulfill its cybersecurity roles and responsibilities, DHS has established the National Cyber Security Division (NCSD). Federal law and policies establish CIP as a national goal and describe a strategy for cooperative efforts by government and the private sector to protect the physical and cyber-based systems that are essential to the minimum operations of the economy and the government. These include (1) the Homeland Security Act of 2002, (2) Homeland Security Presidential Directive-7 (HSPD-7), and (3) the National Strategy to Secure Cyberspace. A discussion of each follows. The Homeland Security Act of 2002, signed by the President on November 25, 2002, established DHS and gave it lead responsibility for preventing terrorist attacks in the United States, reducing the vulnerability of the United States to terrorist attacks, and minimizing the damage and assisting in recovery from attacks that do occur. To help DHS accomplish its mission, the act establishes, among other entities, five under secretaries with responsibility over directorates for management, science and technology, information analysis and infrastructure protection, border and transportation security, and emergency preparedness and response. The act also assigns the department a number of CIP responsibilities, including (1) developing a comprehensive national plan for securing the key resources and critical infrastructure of the United States; (2) recommending measures to protect the key resources and critical infrastructure of the United States in coordination with other federal agencies and in cooperation with state and local government agencies and authorities, the private sector, and other entities; and (3) disseminating, as appropriate, information analyzed by the department—both within the department and to other federal, state, and local government agencies and private-sector entities—to assist in the deterrence, prevention, preemption of, or response to terrorist attacks. In December 2003, the President issued HSPD-7, which superseded Presidential Decision Directive-63 and established a national policy for federal departments and agencies to identify and prioritize critical infrastructures and key resources and to protect them from terrorist attack. HSPD-7 defines responsibilities for DHS, sector-specific federal agencies that are responsible for addressing specific critical infrastructure sectors, and other departments and agencies. These responsibilities are briefly discussed below. DHS—HSPD-7 requires, among other things, that the Secretary of Homeland Security coordinate the national effort to enhance CIP; identify, prioritize, and coordinate the protection of critical infrastructure, emphasizing protection against catastrophic health effects or mass casualties; establish uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across sectors; serve as the focal point for securing cyberspace, including analysis, warning, information sharing, vulnerability reduction, mitigation, and recovery efforts for critical infrastructure information systems; and produce a comprehensive and integrated national plan for critical infrastructure and key resources protection that outlines national goals, objectives, milestones, and key initiatives. Sector-specific agencies—HSPD-7 designated certain federal agencies as lead federal points of contact for the critical infrastructure sectors identified in the National Strategy for Homeland Security (see table 5). These agencies are responsible for infrastructure protection activities in their assigned sectors and are to coordinate and collaborate with relevant federal agencies, state, and local governments, and the private sector to carry out related responsibilities. Other federal agencies—HSPD-7 instructs all federal departments and agencies to identify, prioritize, and coordinate the protection of their own critical infrastructures in order to prevent, deter, and mitigate the effects of attacks. In addition, this national policy recognizes that certain other federal entities have special functions related to critical infrastructure and key resources protection, such as the Department of Justice’s law enforcement function, the State Department’s foreign affairs function, and the Executive Office of the President’s Office of Science and Technology’s research and development policy-setting function. The National Strategy to Secure Cyberspace (cyberspace strategy), a national policy issued in February 2003, provides a framework for both organizing and prioritizing efforts to protect our nation’s cyberspace. It also provides direction to federal departments and agencies that have roles in cyberspace security and identifies steps that state and local governments, private companies and organizations, and individual Americans can take to improve our collective cybersecurity. In addition, the cyberspace strategy identifies DHS as the central coordinator for cyberspace security efforts. As such, DHS is responsible for coordinating and working with other federal and nonfederal entities that are involved in cybersecurity. The cyberspace strategy is organized according to five national priorities, and it identifies major actions and initiatives for each. The five priorities are (1) providing national cyber analysis, warning, and incident response; (2) reducing cyberspace threats and vulnerabilities; (3) promoting awareness and training; (4) securing governments’ cyberspace; and (5) strengthening national security and international cyberspace security cooperation. Among the many CIP roles and responsibilities established for DHS identified in federal law and policy are 13 key cybersecurity-related responsibilities. These include general CIP responsibilities that have a cyber element (such as developing national plans, building partnerships, and improving information sharing) as well as responsibilities that relate to the five priorities established by the cyberspace strategy. Table 6 provides a description of each responsibility. In June 2003, DHS established the National Cyber Security Division (NCSD), under its Information Analysis and Infrastructure Protection Directorate, to serve as a national focal point for addressing cybersecurity issues and to coordinate implementation of the cybersecurity strategy. NCSD also serves as the government lead on a public/private partnership supporting the U.S. Computer Emergency Response Team (US-CERT) and as the lead for federal government incident response. NCSD is headed by the Office of the Director and includes a cybersecurity partnership program as well as four branches: US-CERT Operations, Law Enforcement and Intelligence, Outreach and Awareness, and Strategic Initiatives. Table 7 displays the NCSD organization chart and the major functions of each organization; it is followed by a brief description of each organization’s roles and responsibilities. The NCSD/US-CERT Director is responsible for issues related to the operation of the NCSD, such as human resources, policy, and budget, as well as international coordination efforts. The director is responsible for managing US-CERT—which is a partnership between NCSD and the public and private sectors to make cybersecurity a coordinated, national effort; increase public awareness of cyber threats and vulnerabilities; and improve computer security preparedness and response to cyber threats. DHS Cyber Security Partnership Program This program is to foster effective public/private partnership among and between industry, government, and academia. It is intended to facilitate and leverage stakeholder collaboration to drive measurable progress in addressing cybersecurity issues and mitigating cyber vulnerabilities. Under the auspices of the partnership program, DHS works jointly with software developers, academic institutions, researchers, and communities of interest—including the information sharing and analysis centers (ISAC)— as well as with DHS’s federal, state, local, and international government counterparts. NCSD’s US-CERT Operations branch focuses on situational awareness, analytical cells, and federal coordination. It is to provide capabilities to US- CERT and coordinate all cyber incident warnings and responses across both the government and the private sector through US-CERT. A key component of US-CERT is the National Cyber Security Response System (Response System), which provides a nationwide, real-time collaborative information-sharing network to enable communication and collaboration among DHS and federal, state, local, and international government and law enforcement entities. Components of the Response System include the following: The US-CERT Operations Center serves as a 24-hour-a-day/7-day-a- week, real-time focal point for cybersecurity, conducting daily conference calls with U.S.-based watch and warning centers to share classified and unclassified security information. The US-CERT Portal provides a Web-based collaborative system that allows US-CERT to share sensitive cyber-related information with members of government and industry. The US-CERT Control Systems Security Center serves as an operational and strategic component of US-CERT’s capability to address the complex security issues associated with the use of control systems. The US-CERT public Web site provides government, the private sector, and the public with information they need to improve their ability to protect their information systems and infrastructures. The National Cyber Alert System is to deliver targeted, timely, and actionable information to Americans to allow them to secure their computer systems. The National Cyber Response Coordination Group brings together officials from federal agencies to coordinate public/private cyber preparedness and incident response. The Government Forum of Incident Response and Security Teams is a community of government response teams that are responsible for securing government information technology systems. This forum works to understand and handle computer security incidents and to encourage proactive and preventative security practices. Law Enforcement and Intelligence Branch The Law Enforcement and Intelligence branch of NCSD has two primary responsibilities: managing the National Cyber Response Coordinating Group and facilitating the coordination of law enforcement and intelligence cyber-related efforts for NCSD. This branch provides a mechanism for information sharing among the components concerned with cyber issues of law enforcement, intelligence, and the private sector. This information sharing includes all levels of information (classified, law enforcement sensitive, and unclassified). The branch coordinates clearing classified information of its sensitive content and shares it with private sector partners. NCSD’s Outreach and Awareness branch is responsible for outreach, awareness, and messaging. The branch promotes cybersecurity awareness among the general public and within key communities, maintains relationships with governmental cybersecurity professionals to coordinate and share information about cybersecurity initiatives, and develops partnerships to promote public/private coordination and collaboration on cybersecurity issues. The branch is organized into three functional areas: Stakeholder Outreach, Communications and Messaging, and Coordination. The Stakeholder Outreach team serves to build and maintain relationships among and between industry, government, and academia in order to raise cybersecurity awareness and secure cyberspace. The Communications and Messaging team focuses on coordination of internal and external communications. The Coordination team works to ensure collaboration on events and activities across NCSD and with other DHS entities, including the public affairs, legislative affairs, and private-sector offices and others, as appropriate. In addition, the team works to foster the department’s role as a focal point and coordinator for securing cyberspace and implementing the National Strategy to Secure Cyberspace. NCSD’s Strategic Initiatives branch is organized into six teams with different responsibilities, as follows: The CIP Cybersecurity team is jointly responsible (with DHS’s National Communications System) for developing a CIP plan for the Information Technology (IT) Sector, including the Internet, that will identify critical assets and vulnerabilities, map interdependencies, and promote cyber awareness throughout other federal sector plans. The Control Systems team is responsible for facilitating control system incident management and security awareness, establishing an assessment capability for vulnerability reduction and incident response, creating a self-sustaining security culture within the control systems community, focusing attention on the protection of legacy control systems, and making strategic recommendations for the future of control systems and security products. The Software Assurance initiative presents a framework for promoting and coordinating efforts to improve the security, reliability, and safety of software. The Training and Education team is responsible for promoting the development of an adequate number of effective cybersecurity professionals, enhancing cybersecurity capability within the federal workforce by identifying the skills and abilities necessary for specific job tasks, and working with other organizations to develop content standards for training products and for certifications. The Exercise Plans and Programs team is charged with improving the nation’s ability to respond to cyber incidents by creating, sponsoring, and learning from international, national, regional, and interagency exercises. The team is responsible for planning and coordinating cybersecurity exercises with internal and external DHS stakeholders. The Standards and Best Practices/Research and Development Coordination team works to encourage technology innovation efforts. The team is responsible for identifying cybersecurity research and development requirements and cybersecurity standards issues and for assembling and distributing information on best practices. DHS has additional directorates, branches, and offices with CIP responsibilities. In its role as the cybersecurity focal point, NCSD collaborates with these other DHS entities, including the Infrastructure Coordination Division, which runs the Protected Critical Infrastructure Information program to encourage sharing of sensitive information (including cybersecurity-related information), and the National Communications System, a federal interagency group, which is responsible for, among other things, improving the effectiveness of the management and use of national telecommunications resources to support the federal government during emergencies. In appendix II, we discuss other DHS entities with responsibilities for CIP-related activities that impact cybersecurity. DHS has initiated efforts that begin to address each of its 13 key responsibilities for cybersecurity; however, the extent of progress varies among these responsibilities, and more work remains to be done on each. For example, DHS (1) has recently issued an interim plan for infrastructure protection that includes cybersecurity plans, (2) is supporting a national cyber analysis and warning capability through its role in US-CERT, and (3) has established forums to build greater trust and to encourage information sharing among federal officials with information security responsibilities and among various law enforcement entities. However, DHS has not yet developed national cyber threat and vulnerability assessments or developed and exercised government and government/industry contingency recovery plans for cybersecurity, including a plan for recovering key Internet functions. The department also continues to have difficulties in developing partnerships, as called for in federal policy, with other federal agencies, state and local governments, and the private sector. Without such partnerships, it is difficult to develop the trusted, two-way information sharing that is essential to improving homeland security. We discuss below the steps that DHS has taken related to each of the department’s 13 key responsibilities and the steps that remain. In February 2005, DHS issued a national plan for critical infrastructure protection that includes cybersecurity-related initiatives. This plan, the Interim National Infrastructure Protection Plan (Interim NIPP), addresses many of the requirements identified in federal law and policy, but it does not yet comprise a comprehensive and complete plan. Specifically, the Interim NIPP provides a strategy for protecting critical infrastructures by integrating physical security and cybersecurity in its goals, objectives, and planned actions. Key actions include developing and implementing sector-specific and cross-sector protection plans; conducting cross-sector interdependency analysis; conducting and updating vulnerability assessments at the asset, sector, and cross-sector levels; and establishing performance metrics. In addition, the Interim NIPP establishes a national organizational structure to provide effective partnerships, communications, and coordination between DHS and infrastructure stakeholders. However, the plan does not yet comprise the comprehensive national plan envisioned in federal law and policy, for several reasons, including the following. The Interim NIPP lacks sector-specific cybersecurity plans. This plan does not yet include detailed plans for addressing cybersecurity in the infrastructure sectors. Agency officials acknowledge that many of the detailed plans for addressing cybersecurity will be included in the sector-specific annexes that are to be provided in the next version of the plan. To ensure that cybersecurity will be appropriately and consistently addressed in the next version of the plan, NCSD has provided guidance to sector-specific agencies regarding the inclusion of cybersecurity issues in their respective sector-specific plans. In addition, NCSD continues to review and provide feedback on the sector-specific plans, which will become annexes to the next NIPP. The Interim NIPP is not yet a final plan. The development of this plan is an ongoing, evolving process that requires the participation of key stakeholders, including other federal agencies, state and local governments, the private sector, foreign countries, and international organizations. DHS expects to obtain and incorporate stakeholder comments and to issue a more complete NIPP in November 2005. The Interim NIPP lacks required milestones. Specifically, this plan does not include any national-level milestones for completing efforts to enhance the security of the nation’s critical infrastructures. According to a DHS official, these milestones will be incorporated in the sector- specific plans. DHS acknowledges the need to address these issues with the Interim NIPP and plans to do so in subsequent versions. According to DHS officials, as the NIPP evolves and as the sector-specific plans are developed, the level of specificity will increase to include key initiatives and milestones. DHS has undertaken numerous initiatives to foster partnerships and enhance information sharing with other federal agencies, state and local governments, and the private sector about cyber attacks, threats, and vulnerabilities; but more work is needed to address underlying barriers to sharing information. DHS and NCSD have multiple initiatives under way to enhance partnerships and information sharing. Descriptions of selected initiatives are provided in table 7. Although NCSD has taken steps to develop partnerships and information- sharing mechanisms, the organization has not effectively leveraged its partnerships to increase the sharing of information. For example, although the Multi-State ISAC and US-CERT have established an effective working relationship, according to officials from both organizations, their ability to share classified information has been hindered by ISAC members’ lack of security clearances. Further, DHS officials reported that only limited information has been shared by the private sector under the Protected Critical Infrastructure Information program because of private sector concerns about what information DHS would share with other federal agencies. Additionally, key stakeholders in NCSD partnerships have expressed concerns about information sharing. For example, while officials from several CIP-related federal agencies found the Chief Information Security Officers forum to be valuable, officials from one agency stated that it had been largely ineffective in improving communications among federal agencies. Regarding NCSD’s efforts with the private sector, one ISAC reported publicly that its information sharing with DHS was disintegrating. Further, a representative from that ISAC stated that DHS had abruptly stopped sending notices to ISAC managers and no longer called the ISAC about new terrorism activity. Further, an ISAC official stated that when the ISAC recently contacted DHS’s Homeland Security Operations Center about rumors of a dirty bomb during a national event, ISAC officials were told to obtain the information from the media. Issues related to the development of partnerships and of appropriate information-sharing relationships are not new. In July 2004, we recommended actions to improve the effectiveness of DHS’s information- sharing efforts. We recommended that officials within the Information Analysis and Infrastructure Protection Directorate (1) proceed with and establish milestones for developing an information-sharing plan and (2) develop appropriate DHS policies and procedures for interacting with ISACs, sector coordinators (groups or individuals designated to represent their respective infrastructure sectors’ CIP activities), and sector-specific agencies and for coordination and information sharing within the Information Analysis and Infrastructure Protection Directorate and other DHS components. Moreover, we recently designated establishing appropriate and effective information-sharing mechanisms to improve homeland security as a new high-risk area. We reported that the ability to share security-related information can unify the efforts of federal, state, and local government agencies and the private sector in preventing or minimizing terrorist attacks. In its strategic plan for cybersecurity, DHS acknowledges the need to build better partnerships and information-sharing relationships. Among the actions that DHS identified are enhancing the US-CERT Operations Center’s capabilities and increasing participation in information-sharing mechanisms such as the National Cyber Alert System. For the nonfederal sector, DHS’s strategic plan for cybersecurity includes actions to develop effective public/private partnerships through associations, ISACs, Internet service providers, and improved international partnerships. For federal agency information security, the strategic plan identifies efforts to improve government mechanisms, such as the National Cyber Response Coordination Group and the Government Forum of Incident Response and Security Teams. In addition, the Interim NIPP acknowledges as a goal, the importance of building partnerships among stakeholders to implement critical infrastructure protection programs and identifies related objectives, including establishing mechanisms for coordination and information exchange among partners. DHS has collaborated on, developed, and is working to enhance tools and communication mechanisms for providing analysis and warning of occurring and potential cyber incidents, but it has not yet developed the indications and warning architecture required by HSPD-7, and important analytical tools are not yet mature. Through NCSD’s involvement in US-CERT, DHS provides cyber analysis and warning capabilities by providing continuous operational support in monitoring the status of systems and networks. When a new vulnerability or exploit is identified, US-CERT evaluates its severity; determines what actions should be taken and what message should be disseminated; and provides information through NCSD’s multiple communications channels, including its daily telephone call with other U.S.-based watch and warning centers, the US-CERT portal, the US-CERT public Web site, and the National Cyber Alert System. It produces the following types of warnings: Technical cybersecurity alerts—provide real-time information about current security issues, vulnerabilities, and exploits. Cybersecurity bulletins—provide technical audiences with weekly summaries of security issues and new vulnerabilities. Cybersecurity alerts—provide nontechnical audiences with real-time information about current issues, vulnerabilities, and exploits and include steps and actions that nontechnical users can take. Cybersecurity tips—describe common security issues and offer advice for nontechnical users. Vulnerability notes—provide warnings about vulnerabilities that do not meet the severity threshold required to issue an alert. Additionally, when a situation warrants direct contact with a federal agency, an infrastructure sector, or a nonfederal entity, NCSD contacts the entity and provides relevant information prior to making public announcements about the situation. This includes collaborating with relevant software vendors on a particular vulnerability or exploit. DHS is also involved in several initiatives to enhance cyber analytical capabilities. Key initiatives are identified in table 8. Despite its progress in providing analysis and warning capabilities, DHS has not yet developed or deployed a national indications and warning architecture for infrastructure protection that would identify the precursors to a cyber attack, and NCSD’s analytical capabilities are still evolving and are not yet robust. For example, the US-CERT Einstein program, identified in table 8, is in the early stages of deployment and is currently being pilot tested at one agency. In addition, NCSD officials acknowledge that the program’s current analytical capabilities are not expected to provide national-level indicators and precursors to a cyber attack, as called for in HSPD-7’s requirement that DHS provide an indications and warning architecture. DHS is still facing the same challenges in developing strategic analysis and warning capabilities that we reported on 4 years ago during a review of NCSD’s predecessor, the National Infrastructure Protection Center. In 2001, we reported on the analysis and warnings efforts within the center and identified several challenges that were impeding development of an effective strategic analysis and warning capability. We reported that a generally accepted methodology for analyzing strategic cyber-based threats did not exist. Specifically, there was no standard terminology, no standard set of factors to consider, and no established thresholds for determining the sophistication of attack techniques. We also reported that the Center did not have the industry-specific data on factors such as critical systems components, known vulnerabilities, and interdependencies. We therefore recommended that the responsible executive-branch officials and agencies establish a capability for strategic analysis of computer-based threats, including developing a methodology, acquiring expertise, and obtaining infrastructure data. However, officials have taken little action to establish this capability, and therefore our recommendations remain open today. In its strategic plan for cybersecurity, DHS acknowledges that it has more to do to enhance its analytical capability and to leverage existing capabilities. Specifically, it establishes objectives and activities to enhance the US-CERT Operations Center capability, expand the US-CERT Einstein Program pilot to a total of six agencies, promote consistency across federal civilian incident-response teams, develop a vulnerability assessment methodology and compile improve its coordinated cyber intelligence capability. DHS has improved its ability to coordinate a response to cyber attacks with federal, state, and local governments and private-sector entities through the communications capabilities that it has developed for US-CERT, the continued expansion of backup communication capabilities, and the establishment of collaboration mechanisms. However, DHS’s plans and exercises for recovering from attacks are not yet complete and comprehensive. As a partnership between DHS and the public and private sectors to make cybersecurity a coordinated national effort, US-CERT is an essential mechanism for coordinating information and activity on a real-time basis. US-CERT’s Operations Center, secure portal, public Web site, and National Cyber Alert System not only provide means for disseminating alerts and warnings—as discussed above—but they also support incident response and recovery efforts. Additionally, DHS is expanding its incident response and recovery capabilities through the use of the Critical Infrastructure Warning Information Network, a survivable communications network that does not rely on public telecommunications networks or the Internet. DHS has installed these network terminals in key government network operations centers, in several private industry network operations centers, and in the United Kingdom’s National Infrastructure Security Coordination Centre. In addition, it is considering placing additional network nodes at critical government agencies, companies, and trusted foreign partners. Additional initiatives to expand incident response and recovery capabilities, including mechanisms for collaboration, are identified in table 9. While DHS has made clear progress in planning for incident response, key steps remain to be taken in order to fulfill requirements for exercising continuity plans for federal systems and for coordinating the development of government/industry contingency recovery plans for cybersecurity—as recommended in the cyberspace strategy. Specifically, DHS does not yet have plans (or associated performance measures or milestones) for testing federal continuity plans, for recovering key Internet functions, or for providing technical assistance to both private-sector and other government entities as they develop their own emergency recovery plans. Without continuity planning exercises, federal agencies will not be able to coordinate efforts to ensure that the critical functions provided by federal systems would continue during a significant event and that recovery from such an event would occur in an effective and timely manner. In addition, without plans to address the recovery of key Internet functions, it is unclear how recovery would be performed and how federal capabilities could be used to assist with recovery. In commenting on a draft of this report, NCSD officials stated that although the division is not currently sponsoring any exercises to test other department and agencies’ continuity plans or plans for recovering key Internet functions, they are participating in and offering cybersecurity expertise to already existing department and agency exercises that test continuity of operations and plans for recovery. DHS has participated in national efforts to identify and assess cyber threats and has begun taking steps to facilitate sector-specific vulnerability assessments, but it has not yet completed the comprehensive cyber threat and vulnerability assessments—or the identification of cross-sector interdependencies—that are called for in the cyberspace strategy. In late 2003 and early 2004, DHS assisted in coordinating the cyber-related issues for the National Intelligence Estimate of Cyber Threats to the U.S. Information Infrastructure. The resulting classified document issued in February 2004 details actors (nation-states, terrorist groups, organized criminal groups, hackers, etc.), capabilities, and, where known, associated intent. National intelligence estimates provide America’s highest integrated national threat assessment and are used throughout the defense, intelligence, and homeland security communities. Regarding ongoing threat identification, DHS’s Infrastructure Protection Office, Information Analysis Office, and NCSD coordinate efforts on a daily basis. For example, NCSD works closely with the Information Analysis Office to coordinate the exchange of threat information, discussions of the potential threat to critical infrastructures based on reported information, and the creation of cyber-based intelligence requirements to gather additional information. In addition, as discussed earlier, information is shared between the private sector and the intelligence community through US-CERT. According to NCSD officials, because there are restrictions on the ability of some parts of the intelligence communities to collect information within the United States, information properly shared through US-CERT could help the intelligence community to develop better situational awareness. DHS has also taken a number of foundational steps toward developing the comprehensive vulnerability assessment mandated by HSPD-7. Three key initiatives are discussed below: Development of a Baseline Methodology for Vulnerability Assessment—As the designated entity for fulfilling DHS’s responsibility as the sector-specific agency for the IT infrastructure sector, NCSD is currently identifying the IT sector’s critical assets and developing a baseline methodology for performing vulnerability assessments within the sector. To do so, NCSD is studying existing vulnerability assessment methodologies with the idea of developing a flexible baseline methodology that can be used by members of the IT sector who do not yet have established methodologies. An NCSD official stated that a secondary use for this methodology would be as baseline guidance for cyber assessments across the other critical infrastructures, to be carried out by the sector-specific agencies and their sectors. Development of a Cyber Assessment Template—NCSD is assisting DHS’s Information Analysis and Infrastructure Protection Directorate’s Protective Security Division by developing a cyber assessment template for their “site assistance visits” to be used to assess the security of critical infrastructure facilities. The cyber-related segment of these visits includes an assessment of process control systems, including supervisory control and data acquisition, and business information technology. According to NCSD officials, they have developed the process control template and are currently developing the business information technology template. Development of Sector Guidance—As the subject matter expert for the cyber aspects of the National Infrastructure Protection Plan and associated sector-specific plans, NCSD has developed and distributed guidance to assist sector-specific agencies in addressing the cyber components of their sectors. While NCSD’s plans are focused on important issues, it has not yet completed the national cyber threat assessment and the sector vulnerability assessments—or the identification of cross-sector interdependencies—that are called for in the cyberspace strategy. Further, its assessment efforts are still in early stages. For example, according to an NCSD official, efforts to develop a vulnerability assessment methodology for the IT Sector are in early development. As part of its next steps, NCSD plans to involve the private sector in completing the methodology and then give a larger group of stakeholders in the IT Sector an opportunity to review and comment on it. NCSD also plans to assist the IT sector in conducting its cybersecurity-related vulnerability assessment. Once these assessments are complete, NCSD plans to coordinate a thorough analysis of the impact that interdependencies have on sectors and entities within the sectors. The Interim NIPP and DHS’s strategic plan for cybersecurity acknowledge that much remains to be done in the areas of threat and vulnerability assessment. The Interim NIPP recognizes that DHS is responsible for analyzing specific threats, providing threat warnings, and conducting general threat assessments. It also reports that the Information Analysis and Infrastructure Protection Directorate’s Office of Infrastructure Protection will conduct vulnerability assessments for a number of purposes, including investigating interdependencies, filling selected gaps, and testing new methodologies. Additionally, one of NCSD’s strategic goals is to work with the public and private sectors to reduce vulnerabilities and to minimize the severity of cyber attacks. As part of this goal, NCSD plans to define and execute methodologies to identify critical assets and to identify and assess vulnerabilities. It established a milestone of developing a vulnerability assessment methodology for the IT Sector by the third quarter of fiscal year 2005. However, neither DHS nor NCSD has defined plans, performance measures, or milestones for completing the required national cyber-related threat and sector vulnerability assessments, or for identifying cross-sector interdependencies. In commenting on a draft of this report, NCSD officials noted that because of the IT sector’s recent formation and its complexity, NCSD has not set strict milestones or performance measures for completing plans. NCSD officials noted, however, that milestones have been set for (1) defining the sector, (2) creating a public/private collaboration mechanism, and (3) developing methodologies for identifying assets and vulnerability assessments. NCSD officials stated that these steps must be fulfilled in order to ensure accurate assessments and to identify cross-sector interdependences. Performing infrastructure sector-level vulnerability assessments and developing related remedial plans have been long-standing issues that were identified as requirements in Presidential Decision Directive 63 in 1998. From a planning perspective, it is important to perform comprehensive vulnerability assessments of all of our nation’s critical infrastructures because such assessments can enable authorities to evaluate the potential effects of an attack on a given sector and then invest accordingly to protect that sector. Without a vulnerability assessment and remedial plan, it will be difficult to know with any certainty that those vulnerabilities that could cause the greatest harm—or are most likely to be exploited— have been addressed. In September 2001, we reported that substantive, comprehensive analysis of infrastructure sector vulnerabilities and the development of remedial plans had not yet been performed because sector coordinators were still establishing the necessary relationships, identifying critical assets and entities, and researching and identifying appropriate methodologies. In May 2004, we reported that some sectors had taken steps to perform sector-wide vulnerability assessments or to require individual entities to perform vulnerability assessments for their facilities and operations. However, others—including the IT sector—still have not taken such actions. Until a comprehensive threat assessment and sector- specific vulnerability assessments are completed and cross-sector dependencies are identified, DHS cannot ensure that all threats and vulnerabilities have been identified and addressed. In commenting on a draft of this report, NCSD officials stated that because of the IT sector’s recent formation and its complexity, NCSD and the sector face challenges in defining the sector, developing effective partnerships, and identifying critical assets. The officials also stated that significant progress has been made in developing methodologies to identify assets and assess vulnerabilities in the IT sector; however, continued collaborative efforts are necessary to ensure that all threats and vulnerabilities are identified and addressed. DHS has initiated efforts to reduce threats by enhancing its collaboration with the law enforcement community and to reduce vulnerabilities by shoring up guidance on software and system security, but much remains to be done. To support efforts to reduce cyber threats, NCSD has restructured its organization to improve its coordination with the law enforcement community and has initiated numerous outreach initiatives. Specifically, NCSD restructured its organization to establish a law enforcement and intelligence branch. It currently has representatives from the cyber components of five different agencies: the National Security Agency, U.S. Immigration and Customs Enforcement, U.S. Secret Service, Federal Bureau of Investigation, and Central Intelligence Agency. This branch provides an information-sharing mechanism among the intelligence, law enforcement, and network security communities. For example, there have been at least two instances where the intelligence community had discovered cyber-related issues that it wanted to report to the public, but it was unable to do so because it would potentially reveal sources and methods, according to an NCSD official. In those cases, NCSD and the intelligence community collaborated to develop and release a public alert that conveyed the threat without revealing sensitive information. In addition, the law enforcement and intelligence branch has provided information from the law enforcement community to the intelligence community. For example, according to an NCSD official, in August 2004, the organization received information about a potential software vulnerability from a law enforcement partner that it shared with the intelligence community. Additionally, NSCD’s law enforcement and intelligence branch has taken steps to improve its domestic and international outreach efforts to support threat reduction; and, according to an NCSD official, the interaction and coordination among the branch and other agencies on cyber-related issues have been effective. Key outreach initiatives include the following: Within the federal government, NCSD’s law enforcement and intelligence branch has developed a relationship with other law enforcement entities, including entities within the Departments of Energy and Defense and the federal inspector general community. DHS supports the Cybercop Portal, which is a secure, internet-based information-sharing mechanism that allows members of local, state, and federal government law enforcement organizations to discuss issues related to electronic/cyber crime and threat reduction. At the time of our review, according to an NCSD official, there were over 6,000 members from the 50 states, most government agencies, and over 40 countries. According to an NCSD official, NCSD has entered into a partnership with the Department of Justice’s Bureau of Justice Statistics to conduct a joint survey to study the amount and scope of cyber crime in the United States. The survey will be distributed to 36,000 businesses, including small businesses covering all critical infrastructure sectors. NCSD is reviewing the possibility of enhancing the U.S. computer crime statute (18 U.S.C. 1030). Specifically, according to NCSD officials, it is trying to determine the effect of criminalizing the development and possession (with criminal intent) of malicious computer code, such a change would provide law enforcement with a proactive mechanism to address certain cyber crimes. NCSD has entered into preliminary discussions with the Department of Justice's Computer Crimes and Intellectual Property Section and with other federal, state, and local law enforcement agencies. In addition, NCSD has solicited opinions from the private sector and from academia. To reduce vulnerabilities, NCSD is encouraging the development of better quality and more secure software. It has established a plan targeting four areas: (1) people (including software developers and users), (2) processes (including best practices and practical software development guidelines), (3) software evaluation tools, and (4) acquisition—creating software security improvements through acquisition specifications and guidelines. To accomplish its plans, NCSD has undertaken the following initiatives: NCSD has hosted and cohosted various forums and workshops that focused on topics such as developing a common body of knowledge for software assurance and improving the quality, reliability, and dependability of software. For example: NCSD has hosted three workshops, with subject matter experts from academia and the private sector, to begin the process of developing a common body of knowledge on software assurance that could be used by educators across the country to develop curricula for academic programs in software engineering, information assurance, and various other disciplines. DHS and the Department of Defense have cosponsored two Software Assurance Forums to bring together representatives from industry, government, and academia to address the challenges in software security and quality. NCSD is inventorying existing software assurance-related efforts in public and private industry to develop and publish practical guidance, reference materials, and best practices for training software developers. NCSD is conducting a software assurance security tools evaluation to support and promote the development of technological advances in software assurance. In coordination with the National Institute of Science and Technology, NCSD has created a set of studies and experiments to measure the effectiveness of various tools and classes of tools. NCSD is working with the Department of Defense and other government agencies to examine successful models and to develop and publish best practices for acquisition language and evaluation. NCSD also is working to develop and publish common or sample statement of work/procurement language, which includes provisions on liability, for federal acquisition managers. According to an NCSD official, the organization has also formed a working group to address the issue of preventing a major disruption on the Internet. The working group is composed of federal agencies with an interest in preventing a major interruption on the Internet. These agencies are the Department of the Treasury, the Department of Defense, the National Communication System, and NCSD (including US- CERT and CERT/CC). The working group has also tried to include key private-sector individuals. The group’s initiatives include efforts to (1) create various scenarios for disruptions in order to determine whom to work with to solve the problem, how to respond and what to do, and what protective measures should be put in place; and (2) determine what infrastructure sectors are functionally dependent on the Internet. While NCSD has many efforts under way to coordinate threat reduction activities, it is limited in what it can do on vulnerability reduction until the cyber-related vulnerability assessments (discussed in the previous section) are completed. Since DHS is now planning a methodology for conducting vulnerability assessments, it will likely be some time before stakeholders can conduct the assessments—and even longer before they are able to develop a comprehensive plan for reducing vulnerabilities. In its strategic plan for cybersecurity, DHS acknowledges that there is more to do to coordinate both threat and vulnerability reduction efforts. Specifically, NCSD has established a strategic goal to coordinate with the intelligence and law enforcement communities to identify and reduce threats to cyberspace. As part of this goal, NCSD identified a number of actions to improve the available information on cyber incidents, publish the results of the planned cyber incident survey, improve the Cybercop Portal, and reach out to other law enforcement entities. Regarding vulnerability reduction, NCSD has established a goal to reduce vulnerabilities and a list of action items, including actions to improve the security within the IT infrastructure sector; to address cybersecurity issues for control systems; to improve software assurance efforts; and to promote cybersecurity standards and best practices. DHS is collaborating with the Executive Office of the President’s Office of Science and Technology Policy and with many other federal departments and agencies, including the Departments of Agriculture, Commerce, Defense, and Energy, to develop a national research and development plan for CIP, including cybersecurity. However, a complete plan is not yet in place, and the milestones for key activities under this plan have not yet been developed. NCSD coordinates with DHS’s Science and Technology Directorate to develop (1) the Cyber Security Research and Development Portfolio and (2) the CIP Portfolio that targets process control system security and includes some research and development projects. Research programs include efforts to develop operational analysis tools to enhance the security of domain name systems, establish secure routing protocols, and improve Internet security. In addition, NCSD participates in the Critical Information Infrastructure Protection Interagency Working Group, which is cochaired by the Executive Office of the President’s Office of Science and Technology Policy and DHS’s Science and Technology Directorate, to identify critical cyber research and development requirements for inclusion in the federal research and development effort. As part of this requirement identification process, NCSD determines where the private sector has already done research and development, in order to minimize overlap and wasted effort. An NCSD official reports that requirements come from software developers and from the agency’s work with industry, academia, and other government agencies. Although DHS is working to identify cyber research requirements and to support and coordinate cybersecurity-related research and development projects, the working group cochaired by DHS and the Executive Office of the President’s Office of Science and Technology Policy that was required to lead the effort to issue a national research and development plan for CIP (including cybersecurity) has not yet developed a comprehensive plan. Also, while the Interim NIPP acknowledges the importance of research and development to a variety of cybersecurity initiatives—including improving Internet security protocols and developing a next generation security architecture featuring autonomic, self-aware, and self-healing systems—it does not identify goals or milestones associated with developing a prioritized plan for these initiatives. In commenting on a draft of this report, DHS Science and Technology Directorate officials stated that the first public version of the national research and development plan supporting CIP had recently been released. They acknowledged, however, that this is a baseline plan and does not include an investment plan and road map that are to be added next year. In addition, these officials commented that milestones have not yet been established because planning activities are in progress. DHS has made progress in increasing cybersecurity awareness by implementing numerous awareness and outreach initiatives, but the effectiveness of its activities is unclear because many CIP stakeholders are still uncertain of DHS’s cybersecurity roles. Table 10 identifies key DHS awareness and outreach initiatives. Although DHS has an active awareness and outreach program under way, more remains to be done to expand awareness of the department’s roles, responsibilities, and capabilities. Multiple CIP stakeholders have reported that they were unaware of DHS’s cybersecurity responsibilities. For example, officials from one federal agency indicated they have not independently interacted with NCSD about their sector’s cybersecurity efforts. In addition, at a recent regional security exercise, state and local government officials were not clear on DHS’s role in cybersecurity. NCSD acknowledges that it has more to do to expand awareness of its cybersecurity roles and capabilities and to increase its outreach efforts. In its strategic plan for cybersecurity, DHS has outlined goals, objectives, activities, and milestones for improving in these areas. DHS has initiated multiple efforts to improve the education of future cybersecurity analysts, but much work remains to be done to develop certification standards. Key DHS cyber education initiatives are listed in table 11. While DHS has made progress in expanding education and training in cybersecurity, it has more to do to develop baseline standards for cybersecurity certification. According to NCSD’s progress report, each cyber-related industry certification currently is based on a different notion of what tasks information assurance employees perform. This leads to confusion on the part of employers when they attempt to assess what skill set they are getting when they hire a certified professional. DHS acknowledges this issue and has begun to take steps to address it. Specifically, DHS has partnered with the Department of Defense on an initiative to create a national-level job task analysis and information assurance professional skill standards. The job task analysis and skill standards are expected to identify the knowledge, skills, and abilities associated with information assurance jobs across all sectors, and to provide a clear baseline for comparing and evaluating existing industry certifications and developing future certifications. The final goal is to produce a job task analysis and skill standard that reflects all sectors, is national in scope, and can be used to compare existing professional certifications and provide for future certifications. In addition, in its strategic plan for cybersecurity, DHS identifies a number of actions and milestones for making progress in cybersecurity education, including promoting the creation of widely recognized, industry-led, vendor-neutral cybersecurity professional certifications based on a nationally recognized skill baseline. DHS supports multiple interagency groups’ efforts to improve government cybersecurity through communication and collaboration, but state and local government stakeholders have expressed concerns about the scope of these efforts. DHS participates in numerous initiatives to enhance intergovernmental coordination. Key initiatives are listed in table 12. While DHS has made concerted efforts to form and support intergovernmental partnerships, several governmental entities have expressed concerns about the scope of these efforts and their effectiveness. For example, officials representing a state government organization noted that DHS has not provided adequate attention to the states regarding cybersecurity and has not included local government IT officials in cybersecurity-related discussions. State officials also noted that DHS’s focus on cybersecurity has been secondary to its physical security efforts; for example, there have been only limited grants to assist states with cybersecurity. As a result, these representatives have reported that there is a “fundamental lack of appreciation” for cybersecurity by state and local governments. The Interim NIPP and DHS’s strategic plan for cybersecurity acknowledge the importance of continually enhancing the security of federal, state, and local government systems through partnerships and information sharing. For example, the Interim NIPP includes a goal to build partnerships with federal, state, local, tribal, international, and private-sector stakeholders to implement CIP programs. In addition, DHS’s strategic plan for cybersecurity establishes goals, objectives, and actions that involve securing governments’ cyberspace through collaboration with key stakeholders in other federal, state, and local governments and in the private sector. DHS is working in conjunction with other governments to promote a global culture of security but acknowledges that more remains to be done to accomplish its goals. In recent years, NCSD has participated with its international counterparts in several initiatives to improve interaction and coordination. Table 13 lists key international cybersecurity initiatives, including multilateral and bilateral efforts. While NCSD has initiated numerous outreach and coordination efforts with the international community, important actions remain ahead. DHS’s strategic plan for cybersecurity includes two objectives related to national security and international cyberspace security cooperation, to (1) create and pursue an international strategy to secure cyberspace and (2) promote collaboration, coordination, and information sharing with international communities. In addition, NCSD’s January 2005 progress report described plans to work with its counterparts in Australia, Canada, New Zealand and the United Kingdom “to formulate a framework for on-going policy and operational cooperation and collaboration” that will “incorporate shared efforts on key strategic issues to address cybersecurity over the long term, including software assurance, research and development, attribution, control systems, and others.” This framework is expected to enhance the allies’ current information-sharing and incident-response efforts and to foster collaboration in other international activities. In commenting on a draft of this report, DHS Science and Technology Directorate officials stated that the directorate had entered into international agreements with Canada and the United Kingdom for collaborative science and technology activities and had engaged in bilateral meetings with those countries on the topic of cybersecurity research and development. DHS formed the National Cyber Response Coordination Group to coordinate the federal response to cyber incidents of national significance. It is a forum of national security, law enforcement, defense, intelligence, and other government agencies that coordinates intragovernmental and public/private preparedness and response to and recovery from national- level cyber incidents and physical attacks that have significant cyber consequences. During a significant national incident, the coordinating group’s senior level membership is responsible for ensuring that the full range of federal capabilities are deployed in a coordinated and effective fashion. However, at the time of our review, there had not been a cyber incident of national significance to activate these procedures, and, according to NCSD officials, early tests of this coordination identified some lessons and showed the need to make improvements. For example, officials learned that they need to improve communication protocols and mechanisms. DHS faces a number of challenges that have impeded its ability to fulfill its cyber CIP responsibilities. Key challenges include achieving organizational stability; gaining organizational authority; overcoming hiring and contracting issues; increasing awareness about cybersecurity roles and capabilities; establishing effective partnerships with stakeholders (other federal, state, and local governments and the private sector); achieving two-way information sharing with these stakeholders; and providing and demonstrating the value DHS can provide. Organizational stability: Over the last year, multiple senior DHS cybersecurity officials—including the NCSD Director, the Deputy Director responsible for Outreach and Awareness, and the Director of the US-CERT Control Systems Security Center, the Under Secretary for the Information Analysis and Infrastructure Protection Directorate and the Assistant Secretary responsible for the Information Protection Office—have left the department. Infrastructure sector officials stated that the lack of stable leadership has diminished NCSD’s ability to maintain trusted relationships with its infrastructure partners and has hindered its ability to adequately plan and execute activities. According to one private-sector representative, the importance of organizational stability in fostering strong partnerships cannot be over emphasized. Organizational authority: NCSD does not have the organizational authority it needs to effectively serve as a national focal point for cybersecurity. Accordingly, NCSD officials lack the authority to represent and commit DHS to efforts with the private sector. Infrastructure and cybersecurity officials, including the chairman of the sector coordinators and representatives of the cybersecurity industry, have expressed concern that the NCSD’s relatively low position within the DHS organization hinders its ability to accomplish cybersecurity-related goals. NCSD’s lack of authority has led to some missteps, including DHS canceling an important cyber event without explanation and taking almost a year to issue formal responses to private sector recommendations resulting from selected National Cyber Security Summit task forces—even though responses were drafted within months. A congressional subcommittee also expressed concern that DHS’s cybersecurity office lacks the authority to effectively fulfill its role. In 2004, the subcommittee proposed legislation to elevate the head of the cybersecurity office to an assistant secretary position. Among other benefits, the subcommittee reported that such a change could provide more focus and authority for DHS’s cybersecurity mission, allow higher level input into national policy decisions, and provide a single visible point of contact within the federal government to improve interactions with the private sector. Hiring and contracting: Ineffective DHS management processes have impeded the department’s ability to hire employees and maintain contracts. We recently reported that since its inception, DHS’s leadership has provided a foundation for maintaining critical operations while undergoing transformation. However, in managing its transformation, we noted that DHS still needed to overcome a number of significant challenges, including addressing systemic problems in human capital and acquisition systems. Federal and nonfederal officials expressed concerns with DHS’s hiring and contracting processes. For example, an NCSD official reported that the division has had difficulty in hiring personnel to fill vacant positions. These officials stated that once they found qualified candidates, some candidates decided not to apply and another withdrew his acceptance because they felt that the DHS hiring process took too long. In addition, an NCSD official stated that there had been times when DHS did not renew NCSD contracts in a timely manner, requiring that key contractors work without pay until approvals could be completed and payments could be made. In other cases, NCSD was denied services from a vendor, because DHS had repeatedly failed to pay for its services. External stakeholders, including an ISAC representative, also noted that NCSD is hampered by how long it takes DHS to award a contract. Awareness of DHS roles and capabilities: Many infrastructure stakeholders are not yet aware of DHS’s cybersecurity roles and capabilities. Department of Energy critical infrastructure officials stated that the roles and responsibilities of DHS and the sector-specific agencies need to be better clarified in order to improve coordination. In addition, during a regional cyber exercise, private-sector and state and local government officials reported that the mission of NCSD and the capabilities that DHS could provide during a serious cyber-threat were not clear to them. NCSD’s manager of cyber analysis and warning operations acknowledged that the organization has not done an adequate job in reaching out to the private sector regarding DHS’s role and capabilities. Effective partnerships: NCSD is responsible for leveraging the assets of key stakeholders, including other federal, state, and local governments and the private sector, in order to facilitate effective protection of cyber assets. The ability to develop partnerships greatly enhances the agency’s ability to identify, assess, and reduce cyber threats and vulnerabilities, establish strategic analytical capabilities, provide incident response, enhance government cybersecurity, and improve international efforts. According to one infrastructure sector representative, effective partnerships require building relationships with mutually developed goals, shared benefits and responsibilities, and tangible, measurable results. However, this individual reported that DHS has not typically adopted these principles in pursuing partnerships with the private sector, which dramatically diminishes cybersecurity gains that government and industry could otherwise achieve. For example, DHS has often informed the infrastructure sectors about government initiatives or sought input after most key decisions have been made. Also, DHS has not demonstrated that it recognizes the value of leveraging existing private sector mechanisms, such as information-sharing entities and processes already in place and working. In addition, the instability of NCSD’s leadership positions to date has led to problems in developing partnerships. Representatives from two ISACs reported that turnover at NCSD has hindered partnership efforts. Additionally, IT sector representatives stated that NCSD needs continuity of leadership, regular communications, and trusted policies and procedures in order to build the partnerships that will allow the private sector to share information. Information sharing: We recently identified information sharing in support of homeland security as a high-risk area, and we noted that establishing an effective two-way exchange of information to help detect, prevent, and mitigate potential terrorist attacks requires an extraordinary level of cooperation and perseverance among federal, state, and local governments and the private sector. However, such effective communications are not yet in place in support of our nation’s cybersecurity. Representatives from critical infrastructure sectors stated that entities within their respective sectors still do not openly share cybersecurity information with DHS. As we have reported in the past, much of the concern is that the potential release of sensitive information could increase the threat to an entity. In addition, sector representatives stated that when information is shared, it is not clear whether the information will be shared with other entities, such as other federal entities, state and local entities, law enforcement, or various regulators, or how it will be used or protected from disclosure. Representatives from the banking and finance sector stated that the protection provided by the Critical Infrastructure Information Act and the subsequently established Protected Critical Infrastructure Information Program is not clear and has not overcome the trust barrier. Alternatively, sector representatives have expressed concerns that DHS is not effectively communicating information with them. According to one infrastructure representative, DHS has not matched private sector efforts to share valuable information with a corresponding level of trusted information sharing. An official from the water sector noted that when representatives called DHS to inquire about a potential terrorist threat, they were told that DHS could not share any information and that they should “watch the news.” Providing value: According to sector representatives, even when organizations within their sectors have shared information with NCSD, the entities do not consistently receive useful information in return. They noted that without a clear benefit, they are unlikely to pursue further information sharing with DHS. Federal officials also noted problems in identifying the value that DHS provides. According to Department of Energy officials, DHS does not always provide analysis or reports based on the information that agencies provide. Federal and nonfederal officials also stated that most of US-CERT’s alerts have not been useful because the alerts lack essential details or have been based on already available information. Further, Treasury officials stated that US-CERT needed to provide relevant and timely feedback regarding the incidents reported to it. Clearly, these challenges are not mutually exclusive. That is, addressing challenges in organizational stability and authority will help NCSD build the credibility it needs in order to establish effective partnerships and achieve two-way information sharing. Similarly, effective partnerships and ongoing information sharing with its stakeholders will allow DHS to better demonstrate the value it can add. DHS has identified steps in its strategic plan for cybersecurity that can begin to address these challenges. Specifically, DHS has established goals and plans for improving human capital management, which should help stabilize the organization. Further, DHS has developed plans for communicating with stakeholders, which are intended to increase awareness of its roles and capabilities and to encourage information sharing. Also, DHS has established plans for developing effective partnerships and improving analytical and watch and warning capabilities, which could help build partnerships and begin to demonstrate added value. However, until it begins to address these underlying challenges, DHS cannot achieve significant results in coordinating cybersecurity activities and our nation will lack the effective focal point it needs to better ensure the security of cyberspace for public and private critical infrastructure systems. As our nation has become increasingly dependent on timely, reliable information, it has also become increasingly vulnerable to attacks on the information infrastructure that supports the nation’s critical infrastructures (including the energy, banking and finance, transportation, telecommunications, and drinking water infrastructures). Federal law and policy acknowledge this by establishing DHS as the focal point for coordinating cybersecurity plans and initiatives with other federal agencies, state and local governments, and private industry. DHS has made progress in planning and coordinating efforts to enhance cybersecurity, but much more work remains to be done to fulfill its basic responsibilities— including conducting important threat and vulnerability assessments and recovery plans. As DHS strives to fulfill its mission, it faces key challenges in building its credibility as a stable, authoritative, and capable organization and in leveraging private/public assets and information in order to clearly demonstrate the value it can provide. Until it overcomes the many challenges it faces and completes critical activities, DHS cannot effectively function as the cybersecurity focal point intended by law and national policy. As such, there is increased risk that large portions of our national infrastructure are either unaware of key areas of cybersecurity risks or unprepared to effectively address cyber emergencies. In order to improve DHS’s ability to fulfill its mission as an effective focal point for cybersecurity, we recommend that the Secretary of Homeland Security implement the following three steps: engage appropriate stakeholders to prioritize key cybersecurity responsibilities so that the most important activities are addressed first, including responsibilities that are not detailed in the cybersecurity strategic plan: (1) perform a national cyber threat assessment; (2) facilitate sector cyber vulnerability assessments—to include identification of cross-sector interdependencies; and (3) establish contingency plans for cybersecurity, including recovery plans for key Internet functions; require NCSD to develop a prioritized list of key activities for addressing the underlying challenges that are impeding execution of its responsibilities; and identify performance measures and milestones for fulfilling its prioritized responsibilities and for performing activities to address its challenges, and track organizational progress against these measures and milestones. We are not making new recommendations regarding cyber-related analysis and warning and cybersecurity information sharing at this time because our previous recommendations in these areas have not yet been fully implemented. We received written comments on a draft of this report from DHS (see app. III). In DHS’s response, the Director of the Departmental GAO/OIG Liaison Office stated that DHS agrees that strengthening cybersecurity is central to protecting the nation’s critical infrastructures and that much remains to be done. In addition, DHS concurred with our recommendation to engage stakeholders in prioritizing its key cybersecurity responsibilities. The director stated that continued and expanded stakeholder involvement is critical and identified some of NCSD’s significant activities—many of which are discussed in the body of this report. However, the director noted that DHS does not agree that the challenges it has experienced have prevented it from achieving significant results in improving the nation’s cybersecurity posture. In addition, DHS did not concur with our recommendations to (1) develop a prioritized list of key activities for addressing the underlying challenges and (2) identify performance measures and milestones for fulfilling its prioritized responsibilities and for performing activities to address its challenges and track organizational progress. Specifically, the director reported that DHS already uses a prioritized list, performance measures, and milestones to guide and track its activities and sought additional clarification of these recommendations. The director also noted that our report makes a reference to previous recommendations involving cyber-related information sharing and strategic analysis and warning capabilities that have not been fully implemented, but he disagreed that there were any valid outstanding recommendations. Because most of the nation’s information infrastructure is owned by the private-sector, developing trusted partnerships and information-sharing relationships between the federal government and the private sector are critical. We agree that DHS has initiated many efforts as a focal point for the nation’s efforts to secure cyberspace and have acknowledged these in our report, but the challenges it faces—including achieving organizational stability, achieving two-way information sharing with stakeholders, and demonstrating value—have hindered its progress to date. This view was reiterated by the federal and nonfederal stakeholders we interviewed. Regarding our recommendations, while we agree with DHS that its strategic plan for cybersecurity identifies a number of activities (along with some performance metrics and milestones) that will begin to address the challenges, this plan does not include specific initiatives that would ensure that the challenges are addressed in a prioritized and comprehensive manner. For example, the strategic plan for cybersecurity does not include initiatives to help stabilize and build authority for the organization. Further, the strategic plan does not identify the relative priority of its initiatives and does not consistently identify performance measure for completing its initiatives. As DHS moves forward in identifying initiatives to address the underlying challenges it faces, it will be important to establish performance metrics and milestones for fulfilling these initiatives. In fact, in its strategic plan for cybersecurity, DHS acknowledges that it needs to establish performance measures and milestones and to collect performance data for its key initiatives. Regarding our previous recommendations related to information sharing, DHS identified plans for fulfilling our recommendations but did not provide any evidence that these efforts were completed. For example, in November 2004, DHS reported that by June 2005, it planned to develop an information- sharing plan including the elements we recommended; however, DHS has not yet completed this plan and has not provided any evidence that this plan will include the key elements we had recommended. In addition, in regard to our recommendation that DHS develop appropriate policies and procedures for information sharing and coordination within DHS and with other federal and nonfederal entities, DHS reported that it has many information sharing initiatives and high-level documents. However, DHS did not specify any DHS-level policies or procedures for information sharing. NCSD procedures, including the US-CERT Concept of Operations and Standard Operating Procedure, were still in draft at the time of our review. Thus, these recommendations remain open. As for our previous recommendations to develop a strategic analysis and warning capability, we reported that DHS is still facing the same challenges in developing strategic analysis and warning capabilities that we reported on 4 years ago during a review of NCSD’s predecessor. In 2001, we reported that a generally accepted methodology for analyzing strategic cyber-based threats did not exist. We also reported that the center did not have the industry-specific data on factors such as critical systems components, known vulnerabilities, and interdependencies. Therefore, we recommended that responsible executive-branch officials and agencies establish a capability for strategic analysis of computer-based threats, including developing a methodology and obtaining infrastructure data. In response to specific questions on these topics in April 2005, NCSD officials acknowledged that work remains to be done in developing cyber-related strategic analysis and warning capabilities. They stated that there is still no generally accepted methodology for analyzing strategic cyber-based threats and that NCSD is in the process of developing industry-specific data. In addition, these officials discussed a number of ongoing initiatives to address various aspects of the methodology. Because these efforts are incomplete, our recommendations remain open. DHS officials as well as others who were quoted in our report also provided technical corrections, which we have incorporated in this report as appropriate. We are sending copies of this report to interested congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, this report will be available at no charge on GAO’s Web site at www.gao.gov. If you have any questions on matters discussed in this report, please contact me at (202) 512-9286, or by e-mail at pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Our objectives were to determine (1) the Department of Homeland Security’s (DHS) roles and responsibilities for cyber critical infrastructure protection (CIP) and national information security, as established in law and policy, and determine the specific organizational structures DHS has created to fulfill them; (2) the status of DHS’s efforts to protect the computer systems supporting the nation’s critical infrastructures and to strengthen information security both inside and outside the federal government and the extent to which such efforts and DHS’s organizational structures adequately address its responsibilities; and (3) the challenges DHS faces in fulfilling its cybersecurity roles and responsibilities. To determine DHS’s cyber roles and responsibilities supporting CIP, we analyzed relevant law and policy, including the Homeland Security Act of 2002, Homeland Security Presidential Directive (HSPD) 7, and the National Strategy to Secure Cyberspace. Because many of the roles and responsibilities in the law and policies are overlapping, we focused on identifying responsibilities related to cybersecurity that could be used to gauge DHS’s progress and grouped them into 13 key responsibilities. We shared the 13 key responsibilities with DHS officials responsible for cybersecurity, and the officials concurred that these are important responsibilities. We also compared the key responsibilities with the activities that DHS identified in its cybersecurity plans and progress reports, to ensure that no key responsibilities were missed. To identify DHS’s organizational structure for fulfilling its responsibilities, we analyzed DHS and National Cyber Security Division (NCSD) organizational charts and interviewed DHS officials. To determine the status and adequacy of DHS’s efforts, we analyzed key documents, including the Interim National Infrastructure Protection Plan, NCSD’s cyber strategies and plans, and NCSD’s policies and procedures, and we interviewed key DHS and NCSD officials. We compared DHS’s efforts and plans with the 13 responsibilities to identify what has been accomplished and what more needs to be done. In addition, we gathered documents and performed structured interviews with officials from other federal agencies with established CIP roles. We included officials responsible for each agency’s efforts to enhance CIP and the officials responsible for their respective agency’s information security efforts. We spoke with officials from the Departments of Agriculture; Energy; Health and Human Services (including the Food and Drug Administration); Justice (including the Federal Bureau of Investigation); the Treasury; and the Environmental Protection Agency. We also interviewed representatives from the following infrastructure sectors: banking and finance, electricity, water, and information technology. In addition, we interviewed representatives from the Information Sharing and Analysis Center (ISAC) council. We also interviewed officials from entities representing state governments, including the Multi-State ISAC and the National Association of State Chief Information Officers. To identify the challenges facing DHS and NCSD as they attempt to fulfill their cybersecurity responsibilities, we analyzed our prior work on CIP as well as reports by the cybersecurity industry that offered recommendations for improving cybersecurity and CIP. We also interviewed DHS and NCSD officials, representatives from other federal agencies with CIP roles, infrastructure sector officials, and officials of an organization representing state governments. We also observed a regional infrastructure security tabletop exercise focusing on cybersecurity and identified challenges in achieving effective collaboration among public/private partners from discussions by the participants of this exercise. We performed our work from July 2004 to April 2005 in accordance with generally accepted government auditing standards. DHS established NCSD as the primary organization with responsibility for cybersecurity. However, multiple other organizations have roles and responsibilities that impact cybersecurity and require close coordination with NCSD. These include the following offices and suboffices: Information Analysis Office—which is to provide actionable intelligence essential for preventing acts of terrorism and, with timely and thorough analysis and dissemination of information about terrorists and their activities, improve the federal government’s ability to disrupt and prevent terrorist acts and to provide useful warning to state and local governments, the private sector, and our citizens. Homeland Security Operations Center—which provides real-time situational awareness and monitoring of the homeland, coordinates incidents and response activities and, in conjunction with the DHS Office of Information Analysis, issues advisories and bulletins concerning threats to homeland security, as well as specific protective measures. Infrastructure Protection Office—which is to coordinate national efforts to secure America’s critical infrastructure, including vulnerability assessments, strategic planning efforts, and exercises. Infrastructure Protection Office’s Infrastructure Coordination Division—which plays a key role in coordinating with sector coordinating mechanisms (e.g., sector coordinating councils and government coordinating councils) concerning information sharing. In addition, it operates the National Infrastructure Coordination Center. Infrastructure Coordination Division’s Protected Critical Infrastructure Information Program Office—which was established to encourage private industry and others with knowledge about the nation’s critical infrastructure to share sensitive and proprietary business information about this critical infrastructure with the government in accordance with the Critical Infrastructure Information Act of 2002 (CII Act). Protected CII is designed so that members of the private sector can voluntarily submit sensitive information regarding the nation’s critical infrastructure to DHS with the assurance that the information will be protected from public disclosure as long as it satisfies the requirements of the CII Act. Infrastructure Protection Office’s Protective Security Division— which is to coordinate strategies for protecting the nation’s critical physical infrastructure. Infrastructure Protection Office’s National Communications System—which was established by executive order in 1982 as a federal interagency group responsible for national security and emergency preparedness telecommunications and was transferred to DHS by the Homeland Security Act of 2002. Its responsibilities include planning for, developing, and implementing enhancements to the national telecommunications infrastructure, which includes the Internet, to achieve effectiveness in managing and using national telecommunication resources to support the federal government during any emergency. In addition, through the National Coordinating Center for Telecommunications, the National Communications System sponsors the Telecommunications Information Sharing and Analysis Center. The National Communications System is also jointly responsible with NCSD for developing the IT infrastructure sector plan. DHS’s Science and Technology Directorate—which serves as the primary research and development arm of DHS. It uses our nation’s scientific and technological resources to provide federal, state, and local officials with the technology and capabilities to protect the homeland. It focuses on catastrophic terrorism—threats to the security of our homeland that could result in large-scale loss of life and major economic impact. Office of State and Local Coordination—which was established to serve as a single point of contact for facilitation and coordination of departmental programs that impact state, local, territorial, and tribal governments. Private Sector Office—which works directly with individual businesses, trade associations, and other professional and nongovernmental organizations to share department information, programs, and partnership opportunities. In addition to those named above, Joanne Fiorino, Michael Gilmore, Barbarol James, Colleen M. Phillips, and Nik Rapelje made key contributions to this report.

Summary: Increasing computer interconnectivity has revolutionized the way that our government, our nation, and much of the world communicate and conduct business. While the benefits have been enormous, this widespread interconnectivity also poses significant risks to our nation's computer systems and, more importantly, to the critical operations and infrastructures they support. The Homeland Security Act of 2002 and federal policy established DHS as the focal point for coordinating activities to protect the computer systems that support our nation's critical infrastructures. GAO was asked to determine (1) DHS's roles and responsibilities for cyber critical infrastructure protection, (2) the status and adequacy of DHS's efforts to fulfill these responsibilities, and (3) the challenges DHS faces in fulfilling its cybersecurity responsibilities. As the focal point for critical infrastructure protection (CIP), the Department of Homeland Security (DHS) has many cybersecurity-related roles and responsibilities that we identified in law and policy. DHS established the National Cyber Security Division to take the lead in addressing the cybersecurity of critical infrastructures. While DHS has initiated multiple efforts to fulfill its responsibilities, it has not fully addressed any of the 13 responsibilities, and much work remains ahead. For example, the department established the United States Computer Emergency Readiness Team as a public/private partnership to make cybersecurity a coordinated national effort, and it established forums to build greater trust and information sharing among federal officials with information security responsibilities and law enforcement entities. However, DHS has not yet developed national cyber threat and vulnerability assessments or government/industry contingency recovery plans for cybersecurity, including a plan for recovering key Internet functions. DHS faces a number of challenges that have impeded its ability to fulfill its cyber CIP responsibilities. These key challenges include achieving organizational stability, gaining organizational authority, overcoming hiring and contracting issues, increasing awareness about cybersecurity roles and capabilities, establishing effective partnerships with stakeholders, achieving two-way information sharing with these stakeholders, and demonstrating the value DHS can provide. In its strategic plan for cybersecurity, DHS identifies steps that can begin to address the challenges. However, until it confronts and resolves these underlying challenges and implements its plans, DHS will have difficulty achieving significant results in strengthening the cybersecurity of our critical infrastructures.