Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. Of particular importance is the security of information and systems supporting critical infrastructures—physical or virtual systems and assets so vital to the nation that their incapacitation or destruction would have a debilitating impact on national and economic security and on public health and safety. Although the majority of our nation’s critical infrastructures are owned by the private sector, the federal government owns and operates key facilities that use control systems, including oil, gas, water, electricity, and nuclear facilities. In the electric power industry, control systems can be used to manage and control the generation, transmission, and distribution of electric power. For example, control systems can open and close circuit breakers and set thresholds for preventive shutdowns. Critical infrastructure control systems face increasing risks due to cyber threats, system vulnerabilities, and the potential impact of attacks as demonstrated by reported incidents. Control systems are more vulnerable to cyber threats and unintended incidents now than in the past for several reasons, including their increasing standardization and connectivity to other systems and the Internet. For example, in August 2006, two circulation pumps at Unit 3 of the Browns Ferry, Alabama, nuclear power plant operated by TVA failed, forcing the unit to be shut down manually. The failure of the pumps was traced to an unintended incident involving excessive traffic on the control system’s network. To address this increasing threat to control systems governing critical infrastructures, both federal and private organizations have begun efforts to develop requirements, guidance, and best practices for securing those systems. For example, FISMA outlines a comprehensive risk-based approach to securing federal information systems, which include control systems. Federal organizations, including the National Institute of Standards and Technology (NIST), the Federal Energy Regulatory Commission (FERC), and the Nuclear Regulatory Commission (NRC), have used a risk-based approach to develop guidance and standards to secure control systems. NIST guidance has been developed that currently applies to federal agencies; however, much of the guidance and standards developed by FERC and NRC has not yet been finalized. Once implemented, FERC and NRC standards will apply to both public and private organizations that operate covered critical infrastructures. The TVA is a federal corporation and the nation’s largest public power company. TVA’s power service area includes almost all of Tennessee and parts of Mississippi, Kentucky, Alabama, Georgia, North Carolina, and Virginia. It operates 11 coal-fired fossil plants, 8 combustion turbine plants, 3 nuclear plants, and a hydroelectric system that includes 29 hydroelectric dams and one pumped storage facility. TVA also owns and operates one of the largest transmission systems in North America. Control systems are essential to TVA’s operation because it uses them to both generate and deliver power. To generate power, control systems are used within power plants to open and close valves, control equipment, monitor sensors, and ensure the safe and efficient operation of a generating unit. Many control systems networks connect with other agency networks to transmit system status information. To deliver power, TVA monitors the status of its own and surrounding transmission facilities from two operations centers. TVA had not fully implemented appropriate security practices to secure the networks on which its control systems rely. Specifically, the interconnected corporate and control systems networks at certain facilities that we reviewed did not have sufficient information security safeguards in place to adequately protect control systems. In addition, TVA did not always implement controls adequate to restrict physical access to control system areas and to protect these systems—and their operators— from fire damage or other hazards. As a result TVA, control systems were at increased risk of unauthorized modification or disruption by both internal and external threats. Multiple weaknesses within the TVA corporate network left it vulnerable to potential compromise of the confidentiality, integrity, and availability of network devices and the information transmitted by the network. For example: Almost all of the workstations and servers that we examined on the corporate network lacked key security patches or had inadequate security settings. TVA hd not effectively configured host firewall controls on laptop computers we reviewed, and one remote access system that we reviewed had not been securely configured. Network services had been configured across lower and higher-security network segments, which could allow a malicious user to gain access to sensitive systems or modify or disrupt network traffic. TVA’s ability to use its intrusion detection system to effectively monitor its network was limited. The access controls implemented by TVA did not adequately secure its control systems networks and devices, leaving the control systems vulnerable to disruption by unauthorized individuals. For example: TVA had implemented firewalls to segment control systems networks from the corporate network. However, the configuration of certain firewalls limited their effectiveness. The agency did not have effective passwords or other equivalent documented controls to restrict access to the control systems we reviewed. According to agency officials, passwords were not always technologically possible to implement, but in the cases we reviewed there were no documented compensating controls. TVA had not installed current versions of patches for key applications on computers on control systems networks. In addition, the agencywide policy for patch management did not apply to individual plant-level control systems. Although TVA had implemented antivirus software on its transmission control systems network, it had not consistently implemented antivirus software on other control systems we reviewed. TVA had not consistently implemented physical security controls at several facilities that we reviewed. For example: Live network jacks connected to TVA’s internal network at certain facilities we reviewed had not been adequately secured from unauthorized access. At one facility, sufficient emergency lighting was not available, a server room had no smoke detectors, and a control room contained a kitchen (a potential fire and water hazard). The agency had not always ensured that access to sensitive computing and industrial control systems resources had been granted to only those who needed it to perform their jobs. At one facility, about 75 percent of facility badgeholders had access to a plant computer room, although the vast majority of these individuals did not need access. Officials stated that all of those with access had been through the required background investigation and training process. Nevertheless, an underlying principle for secure computer systems and data is that users should be granted only those access rights and permissions needed to perform their official duties. An underlying reason for TVA’s information security control weaknesses was that it had not consistently implemented significant elements of its information security program, such as: documenting a complete inventory of systems; assessing risk of all systems identified; developing, documenting, and implementing information security policies and procedures; and documenting plans for security of control systems as well as for remedial actions to mitigate known vulnerabilities. As a result of not fully developing and implementing these elements of its information security program, TVA had limited assurance that its control systems were adequately protected from disruption or compromise from intentional attack or unintentional incident. TVA’s inventory of systems did not include all of its control systems as required by agency policy. In its fiscal year 2007 FISMA submission, TVA included the transmission and the hydro automation control systems in its inventory. However, the plant control systems at its nuclear and fossil facilities had not been included in the inventory. At the conclusion of our review, agency officials stated they planned to develop a more complete and accurate system inventory by September 2008. TVA had not completed categorizing risk levels or assessing the risks to its control systems. FISMA mandates that agencies assess the risk and magnitude of harm that could result from the unauthorized access, use, disclosure disruption, modification, or destruction of their information and information systems. However, while the agency had categorized the transmission and hydro automation control systems as high-impact systems, its nuclear division and fossil business unit, which includes its coal and combustion turbine facilities, had not assigned risk levels to its control systems. TVA had also not completed risk assessments for the control systems at its hydroelectric, nuclear, coal, and combustion turbine facilities. According to TVA officials, the agency plans to complete the hydroelectric and nuclear control systems risk assessments by June 2008 and they plan to complete the security categorization of remaining control systems throughout TVA by September 2008, except for fossil systems, for which no date has been set. Several shortfalls in the development, documentation, and implementation of TVA’s information security policies contributed to many of the inadequacies in TVA’s security practices. For example: TVA had not consistently applied agencywide information security policies to its control systems, and TVA business unit security policies were not always consistent with agencywide information security policies. Cyber security responsibilities for interfaces between TVA’s transmission control system and its hydroelectric and fossil generation units had not been documented. Physical security standards for control system sites had not been finalized or were in draft form. Weaknesses in TVA’s patch management process hampered the efforts of TVA personnel to identify, prioritize, and install critical software security patches to TVA systems in a timely manner. For a 15-month period, TVA documented its analysis of 351 reported vulnerabilities, while NIST’s National Vulnerability Database reported about 2,000 vulnerabilities rated as high or medium risk for the types of systems in operation at TVA for the same time period. In addition, upon release of a patch by the software vendor, the agency had difficulty in determining the patch’s applicability to the software applications in use at the agency because it did not have a mechanism in place to provide timely access to software version and configuration information for the applications. Furthermore, TVA’s written guidance on patch management provided only limited guidance on how to prioritize vulnerabilities. The guidance did not refer to the criticality of IT resources or specify situations in which it was acceptable to upgrade or downgrade a vulnerability’s priority from that given by its vendors or third- party patch tracking services.