As computer technology has advanced, both government and private entities have become increasingly dependent on computerized information systems to carry out operations and to process, maintain, and report essential information. Public and private organizations rely on computer systems to transmit sensitive and proprietary information, develop and maintain intellectual capital, conduct operations, process business transactions, transfer funds, and deliver services. In addition, the Internet has grown increasingly important to American business and consumers, serving as a medium for hundreds of billions of dollars of commerce each year. Consequently, ineffective information security controls can result in significant risks, including loss or theft of resources, including money and intellectual property; inappropriate access to and disclosure, modification, or destruction of sensitive information; use of computer resources for unauthorized purposes or to launch attacks on other computers systems; damage to networks and equipment; loss of business due to lack of customer confidence; and increased costs from remediation. Cyber-based threats are evolving and growing and arise from a wide array of sources. These sources include business competitors, corrupt employees, criminal groups, hackers, and foreign nations engaged in espionage and information warfare. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. Table 1 shows common sources of cyber threats. These sources of cyber threats make use of various techniques, or exploits, to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. Table 2 provides descriptions of common types of cyber exploits. Cyberspace—where much business activity and the development of new ideas often take place—amplifies these threats by making it possible for malicious actors to quickly steal and transfer massive quantities of data while remaining anonymous and difficult to detect. For example, cyber attackers do not need to be physically close to their victims, technology allows attacks to easily cross state and national borders, attacks can be carried out at high speed and directed at a number of victims simultaneously, and cyber attackers can more easily remain anonymous. Moreover, the use of these and other techniques is becoming more sophisticated, with attackers using multiple or “blended” approaches that combine two or more techniques. Using such techniques, threat actors may target individuals, resulting in loss of privacy or identity theft; businesses, resulting in the compromise of proprietary information or intellectual property; critical infrastructures, resulting in their disruption or destruction; or government agencies, resulting in the loss of sensitive information and damage to economic and national security. Reports of cyber incidents affecting both public and private institutions are widespread. The U.S. Computer Emergency Readiness Team (US- CERT) receives computer security incident reports from federal agencies, state and local governments, commercial enterprises, U.S. citizens, and international computer security incident response teams. In its fiscal year 2011 report to Congress on implementation of the Federal Information Security Management Act of 2002, the Office of Management and Budget reported that US-CERT received over 100,000 total incident reports in fiscal year 2011. Over half of these (about 55,000) were phishing exploits; other categories of incidents included virus/Trojan horse/worm/logic bombs; malicious websites; policy violations; equipment theft or loss; suspicious network activity; attempted access; and social engineering. Private sector organizations have experienced a wide range of incidents involving data loss or theft, economic loss, computer intrusions, and privacy breaches, underscoring the need for improved security practices. The following examples from news media and other public sources illustrate that a broad array of information and assets remain at risk. In March 2012, it was reported that a security breach at Global Payments, a firm that processed payments for Visa and Mastercard, could compromise the credit- and debit-card information of millions of Americans. Subsequent to the reported breach, the company’s stock fell more than 9 percent before trading in its stock was halted. Visa also removed the company from its list of approved processors. In March 2012, it was reported that Blue Cross Blue Shield of Tennessee paid out a settlement of $1.5 million to the U.S. Department of Health and Human Services arising from potential violations stemming from the theft of 57 unencrypted computer hard drives that contained protected health information of over 1 million individuals. In April 2011, Sony disclosed that it suffered a massive breach in its video game online network that led to the theft of personal information, including the names, addresses, and possibly credit card data belonging to 77 million user accounts. In February 2011, media reports stated that computer hackers had broken into and stolen proprietary information worth millions of dollars from the networks of six U.S. and European energy companies. A retailer reported in May 2011 that it had suffered a breach of its customers’ card data. The company discovered tampering with the personal identification number (PIN) pads at its checkout lanes in stores across 20 states. In mid-2009 a research chemist with DuPont Corporation reportedly downloaded proprietary information to a personal e-mail account and thumb drive with the intention of transferring this information to Peking University in China and also sought Chinese government funding to commercialize research related to the information he had stolen. Between 2008 and 2009, a chemist with Valspar Corporation reportedly used access to an internal computer network to download secret formulas for paints and coatings, reportedly intending to take this proprietary information to a new job with a paint company in Shanghai, China. In December 2006, a product engineer with Ford Motor Company reportedly copied approximately 4,000 Ford documents onto an external hard drive in order to acquire a job with a Chinese automotive company. These incidents illustrate the serious impact that cyber threats can have on, among other things, the security of sensitive personal and financial information and proprietary information and intellectual property. While these effects can be difficult to quantify monetarily, they can include any of the following: For consumers or private citizens: identity theft or compromise of personal and economic information and costs associated with lower- quality counterfeit or pirated goods. For business: lost sales, lost brand value or damage to public image, cost of intellectual property protection, and decreased incentive to invest in research and development. For the economy as a whole: lower economic growth due to reduced incentives to innovate and lost revenue from declining U.S. trade with countries that have weak IP rights regimes. The prevalence of cyber threats and the risks they pose illustrate the need for security controls and other actions that can reduce organizations’ vulnerability to such attacks. As we have reported, there are a number of cybersecurity technologies that can be used to better protect systems from cyber attacks, including access control technologies, system integrity technologies, cryptography, audit and monitoring tools, and configuration management and assurance technologies. In prior reports, we have made hundreds of recommendations to federal agencies to better protect their systems and cyber-reliant critical infrastructures. Table 3 summarizes some of the common cybersecurity technologies, categorized by the type of security control they help to implement. In addition, the use of an overall cybersecurity framework can assist in the selection of technologies to protect an organization against cyber attacks. Such a framework includes determining the business requirements for security; performing risk assessments; establishing a security policy; implementing a cybersecurity solution that includes people, process, and technology to mitigate identified security risks; and continuously monitoring and managing security. Risk assessments, which are central to this framework, help organizations determine which assets are most at risk and to identify countermeasures to mitigate those risks. Risk assessment is based on a consideration of threats and vulnerabilities that could be exploited to inflict damage. Even with such a framework, there often are competing demands for cybersecurity investments. For example, for some companies, mitigating physical risks may be more important than mitigating cyber risks. Further, investing in cybersecurity technologies needs to make business sense. It is also important to bear in mind the limitations of some cybersecurity technologies and to be aware that their capabilities should not be overstated. Technologies do not work in isolation. Cybersecurity solutions make use of people, process, and technology. Cybersecurity technology must work within an overall security process and be used by trained personnel. We have also emphasized the importance of public-private partnerships for sharing information and implementing effective cybercrime prevention strategies. Similarly, the Office of the National Counterintelligence Executive has identified a series of “best practices in data protection strategies and due diligence for corporations.” strategy; insider threat programs and awareness; effective data management; network security, auditing, and monitoring; and contingency planning. Multiple federal agencies undertake a wide range of activities in support of IP rights. Some of these agencies are the Departments of Commerce (including the U.S. Patent and Trademark Office), State, Justice (including the FBI), Health and Human Services, and Homeland Security; the U.S. Trade Representative; the U.S. Copyright Office; and the U.S. International Trade Commission. In many cases, IP-related efforts represent a small part of the agencies’ much broader missions. Office of the National Counterintelligence Executive, Foreign Spies Stealing U.S. Economic Secrets in Cyberspace. Department of Justice’s (DOJ) U.S. attorneys offices, Criminal Division, and the FBI investigate and prosecute federal IP crimes. DOJ established the Computer Hacking and Intellectual Property program, which consists of specially trained assistant U.S. attorneys to pursue IP cases. Each of the 93 U.S. attorneys offices throughout the country have assistant U.S. attorneys designated as Computer Hacking and Intellectual Property coordinators, who are available to work on IP cases. In addition, DOJ has created Computer Hacking and Intellectual Property units in 25 U.S. attorney’s offices with histories of large IP case loads. DOJ’s Computer Crime and Intellectual Property Section—based in Washington, D.C.— consists of prosecutors devoted to enforcing computer crime and IP laws.