The same speed and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with computer operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. We reported in March 2004 that federal agencies continue to show significant weaknesses in computer systems that put critical operations and assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. The increasing sophistication and maliciousness of cybersecurity threats create unique challenges to federal systems and governmentwide cybersecurity efforts. Security experts are observing the rapid evolution of attack technologies and methods. Unsolicited commercial e-mail (spam) has been an annoyance to Internet users for several years. However, over the past few years, this mass-marketing tool has evolved from a mere nuisance to a delivery mechanism for malicious software programs (commonly referred to as malware) that hijack computers, and e-mail that deceives recipients into divulging sensitive information, such as credit card numbers, login IDs, and passwords (phishing). One emerging form of malware, known as spyware, is installed without the user’s knowledge to surreptitiously track and/or transmit data to an unauthorized third party. Security researchers’ and vendors’ 2004 annual security reports reportedly identified phishing and spyware as among the top emerging threats of last year, and they were predicted to increase in 2005. These threats have targeted our government; for instance, in 2004, federal entities such as FDIC, the Federal Bureau of Investigation (FBI), and IRS were used in phishing scams in which their agency names were exploited. Although spam, phishing, and spyware were once viewed as discrete consumer challenges, they are now being blended to create substantial threats to large enterprises, including federal systems. For example, the number of phishing scams that are often spread through spam has significantly increased. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as crime, terrorism, foreign intelligence gathering, and acts of war. According to the FBI, terrorists, transnational criminals, and intelligence services are quickly becoming aware of and using information exploitation tools such as computer viruses, Trojan horses, worms, logic bombs, and eavesdropping sniffers that can destroy, intercept, and degrade the integrity of or deny access to data. As larger amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. Table 1 summarizes the sources of emerging cybersecurity threats. The sophistication and effectiveness of cyberattacks have steadily advanced. These attacks often take advantage of flaws in software code, circumvent signature-based tools that commonly identify and prevent known threats, and use stealthy social engineering techniques designed to trick the unsuspecting user into divulging sensitive information. These attacks are becoming increasingly automated with the use of botnets— compromised computers that can be controlled remotely by attackers to automatically launch attacks. Bots have become one of the key automation tools that speed the location and infection of vulnerable systems. Several laws have been implemented to improve the nation’s cybersecurity posture. The Federal Information Security Management Act of 2002 (FISMA) requires agencies to implement an entitywide risk-based approach to protecting federal systems and information against cyberattack. Other laws, such as the Homeland Security Act and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), among others, also address actions that the government can take to increase national cybersecurity awareness and preparedness, including the roles and responsibilities of key agencies such as DHS. Additionally, recent legislation, both enacted and pending, that specifically addresses spam, phishing, and spyware has included civil and criminal penalties to deter cybercrime. FISMA establishes clear criteria to improve federal agencies’ cybersecurity programs. Enacted into law on December 17, 2002, as title III of the E- Government Act of 2002, FISMA requires federal agencies to protect and maintain the confidentiality, integrity, and availability of their information and information systems. It also assigns specific information security responsibilities to the Office of Management and Budget (OMB), the Department of Commerce’s National Institute of Standards and Technology (NIST), agency heads, chief information officers (CIO), and inspectors general (IG). For OMB, these responsibilities include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, as well as reviewing, at least annually, and approving or disapproving, agency information security programs. FISMA required each agency including agencies with national security systems, to develop, document, and implement agencywide information security programs to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. FISMA requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of information security policies, procedures, and practices, and on compliance with FISMA’s requirements. FISMA also charges the Director of OMB with ensuring the operation of a central federal information security incident center with responsibility for issuing guidance to agencies on detecting and responding to incidents. Other responsibilities include compiling and analyzing information about incidents and informing agencies about current and potential information security threats. Prior to FISMA, the CIO Council (then chaired by OMB’s Deputy Director for Management) issued a memorandum to all agency CIOs instructing agencies to follow specific practices for appropriate coordination and interaction with the Federal Computer Incident Response Capability (FedCIRC). OMB’s statutory requirement supported FedCIRC, and OMB received quarterly reports from FedCIRC on the federal government’s status on information technology security incidents. Following the establishment of DHS and in an effort to implement action items described in the National Strategy to Secure Cyberspace, FedCIRC was dissolved as a separate entity and its functions absorbed into the United States Computer Emergency Readiness Team (US-CERT), which was created in September 2003. US-CERT was established to aggregate and disseminate cybersecurity information to improve warning about and response to incidents, increase coordination of response information, reduce vulnerabilities, and enhance prevention and protection. US-CERT analyzes incidents reported by federal civilian agencies and coordinates with national security incident response centers in responding to incidents on both classified and unclassified systems. US-CERT also provides a service through its National Cyber Alert System to identify, analyze, prioritize, and disseminate information on emerging vulnerabilities and threats. On August 23, 2004, OMB issued FISMA reporting instructions to the agencies. This guidance reinforces the requirement for agencies to test and evaluate their security controls annually, at a minimum, to promote a continuous process of assessing risk and ensuring that security controls maintain risk at an acceptable level. Further, agencies’ 2004 FISMA reporting guidance requires them to report on their incident-detection and incident-handling procedures, including methods used to mitigate information technology security risk and internal and external incident- reporting procedures. OMB also issued a memorandum to the agencies on personal use policies and “file sharing” technology. In this guidance, OMB directs agencies to establish or update their personal use policies and to train employees on these policies to “ensure that all individuals are appropriately trained in how to fulfill their security responsibilities.” FISMA also requires NIST to establish standards, guidelines, and requirements to help agencies improve the posture of their information security programs. NIST has issued several publications relevant to assisting agencies in protecting their systems against emerging cybersecurity threats. For instance, Special Publication 800-61, Computer Security Incident Handling Guide, advises agencies to establish an incident-response capability that includes establishing guidelines for communicating with outside parties regarding incidents, including law enforcement agencies, and also discusses handling specific types of incidents, including malicious code and unauthorized access. Additionally, NIST Special Publication 800-68 (Draft), Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist, describes configuration recommendations that focus on deterring malware, countermeasures against security threats with malicious payload, and specific recommendations for addressing spyware. NIST has also issued guidance on various controls that agencies can implement, such as Guidelines on Electronic Mail Security and Guidelines on Securing Public Web Servers.