Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Therefore, it is important for agencies to safeguard their systems against risks such as loss or theft of resources (such as federal payments and collections), modification or destruction of data, and unauthorized uses of computer resources or to launch attacks on other computer systems. Sensitive information, such as taxpayer data, Social Security records, medical records, and proprietary business information could be inappropriately disclosed, browsed, or copied for improper or criminal purposes. Critical operations could be disrupted, such as those supporting national defense and emergency services or agencies’ missions could be undermined by embarrassing incidents, resulting in diminished confidence in their ability to conduct operations and fulfill their responsibilities. Cyber threats to federal systems and critical infrastructures can be unintentional and intentional, targeted or nontargeted, and can come from a variety of sources. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and nontargeted attacks. A targeted attack is when a group or individual specifically attacks a critical infrastructure system. A nontargeted attack occurs when the intended target of the attack is uncertain, such as when a virus, worm, or malware is released on the Internet with no specific target. The Federal Bureau of Investigation has identified multiple sources of threats to our nation’s critical information systems, including foreign nation states engaged in information warfare, domestic criminals, hackers, virus writers, and disgruntled employees working within an organization. Table 1 summarizes those groups or individuals that are considered to be key sources of cyber threats to our nation’s information systems and infrastructures. As federal information systems increase their connectivity with other networks and the Internet and as the system capabilities continue to increase, federal systems will become increasingly more vulnerable. Data from the National Vulnerability Database, the U.S. government repository of standards-based vulnerability management data, showed that, as of February 6, 2008, there were about 29,000 security vulnerabilities or software defects that can be directly used by a hacker to gain access to a system or network. On average, close to 17 new vulnerabilities are added each day. Furthermore, the database revealed that more than 13,000 products contained security vulnerabilities. These vulnerabilities become particularly significant when considering the ease of obtaining and using hacking tools, the steady advances in the sophistication and effectiveness of attack technology, and the emergence of new and more destructive attacks. Thus, protecting federal computer systems and the systems that support critical infrastructures has never been more important. Over five years have passed since Congress enacted FISMA, which sets forth a comprehensive framework for ensuring the effectiveness of security controls over information resources that support federal operations and assets. FISMA’s framework creates a cycle of risk management activities necessary for an effective security program, and these activities are similar to the principles noted in our study of the risk management activities of leading private sector organizations—assessing risk, establishing a central management focal point, implementing appropriate policies and procedures, promoting awareness, and monitoring and evaluating policy and control effectiveness. More specifically, FISMA requires the head of each agency to provide information security protections commensurate with the risk and magnitude of harm resulting from the unauthorized access, use, disclosure, disruption, modification or destruction of information and information systems used or operated by the agency or on behalf of the agency. In this regard, FISMA requires that agencies implement information security programs that, among other things, include ● periodic assessments of the risk; ● risk-based policies and procedures; ● subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; ● security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; ● periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually; ● a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies; ● procedures for detecting, reporting, and responding to security ● plans and procedures to ensure continuity of operations. In addition, agencies must develop and maintain an inventory of major information systems that is updated at least annually and report annually to the Director of OMB and several Congressional Committees on the adequacy and effectiveness of their information security policies, procedures, and practices and compliance with the requirements of the act. OMB and agency IGs also play key roles under FISMA. Among other responsibilities, OMB is to develop policies, principles, standards, and guidelines on information security and is required to report annually to Congress on agency compliance with the requirements of the act. OMB has provided instructions to federal agencies and their IGs for annual FISMA reporting. OMB’s reporting instructions focus on performance metrics related to the performance of key control activities such as certifying and accrediting systems, testing and evaluating security controls, and providing security training to personnel. Its yearly guidance also requires agencies to identify any physical or electronic incidents involving the loss of, or unauthorized access to, personally identifiable information. FISMA also requires agency IGs to perform an independent evaluation of the information security programs and practices of the agency to determine the effectiveness of such programs and practices. Each evaluation is to include (1) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems and (2) assessing compliance (based on the results of the testing) with FISMA requirements and related information security policies, procedures, standards, and guidelines. These required evaluations are then submitted by each agency to OMB in the form of an OMB-developed template that summarizes the results. In addition to the template submission, OMB encourages agency IGs to provide any additional narrative in an appendix to the report to the extent they provide meaningful insight into the status of the agency’s security or privacy program. Federal agencies continue to report progress in implementing key information security activities. The President’s proposed fiscal year 2009 budget for IT states that the federal government continues to improve information security performance relative to the certification and accreditation of systems and the testing of security controls and contingency plans. According to the budget, in 2007 the percentage of certified and accredited systems rose from 88 percent to 92 percent. Even greater gains were reported in testing of security controls—from 88 percent of systems to 95 percent of systems— and for contingency plan testing—from 77 percent to 86 percent. The proposed budget also noted improvements related to agency IG qualitative assessments of certain IT security processes. It reported that the overall quality of the certification and accreditation processes as determined by agency IGs increased compared to 2006, with 76 percent of agencies reporting ‘‘satisfactory’’ or better processes, up from 60 percent the prior year. In addition, the budget noted that 76 percent of agencies demonstrated that they had an effective process in place for identifying and correcting weaknesses using plans of action and milestone management processes. Although we have not yet verified the information security performance information for fiscal year 2007 contained in the President’s proposed budget, the information is consistent with historical trends. As we reported last year, agencies reported increased percentages in most OMB performance metrics for fiscal year 2006 when compared to fiscal year 2005 (see fig. 1) including those related to: Percentage of employees and contractors receiving IT Percentage of employees with significant security responsibilities who received specialized security training, Percentage of systems whose controls were tested and evaluated, Percentage of systems with tested contingency plans, Percentage of 24 major agencies with 96-100 percent complete inventories of major information systems, and Percentage of systems certified and accredited. However, for the fiscal year 2006 reporting period, IGs identified weaknesses with their agencies’ implementations of those key control activities. For example, according to agency IGs, five major agencies reported challenges in ensuring that contractors had received security awareness training. In addition, they reported that not all systems had been tested and evaluated at least annually, including some high impact systems, and that weaknesses existed in agencies’ monitoring of contractor systems or facilities. They highlighted other weaknesses such as contingency plans not being completed for critical systems and inventories of systems that were incomplete. Furthermore, IGs reported weaknesses in agencies’ certification and accreditation processes, a key activity OMB uses to monitor agencies’ implementation of information security requirements. Our work and that of IGs show that significant weaknesses continue to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of federal agencies. In their fiscal year 2007 performance and accountability reports, 20 of 24 major agencies indicated that inadequate information security controls were either a significant deficiency or a material weakness (see fig. 2). Our audits continue to identify similar conditions in both financial and non-financial systems, including agencywide weaknesses as well as weaknesses in critical federal systems. Persistent weaknesses appear in five major categories of information system controls: (1) access controls, which ensure that only authorized individuals can read, alter, or delete data; (2) configuration management controls, which provide assurance that only authorized software programs are implemented; (3) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (4) continuity of operations planning, which provides for the prevention of significant disruptions of computer-dependent operations; and (5) an agencywide information security program, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented. Figure 3 shows the number of major agencies with weaknesses in these five areas. A basic management control objective for any organization is to protect data supporting its critical operations from unauthorized access, which could lead to improper modification, disclosure, or deletion of the data.