Critical Infrastructure Protection (CIP) involves activities that enhance the cyber and physical security of the public and private infrastructures that are critical to national security, national economic security, and national public health and safety. Because a large percentage of the nation’s critical infrastructures is owned and operated by the private sector, public/private partnerships are crucial for successful critical infrastructure protection. Recent terrorist attacks and threats have further underscored the need to encourage and manage CIP activities. Vulnerabilities are being identified on a more frequent basis and, if these vulnerabilities are exploited, several of our nation’s critical infrastructures could be disrupted or disabled. Several types of organizations and individuals are capable of conducting attacks on our nation’s critical infrastructures. Historically, attacks on our infrastructures could be conducted only by a relatively small number of entities. However, with critical infrastructures’ increasing reliance on computers and networks, more organizations and individuals can cause harm using cyber attacks. Further, U.S. authorities are becoming increasingly concerned about the prospect of combined physical and cyber attacks, which could have devastating consequences. Table 1 lists sources of threats that have been identified by the U.S. intelligence community and others. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent—such as crime, terrorism, foreign intelligence gathering, and acts of war. For example, in February 2005, the Federal Bureau of Investigation Director testified before the Senate Select Committee on Intelligence about current threats—including cyber threats—to the United States. He stated that the cyber threat to the United States is serious, and the number of actors with both the ability and the desire to use computers for illegal and harmful purposes continues to rise. The Director added that individuals or groups from foreign states, including foreign governments, continue to pose threats to our national and economic security because they have the resources to support advanced network exploitation and attack. In addition, he stated that “terrorists show a growing understanding of the critical role of information technology in the day-to-day operations of our economy and national security and have expanded their recruitment to include people studying math, computer science and engineering.” The Director further stated that although individual hackers do not pose a great threat, hackers intent on stealing information or motivated by money are a concern—adding that “if this pool of talent is utilized by terrorists, foreign governments or criminal organizations, the potential for a successful cyber attack on our critical infrastructures is greatly increased.” Analyses by various organizations have also demonstrated the increasing threats that are faced by critical infrastructure sectors in the United States. For example, in May 2004, the E-Crime Watch™ survey of security and law enforcement executives found that 43 percent of the respondents reported “an increase in electronic crimes and intrusions over the previous year and 70 percent reported at least one electronic crime or intrusion being committed against their organization.” Regarding the source of the electronic crime or intrusion, 70 percent of respondents reported that they knew the source. The respondents most frequently identified hackers (40 percent), followed by current and former employees and contractors (31 percent), as the greatest threats to cybersecurity. Similarly, respondents to the 2003 Computer Security Institute and Federal Bureau of Investigation Computer Crime and Security Survey identified independent hackers as the most likely source of cyber attacks, as shown in table 2. As larger amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. According to the Federal Bureau of Investigation, terrorists, transnational criminals, and intelligence services are quickly becoming aware of and using tools such as computer viruses, Trojan horses, worms, logic bombs, and eavesdropping programs (“sniffers”) that can deny access, degrade the integrity of, intercept, or destroy data (see table 3). Viruses and worms are commonly used to launch denial-of-service attacks, which generally flood targeted networks and systems by transmitting so much data that regular traffic is either slowed or stopped. Such attacks have been used ever since the groundbreaking Morris worm, which brought 10 percent of the systems connected to the Internet to a halt in November 1988. In 2001, the Code Red worm used a denial-of-service attack to affect millions of computer users by shutting down Web sites, slowing Internet service and disrupting business and government operations. As the number of individuals with computer skills has increased, intrusion tools have become more readily available and relatively easy to use. Frequently, skilled hackers develop exploitation tools and post them on Internet hacking sites. These tools are then readily available for others to download, allowing even inexperienced programmers to create a computer virus or to literally point and click to launch an attack. According to the National Institute of Standards and Technology, 30 to 40 new attack tools are posted on the Internet every month. Experts also agree that there has been a steady advance in the sophistication and effectiveness of attack technologies. Intruders quickly develop attacks to exploit vulnerabilities that have been discovered in products, use these attacks to compromise computers, and share them with other attackers. In addition, they can combine these attacks with other forms of technology to develop programs that automatically scan the network for vulnerable systems, attack them, compromise them, and use them to spread the attack even further. In addition to the growing threat from terrorists, transnational criminals, foreign intelligence services, and hackers, there has been a growing number of software vulnerabilities. Flaws in software code that could cause a program to malfunction generally result from programming errors that occur during software development. The increasing complexity and size of software programs contribute to an increase in software flaws. For example, Microsoft Windows 2000 reportedly contains about 35 million lines of code, compared with about 15 million lines for Windows 95. As reported by the National Institute of Science and Technology, based on studies of code inspections, there can be as many as 20 flaws per thousand lines of software code. While most flaws do not create security vulnerabilities, the potential for these errors reflects the difficulty and complexity of delivering trustworthy code. By exploiting software vulnerabilities, hackers and others who spread malicious code can cause significant damage, ranging from defacing Web sites to taking control of entire systems and thereby being able to read, modify, or delete sensitive information; disrupt operations; launch attacks against other organizations’ systems; or destroy systems. Between 1995 and 2004, the Software Engineering Institute’s CERT® Coordination Center (CERT/CC) reported that 16,726 security vulnerabilities had resulted from software flaws. Figure 1 illustrates the increase in security vulnerabilities over these years. The growing number of known vulnerabilities increases the potential number of attacks. As vulnerabilities are discovered, attackers attempt to exploit them. Attacks can be launched against specific targets or widely distributed through viruses and worms. The risks posed by this increasing and evolving threat are demonstrated in media and other reports of actual and potential attacks and disruptions, such as those cited below. In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to U.S. utilities’ electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had “caused an impact.” While officials stated that hackers had not caused serious damage to the systems that feed the nation’s power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified their defenses against a potential catastrophic strike. In January 2005, a major university reported that a hacker had broken into a database containing 32,000 student and employee Social Security numbers, potentially compromising their finances and identities. In similar incidents during 2003 and 2004, it was reported that hackers had attacked the systems of other universities, exposing the personal information of over 1.8 million people. On August 11, 2003, the Blaster worm was launched, and it infected more than 120,000 computers in its first 36 hours. The worm was programmed to launch a denial-of-service attack against Microsoft’s Windows Update Web site, and it affected a wide range of systems and caused slowdowns and disruptions in users’ Internet services. For example, the Maryland Motor Vehicle Administration was forced to shut down its computer systems. In June 2003, the U.S. government issued a warning concerning a virus that specifically targeted financial institutions. Experts said the BugBear.b virus was programmed to determine whether a victim had used an e-mail address for any of the roughly 1,300 financial institutions listed in the virus’s code. If a match was found, the software attempted to collect and document user input by logging keystrokes and then provide this information to a hacker, who could use it in attempts to break into the banks’ networks. In May 2004, we reported that according to a preliminary study coordinated by the Cooperative Association for Internet Data Analysis, on January 25, 2003, the SQL Slammer worm (also known as “Sapphire” and “SQL Hell”) infected more than 90 percent of vulnerable computers worldwide within 10 minutes of its release on the Internet. As the study reports, exploiting a known vulnerability for which a patch had been available since July 2002, Slammer doubled in size every 8.5 seconds and achieved its full scanning rate (55 million scans per second) after about 3 minutes, causing considerable harm through network outages. Further, the study emphasized that the effects would likely have been more severe had Slammer carried a malicious payload, exploited a more widespread vulnerability, or targeted a more popular service. Despite its lack of malicious payload, Slammer caused significant damage, exacting a toll on several large companies and municipalities that found their internal networks deluged with data from the virus. Major financial institutions reported problems; for example, one reported that a majority of its automatic teller machines were unable to process customer transactions for several hours. The attack disrupted operations for several hours at a 911 call center that served two suburban police departments and at least 14 fire departments.