As computer technology has advanced, federal agencies have become dependent on computerized information systems to carry out their operations and to process, maintain, and report essential information. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions without these information assets. Information security is thus critically important. Conversely, ineffective information security controls can result in significant risks. Examples of such risks include the following: Resources, such as federal payments and collections, could be lost or stolen. Sensitive information, such as national security information, taxpayer data, Social Security records, medical records, and proprietary business information, could be inappropriately accessed and used for identity theft or espionage. Critical operations, such as those supporting critical infrastructure, national defense, and emergency services could be disrupted. Agency missions could be undermined by embarrassing incidents that result in diminished confidence in the ability of federal organizations to conduct operations and fulfill their responsibilities. Threats to federal information systems and cyber-based critical infrastructures are evolving and growing. Government officials are concerned about attacks from individuals and groups with malicious intent, such as criminals, terrorists, and foreign nations. Federal law enforcement and intelligence agencies have identified multiple sources of threats to our nation’s critical information systems, including foreign nations engaged in espionage and information warfare, criminals, hackers, virus writers, and disgruntled employees and contractors. These groups and individuals have a variety of attack techniques at their disposal. Furthermore, as we have previously reported, the techniques have characteristics that can vastly enhance the reach and impact of their actions, such as the following: Attackers do not need to be physically close to their targets to perpetrate a cyber attack. Technology allows actions to easily cross multiple state and national borders. Attacks can be carried out automatically, at high speed, and by attacking a vast number of victims at the same time. Attackers can easily remain anonymous. The connectivity between information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt telecommunications, electrical power, and other critical services. As government, private sector, and personal activities continue to move to networked operations, the threat will continue to grow. Consistent with the evolving and growing nature of the threats to federal systems, agencies are reporting an increasing number of security incidents. These incidents put sensitive information at risk. Personally identifiable information about U.S. citizens has been lost, stolen, or improperly disclosed, thereby potentially exposing those individuals to loss of privacy, identity theft, and financial crimes. Reported attacks and unintentional incidents involving critical infrastructure systems demonstrate that a serious attack could be devastating. Agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices. When incidents occur, agencies are to notify the Department of Homeland Security’s (DHS) federal information security incident center—the United States Computer Emergency Readiness Team (US-CERT). As shown in figure 1, the number of incidents reported by federal agencies to US-CERT has increased dramatically over the past 4 years, from 5,503 incidents reported in fiscal year 2006 to about 30,000 incidents in fiscal year 2009 (over a 400 percent increase). The four most prevalent types of incidents and events reported to US- C ERT during fiscal year 2009 were: (1) malicious code (software that infects an operating system or application), (2) improper usage (a violation of acceptable computing use policies), (3) unauthorized acce (where an individual gains logical or physical access to a system wi permission), and (4) investigation (unconfirmed incidents that are potentially malicious or anomalous activity deemed by the reporting entity to warrant further review). The growing threats and increasing number of reported incidents highlight the need for effective information security policies and practices. However, serious and widespread information security control deficiencies continue to place federal assets at risk of inadvertent o deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropr disclosure, and critical operations at risk of disruption. GAO hasdesignated information security as a high-risk area in the federal government since 1997. In their fiscal year 2009 performance and accountability reports, 21 of 24 major federal agencies noted that inadequate information system controls over their financial systems and information were either a material weakness or a significant deficiency. Similarly, our audits have identified control deficiencies in both financial and nonfinancial systems, including vulnerabilities in critical federal systems. For example, we reported in September 2008 that, although the Los Alamos National Laboratory—one of the nation’s weapons laboratories—implemented measures to enhance the information security of its unclassified network, vulnerabilities continued to exist in several critical areas. Similarly, in October 2009 we reported that the National Aeronautics and Space Administration (NASA)—the civilian agency that oversees U.S. aeronautical and space activities—had not always implemented appropriate controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems supporting its mission directorates. Over the past several years, we and agency inspectors general have made hundreds of recommendations to agencies for actions necessary to resolve prior significant control deficiencies and information security program shortfalls. For example, we recommended that agencies correct specific information security deficiencies related to user identification and authentication, authorization, boundary protections, cryptography, audit and monitoring, physical security, configuration management, segregation of duties, and contingency planning. We have also recommended that agencies fully implement comprehensive, agencywide information security programs by correcting weaknesses in risk assessments, information security policies and procedures, security planning, security training, system tests and evaluations, and remedial actions. The effective implementation of these recommendations will strengthen the security posture at these agencies. Agencies have implemented or are in the process of implementing many of our recommendations. In addition, the White House, OMB, and certain federal agencies have undertaken several governmentwide initiatives that are intended to enhance information security at federal agencies. However, these initiatives face challenges that require sustained attention: Comprehensive National Cybersecurity Initiative (CNCI): In January 2008, President Bush initiated a series of 12 projects aimed primarily at improving the Department of Homeland Security’s (DHS) and other federal agencies’ efforts to protect against intrusion attempts and anticipate future threats. The initiative is intended to reduce vulnerabilities, protect against intrusions, and anticipate future threats against federal executive branch information systems. As we recently reported, the White House and federal agencies have established interagency groups to plan and coordinate CNCI activities. However, the initiative faces challenges in achieving its objectives related to securing federal information, including better defining agency roles and responsibilities, establishing measures of effectiveness, and establishing an appropriate level of transparency. Until these challenges are adequately addressed, there is a risk that CNCI will not fully achieve its goals. Federal Desktop Core Configuration (FDCC): For this initiative, OMB directed agencies that have workstations with Windows XP and/or Windows Vista operating systems to adopt security configurations developed by the National Institute of Standards and Technology, the Department of Defense, and DHS. The goal of this initiative is to improve information security and reduce overall information technology operating costs. We recently reported that while agencies have taken actions to implement FDCC requirements, none of the agencies has fully implemented all configuration settings on their applicable workstations. In our report we recommended that OMB, among other things, issue guidance on assessing the risks of agencies having deviations from the approved settings and monitoring compliance with FDCC. Einstein: This is a computer network intrusion detection system that analyzes network flow information from participating federal agencies and is intended to provide a high-level perspective from which to observe potential malicious activity in computer network traffic. We recently reported that as of September 2009, fewer than half of the 23 agencies reviewed had executed the required agreements with DHS, and Einstein 2 had been deployed to 6 agencies. Agencies that participated in Einstein 1 cited improved identification of incidents and mitigation of attacks, but determining whether the initiative is meeting its objectives will likely remain difficult because DHS lacks performance measures that address how agencies respond to alerts. Trusted Internet Connections (TIC) Initiative: This is an effort designed to optimize individual agency network services through a common solution for the federal government. The initiative is to facilitate the reduction of external connections, including Internet points of presence. We recently reported that none of the 23 agencies we reviewed met all of the requirements of the TIC initiative, and most agencies experienced delays in their plans for reducing and consolidating connections. However, most agencies reported that they have made progress toward reducing and consolidating their external connections and implementing security capabilities. Critical infrastructures are systems and assets, whether physical or virtual, so vital to the nation that their incapacity or destruction would have a debilitating impact on national security, national economic security, national public health or safety, or any combination of those matters. Federal policy established 18 critical infrastructure sectors: agriculture and food; banking and finance; chemical; commercial facilities; communications; critical manufacturing; dams; defense industrial base; emergency services; energy; government facilities; information technology; national monuments and icons; nuclear reactors, materials and waste; postal and shipping; public health and health care; transportation systems; and water. timely and actionable threat and mitigation information, and (4) responding to the threat. For example, US-CERT provided warnings by developing and distributing a wide array of notifications; however, these notifications were not consistently actionable or timely. As a result, we recommended that the department address shortfalls associated with the 15 attributes in order to fully establish a national cyber analysis and warning capability as envisioned in the national strategy. DHS agreed in large part with our recommendations and has reported that it is taking steps to implement them. Similarly, in September 2008, we reported that since conducting a major cyber attack exercise, called Cyber Storm, DHS had demonstrated progress in addressing eight lessons it had learned from these efforts. However, its actions to address the lessons had not been fully implemented.