Threats to systems supporting critical infrastructure and federal information systems are evolving and growing. Advanced persistent threats—where adversaries that possess sophisticated levels of expertise and significant resources to pursue its objectives repeatedly over an extended period of time—pose increasing risks. In 2009, the President declared the cyber threat to be “ne of the most serious economic and national security challenges we face as a nation” and stated that “America’s economic prosperity in the 21st century will depend on cybersecurity.” The Director of National Intelligence has also warned of the increasing globalization of cyber attacks, including those carried out by foreign militaries or organized international crime. In January 2012, he testified that such threats pose a critical national and economic security concern. To further highlight the importance of the threat, on October 11, 2012, the Secretary of Defense stated that the collective result of attacks on our nation’s critical infrastructure could be “a cyber Pearl Harbor; an attack that would cause physical destruction and the loss of life.” These growing and evolving threats can potentially affect all segments of our society, including individuals, private businesses, government agencies, and other entities. We have identified the protection of federal information In 2003, this systems as a high-risk area for the government since 1997.high-risk area was expanded to include protecting systems supporting our nation’s critical infrastructure. Each year since that time, GAO has issued multiple reports detailing weaknesses in federal information security programs and making recommendations to address them. A list of key GAO products can be found at the end of this report. The evolving array of cyber-based threats facing the nation pose threats to national security, commerce and intellectual property, and individuals. Threats to national security include those aimed against the systems and networks of the U.S. government, including the U.S. military, as well as private companies that support government activities or control critical infrastructure. These threats may be intended to cause harm for monetary gain or political or military advantage and can result, among other things, in the disclosure of classified information or the disruption of operations supporting critical infrastructure, national defense, or emergency services. Threats to commerce and intellectual property include those aimed at obtaining the confidential intellectual property of private companies, the U.S. government, or individuals with the aim of using that intellectual property for economic gain. For example, product specifications may be stolen to facilitate counterfeiting and piracy or to gain a competitive edge over a commercial rival. In some cases, theft of intellectual property may also have national security repercussions, as when designs for weapon systems are compromised. Threats to individuals include those that lead to the unauthorized disclosure of personally identifiable information, such as taxpayer data, Social Security numbers, credit and debit card information, or medical records. The disclosure of such information could cause harm to individuals, such as identity theft, financial loss, and embarrassment. The sources of these threats vary in terms of the types and capabilities of the actors, their willingness to act, and their motives. Table 1 shows common sources of adversarial cybersecurity threats. These sources of cybersecurity threats make use of various techniques, or attacks that may compromise information or adversely affect computers, software, a network, an organization’s operation, an industry, or the Internet itself. Table 2 provides descriptions of common types of cyber attacks. The unique nature of cyber-based attacks can vastly enhance their reach and impact, resulting in the loss of sensitive information and damage to economic and national security, the loss of privacy, identity theft, or the compromise of proprietary information or intellectual property. The increasing number of incidents reported by federal agencies, and the recently reported cyber-based attacks against individuals, businesses, critical infrastructures, and government organizations have further underscored the need to manage and bolster the cybersecurity of our government’s information systems and our nation’s critical infrastructures. Federal agencies have reported increasing numbers of cybersecurity incidents that have placed sensitive information at risk, with potentially serious impacts on federal operations, assets, and people. The increasing risks to federal systems are demonstrated by the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and steady advances in the sophistication and effectiveness of attack technology. As shown in figure 1, over the past 6 years, the number of incidents reported by federal agencies to the U.S. Computer Emergency Readiness Team (US-CERT) has increased from 5,503 in fiscal year 2006 to 48,562 incidents in fiscal year 2012, an increase of 782 percent. These incidents include, among others, the installation of malware, improper use of computing resources, and unauthorized access to systems. Of the incidents occurring in 2012 (not including those that were reported as under investigation), improper usage, malicious code, and unauthorized access were the most widely reported types across the federal government. As indicated in figure 2, which includes a breakout of incidents reported to US-CERT by agencies in fiscal year 2012, improper usage accounted for 20 percent of total incidents reported by agencies. In addition, reports of cyber incidents affecting national security, intellectual property, and individuals have been widespread and involve data loss or theft, economic loss, computer intrusions, and privacy breaches. The following examples from news media and other public sources illustrate that a broad array of information and assets remain at risk. In February 2012, the National Aeronautics and Space Administration (NASA) inspector general testified that computers with Chinese-based Internet protocol addresses had gained full access to key systems at its Jet Propulsion Laboratory, enabling attackers to modify, copy, or delete sensitive files; create user accounts for mission-critical laboratory systems; and upload hacking tools to steal user credentials and compromise other NASA systems. These individuals were also able to modify system logs to conceal their actions. In March 2011, attackers breached the networks of RSA, the Security Division of EMC Corporation, and obtained information about network authentication tokens for a U.S. military contractor. In May 2011, attackers used this information to make duplicate network authentication tokens and breached the contractor’s security systems containing sensitive weapons information and military technology. EMC published information about the breach and the immediate steps customers could take to strengthen the security of their systems. In 2008, the Department of Defense was successfully compromised when an infected flash drive was inserted into a U.S. military laptop at a military base in the Middle East. The flash drive contained malicious computer code, placed there by a foreign intelligence agency, that uploaded itself onto the military network, spreading through classified and unclassified systems. According to the then Deputy Secretary of Defense, this incident was the most significant breach of U.S. military computers at that time, and DOD’s subsequent Strategy for Operating in Cyberspace was designed in part to prevent such attacks from recurring in the future. In March 2011, an individual was found guilty of distributing source code stolen from his employer, an American company. The investigation revealed that a Chinese company paid the individual $1.5 million to create control system source code based on the American company’s design. The Chinese company stopped the delivery of the turbines from the American company, resulting in revenue loss for the American company. In February 2011, media reports stated that computer attackers broke into and stole proprietary information worth millions of dollars from networks of six U.S. and European energy companies. In mid-2009, a research chemist with DuPont Corporation downloaded proprietary information to a personal e-mail account and thumb drive with the intention of transferring this information to Peking University in China and also sought Chinese government funding to commercialize research related to the information he had stolen. In May 2012, the Federal Retirement Thrift Investment Board reported a sophisticated cyber attack on the computer of a third party that provided services to the Thrift Savings Plan (TSP). As a result of the attack, approximately 123,000 TSP participants had their personal information accessed. According to the board, the information included 43,587 individuals’ names, addresses, and Social Security numbers; and 79,614 individuals’ Social Security numbers and other TSP-related information. In March 2012, attackers breached a server that held thousands of Medicaid records at the Utah Department of Health. Included in the breach were the names of Medicaid recipients and clients of the Children’s Health Insurance Plan. In addition, approximately 280,000 people had their Social Security numbers exposed, and another 350,000 people listed in the eligibility inquiries may have had other sensitive data stolen, including names, birth dates, and addresses. In March 2012, Global Payments, a credit-transaction processor in Atlanta, reported a data breach that exposed credit and debit card account information of as many as 1.5 million accounts in North America. Although Global Payments does not believe any personal information was taken, it provided alerts and planned to pay for credit monitoring for those whose personal information was at risk. These incidents illustrate the serious impact that cyber attacks can have on federal and military operations, critical infrastructure, and the confidentiality, integrity, and availability of sensitive government, private sector, and personal information. Federal law and policy address agency responsibilities for cybersecurity in a variety of ways, reflecting its complexity and the nature of our country’s political and economic structure. Requirements for securing the federal government’s information systems are addressed in federal laws and policies. Beyond high-level critical infrastructure protection responsibilities, the existence of a federal role in securing systems not controlled by the federal government typically relates to the government’s application of regulatory authority and reflects the fact that much of our nation’s economic infrastructure is owned and controlled by the private sector. Certain federal agencies have cybersecurity-related responsibilities within a specific economic sector and may issue standards and guidance. For example, the Federal Energy Regulatory Commission approves cybersecurity standards in carrying out responsibilities for the reliability of the nation’s bulk power system.