As computer technology has advanced, federal agencies have become dependent on computerized information systems to carry out their operations and to process, maintain, and report essential information. Virtually all federal operations are supported by computer systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions, deliver services to the public, and account for their resources without these cyber assets. Information security is thus especially important for federal agencies to ensure the confidentiality, integrity, and availability of their systems and data. Conversely, ineffective information security controls can result in significant risk to a broad array of government operations and assets, as the following examples illustrate: Computer resources could be used for unauthorized purposes or to launch attacks on other computer systems. Sensitive information, such as personally identifiable information, intellectual property, and proprietary business information could be inappropriately disclosed, browsed, or copied for purposes of identity theft, espionage, or other types of crime. Critical operations, such as those supporting critical infrastructure, national defense, and emergency services, could be disrupted. Data could be added, modified, or deleted for purposes of fraud, subterfuge, or disruption. Due to the growing cyber-based threats to federal systems and critical infrastructure, the persistent nature of information security vulnerabilities, and the associated risks, we continue to designate information security as a governmentwide high-risk issue in our most recent biennial report to Congress, a designation we have made in each report since 1997. In July 2009, we reported that almost all 24 major federal agencies had weaknesses in information security controls and that an underlying reason for these weaknesses is that agencies have not fully implemented their information security programs as required under the Federal Information Security Management Act. As a result, federal systems and sensitive information are at increased risk of unauthorized access and disclosure, modification, or destruction, as well as inadvertent or deliberate disruption of system operations and services. We have previously reported that federal agencies have experienced security breaches in their networks, potentially allowing sensitive information to be compromised, and systems, operations, and services to be disrupted. These examples illustrate that a broad array of federal information and critical infrastructures are at risk: The Department of State experienced a breach on its unclassified network, which daily processes about 750,000 e-mails and instant messages from more than 40,000 employees and contractors at 100 domestic and 260 overseas locations. The Nuclear Regulatory Commission confirmed that in January 2003, the Microsoft SQL Server worm known as “Slammer” infected a private computer network at the idled Davis-Besse nuclear power plant in Oak Harbor, Ohio, disabling a safety monitoring system for nearly 5 hours. Officials at the Department of Commerce’s Bureau of Industry and Security discovered a security breach in July 2006. In investigating this incident, officials were able to review firewall logs for an 8-month period prior to the initial detection of the incident, but were unable to clearly define the amount of time that perpetrators were inside its computers, or find any evidence to show that data was lost as a result. Because the threats have persisted and grown, in January 2008 the President issued National Security Presidential Directive 54/Homeland Security Presidential Directive 23, establishing the Comprehensive National Cybersecurity Initiative, a set of projects with the objective of safeguarding federal executive branch government information systems by reducing potential vulnerabilities, protecting against intrusion attempts, and anticipating future threats against the federal government’s networks. Under the initiative, DHS is to lead several projects to better secure civilian federal government networks, while other agencies, including OMB, the Department of Defense, the Office of the Director of National Intelligence, and other agencies have key roles in other projects, including monitoring military systems and classified networks, overseeing intelligence community systems and networks, and spearheading advanced technology research and development. The initiative’s 12 projects can be grouped into three focus areas: Establishing front lines of defense. This focus area includes initiatives intended to protect the perimeter of federal networks, such as consolidating connections and deploying intrusion detection and prevention systems. Defend against full spectrum of threats. This focus area includes activities intended to protect national security and intelligence-related information and systems across the federal government. Shape the future environment. The initiatives in this area are focused on expansion of cybersecurity education and research and development efforts for future technologies and cybersecurity strategies. Two primary initiatives under the establishing front lines of defense focus area are TIC and Einstein. In November 2007, OMB announced the TIC initiative. Directed by OMB with assistance from DHS, this effort is intended to improve the federal government’s security posture and incident response capability by reducing and consolidating external network connections, including Internet connections, currently in use by the government, and by centrally monitoring the traffic passing through these connections for potentially malicious activity. All federal agencies in the executive branch, except for the Department of Defense, are required to implement the initiative. Although the initiative is intended to secure connections to the Internet, other external connections to potentially unsecured systems must also be routed through an approved TIC access point, even if they do not pass through the Internet. Agencies may implement TIC by serving as their own access provider or by obtaining services from another source. Agencies may choose one of four service options: Single service: The agency provides services to its own bureaus and components only. Multi-service: The agency provides services to its own bureaus and components as well as to other agencies. Seeking service: The agency obtains services from a multi-service agency or through the Networx program. This program, managed by the General Services Administration (GSA), provides an acquisition vehicle for agencies to procure telecommunication, network, wireless, and information technology security services, including TIC services, from among multiple vendors. Hybrid: The agency both provides services to its own bureaus and components and obtains additional services from a Networx provider. Of the 23 agencies in our review, 16 have chosen to be a TIC access provider: specifically, 12 have chosen the single service option, 1 chose the multi-service option, and 3 have chosen the hybrid approach. The remaining seven agencies have chosen to seek service from another access provider. NCPS, operationally known as Einstein, was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT) in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity. It then coordinated with the appropriate agencies to mitigate those threats and vulnerabilities. US-CERT also used the information from the sensors to create analyses of cross-governmental trends, offering departments and agencies an aggregate picture of external threats against the federal government’s networks. Participation in the program was initially voluntary for federal agencies. In 2008, DHS developed the current iteration of Einstein—Einstein 2— which incorporated network intrusion detection technology into the capabilities of the initial version of the system. Einstein 2 monitors for specific predefined signatures of known malicious activity at federal agency Internet connections and alerts US-CERT when specific malicious network activity matching the predetermined signatures is detected. According to US-CERT, the signatures are not typically included in commercially available databases of known attack signatures, but are developed by US-CERT to look for specific malicious activity based on previous analysis. In addition, participation in Einstein became mandatory as part of the TIC initiative. Currently being piloted by DHS, Einstein 3 is intended to be an intrusion prevention system that is to automatically detect and respond appropriately to cyber threats before harm is done. Using signatures developed from critical information about foreign cyber threats as determined by the National Security Agency, the system is to draw on commercial technology and specialized government technology to conduct real-time full packet inspection and threat-based decision making on traffic entering or leaving federal agency networks. It is also intended to support enhanced information sharing by US-CERT with federal agencies by giving DHS the ability to provide agencies with automated alerts of detected network intrusion attempts. Ultimately, TIC and Einstein are intended to work together to build successive layers of defense mechanisms in the federal government’s information technology infrastructures. When Einstein is deployed at a TIC location, it monitors inbound and outbound network traffic. Once TIC is fully implemented across the federal government, all traffic passing between the federal civilian networks and the Internet is to be monitored for malicious activity by US-CERT using Einstein and its supporting processes. Figure 1 illustrates how TIC portals interact with the Einstein sensors and the Internet. OMB and DHS established requirements to meet the initiative’s goals of securing agencies’ external connections and improving the government’s incident response capability. However, as of September 2009, none of the 23 agencies had met all of the requirements. Throughout their efforts, agencies have experienced benefits and challenges as well as learned lessons. The primary goals of the TIC initiative are (1) to secure federal agency external connections using a common set of security controls and (2) to improve the federal government’s incident response capability. To achieve these goals, the initiative has the following objectives: reduce and consolidate external connections, including connections to the Internet, across the federal government; define and maintain baseline security capabilities for TIC access providers; establish a compliance program to monitor agency adherence to TIC policy. To achieve these objectives, agencies were required to: Inventory agency external connections. Agencies were required to provide their connection inventories to DHS by January 8, 2008. Identify and justify target number of external access points. Each agency was to submit their target number to DHS by April 15, 2008. They were also required to provide a justification indicating why the requested number of external access points was necessary to support their missions. Develop and implement plans to consolidate external connections.