According to DOD, the department relies on over 2.5 million unclassified computer systems, 10,000 local area networks, and hundreds of long- distance networks for mission-critical operations. These systems and networks run on multiple hardware and software platforms consisting of interconnected mainframes, systems, and network operating systems that often operate over public, commercial telecommunication lines. Security over these systems and networks involves multiple DOD and private sector organizations and is a difficult undertaking because of the ever-increasing number of cyber threats and attacks occurring over the Internet. Daily, DOD identifies and records thousands of “cyber events,” some of which are determined to be attacks against systems and networks. These attacks may be perpetrated by individuals inside or outside the organization, including hackers, foreign-sponsored entities, employees, former employees, and contractors or other service providers. Although historically DOD focused most of its security efforts on protecting the confidentiality of classified and sensitive information, this focus evolved as unclassified DOD systems and networks became increasingly exposed to cyber threats and attacks because of their connections with the public telecommunications infrastructure. After the “Morris Worm” attack crippled about 10 percent of the computers connected to the Internet in 1988, DOD acted—through the Defense Advanced Research Projects Agency—to establish the CERT Coordination Center at Carnegie Mellon University to address computer security threats. In 1992, the Air Force established the first military CERT to help address computer security threats and attacks internally. In 1994, a hacker from the United Kingdom raised concerns by launching a series of attacks against critical DOD research systems, demonstrating a need for better cyber defenses. Following these events, the Navy and Army established CERTs in 1995 and 1996, respectively. During the 1990s, incident response organizations were also gradually being established throughout other agencies of the federal government. In 1996, the Federal Computer Incident Response Capability (FedCIRC) was established to assist federal civilian agencies in their incident handling efforts. Like DOD, civilian agencies continue to evolve and mature in their incident response capabilities. Even as greater attention has been paid to incident response, cyber threats and attacks continue to affect the operations of DOD and other federal systems and networks. Since 1998, a number of federal systems have been subjected to a series of recurring, “stealth-like” attacks, code-named Moonlight Maze, that federal incident response officials have attributed to foreign entities and are still investigating. More recently, the “ILOVEYOU” virus attack affected electronic mail and other systems worldwide. According to DOD officials, thousands of potential cyber attacks are launched against DOD systems and networks daily, though very few are successful in accessing computer and information resources. In 1999 and 2000, the Air Force, Army, and Navy recorded a combined total of 600 and 715 cyber attacks respectively, during which intruders attacked DOD systems and networks in a variety of ways. Table 1 summarizes the numbers of recent documented cyber attacks reported by the military services. DOD and other organizations rely on a range of incident response activities to safeguard their systems, networks, and information from attack. These activities involve the use of various computer security tools and techniques as well as the support of systems and technical specialists. Incident response activities can be grouped into four broad categories: Preventive activities—such as conducting security reviews of major systems and networks and disseminating vulnerability notifications— are used to identify and correct security vulnerabilities before they can be exploited. Detection activities rely on automated techniques, such as intrusion detection systems and the logging capabilities of firewalls, to systematically scan electronic messages and other data that traverse an organization’s networks for signs of potential misuse. Investigative and diagnostic activities involve (1) technical specialists who research cyber events and develop countermeasures and (2) law enforcement personnel who investigate apparent attacks. Event handling and response activities—responding to actual events that could threaten an organization’s systems and networks—involve technical and system specialists who review data generated by intrusion detection systems and determine what needs to be done. This includes providing appropriate internal and external officials with critical information on events under way and possible remedies for minimizing operational disruption. The objectives of our review were to (1) identify DOD’s incident response capabilities and how these capabilities are being implemented and (2) identify challenges to improving these capabilities. To do this, we worked at the DOD organizations primarily responsible for incident response activities at the departmentwide level and within the four services. Specifically, we worked at the U.S. Space Command in Colorado Springs, Colorado; the Joint Task Force for Computer Network Defense (JTF-CND) in Arlington, Virginia; the Defense Information System Agency’s DOD Computer Emergency Response Team (CERT) and Global Network Operations and Security Center in Arlington, Virginia; the Air Force’s Information Warfare Center and CERT in San Antonio, Texas, and Communication and Information Center, Rosslyn, Virginia; the Army’s Land Information Warfare Activity and CERT at Fort Belvoir, Virginia; the Marine Information Technology Operations Center in Quantico, Virginia; and the Navy’s Fleet Information Warfare Center and Computer Incident Response Team in Norfolk, Virginia. At these locations, we obtained and analyzed information on (1) policies, procedures, roles, and responsibilities for incident response, (2) intrusion detection and other incident response tools and databases, and (3) key oversight and incident reporting procedures. Technical reports and database description documents were obtained and reviewed. We also reviewed operations and strategic planning documents and reports on computer security events, incidents, and intrusions for January 1999 through December 2000. Finally, we met with senior DOD officials in the Office of the Secretary of Defense to discuss departmentwide information security programs, strategies, and plans. Our work was performed in accordance with generally accepted government auditing standards from April 2000 through January 2001. We did not verify the effectiveness of DOD’s incident response capabilities and did not evaluate incident response capabilities within DOD support agencies, such as DISA. We obtained written comments on a draft of this report from the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence. These comments are reprinted in appendix I. DOD has taken important steps to highlight the threat to its networks and systems and to enhance its ability to respond to computer incidents. For example, in 1997, DOD conducted a military exercise known as Eligible Receiver that demonstrated that hostile forces could penetrate DOD systems and networks and further highlighted the need for an organization to manage the defense of its systems and networks. A series of computer attacks against DOD systems in early 1998 further highlighted the need for a single departmentwide focal point for incident response. In December 1998, DOD established JTF-CND as the primary department- level agent to coordinate and direct internal activities aimed at preventing and detecting cyber attacks, containing damage, and restoring computer functionality. The services—Air Force, Army, Marine Corps, and Navy— were directed to provide JTF-CND with tactical support through their CERTs and other supporting components. The U.S. Space Command assumed operational control over JTF-CND in October 1999. JTF-CND serves as the departmentwide focal point for incident response activities. In 1998, DOD also established the Defense-wide Information Assurance Program (DIAP) to promote integrated, comprehensive, and consistent information assurance activities across the department. “Information assurance” refers to the range of information security activities and functions needed to protect and defend DOD’s information and systems. While JTF-CND coordinates and oversees incident response activities on a day-to-day operational basis, DIAP’s responsibilities include coordinating DOD plans and policies related to incident response. DOD’s network of CERTs, JTF-CND, and other related organizations engage in a variety of preventive, detective, investigative, and response activities, as described in further detail below. DOD’s preventive activities are aimed at stopping cyber attacks or minimizing the likelihood that they will be successful in penetrating systems or networks through exploiting known vulnerabilities. These activities have included (1) vulnerability assessments of the security of DOD systems and networks, (2) using technical experts to try to surreptitiously gain access to systems and networks, thus exposing security weaknesses before adversaries can exploit them, and (3) alerting systems administrators to identified vulnerabilities. Conducting vulnerability assessments can help ensure that system and security software is properly installed and configured and that the proper configuration is maintained through any updates or other modifications. Upon request, the Air Force, Army, Navy, and National Security Agency conduct vulnerability assessments of DOD systems and networks using a variety of automated computer security assessment tools. These tools automatically check systems and networks for known security weaknesses and generate reports summarizing results. During 2000, the Air Force, Army, Navy, and National Security Agency completed over 150 assessments that identified hundreds of vulnerabilities for commands to address. Upon request, the services and the National Security Agency use groups of technical experts to play the role of hackers and attempt to penetrate DOD systems and networks by exploiting known security weaknesses in commonly used systems and software. These efforts help prepare military forces to defend against cyber attacks and are often conducted during military training exercises. In addition, DOD established a Joint Web Risk Assessment Cell (JWRAC), staffed by reservists, to continually review DOD web sites to identify sensitive information. According to DOD officials, during its first 6 months of operation, JWRAC reviewed about 10,000 Web pages and identified hundreds of discrepancies for corrective action. Even with these preventive efforts, new types of security vulnerabilities are being identified almost daily, and hackers are continually developing automated tools to take advantage of them.