Specifically, this program is to include    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;    subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. TVA Provides Power to the Southeastern United States

The TVA is a federal corporation and the nation’s largest public power  company. TVA Had Not Fully Implemented Appropriate Security Practices to Protect Its Critical Infrastructures

TVA had not fully implemented appropriate security practices to secure  the control systems used to operate its critical infrastructures. Both the  corporate network infrastructure and control systems networks and  devices at individual facilities and plants were vulnerable to disruption. In  addition, physical security controls at multiple locations did not  sufficiently protect critical control systems. The interconnections between  TVA’s control system networks and its corporate network increase the risk  that security weaknesses on the corporate network could affect control  systems networks. As a  result, TVA’s control systems that operate its critical infrastructures are at  increased risk of unauthorized modification or disruption by both internal  and external threats. In addition, the configuration of numerous network  infrastructure protocols and devices provided limited or ineffective  security protections. Moreover, the intrusion detection system that TVA  used had significant limitations. However, almost all of the workstations and servers that we examined on  the corporate network lacked key security patches or had inadequate  security settings. Specifically, firewalls were either bypassed or inadequately configured,  passwords were either weak or not used at all, logging of certain activity  was limited, configuration management policies for control systems  software were not consistently implemented, and servers and  workstations lacked key patches and effective virus protection. Information Security Management Program Was Not Consistently Implemented across TVA’s Critical Infrastructure

An underlying reason for TVA’s information security control weaknesses is  that it had not consistently implemented significant elements of its  information security program. The effective implementation of an  information security program includes implementing the key elements  required under FISMA and the establishment of a continuing cycle of  activity—which includes developing an inventory of systems, assessing  risk, developing policies and procedures, developing security plans,  testing and monitoring the effectiveness of controls, identifying and  tracking remedial actions, and establishing appropriate training. TVA did not have a complete and accurate inventory of its control  systems. Until TVA has a complete and accurate  inventory of its control systems, it cannot ensure that the appropriate  security controls have been implemented to protect these systems. In addition, as  previously noted, the agency had not categorized the impact of many of its  control systems. Agency officials stated that they were planning to develop  security plans and complete the certification and accreditation process for  these control systems. According to agency officials, training had not been  completed primarily due to a lack of staff to provide the training. In  addition, the agency had developed backup procedures for key  information resources, including those that support its control systems. Finalize the draft agencywide cyber incident response procedure. We evaluated TVA’s implementation of these key elements by  reviewing TVA’s system inventory to determine whether it contained an  accurate and comprehensive list of control systems;   analyzing risk assessments for key TVA systems to determine whether  risks and threats were documented;   examining security plans to determine if management, operational, and  technical controls were in place or planned and whether these security  plans were updated;   analyzing TVA policies, procedures, practices, and standards to determine  their effectiveness in providing guidance to personnel responsible for  securing information and information systems; inspecting training records for personnel with significant responsibilities  to determine if they received training commensurate with those  responsibilities;   analyzing test plans and test results for key TVA systems to determine  whether management, operational, and technical controls were adequately  tested at least annually and were based on risk;    evaluating TVA’s process to correct weaknesses and determining whether  remedial action plans complied with federal guidance; and    examining contingency plans for key TVA systems to determine whether  those plans had been tested or updated.
Why GAO Did This Study

Securing the control systems that regulate the nation's critical infrastructures is vital to ensuring our economic security and public health and safety. The Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, generates and distributes power in an area of about 80,000 square miles in the southeastern United States. GAO was asked to determine whether TVA has implemented appropriate information security practices to protect its control systems. To do this, GAO examined the security practices in place at several TVA facilities; analyzed the agency's information security policies, plans, and procedures against federal law and guidance; and interviewed agency officials who are responsible for overseeing TVA's control systems and their security.

What GAO Found

TVA has not fully implemented appropriate security practices to secure the control systems and networks used to operate its critical infrastructures. Both its corporate network infrastructure and control systems networks and devices were vulnerable to disruption. The corporate network was interconnected with control systems networks GAO reviewed, thereby increasing the risk that security weaknesses on the corporate network could affect those control systems networks. On TVA's corporate network, certain individual workstations lacked key software patches and had inadequate security settings, and numerous network infrastructure protocols and devices had limited or ineffective security configurations. In addition, the intrusion detection system had significant limitations. On control systems networks, firewalls reviewed were either inadequately configured or had been bypassed, passwords were not effectively implemented, logging of certain activity was limited, configuration management policies for control systems software were inconsistently implemented, and servers and workstations lacked key patches and effective virus protection. In addition, physical security at multiple locations did not sufficiently protect critical control systems. As a result, systems that operate TVA's critical infrastructures are at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses is that TVA had not consistently implemented significant elements of its information security program. Although TVA had developed and implemented program activities related to contingency planning and incident response, it had not consistently implemented key activities related to developing an inventory of systems, assessing risk, developing policies and procedures, developing security plans, testing and monitoring the effectiveness of controls, completing appropriate training, and identifying and tracking remedial actions. For example, the agency lacked a complete inventory of its control systems and had not categorized all of its control systems according to risk, thereby limiting assurance that these systems were adequately protected. Agency officials stated that they plan to complete these risk assessments and related activities but have not established a completion date. Key information security policies and procedures were also in draft or under revision. Additionally, the agency's patch management process lacked a way to effectively prioritize vulnerabilities. TVA had only completed one system security plan, and another plan was under development. The agency had also tested the effectiveness of its control systems' security using outdated federal guidance, and many control systems had not been tested for security. In addition, only 25 percent of relevant agency staff had completed required role-based security training in fiscal year 2007. Furthermore, while the agency had developed a process to track remedial actions for information security, this process had not been implemented for the majority of its control systems. Until TVA fully implements these security program activities, it risks a disruption of its operations as a result of a cyber incident, which could impact its customers.