Government officials are increasingly concerned about attacks from  individuals and groups with malicious intent, such as criminals,  terrorists, and nation-states. In addition, there is continued concern about the  threat that our adversaries, including nation-states and terrorists,  pose to our national security. To address threats posed against the nation’s computer-reliant  infrastructures, federal law and policy establishes DHS as the focal  point for cyber CIP. DHS Needs to Address Several Key Areas Associated with Its Cybersecurity Responsibilities

Over the last several years, we have reported that DHS has yet to  comprehensively satisfy its key cybersecurity responsibilities. These  reports included about 30 recommendations that we summarized  into the following key areas that are essential for DHS to address in  order to fully implement its cybersecurity responsibilities. We concluded that while US-CERT demonstrated aspects of each of  the key attributes, it did not fully incorporate all of them. The organization also provided warnings by  developing and distributing a wide array of attack and other  notifications; however, these notifications were not consistently  actionable or timely—providing the right information to the right  persons or groups as early as possible to give them time to take  appropriate action. We also concluded that while DHS  had demonstrated progress in addressing the lessons learned, more  needed to be done. Consequently, we recommended that DHS schedule  and complete the identified corrective activities so that its cyber  exercises can help both public and private sector participants  coordinate their responses to significant cyber incidents. Improving Cybersecurity of Infrastructure Control Systems

In a September 2007 report and October 2007 testimony, we  identified that federal agencies had initiated efforts to improve the  security of critical infrastructure control systems—computer-based  systems that monitor and control sensitive processes and physical  functions. For example, DHS was sponsoring multiple control  systems security initiatives, including efforts to (1) improve control  systems cybersecurity using vulnerability evaluation and response  tools and (2) build relationships with control systems vendors and  infrastructure asset owners. However, the department had not  established a strategy to coordinate the various control systems  activities across federal agencies and the private sector. Consequently, we recommended that DHS develop a strategy to  guide efforts for securing control systems and establish a rapid and  secure process for sharing sensitive control system vulnerability  information to improve federal government efforts to secure control  systems governing critical infrastructure. In summary, DHS has developed and implemented capabilities to  satisfy aspects of key cybersecurity responsibilities. Until these steps are taken, our nation’s  computer-reliant critical infrastructure remains at unnecessary risk  of significant cyber incidents. Appendix II: Key Attributes of Cyber Analysis and Warning Capabilities

Attribute    Establish a baseline understanding of network assets and normal network traffic volume and flow     Assess risks to network assets     Obtain internal information on network operations via technical tools and user reports    Obtain external information on threats, vulnerabilities, and incidents through various relationships,  alerts, and other sources     Detect anomalous activities    Verify that an anomaly is an incident (threat of attack or actual attack)    Investigate the incident to identify the type of cyber attack, estimate impact, and collect evidence    Identify possible actions to mitigate the impact of the incident    Integrate results into predictive analysis of broader implications or potential future attack    Develop attack and other notifications that are targeted and actionable     Provide notifications in a timely manner     Distribute notifications using appropriate communications methods    Contain and mitigate the incident     Recover from damages and remediate vulnerabilities     Evaluate actions and incorporate lessons learned  This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.
Why GAO Did This Study

Recent cyber attacks demonstrate the potentially devastating impact these pose to our nation's computer systems and to the federal operations and critical infrastructures that they support. They also highlight that we need to be vigilant against individuals and groups with malicious intent, such as criminals, terrorists, and nation-states perpetuating these attacks. Federal law and policy established the Department of Homeland Security (DHS) as the focal point for coordinating cybersecurity, including making it responsible for protecting systems that support critical infrastructures, a practice commonly referred to as cyber critical infrastructure protection. Since 2005, GAO has reported on the responsibilities and progress DHS has made in its cybersecurity efforts. GAO was asked to summarize its key reports and their associated recommendations aimed at securing our nation's cyber critical infrastructure. To do so, GAO relied on previous reports, as well as two reports being released today, and analyzed information about the status of recommendations.

What GAO Found

GAO has reported over the last several years that DHS has yet to fully satisfy its cybersecurity responsibilities. To address these shortfalls, GAO has made about 30 recommendations in the following key areas. Specifically, examples of what GAO reported and recommended are as follows: (1) Cyber analysis and warning--In July 2008, GAO reported that DHS's United States Computer Emergency Readiness Team (US-CERT) did not fully address 15 key cyber analysis and warning attributes. For example, US-CERT provided warnings by developing and distributing a wide array of notifications; however, these notifications were not consistently actionable or timely. Consequently, GAO recommended that DHS address these attribute shortfalls. (2) Cyber exercises--In September 2008, GAO reported that since conducting a cyber attack exercise in 2006, DHS demonstrated progress in addressing eight lessons it learned from this effort. However, its actions to address the lessons had not been fully implemented. GAO recommended that the department schedule and complete all identified corrective activities. (3) Control systems--In a September 2007 report and October 2007 testimony, GAO identified that DHS was sponsoring multiple efforts to improve control system cybersecurity using vulnerability evaluation and response tools. However, the department had not established a strategy to coordinate this and other efforts across federal agencies and the private sector, and it did not effectively share control system vulnerabilities with others. Accordingly, GAO recommended that DHS develop a strategy to guide efforts for securing such systems and establish a process for sharing vulnerability information. While DHS has developed and implemented capabilities to address aspects of these areas, it still has not fully satisfied any of them. Until these and other areas are effectively addressed, our nation's cyber critical infrastructure is at risk of increasing threats posed by terrorists, nation-states, and others.