	Background

As computer technology has advanced, federal agencies have  become dependent on computerized information systems to carry  out their operations and to process, maintain, and report essential  information. Conversely, ineffective information security controls can result in  significant risk to a broad array of government operations and  assets. Federal Systems and Infrastructures Face Increasing Cyber Threats

Cyber threats to federal information systems and cyber-based  critical infrastructures are evolving and growing. In September 2007,  we reported that these threats can be unintentional and intentional,  targeted or nontargeted, and can come from a variety of sources. A targeted attack is when a group or individual attacks a  specific system or cyber-based critical infrastructure. The Federal Bureau of Investigation has  identified multiple sources of threats to our nation’s critical  information systems, including foreign nations engaged in espionage  and information warfare, domestic criminals, hackers, virus writers,  and disgruntled employees and contractors working within an  organization. These groups and individuals have a variety of attack techniques at  their disposal. Furthermore, as we have previously reported, the  techniques have characteristics that can vastly enhance the reach  and impact of their actions, such as the following:  ●  Attackers do not need to be physically close to their targets to  perpetrate a cyber attack. ●  Technology allows actions to easily cross multiple state and national  borders. ●  Attackers can more easily remain anonymous. The growing connectivity between information systems, the  Internet, and other infrastructures creates opportunities for  attackers to disrupt telecommunications, electrical power, and other  critical services. Reported Security Incidents Are on the Rise

Consistent with the evolving and growing nature of the threats to  federal systems, agencies are reporting an increasing number of  security incidents. Similarly, our audits have identified control deficiencies in both  financial and nonfinancial systems, including vulnerabilities in  critical federal systems. To illustrate, weaknesses were reported in  such controls at 23 of 24 major agencies for fiscal year 2008. For  example, agencies did not consistently (1) identify and authenticate  users to prevent unauthorized access; (2) enforce the principle of  least privilege to ensure that authorized access was necessary and  appropriate; (3) establish sufficient boundary protection  mechanisms; (4) apply encryption to protect sensitive data on  networks and portable devices; and (5) log, audit, and monitor  security-relevant events. An underlying cause of information security weaknesses identified  at federal agencies is that they have not yet fully or effectively  implemented key elements for an agencywide information security  program. An agencywide security program, required by the Federal  Information Security Management Act (FISMA), is intended to  provide a framework and continuing cycle of activities, including  assessing and managing risk, developing and implementing security  policies and procedures, promoting security awareness and training,  monitoring the adequacy of the entity’s computer-related controls  through security tests and evaluations, and implementing remedial  actions as appropriate. Opportunities Exist for Enhancing Federal Cybersecurity

Over the past several years, we and inspectors general have made  hundreds of recommendations to agencies for actions necessary to  resolve prior significant control deficiencies and information  security program shortfalls. In addition, the White House, OMB, and certain federal agencies  have undertaken several governmentwide initiatives that are  intended to enhance information security at federal agencies. In preparation for that testimony,  we obtained the views of experts (by means of panel discussions)  on critical aspects of the strategy, including areas for improvement. Unintended incidents and attacks  from individuals and groups with malicious intent, such as  criminals, terrorists, and adversarial foreign nations, have the  potential to cause significant damage to the ability of agencies to  effectively perform their missions, deliver services to constituents,  and account for their resources. To help in meeting these threats,  opportunities exist to improve information security throughout the  federal government. In  addition, the prompt and effective implementation of the hundreds  of recommendations by us and by agency inspectors general to  mitigate information security control deficiencies and fully  implement agencywide security programs would also strengthen the  protection of federal information systems, as would efforts by DHS  to develop better capabilities to meets its responsibilities, and the  implementation of recommended improvements to the national  cybersecurity strategy. Information Security: Cyber Threats and Vulnerabilities Place Federal  Systems at Risk. Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise.
Why GAO Did This Study

Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the federal government. In recent months, federal officials have cited the continued efforts of foreign nations and criminals to target government and private sector networks; terrorist groups have expressed a desire to use cyber attacks to target the United States; and press accounts have reported attacks on the Web sites of government agencies. The ever-increasing dependence of federal agencies on computerized systems to carry out essential, everyday operations can make them vulnerable to an array of cyber-based risks. Thus it is increasingly important for the federal government to have effective information security controls in place to safeguard its systems and the information they contain. GAO was asked to provide a statement describing (1) cyber threats to federal information systems and cyber-based critical infrastructures, (2) control deficiencies at federal agencies that make these systems and infrastructures vulnerable to cyber threats, and (3) opportunities that exist for improving federal cybersecurity. In preparing this statement, GAO relied on its previously published work in this area.

What GAO Found

Cyber-based threats to federal systems and critical infrastructure are evolving and growing. These threats can be unintentional or intentional, targeted or non-targeted, and can come from a variety of sources, including criminals, terrorists, and adversarial foreign nations, as well as hackers and disgruntled employees. These potential attackers have a variety of techniques at their disposal, which can vastly enhance the reach and impact of their actions. For example, cyber attackers do not need to be physically close to their targets, their attacks can easily cross state and national borders, and cyber attackers can more easily preserve their anonymity. Further, the growing interconnectivity between information systems, the Internet, and other infrastructure presents increasing opportunities for such attacks. In addition, reports of security incidents from federal agencies are on the rise, increasing by over 200 percent from fiscal year 2006 to fiscal year 2008. Compounding the growing number and kinds of threats, GAO--along with agencies and their inspectors general--has identified significant weaknesses in the security controls on federal information systems, resulting in pervasive vulnerabilities. These include deficiencies in the security of financial systems and information and vulnerabilities in other critical federal information systems. GAO has identified weaknesses in all major categories of information security controls at federal agencies. For example, in fiscal year 2008, weaknesses were reported in such controls at 23 of 24 major agencies. Specifically, agencies did not consistently authenticate users to prevent unauthorized access to systems; apply encryption to protect sensitive data; and log, audit, and monitor security-relevant events, among other actions. An underlying cause of these weaknesses is agencies' failure to fully or effectively implement information security programs, which entails assessing and managing risk, developing and implementing security policies and procedures, promoting security awareness and training, monitoring the adequacy of security controls, and implementing appropriate remedial actions. Multiple opportunities exist to enhance cybersecurity. In light of weaknesses in agencies' information security controls, GAO and inspectors general have made hundreds of recommendations to improve security, many of which agencies are implementing. In addition, the White House and the Office of Management and Budget, collaborating with other agencies, have launched several initiatives aimed at improving aspects of federal cybersecurity. The Department of Homeland Security, which plays a key role in coordinating cybersecurity activities, also needs to fulfill its responsibilities, such as developing capabilities for protecting cyber-reliant critical infrastructures and implementing lessons learned from a major cyber simulation exercise. Finally, a panel of experts convened by GAO made several recommendations for improving the nation's cybersecurity strategy. Realizing these opportunities for improvement can help ensure that the federal government's systems, information, and critical cyber-reliant infrastructure are effectively protected.