Critical Protocols Supporting the Internet

The nation’s communications infrastructure also provides the networks  that support the Internet. Agencies Have Taken Action to Address Security of Communications Networks

While the private sector owns and operates the nation’s communications  networks and is primarily responsible for protecting these assets, federal  law and policy establish regulatory and support roles for the federal  government in regard to the communications networks. As part of their efforts in support of the security of communications  networks, FCC, DHS, DOD, and Commerce have taken a variety of  actions, including ones related to developing cyber policy and standards,  securing Internet infrastructure, sharing information, supporting national  security and emergency preparedness (NS/EP), and promoting sector  protection efforts. To fulfill DHS’s cyber-critical infrastructure protection and NS/EP-related  missions, the Office of Cybersecurity and Communications within the  National Protection and Programs Directorate is responsible for, among other things, ensuring the security, resiliency, and reliability of the nation’s  cyber and communications infrastructure, implementing a cyber-risk  management program for protection of critical infrastructure, and planning  for and providing national security and emergency preparedness  communications to the federal government. However, DHS and its partners have not yet developed outcome-based  metrics related to the cyber-protection activities for the core and access  networks, DNS functionality, and Internet routing services. Though Reporting Mechanisms Are in Place, FCC and DHS Have Not Received Reports of Cyber- Related Incidents Affecting the Nation’s Core and Access Networks

No cyber incidents affecting the core and access networks have been  reported by communications networks owners and operators through  three established reporting mechanisms from January 2010 to October  2012. To report incidents involving the core and access communications  networks to the federal government, communication networks operators  can use reporting mechanisms established by FCC and DHS to share  information on outages and incidents:
FCC’s Network Outage Reporting System is a web-based filing  system that communications providers use to submit detailed outage  reports to FCC. Officials within FCC and the private sector attributed the lack of incidents  to the fact that the communications networks provide the medium for  direct attacks on consumer, business, and government systems—and  thus these networks are less likely to be targeted by a cyber attack  themselves. Attributes of Defense Industry Cybersecurity Pilot Programs Could Be Applied to the Communications Sector

DOD, in its role as the sector-specific agency for the defense industrial  base critical infrastructure sector, established two pilot programs to  enhance the cybersecurity of sector companies and better protect  unclassified department data residing on those company networks. The pilot programs undertaken by DOD with its defense industrial base  partners exhibit several attributes that could apply to the communications  sector and help private sector entities more effectively secure the  communications infrastructure they own and operate. As DHS develops  procedures for expanding this program, considering these attributes could  inform DHS’s efforts. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify the roles of and actions taken by key  federal entities to help protect the communications networks from cyber- based threats, (2) assess what is known about the extent to which cyber- incidents affecting the communications networks have been reported to  the Federal Communications Commission (FCC) and Department of  Homeland Security (DHS), and (3) determine if the Department of  Defense’s (DOD) pilot programs to promote cybersecurity in the defense  industrial base can be used in the communications sector.
Why GAO Did This Study

Ensuring the effectiveness and reliability of communications networks is essential to national security, the economy, and public health and safety. The communications networks (including core and access networks) can be threatened by both natural and human-caused events, including increasingly sophisticated and prevalent cyber-based threats. GAO has identified the protection of systems supporting the nation's critical infrastructure--which includes the communications sector--as a government-wide high-risk area.
GAO was asked to (1) identify the roles of and actions taken by key federal entities to help protect communications networks from cyber-based threats, (2) assess what is known about the extent to which cyber incidents affecting the communications networks have been reported to the FCC and DHS, and (3) determine if Defense's pilot programs to promote cybersecurity in the defense industrial base can be used in the communications sector. To do this, GAO focused on core and access networks that support communication services, as well as critical components supporting the Internet. GAO analyzed federal agency policies, plans, and other documents; interviewed officials; and reviewed relevant reports.

What GAO Found

While the primary responsibility for protecting the nation's communications networks belongs to private-sector owners and operators, federal agencies also play a role in support of their security, as well as that of critical components supporting the Internet. Specifically, private-sector entities are responsible for the operational security of the networks they own, but the Federal Communications Commission (FCC) and the Departments of Homeland Security (DHS), Defense, and Commerce have regulatory and support roles, as established in federal law and policy, and have taken a variety of related actions. For example, FCC has developed and maintained a system for reporting network outage information; DHS has multiple components focused on assessing risk and sharing threat information; Defense and DHS serve as co-chairs for a committee on national security and emergency preparedness for telecommunications functions; and Commerce has studied cyber risks facing the communications infrastructure and participates in standards development. However, DHS and its partners have not yet initiated the process for developing outcome-based performance measures related to the cyber protection of key parts of the communications infrastructure. Outcome-based metrics related to communications networks and critical components supporting the Internet would provide federal decision makers with additional insight into the effectiveness of sector protection efforts.
No cyber-related incidents affecting core and access networks have been recently reported to FCC and DHS through established mechanisms. Specifically, both FCC and DHS have established reporting mechanisms to share information on outages and incidents, but of the outages reported to FCC between January 2010 and October 2012, none were related to common cyber threats. Officials within FCC and the private sector stated that communication networks are less likely to be targeted themselves because they provide the access and the means by which attacks on consumer, business, and government systems can be facilitated.
Attributes of two pilot programs established by Defense to enhance the cybersecurity of firms in the defense industrial base (the industry associated with the production of defense capabilities) could be applied to the communications sector. The department's pilot programs involve partnering with firms to share information about cyber threats and responding accordingly. Considering these attributes can inform DHS as it develops procedures for expanding these pilot programs to all critical infrastructure sectors, including the communications sector.

What GAO Recommends

GAO recommends that DHS collaborate with its partners to develop outcome-oriented measures for the communications sector. DHS concurred with GAO's recommendation.