	Background

The United States has approximately 360 commercial sea and river ports  that handle more than $1.3 trillion in cargo annually. Moreover, entities within the maritime port environment are vulnerable to  cyber-based threats because they rely on various types of information  and communications technologies to manage the movement of cargo  throughout the ports. All of these systems are potentially vulnerable to cyber-based attacks and  other threats, which could disrupt operations at a port. It  details the roles and responsibilities of DHS in protecting the nation’s  critical infrastructures; identifies agencies that have lead responsibility for  coordinating with federally designated critical infrastructure sectors  (maritime is a component of one of these sectors—the transportation  sector); and specifies how other federal, state, regional, local, tribal,  territorial, and private-sector stakeholders should use risk management  principles to prioritize protection activities within and across sectors. These coordination activities are carried out through sector  coordinating councils and government coordinating councils. MTSA also codified the Port Security Grant Program, which is to help  defray the costs of implementing security measures at domestic ports. The Nation and Its Ports Face an Evolving Array of Cyber-Based Threats

Like threats affecting other critical infrastructures, threats to the maritime  IT infrastructure are evolving and growing and can come from a wide  array of sources. For example, according to Europol’s European Cybercrime Center, a  cyber incident was reported in 2013 (and corroborated by the FBI) in  which malicious software was installed on a computer at a foreign port. DHS and Other Stakeholders Have Taken Limited Actions to Address Maritime Port Cybersecurity

In June 2014 we reported that DHS and the other stakeholders had taken  limited steps with respect to maritime cybersecurity. In particular, risk  assessments for the maritime mode did not address cyber-related risks;  maritime-related security plans contained limited consideration of  cybersecurity; information-sharing mechanisms shared cybersecurity  information to varying degrees; and the guidance for the Port Security  Grant Program did not take certain steps to ensure that cyber risks were  addressed. Maritime Risk Assessment Did Not Address Cybersecurity

In its 2012 National Maritime Strategic Risk assessment, which was the  most recent available at the time of our 2014 review, the Coast Guard did  not address cyber-related risks to the maritime mode. As called for by the  NIPP, the Coast Guard completes this assessment on a biennial basis,  and it is to provide a description of the types of threats the Coast Guard  expects to encounter within its areas of responsibility, such as ensuring  the security of port facilities, over the next 5 to 8 years. However, we found that while the 2012 assessment contained information  regarding threats, vulnerabilities, and the mitigation of potential risks in  the maritime environment, none of the information addressed cyber- related risks or provided a thorough assessment of cyber-related threats,  vulnerabilities, and potential consequences. We therefore recommended that DHS direct the Coast Guard to ensure  that the next iteration of the maritime risk assessment include cyber- related threats, vulnerabilities, and potential consequences. However, the assessment does not identify  vulnerabilities of cyber-related assets. Coast Guard officials and other stakeholders stated that the area and  facility-level security plans did not adequately address cybersecurity  because the guidance for developing the plans did not require a cyber  component. While DHS concurred with this recommendation, as noted  above, the revised maritime risk assessment does not address  vulnerabilities of systems supporting maritime port operations, and thus is  limited as a tool for informing maritime cybersecurity planning. Further, it  is unclear to what extent the updated port area and facility plans include  cyber risks because the Coast Guard has not yet provided us with  updated plans. In our June 2014 report, we noted that in the absence of a sector  coordinating council, the maritime mode lacked a body to facilitate  national-level information sharing and coordination of security-related  information. Port Security Grant Program Did Not Take Key Steps to Effectively Address Cyber Risks

In 2013 and 2014 FEMA identified enhancing cybersecurity capabilities  as a funding priority for its Port Security Grant Program and provided  guidance to grant applicants regarding the types of cybersecurity-related  proposals eligible for funding. However, in our June 2014 report we noted  that the agency’s national review panel had not consulted with  cybersecurity-related subject matter experts to inform its review of cyber- related grant proposals. Accordingly, we recommended that DHS direct FEMA to (1) develop  procedures for grant proposal reviewers, at both the national and field  level, to consult with cybersecurity subject matter experts from the Coast  Guard when making funding decisions and (2) use information on cyber- related threats, vulnerabilities, and consequences identified in the revised  maritime risk assessment to inform funding guidance for grant applicants  and reviewers. As a result, we continue to be concerned that port security  grants may not be allocated to projects that will best contribute to the  cybersecurity of the maritime environment. Until DHS fully implements our recommendations, the nation’s  maritime ports will remain susceptible to cyber risks.
Why GAO Did This Study

The nation's maritime ports handle more than $1.3 trillion in cargo each year: a disruption at one of these ports could have a significant economic impact. Increasingly, port operations rely on computerized information and communications technologies, which can be vulnerable to cyber-based attacks. Federal entities, including DHS's Coast Guard and FEMA, have responsibilities for protecting ports against cyber-related threats. GAO has designated the protection of federal information systems as a government-wide high-risk area since 1997, and in 2003 expanded this to include systems supporting the nation's critical infrastructure.
This statement addresses (1) cyber-related threats facing the maritime port environment and (2) steps DHS has taken to address cybersecurity in that environment. In preparing this statement, GAO relied on work supporting its June 2014 report on cybersecurity at ports. (GAO-14-459)

What GAO Found

Similar to other critical infrastructures, the nation's ports face an evolving array of cyber-based threats. These can come from insiders, criminals, terrorists, or other hostile sources and may employ a variety of techniques or exploits, such as denial-of-service attacks and malicious software. By exploiting vulnerabilities in information and communications technologies supporting port operations, cyber-attacks can potentially disrupt the flow of commerce, endanger public safety, and facilitate the theft of valuable cargo.
In its June 2014 report, GAO determined that the Department of Homeland Security (DHS) and other stakeholders had taken limited steps to address cybersecurity in the maritime environment. Specifically:
DHS's Coast Guard had not included cyber-related risks in its biennial assessment of risks to the maritime environment, as called for by federal policy. Specifically, the inputs into the 2012 risk assessment did not include cyber-related threats and vulnerabilities. Officials stated that they planned to address this gap in the 2014 revision of the assessment. However, when GAO recently reviewed the updated risk assessment, it noted that the assessments did not identify vulnerabilities of cyber-related assets, although it identified some cyber threats and their potential impacts.
The Coast Guard also did not address cyber-related risks in its guidance for developing port area and port facility security plans. As a result, port and facility security plans that GAO reviewed generally did not include cyber threats or vulnerabilities. While Coast Guard officials noted that they planned to update the security plan guidance to include cyber-related elements, without a comprehensive risk assessment for the maritime environment, the plans may not address all relevant cyber-threats and vulnerabilities.
The Coast Guard had helped to establish information-sharing mechanisms called for by federal policy, including a sector coordinating council, made up of private-sector stakeholders, and a government coordinating council, with representation from relevant federal agencies. However, these bodies shared cybersecurity-related information to a limited extent, and the sector coordinating council was disbanded in 2011. Thus, maritime stakeholders lacked a national-level forum for information sharing and coordination.
DHS's Federal Emergency Management Agency (FEMA) identified enhancing cybersecurity capabilities as a priority for its port security grant program, which is to defray the costs of implementing security measures. However, FEMA's grant review process was not informed by Coast Guard cybersecurity subject matter expertise or a comprehensive assessment of cyber-related risks for the port environment. Consequently, there was an increased risk that grants were not allocated to projects that would most effectively enhance security at the nation's ports.
GAO concluded that until DHS and other stakeholders take additional steps to address cybersecurity in the maritime environment—particularly by conducting a comprehensive risk assessment that includes cyber threats, vulnerabilities, and potential impacts—their efforts to help secure the maritime environment may be hindered. This in turn could increase the risk of a cyber-based disruption with potentially serious consequences.

What GAO Recommends

In its June 2014 report on port cybersecurity, GAO recommended that the Coast Guard include cyber-risks in its updated risk assessment for the maritime environment, address cyber-risks in its guidance for port security plans, and consider reestablishing the sector coordinating council. GAO also recommended that FEMA ensure funding decisions for its port security grant program are informed by subject matter expertise and a comprehensive risk assessment. DHS has partially addressed two of these recommendations since GAO's report was issued.