	Background

As computer technology has advanced, federal agencies and our nation’s  critical infrastructures—such as power distribution, water supply,  telecommunications, and emergency services—have become increasingly  dependent on computerized information systems to carry out their  operations and to process, maintain, and report essential information. Cyber-reliant Critical Infrastructure and Federal Systems Face Increasing Cyber Threats

Threats to systems supporting critical infrastructure and federal  information systems are evolving and growing. Government officials are  concerned about attacks from individuals and groups with malicious  intent, such as criminals, terrorists, and foreign nations. These groups  and individuals have a variety of attack techniques at their disposal that  can be used to determine vulnerabilities and gain entry into targeted  systems. The connectivity between information systems, the Internet, and other  infrastructures also creates opportunities for attackers to disrupt  telecommunications, electrical power, and other critical services. Reported Security Incidents Are on the Rise

Consistent with the evolving and growing nature of the threats to federal  systems, agencies are reporting an increasing number of security  incidents. Reports of cyber attacks and information security incidents against federal  systems and systems supporting critical infrastructure illustrate the effect  that such incidents could have on national and economic security. The Federal Government Has Taken Actions to Address Cyber Threats, but Challenges Remain in Protecting Critical Systems

The federal government has a variety of roles and responsibilities in  protecting the nation’s cyber-reliant critical infrastructure, enhancing the  nation’s overall cybersecurity posture, and ensuring the security of federal  systems and the information they contain. Despite these efforts, the federal government  continues to face significant challenges in protecting the nation’s cyber- reliant critical infrastructure and federal information systems. Key Actions to Improve Our Current National Approach to Cybersecurity Have Not Yet Been Fully Implemented

The administration and executive branch agencies have not yet fully  implemented key actions that are intended to address threats and improve  the current U.S. approach to cybersecurity. Implementing actions recommended by the president’s cybersecurity  policy review. In February 2009, the president initiated a review of the  government’s cybersecurity policies and structures, which resulted in 24  near- and mid-term recommendations to address organizational and policy  changes to improve the current U.S. approach to cybersecurity. Updating the national strategy for securing the information and  communications infrastructure. Developing a comprehensive national strategy for addressing global  cybersecurity and governance. Creating a prioritized national and federal cybersecurity research and  development (R&D) agenda. Strengthening the public-private partnerships for securing cyber critical  infrastructure. Federal Agencies Have Not Addressed Persistent Control Weaknesses or Implemented Effective Information Security Programs

Federal systems continue to be afflicted by persistent information security  control weaknesses. In addition, GAO determined that  serious and widespread information security control deficiencies were a  governmentwide material weakness in internal control over financial  reporting as part of its audit of the fiscal year 2010 financial statements for  the United States government. Over the past several years, we and inspectors general have made  hundreds of recommendations to agencies for actions necessary to resolve  prior significant control deficiencies and information security program  shortfalls. In addition, the White House, OMB, and selected federal agencies have  undertaken governmentwide initiatives to enhance information security at  federal agencies. However, the projects face  challenges in achieving their objectives related to securing federal  information, including better defining agency roles and responsibilities,  establishing measures of effectiveness, and establishing an appropriate  level of transparency. These challenges require sustained attention, which  agencies have begun to provide. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of our nation's critical infrastructure and the federal government. In recent testimony, the Director of National Intelligence stated that there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks. In addition, recent reports of cyber attacks and incidents affecting federal systems and critical infrastructures illustrate the potential impact of such events on national and economic security. The nation's ever-increasing dependence on information systems to carry out essential everyday operations makes it vulnerable to an array of cyber-based risks. Thus it is increasingly important that federal and nonfederal entities carry out concerted efforts to safeguard their systems and the information they contain. GAO is providing a statement describing (1) cyber threats to cyber-reliant critical infrastructures and federal information systems and (2) the continuing challenges facing federal agencies in protecting the nation's cyber-reliant critical infrastructure and federal systems. In preparing this statement, GAO relied on its previously published work in the area, which included many recommendations for improvements.

What GAO Found

Cyber-based threats to critical infrastructure and federal systems are evolving and growing. These threats can come from a variety of sources, including criminals and foreign nations, as well as hackers and disgruntled employees. These potential attackers have a variety of techniques at their disposal that can vastly expand the reach and impact of their actions. In addition, the interconnectivity between information systems, the Internet, and other infrastructure presents increasing opportunities for such attacks. Consistent with this, reports of security incidents from federal agencies are on the rise, increasing over 650 percent over the past 5 years. In addition, reports of cyber attacks and information security incidents affecting federal systems and systems supporting critical infrastructure illustrate the serious impact such incidents can have on national and economic security, including the loss of classified information and intellectual property worth millions of dollars. The administration and executive branch agencies continue to act to better protect cyber-reliant critical infrastructures, improve the security of federal systems, and strengthen the nation's cybersecurity posture. However, they have not yet fully implemented key actions that are intended to address threats and improve the current U.S. approach to cybersecurity, such as (1) implementing near- and mid-term actions recommended by the cybersecurity policy review directed by the president; (2) updating the national strategy for securing the information and communications infrastructure; (3) developing a comprehensive national strategy for addressing global cybersecurity and governance; and (4) creating a prioritized national and federal research and development agenda for improving cybersecurity. Federal systems continue to be afflicted by persistent information security control weaknesses. For example, as part of its audit of the fiscal year 2010 financial statements for the U.S. government, GAO determined that serious and widespread information security control deficiencies were a governmentwide material weakness. Over the past several years, GAO and agency inspectors general have made hundreds of recommendations to agencies for actions necessary to resolve prior significant control deficiencies and information security program shortfalls. The White House, the Office of Management and Budget, and selected federal agencies have undertaken additional governmentwide initiatives intended to enhance information security at federal agencies. However, these initiatives face challenges, such as better defining agency roles and responsibilities and establishing measures of effectiveness, and require sustained attention, which agencies have begun to provide. As such, GAO continues to identify protecting the federal government's information systems and the nation's cyber critical infrastructure as a governmentwide high-risk area.