Recent terrorist attacks  and threats have underscored the need to protect our nation’s critical  infrastructures. Control Systems Are Used in Many Critical Infrastructures

Control systems are computer-based systems that are used within many  infrastructures and industries to monitor and control sensitive processes  and physical functions. Critical Infrastructure Control Systems Face Increasing Risks Due to Cyber Threats, Vulnerabilities, and the Potentially Serious Impact of an Attack

Critical infrastructure control systems face increasing risks due to cyber  threats, system vulnerabilities, and the potentially serious impact of an  attack as demonstrated by reported incidents. Further, based on past events, the impact of a control systems  incident on a critical infrastructure could be substantial. Critical Infrastructures Face Multiple Cyber Threats

Cyber threats can be unintentional and intentional, targeted or  nontargeted, and can come from a variety of sources. In August 2003, the Sobig computer virus  was blamed for shutting down train signaling systems throughout the East  Coast of the United States. In October 2006, a foreign  hacker penetrated security at a water filtering plant. The intruder planted  malicious software that was capable of affecting the plant’s water  treatment operations. Technical Challenges Hinder Use of Traditional Information Security Measures for Control Systems

According to industry experts, existing information security technologies  and practices—such as strong user authentication and patch  management—are generally not implemented in control systems due to  several technical issues, including limited computational processing  capabilities, the need for real-time operation, and the lack of consideration  of cybersecurity in the original design of the system. Organizational Issues Pose Challenges to Securing Control Systems

In addition to the technical challenges of securing control systems, critical  infrastructure owners face organizational challenges in securing control  systems, including difficulty in developing a compelling business case for  improving control systems security, a reluctance to share information on  control system incidents (which could help build a business case), and the  division of technical responsibilities within an organization. The Private Sector Has Multiple Initiatives Under Way to Help Secure Control Systems

Industry-specific organizations in various sectors, including the electricity,  chemical, oil and gas, and water sectors, have initiatives under way to help  improve control system security. These initiatives include developing  standards, publishing guidance, and hosting workshops. Federal Agencies Have Multiple Initiatives to Help Secure Critical Infrastructure Control Systems, but More Remains to Be Done

Over the past few years, federal agencies—including DHS, DOE, NIST,  FERC, and others—have initiated efforts to improve the security of critical  infrastructure control systems. Further, more can be done to address  specific weaknesses in DHS’s ability to share information on control  systems vulnerabilities. Until DHS develops an overarching strategy, there  is an increased risk that the federal government and private sector will  invest in duplicative initiatives and miss opportunities to learn from other  organization’s activities. However, the federal government lacks an overall strategy for  coordinating public and private sector efforts. Recommendations for Executive Action

To improve federal government efforts to secure control systems  governing critical infrastructure, we recommend that the Secretary of the  Department of Homeland Security implement the following two actions:    develop a strategy to guide efforts for securing control systems,  including agencies’ responsibilities, as well as overall goals, milestones,  and performance measures, and    establish a rapid and secure process for sharing sensitive control  system vulnerability information with critical infrastructure control  system stakeholders, including vendors, owners, and operators. GAO staff who made major contributions to  this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine cyber threats, vulnerabilities, and the  potential impact of attacks on critical infrastructure control systems;  (2) determine the challenges to securing critical infrastructure control  systems; (3) identify private sector initiatives to strengthen the  cybersecurity of control systems; and (4) assess the adequacy of public  sector initiatives to strengthen the cybersecurity of control systems. We also met with representatives  from trade associations and federal agencies.
Why GAO Did This Study

Control systems--computer-based systems that monitor and control sensitive processes and physical functions--perform vital functions in many of our nation's critical infrastructures, including electric power, oil and gas, water treatment, and chemical production. The disruption of control systems could have a significant impact on public health and safety, which makes securing them a national priority. GAO was asked to (1) determine cyber threats, vulnerabilities, and the potential impact of attacks on critical infrastructure control systems; (2) determine the challenges to securing these systems; (3) identify private sector initiatives to strengthen the cybersecurity of control systems; and (4) assess the adequacy of public sector initiatives to strengthen the cybersecurity of control systems. To address these objectives, we met with federal and private sector officials to identify risks, initiatives, and challenges. We also compared agency plans to best practices for securing critical infrastructures.

What GAO Found

Critical infrastructure control systems face increasing risks due to cyber threats, system vulnerabilities, and the serious potential impact of attacks as demonstrated by reported incidents. Threats can be intentional or unintentional, targeted or nontargeted, and can come from a variety of sources. Control systems are more vulnerable to cyber attacks than in the past for several reasons, including their increased connectivity to other systems and the Internet. Further, as demonstrated by past attacks and incidents involving control systems, the impact on a critical infrastructure could be substantial. For example, in 2003, a computer virus was blamed for shutting down train signaling systems throughout the East Coast and in 2006, a foreign hacker was reported to have planted malicious software capable of affecting a water filtering plant's treatment operations. Critical infrastructure owners face both technical and organizational challenges to securing control systems. Technical challenges--including control systems' limited processing capabilities, real-time operations, and design constraints--hinder an infrastructure owner's ability to implement traditional information technology security processes, such as strong user authentication and patch management. Organizational challenges include difficulty in developing a compelling business case for investing in control systems security and differing priorities of information security personnel and control systems engineers. Multiple private sector entities such as trade associations and standards setting organizations are working to help secure control systems. Their efforts include developing standards, providing guidance to members, and hosting workshops on control systems security. For example, the electricity industry has recently developed standards for cybersecurity of control systems and a gas trade association is developing guidance for members to use encryption to secure control systems. Federal agencies also have multiple initiatives under way to help secure critical infrastructure control systems, but more remains to be done to coordinate these efforts and to address specific shortfalls. Over the past few years, federal agencies--including the Department of Homeland Security, the Department of Energy, and the Federal Energy Regulatory Commission (FERC)--have initiated efforts to improve the security of critical infrastructure control systems. However, there is as yet no overall strategy to coordinate the various activities across federal agencies and the private sector. Further, DHS lacks processes needed to address specific weaknesses in sharing information on control system vulnerabilities. Until public and private sector security efforts are coordinated by an overarching strategy and specific information sharing shortfalls are addressed, there is an increased risk that multiple organizations will conduct duplicative work and miss opportunities to fulfill their critical missions.