In addition, cyber threats to systems supporting the federal government  are evolving and becoming more sophisticated. This year marks the 20th anniversary of when GAO first  designated information security as a government-wide high-risk area in  1997. We expanded this high-risk area to include safeguarding the  systems supporting our nation’s critical infrastructure in 2003 and  protecting the privacy of personally identifiable information in 2015. Specifically,  with certain exceptions, DHS is to administer the implementation of  agency information security policies and practices for information systems  including: monitoring agency implementation of information security policies and providing operational and technical guidance to agencies; operating a central federal information security incident center; and deploying technology upon request to assist the agency to  continuously diagnose and mitigate cyber threats and vulnerabilities. In addition, the Cybersecurity Act of 2015 requires DHS to deploy,  operate, and maintain for use by any federal agency, a capability to (1)  detect cybersecurity risks in network traffic transiting to or from agency  information systems and (2) prevent network traffic with such risks from  traveling to or from an agency information system or modify the traffic to  remove the cybersecurity risk. NCPS Capabilities and Adoption Could Be Improved

Operated by DHS’s United States Computer Emergency Readiness  Team (US-CERT), NCPS is intended to detect and prevent cyber  intrusions into agency networks, analyze network data for trends and  anomalous data, and share information with agencies on cyber threats  and incidents. In addition, NCPS did not monitor several types of network  traffic and therefore would not have detected malicious traffic  embedded in such traffic. NCPS also did not examine traffic for  certain common vulnerabilities and exposures that cyber threat  adversaries could have attempted to exploit during intrusion attempts. To enhance the functionality of NCPS, we made six recommendations to  DHS, which if implemented, could help the agency to expand the  capability of NCPS to detect cyber intrusions, notify customers of  potential incidents, and track the quality, efficiency, and accuracy of  supporting actions related to detecting and preventing intrusions,  providing analytic services, and sharing cyber-related information. DHS  concurred with the recommendations. In January 2016, we also reported that federal agencies had adopted  NCPS to varying degrees. Effective Implementation of the CDM Program Could Improve Information Security at Agencies

The CDM program provides federal agencies with tools and services that  are intended to provide them with the capability to automate network  monitoring, correlate and analyze security-related information, and  enhance risk-based decision making at agency and government-wide  levels. As we reported in May 2016, most of the 18 agencies covered by the  CFO Act that had high-impact systems were in the early stages of CDM  implementation. Additionally, according to survey responses, 14 of  the 17 had deployed products to automate hardware and software asset  configuration settings and common vulnerability management. However, only 2 of the 17 agencies reported that they  had completed installation of agency and bureau/component-level  dashboards and monitored attributes of authorized users operating in  their agency’s computing environment. Agencies also noted that  expediting the implementation of CDM phases could be of benefit to them  in further protecting their high-impact systems. By continuing to make these tools  and capabilities available to federal agencies, DHS can also have  additional assurance that agencies are better positioned to protect their  information systems and information. In May 2016, we reported that although participation varied among the 18  agencies we surveyed, most of those that chose to participate generally  found these services to be useful in aiding the cybersecurity protection of  their high-impact systems. All 18 agencies participated in the CyberStat reviews, and most found  the service very or somewhat useful. We believe that by continuing to make these services  available to agencies, DHS will be better able to assist agencies in  strengthening the security of their information systems. Enhancing NCPS’s capabilities and  greater adoption by agencies will help DHS achieve the full benefit of the  system.
Why GAO Did This Study

Cyber-based intrusions and attacks on federal systems are evolving and becoming more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.
DHS plays a key role in strengthening the cybersecurity posture of the federal government. Among other things, DHS has initiatives for (1) detecting and preventing malicious cyber intrusions into agencies' networks and (2) deploying technology to assist agencies to continuously diagnose and mitigate cyber threats and vulnerabilities.
This statement provides an overview of GAO's work related to DHS's efforts to improve the cybersecurity posture of the federal government. In preparing this statement, GAO relied on previously published work, as well as information provided by DHS on its actions in response to GAO's previous recommendations.

What GAO Found

The Department of Homeland Security (DHS) is spearheading multiple efforts to improve the cybersecurity posture of the federal government. Among these, the National Cybersecurity Protection System (NCPS) provides a capability to detect and prevent potentially malicious network traffic from entering agencies' networks. In addition, DHS's continuous diagnostics and mitigation (CDM) program provides tools to agencies to identify and resolve cyber vulnerabilities on an ongoing basis.
In January 2016, GAO reported that NCPS was limited in its capabilities to detect or prevent cyber intrusions, analyze network data for trends, and share information with agencies on cyber threats and incidents. For example, it did not monitor or evaluate certain types of network traffic and therefore would not have detected malicious traffic embedded in such traffic. NCPS also did not examine traffic for certain common vulnerabilities and exposures that cyber threat adversaries could have attempted to exploit during intrusion attempts. In addition, at the time of the review, federal agencies had adopted NCPS to varying degrees. GAO noted that expanding NCPS's capabilities, such as those for detecting and preventing malicious traffic and developing network routing guidance, could increase assurance of the system's effectiveness in detecting and preventing computer intrusions and support wider adoption by agencies. By taking these steps, DHS would be better positioned to achieve the full benefits of NCPS.
The tools and services delivered through DHS's CDM program are intended to provide agencies with the capability to automate network monitoring, correlate and analyze security-related information, and enhance risk-based decision making at agency and government-wide levels. In May 2016, GAO reported that most of the 17 civilian agencies covered by the Chief Financial Officers Act that also reported having high-impact systems were in the early stages of CDM implementation. For example, 14 of the 17 agencies reported that they had deployed products to automate hardware and software asset inventories, configuration settings, and common vulnerability management but only 2 had completed installation of agency and bureau/component-level dashboards. Some of the agencies noted that expediting CDM implementation could be of benefit to them in further protecting their high-impact systems. GAO concluded that the effective implementation of the CDM program can assist agencies in resolving cybersecurity vulnerabilities that expose their information systems and information to evolving and pernicious threats. By continuing to make available CDM tools and capabilities to agencies, DHS can have additional assurance that agencies are better positioned to protect their information system and information.
In addition, DHS offered other services such as monthly operational bulletins, CyberStat reviews, and cyber exercises to help protect federal systems. In May 2016, GAO reported that although participation varied among the agencies surveyed, most agencies had found that the services were very or somewhat useful. By continuing to make these services available to agencies, DHS is better able to assist agencies in strengthening the security of their information systems.

What GAO Recommends

In a January 2016 report, GAO made nine recommendations related to expanding NCPS's capability to detect cyber intrusions; notifying customers of potential incidents; providing analytic services; and sharing cyber-related information, among other things. DHS concurred with the recommendations and is taking actions to implement them.