Ineffective protection of these information systems and networks can  impair delivery of vital services, and result in  loss or theft of computer resources, assets, and funds;  inappropriate access to and disclosure, modification, or destruction of  sensitive information, such as personally identifiable information; disruption of essential operations supporting critical infrastructure,  national defense, or emergency services; undermining of agency missions due to embarrassing incidents that  erode the public’s confidence in government; use of computer resources for unauthorized purposes or to launch  attacks on other systems; damage to networks and equipment; and high costs for remediation. To support these activities, the department relies on a variety of  information technology (IT) systems and infrastructure. Cyber Threats to Federal Systems Continue to Evolve amid Increasing Numbers of Incidents

Risks to cyber-based assets can originate from unintentional or  intentional threats. Unintentional threats can be caused by, among other  things, natural disasters, defective computer or network equipment,  software coding errors, and the actions of careless or poorly trained  employees. As we reported in February 2015, since fiscal year 2006, the number of  information security incidents reported to the U.S. Computer Emergency  Readiness Team (US-CERT) affecting systems supporting the federal  government has steadily increased each year. Figure 2 shows the different types of incidents reported by Education in  fiscal year 2014. Similar to Other Agencies, Information Security Weaknesses Place Education’s Systems and Sensitive Data at Risk

Given the risks posed by cyber threats and the increasing number of  incidents, it is crucial that federal agencies, such as Education, take  appropriate steps to secure their systems and information. As we reported in September 2015, for fiscal year 2014 most of the 24  agencies covered by the Chief Financial Officers Act, including  Education, had weaknesses in most of the five major categories of  information system controls. These control categories are: (1) access  controls, which limit or detect access to computer resources (data,  programs, equipment, and facilities), thereby protecting them against  unauthorized modification, loss, and disclosure; (2) configuration  management controls, intended to prevent unauthorized changes to  information system resources (for example, software programs and  hardware configurations) and assure that software is current and known  vulnerabilities are patched; (3) segregation of duties, which prevents a  single individual from controlling all critical stages of a process by splitting  responsibilities between two or more organizational groups; (4)  contingency planning, which helps avoid significant disruptions in  computer-dependent operations; and (5) agency-wide security  management, which provides a framework for ensuring that risks are  understood and that effective controls are selected, implemented, and  operating as intended. Security management: For fiscal year 2014, 23 agencies, including  Education, had weaknesses reported in security management, which  is an underlying cause for information security control deficiencies  identified at federal agencies. Specifically, for fiscal year 2014, 19 agencies—including  Education—reported that information security control deficiencies were  either a material weakness or a significant deficiency in internal controls  over their financial reporting. Further, 23 of 24  inspectors general for the agencies, including Education, cited information  security as a “major management challenge” for their agency. Over the last several years, we and agency inspectors general have  made thousands of recommendations to agencies aimed at improving  their implementation of information security controls. For example, we  have made about 2,000 recommendations over the last 6 years. Agency  inspectors general have also made a multitude of recommendations to  assist their agencies. Many agencies continue to have weaknesses in  implementing these controls in part because many of these  recommendations remain unimplemented. Until federal agencies take actions to  implement the recommendations made by us and the inspectors  general—federal systems and information, as well as sensitive personal  information about the public, will be at an increased risk of compromise  from cyber-based attacks and other threats. While federal  agencies, including the Department of Education, have established  information security programs, weaknesses in these programs persist,  and more needs to be done to fully implement them and to address  existing weaknesses. Federal Information Security: Agencies Need to Correct Weaknesses and  Fully Implement Security Programs, GAO-15-714. Cybersecurity: Actions Needed to Address Challenges Facing Federal  Systems. Information Security: Federal Agencies Need to Enhance Responses to  Data Breaches.
Why GAO Did This Study

The federal government faces an evolving array of cyber-based threats to its systems and data, and data breaches at federal agencies have compromised sensitive personal information, affecting millions of people. Education, in carrying out its mission of serving America's students, relies extensively on IT systems that collect and process a large amount of sensitive information. Accordingly, it is important for federal agencies such as Education to implement information security programs that can help protect systems and networks. GAO has identified federal information security as a government-wide high-risk area since 1997, and in February 2015 expanded this to include protecting the privacy of personally identifiable information.
This statement provides information on cyber threats facing federal systems and information security weaknesses identified at federal agencies, including Education. In preparing this statement, GAO relied on previously published work and updated data on security incidents and federal cybersecurity efforts.

What GAO Found

Cyber-based risks to federal systems and information can come from unintentional threats, such as natural disasters, software coding errors, and poorly trained or careless employees, or intentional threats, such as disgruntled insiders, hackers, or hostile nations. These threat sources may exploit vulnerabilities in agencies' systems and networks to steal or disclose sensitive information, among other things. Since fiscal year 2006, the number of reported information security incidents affecting federal systems has steadily increased, rising from about 5,500 in fiscal year 2006 to almost 67,200 in fiscal year 2014. At the Department of Education, the number of incidents reported since 2009 has fluctuated, but generally increased.
GAO reported in September 2015, that most of 24 major agencies (including Education) had weaknesses in at least three of five major categories of information security controls for fiscal year 2014. These are controls intended to (1) limit unauthorized access to agency systems and information; (2) ensure that software and hardware are authorized, updated, monitored, and securely configured; (3) appropriately divide duties so that no single person can control all aspects of a computer-related operation; (4) establish plans for continuing information system operations in the event of a disaster, and (5) provide a security management framework for understanding risks and ensuring that controls are selected, implemented, and operating as intended. The figure below shows the number of agencies with weaknesses in these control categories.
In addition, 19 agencies—including Education—reported that information security control deficiencies were either a material weakness or a significant deficiency for fiscal year 2014. Further, inspectors general for 23 of 24 agencies, including Education, cited information security as a major management challenge. In prior reports, GAO and inspectors general have made thousands of recommendations to agencies to address deficiencies in their information security controls and weaknesses in their programs, but many of these recommendations remain open. Until agencies implement these recommendations, sensitive information will remain at risk of unauthorized disclosure, modification, or destruction.

What GAO Recommends

Over the past 6 years, GAO has made about 2,000 recommendations to federal agencies to correct weaknesses and fully implement agency-wide information security programs. Agencies have implemented about 58 percent of these recommendations. Agency inspectors general have also made a multitude of recommendations to assist their agencies.