Of particular importance is the security of  information and systems supporting critical infrastructures—physical or  virtual systems and assets so vital to the nation that their incapacitation or  destruction would have a debilitating impact on national and economic  security and on public health and safety. Critical infrastructure control systems face increasing risks due to cyber  threats, system vulnerabilities, and the potential impact of attacks as  demonstrated by reported incidents. TVA Provides Power to the Southeastern United States

The TVA is a federal corporation and the nation’s largest public power  company. TVA Had Not Fully Implemented Appropriate Controls to Protect Control Systems from Unauthorized Access

TVA had not fully implemented appropriate security practices to secure  the networks on which its control systems rely. Specifically, the  interconnected corporate and control systems networks at certain  facilities that we reviewed did not have sufficient information security  safeguards in place to adequately protect control systems. As a result TVA, control systems were  at increased risk of unauthorized modification or disruption by both  internal and external threats. Weaknesses in TVA’s Corporate Network Controls Placed Network Devices at Risk

Multiple weaknesses within the TVA corporate network left it vulnerable  to potential compromise of the confidentiality, integrity, and availability of  network devices and the information transmitted by the network. For  example:    Almost all of the workstations and servers that we examined on the  corporate network lacked key security patches or had inadequate security  settings. Weaknesses in TVA Control Systems Networks Jeopardized the Security of its Control Systems

The access controls implemented by TVA did not adequately secure its  control systems networks and devices, leaving the control systems  vulnerable to disruption by unauthorized individuals. For example:    Live network jacks connected to TVA’s internal network at certain  facilities we reviewed had not been adequately secured from unauthorized  access. Information Security Management Program Was Not Consistently Implemented Across TVA’s Critical Infrastructure

An underlying reason for TVA’s information security control weaknesses  was that it had not consistently implemented significant elements of its  information security program, such as: documenting a complete inventory  of systems; assessing risk of all systems identified; developing,  documenting, and implementing information security policies and  procedures; and documenting plans for security of control systems as well  as for remedial actions to mitigate known vulnerabilities. Furthermore, TVA’s written  guidance on patch management provided only limited guidance on how to  prioritize vulnerabilities. As a result, patches that were  identified as critical were not applied in a timely manner; in some cases, a  patch was applied more than 6 months past TVA deadlines for installation. Opportunities Exist to Improve Security of TVA’s Control Systems

Numerous opportunities exist for TVA to improve the security of its  control systems. An underlying cause for these weaknesses is that the agency had not  consistently implemented its information security program throughout the  agency. If TVA does not take sufficient steps to secure its control systems  and implement an information security program, it risks not being able to  respond properly to a major disruption that is the result of an intended or  unintended cyber incident.
Why GAO Did This Study

The control systems that regulate the nation's critical infrastructures face risks of cyber threats, system vulnerabilities, and potential attacks. Securing these systems is therefore vital to ensuring national security, economic well-being, and public health and safety. While most critical infrastructures are privately owned, the Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, provides power and other services to a large swath of the American Southeast. GAO was asked to testify on its public report being released today on the security controls in place over TVA's critical infrastructure control systems. In doing this work, GAO examined the security practices in place at TVA facilities; analyzed the agency's information security policies, plans, and procedures in light of federal law and guidance; and interviewed agency officials responsible for overseeing TVA's control systems and their security.

What GAO Found

TVA had not fully implemented appropriate security practices to secure the control systems used to operate its critical infrastructures at facilities GAO reviewed. Multiple weaknesses within the TVA corporate network left it vulnerable to potential compromise of the confidentiality, integrity, and availability of network devices and the information transmitted by the network. For example, almost all of the workstations and servers that GAO examined on the corporate network lacked key security patches or had inadequate security settings. Furthermore, TVA did not adequately secure its control system networks and devices on these networks, leaving the control systems vulnerable to disruption by unauthorized individuals. Network interconnections provided opportunities for weaknesses on one network to potentially affect systems on other networks. For example, weaknesses in the separation of network segments could allow an individual who gained access to a computing device connected to a less secure portion of the network to compromise systems in a more secure portion of the network, such as the control systems. In addition, physical security at multiple locations that GAO reviewed did not sufficiently protect the control systems. For example, live network jacks connected to TVA's internal network at certain facilities GAO reviewed had not been adequately secured from unauthorized access. As a result, TVA's control systems were at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses was that TVA had not consistently implemented significant elements of its information security program. For example, the agency lacked a complete and accurate inventory of its control systems and had not categorized all of its control systems according to risk, limiting assurance that these systems are adequately protected. In addition, TVA's patch management process lacked a mechanism to effectively prioritize vulnerabilities. As a result, patches that were identified as critical, meaning they should be applied immediately to vulnerable systems, were not applied in a timely manner. Numerous opportunities exist for TVA to improve the security of its control systems. For example, TVA can strengthen logical access controls, improve physical security, and fully implement its information security program. If TVA does not take sufficient steps to secure its control systems and fully implement an information security program, it risks not being able to respond properly to a major disruption that is the result of an intended or unintended cyber incident.