Consequently, the security of these systems and networks is essential to  protecting national and economic security, public health and safety, and  the flow of commerce. Conversely, ineffective information security  controls can result in significant risks, including  loss or theft of resources, such as federal payments and collections;  inappropriate access to and disclosure, modification, or destruction of  sensitive information, such as national security information, personal  taxpayer information, or proprietary business information; disruption of critical operations supporting critical infrastructure,  national defense, or emergency services; undermining of agency missions due to embarrassing incidents that  erode the public’s confidence in government; and use of computer resources for unauthorized purposes or to launch  attacks on other computers systems. The Nation Faces an Evolving Array of Cyber-Based Threats

Cyber-based threats are evolving and growing and arise from a wide  array of sources. These threats can be unintentional or intentional. Unintentional threats can be caused by software upgrades or defective  equipment that inadvertently disrupt systems. Intentional threats include  both targeted and untargeted attacks from a variety of sources, including  criminal groups, hackers, disgruntled employees, foreign nations engaged  in espionage and information warfare, and terrorists. These threat  sources vary in terms of the capabilities of the actors, their willingness to  act, and their motives, which can include monetary gain or political  advantage, among others. These sources of cyber threats make use of various techniques, or  exploits, that may adversely affect computers, software, a network, an  organization’s operation, an industry, or the Internet itself. The unique nature of cyber-based attacks can vastly enhance their reach  and impact. For example, cyber attackers do not need to be physically  close to their victims, technology allows attacks to easily cross state and  national borders, attacks can be carried out at high speed and directed at  a number of victims simultaneously, and cyber attackers can more easily  remain anonymous. Systems Supporting Federal Operations and Critical Infrastructure Are Vulnerable to Cyber Attacks

Significant weaknesses in information security controls continue to  threaten the confidentiality, integrity, and availability of critical information  and information systems used to support the operations, assets, and  personnel of federal agencies. In addition, inspectors  general at 22 of the major agencies identified information security or  information system control as a major management challenge for their  agency. Agency, inspectors general, and GAO assessments of information  security controls during fiscal year 2011 revealed that most major federal  agencies had weaknesses in most of the five major categories of  information system controls: (1) access controls, which ensure that only  authorized individuals can read, alter, or delete data; (2) configuration  management controls, which provide assurance that only authorized  software programs are implemented; (3) segregation of duties, which  reduces the risk that one individual can independently perform  inappropriate actions without detection; (4) continuity of operations  planning, which helps avoid significant disruptions in computer-dependent  operations; and (5) agencywide information security programs, which  provide a framework for ensuring that risks are understood and that  effective controls are selected and implemented. Over the past several years, we and agency inspectors general have  made hundreds of recommendations to resolve similar previously  identified significant control deficiencies. In addition, securing the control systems that monitor and control  sensitive processes and physical functions supporting many of our  nation’s critical infrastructures is a national priority, and we have identified  vulnerabilities in these systems. Number of Cybersecurity Incidents Reported by Federal Agencies Continues to Rise, and Recent Incidents Illustrate Serious Risk

Federal agencies have reported increasing numbers of security incidents  that placed sensitive information at risk, with potentially serious impacts  on federal operations, assets, and people. Over the past 6 years, the number of incidents reported by  federal agencies to US-CERT has increased from 5,503 incidents in fiscal  year 2006 to 42,887 incidents in fiscal year 2011, an increase of nearly  680 percent (see fig. Reported attacks and unintentional incidents involving federal, private,  and critical infrastructure systems demonstrate that the impact of a  serious attack could be significant. In summary, the cyber-threats facing the nation are evolving and growing,  with a wide array of potential threat actors having access to increasingly  sophisticated techniques for exploiting system vulnerabilities. The danger  posed by these threats is heightened by the weaknesses that continue to  exist in federal information systems and systems supporting critical  infrastructures. GAO-11-24.
Why GAO Did This Study

Nearly every aspect of American society increasingly depends upon information technology systems and networks. This includes increasing computer interconnectivity, particularly through the widespread use of the Internet as a medium of communication and commerce. While providing significant benefits, this increased interconnectivity can also create vulnerabilities to cyber-based threats. Pervasive and sustained cyber attacks against the United States could have a potentially devastating impact on federal and nonfederal systems, disrupting the operations of governments and businesses and the lives of private individuals. Accordingly, GAO has designated federal information security as a governmentwide high-risk area since 1997, and in 2003 expanded it to include protecting systems and assets vital to the nation (referred to as critical infrastructures).
GAO is providing a statement that describes (1) cyber threats facing the nations systems, (2) vulnerabilities present in federal information systems and systems supporting critical infrastructure, and (3) reported cyber incidents and their impacts. In preparing this statement, GAO relied on previously published work in these areas and reviewed more recent GAO, agency, and inspectors general work, as well as reports on security incidents.

What GAO Found

The nation faces an evolving array of cyber-based threats arising from a variety of sources. These threats can be intentional or unintentional. Unintentional threats can be caused by software upgrades or defective equipment that inadvertently disrupt systems, and intentional threats can be both targeted and untargeted attacks from a variety of threat sources. Sources of threats include criminal groups, hackers, terrorists, organization insiders, and foreign nations engaged in crime, political activism, or espionage and information warfare. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. Moreover, potential threat actors have a variety of attack techniques at their disposal, which can adversely affect computers, software, a network, an organizations operation, an industry, or the Internet itself. The nature of cyber attacks can vastly enhance their reach and impact due to the fact that attackers do not need to be physically close to their victims and can more easily remain anonymous, among other things. The magnitude of the threat is compounded by the ever-increasing sophistication of cyber attack techniques, such as attacks that may combine multiple techniques. Using these techniques, threat actors may target individuals, businesses, critical infrastructures, or government organizations.
The threat posed by cyber attacks is heightened by vulnerabilities in federal systems and systems supporting critical infrastructure. Specifically, significant weaknesses in information security controls continue to threaten the confidentiality, integrity, and availability of critical information and information systems supporting the operations, assets, and personnel of federal government agencies. For example, 18 of 24 major federal agencies have reported inadequate information security controls for financial reporting for fiscal year 2011, and inspectors general at 22 of these agencies identified information security as a major management challenge for their agency. Moreover, GAO, agency, and inspector general assessments of information security controls during fiscal year 2011 revealed that most major agencies had weaknesses in most major categories of information system controls. In addition, GAO has identified vulnerabilities in systems that monitor and control sensitive processes and physical functions supporting the nations critical infrastructures. These and similar weaknesses can be exploited by threat actors, with potentially severe effects.
The number of cybersecurity incidents reported by federal agencies continues to rise, and recent incidents illustrate that these pose serious risk. Over the past 6 years, the number of incidents reported by federal agencies to the federal information security incident center has increased by nearly 680 percent. These incidents include unauthorized access to systems; improper use of computing resources; and the installation of malicious software, among others. Reported attacks and unintentional incidents involving federal, private, and infrastructure systems demonstrate that the impact of a serious attack could be significant, including loss of personal or sensitive information, disruption or destruction of critical infrastructure, and damage to national and economic security.

What GAO Recommends

GAO has previously made recommendations to resolve identified significant control deficiencies.