Trusted Internet Connections

In November 2007, OMB announced the TIC initiative. Agencies may implement TIC by serving as their own access provider or  by obtaining services from another source. Agencies Have Made Progress toward Consolidating and Reducing Connections, but Inconsistent Communication from OMB and DHS Has Led to Challenges

OMB and DHS established requirements to meet the initiative’s goals of  securing agencies’ external connections and improving the government’s  incident response capability. Throughout their efforts,  agencies have experienced benefits and challenges as well as learned  lessons. Agencies Were Required to Develop and Implement Plans to Consolidate and Secure External Connections

To achieve these objectives, agencies were required to:    Inventory agency external connections. Identify and justify target number of external access points. Implement security capabilities. The 74 security capabilities  include technical capabilities, such as encryption of Internet traffic and  the use of firewalls; capabilities related to availability, such as the  presence of an uninterrupted power source; physical access controls; and  capabilities that describe how an access provider maintains an acceptable  level of service. Demonstrate consolidation of connections and implementation of  TIC security capabilities. Agencies Have Not Fully Implemented All Requirements of TIC and Progress Has Been Slower Than Planned

None of the 23 agencies has met all of the requirements of the TIC  initiative, and most agencies have experienced delays in their plans for  reducing and consolidating connections. However, most agencies reported  that they have made progress toward reducing and consolidating their  external connections and implementing security capabilities. However, in their September 2009 plans  of action and milestones, these agencies reported that they had  consolidated to a maximum of 1,753 connections—225 more than they had  planned. TIC will improve security at agencies by  reducing the number of access points that have to be monitored. Improved Network Management. However, in  some circumstances, agencies have been unable to effectively plan for  implementing the initiative because OMB did not always consistently  communicate the number of TIC access points for which agencies had  been approved in a timely manner and DHS did not always promptly  respond to agencies’ questions about the required security capabilities. As indicated earlier, the 16 access  provider agencies in our review are reporting that they are reducing and  consolidating from 3,286 external connections. DHS Has Deployed Einstein to Six Agencies, but Faces Challenges with Meeting Program Goals

Einstein is intended to provide DHS with an increased awareness of  activity, including possible security incidents, on federal networks. As of  September 2009, fewer than half of the 23 agencies had executed the  required agreements with DHS, and Einstein 2 had been deployed to six  agencies. Agencies that participated in Einstein 1 improved identification  of incidents and mitigation of attacks, but DHS continues to face  challenges with meeting the goals of the initiative. Although one of the  objectives of Einstein is to improve situational awareness of activity  across the federal government, DHS will be challenged in understanding  the extent to which this objective is being met because it lacks  performance measures for Einstein 2 that address whether or not agencies  report that the alerts represent actual incidents. For each initiative, our  objectives were to (1) identify their goals, objectives, and requirements;  (2) determine the status of the actions federal agencies have taken, or plan  to take, to implement them; and (3) identify the benefits, challenges, and  lessons learned in implementing each initiative. For TIC, to address the first objective, we obtained and reviewed  applicable policies and memorandums issued by the Office of Management  and Budget (OMB) and guidance, reports, and other documentation  provided by the Department of Homeland Security (DHS).
Why GAO Did This Study

To reduce the threat to federal systems and operations posed by cyber attacks on the United States, the Office of Management and Budget (OMB) launched, in November 2007, the Trusted Internet Connections (TIC) initiative, and later, in 2008, the Department of Homeland Security's (DHS) National Cybersecurity Protection System (NCPS), operationally known as Einstein, became mandatory for federal agencies as part of TIC. For each of these initiatives, GAO was asked to (1) identify their goals, objectives, and requirements; (2) determine the status of actions federal agencies have taken, or plan to take, to implement the initiatives; and (3) identify any benefits, challenges, and lessons learned. To do this, GAO reviewed plans, reports, and other documents at 23 major executive branch agencies, interviewed officials, and reviewed OMB and DHS guidance.

What GAO Found

The goals of TIC are to secure federal agencies' external network connections, including Internet connections, and improve the government's incident response capability by reducing the number of agencies' external network connections and implementing security controls over the connections that remain. In implementing TIC, agencies could either provide their own access points by becoming an access provider or seek service from these providers or an approved vendor. To achieve the initiative's goals, agencies were required to (1) inventory external connections, (2) establish a target number of TIC access points, (3) develop and implement plans to reduce their connections, (4) implement security capabilities (if they chose to be an access provider) addressing such issues as encryption and physical security, and (5) demonstrate to DHS the consolidation of connections and compliance with the security capabilities (if they chose to be an access provider). As of September 2009, none of the 23 agencies had met all of the requirements of the TIC initiative. Although most agencies reported that they have made progress toward reducing their external connections and implementing critical security capabilities, most agencies have also experienced delays in their implementation efforts. For example, the 16 agencies that chose to become access providers reported that they had reduced their number of external connections from 3,286 to approximately 1,753. Further, agencies have not demonstrated that they have fully implemented the required security capabilities. Throughout their reduction efforts, agencies have experienced benefits, such as improved security and network management. However, they have been challenged in implementing TIC because OMB did not promptly communicate the number of access points for which they had been approved and DHS did not always respond to agency queries on security capabilities in a timely manner. Agencies' experiences with implementing TIC offered OMB and DHS lessons learned, such as the need to define program requirements before establishing deadlines and the usefulness of sponsoring collaborative meetings for agencies' implementation efforts. Einstein is intended to provide DHS with an increased awareness of activity, including possible security incidents, on federal networks by providing intrusion detection capabilities that allow DHS to monitor and analyze agencies' incoming and outgoing Internet traffic. As of September 2009, fewer than half of the 23 agencies had executed the required agreements with DHS, and Einstein 2 had been deployed to 6 agencies. Agencies that participated in Einstein 1 improved identification of incidents and mitigation of attacks, but DHS will continue to be challenged in understanding whether the initiative is meeting all of its objectives because it lacks performance measures that address how agencies respond to alerts.