The  benefits have been enormous. What Are Control Systems? In October 1997, the President’s Commission on Critical Infrastructure  Protection discussed the potential damaging effects on the electric power  and oil and gas industries of successful attacks on control systems. In  February 2003, the President clearly demonstrated concern about “the  threat of organized cyber attacks capable of causing debilitating disruption  to our Nation’s critical infrastructures, economy, or national security,”  noting that “disruption of these systems can have significant consequences  for public health and safety” and emphasizing that the protection of  control systems has become “a national priority.”
Several factors have contributed to the escalation of risk to control  systems, including (1) the adoption of standardized technologies with  known vulnerabilities, (2) the connectivity of control systems to other  networks, (3) insecure remote connections, and (4) the widespread  availability of technical information about control systems. I will now discuss potential and reported  cyber attacks on control systems, as well as challenges to securing them. Securing Control Systems Poses Significant Challenges

The control systems community faces several challenges to securing  control systems against cyber threats. Efforts to Strengthen the Cybersecurity of Control Systems Under Way, but Lack Adequate Coordination

Government, academia, and private industry have independently initiated  multiple efforts and programs focused on some of the key areas that  should be addressed to strengthen the cybersecurity of control systems. Our March 2004 report includes a detailed discussion of many initiatives. Increased awareness of security and sharing of information about  the implementation of more secure architectures and existing  security technologies. In February 2003, the President’s National Strategy to Secure Cyberspace  established a role for DHS to coordinate with other government agencies  and the private sector to improve the cybersecurity of control systems. DHS’s  coordination of these efforts could accelerate the development and  implementation of more secure systems to manage our critical  infrastructures.
Why GAO Did This Study

Computerized control systems perform vital functions across many of our nation's critical infrastructures. For example, in natural gas distribution, they can monitor and control the pressure and flow of gas through pipelines. In October 1997, the President's Commission on Critical Infrastructure Protection emphasized the increasing vulnerability of control systems to cyber attacks. At the request of the House Committee on Government Reform, Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, this testimony will discuss GAO's March 2004 report on potential cyber vulnerabilities, focusing on (1) significant cybersecurity risks associated with control systems (2) potential and reported cyber attacks against these systems (3) key challenges to securing control systems, and (4) efforts to strengthen the cybersecurity of control systems.

What GAO Found

In addition to general cyber threats, which have been steadily increasing, several factors have contributed to the escalation of the risks of cyber attacks against control systems. These include the adoption of standardized technologies with known vulnerabilities and the increased connectivity of control systems to other systems. Control systems can be vulnerable to a variety of attacks, examples of which have already occurred. Successful attacks on control systems could have devastating consequences, such as endangering public health and safety. Securing control systems poses significant challenges, including limited specialized security technologies and lack of economic justification. The government, academia, and private industry have initiated efforts to strengthen the cybersecurity of control systems. The President's National Strategy to Secure Cyberspace establishes a role for DHS to coordinate with these entities to improve the cybersecurity of control systems. While some coordination is occurring, DHS's coordination of these efforts could accelerate the development and implementation of more secure systems. Without effective coordination of these efforts, there is a risk of delaying the development and implementation of more secure systems to manage our critical infrastructures.