US-CERT’s Capabilities Include Some but Not All Aspects of Key Attributes

US-CERT has established cyber analysis and warning capabilities that  include aspects of each of the key attributes. However, they do not fully  incorporate all of them. For example, it has not established a baseline of our nation’s critical  infrastructure information systems. However, according to customers, these warning products are not  consistently actionable and timely. US-CERT Faces New and Ongoing Challenges to Fulfilling Its Mission

US-CERT faces a number of newly identified and ongoing challenges that  impede it from fully implementing the key attributes and in turn  establishing cyber analysis and warning capabilities essential to  coordinating the national effort to prepare for, prevent, and respond to  cyber threats. The new challenge is creating warnings that are actionable  and timely—it does not consistently issue warning and other notifications  that its customers find useful. In addition, US-CERT continues to face four  challenges that we previously identified: (1) employing predictive cyber  analysis, (2) developing more trusted relationships to encourage  information sharing, (3) having sufficient analytical and technical  capabilities, and (4) operating without organizational stability and  leadership within DHS. Until DHS addresses these challenges and fully  incorporates all key attributes into its capabilities, it will not have the full  complement of cyber analysis and warning capabilities essential to  effectively performing its national mission. However,  according to the Acting Director of US-CERT, its efforts are limited by  other federal entities’ abilities to determine specific cyber threats to the  nation’s critical infrastructure. In addition, we recommended that  performance measures and milestones for performing activities to address  these challenges be identified. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify key attributes of cyber analysis and  warning capabilities, (2) compare these attributes with the United States  Computer Emergency Readiness Team’s (US-CERT) current analysis and  warning capabilities to identify whether there are gaps, and (3) identify  US-CERT’s challenges to developing and implementing key attributes and  a successful national cyber analysis and warning capability. We also interviewed the Deputy Director of the Department  of Homeland Security’s National Cybersecurity Center to obtain  information about its concept-of-operations document.
Why GAO Did This Study

Cyber analysis and warning capabilities are critical to thwarting computer-based (cyber) threats and attacks. The Department of Homeland Security (DHS) established the United States Computer Emergency Readiness Team (US-CERT) to, among other things, coordinate the nation's efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. GAO's objectives were to (1) identify key attributes of cyber analysis and warning capabilities, (2) compare these attributes with US-CERT's current capabilities to identify whether there are gaps, and (3) identify US-CERT's challenges to developing and implementing key attributes and a successful national cyber analysis and warning capability. To address these objectives, GAO identified and analyzed related documents, observed operations at numerous entities, and interviewed responsible officials and experts.

What GAO Found

Cyber analysis and warning capabilities include (1) monitoring network activity to detect anomalies, (2) analyzing information and investigating anomalies to determine whether they are threats, (3) warning appropriate officials with timely and actionable threat and mitigation information, and (4) responding to the threat. GAO identified 15 key attributes associated with these capabilities. While US-CERT's cyber analysis and warning capabilities include aspects of each of the key attributes, they do not fully incorporate all of them. For example, as part of its monitoring, US-CERT obtains information from numerous external information sources; however, it has not established a baseline of our nation's critical network assets and operations. In addition, while it investigates if identified anomalies constitute actual cyber threats or attacks as part of its analysis, it does not integrate its work into predictive analyses. Further, it provides warnings by developing and distributing a wide array of notifications; however, these notifications are not consistently actionable or timely. US-CERT faces a number of newly identified and ongoing challenges that impede it from fully incorporating the key attributes and thus being able to coordinate the national efforts to prepare for, prevent, and respond to cyber threats. The newly identified challenge is creating warnings that are consistently actionable and timely. Ongoing challenges that GAO previously identified, and made recommendations to address, include employing predictive analysis and operating without organizational stability and leadership within DHS, including possible overlapping roles and responsibilities. Until US-CERT addresses these challenges and fully incorporates all key attributes, it will not have the full complement of cyber analysis and warning capabilities essential to effectively performing its national mission.