Objectives, Scope, and Methodology

Our objectives were to determine (1) the potential risks to federal  information systems from emerging cybersecurity threats such as spam,  phishing, and spyware; (2) the 24 Chief Financial Officers (CFO) Act  agencies’ reported perceptions of these risks and their actions and plans to  mitigate them; (3) government and private-sector efforts to address these  emerging cybersecurity threats on a national level, including actions to  increase consumer awareness; and (4) governmentwide challenges to  protecting federal information systems from these emerging cybersecurity  threats. Emerging Cybersecurity Threats to Federal Agencies

Federal agencies are facing a set of emerging cybersecurity threats that are  the result of changing sources of attack, increasingly sophisticated social  engineering techniques designed to trick the unsuspecting user into  divulging sensitive information, new modes of covert compromise, and the  blending of once distinct types of attack into more complex and damaging  forms. Spam consumes employee and technical resources and can be used as a  delivery mechanism for malware and other cyber threats. Phishing Can Lead to Identity Theft, Loss of Sensitive Information, and Reduced Trust in E- Government Services

Federal agencies and employees can be victims of phishing scams. These efforts range from targeting cybercrime to educating the user and  the private-sector community on how to detect and protect systems and  information from these threats. Lack of Coordinated Incident Reporting Limits Federal Capability to Address Emerging Threats

Although federal agencies are required to report incidents to a central  federal entity, they are not consistently reporting incidents of emerging  cybersecurity threats. Pursuant to FISMA, OMB and DHS share  responsibility for the federal government’s capability to detect, analyze,  and respond to cybersecurity incidents. However, governmentwide  guidance has not been issued to clarify to agencies which incidents they  should be reporting, as well as how and to whom they should report. Without effective coordination, the federal government is limited in its  ability to identify and respond to emerging cybersecurity threats, including  sophisticated and coordinated attacks that target multiple federal entities. Recommendations

In order to more effectively prepare for and address emerging  cybersecurity threats, we recommend that the Director, Office of  Management and Budget, take the following two actions:  ensure that agencies’ information security programs required by FISMA  address the risk of emerging cybersecurity threats such as spam,  phishing, and spyware, including performing periodic risk assessments;  implementing risk-based policies and procedures to mitigate identified  risks; providing security-awareness training; and establishing  procedures for detecting, reporting, and responding to incidents of  emerging cybersecurity threats; and  coordinate with the Secretary of Homeland Security and the Attorney  General to establish governmentwide guidance for agencies on how to  (1) address emerging cybersecurity threats and (2) report incidents to a  single government entity, including clarifying the respective roles,  responsibilities, processes, and procedures for federal entities— including homeland security and law enforcement entities.
Why GAO Did This Study

Federal agencies are facing a set of emerging cybersecurity threats that are the result of increasingly sophisticated methods of attack and the blending of once distinct types of attack into more complex and damaging forms. Examples of these threats include spam (unsolicited commercial e-mail), phishing (fraudulent messages to obtain personal or sensitive data), and spyware (software that monitors user activity without user knowledge or consent). To address these issues, GAO was asked to determine (1) the potential risks to federal systems from these emerging cybersecurity threats, (2) the federal agencies' perceptions of risk and their actions to mitigate them, (3) federal and private-sector actions to address the threats on a national level, and (4) governmentwide challenges to protecting federal systems from these threats.

What GAO Found

Spam, phishing, and spyware pose security risks to federal information systems. Spam consumes significant resources and is used as a delivery mechanism for other types of cyberattacks; phishing can lead to identity theft, loss of sensitive information, and reduced trust and use of electronic government services; and spyware can capture and release sensitive data, make unauthorized changes, and decrease system performance. The blending of these threats creates additional risks that cannot be easily mitigated with currently available tools. Agencies' perceptions of the risks of spam, phishing, and spyware vary. In addition, most agencies were not applying the information security program requirements of the Federal Information Security Management Act of 2002 (FISMA) to these emerging threats, including performing risk assessments, implementing effective mitigating controls, providing security awareness training, and ensuring that their incident-response plans and procedures addressed these threats. Several entities within the federal government and the private sector have begun initiatives to address these emerging threats. These efforts range from educating consumers to targeting cybercrime. Similar efforts are not, however, being made to assist and educate federal agencies. Although federal agencies are required to report incidents to a central federal entity, they are not consistently reporting incidents of emerging cybersecurity threats. Pursuant to FISMA, the Office Management and Budget (OMB) and the Department of Homeland Security (DHS) share responsibility for the federal government's capability to detect, analyze, and respond to cybersecurity incidents. However, governmentwide guidance has not been issued to clarify to agencies which incidents they should be reporting, as well as how and to whom they should report. Without effective coordination, the federal government is limited in its ability to identify and respond to emerging cybersecurity threats, including sophisticated and coordinated attacks that target multiple federal entities.