Critical infrastructure  includes, among other things, banking and financial institutions,  telecommunications networks, and energy production and transmission  facilities, most of which are owned by the private sector. Because the private sector owns most of the nation’s critical  infrastructures, forming effective partnerships between the public and  private sectors is vital to successfully protect cyber-reliant critical assets  from a multitude of threats, including terrorists, criminals, and hostile  nations. Federal law and policy have established roles and  responsibilities for federal agencies to work with the private sector and  other entities in enhancing the cyber and physical security of critical  public and private infrastructures. In addition, they  establish the Department of Homeland Security (DHS) as the focal point  for the security of cyberspace—including analysis, warning, information  sharing, vulnerability reduction, mitigation efforts, and recovery efforts for  public and private critical infrastructure and information systems. In May 1998, Presidential Decision Directive 63 (PDD-63) established  critical infrastructure protection as a national goal and presented a  strategy for cooperative efforts by the government and the private sector  to protect the physical and cyber-based systems essential to the  minimum operations of the economy and the government. Among other things, DHS was assigned with the following  critical infrastructure protection responsibilities: (1) developing a  comprehensive national plan for securing the key resources and critical  infrastructures of the United States, (2) recommending measures to  protect those key resources and critical infrastructures in coordination  with other groups, and (3) disseminating, as appropriate, information to  assist in the deterrence, prevention, and preemption of or response to  terrorist attacks. Cyber-Reliant Critical Infrastructures Face a Proliferation of Threats

Threats to systems supporting critical infrastructure are evolving and  growing. In February 2011, the Director of National Intelligence testified  that, in the past year, there had been a dramatic increase in malicious  cyber activity targeting U.S. computers and networks, including a more  than tripling of the volume of malicious software since 2009. Different  types of cyber threats from numerous sources may adversely affect  computers, software, networks, organizations, entire industries, or the  Internet itself. Intentional  threats include both targeted and untargeted attacks from a variety of  sources, including criminal groups, hackers, disgruntled employees,  foreign nations engaged in espionage and information warfare, and  terrorists. In June 2011, a major bank reported that hackers broke into its  systems and gained access to the personal information of hundreds of  thousands of customers. It targeted control systems used to operate industrial  processes in the energy, nuclear, and other critical sectors. The Federal Government Has Taken Steps to Address Cyber Threats to Cyber Critical Infrastructure

Over the past 2 years, the federal government has taken a number of  steps aimed at addressing cyber threats to critical infrastructure. In early 2009, the President initiated a review of the nation’s cyberspace  policy that specifically assessed the missions and activities associated  with the nation’s information and communication infrastructure and issued  the results in May of that year. These included,  among other things, that the President appoint a cybersecurity policy  official for coordinating the nation’s cybersecurity policies and activities. Also in 2009, DHS issued an updated version of its National Infrastructure  Protection Plan (NIPP). The NIPP is intended to provide the framework  for a coordinated national approach to addressing the full range of  physical, cyber, and human threats and vulnerabilities that pose risks to  the nation’s critical infrastructures. The NIPP relies on a sector  partnership model as the primary means of coordinating government and  private-sector critical infrastructure protection efforts. DHS has also coordinated several cyber attack simulation exercises to  strengthen public and private incident response capabilities. Challenges in Protecting Cyber Critical Infrastructure Persist

Despite the actions taken by several successive administrations and the  executive branch agencies, significant challenges remain to enhancing  the protection of cyber-reliant critical infrastructures. Implementing actions recommended by the president’s cybersecurity  policy review.   Updating the national strategy for securing the information and  communications infrastructure.   Addressing global cybersecurity and governance.   Securing the modernized electricity grid. Among other things, we identified  six key challenges to securing smart grid systems.
Why GAO Did This Study

Increasing computer interconnectivity, such as the growth of the Internet, has revolutionized the way our government, our nation, and much of the world communicate and conduct business. However, this widespread interconnectivity poses significant risks to the government's and the nation's computer systems, and to the critical infrastructures they support. These critical infrastructures include systems and assets--both physical and virtual--that are essential to the nation's security, economic prosperity, and public health, such as financial institutions, telecommunications networks, and energy production and transmission facilities. Because most of these infrastructures are owned by the private sector, establishing effective public-private partnerships is essential to securing them from pervasive cyber-based threats. Federal law and policy call for federal entities, such as the Department of Homeland Security (DHS), to work with private-sector partners to enhance the physical and cyber security of these critical infrastructures. GAO is providing a statement describing (1) cyber threats facing cyber-reliant critical infrastructures; (2) recent actions the federal government has taken, in partnership with the private sector, to identify and protect cyber-reliant critical infrastructures; and (3) ongoing challenges to protecting these infrastructures. In preparing this statement, GAO relied on its previously published work in the area.

What GAO Found

The threats to systems supporting critical infrastructures are evolving and growing. In a February 2011 testimony, the Director of National Intelligence noted that there has been a dramatic increase in cyber activity targeting U.S. computers and systems in the last year, including a more than tripling of the volume of malicious software since 2009. Varying types of threats from numerous sources can adversely affect computers, software, networks, organizations, entire industries, or the Internet itself. These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, hostile nations, or terrorists. The interconnectivity between information systems, the Internet, and other infrastructures can amplify the impact of these threats, potentially affecting the operations of critical infrastructure, the security of sensitive information, and the flow of commerce. Recent reported incidents include hackers accessing the personal information of hundreds of thousands of customers of a major U.S. bank and a sophisticated computer attack targeting control systems used to operate industrial processes in the energy, nuclear, and other critical sectors. Over the past 2 years, the federal government, in partnership with the private sector, has taken a number of steps to address threats to cyber critical infrastructure. In early 2009, the White House conducted a review of the nation's cyberspace policy that addressed the missions and activities associated with the nation's information and communications infrastructure. The results of the review led, among other things, to the appointment of a national Cybersecurity Coordinator with responsibility for coordinating the nation's cybersecurity policies and activities. Also in 2009, DHS updated its National Infrastructure Protection Plan, which provides a framework for addressing threats to critical infrastructures and relies on a public-private partnership model for carrying out these efforts. DHS has also established a communications center to coordinate national response efforts to cyber attacks and work directly with other levels of government and the private sector and has conducted several cyber attack simulation exercises. Despite recent actions taken, a number of significant challenges remain to enhancing the security of cyber-reliant critical infrastructures, such as (1) implementing actions recommended by the president's cybersecurity policy review; (2) updating the national strategy for securing the information and communications infrastructure; (3) reassessing DHS's planning approach to critical infrastructure protection; (4) strengthening public-private partnerships, particularly for information sharing; (5) enhancing the national capability for cyber warning and analysis; (6) addressing global aspects of cybersecurity and governance; and (7)securing the modernized electricity grid, referred to as the "smart grid." In prior reports, GAO has made many recommendations to address these challenges. GAO also continues to identify protecting the nation's cyber critical infrastructure as a governmentwide high-risk area.