This unclassified but sensitive information constitutes a majority of the information on Defense computers. The Internet

The Internet is a global network interconnecting thousands of dissimilar computer networks and millions of computers worldwide. Therefore, only about 1 in 150 successful attacks drew an active defensive response from the organizations being tested. Attackers have stolen, modified, and destroyed both data and software. Other Attacks

The U.S. . . systems and networks is increasing . This is a concern because vulnerabilities in one part of Defense’s information infrastructure make the entire infrastructure vulnerable. Defense has developed training courses and curricula which focus on the secure operation of computer systems and the need to protect information. Firewalls permit authorized users to access and transmit privileged information and deny access to unauthorized users. The hundreds of thousands of attacks that Defense has already experienced demonstrate that (1) significant damage can be incurred by attackers and (2) attacks pose serious risks to national security. Recommendations

To better focus management attention on the Department’s increasing computer security threat and to ensure that a higher priority and sufficient resources are devoted to addressing this problem, we recommend that at a minimum the Secretary of Defense strengthen the Department’s information systems security program by developing departmentwide policies for preventing, detecting, and responding to attacks on Defense information systems, including mandating that (1) all security incidents be reported within the Department, (2) risk assessments be performed routinely to determine vulnerability to attacks and intrusions, (3) vulnerabilities and deficiencies be expeditiously corrected as they are identified, and (4) damage from intrusions be expeditiously assessed to ensure the integrity of data and systems compromised; requiring the military services and Defense agencies to use training and other mechanisms to increase awareness and accountability among installation commanders and all personnel as to the security risks of computer systems connected to the Internet and their responsibility for securing their systems; requiring information system security officers at all installations and setting specific standards for ensuring that these as well as system and network managers are given sufficient time and training to perform their duties appropriately; continually developing and cost-effectively using departmentwide network monitoring and protection technologies; and evaluating the incident response capabilities within DISA, the military services, and the Defense agencies to ensure that they are sufficient to handle the projected threat.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the extent to which Department of Defense (DOD) computer systems are attacked, focusing on the: (1) potential for further damage to DOD computer systems; and (2) challenges DOD faces in securing sensitive information on its computer systems.

What GAO Found

GAO found that: (1) DOD relies on a complex information infrastructure to design weapons, identify and track enemy targets, pay soldiers, mobilize reservists, and manage supplies; (2) use of the Internet to enhance communication and information sharing has increased DOD exposure to attack, since the Internet provides unauthorized users a means to access DOD systems; (3) while the DOD information available on the Internet is unclassified, it is sensitive and must be restricted; (4) only about 1 in 500 attacks is detected and reported, but the Defense Information Systems Agency (DISA) estimates that DOD is attacked about 250,000 times per year; (5) attackers have stolen, modified, and destroyed data and software, disabled protection systems to allow future unauthorized access, and shut down entire systems and networks to preclude authorized use; (6) security breaches pose a serious risk to national security because terrorists or U.S. adversaries could disrupt the national information infrastructure; (7) security breaches cost DOD hundreds of millions of dollars annually; and (8) DOD needs to increase the resources devoted to computer security, update the policies that govern computer security, and increase security training for system and network administrators.