In the electric power industry, control systems can be used to manage and  control the generation, transmission, and distribution of electric power. Critical Infrastructure Control Systems Face Increasing Risks Due to Cyber Threats, Vulnerabilities, and the Potentially Serious Impact of an Attack

Cyber threats can be intentional and unintentional, targeted or  nontargeted, and can come from a variety of sources. Federal and industry experts believe that critical infrastructure control  systems are more vulnerable today than in the past due to the increased  standardization of technologies, the increased connectivity of control  systems to other computer networks and the Internet, insecure  connections, and the widespread availability of technical information  about control systems. Reported Control Systems Incidents Reveal the Potential for Substantial Impact

Reported attacks and unintentional incidents involving critical  infrastructure control systems demonstrate that a serious attack could be  devastating. In October 2006, a foreign  hacker penetrated security at a water filtering plant. The intruder planted  malicious software that was capable of affecting the plant’s water  treatment operations. In August 2006, two circulation pumps at  Unit 3 of the Browns Ferry, Alabama, nuclear power plant failed, forcing  the unit to be shut down manually. The Private Sector Has Multiple Initiatives Under Way to Help Secure Control Systems

Industry-specific organizations in various sectors, including the electricity,  oil and gas, and water sectors, have initiatives under way to help improve  control system security, including developing standards and publishing  guidance. Federal Agencies Have Multiple Initiatives to Help Secure Critical Infrastructure Control Systems, but More Remains to Be Done

Over the past few years, federal agencies— including DHS, DOE, and  others—have initiated efforts to improve the security of critical  infrastructure control systems. DHS, however, has not yet established a strategy to coordinate the various  control systems activities across federal agencies and the private sector. Without a trusted focal point for  sharing sensitive information on vulnerabilities, there is an increased risk  that attacks on control systems could cause a significant disruption to our  nation’s critical infrastructures. Implementation of GAO Recommendations Would Help Improve Federal Control Systems Security Efforts

Control systems are an essential component of our nation’s critical  infrastructure and their disruption could have a significant impact on  public health and safety. Given the importance of control systems, in our  report being released today, we are recommending that the Secretary of  the Department of Homeland Security implement the following two  actions:  develop a strategy to guide efforts for securing control systems, including  agencies’ responsibilities, as well as overall goals, milestones, and  performance measures and   establish a rapid and secure process for sharing sensitive control system  vulnerability information with critical infrastructure control system  stakeholders, including vendors, owners, and operators. The public and private sectors  have begun numerous activities to improve the cyber security of control  systems. However, the federal government lacks an overall strategy for  coordinating public and private sector efforts. DHS also lacks an efficient  process for sharing sensitive information on vulnerabilities with private  sector critical infrastructure owners.
Why GAO Did This Study

Control systems--computer-based systems that monitor and control sensitive processes--perform vital functions in many of our nation's critical infrastructures such as electric power generation, transmission, and distribution; oil and gas refining; and water treatment and distribution. The disruption of control systems could have a significant impact on public health and safety, which makes securing them a national priority. GAO was asked to testify on portions of its report on control systems security being released today. This testimony summarizes the cyber threats, vulnerabilities, and the potential impact of attacks on control systems; identifies private sector initiatives; and assesses the adequacy of public sector initiatives to strengthen the cyber security of control systems. To address these objectives, GAO met with federal and private sector officials to identify risks, initiatives, and challenges. GAO also compared agency plans to best practices for securing critical infrastructures.

What GAO Found

Critical infrastructure control systems face increasing risks due to cyber threats, system vulnerabilities, and the serious potential impact of attacks as demonstrated by reported incidents. Threats can be intentional or unintentional, targeted or nontargeted, and can come from a variety of sources. Control systems are more vulnerable to cyber attacks than in the past for several reasons, including their increased connectivity to other systems and the Internet. Further, as demonstrated by past attacks and incidents involving control systems, the impact on a critical infrastructure could be substantial. For example, in 2006, a foreign hacker was reported to have planted malicious software capable of affecting a water filtering plant's water treatment operations. Also in 2006, excessive traffic on a nuclear power plant's control system network caused two circulation pumps to fail, forcing the unit to be shut down manually. Multiple private sector entities such as trade associations and standards setting organizations are working to help secure control systems. Their efforts include developing standards and providing guidance to members. For example, the electricity industry has recently developed standards for cyber security of control systems and a gas trade association is developing guidance for members to use encryption to secure control systems. Federal agencies also have multiple initiatives under way to help secure critical infrastructure control systems, but more remains to be done to coordinate these efforts and to address specific shortfalls. Over the past few years, federal agencies have initiated efforts to improve the security of critical infrastructure control systems. However, there is as yet no overall strategy to coordinate the various activities across federal agencies and the private sector. Further, the Department of Homeland Security (DHS) lacks processes needed to address specific weaknesses in sharing information on control system vulnerabilities. Until public and private sector security efforts are coordinated by an overarching strategy, there is an increased risk that multiple organizations will conduct duplicative work. In addition, until information-sharing weaknesses are addressed, DHS risks not being able to effectively carry out its responsibility for sharing information on vulnerabilities with the private and public sectors.