Recent attacks and threats have further underscored the need to  bolster the cybersecurity of our government’s and our nation’s  computer systems and, more importantly, of the critical operations  and infrastructures they support. In addition, federal policy establishes  the Department of Homeland Security (DHS) as the focal point for  the security of cyberspace—including analysis, warning,  information sharing, vulnerability reduction, mitigation, and  recovery efforts for public and private critical infrastructure  information systems. Among the many CIP responsibilities established for DHS and  identified in federal law and policy are 13 key cybersecurity-related  responsibilities. DHS Has Initiated Efforts That Begin to Address Its Responsibilities, but More Work Remains

DHS has initiated efforts that begin to address each of its 13 key  responsibilities for cybersecurity; however, the extent of progress  varies among these responsibilities, and more work remains to be  done on each. For example, DHS (1) has recently issued an interim  plan for infrastructure protection that includes cybersecurity plans,  (2) is supporting a national cyber analysis and warning capability  through its role in US-CERT, and (3) has established forums to build  greater trust and to encourage information sharing among federal  officials with information security responsibilities and among  various law enforcement entities. Further, the department has not yet developed  and exercised government and government/industry contingency  recovery plans for cybersecurity, including a plan for recovering key  Internet functions. DHS Continues to Face Challenges in Establishing Itself as a National Focal Point for Cyberspace Security

DHS faces a number of challenges that have impeded its ability to  fulfill its cyber CIP responsibilities. Key challenges include  achieving organizational stability, gaining organizational authority,  overcoming hiring and contracting issues, increasing awareness  about cybersecurity roles and capabilities, establishing effective  partnerships with stakeholders (other federal, state, and local  governments and the private sector), achieving two-way information  sharing with these stakeholders, and providing and demonstrating  the value DHS can provide. However, such  effective communications are not yet in place in support of our  nation’s cybersecurity. DHS has identified steps in its strategic plan for cybersecurity that  can begin to address these challenges. However, until it begins to address these underlying challenges,  DHS cannot achieve significant results in coordinating cybersecurity  activities, and our nation will lack the effective focal point it needs  to better ensure the security of cyberspace for public and private  critical infrastructure systems. Implementation of GAO Recommendations Should Enhance Cybersecurity of Critical Infrastructures

Over the last several years, we have made a series of  recommendations to enhance the cybersecurity of critical  infrastructures, focusing on the need to (1) develop a strategic  analysis and warning capability for identifying potential  cyberattacks, (2) protect infrastructure control systems, (3) enhance  public/private information sharing, and (4) conduct important threat  and vulnerability assessments and address other challenges to  effective cybersecurity. Effectively  implementing these recommendations could greatly improve our  nation’s cybersecurity posture. Provides the financial infrastructure of the nation.
Why GAO Did This Study

Increasing computer interconnectivity has revolutionized the way that our government, our nation, and much of the world communicate and conduct business. While the benefits have been enormous, this widespread interconnectivity also poses significant risks to our nation's computer systems and, more importantly, to the critical operations and infrastructures they support. The Homeland Security Act of 2002 and federal policy established the Department of Homeland Security (DHS) as the focal point for coordinating activities to protect the computer systems that support our nation's critical infrastructures. GAO was asked to summarize previous work, focusing on (1) DHS's responsibilities for cybersecurity-related critical infrastructure protection (CIP), (2) the status of the department's efforts to fulfill these responsibilities, (3) the challenges it faces in fulfilling its cybersecurity responsibilities, and (4) recommendations GAO has made to improve cybersecurity of our nation's critical infrastructure.

What GAO Found

As the focal point for CIP, the Department of Homeland Security (DHS) has many cybersecurity-related roles and responsibilities that GAO identified in law and policy. DHS established the National Cyber Security Division to take the lead in addressing the cybersecurity of critical infrastructures. While DHS has initiated multiple efforts to fulfill its responsibilities, it has not fully addressed any of the 13 responsibilities, and much work remains ahead. For example, the department established the United States Computer Emergency Readiness Team as a public/private partnership to make cybersecurity a coordinated national effort, and it established forums to build greater trust and information sharing among federal officials with information security responsibilities and law enforcement entities. However, DHS has not yet developed national cyber threat and vulnerability assessments or government/industry contingency recovery plans for cybersecurity, including a plan for recovering key Internet functions. DHS faces a number of challenges that have impeded its ability to fulfill its cybersecurity-related CIP responsibilities. These key challenges include achieving organizational stability, increasing awareness about cybersecurity roles and capabilities, establishing effective partnerships with stakeholders, and achieving two-way information sharing with these stakeholders. In its strategic plan for cybersecurity, DHS identifies steps that can begin to address the challenges. However, until it confronts and resolves these underlying challenges and implements its plans, DHS will have difficulty achieving significant results in strengthening the cybersecurity of our critical infrastructures.

What GAO Recommends

In recent years, GAO has made a series of recommendations to enhance the cybersecurity of critical infrastructures that if effectively implemented could greatly improve our nation's cybersecurity posture.