Federal Systems and Infrastructures Face Increasing Cyber Threats

Threats to federal information systems and cyber-based critical  infrastructures are evolving and growing. Federal law  enforcement and intelligence agencies have identified multiple sources of  threats to our nation’s critical information systems, including foreign  nations engaged in espionage and information warfare, criminals, hackers,  virus writers, and disgruntled employees and contractors. These groups and individuals have a variety of attack techniques at their  disposal. Furthermore, as we have previously reported, the techniques  have characteristics that can vastly enhance the reach and impact of their  actions, such as the following:    Attackers do not need to be physically close to their targets to perpetrate a  cyber attack. Technology allows actions to easily cross multiple state and national  borders. Attackers can easily remain anonymous. The connectivity between information systems, the Internet, and other  infrastructures creates opportunities for attackers to disrupt  telecommunications, electrical power, and other critical services. Reported Security Incidents Are on the Rise

Consistent with the evolving and growing nature of the threats to federal  systems, agencies are reporting an increasing number of security  incidents. However, serious and widespread information security control  deficiencies continue to place federal assets at risk of inadvertent o deliberate misuse, financial information at risk of unauthorized  modification or destruction, sensitive information at risk of inappropr disclosure, and critical operations at risk of disruption. In their fiscal year 2009 performance and accountability reports, 21 of 24  major federal agencies noted that inadequate information system controls  over their financial systems and information were either a material  weakness or a significant deficiency. Similarly, our audits have identified control deficiencies in both financial  and nonfinancial systems, including vulnerabilities in critical federal  systems. Opportunities Exist for Enhancing Federal Cybersecurity

Over the past several years, we and agency inspectors general have made  hundreds of recommendations to agencies for actions necessary to resolve  prior significant control deficiencies and information security program  shortfalls. In addition, the White House, OMB, and certain federal agencies have  undertaken several governmentwide initiatives that are intended to  enhance information security at federal agencies. However, these  initiatives face challenges that require sustained attention:    Comprehensive National Cybersecurity Initiative (CNCI): In January  2008, President Bush initiated a series of 12 projects aimed primarily at  improving the Department of Homeland Security’s (DHS) and other  federal agencies’ efforts to protect against intrusion attempts and  anticipate future threats. Similarly, in September 2008, we reported that since conducting a major  cyber attack exercise, called Cyber Storm, DHS had demonstrated  progress in addressing eight lessons it had learned from these efforts. We also testified in March 2009 on needed improvements to the nation’s  cybersecurity strategy. In preparation for that testimony, we obtained the  views of experts (by means of panel discussions) on critical aspects of the  strategy, including areas for improvement. To help in  meeting these threats, opportunities exist to improve information security  throughout the federal government. The prompt and effective  implementation of the hundreds of recommendations by us and by agency  inspectors general to mitigate information security control deficiencies  and fully implement agencywide security programs would strengthen the  protection of federal information systems, as would efforts by DHS to  develop better capabilities to meets its responsibilities, and the  implementation of recommended improvements to the national  cybersecurity strategy. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the federal government. In recent testimony, the Director of National Intelligence highlighted that many nation states, terrorist networks, and organized criminal groups have the capability to target elements of the United States information infrastructure for intelligence collection, intellectual property theft, or disruption. In July 2009, press accounts reported attacks on Web sites operated by major government agencies. The ever-increasing dependence of federal agencies on information systems to carry out essential, everyday operations can make them vulnerable to an array of cyber-based risks. Thus it is increasingly important that the federal government carry out a concerted effort to safeguard its systems and the information they contain. GAO is providing a statement describing (1) cyber threats to federal information systems and cyber-based critical infrastructures, (2) control deficiencies that make federal systems vulnerable to those threats, and (3) opportunities that exist for improving federal cybersecurity. In preparing this statement, GAO relied on its previously published work in this area.

What GAO Found

Cyber-based threats to federal systems and critical infrastructure are evolving and growing. These threats can come from a variety of sources, including criminals and foreign nations, as well as hackers and disgruntled employees. These potential attackers have a variety of techniques at their disposal, which can vastly enhance the reach and impact of their actions. For example, cyber attackers do not need to be physically close to their targets, their attacks can easily cross state and national borders, and cyber attackers can easily preserve their anonymity. Further, the interconnectivity between information systems, the Internet, and other infrastructure presents increasing opportunities for such attacks. Consistent with this, reports of security incidents from federal agencies are on the rise, increasing by over 400 percent from fiscal year 2006 to fiscal year 2009. Compounding the growing number and kinds of threats, GAO--along with agencies' internal assessments--has identified significant deficiencies in the security controls on federal information systems, which have resulted in pervasive vulnerabilities. These include weaknesses in the security of both financial and non-financial systems and information, including vulnerabilities in critical federal systems. These deficiencies continue to place federal assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, and critical operations at risk of disruption. Multiple opportunities exist to improve federal cybersecurity. To address identified deficiencies in agencies' security controls and shortfalls in their information security programs, GAO and agency inspectors general have made hundreds of recommendations over the past several years, many of which agencies are implementing. In addition, the White House, the Office of Management and Budget, and certain federal agencies have undertaken several governmentwide initiatives intended to enhance information security at federal agencies. While progress has been made on these initiatives, they all face challenges that require sustained attention, and GAO has made several recommendations for improving the implementation and effectiveness of these initiatives. Further, the Department of Homeland Security also needs to fulfill its key cybersecurity responsibilities, such as developing capabilities for ensuring the protection of cyber-based critical infrastructures and implementing lessons learned from a major cyber simulation exercise. Finally, a GAO-convened panel of experts has made several recommendations for improving the nation's cybersecurity strategy. Realizing these opportunities for improvement can help ensure that the federal government's systems, information, and critical cyber-based infrastructures are effectively protected.