Experts also agree that there has been  a steady advance in the sophistication and effectiveness of attack  technology. The weaknesses identified place a broad array of federal operations and  assets at risk. GISRA supplemented information security  requirements established in the Computer Security Act of 1987, the  Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996 and  was consistent with existing information security guidance issued by the  Office of Management and Budget (OMB) and the National Institute of  Standards and Technology (NIST), as well as audit and best practice  guidance issued by GAO. Specifically,  this program was to include    periodic risk assessments that consider internal and external threats to the  integrity, confidentiality, and availability of systems, and to data  supporting critical operations and assets; the development and implementation of risk-based, cost-effective policies  and procedures to provide security protections for information collected  or maintained by or for the agency; training on security responsibilities for information security personnel and  on security awareness for agency personnel;   periodic management testing and evaluation of the effectiveness of  policies, procedures, controls, and techniques;   a process for identifying and remediating any significant deficiencies;    procedures for detecting, reporting, and responding to security incidents;    an annual program review by agency program officials. Agencies Show Progress in Implementing Security Requirements, but Further Improvement Needed

In our March 2002 testimony, we reported that the initial implementation  of GISRA was a significant step in improving federal agencies’ information  security programs and addressing their serious, pervasive information  security weaknesses. As shown in  figure 6, our analyses showed that 14 agencies reported that they had  tested the controls of less than 60 percent of their systems for fiscal year  2002. Further information security improvement efforts are also needed at the  governmentwide level, and it is important that these efforts are guided by  a comprehensive strategy and, as development of this strategy continues,  that certain key issues be addressed. Sixth, agencies can allocate resources sufficient to support their  information security and infrastructure protection activities. Federal awareness of the importance of securing our nation’s  critical infrastructures has continued to evolve since the mid-1990s. Regarding CIP, the new department is responsible for, among other things,  (1) developing a comprehensive national plan for securing the key  resources and critical infrastructure of the United States;  (2) recommending measures to protect the key resources and critical  infrastructure of the United States in coordination with other federal  agencies and in cooperation with state and local government agencies and  authorities, the private sector, and other entities; and (3) disseminating, as  appropriate, information analyzed by the department both within the  department and to other federal agencies, state and local government  agencies, and private-sector entities to assist in the deterrence, prevention,  preemption of, or response to terrorist attacks. The Nation Faces Ongoing CIP Challenges

Although the actions taken to date are major steps to more effectively  protect our nation’s critical infrastructures, we have made numerous  recommendations over the last several years concerning CIP challenges  that still need to be addressed. For each of these challenges,  improvements have been made and continuing efforts are in progress. However, even greater efforts are needed to address them. These  challenges include developing a comprehensive and coordinated national  CIP plan, improving information sharing on threats and vulnerabilities,  improving analysis and warning capabilities, and ensuring appropriate  incentives to encourage entities outside of the federal government to  increase their CIP efforts. Both define strategic objectives for  protecting our nation’s critical assets. Such capabilities  need to address both cyber and physical threats. Some of these tools are already being used.
Why GAO Did This Study

Protecting the computer systems that support federal agencies' operations and our nation's critical infrastructures--such as power distribution, telecommunications, water supply, and national defense--is a continuing concern. These concerns are well-founded for a number of reasons, including the dramatic increases in reported computer security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks. GAO first designated computer security as high risk in 1997, and in 2003 expanded this high-risk area to include protecting the systems that support our nation's critical infrastructures, referred to as cyber critical infrastructure protection or cyber CIP. GAO has made previous recommendations and periodically testified on federal information security weaknesses--including agencies' progress in implementing key legislative provisions on information security--and the challenges that the nation faces in protecting our nation's critical infrastructures. GAO was asked to provide an update on the status of federal information security and CIP.

What GAO Found

With the enactment of the Federal Information Security Management Act of 2002, the Congress continued its efforts to improve federal information security by permanently authorizing and strengthening key information security requirements. The administration has also made progress through a number of efforts, among them the Office of Management and Budget's emphasis of information security in the budget process. However, significant information security weaknesses at 24 major agencies continue to place a broad array of federal operations and assets at risk of fraud, misuse, and disruption. Although recent reporting by these agencies showed some improvements, GAO found that agencies still have not established information security programs consistent with the legal requirements. For example, periodic testing of security controls is essential to security program management, but for fiscal year 2002, 14 agencies reported they had tested the controls of less than 60 percent of their systems. Further information security improvement efforts are also needed at the governmentwide level, and these efforts need to be guided by a comprehensive strategy in which roles and responsibilities are clearly delineated, appropriate guidance is given, adequate technical expertise is obtained, and sufficient agency information security resources are allocated. Although improvements have been made in protecting our nation's critical infrastructures and continuing efforts are in progress, further efforts are needed to address critical challenges that GAO has identified over the last several years. These challenges include: (1) developing a comprehensive and coordinated national CIP plan; (2) improving information sharing on threats and vulnerabilities between the private sector and the federal government, as well as within the government itself; (3) improving analysis and warning capabilities for both cyber and physical threats; and (4) encouraging entities outside the federal government to increase their CIP efforts.