Recent attacks and threats have further underscored the need to  bolster the cybersecurity of our government's and our nation's  computer systems and, more importantly, of the critical operations  and infrastructures they support. Prior Reports Identified DHS’s Efforts to Fulfill Cybersecurity Responsibilities

As the focal point for critical infrastructure protection, the  Department of Homeland Security (DHS) has many cybersecurity- related roles and responsibilities that are called for in law and  policy. Since that report was issued, DHS has made progress on its  responsibilities, but none have been completely addressed. The department had also  started a variety of initiatives to improve the nation’s ability to  recover from Internet disruptions, including establishing working  groups to facilitate coordination and exercises in which government  and private industry practice responding to cyber events. Also, the relationships  among these initiatives were not evident. Key challenges in fulfilling DHS’s broad  responsibilities include increasing awareness about cybersecurity  roles and capabilities, establishing effective partnerships with  stakeholders, achieving two-way information sharing with these  stakeholders, and demonstrating the value it can provide to private  sector infrastructure owners. Key challenges to establishing a plan  for recovering from Internet disruptions include addressing innate  characteristics of the Internet that make planning for and  responding to disruptions difficult, achieving consensus on DHS’s  role and on when the department should get involved in responding  to a disruption, addressing legal issues affecting DHS’s ability to  provide assistance to restore Internet service, and overcoming  reluctance of many in the private sector to share information on  Internet disruptions with DHS. Further, the department faces a  particular challenge in attaining the organizational stability and  leadership it needs to gain the trust of other stakeholders in the  cybersecurity world—including other government agencies as well  as the private sector. In May 2005, we reported that multiple senior DHS cybersecurity  officials had recently left the department. In July 2005, DHS underwent a reorganization which elevated  responsibility for cybersecurity to an assistant secretary position. NCSD and the National Communication System were placed in the  Preparedness Directorate under a new position, called the Assistant  Secretary of Cyber Security and Telecommunications—in part to  raise the visibility of cybersecurity issues in the department. However, over a year later, this position remains vacant. Implementation of GAO’s Recommendations Should Enhance DHS’s Ability to Fulfill Cybersecurity Responsibilities and Address Challenges

To strengthen DHS’s ability to implement its cybersecurity  responsibilities and to resolve underlying challenges, GAO has made  about 25 recommendations over the last several years. These  recommendations focus on the need to (1) conduct threat and  vulnerability assessments, (2) develop a strategic analysis and  warning capability for identifying potential cyber attacks, (3) protect  infrastructure control systems, (4) enhance public/private  information sharing, and (5) facilitate recovery planning, including  recovery of the Internet in case of a major disruption. Together, the recommendations provide a high-level roadmap for  DHS to use to improve our nation’s cybersecurity posture. Until it  addresses these recommendations, DHS will have difficulty  achieving results in its role as a federal focal point for cybersecurity  of critical infrastructures. Threat and Vulnerability Assessments: In May 2005, we reported  that while DHS had made progress in planning and coordinating  efforts to enhance cybersecurity, much more work remained to be  done for the department to fulfill its basic responsibilities— including conducting important threat and vulnerability  assessments. More recently,  in June 2006, we reported that DHS had begun a variety of initiatives  to fulfill its responsibility for developing an integrated public/private  plan for Internet recovery, but that these efforts were not complete  or comprehensive. Coordinating and integrating applicable national preparedness goals with its National  Infrastructure Protection Plan.
Why GAO Did This Study

Increasing computer interconnectivity has revolutionized the way that our nation and much of the world communicate and conduct business. While the benefits have been enormous, this widespread interconnectivity also poses significant risks to our nation's computer systems and, more importantly, to the critical operations and infrastructures they support. The Homeland Security Act of 2002 and federal policy establish DHS as the focal point for coordinating activities to protect the computer systems that support our nation's critical infrastructures. GAO was asked to summarize recent reports on (1) DHS's responsibilities for cybersecurity-related critical infrastructure protection and for recovering the Internet in case of a major disruption (2) challenges facing DHS in addressing its cybersecurity responsibilities, including leadership challenges, and (3) recommendations to improve the cybersecurity of national critical infrastructures, including the Internet.

What GAO Found

In 2005 and 2006, GAO reported that DHS had initiated efforts to address its responsibilities for enhancing the cybersecurity of critical infrastructures, but that more remained to be done. Specifically, in 2005, GAO reported that DHS had initiated efforts to fulfill 13 key cybersecurity responsibilities, but it had not fully addressed any of them. For example, DHS established forums to foster information sharing among federal officials with information security responsibilities and among various law enforcement entities, but had not developed national threat and vulnerability assessments for cybersecurity. Since that time, DHS has made progress on its 13 key responsibilities--including the release of its National Infrastructure Protection Plan--but none have been completely addressed. Moreover, in 2006, GAO reported that DHS had begun a variety of initiatives to fulfill its responsibility to develop an integrated public/private plan for Internet recovery, but these efforts were not complete or comprehensive. For example, DHS established working groups to facilitate coordination among government and industry infrastructure officials and fostered exercises in which government and private industry could practice responding to cyber events, but many of its efforts lacked timeframes for completion and the relationships among its various initiatives were not evident. DHS faces a number of challenges that have impeded its ability to fulfill its cybersecurity responsibilities, including establishing effective partnerships with stakeholders, demonstrating the value it can provide to private sector infrastructure owners, and reaching consensus on DHS's role in Internet recovery and on when the department should get involved in responding to an Internet disruption. DHS faces a particular challenge in attaining the organizational stability and leadership it needs to gain the trust of other stakeholders in the cybersecurity world--including other government agencies as well as the private sector. In May 2005, we reported that multiple senior DHS cybersecurity officials had recently left the department. In July 2005, DHS undertook a reorganization which established the position of the Assistant Secretary of Cyber Security and Telecommunications--in part to raise the visibility of cybersecurity issues in the department. However, over a year later, this position remains vacant. To strengthen DHS's ability to implement its cybersecurity responsibilities and to resolve underlying challenges, GAO has made about 25 recommendations over the last several years. These recommendations focus on the need to (1) conduct threat and vulnerability assessments, (2) develop a strategic analysis and warning capability for identifying potential cyber attacks, (3) protect infrastructure control systems, (4) enhance public/private information sharing, and (5) facilitate recovery planning, including recovery of the Internet in case of a major disruption. These recommendations provide a high-level road map for DHS to use to help improve our nation's cybersecurity posture. Until they are addressed, DHS will have difficulty achieving results as the federal cybersecurity focal point.