Objectives, Scope, and Methodology

The objectives of our review were to (1) identify DOD’s incident response  capabilities and how these capabilities are being implemented and  (2) identify challenges to improving these capabilities. In addition, the Defense Advanced  Research Projects Agency is funding research to develop more  sophisticated intrusion detection systems. Conclusions

DOD has established significant incident response capabilities at the  military services and mechanisms for centrally coordinating information  assurance activities and incident response capabilities through DIAP and  JTF-CND, respectively. However, DOD faces challenges in improving the  effectiveness of its incident response capabilities, including  (1) coordinating resource planning and priorities for incident response  across the department; (2) integrating critical data from heterogeneous  systems, sensors, and other devices to better monitor cyber events and  attacks; (3) establishing a departmentwide process to periodically and  systematically review systems and networks on a priority basis for security  weaknesses; (4) ensuring that components across the department  consistently report compliance with vulnerability alerts; (5) improving the  coordination of component-level incident response actions; and  (6) developing departmentwide performance measures to assess incident  response capabilities and thus better ensure mission readiness. Comments From the Department of Defense

	Ordering Information

The first copy of each GAO report is free.
Why GAO Did This Study

This report reviews the department of Defense's (DOD) implementation of computer incident response capabilities and identifies challenges to improving these.

What GAO Found

GAO found that during the last several years, DOD has taken several steps to build incident response capabilities and enhance computer defensive capabilities across the Department, including the creation of computer emergency response teams and incident response capabilities within each of the military services as well as the Defense Information Systems Agency and the Defense Logistics Agency. DOD also created the Joint Task Force-Computer Network Defense (JTF-CND) to coordinate and direct the full range of activities within the Department associated with incident response. GAO identified the following six areas in which DOD faces challenges in improving its incident response capabilities: (1) coordinating resource planning and prioritization activities; (2) integrating critical data from intrusion detection systems, sensors, and other devices to better monitor cyber events and attacks; (3) establishing departmentwide process to periodically review systems and networks for security weaknesses; (4) increasing individual unit compliance with departmentwide vulnerability alerts; (5) improving DOD's system for coordinating component-level incident response actions; and (6) developing departmentwide performance measures to assess incident response capabilities.