Ineffective protection of these information systems and networks can  result in a failure to deliver these vital services, and result in  loss or theft of computer resources, assets, and funds;  inappropriate access to and disclosure, modification, or destruction of  sensitive information, such as national security information, PII, and  proprietary business information; disruption of essential operations supporting critical infrastructure,  national defense, or emergency services; undermining of agency missions due to embarrassing incidents that  erode the public’s confidence in government; use of computer resources for unauthorized purposes or to launch  attacks on other systems; damage to networks and equipment; and high costs for remediation. These laws include the Federal Information Security Modernization Act of  2014 (FISMA), which, among other things, authorizes DHS to (1) assist  the Office of Management and Budget (OMB) with overseeing and  monitoring agencies’ implementation of security requirements; (2) operate  the federal information security incident center; and (3) provide agencies  with operational and technical assistance, such as that for continuously  diagnosing and mitigating cyber threats and vulnerabilities. The Federal Government Faces an Evolving Array of Cyber-Based Threats

Risks to cyber-based assets can originate from unintentional or  intentional threats. Unintentional threats can be caused by, among other  things, natural disasters, defective computer or network equipment, and  careless or poorly trained employees. These inherent advantages, combined  with the increasing sophistication of cyber tools and techniques, allow  threat actors to target government agencies and their contractors,  potentially resulting in the disclosure, alteration, or loss of sensitive  information, including PII; theft of intellectual property; destruction or  disruption of critical systems; and damage to economic and national  security. Since fiscal year 2006, the number of information security incidents  affecting systems supporting the federal government has steadily  increased each year: rising from 5,503 in fiscal year 2006 to 67,168 in  fiscal year 2014, an increase of 1,121 percent. We and agency inspectors general  have identified challenges in protecting federal information and systems,  including those in the following key areas:
Designing and implementing risk-based cybersecurity programs  at federal agencies. Specifically, for fiscal year 2014, 19 of the 24  federal agencies covered by the Chief Financial Officers (CFO) Actreported that information security control deficiencies were either a  material weakness or a significant deficiency in internal controls over   Moreover, inspectors general at 23 of the 24  their financial reporting.agencies cited information security as a major management challenge  for their agency. We  and agency inspectors general have made hundreds of  recommendations to agencies aimed at improving their  implementation of these information security controls. Enhancing oversight of contractors providing IT services. We also  made one recommendation to OPM and the agency concurred, but  has not yet implemented this recommendation. Improving security incident response activities. Responding to breaches of PII. Implementing security programs at small agencies. Until federal agencies take actions to address these challenges— including implementing the hundreds of recommendations we and  inspectors general have made—federal systems and information will be  at an increased risk of compromise from cyber-based attacks and other  threats. Government-wide Cybersecurity Initiatives Present Potential Benefits and Challenges

In addition to the efforts of individual agencies, DHS and OMB have  several initiatives under way to enhance cybersecurity across the federal  government. Subsequently,  NIST defined requirements for such personal identity verification (PIV)  credentials based on “smart cards”—plastic cards with integrated circuit  chips to store and process data—and OMB directed federal agencies to  issue and use PIV credentials to control access to federal facilities and  systems. National Cybersecurity Protection System (NCPS): The National  Cybersecurity Protection System, operationally known as “EINSTEIN,” is  a suite of capabilities intended to detect and prevent malicious network  traffic from entering and exiting federal civilian government networks. Our final report is expected to be released later this year, and our  preliminary observations include the following:
DHS appears to have developed and deployed aspects of the  intrusion detection and intrusion prevention capabilities, but potential  weaknesses may limit their ability to detect and prevent computer  intrusions. While recent  government-wide initiatives hold promise for bolstering the federal  cybersecurity posture, it is important to note that no single technology or  set of practices is sufficient to protect against all these threats. A “defense  in depth” strategy is required that includes well-trained personnel,  effective and consistently applied processes, and appropriately  implemented technologies. Cybersecurity: Actions Needed to Address Challenges Facing Federal  Systems. Cybersecurity: Challenges in Securing the Electricity Grid.
Why GAO Did This Study

Effective cybersecurity for federal information systems is essential to preventing the loss of resources, the compromise of sensitive information, and the disruption of government operations. Since 1997, GAO has designated federal information security as a government-wide high-risk area, and in 2003 expanded this area to include computerized systems supporting the nation's critical infrastructure. Earlier this year, in GAO's high-risk update, the area was further expanded to include protecting the privacy of personal information that is collected, maintained, and shared by both federal and nonfederal entities.
This statement summarizes (1) cyber threats to federal systems, (2) challenges facing federal agencies in securing their systems and information, and (3) government-wide initiatives aimed at improving cybersecurity. In preparing this statement, GAO relied on its previously published and ongoing work in this area.

What GAO Found

Federal systems face an evolving array of cyber-based threats. These threats can be unintentional—for example, from equipment failure or careless or poorly trained employees; or intentional—targeted or untargeted attacks from criminals, hackers, adversarial nations, or terrorists, among others. Threat actors use a variety of attack techniques that can adversely affect federal information, computers, software, networks, or operations, potentially resulting in the disclosure, alteration, or loss of sensitive information; destruction or disruption of critical systems; or damage to economic and national security. These concerns are further highlighted by recent incidents involving breaches of sensitive data and the sharp increase in information security incidents reported by federal agencies over the last several years, which have risen from 5,503 in fiscal year 2006 to 67,168 in fiscal year 2014.
GAO has identified a number of challenges federal agencies face in addressing threats to their cybersecurity. For example, agencies have been challenged with designing and implementing risk-based cybersecurity programs, as illustrated by 19 of 24 major agencies declaring cybersecurity as a significant deficiency or material weakness for financial reporting purposes. Other challenges include:
enhancing oversight of contractors providing IT services,
improving security incident response activities,
responding to breaches of personal information, and
implementing cybersecurity programs at small agencies.
Until federal agencies take actions to address these challenges—including implementing the hundreds of recommendations GAO and agency inspectors general have made—federal systems and information will be at an increased risk of compromise from cyber-based attacks and other threats.
Several government-wide initiatives are under way to bolster cybersecurity.
Personal Identity Verification: The President and the Office of Management and Budget (OMB) directed agencies to issue credentials with enhanced security features to control access to federal facilities and systems. OMB recently reported that only 41 percent of user accounts at 23 civilian agencies had required these credentials to access agency systems.
Continuous Diagnostics and Mitigation: This program is to provide agencies with tools for continuously monitoring cybersecurity risks. The Department of State adopted a continuous monitoring program, and GAO reported on the benefits and challenges in implementing the program.
National Cybersecurity Protection System: This system is to provide capabilities for monitoring network traffic and detecting and preventing intrusions. GAO has ongoing work reviewing the system's implementation. Preliminary observations indicate that implementation of the intrusion detection and prevention capabilities may be limited and requirements for future capabilities appear to have not been fully defined.
While these initiatives are intended to improve security, no single technology or tool is sufficient to protect against all cyber threats. Rather, agencies need to employ a multi-layered approach to security that includes well-trained personnel, effective and consistently applied processes, and appropriate technologies.

What GAO Recommends

In previous work, GAO and agency inspectors general have made hundreds of recommendations to assist agencies in addressing cybersecurity challenges. GAO has also made recommendations to improve government-wide initiatives.