In addition, the law requires agencies to develop, document, and  implement an agency-wide information security program to secure federal  information systems. Among these programs, NCPS  provides a capability to detect and prevent potentially malicious network  traffic from entering agencies’ networks. The department had also identified needs for future capabilities, but had  not defined requirements for the capability to detect threats entering and  exiting cloud service providers. By utilizing defense in depth, federal agencies can  reduce the risk of a successful cyberattack by implementing intrusion  detection and prevention capabilities. Selected Agencies Were Not Effectively Implementing the Federal Government’s Approach and Strategy to Securing Information Systems

According to inspectors general, agency CIOs, and OMB reports on  federal information security practices, many agencies were not effectively  implementing the federal government’s approach and strategy to securing  information systems as of fiscal year 2017. OMB Determined That 13 of the 23 Civilian CFO Act Agencies Were Managing Cybersecurity Risk

In Executive Order 13800, the President directed OMB, in coordination  with DHS, to assess and report to the executive branch on the sufficiency  and appropriateness of federal agencies’ processes for managing  cybersecurity risks. When considering each of the five core security functions, OMB  reported that most of the 23 agencies were at risk or at high risk with  regard to the identify and protect core security functions. Less than half of  the 23 agencies were at risk with regard to the detect, respond, and  recover core security functions. DHS and OMB Facilitated the Use of Intrusion Detection and Prevention Capabilities to Secure Federal Agency Systems, but Further Efforts Remain

DHS and OMB, as required by law and policy, have taken various actions  to facilitate the agencies’ use of intrusion detection and prevention  capabilities to secure federal systems. Further, CDM was behind at meeting planned implementation dates, and  agencies have requested additional training and guidance for these  services. For  example, officials at 13 of 23 agencies stated that not all of their agency  external network traffic flowed through NCPS. Nevertheless, most agencies told us that they wanted DHS to provide  more training and guidance as it relates to their implementation of the  capabilities made available by NCPS and CDM. The act required that the report address (1) the effectiveness of DHS’s  system used for detecting, disrupting, and preventing cyber-threat actors,  including advanced persistent threats, from accessing agency information  and agency information systems; (2) whether the intrusion detection and  prevention capabilities, continuous diagnostics and mitigation, and other  systems deployed are effective in securing federal information systems;  (3) the costs and benefits of the intrusion detection and prevention  capabilities, including as compared to commercial technologies and tools,  and including the value of classified cyber threat indicators; and (4) the  capability of agencies to protect sensitive cyber threat indicators and  defensive measures if they were shared through unclassified  mechanisms for use in commercial technologies and tools. In addition, most of the  agencies did not fully implement any of the phases of DHS’s CDM  program that is intended to improve their capabilities to detect and  prevent intrusions. As a result,  federal systems will remain at risk until the program is fully deployed. For example, the  inspectors general for 17 of the 23 selected agencies reported that their  agencies had not effectively implemented their information security  programs and had significant information security deficiencies associated  with internal control over financial reporting. In addition, CIOs for 17  agencies reported not meeting all nine targets for the cybersecurity cross- agency priority goal. Further, OMB determined that that only 13 of the 23  agencies were managing risks to their overall enterprise, while the other  10 agencies were at risk. (Recommendation 5)
The Director of OMB should direct the Federal CIO to update her  report to Congress to include required information, such as detecting  advanced persistent threats, a comparison of the costs and benefits of  the capabilities versus commercial technologies and tools, and the  capability of agencies to protect sensitive cyber threat indicators and  defense measures. However, OMB’s reports did not cover all outcomes described in the act. Accordingly, we maintain that our  recommendations for OMB to report on required elements in the Federal  Cybersecurity Enhancement Act of 2015 are warranted. In its comments, DHS stated that it concurred with the two  recommendations we made to the department. The objectives of our review were to assess: (1)  the reported effectiveness of selected agencies’ implementation of the  federal government’s approach and strategy to securing agency  information systems; (2) the extent to which the Office of Management  and Budget (OMB) and the Department of Homeland Security (DHS)  have facilitated the use of intrusion detection and prevention capabilities  to secure federal agency information systems; and (3) the extent to which  selected agencies reported implementing intrusion detection and  prevention capabilities. To assess the reported effectiveness of agencies’ implementation of the  federal government’s approach and strategy to securing agency  information systems, we described the federal government’s approach and strategy by  summarizing the Federal Information Security Modernization Act of  2014 (FISMA), Executive Order 13800, Strengthening the  Cybersecurity of Federal Networks and Critical Infrastructure, and the  National Institute of Standards and Technology’s (NIST) Framework  for Improving Critical Infrastructure Cybersecurity (cybersecurity  framework). We also summarized IG reported conclusions on the effectiveness of  agencies’ information security programs for fiscal year 2017.  reviewed the fiscal year 2016 and 2017 financial statement audit  reports for each of the 23 civilian CFO Act agencies to identify the  extent to which any significant deficiencies or material weaknesses  related to information security over financial systems had been  reported and to identify information security control weaknesses  reported by the IGs. To assess the extent to which selected agencies reported implementing  intrusion detection and prevention capabilities, we described the reported  intrusion detection and prevention capabilities implemented by the 23  civilian CFO Act civilian agencies by  summarizing implemented intrusion detection and prevention  capability information obtained from the semi-structured interviews at  the 23 civilian CFO Act agencies described above;  identifying the extent to which the 23 civilian CFO Act agencies were  in compliance with DHS’s binding operating directive (BOD) pertaining  to enhanced email and web security (BOD 18-01) by collecting and  summarizing Cyber Hygiene Trustworthy Email reports from the 23  agencies and determining the extent to which the agencies had taken  required actions to implement the BOD.
Why GAO Did This Study

Federal agencies are dependent on information systems to carry out operations. The risks to these systems are increasing as security threats evolve and become more sophisticated. To reduce the risk of a successful cyberattack, agencies can deploy intrusion detection and prevention capabilities on their networks and systems.
GAO first designated federal information security as a government-wide high-risk area in 1997. In 2015, GAO expanded this area to include protecting the privacy of personally identifiable information. Most recently, in September 2018, GAO updated the area to identify 10 critical actions that the federal government and other entities need to take to address major cybersecurity challenges.
The federal approach and strategy for securing information systems is grounded in the provisions of the Federal Information Security Modernization Act of 2014 and Executive Order 13800. The act requires agencies to develop, document, and implement an agency-wide program to secure their information systems. The Executive Order, issued in May 2017, directs agencies to use the National Institute of Standards and Technology's cybersecurity framework to manage cybersecurity risks.
The Federal Cybersecurity Enhancement Act of 2015 contained a provision for GAO to report on the effectiveness of the government's approach and strategy for securing its systems. GAO determined (1) the reported effectiveness of agencies' implementation of the government's approach and strategy; (2) the extent to which DHS and OMB have taken steps to facilitate the use of intrusion detection and prevention capabilities to secure federal systems; and (3) the extent to which agencies reported implementing capabilities to detect and prevent intrusions.
To address these objectives, GAO analyzed OMB reports related to agencies' information security practices including OMB's annual report to Congress for fiscal year 2017. GAO also analyzed and summarized agency-reported security performance metrics and IG-reported information for the 23 civilian CFO Act agencies. In addition, GAO evaluated plans, reports, and other documents related to DHS intrusion detection and prevention programs, and interviewed OMB, DHS, and agency officials.

What GAO Found

The 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act) have often not effectively implemented the federal government's approach and strategy for securing information systems (see figure below). Until agencies more effectively implement the government's approach and strategy, federal systems will remain at risk. To illustrate:
As required by Office of Management and Budget (OMB), inspectors general (IGs) evaluated the maturity of their agencies' information security programs using performance measures associated with the five core security functions—identify, protect, detect, respond, and recover. The IGs at 17 of the 23 agencies reported that their agencies' programs were not effectively implemented.
IGs also evaluated information security controls as part of the annual audit of their agencies' financial statements, identifying material weaknesses or significant deficiencies in internal controls for financial reporting at 17 of the 23 civilian CFO Act agencies.
Chief information officers (CIOs) for 17 of the 23 agencies reported not meeting all elements of the government's cybersecurity cross-agency priority goal. The goal was intended to improve cybersecurity performance through, among other things, maintaining ongoing awareness of information security, vulnerabilities, and threats; and implementing technologies and processes that reduce malware risk.
Executive Order 13800 directed OMB, in coordination with the Department of Homeland Security (DHS), to assess and report on the sufficiency and appropriateness of federal agencies' processes for managing cybersecurity risks. Using performance measures for each of the five core security functions, OMB determined that 13 of the 23 agencies were managing overall enterprise risks, while the other 10 agencies were at risk. In assessing agency risk by core security function, OMB identified a few agencies to be at high risk (see figure at the top of next page).
DHS and OMB facilitated the use of intrusion detection and prevention capabilities to secure federal agency systems, but further efforts remain. For example, in response to prior GAO recommendations, DHS had improved the capabilities of the National Cybersecurity Protection System (NCPS), which is intended to detect and prevent malicious traffic from entering agencies' computer networks. However, the system still had limitations, such as not having the capability to scan encrypted traffic. The department was also in the process of enhancing the capabilities of federal agencies to automate network monitoring for malicious activity through its Continuous Diagnostics and Mitigation (CDM) program. However, the program was running behind schedule and officials at most agencies indicated the need for additional training and guidance. Further, the Federal CIO issued a mandated report assessing agencies' intrusion detection and prevention capabilities, but the report did not address required information, such as the capability of NCPS to detect advanced persistent threats, and a cost/benefit comparison of capabilities to commercial technologies and tools.
Selected agencies had not consistently implemented capabilities to detect and prevent intrusions into their computer networks. Specifically, the agencies told GAO that they had not fully implemented required actions for protecting email, cloud services, host-based systems, and network traffic from malicious activity. For example, 21 of 23 agencies had not, as of September 2018, sufficiently enhanced email protection through implementation of DHS' directive on enhanced email security. In addition, less than half of the agencies that use cloud services reported monitoring these services. Further, most of the selected 23 agencies had not fully implemented the tools and services available through the first two phases of DHS's CDM program. Until agencies more thoroughly implement capabilities to detect and prevent intrusions, federal systems and the information they process will be vulnerable to malicious threats.

What GAO Recommends

GAO is making two recommendations to DHS, to among other things, coordinate with agencies to identify additional needs for training and guidance. GAO is also making seven recommendations to OMB to, among other things, direct the Federal CIO to update the mandated report with required information, such as detecting advanced persistent threats. DHS concurred with GAO's recommendations. OMB did not indicate whether it concurred with the recommendations or not.