Feds falling behind in the race against cyber threats, GAO says

Despite increased cooperation among agencies charged with protecting the government’s information infrastructure, federal cybersecurity is failing to keep pace with the growing threat of attack from hackers, criminals and other nations, a Senate panel has been told.

The Government Accountability Office has identified weaknesses in security controls in almost all agencies for years, Gregory Wilshusen, GAO's director of information security issues, and David Powner, the agency's director of information technology management issues, told the Senate Judiciary Committee's Terrorism and Homeland Security Subcommittee Nov. 17. Agencies are falling short in their use of strong authentication, encryption, and network monitoring, they said.

“An underlying cause of these weaknesses is agencies’ failure to fully or effectively implement information security programs, which entails assessing and managing risk, developing and implementing security policies and procedures, promoting security awareness and training, monitoring the adequacy of security controls, and implementing appropriate remedial actions,” they testified.

These weaknesses are persisting at a time when the number and the types of threats facing the nation’s public and private critical infrastructures are growing. Between fiscal 2006 and 2008, the number of incidents reported by agencies to the Homeland Security Department’s US-CERT more than tripled, from 5,503 to 16,843.

The Director of National Intelligence has said government and private IT systems are being targeted, sometimes apparently by foreign nations, with coordinated attacks. These include attacks reported as recently as July against U.S. systems. He also cited the apparent coordination of cyber attacks against the nation of Georgia during hostilities with Russia in August 2008.

“The director expects disruptive cyber activities to become the norm in future political and military conflicts,” GAO said.

GAO singled out DHS, saying “that DHS has yet to fully satisfy its key responsibilities for protecting these critical infrastructures,” in its role as lead agency for the government’s cyber defense. The officials said that DHS “needs to fulfill its responsibilities, such as developing capabilities for protecting cyber-reliant critical infrastructures and implementing lessons learned from a major cyber simulation exercise.”

DHS Undersecretary Philip Reitinger, head of the National Protection and Programs Directorate, and director of the National Cyber Security Center, responded by saying, “DHS is upgrading the federal government’s capabilities to secure and defend against threats from individuals or organizations in cyberspace.”

Under its National Cybersecurity Protection System, DHS is working to implement the EINSTEIN network flow monitoring and IDS system for federal networks. The depaetment also is helping with Trusted Internet Connections program to bring government connections under control, helping to develop a supply chain risk management program, coordinating private sector incident response plans, and facilitating information sharing between the private sector and government.

National cybersecurity is becoming a more cooperative effort, Richard Schaeffer, the National Security Agency’s (NSA) information assurance director, told the subcommittee. NSA traditionally has had responsibility for protecting designated National Security Systems, found largely in the military and intelligence communities.

“Today, national security systems are heavily dependent on commercial products and infrastructures, or interconnect with systems that are,” Schaeffer said. “More and more we find that protecting national security systems demands teaming with public and private institutions.”

NSA has collaborated in development of standards for automating cybersecurity, including the Security Content Automation Protocol, Common Vulnerability Enumeration and Federal Desktop Core Configuration. This cooperation is being continued in the Joint Task Force Transformation Initiative, a partnership between the National Institute of Standards and Technology, the Office of the Director of National Intelligence, the Defense Department and the Committee on National Security Systems to create a common information security framework for agencies and contractors.

GAO has proposed a number of improvements to the Federal Information Security Management Act, including:

• Clarifying requirements for testing and evaluating security controls,
• Requiring agency heads to provide an assurance statement on the overall adequacy and effectiveness of the agency’s information security program,
• Enhancing independent annual evaluations.
• Strengthening annual reporting mechanisms.

The agency also met with panels of cybersecurity experts, including former federal officials, academics, and private sector executives, who identified a dozen key improvements that are, in their view, essential to improving the national cybersecurity posture. These are:

• Developing a national strategy that clearly articulates strategic objectives, goals, and priorities.
• Establishing White House responsibility and accountability for leading and overseeing national cybersecurity policy.
• Establishing a governance structure for strategy implementation.
• Publicizing and raising awareness about the seriousness of the cybersecurity problem.
• Creatikng an accountable, operational cybersecurity organization.
• Focuing more actions on prioritizing assets, assessing vulnerabilities, and reducing vulnerabilities than on developing additional plans.
• Bolstering public/private partnerships through an improved value proposition and use of incentives.
• Focusing  greater attention on addressing the global aspects of cyberspace.
• Improving law enforcement efforts to address malicious activities in cyberspace.
• Placikng greater emphasis on cybersecurity research and development, including consideration of how to better coordinate government and private sector efforts.
• Increasing the cadre of cybersecurity professionals.
• Making the federal government a model for cybersecurity, including using its acquisition function to enhance cybersecurity aspects of products and services.

Schaeffer warned that improvements would not come quickly or easily, but that they are possible.

“There are no ‘silver bullets’ when it comes to cybersecurity,” he said. “But over time, increased awareness of cybersecurity issues, new standards, better education, expanded information sharing, more uniform practices, and improved technology can and does make a meaningful difference.”