This is the accessible text file for GAO report number GAO-11-463T 
entitled 'Cybersecurity: Continued Attention Needed to Protect Our 
Nation's Critical Infrastructure and Federal Information Systems' 
which was released on March 16, 2011. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Testimony: 

Before the Subcommittee on Cybersecurity, Infrastructure Protection, 
and Security Technologies, Committee on Homeland Security, House of 
Representatives: 

For Release on Delivery: 
Expected at 10:00 a.m. EDT:
Wednesday, March 16, 2011: 

Cybersecurity: 

Continued Attention Needed to Protect Our Nation's Critical 
Infrastructure and Federal Information Systems: 

Statement of Gregory C. Wilshusen,
Director Information Security Issues: 

GAO-11-463T: 

GAO Highlights: 

Highlights of GAO-11-463T, a testimony before the Subcommittee on 
Cybersecurity, Infrastructure Protection, and Security Technologies, 
Committee on Homeland Security, House of Representatives. 

Why GAO Did This Study: 

Pervasive and sustained cyber attacks continue to pose a potentially 
devastating threat to the systems and operations of our nationís 
critical infrastructure and the federal government. In recent 
testimony, the Director of National Intelligence stated that there 
had been a dramatic increase in malicious cyber activity targeting 
U.S. computers and networks. In addition, recent reports of cyber 
attacks and incidents affecting federal systems and critical 
infrastructures illustrate the potential impact of such events on 
national and economic security. The nationís ever-increasing 
dependence on information systems to carry out essential everyday 
operations makes it vulnerable to an array of cyber-based risks. 
Thus it is increasingly important that federal and nonfederal 
entities carry out concerted efforts to safeguard their systems 
and the information they contain. 

GAO is providing a statement describing (1) cyber threats to 
cyber-reliant critical infrastructures and federal information 
systems and (2) the continuing challenges facing federal agencies 
in protecting the nationís cyber-reliant critical infrastructure 
and federal systems. In preparing this statement, GAO relied on 
its previously published work in the area, which included many 
recommendations for improvement. 

What GAO Found: 

Cyber-based threats to critical infrastructure and federal systems are 
evolving and growing. These threats can come from a variety of sources, 
including criminals and foreign nations, as well as hackers and 
disgruntled employees. These potential attackers have a variety of 
techniques at their disposal that can vastly expand the reach and 
impact of their actions. In addition, the interconnectivity between 
information systems, the Internet, and other infrastructure presents 
increasing opportunities for such attacks. Consistent with this, 
reports of security incidents from federal agencies are on the rise, 
increasing over 650 percent over the past 5 years. In addition, reports 
of cyber attacks and information security incidents affecting federal 
systems and systems supporting critical infrastructure illustrate the 
serious impact such incidents can have on national and economic security, 
including the loss of classified information and intellectual property 
worth millions of dollars. 

The administration and executive branch agencies continue to act to 
better protect cyber-reliant critical infrastructures, improve the 
security of federal systems, and strengthen the nationís cybersecurity 
posture. However, they have not yet fully implemented key actions that 
are intended to address threats and improve the current U.S. approach 
to cybersecurity, such as: 

* implementing near- and mid-term actions recommended by the 
cybersecurity policy review directed by the president;

* updating the national strategy for securing the information and 
communications infrastructure;

* developing a comprehensive national strategy for addressing global 
cybersecurity and governance; and; 

* creating a prioritized national and federal research and development 
agenda for improving cybersecurity. 

Federal systems continue to be afflicted by persistent information 
security control weaknesses. For example, as part of its audit of the 
fiscal year 2010 financial statements for the U.S. government, GAO 
determined that serious and widespread information security control 
deficiencies were a governmentwide material weakness. Over the past 
several years, GAO and agency inspectors general have made hundreds of 
recommendations to agencies for actions necessary to resolve prior 
significant control deficiencies and information security program 
shortfalls. The White House, the Office of Management and Budget, and 
selected federal agencies have undertaken additional governmentwide 
initiatives intended to enhance information security at federal agencies. 
However, these initiatives face challenges, such as better defining 
agency roles and responsibilities and establishing measures of 
effectiveness, and require sustained attention, which agencies have 
begun to provide. 

As such, GAO continues to identify protecting the federal governmentís 
information systems and the nationís cyber critical infrastructure as 
a governmentwide high-risk area. 

View GAO-11-463T or key components. For more information, contact 
Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. 

[End of section] 

Chairman Lungren, Ranking Member Clarke, and Members of the 
Subcommittee: 

Thank you for the opportunity to testify at today's hearing on the 
cyber threats to critical infrastructure and the American economy. 

Pervasive and sustained cyber attacks against the United States 
continue to pose a potentially devastating impact on federal and 
nonfederal systems and operations. In February 2011, the Director of 
National Intelligence testified that, in the past year, there had been 
a dramatic increase in malicious cyber activity targeting U.S. 
computers and networks, including a more than tripling of the volume 
of malicious software since 2009.[Footnote 1] Recent press reports 
that computer hackers broke into and stole proprietary information 
worth millions of dollars from the networks of six U.S. and European 
energy companies also demonstrate the risk that our nation faces. Such 
attacks highlight the importance of developing a concerted response to 
safeguard federal and nonfederal information systems. 

Mr. Chairman, GAO recently issued its high-risk list of government 
programs that have greater vulnerability to fraud, waste, abuse, and 
mismanagement or need transformation to address economy, efficiency, 
or effectiveness challenges.[Footnote 2] Once again, we identified 
protecting the federal government's information systems and the 
nation's cyber critical infrastructure as a governmentwide high-risk 
area. We have designated federal information security as a high-risk 
area since 1997; in 2003, we expanded this high-risk area to include 
protecting systems supporting our nation's critical infrastructure, 
referred to as cyber critical infrastructure protection or cyber CIP. 

In my testimony today I will describe (1) cyber threats to cyber- 
reliant critical infrastructures and federal information systems and 
(2) the continuing challenges federal agencies face in protecting the 
nation's cyber-reliant critical infrastructures and federal systems. 
In preparing this statement in March 2011, we relied on our previous 
work in these areas (please see the related GAO products page at the 
end of this statement). These products contain detailed overviews of 
the scope and methodology we used. The work on which this statement is 
based was performed in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform 
audits to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provided a 
reasonable basis for our findings and conclusions based on our audit 
objectives. 

Background: 

As computer technology has advanced, federal agencies and our nation's 
critical infrastructures[Footnote 3]--such as power distribution, 
water supply, telecommunications, and emergency services--have become 
increasingly dependent on computerized information systems to carry 
out their operations and to process, maintain, and report essential 
information. Public and private organizations rely on computer systems 
to transfer increasing amounts of money and sensitive and proprietary 
information, conduct operations, and deliver services to constituents. 

The security of these systems and data is essential to protecting 
national and economic security, and public health and safety. 
Conversely, ineffective information security controls can result in 
significant risks, including the loss of resources, such as federal 
payments and collections; inappropriate access to sensitive 
information, such as national security information, personal 
information on taxpayers, or proprietary business information; 
disruption of critical operations supporting critical infrastructure, 
national defense, or emergency services; and undermining of agency 
missions due to embarrassing incidents that diminish public confidence 
in government. 

Cyber-reliant Critical Infrastructure and Federal Systems Face 
Increasing Cyber Threats: 

Threats to systems supporting critical infrastructure and federal 
information systems are evolving and growing. Government officials are 
concerned about attacks from individuals and groups with malicious 
intent, such as criminals, terrorists, and foreign nations. Federal 
law enforcement and intelligence agencies have identified multiple 
sources of threats to our nation's critical information systems, 
including foreign nations engaged in espionage and information 
warfare, criminals, hackers, virus writers, and disgruntled employees 
and contractors. These groups and individuals have a variety of attack 
techniques at their disposal that can be used to determine 
vulnerabilities and gain entry into targeted systems. For example, 
phishing involves the creation and use of fake e-mails and Web sites 
to deceive Internet users into disclosing their personal data and 
other sensitive information. 

The connectivity between information systems, the Internet, and other 
infrastructures also creates opportunities for attackers to disrupt 
telecommunications, electrical power, and other critical services. For 
example, in May 2008, we reported that the Tennessee Valley 
Authority's (TVA) corporate network contained security weaknesses that 
could lead to the disruption of control systems networks and devices 
connected to that network.[Footnote 4] We made 19 recommendations to 
improve the implementation of information security program activities 
for the control systems governing TVA's critical infrastructures and 
73 recommendations to address weaknesses in information security 
controls. TVA concurred with the recommendations and has taken steps 
to implement them. As government, private sector, and personal 
activities continue to move to networked operations, the threat will 
continue to grow. 

Reported Security Incidents Are on the Rise: 

Consistent with the evolving and growing nature of the threats to 
federal systems, agencies are reporting an increasing number of 
security incidents. These incidents put sensitive information at risk. 
Personally identifiable information about U.S. citizens has been lost, 
stolen, or improperly disclosed, thereby potentially exposing those 
individuals to loss of privacy, identity theft, and financial crimes. 
Agencies have experienced a wide range of incidents involving data 
loss or theft, computer intrusions, and privacy breaches, underscoring 
the need for improved security practices. Further, reported attacks 
and unintentional incidents involving critical infrastructure systems 
demonstrate that a serious attack could be devastating. 

When incidents occur, agencies are to notify the federal information 
security incident center--the United States Computer Emergency 
Readiness Team (US-CERT). Over the past 5 years, the number of 
incidents reported by federal agencies to US-CERT has increased 
dramatically, from 5,503 incidents reported in fiscal year 2006 to 
about 41,776 incidents in fiscal year 2010 (a more than 650 percent 
increase). The three most prevalent types of incidents and events 
reported to US-CERT during fiscal year 2010 were: (1) malicious code 
(software that infects an operating system or application), (2) 
improper usage (a violation of acceptable computing use policies), and 
(3) unauthorized access (where an individual gains logical or physical 
access to a system without permission). Additionally, according to 
Department of Homeland Security (DHS) officials, US-CERT detects 
incidents and events through its intrusion detection system, 
supplemented by agency reports, for investigation (unconfirmed 
incidents that are potentially malicious or anomalous activity deemed 
by the reporting entity to warrant further review). 

Reports of cyber attacks and information security incidents against 
federal systems and systems supporting critical infrastructure 
illustrate the effect that such incidents could have on national and 
economic security. 

* In July 2010, the Department of Defense (DOD) launched an 
investigation to identify how thousands of classified military 
documents (including Afghanistan and Iraq war operations, as well as 
field reports on Pakistan) were obtained by the group WikiLeaks.org. 
According to DOD, this investigation was related to an ongoing 
investigation of an Army private charged with, among other things, 
transmitting national defense information to an unauthorized source. 

* In 2010, the Deputy Secretary of Defense stated that DOD suffered a 
significant compromise of its classified military computer networks in 
2008. It began when a flash drive's malicious computer code, placed 
there by a foreign intelligence agency, uploaded itself onto a network 
and spread on both classified and unclassified systems.[Footnote 5] 

* In February 2011, media reports stated that computer hackers broke 
into and stole proprietary information worth millions of dollars from 
the networks of six U.S. and European energy companies. 

The Federal Government Has Taken Actions to Address Cyber Threats, but 
Challenges Remain in Protecting Critical Systems: 

The federal government has a variety of roles and responsibilities in 
protecting the nation's cyber-reliant critical infrastructure, 
enhancing the nation's overall cybersecurity posture, and ensuring the 
security of federal systems and the information they contain. In light 
of the pervasive and increasing threats to critical systems, the 
executive branch is taking a number of steps to strengthen the 
nation's approach to cybersecurity. For example, in its role as the 
focal point for federal efforts to protect the nation's cyber critical 
infrastructures,[Footnote 6] DHS issued a revised national 
infrastructure protection plan in 2009 and an interim national cyber 
incident response plan in 2010. Executive branch agencies have also 
made progress instituting several governmentwide initiatives that are 
aimed at bolstering aspects of federal cybersecurity, such as reducing 
the number of federal access points to the Internet, establishing 
security configurations for desktop computers, and enhancing 
situational awareness of cyber events. Despite these efforts, the 
federal government continues to face significant challenges in 
protecting the nation's cyber-reliant critical infrastructure and 
federal information systems. 

Key Actions to Improve Our Current National Approach to Cybersecurity 
Have Not Yet Been Fully Implemented: 

The administration and executive branch agencies have not yet fully 
implemented key actions that are intended to address threats and 
improve the current U.S. approach to cybersecurity. 

* Implementing actions recommended by the president's cybersecurity 
policy review. In February 2009, the president initiated a review of 
the government's cybersecurity policies and structures, which resulted 
in 24 near-and mid-term recommendations to address organizational and 
policy changes to improve the current U.S. approach to cybersecurity. 
[Footnote 7] In October 2010, we reported that 2 recommendations had 
been implemented and 22 were partially implemented.[Footnote 8] 
Officials from key agencies involved in these efforts (e.g., DHS, DOD, 
and the Office of Management and Budget (OMB)) stated that progress 
had been slower than expected because agencies lacked assigned roles 
and responsibilities and because several of the mid-term 
recommendations would require action over multiple years. We 
recommended that the national Cybersecurity Coordinator (whose role 
was established as a result of the policy review) designate roles and 
responsibilities for each recommendation and develop milestones and 
plans, including measures to show agencies' progress and performance. 

* Updating the national strategy for securing the information and 
communications infrastructure. In March 2009, we testified on the 
needed improvements to the nation's cybersecurity strategy.[Footnote 
9] In preparation for that testimony, we convened a panel of experts 
that included former federal officials, academics, and private sector 
executives. The panel highlighted 12 key improvements that are, in its 
view, essential to improving the strategy and our national 
cybersecurity posture, including the development of a national 
strategy that clearly articulates strategic objectives, goals, and 
priorities. 

* Developing a comprehensive national strategy for addressing global 
cybersecurity and governance. In July 2010, we reported that the U.S. 
government faced a number of challenges in formulating and 
implementing a coherent approach to global aspects of cyberspace, 
including, among other things, providing top-level leadership and 
developing a comprehensive strategy.[Footnote 10] Specifically, we 
found that the national Cybersecurity Coordinator's authority and 
capacity to effectively coordinate and forge a coherent national 
approach to cybersecurity were still under development. In addition, 
the U.S. government had not documented a clear vision of how the 
international efforts of federal entities, taken together, support 
overarching national goals. We recommended that, among other things, 
the national Cybersecurity Coordinator develop with other relevant 
entities a comprehensive U.S. global cyberspace strategy. The 
coordinator and his staff concurred with our recommendations and 
stated that actions had already been initiated to address them. 

* Finalizing cybersecurity guidelines and monitoring compliance 
related to electricity grid modernization. In January 2011, we 
reported on efforts by the National Institute of Standards and 
Technology (NIST) to develop cybersecurity guidelines and Federal 
Energy Regulatory Commission (FERC) efforts to adopt and monitor 
cybersecurity standards related to the electric industry's 
incorporation of IT systems to improve reliability and efficiency--
commonly referred to as the smart grid.[Footnote 11] We determined 
that NIST had not addressed all key elements of cybersecurity in its 
initial guidelines or finalized plans for doing so. We also determined 
that FERC had not developed an approach for monitoring industry 
compliance with its initial set of voluntary standards. Further, we 
identified six key challenges with respect to securing smart grid 
systems, including a lack of security features being built into 
certain smart grid systems and an ineffective mechanism for sharing 
information on cybersecurity within the industry. We recommended that 
NIST finalize its plans for updating its cybersecurity guidelines to 
incorporate missing elements and that FERC develop a coordinated 
approach to monitor voluntary standards and address any gaps in 
compliance. Both agencies agreed with these recommendations. 

* Creating a prioritized national and federal cybersecurity research 
and development (R&D) agenda. In June 2010, we reported that while 
efforts to improve cybersecurity R&D were under way by the White 
House's Office Science and Technology Policy (OSTP) and other federal 
entities, six major challenges impeded these efforts.[Footnote 12] 
Among the most critical was the lack of a prioritized national 
cybersecurity research and development agenda. We found that despite 
its legal responsibility and our past recommendations, a key OSTP 
subcommittee had not created a prioritized national R&D agenda, 
increasing the risk that research pursued by individual organizations 
will not reflect national priorities. We recommended that OSTP direct 
the subcommittee to take several actions, including developing a 
national cybersecurity R&D agenda. OSTP agreed with our recommendation 
and provided details on planned actions. 

We are in the process of verifying actions taken to implement our 
recommendations. In addition, we have ongoing work related to cyber 
CIP efforts in several other areas including (1) cybersecurity-related 
standards used by critical infrastructure sectors, (2) federal efforts 
to recruit, retain, train, and develop cybersecurity professionals, 
and (3) federal efforts to address risks to the information technology 
supply chain. 

Federal Capacity to Protect Against Cyber Threats Needs to Improve: 

In addition to improving our national capability to address 
cybersecurity, executive branch agencies, in particular DHS, also need 
to improve their capacity to protect against cyber threats by, among 
other things, advancing cyber analysis and warning capabilities and 
strengthening the effectiveness of the public-private sector 
partnerships in securing cyber critical infrastructure. 

* Enhancing cyber analysis and warning capabilities. In July 2008, we 
reported that DHS's US-CERT had not fully addressed 15 key attributes 
of cyber analysis and warning capabilities.[Footnote 13] As a result, 
we recommended that the department address shortfalls associated with 
the 15 attributes in order to fully establish a national cyber 
analysis and warning capability as envisioned in the national 
strategy. DHS agreed in large part with our recommendations and has 
reported that it is taking steps to implement them. We are currently 
working with DHS officials to determine the status of their efforts to 
address these recommendations. 

* Strengthening the public-private partnerships for securing cyber 
critical infrastructure. In July 2010, we reported that the 
expectations of private sector stakeholders were not being met by 
their federal partners in areas related to sharing information about 
cyber-based threats to critical infrastructure.[Footnote 14] Federal 
partners, such as DHS, were taking steps that may address the key 
expectations of the private sector, including developing new 
information-sharing arrangements. We also reported that public sector 
stakeholders believed that improvements could be made to the 
partnership, including improving private sector sharing of sensitive 
information. We recommended that the national Cybersecurity 
Coordinator and DHS work with their federal and private sector 
partners to enhance information-sharing efforts, including leveraging 
a central focal point for sharing information among the private 
sector, civilian government, law enforcement, the military, and the 
intelligence community. DHS officials stated that they have made 
progress in addressing these recommendations, and we will be 
determining the extent of that progress as part of our audit follow-up 
efforts. 

Federal Agencies Have Not Addressed Persistent Control Weaknesses or 
Implemented Effective Information Security Programs: 

Federal systems continue to be afflicted by persistent information 
security control weaknesses. Specifically, agencies did not 
consistently implement effective controls to prevent, limit, and 
detect unauthorized access or manage the configuration of network 
devices to prevent unauthorized access and ensure system integrity. 
Most of the 24 major federal agencies had information security 
weaknesses in five key internal control categories,[Footnote 15] as 
illustrated in figure 1. In addition, GAO determined that serious and 
widespread information security control deficiencies were a 
governmentwide material weakness in internal control over financial 
reporting as part of its audit of the fiscal year 2010 financial 
statements for the United States government. 

Figure 1: Information Security Weaknesses at Major Federal Agencies 
for FY 2010: 

[Refer to PDF for image: vertical bar graph] 

Information security weakness: Security/management; 
Number of agencies: 24. 

Information security weakness: Access/controls; 
Number of agencies: 24. 

Information security weakness: Configuration/management; 
Number of agencies: 24. 

Information security weakness: Segregation/of duties; 
Number of agencies: 17. 

Information security weakness: Contingency/planning; 
Number of agencies: 22. 

Source: GAO analysis of agency, inspector general, and GAO reports. 

[End of figure] 

Over the past several years, we and inspectors general have made 
hundreds of recommendations to agencies for actions necessary to 
resolve prior significant control deficiencies and information 
security program shortfalls. For example, we recommended that agencies 
correct specific information security deficiencies related to user 
identification and authentication, authorization, boundary 
protections, cryptography, audit and monitoring, physical security, 
configuration management, segregation of duties, and contingency 
planning. We have also recommended that agencies fully implement 
comprehensive, agencywide information security programs by correcting 
weaknesses in risk assessments, information security policies and 
procedures, security planning, security training, system tests and 
evaluations, and remedial actions. The effective implementation of 
these recommendations will strengthen the security posture at these 
agencies. Agencies have implemented or are in the process of 
implementing many of our recommendations. 

In addition, the White House, OMB, and selected federal agencies have 
undertaken governmentwide initiatives to enhance information security 
at federal agencies. For example, the Comprehensive National 
Cybersecurity Initiative, a series of 12 projects, is aimed primarily 
at improving DHS's and other federal agencies' efforts to reduce 
vulnerabilities, protect against intrusion attempts, and anticipate 
future threats against federal executive branch information systems. 
However, the projects face challenges in achieving their objectives 
related to securing federal information, including better defining 
agency roles and responsibilities, establishing measures of 
effectiveness, and establishing an appropriate level of transparency. 
These challenges require sustained attention, which agencies have 
begun to provide. 

In summary, the threats to information systems are evolving and 
growing, and systems supporting our nation's critical infrastructure 
and federal systems are not sufficiently protected to consistently 
thwart the threats. Administration and executive branch agencies need 
to take actions to improve our nation's cybersecurity posture, 
including implementing the actions recommended by the president's 
cybersecurity policy review and enhancing cyber analysis and warning 
capabilities. In addition, actions are needed to enhance security over 
federal systems and information, including fully developing and 
effectively implementing agencywide information security programs and 
implementing open recommendations. Until these actions are taken, our 
nation's federal and nonfederal cyber critical infrastructure will 
remain vulnerable. Mr. Chairman, this completes my statement. I would 
be happy to answer any questions you or other members of the 
Subcommittee have at this time. 

Contact and Acknowledgments: 

If you have any questions regarding this statement, please contact 
Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other 
key contributors to this statement include Michael Gilmore (Assistant 
Director), Anjalique Lawrence (Assistant Director), Larry Crosland, 
Kush Malhotra, Bradley Becker, Lee McCracken, and Jayne Wilson. 

[End of section] 

Related GAO Products: 

High-Risk Series: An Update. [hyperlink, 
http://www.gao.gov/products/GAO-11-278]. Washington, D.C.: February 
2011. 

Electricity Grid Modernization: Progress Being Made on Cybersecurity 
Guidelines, but Key Challenges Remain to be Addressed. [hyperlink, 
http://www.gao.gov/products/GAO-11-117]. Washington, D.C.: January 12, 
2011. 

Information Security: Federal Agencies Have Taken Steps to Secure 
Wireless Networks, but Further Actions Can Mitigate Risk. [hyperlink, 
http://www.gao.gov/products/GAO-11-43]. Washington, D.C.: November 30, 
2010. 

Cyberspace Policy: Executive Branch Is Making Progress Implementing 
2009 Policy Review Recommendations, but Sustained Leadership Is 
Needed. [hyperlink, http://www.gao.gov/products/GAO-11-24]. 
Washington, D.C.: October 6, 2010. 

Information Security: Progress Made on Harmonizing Policies and 
Guidance for National Security and Non-National Security Systems. 
[hyperlink, http://www.gao.gov/products/GAO-10-916]. Washington, D.C.: 
September 15, 2010. 

Information Management: Challenges in Federal Agencies' Use of Web 2.0 
Technologies. [hyperlink, http://www.gao.gov/products/GAO-10-872T]. 
Washington, D.C.: July 22, 2010. 

Critical Infrastructure Protection: Key Private and Public Cyber 
Expectations Need to Be Consistently Addressed. [hyperlink, 
http://www.gao.gov/products/GAO-10-628]. Washington, D.C.: July 15, 
2010. 

Cyberspace: United States Faces Challenges in Addressing Global 
Cybersecurity and Governance. [hyperlink, 
http://www.gao.gov/products/GAO-10-606]. Washington, D.C.: July 2, 
2010. 

Cybersecurity: Continued Attention Is Needed to Protect Federal 
Information Systems from Evolving Threats. [hyperlink, 
http://www.gao.gov/products/GAO-10-834T]. Washington, D.C.: June 16, 
2010. 

Cybersecurity: Key Challenges Need to Be Addressed to Improve Research 
and Development. [hyperlink, http://www.gao.gov/products/GAO-10-466]. 
Washington, D.C.: June 3, 2010. 

Information Security: Federal Guidance Needed to Address Control 
Issues with Implementing Cloud Computing. [hyperlink, 
http://www.gao.gov/products/GAO-10-513]. Washington, D.C.: May 27, 
2010. 

Information Security: Agencies Need to Implement Federal Desktop Core 
Configuration Requirements. [hyperlink, 
http://www.gao.gov/products/GAO-10-202]. Washington, D.C.: March 12, 
2010. 

Information Security: Concerted Effort Needed to Consolidate and 
Secure Internet Connections at Federal Agencies. [hyperlink, 
http://www.gao.gov/products/GAO-10-237]. Washington, D.C.: March 12, 
2010. 

Cybersecurity: Progress Made but Challenges Remain in Defining and 
Coordinating the Comprehensive National Initiative. [hyperlink, 
http://www.gao.gov/products/GAO-10-338]. Washington, D.C.: March 5, 
2010. 

National Cybersecurity Strategy: Key Improvements Are Needed to 
Strengthen the Nation's Posture. [hyperlink, 
http://www.gao.gov/products/GAO-09-432T]. Washington, D.C.: March 10, 
2009. 

Information Security: TVA Needs to Address Weaknesses in Control 
Systems and Networks. [hyperlink, 
http://www.gao.gov/products/GAO-08-526]. Washington, D.C.: May 21, 
2008. 

[End of section] 

Footnotes: 

[1] Director of National Intelligence, Statement for the Record on the 
Worldwide Threat Assessment of the U.S. Intelligence Community, 
statement before the Senate Select Committee on Intelligence (Feb. 16, 
2011). 

[2] GAO, High-Risk Series: An Update, [hyperlink, 
http://www.gao.gov/products/GAO-11-278] (Washington, D.C.: February 
2011). 

[3] Critical infrastructures are systems and assets, whether physical 
or virtual, so vital to the nation that their incapacity or 
destruction would have a debilitating impact on national security, 
national economic security, national public health or safety, or any 
combination of those matters. 

[4] GAO, Information Security: TVA Needs to Address Weaknesses in 
Control Systems and Networks, [hyperlink, 
http://www.gao.gov/products/GAO-08-526] (Washington, D.C.: May 21, 
2008). 

[5] Foreign Affairs, Defending a New Domain: The Pentagon's 
Cyberstrategy, William J. Lynn III, U.S. Deputy Secretary of Defense 
(New York, N.Y.: September/October 2010). 

[6] As established by federal law and policy, including the Homeland 
Security Act of 2002, Homeland Security Presidential Directive-7, and 
the National Strategy to Secure Cyberspace. 

[7] The White House, Cyberspace Policy Review: Assuring a Trusted and 
Resilient Information and Communications Infrastructure (Washington, 
D.C.: May 29, 2009). 

[8] GAO, Cyberspace Policy: Executive Branch Is Making Progress 
Implementing 2009 Policy Review Recommendations, but Sustained 
Leadership Is Needed, [hyperlink, 
http://www.gao.gov/products/GAO-11-24] (Washington, D.C.: Oct. 6, 
2010). 

[9] GAO, National Cybersecurity Strategy: Key Improvements Are Needed 
to Strengthen the Nation's Posture, [hyperlink, 
http://www.gao.gov/products/GAO-09-432T] (Washington, D.C.: Mar. 10, 
2009). 

[10] GAO, Cyberspace: United States Faces Challenges in Addressing 
Global Cybersecurity and Governance, [hyperlink, 
http://www.gao.gov/products/GAO-10-606] (Washington, D.C.: July 2, 
2010). 

[11] GAO, Electricity Grid Modernization: Progress Being Made on 
Cybersecurity Guidelines, but Key Challenges Remain to be Addressed, 
[hyperlink, http://www.gao.gov/products/GAO-11-117] (Washington, D.C.: 
Jan. 12, 2011). 

[12] GAO, Cybersecurity: Key Challenges Need to Be Addressed to 
Improve Research and Development, [hyperlink, 
http://www.gao.gov/products/GAO-10-466] (Washington, D.C.: June 3, 
2010). 

[13] GAO, Cyber Analysis and Warning: DHS Faces Challenges in 
Establishing a Comprehensive National Capability, [hyperlink, 
http://www.gao.gov/products/GAO-08-588] (Washington, D.C.: Jul. 31, 
2008). 

[14] GAO, Critical Infrastructure Protection: Key Private and Public 
Cyber Expectations Need to Be Consistently Addressed, [hyperlink, 
http://www.gao.gov/products/GAO-10-628] (Washington, D.C.: July 15, 
2010). 

[15] The five internal controls are access controls, which ensure that 
only authorized individuals can read, alter, or delete data; 
configuration management controls, which provide assurance that only 
authorized software programs are implemented; segregation of duties, 
which reduces the risk that one individual can independently perform 
inappropriate actions without detection; continuity of operations 
planning, which provides for the prevention of significant disruptions 
of computer-dependent operations; and an agencywide information 
security program (security management), which provides the framework 
for ensuring that risks are understood and that effective controls are 
selected and properly implemented. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAOís actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAOís Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: