This is the accessible text file for GAO report number GAO-10-536T entitled 'Information Security: Concerted Response Needed to Resolve Persistent Weaknesses' which was released on March 24, 2010. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subcommittee on Government Management, Organization, and Procurement, Committee on Oversight and Government Reform, U.S. House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery: Expected at 2:00 p.m. EDT: Wednesday, March 24, 2010: Information Security: Concerted Response Needed to Resolve Persistent Weaknesses: Statement of Gregory C. Wilshusen: Director, Information Security Issues: GAO-10-536T: GAO Highlights: Highlights of GAO-10-536T, a testimony before the Subcommittee on Government Management, Organization, and Procurement, Committee on Oversight and Government Reform, U.S. House of Representatives. Why GAO Did This Study: Without proper safeguards, federal computer systems are vulnerable to intrusions by individuals who have malicious intentions and can obtain sensitive information. The need for a vigilant approach to information security has been demonstrated by the pervasive and sustained cyber attacks against the United States; these attacks continue to pose a potentially devastating impact to systems as well as the operations and critical infrastructures that they support. Concerned by reports of weaknesses in federal systems, Congress passed the Federal Information Security Management Act (FISMA), which authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on federal information security and agency efforts to comply with FISMA. This testimony summarizes (1) federal agencies’ efforts to secure information systems and (2) opportunities to enhance federal cybersecurity. To prepare for this testimony, GAO analyzed its prior reports and those from 24 major federal agencies, their inspectors general, and the Office of Management and Budget (OMB). What GAO Found: Federal agencies have reported mixed progress in securing their systems and implementing key security activities. For example, in fiscal year 2009, agencies collectively reported an increasing percentage of personnel receiving security awareness training and specialized security training, but a decreasing rate of implementation for other key activities when compared to fiscal year 2008. In addition, federal systems continued to be afflicted by persistent control weaknesses. Almost all of the 24 major federal agencies had information security weaknesses in five key control categories, as illustrated in the figure below. Figure: Information Security Weaknesses at Major Federal Agencies for Fiscal Year 2009: [Refer to PDF for image: vertical bar graph] Category: Access control; Number of agencies: 22. Category: Configuration management; Number of agencies: 23. Category: Segregation of duties; Number of agencies: 17. Category: Continuity of operations; Number of agencies: 22. Category: Security management; Number of agencies: 23. Source: GAO analysis of IG, agency, and GAO reports. [End of figure] An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented key elements of an agencywide information security program, as required by FISMA. As a result, they may be at increased risk of unauthorized disclosure, modification, and destruction of information or disruption of mission critical operations. Such risks are illustrated, in part, by the increasing number of security incidents experienced by federal agencies. Opportunities exist to enhance federal cybersecurity through a concerted response to safeguarding systems that include several components. First, agencies can implement the hundreds of recommendations GAO and inspectors general have made to resolve control deficiencies and information security program shortfalls. In addition, OMB’s continued efforts to improve reporting and oversight as recommended by GAO could help assess agency programs. Finally, the White House, OMB, and certain federal agencies have undertaken several governmentwide initiatives that are intended to enhance information security at federal agencies. What GAO Recommends: In previous reports over the past several years, GAO has made hundreds of recommendations to agencies to mitigate identified control deficiencies and to fully implement information security programs. View [hyperlink, http://www.gao.gov/products/GAO-10-536T] or key components. For more information, contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. [End of section] Chairwoman Watson and Members of the Subcommittee: Thank you for the opportunity to participate in today's hearing on federal information security. As the number of reported computer security incidents and threats to the nation's cyber infrastructure steadily increase, the need for a vigilant and comprehensive approach to federal information security is greater than ever. In 2009, the federal government faced coordinated attacks against its Web sites, and several agencies were affected by the Gumblar Trojan, which uses multiple exploits to compromise legitimate web pages. In addition, the Conficker worm posed a threat to both federal and non-federal systems. Such attacks highlight the importance of developing a concerted response to safeguard federal information systems. Proper safeguards can mitigate the risk to federal computer systems and networks posed by individuals and groups with malicious intentions. While progress has been made in identifying and implementing these controls, much work remains. Over the past few years, federal agencies have reported numerous security incidents in which sensitive information has been lost or stolen, including personally identifiable information, which has exposed millions of Americans to the loss of privacy, identity theft, and other financial crimes. In my testimony today, I will discuss (1) federal agencies' efforts to secure information systems and (2) opportunities to enhance federal cybersecurity. In conducting our review, we analyzed agency, inspector general, Office of Management and Budget (OMB), and our reports on information security. We conducted the review from December 2009 to March 2010 in the Washington, D.C., area in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: To help protect against threats to federal systems, the Federal Information Security Management Act (FISMA)[Footnote 1] is intended to set forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. Its framework creates a cycle of risk management activities necessary for an effective security program; these activities are similar to the principles noted in our study of the risk management activities of leading private sector organizations [Footnote 2]--assessing risk, establishing a central management focal point, implementing appropriate policies and procedures, promoting awareness, and monitoring and evaluating policy and control effectiveness. In order to ensure the implementation of this framework, FISMA assigns specific responsibilities to (1) agency heads and chief information officers, to develop, document, and implement an agencywide information security program, among other things; (2) inspectors general, to conduct annual independent evaluations of agency efforts to effectively implement information security; (3) the National Institute for Science and Technology (NIST), to provide standards and guidance to agencies on information security; and (4) OMB, which include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security and reviewing, at least annually, and approving or disapproving, agency information security programs. In addition, the act requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of its information security policies, procedures, practices, and compliance with requirements. FISMA also requires OMB to report annually to Congress by March 1. Although Agencies Report Mixed Progress, Deficiencies in Information Security Controls Remain: FISMA requires each agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. As part of its oversight responsibilities OMB requires agencies to report on specific performance measures, including: * Percentage of employees and contractors receiving IT security awareness training, * Percentage of employees with significant security responsibilities who received specialized security training, * Percentage of systems whose controls were tested and evaluated, * Percentage of systems with tested contingency plans, and: * Percentage of systems certified and accredited. Since the enactment of FISMA in 2002, federal agencies have generally reported increasing rates of implementation for key information security activities. However, in fiscal year 2009, agencies reported mixed progress in implementing these activities compared to fiscal year 2008. For example, governmentwide, agencies collectively reported that 91 percent of employees and contractors had received security awareness training in fiscal year 2009, up from 89 percent in fiscal year 2008. Agencies also reported that 90 percent of employees with significant information security responsibilities had received specialized training, up from 76 percent in fiscal year 2008. In other key areas, agencies reported slight decreases from fiscal years 2008 to 2009. Specifically, the percentage of systems for which security controls have been tested and reviewed decreased from 93 percent to 89 percent, the percentage of systems with tested contingency plans decreased from 91 percent to 86 percent, and the percentage of systems certified and accredited decreased from 96 percent to 94 percent. A summary of these percentages is shown in figure 1. Figure 1: Selected Performance Metrics for Agency Systems: [Refer to PDF for image: multiple vertical bar graph] Metric: Security awareness training; Fiscal year 2006: 91%; Fiscal year 2007: 84%; Fiscal year 2008: 89%; Fiscal year 2009: 91%. Metric: Specialized security training; Fiscal year 2006: 86%; Fiscal year 2007: 90%; Fiscal year 2008: 76%; Fiscal year 2009: 90%. Metric: Periodic testing and evaluation; Fiscal year 2006: 88%; Fiscal year 2007: 95%; Fiscal year 2008: 93%; Fiscal year 2009: 89%. Metric: Tested contingency plans; Fiscal year 2006: 77%; Fiscal year 2007: 86%; Fiscal year 2008: 91%; Fiscal year 2009: 86%. Metric: Certification and Accreditation; Fiscal year 2006: 88%; Fiscal year 2007: 92%; Fiscal year 2008: 96%; Fiscal year 2009: 94%. Source: GAO analysis of agency data. [End of figure] In these and other areas, inspectors general at the 24 major agencies have also reported weaknesses in their fiscal year 2009 audits and evaluations. Weaknesses in requirements such as periodic testing and evaluation, certification and accreditation, configuration management, and remedial actions were most commonly reported. For example, * at least 13 inspectors general reported that their agencies had insecure configuration settings, or had not applied needed patches in a timely manner, or both; * at least 15 inspectors general reported that their agency did not adequately assess security controls such as those recommended by NIST; * at least 11 inspectors general reported that their agencies failed to create a remediation plan for all identified weaknesses. * at least 13 inspectors general reported that documents required to make an informed decision regarding certification and accreditation of systems were either missing or incomplete, or that the accreditation was allowed to expire on at least one system without recertification; Weaknesses such as these continue to impair the government's ability to ensure the confidentiality, integrity, and availability of critical information and information systems used to support the operations and assets of federal agencies. Until these agencies fully implement information security requirements, they may be at increased risk of unauthorized disclosure, modification, and destruction of information or disruption of mission critical operations. Despite Reported Progress, Federal Systems Remain Vulnerable: GAO and agency inspectors general reviews continue to highlight deficiencies in the implementation of security policies and procedures at federal agencies. In their fiscal year 2009 performance and accountability reports, 21 of 24 major agencies noted that inadequate information system controls over their financial systems and information were either a material weakness or a significant deficiency (see figure 2).[Footnote 3] Figure 2: Number of Major Agencies Reporting Significant Deficiencies in Information Security for Financial Reporting: [Refer to PDF for image: pie-chart] Significant deficiency: 15; Material weakness: 6; No significant deficiency: 3. Source: GAO analysis of agency performance and accountability report, annual financial report, or other financial statement reports for FY 2009. [End of figure] Our audits and those of the inspectors general continue to identify similar conditions in both financial and non-financial systems. Most of the 24 major federal agencies had reported deficiencies in the following major categories of information security controls, as defined by our Federal Information System Controls Audit Manual: [Footnote 4] * access controls, which ensure that only authorized individuals can read, alter, or delete data; * configuration management controls, which provide assurance that only authorized software programs are implemented; * segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; * continuity of operations planning, which provides for the prevention of significant disruptions of computer-dependent operations; and: * an agencywide information security program, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented. As shown in figure 3, agencies reported deficiencies in all five of the information security control areas. For example, agencies did not consistently configure network devices and services to prevent unauthorized access and ensure system integrity; assign incompatible duties to different individuals or groups so that one individual does not control all aspects of a process or transaction; and maintain or test continuity of operations plans for key information systems. Such information security control weaknesses unnecessarily increase the risk that the reliability and availability of data that are recorded in or transmitted by federal systems could be compromised. Figure 3: Number of Major Agencies Reporting Weaknesses by Control Category for Fiscal Year 2009: [Refer to PDF for image: vertical bar graph] Category: Access control; Number of agencies: 22. Category: Configuration management; Number of agencies: 23. Category: Segregation of duties; Number of agencies: 17. Category: Continuity of operations; Number of agencies: 22. Category: Security management; Number of agencies: 23. Source: GAO analysis of IG, agency, and GAO reports. [End of figure] An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented key elements of an agencywide information security program, as required by FISMA. An agencywide security program provides a framework and continuing cycle of activity that includes assessing and managing risk, developing and implementing security policies and procedures, promoting security awareness and training, monitoring the adequacy of the entity's computer-related controls through security tests and evaluations, and implementing remedial actions as appropriate. According to inspector general, agency, and our previous reports, 23 of the 24 major federal agencies had weaknesses in their agencywide information security programs. The following examples, reported in 2009, illustrate that a broad array of federal information and systems remain at risk. * At the Financial Crimes Enforcement Network (FinCEN), a bureau within the Department of the Treasury, key information security program activities were not implemented.[Footnote 5] For example, FinCEN did not always include detailed implementation guidance in its policies and procedures or adequately test and evaluate information security controls. * The information security program for the classified computer network at the Los Alamos National Laboratory (LANL) had not been fully implemented.[Footnote 6] Specifically, (1) risk assessments were not comprehensive, (2) specific guidance was missing from policies and procedures, (3) the training and awareness program did not adequately address specialized training needs for individuals with significant network security responsibilities, (4) system security plans were incomplete, (5) the system security testing and evaluation process had shortcomings, (6) corrective action plans were not comprehensive, and (7) contingency plans were incomplete and not tested. In addition, the laboratory's decentralized management approach has led to weaknesses in the effectiveness of its classified cybersecurity program. Although the laboratory has taken steps to address these weaknesses, its efforts may be limited because LANL has not demonstrated a consistent capacity to sustain security improvements over the long term. * We identified a number of shortcomings in key program activities at the National Aeronautics and Space Administration (NASA).[Footnote 7] For example, NASA had not always (1) fully assessed information security risks; (2) fully developed and documented security policies and procedures; (3) included key information in security plans; (4) conducted comprehensive tests and evaluation of its information system controls; (5) tracked the status of plans to remedy known weaknesses; (6) planned for contingencies and disruptions in service; (7) maintained capabilities to detect, report, and respond to security incidents; and (8) incorporated important security requirements in its agreement with its contractor. In addition, the inspectors general at 13 of the 24 major agencies reported information security as major management challenge. Due to the persistent nature of information security vulnerabilities and the associated risks, we continue to designate information security as a governmentwide high-risk issue in our most recent biennial report to Congress; a designation we have made in each report since 1997. [Footnote 8] Reported Security Incidents Are on the Rise: Consistent with the evolving and growing nature of the threats and persistent vulnerabilities to federal systems, agencies are reporting an increasing number of security incidents and events. These incidents put sensitive information at risk. Personally identifiable information about Americans has been lost, stolen, or improperly disclosed, thereby potentially exposing those individuals to loss of privacy, identity theft, and financial crimes. Reported attacks and unintentional incidents involving critical infrastructure systems demonstrate that a serious attack could be devastating. Agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices. When incidents occur, agencies are to notify the federal information security incident center--the United States Computer Emergency Readiness Team (US-CERT). US-CERT serves as a focal point for the government's interaction with federal and nonfederal entities on a 24- hour-a-day, 7-day-a-week basis regarding cyber-related analysis, warning, information sharing, major incident response, and national- level recovery efforts. As shown in figure 4, the number of incidents reported by federal agencies to US-CERT has increased dramatically over the past 4 years, increasing from 5,503 incidents reported in fiscal year 2006 to about 30,000 incidents in fiscal year 2009 (over a 400 percent increase). Figure 4: Incidents Reported to US-CERT, FY 2006-2009: [Refer to PDF for image: vertical bar graph] Fiscal year: 2006; Incidents reported: 5,503. Fiscal year: 2007; Incidents reported: 11,911. Fiscal year: 2008; Incidents reported: 16,843. Fiscal year: 2009; Incidents reported: 29,999. Source: GAO analysis of US-CERT data. [End of figure] Agencies report the following types of incidents and events based on US-CERT-defined categories: * Unauthorized access: Gaining logical or physical access without permission to a federal agency's network, system, application, data, or other resource. * Denial of service: Preventing or impairing the normal authorized functionality of networks, systems, or applications by exhausting resources. This activity includes being the victim of or participating in a denial of service attack. * Malicious code: Installing malicious software (e.g., virus, worm, Trojan horse, or other code-based malicious entity) that infects an operating system or application. Agencies are not required to report malicious logic that has been successfully quarantined by antivirus software. * Improper usage: Violating acceptable computing use policies. * Scans/probes/attempted access: Accessing or identifying a federal agency computer, open ports, protocols, service, or any combination of these for later exploit. This activity does not directly result in a compromise or denial of service. * Unconfirmed incidents under investigation: Investigating unconfirmed incidents that are potentially malicious, or anomalous activity deemed by the reporting entity to warrant further review. The four most prevalent types of incidents and events reported to US- CERT during fiscal year 2009 were: (1) malicious code comprising 23 percent; (2) improper usage, 20 percent; (3) unauthorized access, 16 percent; and (4) unconfirmed incidents under investigation, 36 percent. Incidents reported to US-CERT in fiscal year 2009 are shown by type in figure 5. Figure 5: Percentage of Incidents Reported to US-CERT in Fiscal Year 2009 by Category: [Refer to PDF for image: pie-chart] Under Investigation: 36%; Malicious code: 23%; Improper Usage: 20%; Unauthorized access: 16%; Scans/Probes/Attempted access: 4%; Denial of service: 1%. Source: GAO analysis of U.S. CERT data. [End of figure] Opportunities Exist for Enhancing Federal Cybersecurity: A concerted response to safeguarding federal systems includes several components. Agencies can take action to resolve specific security weaknesses, federal law and guidance can be strengthened, and continued effort can be made on governmentwide security initiatives. Over the past several years, we and agency inspectors general have made hundreds of recommendations to resolve significant control deficiencies and information security program shortfalls. Effective implementation of our recommendations will help agencies to prevent, limit, and detect unauthorized access to computerized networks and systems and help ensure that only authorized individuals can read, alter, or delete data. In addition, implementation of these recommendations will help agencies to better manage the configuration of security features for hardware and software and assure that changes to the configuration are systematically controlled. We have also recommended that agencies fully implement comprehensive, agencywide information security programs, including by correcting weaknesses in specific areas of their programs such as: (1) assessments of the risk to information systems; (2) information security policies and procedures; (3) planning for interruptions to information system processing; (4) training personnel in awareness of security policies and procedures; (5) periodic tests and evaluations of the effectiveness of information system controls; and (6) the implementation of plans of action to remediate information security weaknesses. The effective implementation of these recommendations will strengthen the security posture at these agencies. Agencies have implemented or are in the process of implementing many of our recommendations. In addition, agencies can also increase their efficiency in securing and monitoring networks by expanding their use of automated tools as part of their monitoring programs for performing certain security- related functions. Because federal computing environments are very large, complex, and geographically dispersed, often consisting of tens or hundreds of thousands of devices, increasing automation of key security processes can assist in the efficient and effective implementation of key controls across the entire enterprise. For example, agencies can better use centrally administered automated diagnostic and analytical tools to continuously scan network traffic and devices across the enterprise to identify vulnerabilities or anomalies from typical usage and monitor compliance with agency configuration requirements. In addition, improving the use of automated tools for patch management can increase efficiency in mitigating known vulnerabilities on many systems within an agency. Strengthen FISMA and Its Implementing Guidance: FISMA was intended to provide (1) a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets and (2) a mechanism for improved oversight of federal agency information security programs. In June 2009,[Footnote 9] we proposed several suggested actions that could improve FISMA and its associated implementing guidance, including (1) clarifying requirements for testing and evaluating security controls; (2) requiring agency heads to provide an assurance statement on the overall adequacy and effectiveness of the agency's information security program; (3) enhancing independent annual evaluations; (4) strengthening annual reporting mechanisms; and (5) strengthening OMB oversight of agency information security programs. Implementing these suggestions can improve the implementation and oversight of federal agency information security programs. Continue Efforts to Improve Reporting and Oversight: FISMA specifies that OMB is to develop policies, principles, standards, and guidelines on information security. Each year, OMB provides instructions to federal agencies and their inspectors general for preparing the annual FISMA reports. OMB developed an online reporting tool during fiscal year 2009 to improve the efficiency of the annual reporting process. Agencies are required to use the online tool to submit their annual reports and OMB is to use the data submitted in its online reporting tool to summarize the information provided by the agencies and the inspectors general in its report to Congress. We have previously made several recommendations to OMB for improving its annual reporting instructions and oversight.[Footnote 10] For example, we have recommended that OMB update its annual reporting instructions to request inspectors general report on the effectiveness of agencies' processes for developing inventories, monitoring contractor operations, and providing specialized security training. OMB has acted to enhance its reporting instructions; however, further actions need to be taken to fully address these recommendations. We have also recommended that OMB develop metrics that (1) focus on the effectiveness of information security controls and (2) the overall impact of an agency's information security program.[Footnote 11] In September 2009, OMB convened a Security Metrics Taskforce to develop new FISMA performance measures. According to OMB's website the taskforce is comprised of officials from the both the federal community and private sector and was tasked with developing metrics that focus on outcomes rather than compliance that agencies will be required to report as part of the FISMA reporting process. In December 2009, OMB released draft metrics for comment but has not yet released the final metrics. Continue to Enhance Federal Information Security through Governmentwide Initiatives: The White House, OMB, and certain federal agencies have undertaken several governmentwide initiatives that are intended to enhance information security at federal agencies. Address challenges in implementing CNCI. In January 2008, President Bush established the Comprehensive National Cybersecurity Initiative (CNCI). The initiative, which consists of 12 projects, is intended to reduce vulnerabilities, protect against intrusions, and anticipate future threats against federal executive branch information systems. [Footnote 12] As we recently reported,[Footnote 13] the White House and federal agencies have established interagency groups to plan and coordinate CNCI activities. However, CNCI faces challenges in achieving its objectives related to securing federal information, including better defining agency roles and responsibilities, establishing measures of effectiveness, and establishing an appropriate level of transparency. Until these challenges are adequately addressed, there is a risk that CNCI will not fully achieve its goals. Among other recommendations, we recommended that the Director of OMB take action to: (1) better define roles and responsibilities of all key CNCI participants; (2) establish measures to determine the effectiveness of CNCI projects in making federal information systems more secure and track progress against those measures; (3) establish an appropriate level of transparency about CNCI; and (4) reach agreement on the scope of CNCI's education projects to ensure that an adequate cadre of skilled personnel is developed to protect federal information systems. OMB agreed with 3 of the 4 recommendations, disagreeing with the recommendation regarding defining roles and responsibilities. However, such definitions are key to achieving CNCI's objective of securing federal systems. Continue efforts to implement TIC and Einstein initiatives. Two specific initiatives of CNCI are Trusted Internet Connections (TIC) and Einstein. TIC is an effort to consolidate the federal government's external access points (including those to the Internet). TIC is also intended to establish baseline security capabilities and validate agency adherence to those security capabilities. The Einstein initiative is a computer network intrusion detection system that analyzes network flow information from participating federal agencies. The system is to provide a high-level perspective from which to observe potential malicious activity in computer network traffic of participating agencies' computer networks. Einstein is intended to alert US-CERT in real time of this activity and provides correlation and visualization of the derived data. We have ongoing work that addresses status and implementation of these initiatives. Continue efforts to implement FDCC. Under the Federal Desktop Core Configuration Initiative, OMB directed agencies that have Windows XP and/or Windows Vista operating systems deployed to adopt the security configurations developed by the National Institute of Standards and Technology, the Department of Defense, and DHS. The goal of this initiative is to improve information security and reduce overall information technology operating costs. We have ongoing work that addresses status and implementation of this initiative. Improve the national strategy for cybersecurity. In March 2009, we testified on needed improvements to the nation's cybersecurity strategy.[Footnote 14] In preparation for that testimony, we obtained the views of experts (by means of panel discussions) on critical aspects of the strategy, including areas for improvement. The experts, who included former federal officials, academics, and private sector executives, highlighted 12 key improvements that are, in their view, essential to improving the strategy and our national cybersecurity posture. The key strategy improvements identified by cybersecurity experts are listed in table 1. Table 1: Key Strategy Improvement Identified by Cybersecurity Experts: 1. Develop a national strategy that clearly articulates strategic objectives, goals, and priorities. 2. Establish White House responsibility and accountability for leading and overseeing national cybersecurity policy. 3. Establish a governance structure for strategy implementation. 4. Publicize and raise awareness about the seriousness of the cybersecurity problem. 5. Create an accountable, operational cybersecurity organization. 6. Focus more actions on prioritizing assets, assessing vulnerabilities, and reducing vulnerabilities than on developing additional plans. 7. Bolster public-private partnerships through an improved value proposition and use of incentives. 8. Focus greater attention on addressing the global aspects of cyberspace. 9. Improve law enforcement efforts to address malicious activities in cyberspace. 10. Place greater emphasis on cybersecurity research and development, including consideration of how to better coordinate government and private sector efforts. 11. Increase the cadre of cybersecurity professionals. 12. Make the federal government a model for cybersecurity, including using its acquisition function to enhance cybersecurity aspects of products and services. Source: GAO analysis of opinions solicited during expert panels. [End of table] These recommended improvements to the national strategy are in large part consistent with our previous reports and extensive research and experience in this area. Until they are addressed, our nation's most critical federal and private sector cyber infrastructure remain at unnecessary risk to attack from our adversaries. Since our March testimony, the Obama Administration has performed a review[Footnote 15] of the strategy and issued a list of short and long term actions, which are largely consistent with our past reports and recommendations, to strengthen the strategy. In response to one of these actions, the president appointed a cybersecurity coordinator in December 2009. We recently initiated a review to assess the progress made by the executive branch in implementing the report's recommendations. In summary, while federal agencies continue to report increased compliance in implementing security training requirements, most federal agencies reported weaknesses in most types of information security controls. Additionally, agencies reported mixed progress in implementing key security measures while inspectors general identified persistent weaknesses in those areas of agencies' information security programs. There are multiple opportunities for the federal government to enhance federal cybersecurity and address these continuing weaknesses. These opportunities include addressing the hundreds of recommendations we and inspectors general have made to agencies, making enhancements to FISMA and its implementing guidance, and continuing efforts on White House, OMB, and federal agencies' initiatives. A concerted response by the federal government to current information security challenges will include acting on these opportunities; without such a response, federal information and systems will remain vulnerable. Chairwoman Watson, this concludes my statement. I would be happy to answer any questions you or other members of the subcommittee may have. Contact and Acknowledgments: If you have any questions regarding this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other key contributors to this statement include Anjalique Lawrence (Assistant Director), Larry Crosland, Sharhonda Deloach, Kristi Dorsey, Rebecca Eyler, Nicole Jarvis, Linda Kochersberger, Mary Marshall, Minette Richardson, and Jayne Wilson. [End of section] Footnotes: [1] FISMA was enacted as title III, E-Government Act of 2002, Pub. L. No.107-347, 116 Stat. 2899, 2946 (Dec. 17, 2002). [2] GAO, Executive Guide: Information Security Management: Learning from Leading Organizations, [hyperlink, http://www.gao.gov/products/GAO/AIMD-98-68] (Washington, D.C.: May 1998). [3] A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected. A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity's ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity's financial statements that is more than inconsequential will not be prevented or detected. A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. [4] GAO, Federal Information System Controls Audit Manual (FISCAM), [hyperlink, http://www.gao.gov/products/GAO-09-232G] (Washington, D.C.: Feb. 2009). [5] GAO, Information Security: Further Actions Needed to Address Risks to Bank Secrecy Act Data, [hyperlink, http://www.gao.gov/products/GAO-09-195] (Washington, D.C.: Jan. 30, 2009). [6] GAO, Information Security: Actions Needed to Better Manage, Protect, and Sustain Improvements to Los Alamos National Laboratory's Classified Computer Network, [hyperlink, http://www.gao.gov/products/GAO-10-28] (Washington, D.C.: Oct. 14, 2009). [7] GAO, Information Security: NASA Needs to Remedy Vulnerabilities in Key Networks, [hyperlink, http://www.gao.gov/products/GAO-10-4] (Washington, D.C.: Oct. 15, 2009). [8] Most recently, GAO, High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-09-271] (Washington, D.C.: January 2009). [9] GAO, Federal Information Security Issues, [hyperlink, http://www.gao.gov/products/GAO-09-817R] (Washington, D.C.: June 30, 2009). [10] GAO, Information Security: Agencies Continue to Report Progress, but Need to Mitigate Persistent Weaknesses, [hyperlink, http://www.gao.gov/products/GAO-09-546] (Washington, D.C.: July 17, 2009) and Information Security: Despite Reported Progress, Federal Agencies Need to Address Persistent Weaknesses, [hyperlink, http://www.gao.gov/products/GAO-07-837] (Washington, D.C.: July 27, 2007). [11] GAO, Information Security: Concerted Effort Needed to Improve Federal Performance Measures, [hyperlink, http://www.gao.gov/products/GAO-09-617] (Washington, D.C.: Sep. 14, 2009). [12] The White House, National Security Presidential Directive 54/ Homeland Security Presidential Directive 23 (Washington, D.C.: Jan. 8, 2008). [13] GAO, Cybersecurity: Progress Made but Challenges Remain in Defining and Coordinating the Comprehensive National Initiative, [hyperlink, http://www.gao.gov/products/GAO-10-338] (Washington, D.C.: March 5, 2010). [14] GAO, National Cybersecurity Strategy: Key Improvements Are Needed to Strengthen the Nation's Posture, [hyperlink, http://www.gao.gov/products/GAO-09-432T] (Washington, D.C.: March 10, 2009). [15] The White House, Cyberspace Policy Review: Assuring a Trusted and Resilient Information and Communications Infrastructure (Washington, D.C.: May 29, 2009). [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: