Technology Assessment:
Cybersecurity for Critical Infrastructure Protection
GAO-04-321: Published: May 28, 2004. Publicly Released: May 28, 2004.
Additional Materials:
- Highlights Page:
- Full Report:
- Accessible Text:
Contact:
(202) 512-6412
contact@gao.gov
Office of Public Affairs
(202) 512-4800
youngc1@gao.gov
Computers are crucial to the operations of government and business. Computers and networks essentially run the critical infrastructures that are vital to our national defense, economic security, and public health and safety. Unfortunately, many computer systems and networks were not designed with security in mind. As a result, the core of our critical infrastructure is riddled with vulnerabilities that could enable an attacker to disrupt operations or cause damage to these infrastructures. Critical infrastructure protection (CIP) involves activities that enhance the security of our nation's cyber and physical infrastructure. Defending against attacks on our information technology infrastructure-- cybersecurity--is a major concern of both the government and the private sector. Consistent with guidance provided by the Senate's Fiscal Year 2003 Legislative Branch Appropriations Report (S. Rpt. 107-209), GAO conducted this technology assessment on the use of cybersecurity technologies for CIP in response to a request from congressional committees. This assessment addresses the following questions: (1) What are the key cybersecurity requirements in each of the CIP sectors? (2) What cybersecurity technologies can be applied to CIP? (3) What are the implementation issues associated with using cybersecurity technologies for CIP, including policy issues such as privacy and information sharing?
Many cybersecurity technologies that can be used to protect critical infrastructures from cyber attack are currently available, while other technologies are still being researched and developed. These technologies, including access control technologies, system integrity technologies, cryptography, audit and monitoring tools, and configuration management and assurance technologies, can help to protect information that is being processed, stored, and transmitted in the networked computer systems that are prevalent in critical infrastructures. Although many cybersecurity technologies are available, experts feel that these technologies are not being purchased or implemented to the fullest extent. An overall cybersecurity framework can assist in the selection of technologies for CIP. Such a framework can include (1) determining the business requirements for security; (2) performing risk assessments; (3) establishing a security policy; (4) implementing a cybersecurity solution that includes people, processes, and technologies to mitigate identified security risks; and (5) continuously monitoring and managing security. Even with such a framework, other demands often compete with cybersecurity. For instance, investing in cybersecurity technologies often needs to make business sense. It is also important to understand the limitations of some cybersecurity technologies. Cybersecurity technologies do not work in isolation; they must work within an overall security process and be used by trained personnel. Despite the availability of current cybersecurity technologies, there is a demonstrated need for new technologies. Long-term efforts are needed, such as the development of standards, research into cybersecurity vulnerabilities and technological solutions, and the transition of research results into commercially available products. There are three broad categories of actions that the federal government can undertake to increase the use of cybersecurity technologies. First, it can take steps to help critical infrastructures determine their cybersecurity needs, such as developing a national CIP plan, assisting with risk assessments, and enhancing cybersecurity awareness. Second, the federal government can take actions to protect its own systems, which could lead others to emulate it or could lead to the development and availability of more cybersecurity technology products. Third, it can undertake long-term activities to increase the quality and availability of cybersecurity technologies in the marketplace. Ultimately, the responsibility for protecting critical infrastructures falls on the critical infrastructure owners. However, the federal government has several options at its disposal to manage and encourage the increased use of cybersecurity technologies, research and develop new cybersecurity technologies, and generally improve the cybersecurity posture of critical infrastructure sectors.
Feb 7, 2019
-
Presidential Security:
Vetting of Individuals and Secure Areas at Mar-a-LagoGAO-19-246: Published: Jan 23, 2019. Publicly Released: Feb 7, 2019.
Feb 5, 2019
-
Presidential Travel:
Secret Service and DOD Need to Ensure That Expenditure Reports Are Prepared and Submitted to CongressGAO-19-178: Published: Jan 17, 2019. Publicly Released: Feb 5, 2019.
Jan 8, 2019
-
Federal Protective Service:
DHS Should Take Additional Steps to Evaluate Organizational PlacementGAO-19-122: Published: Jan 8, 2019. Publicly Released: Jan 8, 2019.
Dec 19, 2018
-
Critical Infrastructure Protection:
Actions Needed to Address Significant Weaknesses in TSA's Pipeline Security Program ManagementGAO-19-48: Published: Dec 18, 2018. Publicly Released: Dec 19, 2018.
Dec 13, 2018
-
National Security:
Long-Range Emerging Threats Facing the United States As Identified by Federal AgenciesGAO-19-204SP: Published: Dec 13, 2018. Publicly Released: Dec 13, 2018.
Dec 6, 2018
-
2017 Disaster Contracting:
Action Needed to Better Ensure More Effective Use and Management of Advance ContractsGAO-19-93: Published: Dec 6, 2018. Publicly Released: Dec 6, 2018.
Nov 29, 2018
-
Coast Guard Acquisitions:
Addressing Key Risks Is Important to Success of Polar Icebreaker ProgramGAO-19-255T: Published: Nov 29, 2018. Publicly Released: Nov 29, 2018.
Nov 28, 2018
-
Aviation Security:
TSA Uses a Variety of Methods to Secure U.S.-bound Air Cargo, but Could Do More to Assess Their EffectivenessGAO-19-162: Published: Nov 28, 2018. Publicly Released: Nov 28, 2018.
Oct 11, 2018
-
Coast Guard Acquisitions:
Lessons Learned to Inform Coast Guard and NOAA Shipbuilding EffortsGAO-19-147T: Published: Oct 11, 2018. Publicly Released: Oct 11, 2018.
Sep 21, 2018
-
Chemical Terrorism:
A Strategy and Implementation Plan Would Help DHS Better Manage Fragmented Chemical Defense Programs and ActivitiesGAO-18-562: Published: Aug 22, 2018. Publicly Released: Sep 21, 2018.
Looking for more? Browse all our products here