Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed
Highlights
Pervasive and sustained computer-based attacks pose a potentially devastating impact to systems and operations and the critical infrastructures they support. Addressing these threats depends on effective partnerships between the government and private sector owners and operators of critical infrastructure. Federal policy, including the Department of Homeland Security's (DHS) National Infrastructure Protection Plan, calls for a partnership model that includes public and private councils to coordinate policy and information sharing and analysis centers to gather and disseminate information on threats to physical and cyber-related infrastructure. GAO was asked to determine (1) private sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met and (2) public sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met. To do this, GAO conducted surveys and interviews of public and private sector officials and analyzed relevant policies and other documents.
Private sector stakeholders reported that they expect their federal partners to provide usable, timely, and actionable cyber threat information and alerts; access to sensitive or classified information; a secure mechanism for sharing information; security clearances; and a single centralized government cybersecurity organization to coordinate government efforts. However, according to private sector stakeholders, federal partners are not consistently meeting these expectations. For example, less than one-third of private sector respondents reported that they were receiving actionable cyber threat information and alerts to a great or moderate extent. Federal partners are taking steps that may address the key expectations of the private sector, including developing new information-sharing arrangements. However, while the ongoing efforts may address the public sector's ability to meet the private sector's expectations, much work remains to fully implement improved information sharing. Public sector stakeholders reported that they expect the private sector to provide a commitment to execute plans and recommendations, timely and actionable cyber threat information and alerts, and appropriate staff and resources. Four of the five public sector councils that GAO held structured interviews with reported that their respective private sector partners are committed to executing plans and recommendations and providing timely and actionable information. However, public sector council officials stated that improvements could be made to the partnership, including improving private sector sharing of sensitive information. Some private sector stakeholders do not want to share their proprietary information with the federal government for fear of public disclosure and potential loss of market share, among other reasons. Without improvements in meeting private and public sector expectations, the partnerships will remain less than optimal, and there is a risk that owners of critical infrastructure will not have the information necessary to thwart cyber attacks that could have catastrophic effects on our nation's cyber-reliant critical infrastructure. GAO recommends that the national Cybersecurity Coordinator and DHS work with their federal and private sector partners to enhance information-sharing efforts. The national Cybersecurity Coordinator provided no comments on a draft of this report. DHS concurred with GAO's recommendations.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Homeland Security | The Special Assistant to the President and Cybersecurity Coordinator and the Secretary of Homeland Security, in collaboration with the sector lead agencies, coordinating councils, and the owners and operators of the associated five critical infrastructure sectors, should take two actions: (1) use the results of this report to focus their information-sharing efforts, including their relevant pilot projects, on the most desired services, including providing timely and actionable threat and alert information, access to sensitive or classified information, a secure mechanism for sharing information, and providing security clearance and (2) bolster the efforts to build out the National Cybersecurity and Communications Integration Center as the central focal point for leveraging and integrating the capabilities of the private sector, civilian government, law enforcement, the military, and the intelligence community. |
Closed – Implemented
DHS has taken numerous steps to focus its information sharing efforts on the desired services and to bolster the National Cybersecurity and Communications Integration Center (NCCIC). For example, DHS expanded a program that allows private and public sector partners to share cyber threat, incident, and vulnerability information, in near-real time, to enhance collaboration to better understand the threat and improve network defense for the entire community. In addition, DHS implemented a capability to allow security-cleared owners and operators of critical infrastructure and key resources, as well as state technology officials and law enforcement officials, to access secret-level cybersecurity information and video teleconference calls through state and major urban area fusion centers. Moreover, DHS has, on occasion, provided Chief Information Officers (CIO) from selected critical infrastructure sector entities temporary clearances in order to share with them sensitive and classified threat information to better facilitate their strategic decision making. Also, DHS has processed over 1,300 security clearances at the secret level, 13 at the top-secret level, and 49 at the top-secret sensitive compartmentalized information (TS/SCI) level for private sector individuals so that they can receive cyber threat information. Within the newly realigned Office of Cyber Security and Communications (CS&C), the NCCIC has been expanded to bring all of DHS' operational entities under one division. Functionally, the NCCIC currently provides 24x7 monitoring, information sharing, analysis, and incident response capabilities; provides coordination across all federal cyber centers; deploys fly-away teams, and provides capabilities to analyze network data and malware to assist public and private sector entities in incident response. In addition, DHS has entered into cooperative agreements with selected critical infrastructure entities that allow these entities to be present on the NCCIC operational floor or to access NCCIC information. According to DHS, at least 16 organizations are integrated into NCCIC operations in a full-time or part-time capacity and represent defense, law enforcement, intelligence, and private sector entities.
|
| Cybersecurity | The Special Assistant to the President and Cybersecurity Coordinator and the Secretary of Homeland Security, in collaboration with the sector lead agencies, coordinating councils, and the owners and operators of the associated five critical infrastructure sectors, should take two actions: (1) use the results of this report to focus their information-sharing efforts, including their relevant pilot projects, on the most desired services, including providing timely and actionable threat and alert information, access to sensitive or classified information, a secure mechanism for sharing information, and providing security clearance and (2) bolster the efforts to build out the National Cybersecurity and Communications Integration Center as the central focal point for leveraging and integrating the capabilities of the private sector, civilian government, law enforcement, the military, and the intelligence community. |
Closed – Implemented
According to DHS officials, the cybersecurity coordinator assigned responsibility for implementing this recommendation to DHS, as the action agency with primary responsibility for cyber-related information sharing and public private partnerships. In this regard, DHS has taken numerous steps to enhance its information sharing activities including granting security clearances, sharing classified information with cleared officials, and establishing a secure mechanism for sharing information. In addition, DHS has expanded the capabilities of the NCCIC.
|