I am pleased to be here today to discuss efforts to protect federal agency information systems and our nation's critical computer-dependent infrastructures. Federal agencies, and other public and private entities, rely extensively on computerized systems and electronic data to support their missions. Accordingly, the security of these systems and data is essential to avoiding disruptions in critical operations, data tampering, fraud, and inappropriate disclosure of sensitive information. Further, as the Comptroller General stated in testimony last week, protecting against computer-based attacks on critical infrastructures is an important aspect of homeland security.

The United States General Accounting Office (GAO) presents a report entitled "Critical Infrastructure Protection: Significant Challenges in Developing National Capabilities," published in April 2001. The report is for the Subcommittee on Technology, Terrorism, and Government Information of the Committee on the Judiciary for the U.S. Senate. The report discusses the progress of the National Infrastructure Protection Center (NIPC) in developing national capabilities for analyzing cyber threat and vulnerability data and enhancing capabilities for responding to cyber attacks.

Federal agencies, and other public and private groups, rely extensively on computer systems and electronic data. The security of these systems and data is essential to avoiding disruptions in critical operations and preventing data tampering, fraud, and inappropriate disclosure of sensitive information. However, federal computer systems contain weaknesses that continue to put critical operations and assets at risk. In particular, deficiencies exist in entitywide security programs that are critical to agencies' success in ensuring that risks are understood and effective controls are implemented. Many efforts have been undertaken to implement the nationally critical infrastructure protection strategy outlined in Presidential Decision Directive (PDD) 63. However, progress in key areas has been limited. Although outreach efforts by many federal entities to establish cooperative relationships with and among private and other nonfederal entities have raised awareness and prompted information sharing, efforts to perform substantive analyses of sector-wide and cross-sector interdependencies and related vulnerabilities have been limited. A major impediment to implementing the strategy outlined in PDD 63 is the lack of a national plan that clearly spells out the roles and responsibilities of federal and nonfederal entities and defines interim objectives.

GAO-01-1168T Critical Infrastructure Protection: Significant Challenges in Safeguarding Government and Privately Controlled Systems from Computer-Based Attacks