Advanced search    Help

Clear all search criteria

Only 2/3! You are seeing results from the Public Collection, not the complete Full Collection. Sign in to search everything (see eligibility).

• Cyber Threats and Ongoing Efforts to Protect the Nation: Hearing Before the U.S. House Permanent Select Committee on Intelligence, One Hundred Twelfth Congress, First Session, October 4, 2011

  Show summary     Open resource [pdf]     (open full abstract)

  This testimony compilation is from the October 4, 2011 hearing, "Cyber Threats and Ongoing Efforts to Protect the Nation," before the U.S. House of Representatives Permanent Select Committee on Intelligence. From the opening statement of Mike Rogers: "The United States faces a significant and ongoing cyber security threat today; one that presents issues of national and economic security. There has been a lot of talk about the prospect of a 'cyber-Pearl Harbor' attack that could shut down critical infrastructure and potentially cause actual physical damage in the U.S. A potentially destructive threat against critical infrastructure is certainly possible. I am more concerned, however, about the 'death by a thousand cuts' that we are suffering right now from cyber espionage being conducted every day against nearly every sector of our economy. These cyber espionage attacks result in massive losses of private sector intellectual property and sensitive government information. Urgent action is required to staunch the bleeding." Statements, letters, and materials submitted for the record include those of the following: Mike Rogers, C.A. Dutch Ruppersberger, Michael V. Hayden, Arthur W. Coviello Jr., and Kevin Mandia.

  United States. Congress. House. Permanent Select Committee on Intelligence

  2011-10-04
• Small Business Committee Document No. 112-047: Cyber Security: Protecting Your Small Business, Hearing Before the Subcommittee on Healthcare and Technology of the Committee on Small Business, United States House of Representatives, One Hundred Twelfth Congress, First Session, December 1, 2011

  Show summary     Open resource [pdf]     (open full abstract)

  From the opening statement of Renee Ellmers: "Our Nation's digital infrastructure has become an essential part of our everyday lives. It is difficult to imagine a world without the Internet. It touches nearly every sector of the United States economy, and it is critical to our national security. According to the Federal Communications Commission, over 97 percent of small businesses utilize the Internet to increase their productivity and overall success. […] [T]he growth of the Internet technology and e-commerce has also attracted a growing number of cyber criminals looking to steal sensitive information, including intellectual property and personal financial information. These attacks can be catastrophic, as you can imagine, leaving many businesses unable to recover. Especially our small businesses. Although we often hear about cyber attacks on large businesses and institutions, a recent report shows the majority of these attacks are on small firms. Small businesses generally have fewer resources available to monitor and combat cyber threats, making them easy targets for expert criminals. Moreover, the sophistication and scope of these attacks continue to grow at a rapid pace. A recent report from the Office of the National Counterintelligence Executive stated that tens of billions of dollars in trade secrets, intellectual property, and technology are being stolen each year by foreign nations like China and Russia. As the leader in producing intellectual property, the United States and small businesses will continue to be a primary target for cyber criminals seeking an economic advantage. [...] Protecting our digital infrastructure is complex, and no one agency or private business can do it alone. It takes a true public-private partnership to identify, combat, and share information regarding these sophisticated cyber attacks." Statements, letters, and materials submitted for the record include those of the following: Renee Ellmers, Cedric Richmond, William M. Thornberry, David Beam, Glenn Strebe, Phyllis A. Schneck, Michael Kaiser, and CompTIA.

  United States. Government Printing Office

  2012
• Cyber Threat to Control Systems: Stronger Regulations are Necessary to Secure the Electric Grid, Hearing Before the Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology of the Committee on Homeland Security House of Representatives, One Hundred Tenth Congress, First Session, October 17, 2007

  Show summary     Open resource [pdf]     (open full abstract)

  From the opening statement of James R. Langevin, "the subcommittee is meeting today to receive testimony on 'The Cyber Threat to Control Systems: Stronger Regulations are Necessary to Secure the Electric Grid.' I will begin by recognizing myself for the purposes of an opening statement. Today's hearing provides us with a prime opportunity to assess the future of cybersecurity and critical infrastructure protection in the United States. Today we will discuss two major issues: the efforts to implement cybersecurity standards within the electric sector and a cyber vulnerability, known as Aurora, which was recently made public. Now, I will be blunt, if this administration doesn't recognize and prioritize these problems soon, the future isn't going to be pretty. The bulk power system in the United States and Canada has more than $1 trillion in asset value, more than 200,000 miles of transmission lines, and more than 800 megawatts of generating capability, serving over 300 million people. The effective functioning of this infrastructure is highly dependent on control systems, which a computer-based system is used to monitor and control sensitive processes and physical functions. Once largely proprietary, closed systems, control systems are becoming increasingly connected to open networks, such as corporate intranets and the Internet itself. As such, the cyber risk of these systems is increasing." Statements, letters, and materials submitted for the record include those of the following: James R. Langevin, Michael T. McCaul, Bennie G. Thompson, Bob Etheridge, Al Green, Zoe Lofgren, Bill Pascrell, Ginny Brown-Waite, Greg Garcia, Tim Roxey, Greg Wilshusen, Joseph McClelland, Joe Weiss, David Whiteley and David A. Whiteley.

  United States. Government Printing Office

  2009
• Oversight Hearing - Cybersecurity and Critical Infrastructure: Hearing Before the U.S. House of Representatives Committee on Appropriations, Subcommittee on Homeland Security, One Hundred Thirteenth Congress, First Session, March 20, 2013

  Show summary     Open resource [pdf]     (open full abstract)

  This testimony compilation is from the March 20, 2013 hearing, "Oversight Hearing - Cybersecurity and Critical Infrastructure," before the U.S. House of Representatives Committee on Appropriations, Subcommittee on Homeland Security. From the opening statement of John Carter: "This morning we welcome Under Secretary Rand Beers and Deputy Under Secretary Suzanne Spaulding to explain how DHS is mitigating cybersecurity threats and protecting our Nation's critical infrastructure. Thank you for joining us today. As discussed in our briefing with DHS last month, the U.S. is the target of a massive cyber-espionage campaign that threatens the country's economic competitiveness. More disturbing, are recent reports detailing how the Chinese army is hacking into a wide range of U.S. industries. Our cybersecurity is an issue of national significance. We don't have an endless pocket book to draw from, so we have to make every penny count. In addition to answering our questions today, it is my understanding that you will also be updating us on the threat of these evolving cyber-attacks. A few administrative items for the Members and staff in attendance: (1) This briefing is classified at the Top Secret / SCI level -- the highly sensitive material that we discuss today is not to be discussed in an unauthorized setting, and (2) Members and staff should have already divested themselves of all electronic devices before entering the room." Statements, letters, and materials submitted for the record include those of the following: John Carter and Rand Beers.

  United States. Congress. House. Committee on Appropriations

  2013-03-20
• Guide to the Distributed Energy Resource Risk Management Framework

  Show summary     Open resource [pdf]     (open full abstract)

  From the Executive Summary: "The emergence of distributed energy resources (DERs) has transformed the electric power sector and will likely have even more profound impacts on the future evolution of the United States energy sector as it modernizes and becomes more reliant upon complex informatics programming and systems to ensure that our power grid remains safe from malicious interference. In an effort to improve the nation's cybersecurity posture, Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure (2017) recognizes the increasing interconnectedness of federal information systems while acknowledging that critical infrastructure is at risk due to the misalignment of many policies that govern information technology at a national level. Office of Management and Budget Circular A-130, 'Managing Information as a Strategic Resource' (2016) addresses responsibilities for protecting federal information resources, requiring agencies to implement the Risk Management Framework (RMF), developed by the National Institute of Standards and Technology. Executive Order 14028: Improving the Nation's Cybersecurity (2021) clarifies the responsibility of the federal government to collaborate with the private sector to maintain a safe virtual environment that is agile and may be modified in tandem with the discovery of new cybersecurity threats and proactive mitigation of unknown future cybersecurity incidents."

  National Renewable Energy Laboratory (U.S.)

  Thomas, Dana-Marie; Sanghvi, Anuj; Touhiduzzaman, MD . . .

  2022-04
• Invisible Battleground, Hearing Before the Subcommittee on Cybersecurity, Science, and Research and Development of the Select Committee on Homeland Security, House of Representatives, One Hundred Eighth Congress, First Session, September 16, 2003

  Show summary     Open resource [pdf]     (open full abstract)

  From the opening statement of Mac Thornberry. "I would like to welcome our witness and guests to today's hearing, entitled The Invisible Battleground: What the Department of Homeland Security is Doing to Make America's Cybersecurity More Secure. Over the past several months this subcommittee has received a number of perspectives on cybersecurity. We have held classified and unclassified briefings and hearings. We have heard from witnesses from academia, think tanks, technology industry, government agency, users, and others. Our goal has been to deepen our understanding of the issues involved and to gain a truer perspective on how and where cybersecurity fits into homeland security. Now, today, we will hear a progress report from the new Department of Homeland Security. From the first bills introduced in Congress to create a Department of Homeland Security, cybersecurity was one of those critical elements that was given to the new department, one of the functions where a number of government agencies would be brought together with greater emphasis and broader responsibilities. It was clear that if we were really going to modernize and strengthen Homeland Security, cybersecurity had to be a part of it. The final legislation, in fact, did that. It did not set cybersecurity apart, as some proposed, but included it as one of the critical infrastructures placed under the Directorate for Information Analysis and Infrastructure Protection." Statements, letters, and materials submitted for the record include those of the following: Mac Thornberry, Zoe Lofgren, Donna M. Christensen, Jennifer Dunn, Bob Etheridge, James R. Langevin, Sheila Jackson-Lee, John Linder, Ken Lucas, Kendrick B. Meek, Pete Sessions, and Robert Liscouski.

  United States. Government Printing Office

  2005
• National Infrastructure Advisory Council (NIAC): Meeting Agenda, April 13, 2004

  Show summary     Open resource [pdf]     (open full abstract)

  The following are the Meeting notes for the National Infrastructure Advisory Council (NIAC) on Tuesday, April 13, 2004. "Ms. Wong said the Council approved two sets of recommendations during the January meeting, an Interdependencies Risk Assessment and the second on Vulnerability Disclosures as they relate to information systems. Those reports and recommendations have been transmitted to the President and are currently under review by the White House. They are available for viewing on the DHS website. The NIAC has five more issues to report on. In addition, this meeting will include a briefing by Dr. Vance Coffman, the Chairman of the National Telecommunications Advisory Council; Amit Yoran, Director for National Cyber Security Division; and Mr. Kenneth Stroech, Chief of Staff for Infrastructure Protection Office who will provide a briefing on the Homeland Security Presidential Directive 7 and the progress of the National Critical Infrastructure Protection Plan. Gen. Gordon said the President counts on the NIAC to provide real, direct, and actionable advice and recommendations to improve Cyber Security. He thanked the Council for the last two reports, Vulnerability Disclosures and Cross-Sector Interdependencies Risk Assessment, which were submitted during the January meeting."

  National Infrastructure Advisory Council (U.S.)

  Wong, Nancy J.; Libutti, Frank, 1945-; Gordon, John A.

  2004-04-13
• Information Security: Progress Made, but Challenges Remain to Protect Federal Systems and the Nation's Critical Infrastructure: Testimony of Robert F. Dacey, Director, Information Security Issues, before the Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census, House Committee on Government Operations

  Show summary     Open resource [pdf]     (open full abstract)

  This statement discusses the challenges that the US faces concerning federal information security and critical infrastructure protection (CIP). Federal agencies and other public and private entities rely extensively on computerized systems and electronic data to support their missions. CIP involves activities that enhance the security of the cyber and physical public and private infrastructures that are essential to US national security, national economic security, and/or national public health and safety. Accordingly, the security of these systems and data is essential to avoiding disruptions in critical operations, data tampering, fraud, and inappropriate disclosure of sensitive information. Further, protecting against computer-based attacks on critical infrastructures is an important aspect of homeland security. This testimony provides an overview of the increasing nature of cyber security threats and vulnerabilities and of the continuing pervasive weaknesses that led GAO to initially begin reporting information security as a governmentwide high-risk issue in 1997. It also discusses the status of actions taken by the Office of Management and Budget (OMB) to address overall weaknesses and challenges identified through its GISRA analyses. The federal government continues to need to be guided by a comprehensive improvement strategy and to identify and correct their information security weaknesses that the GISRA analyses revealed at 24 of the largest federal agencies since GAO found that these agencies still have not established information security programs consistent with legal requirements.

  United States. General Accounting Office

  2003-04-08
• Cybersecurity: DHS Needs to Enhance Efforts to Improve and Promote the Security of Federal and Private-Sector Networks, Testimony Before the Committee on Homeland Security and Governmental Affairs, U.S. Senate

  Show summary     Open resource [pdf]     (open full abstract)

  "The emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security. GAO (Government Accountability Office) first designated information security as a government-wide high- risk area in 1997. GAO expanded the high-risk area to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015. Federal law and policy provide DHS with broad authorities to improve and promote cybersecurity. DHS (Department of Homeland Security) plays a key role in strengthening the cybersecurity posture of the federal government and promoting cybersecurity of systems supporting the nation's critical infrastructures."

  United States. Government Accountability Office

  Wilshusen, Gregory C.

  2018-04-24
• Cybersecurity: Homeland Security Issues for the 116th Congress [March 29, 2019]

  Show summary     Open resource [pdf]     (open full abstract)

  From the Document: "For policymaking purposes, 'cybersecurity' can be considered the security of 'cyberspace'. Taking this broad view allows policymakers to examine discrete elements of cybersecurity and determine which parts to address through the legislative process. Cyberspace, itself, includes the infrastructure necessary for the internet to work (e.g., wires, modems, and servers), the services used via the Internet (e.g., web applications and websites), the devices on the network (e.g., computers and Internet-of-Things devices), and the users of those devices. Cybersecurity involves many interrelated issues, such as education; workforce management; research and development; intelligence; law enforcement; and defense. Recent congressional activity and Member statements suggest that five specific cybersecurity topics with an intersection to homeland security may arise during the 116th Congress. This Insight first discusses the importance of risk management for cybersecurity, then introduces each of those topics: Information Sharing, Critical Infrastructure Protection and Cybersecurity, Cyber Supply Chain Risk Management, Federal Agency Oversight, and Data Protection and Privacy."

  Library of Congress. Congressional Research Service

  Jaikaran, Chris

  2019-03-29
• Progress and Challenges in Securing the Nation's Cyberspace

  Show summary     Open resource [pdf]     (open full abstract)

  "The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General Act of 1978. This is one of a series of audit, inspection, investigative, and special reports prepared by the OIG as part of its DHS oversight responsibility to identify and prevent fraud, waste, abuse, and mismanagement. This report assesses the strengths and weaknesses of the program or operation under review. Due to the significance of cyber threats on the United States and their possible consequences, the security of cyber systems is one of the Department of Homeland Security's (DHS) highest priorities. The objective of this audit was to determine whether DHS' efforts to protect the nation's critical infrastructure from a major cyber terrorist attack are adequate and effective. The audit focuses on the National Cyber Security Division (NCSD), within DHS' IAIP directorate. It determines whether: (1) NCSD's organizational structure was established to fulfill its assigned roles and responsibilities; (2) NCSD has developed effective implementation plans; and, (3) NCSD is performing its oversight responsibilities as outlined in The National Strategy to Secure Cyberspace."

  United States. Department of Homeland Security. Office of Inspector General

  2004-07
• Space Policy Directive-5: Cybersecurity Principles for Space Systems

  Show summary     Open resource [pdf]     (open full abstract)

  From the Background: "The United States considers unfettered freedom to operate in space vital to advancing the security, economic prosperity, and scientific knowledge of the Nation. Space systems enable key functions such as global communications; positioning, navigation, and timing; scientific observation; exploration; weather monitoring; and multiple vital national security applications. Therefore, it is essential to protect space systems from cyber incidents in order to prevent disruptions to their ability to provide reliable and efficient contributions to the operations of the Nation's critical infrastructure. Space systems are reliant on information systems and networks from design conceptualization through launch and flight operations. Further, the transmission of command and control and mission information between space vehicles and ground networks relies on the use of radio-frequency-dependent wireless communication channels. These systems, networks, and channels can be vulnerable to malicious activities that can deny, degrade, or disrupt space operations, or even destroy satellites. [...] The National Cyber Strategy of September 2018 states that my Administration will enhance efforts to protect our space assets and supporting infrastructure from evolving cyber threats, and will work with industry and international partners to strengthen the cyber resilience of existing and future space systems."

  United States. Office of the Federal Register

  Trump, Donald, 1946-

  2020-09-04
• Cyber Strategic Outlook: The United States Coast Guard's Vision to Protect and Operate in Cyberspace

  Show summary     Open resource [pdf]     (open full abstract)

  From the Introduction: "Cyber attacks against the United States (U.S.) are one of the most significant threats to our economic and military power since World War II. The events of the last five years, including the exploitation of U.S. Coast Guard networks and information, attacks on maritime critical infrastructure, and adversarial efforts to undermine our democratic processes, reinforce that cyberspace is a contested domain. This Outlook updates the 2015 Cyber Strategy to ensure U.S. Coast Guard readiness to conduct all missions in a contested cyberspace, to secure the maritime transportation sector through a rules-based international order, and to identify and combat adversary activity in and through cyberspace. Working in close collaboration with the Department of Homeland Security (DHS), the Department of Defense (DOD), our government partners, foreign allies, and the maritime industry, we will protect the Marine Transportation System (MTS) from threats delivered in and through cyberspace and hold accountable those who would do our nation harm. The threats we face from the cyber domain have outpaced threats from the physical domain. As a military service, federal law enforcement agency, and federal regulator, the U.S. Coast Guard will use its broad authorities and unique capabilities to protect the MTS from all threats, to respond to attacks on maritime critical infrastructure, and to incorporate cyber effects to achieve all mission outcomes."

  United States. Coast Guard

  2021-08
• Executive Order 14028: Improving the Nation's Cybersecurity

  Show summary     Open resource [pdf]     (open full abstract)

  From the Policy: "The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people's security and privacy. The Federal Government must improve its efforts to identify, deter, protect against, detect, and respond to these actions and actors. The Federal Government must also carefully examine what occurred during any major cyber incident and apply lessons learned. But cybersecurity requires more than government action. Protecting our Nation from malicious cyber actors requires the Federal Government to partner with the private sector. The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace. In the end, the trust we place in our digital infrastructure should be proportional to how trustworthy and transparent that infrastructure is, and to the consequences we will incur if that trust is misplaced. Incremental improvements will not give us the security we need; instead, the Federal Government needs to make bold changes and significant investments in order to defend the vital institutions that underpin the American way of life."

  United States. Office of the Federal Register

  Biden, Joseph R., Jr.

  2021-05-12
• Privacy Impact Assessment for the Critical Infrastructure Warning Information Network

  Show summary     Open resource [pdf]     (open full abstract)

  "This Privacy Impact Assessment (PIA) examines the privacy implications for the Critical infrastructure Warning Information Network (CWIN). The Department of Homeland Security (DHS) is responsible for protecting the national infrastructures. DHS is also responsible for ensuring that in the event cyber or physical infrastructures are compromised, there is a means to collaborate and coordinate the necessary resources to restore impacted infrastructures. The mission of CWIN is to facilitate immediate alert, notification, sharing and collaboration of critical infrastructure and cyber information within and between Government and industry partners. CWIN provides a technologically advanced, secure network for communication and collaboration, and alert and notification. CWIN is DHS' only survivable, critical communications tool not dependent on the Public Switch Network (PSN) or the public internet that can communicate both data and voice information in a collaborative environment in support of infrastructure restoration. CWIN provides a survivable, dependable method of communication allowing DHS to communicate with other federal agencies, state and local government, the private sector, and international organizations in the event that primary methods of communication are unavailable."

  United States. Department of Homeland Security

  2006-01-07
• Energy Sector-Specific Plan 2015

  Show summary     Open resource [pdf]     (open full abstract)

  "The 2015 Energy Sector-Specific Plan (SSP) was developed in accordance with the 'NIPP [National Infrastructure Protection Plan] 2013: Partnering for Critical Infrastructure Security and Resilience', which guides the national effort to manage risk to the Nation's critical infrastructure. The U.S. Department of Energy (DOE), as the Sector-Specific Agency (SSA) for the Energy Sector, led the development of the 2015 Energy SSP in close collaboration with its sector partners. A myriad of Energy Sector partners exist in both private and public sectors in the Critical Infrastructure Partnership Advisory Council (CIPAC) framework, under which the Electricity and Oil and Natural Gas Subsector Coordinating Councils (SCCs) and the Energy Government Coordinating Council (GCC) operate. Energy Sector partners have developed a valuable and increasingly trusted partnership in the past decade, which has been the cornerstone of the Nation's integrated risk management approach to critical infrastructure security and resilience. The Energy Sector is characterized by widely-diverse infrastructure components, a multifaceted operational environment, and complex ownership and regulatory structures. Further, the Energy Sector provides one of the key lifeline-functions upon which all other critical infrastructure sectors rely--the Nation's security and economy depend on it. In turn, the Energy Sector depends on many other critical infrastructure sectors, such as transportation, information technology (IT), communications, water, and financial services. In addition, the sector faces evolving threats and risks, such as natural disaster events, cyber and physical security threats, aging/failing infrastructure, and the potential shortage of a skilled workforce."

  United States. Department of Homeland Security

  2015
• Potential Vulnerabilities in Municipal Communications Networks: A US-CERT Informational Focus Paper

  Show summary     Open resource [pdf]     (open full abstract)

  This United States Computer Emergency Readiness Team (US-CERT) informational paper focuses on vulnerabilities in municipal communications networks. "Until recently, municipal entities such as emergency services, law enforcement, and utility operations, have each maintained and supported their own independent information and communications infrastructure within the municipal operations enclave. Each entity tended to operate in its own isolated domain, and used traditional methods of communications to access information from peer organizations. These methods for infrastructure deployment tended to be costly to maintain, did not provide for robust intra-agency operations, and was difficult to administer from a hierarchical and municipal bureau perspective. Moreover, the disparate nature of the network operations could produce incompatible response capabilities for agencies experiencing incidents or under duress and could lead to stove-piped operations. [...] Within this new business paradigm, one area of key concern is the cyber security of the control systems in core critical infrastructure components such as water, energy, and oil/gas. The convergence of these traditionally isolated operational domains into simplified architectures can introduce security vulnerabilities and weaknesses, and municipalities need to be aware of these issues to be able to protect these resources that are so vital to public safety and quality of life. Without considering the cyber security aspects during the initial phases of development, some municipalities may be inadvertently creating vulnerabilities that can reduce the security posture of infrastructure components, and create attack opportunities into the control system domain. Understanding and mitigating these vulnerabilities are critical, as some attackers could possibly use these municipal 'super nets' to launch cyber attacks, and impact key operational activities."

  United States. Department of Homeland Security. National Cyber Security Division

  2006-12-05
• Cyber Security Division: FY 2011 Annual Report

  Show summary     Open resource [pdf]     (open full abstract)

  "In Fiscal Year 2011 (FY 2011), the U.S. Department of Homeland Security (DHS) Science and Technology (S&T) Directorate established the Cyber Security Division (CSD), within the Directorate's Homeland Security Advanced Research Projects Agency (HSARPA), in response to the increasing importance of the cybersecurity mission. CSD's mission is to develop and transition new technologies, tools, and techniques to protect and secure systems, networks, infrastructure, and users, improving the foundational elements of our nation's critical infrastructure and the world's information infrastructure; and, to provide coordination and research and development leadership across federal, state, and municipal government; international partners; the private sector; and academia to improve cybersecurity research infrastructure."

  United States. Department of Homeland Security. Science and Technology Directorate

  2012?
• Cybersecurity: Challenges in Securing the Modernized Electricity Grid, Statement of Gregory C. Wilshusen, Director Information Security Issues; David C. Trimble, Director Natural Resources and Environment, Testimony Before the Subcommittee on Oversight and Investigations, Committee on Energy and Commerce, House of Representatives

  Show summary     Open resource [pdf]     (open full abstract)

  "The electric power industry is increasingly incorporating information technology (IT) systems and networks into its existing infrastructure as part of nationwide efforts--commonly referred to as the 'smart grid'--aimed at improving reliability and efficiency and facilitating the use of alternative energy sources such as wind and solar. Smart grid technologies include metering infrastructure ('smart meters') that enable two-way communication between customers and electricity utilities, smart components that provide system operators with detailed data on the conditions of transmission and distribution systems, and advanced methods for controlling equipment. The use of these systems can bring a number of benefits, such as fewer and shorter outages, lower electricity rates, and an improved ability to respond to attacks on the electric grid. However, this increased reliance on IT systems and networks also exposes the grid to cybersecurity vulnerabilities, which can be exploited by attackers. Moreover, for nearly a decade, GAO [Government Accountability Office] has identified the protection of systems supporting our nation's critical infrastructure--which include the electric grid--as a governmentwide high-risk area. GAO is providing a statement describing (1) cyber threats facing cyber-reliant critical infrastructures and (2) key challenges to securing smart grid systems and networks. In preparing this statement, GAO relied on its previously published work in this area."

  United States. Government Accountability Office

  2012-02-28
• Private Sector and Government Challenges and Opportunities to Promote the Cybersecurity and Resiliency of Our Nation's Critical Energy Infrastructure, Hearing Before the Committee on Energy and Natural Resources, United States Senate, One Hundred Fifteenth Congress, Second Session, March 1, 2018

  Show summary     Open resource [pdf]     (open full abstract)

  This is the March 1, 2018 hearing on "Private Sector and Government Challenges and Opportunities to Promote the Cybersecurity and Resiliency of Our Nation's Critical Energy Infrastructure" held before the U.S. Senate Committee on Energy and Natural Resources. From the opening statement of Lisa Murkowski:"Cyberattacks are a well-documented and continuing threat. Every day we seem to hear of yet another incident. Increasingly, it appears that the bad actors are nation-states and sophisticated entities, such as organized crime or terror groups. These attacks are across-the-board and not limited, of course, to energy infrastructure. [...] What should the Federal Government do, or refrain from doing, to meet this dynamic and evolving threat? And how can the government help improve the cyber resiliency of critical energy infrastructure if a threat becomes a reality? [...] Protecting our nation's energy infrastructure, we all agree, is critical to maintaining so much of the American way of life. We must determine what the next appropriate steps will be to further identify and prevent cyber intrusions and increase resiliency in the event of an attack. Those solutions may not require more regulation, but rather more common sense and cooperation." Statements, letters, and materials submitted for the record include those of the following: Bruce J. Walker, Jim Matheson, Barbara Endicott-Popovsky, William H. Sanders, and Robert M. Lee.

  United States. Government Publishing Office

  2019
• Cybersecurity Issues for the Bulk Power System [June 10, 2015]

  Show summary     Open resource [pdf]     (open full abstract)

  "In the United States, it is generally taken for granted that the electricity needed to power the U.S. economy is available on demand and will always be available to power our machines and devices. However, in recent years, new threats have materialized as new vulnerabilities have come to light, and a number of major concerns have emerged about the resilience and security of the nation's electric power system. In particular, the cybersecurity of the electricity grid has been a focus of recent efforts to protect the integrity of the electric power system. The increasing frequency of cyber intrusions on industrial control (IC) systems of critical infrastructure continues to be a concern to the electric power sector. Power production and flows on the nation's electricity grid are controlled remotely by a number of IC technologies. The National Security Agency (NSA) reported that it has seen intrusions into IC systems by entities with the apparent technical capability 'to take down control systems that operate U.S. power grids, water systems and other critical infrastructure.' […] This report highlights several areas for congressional consideration to improve grid cybersecurity. One issue is whether electric utilities have the resources to make the financial investment and recruit staff to reduce vulnerabilities. Another issue is that NERC CIP standards do not apply to all points of grid connection to the distribution system, and these connections still may represent cyber vulnerabilities. The adequacy of current standards where they do apply is also an issue."

  Library of Congress. Congressional Research Service

  Campbell, Richard J.

  2015-06-10
• Serial No. 108-196: Telecommunications and SCADA: Secure Links or Open Portals to the Security of Our Nation's Critical Infrastructure? Hearing before the Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census of the Committee on Government Reform, House of Representatives, One Hundred Eighth Congress, Second Session, March 30, 2004

  Show summary     Open resource [pdf]     (open full abstract)

  From the opening statement of Adam H. Putnam: "Clearly, the issue of protecting the cyber element of our Nation's critical infrastructure is of paramount concern to this subcommittee and we will continue to examine these matters comprehensively. This is our second hearing dealing with the issue of SCADA or industrial control systems. Our first hearing was a closed hearing. Through our hearings and other high level briefings, it has become abundantly clear that our Nation is not protected sufficiently from cyber attack against our critical infrastructure. Given the fact that roughly 80 percent of these systems are owned or controlled by the private sector, it is important that we work collaboratively and aggressively to address this matter. The testimony today will, obviously, not reveal specific vulnerabilities; but I hope it will raise the alarm so that necessary steps will be taken to secure our critical infrastructure from the potential of cyber attack. Additionally, this hearing will focus attention on the telecommunications that connect SCADA devices to their control and monitoring networks and review the associated vulnerabilities." Statements, letters, and materials submitted for the record include those of the following: Robert F. Dacey, James F. McDonnell, Joseph Weiss, Dan Verton, Gerald S. Freese, Jeffrey H. Katz, Wm. Lacy Clay, Candice S. Miller, and Adam H. Putnam.

  United States. Government Printing Office

  2004
• National Protection and Programs Directorate: Factors to Consider when Reorganizing, Statement of Chris Currie, Director, Homeland Security and Justice, Testimony Before the Cybersecurity, Infrastructure Protection, and Security Technologies Subcommittee of the Homeland Security Committee, House of Representatives

  Show summary     Open resource [pdf]     (open full abstract)

  "NPPD [National Protection and Programs Directorate] is the DHS component responsible for addressing physical and cyber infrastructure protection, a mission area of critical importance in today's threat environment. Critical infrastructure owners and operators continue to experience increasingly sophisticated cyber intrusions and a 'cyber-physical convergence' has changed the risks to critical infrastructure ranging from energy and transportation to agriculture and health care, according to a DHS strategic review. NPPD's potential reorganization is the latest in DHS's organizational evolution. In 2003, GAO [Government Accountability Office] designated implementing and transforming DHS as high risk because DHS had to transform 22 agencies-several with major management challenges-into one department. The overriding tenet has consistently remained DHS's ability to build a single, cohesive, and effective department that is greater than the sum of its parts-a goal that requires effective collaboration and integration of its various components and management functions. This statement describes key factors for consideration in a NPPD reorganization. It includes observations from GAO's prior work on organizational change, reorganization, and transformation, applicable themes from GAO's high risk list, and NPPD related areas from GAO's work in assessing programmatic duplication, overlap, and fragmentation. This testimony is based on reports we issued from 2003 through 2015."

  United States. Government Accountability Office

  2015-10-07
• NSTAC Response to the Sixty-Day Cyber Study Group

  Show summary     Open resource [pdf]     (open full abstract)

  "The President's National Security Telecommunications Advisory Committee (NSTAC) is pleased to know that the Obama Administration understands that cyberspace is a strategic asset and that its protection should be considered a national security priority. The NSTAC agrees with this posture and has examined issues pertaining to national security and emergency preparedness (NS/EP) communications in a converged environment for many years. The NSTAC is aware that a significant amount of work is being done across the Federal Government and within a number of advisory committees and industry organizations. The NSTAC appreciates the opportunity to provide input to the Executive Office of the President's (EOP) cybersecurity review and believes it is well positioned to offer a unique insight given its national security focus. The Government, inclusive of State and local authorities responsible for protecting critical infrastructure from physical threats, and the private sector share the responsibility for securing cyber space and the Nation's critical communications infrastructure. This responsibility benefits from complementary skills sets and resources possessed by both Government and industry to address cyber threats and threats to the physical infrastructure. In moving forward, it is essential the Government and the private sector adopt a coordinated approach to achieving joint goals in a manner that is consistent with the Constitution and laws of the United States, as well as principals of effective governmental and commercial enterprise management."

  United States. President's National Security Telecommunications Advisory Committee

  2009-03-12
• Cybersecurity: Federal Agencies Met Legislative Requirements for Protecting Privacy When Sharing Threat Information

  Show summary     Open resource [pdf]     (open full abstract)

  "Federal agencies and our nation's critical infrastructures, such as communications and financial services, are dependent on information technology systems and electronic data to carry out operations and to process, maintain, and report essential information. The security of these systems and data is vital to public confidence and national security, prosperity, and well-being. Yet, cyber-based intrusions and attacks on federal and nonfederal systems have become not only more numerous and diverse, but also more damaging and disruptive. For example, a data breach reported in July 2015 at the Office of Personnel Management affected at least 21.5 million individuals and compromised federal employees' personal information, including Social Security numbers, residency and education history, employment history, financial history, and the fingerprints of approximately 5.6 million individuals. Due to cyber-based threats to federal systems and critical infrastructure, the persistent nature of information security vulnerabilities, and associated risks, we have continued to designate information security as a government-wide high-risk area in our most recent biennial report to Congress--a designation we have made in each high-risk report since 1997. We expanded this area beyond federal information systems to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015."

  United States. Government Accountability Office

  2018-12-06
• Evaluation Report: The Department's Unclassified Cyber Security Program - 2012

  Show summary     Open resource [pdf]     (open full abstract)

  "As the use of information technology resources continues to expand, the number of cyber security threats against Federal agencies has also increased. In fact, Federal cyber security officials have warned that the number of cyber attackers has increased and that the Nation's defensive capabilities need improvement. Consistent with the nearly twentyfold increase on the number of attacks on the Nation's infrastructure from 2009 to 2011, the Department of Energy reported nearly 3,000 cyber-related incidents over the past 4 years. To help mitigate the risks posed by such threats, the Department expended significant resources in Fiscal Year (FY) 2012 on cyber security measures designed to secure its information systems and data that support various program operations. The 'Federal Information Security Management Act of 2002' (FISMA) established requirements for all Federal agencies to develop and implement agency-wide information security programs. In addition, FISMA directed Federal agencies to provide appropriate levels of security for the information and systems that support the operations and assets of the agency, including those managed by another agency or contractors. As required by FISMA, the Office of Inspector General conducted an independent evaluation to determine whether the Department's unclassified cyber security program adequately protected its data and information systems. This memorandum and the attached report document the results of our evaluation for FY 2012."

  United States. Department of Energy. Office of Inspector General

  2012-11
• Cybersecurity Information Sharing Between Public Private Sector Agencies

  Show summary     Open resource [pdf]     (open full abstract)

  From the thesis abstract: "Government agencies, businesses, and individuals alike have become more dependent on technology, and the desire and need for interconnectedness has led to increasing network vulnerability affecting both government and private sectors. Recognizing both government and private sector agencies individually lack the capabilities to defend against cyber threats, President Obama has called for a more robust and resilient cybersecurity alliance that encourages information-sharing partnerships with private sector owners and operators in charge of protecting U.S. critical infrastructme. Despite the recent drive for cyber legislation and policies, government agencies and private companies have seemed reluctant to share information related to cyber-attacks and threats with one another. To discover the deeper underlying issues that inhibit public-private cooperation, and to evaluate the effectiveness of public-private partnerships (PPPs) to advance cyber information sharing, this thesis examines the banking and finance sector of U.S. critical infrastructure sector. In doing so , it identifies reasons why information-sharing problems exist between government agencies and private companies; investigates how PPPs satisfy national cybersecurity needs; and, in turn, reveals issues for policymakers to consider when shaping policies that encourage an open dialog between the public and private sector."

  Naval Postgraduate School (U.S.)

  Kaijankoski, Eric A.

  2015-03
• United States Army's Cyberspace Operations Concept Capability Plan 2016-2028

  Show summary     Open resource [pdf]     (open full abstract)

  "The operational environment (OE) has changed dramatically. The technologic convergence of computer and telecommunication networks; astonishing rates of technologic advancements; global proliferation of information and communications technology (ICT) and its consequent effect in social networks and in society impact the OE. The diverse and wide arrays of agents who use or exploit this technological revolution pose a grave threat to U.S. critical infrastructure and operational missions. These agents range from traditional nation-states to noncombatants, transnational corporations, criminal organizations, terrorists, hacker unions, mischievous hackers, and the unwitting individual who intends no malice. Collectively, they combine to create a condition of perpetual turbulence without traditional end states or resolution. Unless otherwise noted in this document, the terms 'adversary' and 'adversaries' are used in this broad context. [...] Training and Doctrine Command (TRADOC) Pamphlet (Pam) 525-7-8, The U.S. Army Concept Capability Plan for Cyberspace Operation (CyberOps) 2016-2028, takes a comprehensive look at how the Army's future force in 2016-2028 will leverage cyberspace and CyberOps. This pamphlet includes a conceptual framework for integrating CyberOps into FSO, thereby providing the basis for follow-on doctrine development efforts. This conceptual framework outlines how commanders integrate CyberOps to gain advantage, protect that advantage, and place adversaries at a disadvantage. This pamphlet also establishes a common lexicon for Army CyberOps, and describes the relationship between cyberspace, the other four domains (air, land, maritime, and space), and the EMS. Lastly, it explains how converging technologies will increasingly affect FSO and influence capability development, thereby enabling the Army to influence the design, development, acquisition, and employment of fully integrated cyber capabilities."

  United States. Department of the Army

  2010-02-22
• Cost of Malicious Cyber Activity to the U.S. Economy

  Show summary     Open resource [pdf]     (open full abstract)

  "This report examines the substantial economic costs that malicious cyber activity imposes on the U.S. economy. Cyber threats are ever-evolving and may come from sophisticated adversaries. Due to common vulnerabilities, instances of security breaches occur across firms and in patterns that are difficult to anticipate. Importantly, cyberattacks and cyber theft impose externalities that may lead to rational underinvestment in cybersecurity by the private sectorrelative to the socially optimal level of investment. Firms in critical infrastructure sectors may generate especially large negative spillover effects to the wider economy. Insufficient data may impair cybersecurity efforts. Successful protection against cyber threats requires cooperation across firms and between private and public sectors."

  United States. Executive Office of the President

  2018-02
• Cyber Threats and Security Solutions: Hearing Before the Committee on Energy and Commerce, House of Representatives, One Hundred Thirteenth Congress, First Session, May 21, 2013

  Show summary     Open resource [pdf]     (open full abstract)

  This is the May 21, 2013 hearing on "Cyber Threats and Security Solutions," held before the United States House of Representatives, Committee on Energy and Commerce. From the opening statement of Marsha Blackburn: "American companies, the U.S. government and private citizens are facing new challenges in the fight to protect our Nation's security, economy, intellectual property and critical infrastructure from cyber attacks. Today the Energy and Commerce Committee is exploring how the private sector and our government are responding. We will also review the implementation of the President's Cybersecurity Executive Order 13636. Cyber attacks have grown in scope and sophistication to include nearly every industry and asset that makes America work. That is why this committee is well positioned to lead, oversee and review policies and solutions to these wide-ranging and evolving threats. Last year an al-Qaeda video surfaced calling for a covert cyber jihad against the United States. On Sunday, the New York Times reported that hackers sponsored by China's People's Liberation Army have resumed attacks on U.S. targets. According to the GAO [Government Accountability Office], the number of cyber incidents reported by federal agencies to U.S. Computer Emergency Readiness Teams has increased by 782 percent over 6 years." Statements, letters, and materials submitted for the record include those of the following: Marsha Blackburn, Henry A. Waxman, Fred Upton, Patrick D. Gallagher, Dave McCurdy, John M. McConnell, R. James Woolsey, Michael Papay, Phyllis Schneck, Charles Blauner, Duane Highley, and Robert Mayer.

  United States. Government Printing Office

  2013