DHS' critical infrastructure plan not cyber-secure, GAO says

GAO says critical industrial sectors' plans don't deal with cybersecuity requirements

The Homeland Security Department should reconsider its approach for securing critical infrastructure after a recent review found most of the protective plans developed by agencies to work with different industries haven’t been updated to meet DHS’ cybersecurity requirements, according to the Government Accountability Office.

GAO investigators found that just three of 17 plans to secure critical infrastructure have been updated to include key cybersecurity criteria, according to a report released Oct. 28. Under DHS’ National Infrastructure Protection Plan, designated government agencies and departments be the lead agencies for collaborating with specific industrial sectors and are responsible for developing the protection plans.

According to GAO, only the water, chemical and commercial facilities industrial sector plans had been updated to include the cybersecurity requirements, while others -- such as information technology, telecommunications, nuclear plants and the defense industrial base -- had not.

DHS agreed with GAO’s overall recommendation to review the current approach and said it “supports the ongoing assessment and improvement of the sector planning approach.” However, the department said there were errors, misinterpretations and incorrect conclusions included in the report.

For example, DHS said the report didn’t take into account the many cybersecurity-related activities in various different sectors. DHS also said just because all of the plans hadn’t been fully updated didn’t mean cybersecurity planning and activities in the sectors were lacking. The department also said updates to the plans for 2010 would deal with the cyber requirements.

However, GAO said until the new sector plans are issued, it is unclear if they actually will deal with the cybersecurity requirements. In addition, GAO said agencies haven’t reported on how much progress they made in putting their plans in place, thus making it unclear how the different sectors were putting in place protective measures.

Meanwhile, DHS said sector specific plans are strategic three-year plans and not meant to provide snapshots of agency efforts or to assess progress in protecting critical infrastructure.

GAO said DHS hadn’t made sector planning a priority. “It is essential that federal cybersecurity leaders — including DHS and the to-be-appointed cybersecurity coordinator — exert their leadership roles in this area by, among other things, determining whether it is worthwhile to continue with the current approach as implemented or consider if proposed options provide more effective results,” the report said.

DHS also disputed GAO's assertion that it hadn’t made the sector planning process a priority and said it was actively engaged with the lead agencies and the industrial sector. 

 

About the Author

Ben Bain is a reporter for Federal Computer Week.

Who's Fed 100-worthy?

Nominations are now open for the 2015 Federal 100 awards. Get the details and submit your picks!

Featured

Reader comments

Mon, Nov 2, 2009 DHS Infrastructure Protection Employee

The reason for this continuing failure by DHS is quite simple. As the current report states (p. 29, slide 19), DHS agreed with GAO's 2007 recommendation to update all critical infrastructure sector plans by September 2008 to address cyber considerations. DHS also stated officially to GAO that actions had been initiated to do that. In reality, the responsible assistant secretary very intentionally undermined that commitment. When reminded by senior staff of the obligation, he said he never agreed with the Department's promise, personally knew more than GAO or the Secretary about protecting American infrastructure, and would absolutely not comply before his appointment ended in 2009. Ego and hubris thus took precedence over the needs of our country -- certainly not the first time in that office. It's odd that current Department leaders are defending and rationalizing that the last administration intentionally misled the GAO. The glaring absence of direction from that assistant secretary to update plans for cyber is a matter of record (p. 38, slide 28). Perhaps Secretary Napolitano simply hasn't been told the whole truth by loyalists (improperly) embedded in his office before he left?

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above