DHS' critical infrastructure plan not cyber-secure, GAO says

GAO says critical industrial sectors' plans don't deal with cybersecuity requirements

The Homeland Security Department should reconsider its approach for securing critical infrastructure after a recent review found most of the protective plans developed by agencies to work with different industries haven’t been updated to meet DHS’ cybersecurity requirements, according to the Government Accountability Office.

GAO investigators found that just three of 17 plans to secure critical infrastructure have been updated to include key cybersecurity criteria, according to a report released Oct. 28. Under DHS’ National Infrastructure Protection Plan, designated government agencies and departments be the lead agencies for collaborating with specific industrial sectors and are responsible for developing the protection plans.

According to GAO, only the water, chemical and commercial facilities industrial sector plans had been updated to include the cybersecurity requirements, while others -- such as information technology, telecommunications, nuclear plants and the defense industrial base -- had not.

DHS agreed with GAO’s overall recommendation to review the current approach and said it “supports the ongoing assessment and improvement of the sector planning approach.” However, the department said there were errors, misinterpretations and incorrect conclusions included in the report.

For example, DHS said the report didn’t take into account the many cybersecurity-related activities in various different sectors. DHS also said just because all of the plans hadn’t been fully updated didn’t mean cybersecurity planning and activities in the sectors were lacking. The department also said updates to the plans for 2010 would deal with the cyber requirements.

However, GAO said until the new sector plans are issued, it is unclear if they actually will deal with the cybersecurity requirements. In addition, GAO said agencies haven’t reported on how much progress they made in putting their plans in place, thus making it unclear how the different sectors were putting in place protective measures.

Meanwhile, DHS said sector specific plans are strategic three-year plans and not meant to provide snapshots of agency efforts or to assess progress in protecting critical infrastructure.

GAO said DHS hadn’t made sector planning a priority. “It is essential that federal cybersecurity leaders — including DHS and the to-be-appointed cybersecurity coordinator — exert their leadership roles in this area by, among other things, determining whether it is worthwhile to continue with the current approach as implemented or consider if proposed options provide more effective results,” the report said.

DHS also disputed GAO's assertion that it hadn’t made the sector planning process a priority and said it was actively engaged with the lead agencies and the industrial sector. 

 

About the Author

Ben Bain is a reporter for Federal Computer Week.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Mon, Nov 2, 2009 DHS Infrastructure Protection Employee

The reason for this continuing failure by DHS is quite simple. As the current report states (p. 29, slide 19), DHS agreed with GAO's 2007 recommendation to update all critical infrastructure sector plans by September 2008 to address cyber considerations. DHS also stated officially to GAO that actions had been initiated to do that. In reality, the responsible assistant secretary very intentionally undermined that commitment. When reminded by senior staff of the obligation, he said he never agreed with the Department's promise, personally knew more than GAO or the Secretary about protecting American infrastructure, and would absolutely not comply before his appointment ended in 2009. Ego and hubris thus took precedence over the needs of our country -- certainly not the first time in that office. It's odd that current Department leaders are defending and rationalizing that the last administration intentionally misled the GAO. The glaring absence of direction from that assistant secretary to update plans for cyber is a matter of record (p. 38, slide 28). Perhaps Secretary Napolitano simply hasn't been told the whole truth by loyalists (improperly) embedded in his office before he left?

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group