DHS' critical infrastructure plan not cyber-secure, GAO says

GAO says critical industrial sectors' plans don't deal with cybersecuity requirements

The Homeland Security Department should reconsider its approach for securing critical infrastructure after a recent review found most of the protective plans developed by agencies to work with different industries haven’t been updated to meet DHS’ cybersecurity requirements, according to the Government Accountability Office.

GAO investigators found that just three of 17 plans to secure critical infrastructure have been updated to include key cybersecurity criteria, according to a report released Oct. 28. Under DHS’ National Infrastructure Protection Plan, designated government agencies and departments be the lead agencies for collaborating with specific industrial sectors and are responsible for developing the protection plans.

According to GAO, only the water, chemical and commercial facilities industrial sector plans had been updated to include the cybersecurity requirements, while others -- such as information technology, telecommunications, nuclear plants and the defense industrial base -- had not.

DHS agreed with GAO’s overall recommendation to review the current approach and said it “supports the ongoing assessment and improvement of the sector planning approach.” However, the department said there were errors, misinterpretations and incorrect conclusions included in the report.

For example, DHS said the report didn’t take into account the many cybersecurity-related activities in various different sectors. DHS also said just because all of the plans hadn’t been fully updated didn’t mean cybersecurity planning and activities in the sectors were lacking. The department also said updates to the plans for 2010 would deal with the cyber requirements.

However, GAO said until the new sector plans are issued, it is unclear if they actually will deal with the cybersecurity requirements. In addition, GAO said agencies haven’t reported on how much progress they made in putting their plans in place, thus making it unclear how the different sectors were putting in place protective measures.

Meanwhile, DHS said sector specific plans are strategic three-year plans and not meant to provide snapshots of agency efforts or to assess progress in protecting critical infrastructure.

GAO said DHS hadn’t made sector planning a priority. “It is essential that federal cybersecurity leaders — including DHS and the to-be-appointed cybersecurity coordinator — exert their leadership roles in this area by, among other things, determining whether it is worthwhile to continue with the current approach as implemented or consider if proposed options provide more effective results,” the report said.

DHS also disputed GAO's assertion that it hadn’t made the sector planning process a priority and said it was actively engaged with the lead agencies and the industrial sector. 

 

About the Author

Ben Bain is a reporter for Federal Computer Week.

The Fed 100

Read the profiles of all this year's winners.

Featured

  • Then-presidential candidate Donald Trump at a 2016 campaign event. Image: Shutterstock

    'Buy American' order puts procurement in the spotlight

    Some IT contractors are worried that the "buy American" executive order from President Trump could squeeze key innovators out of the market.

  • OMB chief Mick Mulvaney, shown here in as a member of Congress in 2013. (Photo credit Gage Skidmore/Flickr)

    White House taps old policies for new government makeover

    New guidance from OMB advises agencies to use shared services, GWACs and federal schedules for acquisition, and to leverage IT wherever possible in restructuring plans.

  • Shutterstock image (by Everett Historical): aerial of the Pentagon.

    What DOD's next CIO will have to deal with

    It could be months before the Defense Department has a new CIO, and he or she will face a host of organizational and operational challenges from Day One

  • USAF Gen. John Hyten

    General: Cyber Command needs new platform before NSA split

    U.S. Cyber Command should be elevated to a full combatant command as soon as possible, the head of Strategic Command told Congress, but it cannot be separated from the NSA until it has its own cyber platform.

  • Image from Shutterstock.

    DLA goes virtual

    The Defense Logistics Agency is in the midst of an ambitious campaign to eliminate its IT infrastructure and transition to using exclusively shared, hosted and virtual services.

  • Fed 100 logo

    The 2017 Federal 100

    The women and men who make up this year's Fed 100 are proof positive of what one person can make possibile in federal IT. Read on to learn more about each and every winner's accomplishments.

Reader comments

Mon, Nov 2, 2009 DHS Infrastructure Protection Employee

The reason for this continuing failure by DHS is quite simple. As the current report states (p. 29, slide 19), DHS agreed with GAO's 2007 recommendation to update all critical infrastructure sector plans by September 2008 to address cyber considerations. DHS also stated officially to GAO that actions had been initiated to do that. In reality, the responsible assistant secretary very intentionally undermined that commitment. When reminded by senior staff of the obligation, he said he never agreed with the Department's promise, personally knew more than GAO or the Secretary about protecting American infrastructure, and would absolutely not comply before his appointment ended in 2009. Ego and hubris thus took precedence over the needs of our country -- certainly not the first time in that office. It's odd that current Department leaders are defending and rationalizing that the last administration intentionally misled the GAO. The glaring absence of direction from that assistant secretary to update plans for cyber is a matter of record (p. 38, slide 28). Perhaps Secretary Napolitano simply hasn't been told the whole truth by loyalists (improperly) embedded in his office before he left?

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group