GAO: Federal agencies lack insight on ransomware protections for critical infrastructure

The Government Accountability Office finds that agencies overseeing key critical infrastructure sectors don’t know whether protections against ransomware have been implemented.

Federal agencies charged with overseeing the manufacturing, energy, health care and transportation sectors are largely in the dark on whether companies in these sectors have adopted recommended ransomware protections, a new Government Accountability Office report found.

In examining the six lead agencies for those four sectors, the GAO said that “none have fully assessed the effectiveness of their support to sectors” as called out in the Department of Homeland Security’s 2013 National Infrastructure Protection Plan, nor have they “determined the extent of adoption of the National Institute of Standards and Technology’s recommended practices for addressing ransomware.” 

Without thorough assessments from the six sector risk management agencies examined in the report — the Cybersecurity and Infrastructure Security Agency, the Department of Energy, the Department of Health and Human Services, the U.S. Coast Guard, Transportation Security Administration, and the Department of Transportation — their respective sectors are missing out on “communication, coordination, and timely sharing of threat and incident information,” the GAO stated.

The report from GAO, which conducted a performance audit from August 2022 to January 2024, comes amid a proliferation of ransomware attacks on critical infrastructure, including against U.S. manufacturing plants and health care facilities as well as high-profile incidents with energy systems, such as Colonial Pipeline in May 2021. 

From October 2021 to October 2022, CISA reported more than 250 ransomware incidents involving the manufacturing, energy, health care and transportation critical infrastructure sectors. The FBI, meanwhile, noted that among the 870 critical infrastructure organizations that the bureau reported to be victims of ransomware, nearly half came from those four sectors.

Given the scattershot reporting approaches of ransomware attacks from both the public and private sector, CISA is working on new rules to create standardization in how ransomware attacks are reported. The lack of current reporting requirements “makes it more challenging for SRMAs to know the full impact of ransomware on their respective sectors,” the GAO noted.

The GAO’s 11 recommendations were met with varied responses: DHS and HHS agreed with their recommendations, while DOE and DOT agreed with some and disagreed with others. 

“Given that ransomware remains one of the most serious and concerning cybersecurity challenges to our nation’s critical infrastructure, it is vital that the SRMAs assess risks and measure the effectiveness of their support activities to better protect their respective sectors from this pervasive threat,” the report said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure