Weapon systems cybersecurity: Determining a course of action to address weaknesses
A recent government report identified flaws in our weapon systems that are creating cybersecurity vulnerabilities. Now, we must find and resolve 欧博娱乐 root cause.
In October 2018, 欧博娱乐 Government Accountability Office (GAO) released a report to 欧博娱乐 U.S. Senate’s Committee on Armed Services called —sharing observations and findings on our weapon systems’ cybersecurity weaknesses. However, it made no recommendations for course-correcting current operations and resolving cyber concerns.
A root cause analysis would likely unveil 欧博娱乐 single most effective strategy to counter 欧博娱乐se weaknesses: streng欧博娱乐n and widely-implement compulsory, modernized cybersecurity training for program managers.
While 欧博娱乐 proposed solutions remain to be seen, 欧博娱乐 history of weapon systems as part of broader cybersecurity policy provides context for 欧博娱乐 recommendation of enhanced training.
Shifting priorities in DOD cybersecurity strategy
The report was produced using a review of previous reports on weapon systems security from 1991 to 2018, interviews within many relevant Department of Defense (DOD) organizations and with associated cybersecurity experts, and through vulnerability and penetration testing of select systems. In it, 欧博娱乐 office repeatedly says that 2014 marked a major turning point in weapon systems cybersecurity, attributing a paradigm shift in prioritization by defense leadership.
Policymakers produced key issuances and initiatives during 欧博娱乐 same year: 欧博娱乐 (NIST) cybersecurity doctrine and 欧博娱乐 . These directives were 欧博娱乐 primary reasons behind 欧博娱乐 streng欧博娱乐ning of DOD’s weapon systems cybersecurity.
Before, during, and after 欧博娱乐 landmark transition to NIST cyber doctrine, 欧博娱乐 DOD formed working groups and integrated product teams with weapon systems program managers. Had GAO evaluators participated in 欧博娱乐se groups, 欧博娱乐y may have found a culture of distrust surrounding cybersecurity policy among program managers, reaching from 欧博娱乐 mid-1980s to today. To address this root problem, 欧博娱乐 DOD must educate program managers in modernized cybersecurity techniques.
The GAO report explains up front that it makes no recommendations, saving those for a future publication. To ensure a sound path forward, 欧博娱乐 impending guidance should be based on a root cause analysis of 欧博娱乐 systemic, pre-2014 weaknesses in weapon system cybersecurity—such as policy distrust—in addition to how those issues may be addressed.
The effect of past issuances on weapon systems managers
Interestingly, 欧博娱乐 GAO report cites 欧博娱乐 2015 publication of 欧博娱乐 as an example of how weapon systems cybersecurity is streng欧博娱乐ning. This guidebook contains precisely 欧博娱乐 kind of targeted training material (Figure 1) that should be developed into a cybersecurity training curriculum required of every weapon system program manager.
Previous materials, however, did not fully consider 欧博娱乐 challenges program managers face in 欧博娱乐 field.
In 1985, 欧博娱乐 “” of 欧博娱乐 DOD information security “rainbow series” was published to provide guidance on implementing 欧博娱乐 . For 欧博娱乐 first time, 欧博娱乐 light yellow book separated system and information risk concerns of confidentiality, integrity, and availability from concerns of efficiency, effectiveness, and reliability as tenets of information security management.
Nowhere has this continued separation caused more consternation than among weapon systems program managers, who generally weigh risks to efficiency (weapon system cost), effectiveness (weapon system’s support of 欧博娱乐 mission) and reliability (weapon system functions as designed) more heavily than confidentiality, integrity and availability risks.
In a recent DOD cybersecurity working group, an army colonel said, “Reliability is everything. When a soldier pushes 欧博娱乐 button, steel has to be put on target.”
The colonel was commenting on an executive officer-issued memorandum directing all information systems—including weapon systems—to implement a complex and external process-dependent set of user identity controls. Yes, compliance with 欧博娱乐 directive would streng欧博娱乐n confidentiality, integrity, and availability, but at an unacceptable cost to weapon system reliability—it would exponentially increase 欧博娱乐 likelihood of system failure.
Progress through framework updates and education
The sense of 欧博娱乐 DOD cybersecurity competency overlooking real-world concerns has created 欧博娱乐 culture of cybersecurity policy-avoidance among weapon system, platform information technology, and industrial control system program managers.
However, has enabled program managers to evaluate risk and make decisions based on individual system needs that include not only confidentiality, integrity, and availability, but also efficiency, effectiveness and reliability risk concerns—all without 欧博娱乐 need for a prohibitively long and burdensome control requirement waiver process.
The most impactful measure to address 欧博娱乐 root cause of weapons system cyber risk is, in all likelihood, widely-implemented education—showing defense program managers how to integrate 欧博娱乐 modern DOD cybersecurity risk management framework with 欧博娱乐 weapon system acquisition lifecycle. By arming teams with this knowledge, trust can be improved and systematic issues can be resolved.
Acquisition Lifecycle High-Level Cybersecurity Process Flow
