Cyber Security For US Weapons Systems Criticised

US Air Force weapon systems are heavily reliant on complex software and high interconnectivity to per- form their missions. Cyber capabilities enable many of the advanced features, such as electronic attack, sensor fusion, and communications that give the Air Force its edge over potential adversaries, but they also create potential opportunities for adversaries to counter US advantages through cyber attacks. 

Despite the US Defense Department’s (DoD) efforts to build networked weapon systems heavily dependent on software and information technologies, the military service branches have not all issued clear guidance describing how acquisition officials should incorporate cybersecurity requirements into contracts for these systems.  

Of the four services, the Air Force is the only branch to have issued service wide guidance for defining and incorporating cybersecurity requirements into contracts, according to a recent Government Accountability Office (GAO) audit report. The report builds on another audit from 2018 when GAO found DOD was in the early stages of understanding how to apply cyber security to weapon systems. 

While DOD has made improvements in this area since 2018, for example, by ensuring programs have access to adequate cyber expertise, increasing the use of cyber security assessments, and releasing more guidance, the agency is still learning how to contract for cyber security in weapon systems, according to the audit. “Current military service guidance, except for the Air Force, does not address how acquisition programs should contract for weapon systems cybersecurity requirements, acceptance criteria, and verification, which DOD and program officials told GAO would be helpful.” 

The GAO did not include the Cybersecurity Maturity Model Certification program, which requires defense contractors to undergo audits by independent third parties overseen by an accreditation body to validate the security of their systems, in this review.  The audit was released in a time of the disastrous SolarWinds attack, which affected multiple federal agencies.

The Chair of the House Armed Services Committee, Adam Smith, emphasised the importance of securing information systems and command and control. “We cannot have the single points of failure, we have to be able to protect those systems,” Smith said.  

The GAO reviewed five programs for the audit: a radar, an anti-jammer, a ship, a ground vehicle, and a missile. The focus of the audit was on weapon systems that include platform IT, which the report defined as hardware and software for real-time mission performance of special-purpose systems. The acquisition programs reviewed lacked cyber security requirements, or at least clear cyber security requirements, in contracts, according to the audit.

Three of the five programs had no cyber security requirements in the contracts whatsoever when they were awarded. 

Even after contracts were modified post-award, some only included generic instruction to comply with DOD policy. “Contractors we spoke to said it is common for requests for proposals to include generic statements regarding cyber security, such as ‘be cyber resilient’ or ‘comply with risk management framework' according to the audit. “The contractors said such statements do not provide enough information to determine what the government wants or how to design a system.”

None of the five contracts defined how cyber security requirements would be verified at the time of the award/. Officials also said contracts usually focus on the controls programs must have rather than on establishing performance-based requirements geared toward achieving desired outcomes. 

The US Air Force’s System Program Protection and Systems Security Engineering Guidebook, created by the Cyber Resiliency Office for Weapons Systems, or CROWS, was the posistive highlight spot of the GAO audit.  

The guidebook consolidates DOD and Air Force guidance into a single, detailed document complete with suggestions for implementation, according to the audit.  GAO recommended the other service branches develop cyber security requirements guidance for acquisition programs like the guidebook. DOD concurred with the recommendations for the Army and the Navy and asked the Marine Corps to be considered under the recommendation for the Navy. 

The US Air Force relies heavily on advanced computer and software systems, so it is paramount to keep those systems safe. It's the job of Cyber Systems Operations specialists to design, install and support our systems to ensure they operate properly and remain secure from outside intrusion. 

US AirForce:        RAND:      US GAO:     US Airforce University:       NextGov:      Image: Unsplash

You Might Also Read: 

US Air Force Hacked By Teenager:

 

« Is Blockchain The Future Of SSL Certificates?
British Companies Compromised By Exchange Email Hacking »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Juniper Networks

Juniper Networks

Juniper Networks is the industry leader in network innovation. We provide network infrastructure and network security solutions.

European Council on Foreign Relations (ECFR)

European Council on Foreign Relations (ECFR)

ECFR is a pan-European think-tank conducting research and promote informed debate on European foreign policy. Cyber security is becoming an intrinsic element of foreign policy debate.

IP Performance

IP Performance

IP Performance Limited is a leading supplier of customised network infrastructure and security solutions.

CloudInsure

CloudInsure

CloudInsure is a Cloud Insurance platform designed to specifically address emerging liabilities within the Cloud environment.

BitSight Technologies

BitSight Technologies

BitSight transforms how companies manage information security risk with objective, verifiable and actionable Security Ratings.

Tenfold Software

Tenfold Software

Tenfold is the unique, centralized platform for managing user and permissions efficiently and automatically.

CyberSecurityTrainingCourses.com

CyberSecurityTrainingCourses.com

Cyber Security Training Courses is a portal to help candidates find the best courses to progress their career within the IT security industry.

SBD Automotive

SBD Automotive

SBD Automotive are specialists in automotive technology providing independent research and consultancy to help create smarter, more secure, better connected, and increasingly autonomous cars.

Charities Security Forum (CSF)

Charities Security Forum (CSF)

The Charities Security Forum is the premier membership group for information security people working for charities and not-for-profits in the UK.

Qualcomm Technologies

Qualcomm Technologies

Qualcomm invents breakthrough technologies that transform how the world connects, computes and communicates.

Informer

Informer

Informer provides an Attack Surface Management SaaS platform alongside penetration testing services. We combine machine learning and human intelligence to reduce cyber risk.

IP2Location

IP2Location

IP2Location provide services to identify geolocation by IP address, and to detect IP addresses associated with anonymous proxy servers, which are often used for fraud and spamming purposes.

Huntington Ingalls Industries (HII)

Huntington Ingalls Industries (HII)

Huntington Ingalls Industries is America’s largest military shipbuilding company and a provider of professional services to partners in government and industry.

Computer Services Inc (CSI)

Computer Services Inc (CSI)

CSI is a leading fintech, regtech and cybersecurity solutions partner operating at the intersection of innovation and service.

CyberUSA

CyberUSA

CyberUSA is a collaboration of leaders and states focused on a common mission purpose of enabling innovation, education, workforce development, enhanced cyber readiness and resilience.

US Department of State - Bureau of Cyberspace & Digital Policy

US Department of State - Bureau of Cyberspace & Digital Policy

The Bureau of Cyberspace and Digital Policy leads and coordinates the Department’s work on cyberspace and digital diplomacy to encourage responsible state behavior in cyberspace.