Cyber Security For US Weapons Systems Criticised

US Air Force weapon systems are heavily reliant on complex software and high interconnectivity to per- form their missions. Cyber capabilities enable many of the advanced features, such as electronic attack, sensor fusion, and communications that give the Air Force its edge over potential adversaries, but they also create potential opportunities for adversaries to counter US advantages through cyber attacks. 

Despite the US Defense Department’s (DoD) efforts to build networked weapon systems heavily dependent on software and information technologies, the military service branches have not all issued clear guidance describing how acquisition officials should incorporate cybersecurity requirements into contracts for these systems.  

Of the four services, the Air Force is the only branch to have issued service wide guidance for defining and incorporating cybersecurity requirements into contracts, according to a recent Government Accountability Office (GAO) audit report. The report builds on another audit from 2018 when GAO found DOD was in the early stages of understanding how to apply cyber security to weapon systems. 

While DOD has made improvements in this area since 2018, for example, by ensuring programs have access to adequate cyber expertise, increasing the use of cyber security assessments, and releasing more guidance, the agency is still learning how to contract for cyber security in weapon systems, according to the audit. “Current military service guidance, except for the Air Force, does not address how acquisition programs should contract for weapon systems cybersecurity requirements, acceptance criteria, and verification, which DOD and program officials told GAO would be helpful.” 

The GAO did not include the Cybersecurity Maturity Model Certification program, which requires defense contractors to undergo audits by independent third parties overseen by an accreditation body to validate the security of their systems, in this review.  The audit was released in a time of the disastrous SolarWinds attack, which affected multiple federal agencies.

The Chair of the House Armed Services Committee, Adam Smith, emphasised the importance of securing information systems and command and control. “We cannot have the single points of failure, we have to be able to protect those systems,” Smith said.  

The GAO reviewed five programs for the audit: a radar, an anti-jammer, a ship, a ground vehicle, and a missile. The focus of the audit was on weapon systems that include platform IT, which the report defined as hardware and software for real-time mission performance of special-purpose systems. The acquisition programs reviewed lacked cyber security requirements, or at least clear cyber security requirements, in contracts, according to the audit.

Three of the five programs had no cyber security requirements in the contracts whatsoever when they were awarded. 

Even after contracts were modified post-award, some only included generic instruction to comply with DOD policy. “Contractors we spoke to said it is common for requests for proposals to include generic statements regarding cyber security, such as ‘be cyber resilient’ or ‘comply with risk management framework' according to the audit. “The contractors said such statements do not provide enough information to determine what the government wants or how to design a system.”

None of the five contracts defined how cyber security requirements would be verified at the time of the award/. Officials also said contracts usually focus on the controls programs must have rather than on establishing performance-based requirements geared toward achieving desired outcomes. 

The US Air Force’s System Program Protection and Systems Security Engineering Guidebook, created by the Cyber Resiliency Office for Weapons Systems, or CROWS, was the posistive highlight spot of the GAO audit.  

The guidebook consolidates DOD and Air Force guidance into a single, detailed document complete with suggestions for implementation, according to the audit.  GAO recommended the other service branches develop cyber security requirements guidance for acquisition programs like the guidebook. DOD concurred with the recommendations for the Army and the Navy and asked the Marine Corps to be considered under the recommendation for the Navy. 

The US Air Force relies heavily on advanced computer and software systems, so it is paramount to keep those systems safe. It's the job of Cyber Systems Operations specialists to design, install and support our systems to ensure they operate properly and remain secure from outside intrusion. 

US AirForce:        RAND:      US GAO:     US Airforce University:       NextGov:      Image: Unsplash

You Might Also Read: 

US Air Force Hacked By Teenager:

 

« Is Blockchain The Future Of SSL Certificates?
British Companies Compromised By Exchange Email Hacking »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

SmartSearch

SmartSearch

SmartSearch is a leading online provider of Anti-Money Laundering and Fraud Prevention Services.

Malta Information Technology Agency (MITA)

Malta Information Technology Agency (MITA)

MITA is the central driver of Government Information and Communications Technology (ICT) policy, programmes and initiatives in Malta.

Signal Sciences

Signal Sciences

Signal Sciences Web Protection Platform (WPP) provides comprehensive threat protection and security visibility for web applications, microservices, and APIs on any platform.

ThreatMark

ThreatMark

ThreatMark provides fraud detection solutions for digital banking and payments.

BELAC

BELAC

BELAC is the national accreditation body for Belgium.

IEEE Cyber Science and Technology Congress (CyberSciTech)

IEEE Cyber Science and Technology Congress (CyberSciTech)

CyberSciTech provides a platform for scientists, researchers, and engineers to share their latest ideas and advances in the broad scope of cyber-related science, technology, and application topics.

TAC Security (TAC Infosec)

TAC Security (TAC Infosec)

TAC Security (aka TAC Infosec) is a leading and trusted cyber security consulting partner that specializes in securing the IT infrastructure and assets of enterprises.

10dot Cloud Security

10dot Cloud Security

10dot Cloud Security is a security service management company. Our solutions give you contextualised visibility into your network security.

Capital Network Solutions

Capital Network Solutions

Capital Network Solutions are a highly accredited managed IT services and consultancy provider, specialising in cyber security, infrastructure and communications.

Prime Technology Services

Prime Technology Services

Prime Tech are a group of Red Hat, Microsoft & Cisco Certified IT Professionals with an impressive track record of consistently delivering value to our corporate clients.

Telesign

Telesign

Telesign connect, protect, and defend online experiences with sophisticated digital identity and programmable communications solutions.

ZAG Technical Services

ZAG Technical Services

ZAG Technical Services is an award-winning information technology consulting firm delivering digital transformation solutions, IT assessments, managed services, security, and support.

Zluri

Zluri

Zluri is a cloud-native SaaSOps platform enabling modern enterprises with SaaS Management and Identity Governance.

White Knight Labs

White Knight Labs

White Knight Labs is a cyber security consultancy that specializes in cybersecurity training.

Arculus Cyber Security

Arculus Cyber Security

Arculus Cyber Security enables customers to securely realise the benefits of digital transformation through pragmatic solutions, guidance and services.

CyberForceHQ

CyberForceHQ

CyberForce helps cyber security professionals take real-world tests, get ranked and get paid better. It's that simple.