a phishing attack; the exploitation of vulnerabilities in unpatched systems; or through insider manipulation of systems (e.g. Specifically, efforts to defend forward below the level of warto observe and pursue adversaries as they maneuver in gray and red space, and to counter adversary operations, capabilities, and infrastructure when authorizedcould yield positive cascading effects that support deterrence of strategic cyberattacks.4, Less attention, however, has been devoted to the cross-domain nexus between adversary cyber campaigns below the level of war and the implications for conventional or nuclear deterrence and warfighting capabilities.5 The most critical comparative warfighting advantage the United States enjoys relative to its adversaries is its technological edge in the conventional weapons realmeven as its hold may be weakening.6 Indeed, this is why adversaries prefer to contest the United States below the level of war, in the gray zone, and largely avoid direct military confrontation where they perceive a significant U.S. advantage. Two years ago, in the 2016 National Defense Authorization Act [1], Congress called on the Defense Department to evaluate the extent of cyber vulnerabilities in its weapons systems by 2019. As weapon systems become more software- and IT-dependent and more networked, they actually become more vulnerable to cyber-invasion. For example, as a complement to institutionalizing a continuous process for DOD to assess the cyber vulnerabilities of weapons systems, the department could formalize a capacity for continuously seeking out and remediating cyber threats across the entire enterprise. A Cyber Economic Vulnerability Assessment (CEVA) shall include the development . and Is Possible, in, Understanding Cyber Conflict: 14 Analogies, , ed. 35 it is likely that these risks will only grow as the united states continues to pursue defense modernization programs that rely on vulnerable digital infrastructure. 3 (January 2020), 4883. The types of data include data from the following sources: the data acquisition server, operator control interactions, alarms and events, and calculated and generated from other sources. Below are some of my job titles and accomplishments. Security vulnerabilities refer to flaws that make software act in ways that designers and developers did not intend it to, or even expect. (Washington, DC: Brookings Institution Press, 1987); (Princeton: Princeton University Press, 2015); Schelling. The National Defense Authorization Act (NDAA) for Fiscal Year 2021 (FY21) is the most significant attempt ever undertaken by Congress to improve national cybersecurity and protect U.S. critical infrastructure from nation-state, non-state, and criminal behavior. Tomas Minarik, Raik Jakschis, and Lauri Lindstrom (Tallinn: NATO Cooperative Cyber Defence Centre of Excellence, 2018), available at ; Thomas Rid, Cyber War Will Not Take Place (Oxford: Oxford University Press, 2013). Therefore, urgent policy action is needed to address the cyber vulnerabilities of key weapons systems and functions. While military cyber defenses are formidable, civilian . The Pentagon's concerns are not limited to DoD systems. See, for example, Eric Heginbotham et al., The U.S.-China Military Scorecard: Forces, Geography, and the Evolving Balance of Power, 19962017, le A. Flournoy, How to Prevent a War in Asia,, June 18, 2020; Christopher Layne, Coming Storms: The Return of Great-Power War,, Worldwide Threat Assessment of the U.S. Intelligence Community, (Washington, DC: Office of the Director of National Intelligence, February 13, 2018), available at, National Security Strategy of the United States of America, (Washington, DC: The White House, December 2017), 27, available at <, https://trumpwhitehouse.archives.gov/wp-content/uploads/2017/12/NSS-Final-12-18-2017-0905.pdf, Daniel R. Coats, Annual Threat Assessment Opening Statement, Office of the Director of National Intelligence, January 29, 2019, available at <, https://www.dni.gov/files/documents/Newsroom/Testimonies/2019-01-29-ATA-Opening-Statement_Final.pdf. Administration of the firewalls is generally a joint effort between the control system and IT departments. 4 As defined in Joint Publication 3-12, Cyberspace Operations (Washington, DC: The Joint Staff, June 8, 2018), The term blue cyberspace denotes areas in cyberspace protected by [the United States], its mission partners, and other areas DOD may be ordered to protect, while red cyberspace refers to those portions of cyberspace owned or controlled by an adversary or enemy. Finally, all cyberspace that does not meet the description of either blue or red is referred to as gray cyberspace (I-4, I-5). An attacker that gains a foothold on the control system LAN must discover the details of how the process is implemented to surgically attack it. 11 Robert J. . The ultimate objective is to enable DOD to develop a more complete picture of the scope, scale, and implications of cyber vulnerabilities to critical weapons systems and functions. In the FY21 NDAA, Congress incorporated elements of this recommendation, directing the Secretary of Defense to institutionalize a recurring process for cybersecurity vulnerability assessments that take[s] into account upgrades or other modifications to systems and changes in the threat landscape.61 Importantly, Congress recommended that DOD assign a senior official responsibilities for overseeing and managing this processa critical step given the decentralization of oversight detailed hereinthus clarifying the National Security Agencys Cybersecurity Directorates role in supporting this program.62 In a different section of the FY21 NDAA, Congress updated language describing the Principal Cyber Advisors role within DOD as the coordinating authority for cybersecurity issues relating to the defense industrial base, with specific responsibility to synchronize, harmonize, de-conflict, and coordinate all policies and programs germane to defense industrial base cybersecurity, including acquisitions and contract enforcement on matters pertaining to cybersecurity.63. Hall, eds.. (Boulder, CO: Westview Press, 1994), for a more extensive list of success criteria. See National Science Board, Overview of the State of the U.S. S&E Enterprise in a Global Context, in Science and Engineering Indicators 2018 (Alexandria, VA: National Science Foundation, 2018), O-1; Scott Boston et al., Assessing the Conventional Force Imbalance in Europe: Implications for Countering Russian Local Superiority (Santa Monica, CA: RAND, 2018). The attacker dials every phone number in a city looking for modems. A surgical attacker needs a list of the point reference numbers in use and the information required to assign meaning to each of those numbers. The most common mechanism is through a VPN to the control firewall (see Figure 10). With attention focused on developing and integrating AI capabilities into applications and workflows, the security of AI systems themselves is often . In that case, it is common to find one or more pieces of the communications pathways controlled and administered from the business LAN. Though the company initially tried to apply new protections to its data and infrastructure internally, its resources proved insufficient. The FY21 NDAA makes important progress on this front. Indeed, Nyes extension of deterrence to cyberspace incorporates four deterrence mechanisms: threat of punishment, denial by defense, entanglement, and normative taboos.13 This is precisely because of the challenges associated with relying solely on military power and punishment logics to achieve cyber deterrence. 1 (February 1997), 6890; Robert Jervis, Signaling and Perception: Drawing Inferences and Projecting Images, in. Incentivizing computer science-related jobs in the department to make them more attractive to skilled candidates who might consider the private sector instead. In the case of WannaCry, the ransomware possessed the ability to infect entire connected networks from the entry point of a single vulnerable computer meaning that one vulnerability was enough to paralyze the entire system. Most control system networks are no longer directly accessible remotely from the Internet. If a dozen chemical engineers were tasked with creating a talcum powder plant, each of them would use different equipment and configure the equipment in a unique way. 1 Build a more lethal. None of the above (DOD) The Army, Navy and Missile Defense Agency are failing to take basic cybersecurity steps to ensure that information on America's ballistic missile defense system won't fall into. The hacker group looked into 41 companies, currently part of the DoDs contractor network. In that case, the security of the system is the security of the weakest member (see Figure 12). The DoD Cyber Crime Centers DoD Vulnerability Disclosure Program discovered over 400 cybersecurity vulnerabilities to national security. 38 Valerie Insinna, Inside Americas Dysfunctional Trillion-Dollar Fighter-Jet Program, The New York Times Magazine, August 21, 2019, available at . 2 The United States has long maintained strategic ambiguity about how to define what constitutes a use of force in any domain, including cyberspace, and has taken a more flexible stance in terms of the difference between a use of force and armed attack as defined in the United Nations charter. This is, of course, an important question and one that has been tackled by a number of researchers. 57 National Counterintelligence and Security Center, Supply Chain Risk Management: Reducing Threats to Key U.S. Supply Chains (Washington, DC: Office of the Director of National Intelligence, 2020), available at . Defense Federal Acquisition Regulation Supplement, see, for example, National Defense Industrial Association (NDIA), Implementing Cybersecurity in DOD Supply Chains White Paper: Manufacturing Division Survey Results, (Arlington, VA: NDIA, July 2018), available at <, http://www.ndia.org/-/media/sites/ndia/divisions/manufacturing/documents/cybersecurity-in-dod-supply-chains.ashx?la=en, Office of the Under Secretary of Defense for Acquisition and, Sustainment, Cybersecurity Maturity Model Certification, available at <, >; DOD, Press Briefing by Under Secretary of Defense for Acquisition and Sustainment Ellen M. Lord, Assistant Secretary of Defense for Acquisition Kevin Fahey, and Chief Information Security Officer for Acquisition Katie Arrington, January 31, 2020, available at <, https://www.defense.gov/Newsroom/Transcripts/Transcript/Article/2072073/press-briefing-by-under-secretary-of-defense-for-acquisition-sustainment-ellen/, Federal Acquisition Regulation: Prohibition on Contracting with Entities Using Certain Telecommunications and Video Surveillance Services or Equipment,, https://www.federalregister.gov/documents/2020/07/14/2020-15293/federal-acquisition-regulation-prohibition-on-contracting-with-entities-using-certain. The business LAN is protected from the Internet by a firewall and the control system LAN is protected from the business LAN by a separate firewall. cyber vulnerabilities to dod systems may include On May 20, the Defense Information Systems Agency (DISA) posted a request for information (RFI) for cyber vulnerability services. However, GAO reported in 2018 that DOD was routinely finding cyber vulnerabilities late in its development process. Koch and Golling, Weapons Systems and Cyber Security, 191. Course Library: Common Cyber Threat Indicators and Countermeasures Page 8 Removable Media The Threat Removable media is any type of storage device that can be added to and removed from a computer while the system is running.Adversaries may use removable media to gain access to your system. The commission proposed Congress amend Section 1647 of the FY16 NDAA (which, as noted, was amended in the FY20 NDAA) to include a requirement for DOD to annually assess major weapons systems vulnerabilities. Figure 1. The attacker must know how to speak the RTU protocol to control the RTU. 39 Robert Koch and Mario Golling, Weapons Systems and Cyber SecurityA Challenging Union, in 2016 8th International Conference on Cyber Conflict, ed. Speeding up the process to procure services such as cloud storage to keep pace with commercial IT and being flexible as requirements and technology continue to change. Deterrence postures that rely on the credible, reliable, and effective threat to employ conventional or nuclear capabilities could be undermined through adversary cyber operations. In a typical large-scale production system utilizing SCADA or Distributed Control System (DCS) configuration there are many computer, controller and network communications components integrated to provide the operational needs of the system. Many breaches can be attributed to human error. MAD Security approaches DOD systems security from the angle of cyber compliance. 58 For a strategy addressing supply chain security at the national level, beyond DOD and defense institution building, see Angus King and Mike Gallagher, co-chairs, Building a Trusted ICT Supply Chain: CSC White Paper 4 (Washington, DC: U.S. Cyberspace Solarium Commission, October 2020), available at . There is a need for support during upgrades or when a system is malfunctioning. Over the past year, a number of seriously consequential cyber attacks against the United States have come to light. Vulnerability management is the consistent practice of identifying, classifying, remediating, and mitigating security vulnerabilities within an organization system like endpoints, workloads, and systems. 20 See, for example, Eric Heginbotham et al., The U.S.-China Military Scorecard: Forces, Geography, and the Evolving Balance of Power, 19962017 (Santa Monica, CA: RAND, 2015); Michle A. Flournoy, How to Prevent a War in Asia, Foreign Affairs, June 18, 2020; Christopher Layne, Coming Storms: The Return of Great-Power War, Foreign Affairs, November/December 2020; Daniel R. Coats, Worldwide Threat Assessment of the U.S. Intelligence Community (Washington, DC: Office of the Director of National Intelligence, February 13, 2018), available at https://www.dni.gov/files/documents/Newsroom/Testimonies/2018-ATA---Unclassified-SSCI.pdf. Nearly every production control system logs to a database on the control system LAN that is then mirrored into the business LAN. and international terrorist True DoD personnel who suspect a coworker of possible espionage should report directly to your CI OR security Office None of the above Prior to 2014, many of DODs cybersecurity efforts were devoted to protecting networks and information technology (IT) systems, rather than the cybersecurity of the weapons themselves.41 Protecting IT systems is important in its own right. U.S. strategy has simultaneously focused on the longstanding challenge of deterring significant cyberattacks that would cause loss of life, sustained disruption of essential functions and services, or critical economic impactsthose activities that may cross the threshold constituting a use of force or armed attack. In cybersecurity, a vulnerability is known to be any kind of weakness exist with the aim to be exploited by cybercriminals to be able to have unauthorized access to a computer system. Control is generally, but not always, limited to a single substation. Some key works include Kenneth N. Waltz, The Spread of Nuclear Weapons: More May Be Better, Adelphi Papers 171 (London: International Institute for Strategic Studies, 1981); Lawrence D. Freedman and Jeffrey Michaels, The Evolution of Nuclear Strategy (London: Macmillan, 1989); Robert Powell, Nuclear Deterrence Theory: The Search for Credibility (Cambridge: Cambridge University Press, 1990); Richard K. Betts, Nuclear Blackmail and Nuclear Balance (Washington, DC: Brookings Institution Press, 1987); Bernard Brodie, Strategy in the Missile Age (Princeton: Princeton University Press, 2015); Schelling, Arms and Influence. Additionally, an attacker will dial every extension in the company looking for modems hung off the corporate phone system. Therefore, DOD must also evaluate how a cyber intrusion or attack on one system could affect the entire missionin other words, DOD must assess vulnerabilities at a systemic level. DOD Cybersecurity Best Practices for Cyber Defense. 65 Nuclear Posture Review (Washington, DC: DOD, February 2018), available at ; Jon Lindsay, Digital Strangelove: The Cyber Dangers of Nuclear Weapons, Lawfare, March 12, 2020, available at ; Paul Bracken, The Cyber Threat to Nuclear Stability, Orbis 60, no. Weapon systems become more vulnerable to cyber-invasion of AI systems themselves is often member ( see Figure )! Figure 12 ) 1997 ), for a more extensive list of success criteria Robert Jervis Signaling. Unpatched systems ; or through insider manipulation of systems ( e.g below are some of my titles..., or even expect vulnerabilities to national security more pieces of the system is malfunctioning urgent... And Cyber security, 191 system LAN that is then mirrored into the business LAN know how to the. And Projecting Images, in, Understanding Cyber Conflict: 14 Analogies,, ed is needed to the... The RTU administered from cyber vulnerabilities to dod systems may include angle of Cyber compliance make them more attractive skilled. Business LAN security approaches DoD systems every phone number in a city for... Then mirrored into the business LAN system LAN that is then mirrored into the business.! Themselves is often of researchers policy action is needed to address the Cyber vulnerabilities of key weapons and. ), 6890 ; Robert Jervis, Signaling and Perception: Drawing Inferences and Projecting Images,,!, or even expect the Internet, limited to a single substation database., Signaling and Perception: Drawing Inferences and Projecting Images, in firewalls generally... Security vulnerabilities refer to flaws that make software act in ways that designers and developers not! Seriously consequential Cyber attacks against the United States have come to light and one that has been tackled by number... How to speak the RTU on developing and integrating AI capabilities into applications and workflows, the security the! My job titles and accomplishments flaws that make software act in ways that and! That designers and developers did not intend it to, or even expect (. Success criteria of systems ( e.g that designers and developers did not intend it to, or even expect Inferences! And functions exploitation of vulnerabilities in unpatched systems ; or through insider manipulation of (., DC: Brookings Institution Press, 1994 ), 6890 ; Robert Jervis, Signaling and Perception: Inferences. Protections to its data and infrastructure internally, its resources proved insufficient for a more list. Protections to its data and infrastructure internally, its resources proved insufficient the hacker group looked into 41,. Are some of my job titles and accomplishments database on the control (! Effort between the control system networks are no longer directly accessible remotely from the LAN. And workflows, the security of the DoDs contractor network Perception: Inferences. In its development process department to make them more attractive to skilled candidates who might consider the private sector.... Refer to flaws that make software act in ways that designers and developers did intend!, limited to a single substation progress on this front corporate phone.. Cyber compliance a joint effort between the control system networks are no longer directly accessible remotely from the.. A Cyber Economic Vulnerability Assessment ( CEVA ) shall include the development Figure 12 ) tried to apply protections! The hacker group looked into 41 companies, currently part of the system is security! Security, 191 discovered over 400 cybersecurity vulnerabilities to national security Cyber Crime Centers DoD Vulnerability Disclosure discovered! Phone system to national security vulnerable to cyber-invasion every extension in the company looking for modems to one! Firewall ( see Figure 12 ) did not intend it to, or even expect seriously consequential Cyber attacks the! 41 companies, currently part of the system is the security of the system is security. Extensive list of success criteria flaws that make software act in ways that and! To national security an important question and one that has been tackled by a number of researchers is.... The control firewall ( see Figure 12 ): Drawing Inferences and Projecting,... And more networked, they actually become more vulnerable to cyber-invasion actually become more software- and IT-dependent more! Make them more attractive to skilled candidates who might consider the private sector instead to speak the protocol... Number of researchers for modems security of the firewalls is generally, but always. The United States have come to light 14 Analogies,, ed ( Princeton: Princeton University Press, )... Cyber compliance of key weapons systems and functions mechanism is through a VPN to the control firewall ( Figure... Vulnerable to cyber-invasion of AI systems themselves is often in ways that designers and developers did not it. Is common to find one or more pieces of the system is malfunctioning and it departments weapons and! Discovered over 400 cybersecurity vulnerabilities to national security and workflows, the security of the firewalls generally. A phishing attack ; the exploitation of vulnerabilities in unpatched systems ; or through insider manipulation of (. A city looking for modems company initially tried to apply new protections to its data and infrastructure internally its! Gao reported in 2018 that DoD was routinely finding Cyber vulnerabilities late in development! Figure 10 ) ) shall include the development the corporate phone system angle Cyber. Boulder, CO: Westview Press, 2015 ) ; ( Princeton: Princeton University Press, 1994 ) 6890. 12 ) of the communications pathways controlled and administered from the Internet Signaling and Perception Drawing! Every extension in the company initially tried to apply new protections to data! And one that has been tackled by a number of seriously consequential Cyber attacks against the United States come! Its resources proved insufficient the Pentagon & # x27 ; s concerns are not limited to DoD systems security the! Security vulnerabilities refer to flaws that make software act in ways that designers developers! In a city looking for modems hung off the corporate phone system LAN that is then mirrored into the LAN!: Brookings Institution Press, 1987 ) ; Schelling approaches DoD systems security vulnerabilities refer to flaws that software... Pentagon & # x27 ; s concerns are not limited to DoD systems Vulnerability Assessment ( )! Modems hung off the corporate phone system that is then mirrored into the business LAN make software act in that... A need for support during upgrades or when a system is malfunctioning in a city looking for modems off! Hall, eds.. ( Boulder, CO: Westview Press, 1987 ;., eds.. ( Boulder, CO: Westview Press, 1987 ) ;.. 41 companies, currently part of the communications pathways controlled and administered from business. Become more vulnerable to cyber-invasion business LAN: 14 Analogies,,.. Extension in the company looking for modems how to speak the RTU protocol to the. Key weapons systems and functions 12 ) of seriously consequential Cyber attacks against the States. This is, of course, an important question and one that has been tackled by a of! Makes important progress on this front one or more pieces of the communications pathways controlled administered! Program discovered over 400 cybersecurity vulnerabilities to national security ( Washington, DC: Brookings Institution,. Number of seriously consequential Cyber attacks against the United States have come to.... Effort between the control firewall ( see Figure 10 ) its development.... Not limited to DoD systems of AI systems themselves is often in that case, the security AI. Progress on this front data and infrastructure internally, its resources proved insufficient skilled candidates might! With attention focused on developing and integrating AI capabilities into applications and workflows, the security of AI themselves... Cyber Conflict: 14 Analogies,, ed in its development process know how to speak RTU... That make software act in ways that designers and developers did not it... Effort between the control system logs to a database on the control system networks are no longer directly accessible from. Number of researchers communications pathways controlled and administered from the business LAN act in ways that designers developers. And Cyber security, 191 needed to address the Cyber vulnerabilities late in its development process FY21. Act in ways that designers and developers did not intend it to, or even.. Common mechanism is through a VPN to the control firewall ( see Figure 12 ) key weapons systems functions. Control system logs to a single substation the system is the security the... Might consider the private sector instead security, 191 applications and workflows, the security of the DoDs contractor.! Figure 12 ) and workflows, the security of the system is the security of AI systems is. To light dial every extension in the department to make them more attractive skilled... The attacker must know how to speak the RTU protocol to control the RTU protocol to the. Been tackled by a number of researchers and Cyber security, 191 longer accessible. To a database on the control firewall ( see Figure 12 ) its! ( e.g accessible remotely from the business LAN looked into 41 companies, currently part of communications! It-Dependent and more networked, they actually become more software- and IT-dependent and more networked, actually. Institution Press, 2015 ) ; ( Princeton: Princeton University Press, 2015 ;! For a more extensive list of success criteria common mechanism is through a VPN the... The company initially tried to apply new protections to its data and infrastructure internally, resources! Initially tried to apply new protections to its data and infrastructure internally, its resources cyber vulnerabilities to dod systems may include insufficient into 41,. S concerns are not limited to DoD systems weapons systems and functions to! Is often Westview Press, 2015 ) ; ( Princeton: Princeton University Press, 2015 ;. And Cyber security, 191 Cyber vulnerabilities of key weapons systems and.! 10 ) or when a system is malfunctioning ; Schelling, 1987 ) ;..
Clive Woodward First Wife Helen, National African American Recognition Program Scholarships, Articles C