Faced with mounting challenges in protecting its weapon systems from increasingly sophisticated cyber threats, the U.S. Department of Defense (DOD) has stepped up its efforts to address weapon systems cybersecurity.
In a new report, the U.S. Government Accountability Office (GAO) found that because the DOD’s weapon systems are more software dependent and more computerized and networked than ever, they are more vulnerable to cyberattacks.
The GAO has warned the DOD about the risks of cyber risks for decades, but the DOD did not prioritize weapon systems cybersecurity until recently.
In operational testing, DOD routinely found cyber vulnerabilities in systems that were under development, yet program officials believed their systems were secure and discounted some test results as unrealistic, the GAO said. Testers were able to take control of systems and largely operate undetected, using relatively simple tools and techniques. The vulnerabilities that DOD is aware of likely represent a fraction of the total because not all programs have been tested and tests do not reflect the full range of threats.
DOD has taken steps recently to improve weapon systems cybersecurity, including issuing and revising policies and guidance to incorporate cybersecurity considerations better. However, challenges remain to improve the state of weapon systems cybersecurity. The GAO is not making any recommendations at this time but will continue to evaluate this issue.