Defense Department Cyber Efforts: DOD Faces Challenges In Its Cyber Activities
Published: 2011-07-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: According to the U.S. Strategic Command, the Department of Defense (DOD) is in the midst of a global cyberspace crisis as foreign nation states and other actors, such as hackers, criminals, terrorists, and activists exploit DOD and other U.S. government computer networks to further a variety of national, ideological, and personal objectives. This report identifies (1) how DOD is organized to address cybersecurity threats; and assesses the extent to which DOD has (2) developed joint doctrine that addresses cyberspace operations; (3) assigned command and control responsibilities; and (4) identified and taken actions to mitigate any key capability gaps involving cyberspace operations. It is an unclassified version of a previously issued classified report. GAO analyzed policies, doctrine, lessons learned, and studies from throughout DOD, commands, and the services involved with DOD's computer network operations and interviewed officials from a wide range of DOD organizations..
section_title: What GAO Found
paragraphs: DOD's organization to address cybersecurity threats is decentralized and spread across various offices, commands, military services, and military agencies. DOD cybersecurity roles and responsibilities are vast and include developing joint policy and guidance and operational functions to protect and defend its computer networks. DOD is taking proactive measures to better address cybersecurity threats, such as developing new organizational structures, led by the establishment of the U.S. Cyber Command, to facilitate the integration of cyberspace operations. However, it is too early to tell if these changes will help DOD better address cybersecurity threats. Several joint doctrine publications address aspects of cyberspace operations, but DOD officials acknowledge that the discussions are insufficient; and no single joint publication completely addresses cyberspace operations. While at least 16 DOD joint publications discuss cyberspace-related topics and 8 mention "cyberspace operations," none contained a sufficient discussion of cyberspace operations. DOD recognizes the need to develop and update cyber-related joint doctrine and is currently debating the merits of developing a single cyberspace operations joint doctrine publication in addition to updating all existing doctrine. However, there is no timetable for completing the decision-making process or for updates to existing doctrine. DOD has assigned authorities and responsibilities for implementing cyberspace operations among combatant commands, military services, and defense agencies; however, the supporting relationships necessary to achieve command and control of cyberspace operations remain unclear. In response to a major computer infection, U.S. Strategic Command identified confusion regarding command and control authorities and chains of command because the exploited network fell under the purview of both its own command and a geographic combatant command. Without complete and clearly articulated guidance on command and control responsibilities that is well communicated and practiced with key stakeholders, DOD will have difficulty in achieving command and control of its cyber forces globally and in building unity of effort for carrying out cyberspace operations. DOD has identified some cyberspace capability gaps, but it has not completed a comprehensive, departmentwide assessment of needed resources, capability gaps, and an implementation plan to address any gaps. For example, U.S. Strategic Command has identified that DOD's cyber workforce is undersized and unprepared to meet the current threat, which is projected to increase significantly over time. While the department's review of some cyberspace capability gaps on cyberspace operations is a step in the right direction, it remains unclear whether these gaps will be addressed since DOD has not conducted a more comprehensive departmentwide assessment of cyber-related capability gaps or established an implementation plan or funding strategy to resolve any gaps that may be identified.
section_title: What GAO Recommends
paragraphs: GAO recommends that DOD (1) establish a timeframe for deciding on whether to complete a separate joint cyberspace publication and for updating the existing body of joint publications, (2) clarify command and control relationships regarding cyberspace operations and establish a timeframe for issuing the clarified guidance, and (3) more fully assess cyber-specific capability gaps, and (4) develop a plan and funding strategy to address them. DOD agreed with the recommendations.

section_title: Letter
paragraphs: The wealth and strength of the United States make it a target in  cyberspace. The U.S. economy and government are the most dependent  in the world on the Internet and therefore the most vulnerable to cyber  attacks.  Information technology powers the U.S. economy and enables  almost everything the military does, including command and control of  forces, intelligence gathering, and logistical support of troops.  According  to the President of the United States, the cyber threat is thus one of the  most serious national security challenges that the nation faces. The  United States confronts a growing array of cyber threats from foreign  intelligence services and other actors, including terrorists, criminal  groups, and individual hackers, that could compromise our personal and  national security.  Protecting our digital infrastructure, while safeguarding  privacy and civil liberties, is therefore a national security priority,  according to U.S. Cyber Command.
In June 2009, the Deputy Secretary of Defense cautioned that the cyber  threat is not an emerging or future threat, but one that is already here  today.  The Department of Defense (DOD) alone depends on 7 million  computer devices, linked on over 10,000 networks with satellite gateways  and commercial circuits that are composed of innumerable devices and  components.  The threat to DOD computer networks is thus substantial,  and the potential for sabotage and destruction is present.  While criminal  organizations are a source of concern, foreign governments have more  resources and more worrisome motivations.  Cyber warfare is attractive to  adversaries because it poses a significant threat at a low cost.  An  adversary does not need an expensive weapons program to conduct  damaging attacks; a handful of programmers could cripple an entire  information system.  Moreover, it is also an attractive weapon to our  adversaries because it is difficult to trace the origin of the attack and even  more difficult to deter one.  According to DOD, a large number of  intelligence agencies and foreign militaries are actively trying to penetrate  our military networks.  These networks are scanned millions of times a  day and probed thousands of times a day.  Over the past several years,  DOD has experienced damaging penetration to these networks.  For  example, blueprints of weapons systems have already been  compromised. Ensuring the security of these networks is therefore critical  so DOD can operate securely and confidently not only in the new cyber  domain but in the traditional military domains of land, sea, air, and space.
In addition, the recent Quadrennial Defense Review recognized the need  for DOD to operate effectively in cyberspace and improve its policy,  doctrine, and capabilities to counter threats in cyberspace. It also  cautioned that failure to adapt to cyber threats would pose a fundamental  risk to DOD’s ability to accomplish its missions today.
In prior reports, agency inspector general offices and we have made  hundreds of recommendations to agencies for actions necessary to  resolve prior significant control deficiencies and information security  program shortfalls. In the past, we have also reviewed DOD’s information  security weaknesses in various reports. For example, as early as 1991,  we reported on foreign hackers penetrating DOD computer systems  between April 1990 and May 1991, as a result of inadequate attention to  computer security, such as password management and the lack of  technical expertise on the part of some system administrators. To see  further information on past reports on DOD networks, see appendix IV.
DOD’s cyberspace operations encompass both defensive and offensive  activities, for which the primary purpose is to achieve military objectives  or effects in or through cyberspace. Defensive cyber operations are  categorized as computer network defense, which consists of actions  taken to protect, monitor, analyze, detect, and respond to unauthorized  activity within DOD information systems and computer networks. In  appendix III we provide further information on DOD tools and programs  used to defend its networks. Offensive cyber operations are comprised of  two functions: information gathering (or computer network exploitation)  and computer network attack. Computer network exploitation is the  method by which DOD and the intelligence community gather information  on adversaries in and through cyberspace. Computer network attack  consists of operations through the use of computer networks to disrupt,  deny, degrade, or destroy information residing in computers and  computer networks or the computers and networks themselves.
In light of worldwide cybersecurity incidents in 2008, you requested that  we perform a review focused on DOD’s organization and planning of  cyberspace operations, including its defensive and offensive efforts to  address cyber threats. In prior work, we have examined information  security weaknesses in federal government networks, including DOD’s  networks. Our objectives for this report were to determine (1) how DOD  is organized to address cybersecurity threats; and to assess the extent to  which DOD has (2) developed joint doctrine that addresses cyberspace  operations across DOD; (3) assigned command and control  responsibilities that clearly establish roles between combatant commands  and military services; and (4) identified and taken actions to mitigate any  key capability gaps involving cyberspace operations.  In May 2010, we  reported to you on the results of our work in a classified report.  This  report is an unclassified version of that report. To remove information  DOD determined to be classified, this report omits details on DOD cyber- related planning, operations, capabilities, and capability gaps.
To answer the objectives, we reviewed documentation and conducted  interviews with DOD officials at the Office of the Secretary of Defense; the  Army, the Navy, the Marine Corps, and the Air Force; U.S. Strategic  Command; U.S. Central Command; U.S. Pacific Command; U.S.  European Command; U.S. Northern Command; U.S. Africa Command;  U.S. Joint Forces Command; U.S. Special Operations Command; Joint  Staff; the National Security Agency; and other cognizant organizations.  To evaluate DOD’s organization to address cybersecurity threats, we  conducted interviews and analyzed various policies, guidance, and  directives relating to organizations involved with the department’s  computer network operations. We also reviewed documents involving the  reorganization and development of new organizations within the Office of  the Secretary of Defense, U.S. Strategic Command, the Air Force, and  the Navy to address cyber threats. To determine the extent to which DOD  has developed an overarching joint doctrine that addresses cyberspace  operations across DOD, we reviewed and analyzed current joint doctrine  publications involving computer network operations and U.S. Joint Forces  Command analysis of cyber-related joint doctrine. To assess the extent to  which DOD has assigned command and control responsibilities, we  compared the 2008 Unified Command Plan to DOD plans, policies, and  guidance to determine authorities for functional and combatant  commands, military services, and defense agencies. Additionally, we  reviewed and identified common lessons learned from combatant  commands following DOD’s response to malware infections in 2008. To  determine any capability gaps involving computer network operations we  analyzed the fiscal year 2010 and 2011-2015 Integrated Priority Lists to  identify cyberspace capability gaps for the functional and geographic  combatant commands. Finally, we analyzed the National Intelligence  Estimate, The Global Cyber Threat to the U.S. Information Infrastructure,  the Central Intelligence Agency’s Cyber Threat Intelligence Highlights,  and prior GAO reports on cybersecurity to determine the depth of cyber  threats facing the nation and DOD.
We conducted this performance audit from November 2008 to April 2010  in accordance with generally accepted government auditing standards  and worked with DOD from November 2010 to July 2011 to prepare an  unclassified version of this report for public release. Government auditing  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
subsections: section_title: National Cyber Policy
paragraphs: As cyber threats have grown in sophistication, federal efforts to address  them have evolved. Presidential Decision Directive 63, signed in May  1998, established a structure under White House leadership to coordinate  the activities of designated lead departments and agencies, in partnership  with their counterparts from the private sector, to eliminate any significant  vulnerabilities to both physical and cyber attacks on our critical  infrastructures, including computer systems. National cyber policy was  updated in 2003 with The National Strategy to Secure Cyberspace.  Presidential Decision Directive 63 was superseded later that year by  Homeland Security Presidential Directive 7, which assigned the Secretary  of Homeland Security responsibility for coordinating the nation’s overall  critical infrastructure protection efforts, including protection of the cyber  infrastructure, across all sectors (federal, state, local, and private) working  in cooperation with designated sector-specific agencies within the  executive branch. Both of these policies focused on defensive  strategies, and Homeland Security Presidential Directive 7 did not  emphasize protection of federal government information systems.   Subsequent classified presidential directives and strategic planning  documents have continued to reflect evolving federal policy in response  to cyber threats.
Recognizing the need for common solutions to improve cybersecurity, the  White House, Office of Management and Budget, and various federal  agencies have launched or continued several governmentwide initiatives  that are intended to enhance information security at federal agencies.  According to Director of National Intelligence implementing guidance, in  2008 the Comprehensive National Cybersecurity Initiative was begun in  order to develop an approach to address current threats, anticipate future  threats and technologies, and foster innovative public-private  partnerships. It was created to bridge cyber-related missions for federal  agencies, by asking them to undertake a set of 12 initiatives and 7  strategic enabling activities. According to DOD officials, these initiatives  include defensive, offensive, research and development, and  counterintelligence efforts. Programs focus primarily on the security of  executive-branch networks, which represent only a fraction of the global  information and communications infrastructure on which the United States  depends.
In May 2009, the National Security Council and Homeland Security  Council completed a 60-day interagency review intended to assess U.S.  policies and structures for cybersecurity and outline initial areas for  action. The resulting report recommended, among other things,  appointing an official in the White House to coordinate the nation’s  cybersecurity policies and activities, preparing an updated national  cybersecurity strategy, developing a framework for cyber research and  development, and continuing to evaluate the Comprehensive National  Cybersecurity Initiatives.
section_title: DOD Policy Guidance on Cybersecurity
paragraphs: Following the lead of federal government efforts, DOD initiated several  efforts to develop policy and guidance on cyberspace operations. In 2006  and 2007, The National Military Strategy for Cyberspace Operations and  associated Implementation Plan provided a strategy for the U.S. military  to achieve military superiority in cyberspace and established a military  strategic framework that orients and focuses DOD action in the areas of  military, intelligence, and business operation in and through cyberspace.  In 2008, U.S. Strategic Command developed the Operational Concept for  Cyberspace, which identifies near-term concepts to improve operations in  and through cyberspace and gain superiority over potential adversaries in  support of national objectives. The 2009 Quadrennial Roles and  Missions Review Report discussed efforts by the Cyber Issue Team,  jointly led by the Office of the Under Secretary of Defense for Policy and  U.S. Strategic Command, which addressed cyberspace issues related to  developing, structuring, and employing the cyberspace force. Also in  2009, U.S. Strategic Command developed an Operations Order titled  Operation Gladiator Phoenix to provide DOD with a strategic framework  to operate, secure, and defend the global information grid. As early as  2006, the Quadrennial Defense Review highlighted the department’s  need to be capable of shaping and defending cyberspace. DOD  published a new Quadrennial Defense Review in February 2010, which  designated cyberspace operations as a key mission area and discussed  steps the department was taking to strengthen capabilities in the cyber  domain, including centralizing command of cyber operations and  enhancing partnerships with other agencies and governments. Currently,  DOD continues to develop and update cyberspace policies.
section_title: Cybersecurity Threats
paragraphs: Different types of cybersecurity threats from numerous sources may  adversely affect computers, software, networks, agency operations,  industry, or the Internet itself. Cyber threats to federal information  systems continue to evolve and grow. These threats can be unintentional  or intentional, targeted or nontargeted, and can come from a variety of  sources. Unintentional threats can be caused by inattentive or untrained  employees, software upgrades, maintenance procedures, and equipment  failures that inadvertently disrupt systems or corrupt data. Intentional  threats include both targeted and nontargeted attacks. An attack is  considered to be targeted when a group or individual attacks a specific  system or cyber-based critical infrastructure. A nontargeted attack occurs  when the intended target of the attack is uncertain, such as when a virus,  worm, or other malicious software is released on the Internet with no  specific target.
Government officials are concerned about cyber attacks from individuals  and groups with malicious intent, such as criminals, terrorists, and  adversarial foreign nations. Threats to DOD computer networks posed by  the intelligence branches of foreign countries and hackers alike represent  an unprecedented national security challenge. For example, in February  2009, the Director of National Intelligence testified that foreign nations  and criminals have targeted government and private-sector networks to  gain a competitive advantage and potentially disrupt or destroy them, and  that terrorist groups have expressed a desire to use cyber attacks as a  means to target the United States. The Federal Bureau of Investigation  has also identified multiple sources of threats to our nation’s critical  information systems, including foreign nations engaged in espionage and  information warfare, domestic criminals, hackers, virus writers, and  disgruntled employees and contractors working within an organization.  Table 1 summarizes those groups or individuals that are considered to be  key sources of cyber threats to our nation’s information systems and  cyber infrastructures.
These groups and individuals have a variety of attack techniques at their  disposal. Furthermore, as we have previously reported, the techniques  have characteristics that can vastly enhance the reach and effect of their  actions, such as the following:    Attackers do not need to be physically close to their targets to  perpetrate a cyber attack.    Technology allows actions to easily cross multiple state and national  borders.    Attacks can be carried out automatically, at high speed, and by  attacking a vast number of victims at the same time.    Attackers can more easily remain anonymous.
Table 2 identifies the types and techniques of cyber attacks that are  commonly used.
section_title: Key Terms for DOD’s Cyberspace Domain
paragraphs: Various terms are used within the DOD cyberspace domain. For example,  in May 2008, DOD defined cyberspace as the “global domain within the  information environment consisting of the interdependent network of  information technology infrastructures, including the Internet,  telecommunications networks, computer systems, and embedded  processors and controllers.” Also, DOD defines computer network  defense as actions taken to protect, monitor, analyze, detect, and  respond to unauthorized activity within DOD information systems and  computer networks. For further discussion of policies, programs, and  tools that DOD uses to protect its networks, see appendix III. Table 3 lists  several key terms used within the DOD cyberspace domain.
section_title: Cybersecurity Roles and Responsibilities Are Spread across DOD, and DOD Is Reorganizing to Better Address Cybersecurity Threats
paragraphs: DOD’s organization to address cybersecurity threats is decentralized and  spread across various offices, commands, military services, and military  agencies. DOD cybersecurity roles and responsibilities are vast and  include developing joint policy and guidance and operational functions to  protect and defend its computer networks. DOD is taking proactive  measures to better address cybersecurity threats, such as developing  new organizational structures, led by the establishment of the U.S. Cyber  Command, to facilitate the integration of cyberspace operations.
subsections: section_title: Cybersecurity Roles and Responsibilities Are Spread across DOD
paragraphs: Cybersecurity roles and responsibilities within DOD are spread across  various DOD components. The current cybersecurity organizational  structure is decentralized and there are many DOD components that hold  responsibilities. Cybersecurity roles and responsibilities include  developing joint policy and guidance and operational functions to defend  and secure DOD networks, and are spread among the Office of the  Secretary of Defense, Joint Staff, functional and geographic combatant  commands, military services, and military agencies. According to DOD  officials, to ensure a holistic approach and limit potential stovepiping, the  department has begun to develop cybersecurity expertise across various  offices. Figure 1 illustrates DOD’s cyber organization as of March 2010.  Additionally, there are other organizations that play a pivotal role in  cybersecurity, such as the DOD intelligence agencies, National Guard,  and defense criminal investigative organizations. DOD is taking proactive  measures to reorganize and develop new organizational structures to  better address cybersecurity threats. However, it is too early to tell if  these organizational changes will help DOD better address cybersecurity  threats.
There are several offices within both the Office of the Secretary of  Defense and the Joint Staff that share responsibility for developing joint  cyber policy, guidance, and doctrine for DOD activities that occur in and  through cyberspace. For example, within the Office of the Secretary of  Defense, the offices of the Under Secretary of Defense for Policy;  Assistant Secretary of Defense for Networks and Information Integration;  and the Under Secretary of Defense for Intelligence, all share  responsibility for developing joint cyber policy and guidance. For example,  according to DOD officials, both the Assistant Secretary of Defense for  Networks and Information Integration and the Under Secretary of Defense  for Policy have responsibility for strategic-level guidance and oversight for  computer network operations and information assurance. Appendix II  provides more detailed information on the cyber-related responsibilities of  the DOD offices.
Several offices within the Joint Staff also hold responsibilities for  developing joint cyber policy, guidance, and doctrine for DOD activities  that occur in and through cyberspace. The Joint Staff’s cyber  responsibilities include establishing and developing doctrine, policies, and  associated joint tactics, techniques, and procedures for DOD’s global  information grid, information assurance, and joint and combined  operations. According to DOD directive O-3600.01, the Joint Staff is to  develop and maintain joint doctrine for core, supporting, and related  information operations capabilities in joint operations and ensure that all  joint education, training, plans, and operations are consistent with  information operations policy, strategy, and doctrine. The Joint Staff is  also responsible for developing, coordinating, and disseminating  information assurance policies and doctrine for joint operations.  Additionally, several Joint Staff divisions and Joint Staff–led coordination  forums have cybersecurity responsibilities.
The U.S. Joint Forces Command also has doctrine development and  operational roles. Chairman of the Joint Chiefs of Staff Instruction  5120.02B establishes U.S. Joint Forces Command as a voting member of  the joint doctrine development community, responsible for developing and  submitting recommendations for improving existing joint doctrine or  initiating new joint doctrine projects and conducting front-end analyses of  all joint doctrine project proposals and providing appropriate  recommendations. Moreover, as with all other combatant commands,  U.S. Joint Forces Command is responsible for conducting computer  network defense to secure its portion of the DOD global information grid,  including developing and implementing information operations and  information assurance programs and activities.
section_title: Numerous DOD Organizations Have Operational Responsibilities to Defend and Secure DOD Computer Networks
paragraphs: DOD also has numerous organizations with operational roles and  responsibilities to defend and secure DOD computer networks. U.S.  Strategic Command is considered the lead for cyberspace operations  within DOD.  According to the 2008 Unified Command Plan, U.S.  Strategic Command is responsible for synchronizing DOD’s planning for  cyberspace operations, and it does so in coordination with other  combatant commands, the military services, and defense agencies.
In order to operationalize its missions, U.S. Strategic Command  delegated operational and tactical-level planning, force execution, and  day-to-day management of forces to its joint functional component  commands. Prior to the establishment of U.S. Cyber Command, these  component commands conducted cyberspace-related operations for the  U.S. Strategic Command while headquarters focuses on strategic-level  integration and advocacy. These component commands were as follows:  Joint Functional Component Command for Network Warfare (JFCC  NW), which was responsible for planning, integrating, and coordinating  cyberspace capabilities and integrating with all necessary computer  network operations capabilities.  Joint Task Force–Global Network Operations, which was responsible  for DOD’s global network operations and directing the operation and  defense of DOD’s global information grid.  Joint Information Operations Warfare Center, which is the lead entity  responsible for planning, integrating, synchronizing, and advocating  for information operations across DOD including computer network  operations, electronic warfare, psychological operations, military  deception, and operations security.
In June 2009, as part of the creation of U.S. Cyber Command, U.S.  Strategic Command was directed by the Secretary of Defense to  disestablish Joint Task Force–Global Network Operations and Joint  Functional Component Command for Network Warfare in preparation for  U.S. Cyber Command reaching its full operating capability, planned for  October 2010. Additionally, the military departments were directed to  identify and provide appropriate component support to U.S. Cyber  Command to be in place and functioning by that same date.
Other combatant commands also have operational roles and  responsibilities for defending and securing DOD computer networks.  According to DOD Directive 8500.01E, the combatant commands must  also develop and implement their own information assurance programs  for their respective portions of the DOD global information grid and must  provide training and education for their information assurance  personnel. Certain combatant commands have unique responsibilities.  For instance, U.S. Northern Command has specific responsibilities and is  the DOD lead in assisting the Department of Homeland Security and  other civilian agencies during cyber-related incidents as part of its  Defense Support of Civil Authorities missions—or civil support. During  these incidents, U.S. Northern Command—and in some instances U.S.  Pacific Command—will be supported by U.S. Strategic Command.   Functional combatant commands have a global mission and a global  requirement for network operations support. Some functional combatant  commands, such as U.S. Special Operations Command, operate their  own specific functional global networks.
The military service components have a significant role in providing  cybersecurity while operating and defending their respective networks  within DOD’s global information grid. In their role, each military service is  responsible for fielding, training, and equipping cyberspace forces. They  also protect, defend, and conduct restoration measures for the networks  they control, and ensure that service-managed portions of DOD’s global  information grid are secure and interoperable, with appropriate  information assurance and trained personnel. Appendix II has more  information on the military services’ current cyber organization.
Defense agencies also share responsibilities related to cyber operations.  For example, the Defense Information Systems Agency is a combat  support agency responsible for the day-to-day management of DOD’s  global information grid, communication and computer-based information  systems, and performs significant network operations support functions.  Together with the military services, the agency has the responsibility to  build, maintain, and operate DOD’s global information grid. It is also  responsible for employing information assurance operations and securing  DOD’s enterprise systems. The agency reports to the Assistant Secretary  of Defense for Network and Information Integration, and its director also  currently commands Joint Task Force–Global Network Operations.
There are many other agencies and organizations that support DOD  cyber efforts, including the DOD intelligence agencies, the National  Guard, and defense criminal investigative organizations. The intelligence  agencies play an integral role in enhancing cybersecurity both by  increasing our ability to detect and identify adversary cyber activity and by  expanding our knowledge of the capabilities, intentions, and cyber  vulnerabilities of our adversaries.  For example, the National Security  Agency provides information assurance support to DOD, prescribes  minimum standards for protecting national security systems, and provides  warning support to other DOD components.  The Director of the National  Security Agency was also designated to serve as commander of the Joint  Functional Component Command for Network Warfare.  The Defense  Intelligence Agency is a combat support agency that provides all-source  intelligence to combatant commanders, defense planners, and national  security policymakers, as well as manages, operates, and maintains its  own network and information assurance program.  The Office of the  Director for National Intelligence provides direction for signals intelligence  collection in cyberspace through the National Intelligence Strategy and  National Intelligence Priority Framework.The National Guard—comprising  the Army National Guard and Air National Guard—provides cyber  capabilities to meet military service and combatant commander  requirements and can be leveraged under state authorities to assist civil  authorities. According to Air National Guard officials, skilled personnel  that come from information technology, banking, and other sectors have  been utilized to provide cyber capabilities to agencies with insufficient  manpower.
Defense criminal investigative organizations conduct cyber-related  criminal and counterintelligence investigations that may involve offenses  under title 18 of the U.S. Code. These organizations include: (1) the  Naval Criminal Investigative Service; (2) the Air Force Office of Special  Investigations; (3) the Defense Criminal Investigative Service; (4) the  Army Criminal Investigation Command; (5) Army Counterintelligence, and  the related DOD Cyber Crime Center.
section_title: DOD Is Reorganizing to Better Address Cybersecurity Threats
paragraphs: DOD is taking proactive measures to reorganize and develop new  organizational structures to better address cybersecurity threats. As a  result of significant cyber challenges and organizational constraints, DOD  is conducting a multitiered organizational restructuring for cyber  organizations, including the establishment of the U.S. Cyber Command,  and changes within the Office of the Secretary of Defense and the military  services.
The establishment of U.S. Cyber Command is DOD’s primary  organizational change to better address cybersecurity threats. On June  23, 2009, the Secretary of Defense signed a memorandum directing U.S.  Strategic Command to establish the U.S. Cyber Command as a  subordinate unified command with responsibility for military cyberspace  operations. In this memorandum, the Secretary of Defense stressed the  new national security risks that arise from DOD’s increasing dependency  on cyberspace and the growing array of cyber threats and vulnerabilities.  DOD has recognized that it lacks integration of computer network  operations at the command and operational levels. DOD anticipates that  the U.S. Cyber Command will focus on the integration of cyberspace  operations, will synchronize DOD cyber missions and warfighting efforts,  and will provide support to civil authorities and international partners.
The Secretary of Defense recommended that the director of the National  Security Agency become the commander of the U.S. Cyber Command  and that the command retain current authorities to conduct cyberspace  responsibilities that had been given to the U.S. Strategic Command in the  2008 Unified Command Plan. Additionally, U.S. Strategic Command will  delegate its cyberspace missions to U.S. Cyber Command in a phased  approach. Initial operating capability was established in October 2009;  and full operational capability is anticipated in October 2010.  By full  operational capability, U.S. Strategic Command will disestablish both the  Joint Task Force–Global Network Operations and the Joint Functional  Component Command for Network Warfare, and their existing personnel  will be incorporated into the new subunified command.  As a result, the  Director of the Defense Information Systems Agency will relinquish all  duties as the Commander of the Joint Task Force–Global Network  Operations.  However, the Defense Information Systems Agency will  establish a field office and a support element at U.S. Cyber Command to  ensure an operational linkage between the new command and the  agency.
The Secretary of Defense also directed actions in his own office and in  each military service intended to improve the diffuse efforts related to  cyberspace operations. In response, the Office of the Under Secretary of  Defense for Policy is leading a review of policy and strategy to develop a  comprehensive approach to DOD cyberspace operations. Additionally,  the Office of the Under Secretary of Defense for Policy is conducting an  organizational realignment to better address cybersecurity. The office  created a separate division—Deputy Assistant Secretary of Defense for  Cyber and Space Policy—to be a central focal point for cyberspace policy  in the Office of the Secretary of Defense. The military services are also  working to identify and provide appropriate component support to the U.S.  Cyber Command prior to its full operational capability in October 2010.  The military services are developing and implementing the following new  initiatives. On January 29, 2010, the U.S. Navy established the Fleet  Cyber Command, 10th Fleet to provide component support to the U.S.  Cyber Command. The Air Force initially planned to establish a major  cyber command. Instead, it stood up the 24th Air Force which will provide  cyber forces and capabilities to the U.S. Cyber Command. The Army  plans to support the U.S. Cyber Command through the Army Forces  Cyber, and the Marine Corps established Marine Forces Cyber.
DOD officials we interviewed expressed varying opinions on whether the  establishment of the U.S. Cyber Command will help DOD better address  cybersecurity threats. Many officials with whom we spoke said that it was  a step in the right direction as the command will potentially provide a  single point of accountability for cyber-related issues. Additionally, the  Joint Staff concluded that a four-star subunified Cyber Command under  U.S. Strategic Command, dual-hatted as the Director of the National  Security Agency, would be the most effective way to address the need to  better integrate cyber defense, attack, exploitation, and network  operations. However, officials from some combatant commands  expressed concern about the command’s close relationship to the DOD  intelligence community. These officials believed that with the Director of  the National Security Agency dual-hatted as the Commander of U.S.  Cyber Command, the U.S. Cyber Command will become too focused on  intelligence structures in detriment to a focus on operations in support of  the combatant commands. Additionally, DOD officials expressed some  concern regarding the reduced role of the Defense Information Systems  Agency with respect to the U.S. Cyber Command. The agency head was  previously also the Commander of the Joint Task Force–Global Network  Operations. Under the new relationship, the Defense Information Systems  Agency will continue to provide network and information assurance  technical assistance through a field office and a support element at U.S.  Cyber Command.
section_title: DOD Recognizes the Need to Update Cyber-Related Joint Doctrine and Guidance, but Lacks a Timetable for Completion
paragraphs: Several joint doctrine publications address aspects of cyberspace  operations, but DOD officials acknowledge that this is insufficient. None of  the joint publications that mention “cyberspace operations” contains a  sufficient discussion of cyberspace operations. DOD doctrine also lacks  key common definitions. DOD recognizes the need to develop and update  cyber-related joint doctrine and is currently debating the merits of  developing a single cyberspace operations joint doctrine publication in  addition to updating all existing doctrine.  However, there is no timetable  for completing the decision-making process or for updates to existing  doctrine.
subsections: section_title: Numerous Joint Doctrine Publications Discuss Cyber-Related Topics, but Need Updating
paragraphs: DOD has numerous joint doctrine publications that discuss cyber-related  topics; however, the content is incomplete or out of date and DOD lacks  joint doctrine that fully addresses cyberspace operations. The discussion  of cyber-related topics in current joint doctrine publications is limited and  insufficient, leaving problems such as incomplete definitions. Other  discussions—such as what constitutes a cyber force—are not uniformly  defined across DOD doctrine publications and guidance. DOD recognizes  the need to develop and update cyber-related joint doctrine and is  currently debating the merits of developing a single, overarching cyber  joint doctrine publication in addition to updating all existing doctrine with  respect to cyberspace operations. However, DOD has not set a timetable  for the completion of these efforts.
According to DOD, the purpose of joint doctrine is to enhance the  operational effectiveness of U.S. forces. Joint doctrine consists of   fundamental principles to guide the employment of U.S. military forces in  coordinated action toward a common objective and should include key  terms, tactics, techniques, and procedures. In order to be effective,  combatant commands and military services need to understand the joint  functions within the domain and the manner in which those joint functions  are integrated globally as well as operationally. The cyberspace domain is  inherently joint; it cuts across all combatant commands, military services,  and agency boundaries and supports engagement operations for all  geographic combatant commands. Therefore, DOD expects that a joint  publication focusing on all aspects of cyberspace operation will not only  enhance the operational effectiveness and performance of joint U.S  forces but also provide a doctrinal basis for collaborative planning and  interagency coordination.
DOD determined that it has addressed cyberspace-related topics in at  least 16 DOD joint doctrine publications and mentions “cyberspace  operations” in at least 8 joint publications. This reflects the importance of  cyber-related issues across the body of joint doctrine. However,  according to combatant command officials, the discussions and content in  these publications are insufficient and do not completely address  cyberspace operations or contain critical related definitions. U.S. Joint  Forces Command’s assessment of the existing state of joint doctrine for  cyber issues concluded that while the term “cyberspace operations” was  addressed or mentioned in 8 approved and draft publications, none  contained a significant discussion of cyberspace operations.
U.S. Joint Forces Command’s assessment of DOD joint publications  showed that the majority of references to cyberspace operations come  from Joint Publication 3-13, Information Operations—the current  publication with the most relevance to cyber issues. While this  publication may have been sufficient for its intentioned purposes at the  time it was written in 2006, U.S. Strategic Command reported that  Information Operations should be revised to use updated cyberspace  terminology and content. U.S. Strategic Command reported that the  publication is not currently sufficient and does not provide a basis for   cyberspace joint doctrine for 3 key reasons. First, its definition of  cyberspace does not reflect the scope of the current definition of  cyberspace that was approved by the Deputy Secretary of Defense in  May 2008. The definition in the publication restricts cyberspace to  “digital information communicated over computer networks,” while the  current approved definition recognizes cyberspace as a global domain  within the information environment that includes the Internet,  telecommunications networks, computer systems, and embedded  processors and controllers. Second, the publication discusses computer  network operations as a component of information operations by grouping  it with military deception, operation security, psychological operations,  and electronic warfare; but it does not recognize the scope of computer  network operations as a warfighting domain. Third, Joint Publication 3-13  omits integral elements in the discussion of computer network operations  that are important to provide a complete view and scope of cyberspace  operations. For example, the publication discusses computer network  attack and computer network defense but does not thoroughly address  key elements such as computer network defense response actions,  computer network attack–operational preparation of the environment, or  network operations. Our analysis of the current usage of cyber-related  terms confirms that these are considered important elements of both  computer network operations and cyberspace operations.
section_title: DOD Lacks a Common Definition of Cyber Personnel
paragraphs: Another example of the shortfall in existing doctrine is the lack of a  common definition for what constitutes cyber personnel in DOD.  According to a U.S. Joint Forces Command report, the cyberspace  operations community lacks a common dictionary of terms, and the terms  defined in current doctrine are not used uniformly. This can cause  confusion in planning for adequate types and numbers of personnel.  Because career paths and skill sets are scattered across various career  identifiers, the military services and commands vary in their scope and  definitions of what constitutes cyber personnel. As a result, there are  cases in which the same cyber-related term may mean something  different among the services. In another report, the U.S. Joint Forces  Command found that 18 different cyber position titles across combatant  commands are used to identify cyberspace forces. Some of these titles  may be inconsistent from command to command and are likely to be  duplicates. According to the report, U.S. Pacific Command had the largest  number of cyber personnel positions and position titles compared to other  combatant commands, while some commands reported no cyber  personnel. This may be due in part to duplicative and differing definitions  among the combatant commands of what constitutes cyber personnel.  Examples of cyberspace-related position titles from combatant  commands include    Computer Network Attack Intelligence Officer,    Computer Network Attack Ops Officer,    Computer Network Attack Ops Planner,    Computer Network Attack Planner,    Computer Network Attack Weapons Risk Assessor,    Computer Network Defense Planner,    Computer Network Operations Exercises Officer,    Computer Network Operations Planner,    Computer Network Operations Technician,            Network Attack Planner,    Network Defender,    Network Defense Planner,    Network Warfare Planner, and  Information Assurance Support Person,  Intelligence Support to Computer Network Attack,  Intelligence Support to Computer Network Defense,  Intelligence Systems Officer / Computer Network Defense,  The lack of clear guidance on cyber personnel in joint doctrine is also  reflected in the military services. The military services do not currently  have specific job identifiers for cyberspace operations, and cyberspace- related jobs are generally identified under the umbrella of intelligence,  communication, or command and control. While the military services bring  unique capabilities based upon their individual core competencies,  cyberspace forces must meet joint standards. U.S. Joint Forces  Command, whose mission is to synchronize global forces, reported that it  is unable to quickly and easily identify personnel who are certified for  cyber operations, as there is no identifier in the personnel records that  indicate if the individual is a “cyber warrior.” Additionally, U.S. Strategic  Command reviewed current military service cyber force identifiers and  reported that the Air Force identifies computer-related careers under  “general” for enlisted personnel and under “non-technical” skills for  officers; the Navy identifies computer network operation careers under  “information warfare” for officers and “information systems technicians” or  “intelligence and communications” for enlisted personnel.
section_title: DOD Recognizes the Need to Update and Improve Cyber-Related Joint Doctrine but Lacks a Timetable for Completion
paragraphs: DOD recognizes the need to update and improve cyber-related joint  doctrine. According to DOD, joint doctrine is being revised and updated  and will include refined discussion of cyber-related issues. The U.S. Joint  Forces Command’s assessment of the status of cyber-related joint  doctrine reported that 14 of the 16 publications that discuss cyberspace- related issues are in various stages of review or revision and that virtually  all will contain additional information that is consistent with the new  definitions for cyberspace and cyberspace operations. The report also  states that while pending revisions to various joint publications could  provide the necessary coverage of these topics, the degree of coverage  is not known until the draft revisions are available for review and  comment.
Ibid. doctrine are completed. However, until the revised doctrine publications  are released, the full extent of the changes and their inclusion of cyber- related information will be unknown. While all of these efforts represent  significant progress toward enhancing joint doctrine, there is no timetable  for the completion of all cyber-related updates to existing joint  publications.
DOD is also currently debating the merits of developing a single,  overarching cyber joint doctrine publication in addition to updating all  existing doctrine. Separate joint doctrine publications are devoted to other  major elements of operations in various “domains,” including such topics  as mine warfare, amphibious operations, urban operations, operations  other than war, counterdrug operations, and space operations.
In 2007 the National Military Strategy for Cyberspace Operations  Implementation Plan tasked a number of DOD commands and  organizations with cyber-related studies, some of which evaluated cyber- related joint doctrine. There has subsequently been broad agreement  within DOD about the need for improved joint doctrine. However, not all  commands agreed about the need for a separate cyber-specific doctrine  publication. Table 4 provides examples of some of the conclusions and  recommendations stemming from studies related to cyber joint doctrine.
In May of 2009, U.S. Strategic Command proposed the development of  an overarching joint publication for cyberspace operations dedicated to all  aspects of cyberspace operations. As the DOD command responsible  for evaluating joint doctrine proposals, U.S. Joint Forces Command  conducted a Front End Analysis that reviewed and analyzed the proposal  to determine if a doctrinal void exists and if the proposal is appropriate for  inclusion in the doctrine community. Additionally, the U.S. Joint Forces  Command officials we spoke with expressed concern about developing a  separate cyber joint publication and that this might create inefficiencies  and disconnects with existing related doctrine in such areas as  information operations. The Front End Analysis recommended that further  consideration of a separate joint doctrine publication be postponed and  that U.S. Strategic Command develop a joint test publication for  cyberspace operations.
In September 2009, the Joint Staff approved the development of the  cyberspace operations joint test publication. A joint test publication is a  proposed version of a joint doctrine that normally contains contentious  issues. After the test publication is developed, it will be evaluated  through U.S. Joint Forces Command, resulting in one of the following  recommendations: (1) that DOD convert the cyber joint test publication  into a joint publication; (2) that DOD incorporate the joint test publication  or portions of it into existing joint publications; or (3) that DOD determine  that the cyber joint test publication is not sufficient and discontinues work  on it with no effect on joint doctrine. A test publication is not considered  approved doctrine. The Joint Staff established a milestone of June 2010  for completion of the draft test publication. The Joint Staff told us it  expects evaluation of the test publication to take 6 to 12 months.  However, DOD has not determined a completion date for the evaluation  or for the final decision on the joint test publication as part of the test  publication development plan.
Regardless of whether DOD proceeds with developing a separate joint  doctrine, completion of its effort to update existing doctrine is crucial to  further improve the understanding of key cyber-related terms and  operational issues throughout DOD. According to DOD’s principal  guidance for joint doctrine development, joint doctrine must evolve as the  United States strives to meet national security challenges, and doctrinal  voids are identified. Providing a baseline of common definitions and  operational constructs for cyber operations in existing doctrine or in a  separate overarching publication would provide the basis for future  adaptation. DOD’s well-established joint doctrine development processes  provides a sound structure to assess all aspects of cyber operations,  propose doctrinal change or creation, and establish clear time frames for  completing interim and final efforts. The lack of a time frame for cyber  doctrine makes it difficult for DOD to plan for additional efforts that rely on  doctrine and may permit delay while service and joint officials continue to  debate the possible future of cyber operations rather than concentrate on  establishing a solid basis upon which future efforts can be built.
section_title: Conflicting Guidance and Unclear Responsibilities Have Created Challenges for Command and Control of Cyberspace Operations
paragraphs: DOD has assigned authorities and responsibilities for implementing  cyberspace operations among combatant commands, military services,  and defense agencies. However, the supporting relationships necessary  to achieve command and control of cyberspace operations remain  unclear. In response to a major computer infection in 2008, U.S. Strategic  Command identified confusion regarding command and control  authorities and chains of command because the exploited network fell  under the purview of both its own command and a geographic combatant  command. DOD-commissioned studies have recommended command  and control improvements.
subsections: section_title: Cyber Command and Control Is Unclear and Divided among DOD Components
paragraphs: Lines of command and control of cyber forces are divided among U.S.  Strategic Command, the geographic combatant commands, and the  military services, through several policy and guidance documents. The  National Military Strategy for Cyberspace Operations, the 2008 Unified  Command Plan, DOD Directive O-8530.1, and the Standing Rules of   Engagement are all relevant to command and control of cyberspace  operations, but they sometimes conflict with each other and remain  unclear because of overlapping responsibilities.
The National Military Strategy for Cyberspace Operations, issued in  December 2006, demonstrates DOD’s recognition that clear command  and control relationships are necessary for the successful application of  military power in cyberspace. The purpose of this strategy is to establish  a common understanding of cyberspace and set forth a military strategic  framework that orients and focuses DOD action in the areas of military,  intelligence, and business operations in and through cyberspace.  According to the strategy, the United States can achieve superiority in  cyberspace only if command relationships are clearly defined and  executed, and must support unity of effort in achieving combatant  commanders’ missions as well as maintaining freedom of action in  cyberspace. The strategy also states that cyberspace provides the  foundation for command and control of military operations in other  domains and that, due to the nature of cyberspace, command and control  requires extremely short decision-making cycles. According to the  strategy, effective command and control integrates, deconflicts, and  synchronizes cyberspace operations at the speeds required for achieving  awareness and generating effects, while failure to establish an integrated  structure can hinder collaboration and lengthen decision-making cycles.
The 2008 Unified Command Plan gave specific responsibilities for  synchronizing planning for cyberspace operations to U.S. Strategic  Command, including directing global information grid operations and  defense, planning against designated cyberspace threats, coordinating  with other combatant commands and U.S. government agencies, and  executing cyberspace operations. The Unified Command Plan also states  that, unless otherwise directed, combatant commanders will exercise  command authority over all commands and forces assigned to them, in  accordance with section 164 of title 10 of the U.S. Code. However, while  individual service networks may reside within the area of responsibility of  a particular geographic combatant command, that geographic  commander does not possess the authority to direct the network  operations of his component organizations, because those component  networks are owned and directed by their respective service  organizations through their role as Computer Network Defense Service  Providers (defined within DOD Directive O-8530). This establishes a  conflicting situation that affects the geographic combatant commanders’  visibility over networks in their areas of responsibility.
Also, the Standing Rules of Engagement state that unit commanders  always retain the inherent right and obligation to exercise unit self- defense in response to a hostile act or demonstrated hostile intent. This  generally extends to commanders conducting information operations and  includes the authorization to conduct protective, defensive, and  restorative measures for the networks they control in response to all  unauthorized network activity. However, when defensive measures would  have potentially adverse effects across multiple DOD networks or on  adversary or intermediary networks outside the DOD global information  grid, they must be approved by the Commander of U.S. Strategic  Command, under his responsibility for DOD-wide network operations, and  coordinated with affected components and appropriate law enforcement  or intelligence organizations.
section_title: 2008 Cyber Incident Exposed Weaknesses in DOD’s Command and Control Authorities and Procedures for Cyberspace Operations
paragraphs: An incident of malware infection on DOD systems in 2008 illustrated that  a lack of operational clarity significantly slowed down DOD’s response. As  a result of this malware eradication effort, U.S. Strategic Command  identified confusion regarding the exploited networks. This led to  uncoordinated, conflicting, and unsynchronized guidance in response to  the incident being issued in several forms via multiple channels. Our  review confirmed that multiple directives contributed to confusion at the  execution level, leaving operators and administrators to reconcile  priorities and question which procedures were appropriate and most  urgent to address the malware infection. Although DOD intends for the  new U.S. Cyber Command to facilitate command and control, as late as  December 2009, DOD noted that these problems had not been fully  addressed, though the new U.S. Cyber Command is expected to be  established by October 2010. Without complete and clearly articulated  guidance on cyber command and control responsibilities that is well- communicated and practiced with key stakeholders, DOD may have  difficulty in building unity of effort for carrying out cyber operations.
section_title: DOD-Commissioned Studies Recommend Cyber Command and Control Improvements
paragraphs: DOD has recognized the need for improvements in its command and  control organization for cyberspace operations and commissioned  associated studies by U.S. Joint Forces Command and the Institute for  Defense Analyses. Both classified studies evaluated DOD’s command  and control organization and recommended improvements in 2008.
DOD has started to act on these recommendations, by initiating key  organization changes, such as establishing the U.S. Cyber Command.  However, until DOD updates its policies and guidance to clarify command  and control relationships for cyber operations and clearly communicates  those to all DOD entities, its efforts to conduct coordinated and timely  actions to defend DOD’s critical networks and other cyber operations will  be degraded.
section_title: DOD Has Identified Some Capability Gaps in Cyber Operations, but Lacks a Comprehensive Assessment of Departmentwide Cyberspace Needs and an Implementation Plan to Address Any Gaps
paragraphs: DOD has identified some cyberspace capability gaps. DOD also  continues to study the extent of these gaps. However, it has not  completed a comprehensive, departmentwide assessment of needed  resources associated with the capability gaps and an implementation plan  to address any gaps.
subsections: section_title: DOD Has Identified Some Capability Gaps in Cyber Operations
paragraphs: According to the 2006 National Military Strategy for Cyberspace  Operations, military departments and certain agencies and commands  should develop the capabilities necessary to conduct cyberspace  operations, including consistently trained personnel, infrastructure, and  organization structures. U.S. Strategic Command’s Operational Concept  for Cyberspace reported in 2008 that national security vulnerabilities  inherent in cyberspace make it imperative that the United States develop  the requisite capabilities, policy, and tactics, techniques, and procedures  for employing offensive, defensive, and supporting operations to ensure  freedom of action in cyberspace. In addition, a study commissioned by  the Joint Staff and conducted by the Institute for Defense Analyses states  that the key underlying drivers of effectiveness in cyberspace are  developing and deploying the right tools and building and sustaining an  adequate cyber force of trained and certified people. Institute for  Defense Analyses officials stated that unless DOD has adequate  resources for cyber   operations, organizational changes within the cyber domain will not be  effective.
DOD commands have identified capability gaps that hinder their ability to  marshal resources to operate in the cyberspace domain. U.S. Strategic  Command and other combatant commands highlighted their cyber  capability gaps in their Integrated Priority Lists for fiscal years 2011- 2015. U.S. Strategic Command, which is tasked with being the global  synchronizer for cyber operations within DOD, identified in its Integrated  Priority List for fiscal years 2011-2015 gaps and associated priorities in  such areas as the need to be able to defend against known threats,  detect or characterize evolving threats, and conduct exploitation and  counter operations, as desired. U.S. Strategic Command listed cyber- related gaps as its highest priority, emphasizing the need for and  importance of resources to increase cyber capabilities. U.S. Pacific  Command, U.S. Special Operations Command, and U.S. Joint Forces  Command have also reported cyber capability gaps involving lack of  sufficient numbers of trained personnel to support their cyber operations  and a need for additional cyber intelligence capabilities.
U.S. Strategic Command has reported that the lack of cyber resources it  identified has affected the command’s ability to respond to requests for  cyber capabilities from other combatant commands, particularly for full- spectrum cyberspace operations. It remains to be seen what effect the  newly proposed U.S. Cyber Command will have on this process,  particularly with Joint Functional Component Command for Network  Warfare and Joint Task Force–Global Network Operations being merged  into one organization within the new U.S. Cyber Command.
A need for more cyber planners and cyber-focused intelligence analysts  was a common theme during our meetings with officials at the combatant  commands. Officials at several of the geographic combatant commands  stated that without the proper planners and cyber-focused intelligence  analysts, they lacked situational awareness of their networks and the  ability to both plan cyber operations for their respective commands and  request applicable support from U.S. Strategic Command. For example,  cyber planners play a key part in the developmental process of a  computer network attack operation. U.S. Central Command officials  stated that although most computer network attack operations are being  conducted in its area of responsibility, it does not have a single full-time  dedicated cyber planner to assist in the development of such operations.  Because it lacks the appropriate trained personnel and dedicated career  path, U.S. Central Command has redirected personnel with cyber  expertise to act as temporary planners. This greatly affected the  command’s ability to match resources to, and plan for, all cyber-related  functions. For example, a cyber planner within U.S. Central Command  was borrowed from another career field, worked as a planner for a time,  and then was reassigned to help resolve information technology issues at  a help desk.
Without a sufficient number of cyber planners in-theater, combatant  commands will continue to struggle with being able to plan cyber activities  to assist in accomplishing the commander’s mission objectives, and  communicating their need for assistance to U.S. Strategic Command. The  lack of skilled and highly trained cyber personnel presents challenges for  many DOD components, and the lack of sufficient personnel prevents  DOD components from fulfilling essential computer network operation  activities.
section_title: DOD Is Taking Steps to Study Cyber Capability Gaps but Lacks a Comprehensive Departmentwide Capabilities-Based Assessment
paragraphs: DOD’s Joint Capabilities Integration and Development System provides a  framework from which DOD can assess and prioritize departmentwide  cyber-related capability gaps, assign responsibility for addressing them,  and develop an implementation plan for achieving and tracking results.  This system is DOD’s primary means of identifying the capabilities  required to support national strategies. It therefore helps the military  services prepare long-term program plans to address critical joint  capabilities. One of the key elements of this system is a capabilities- based assessment that defines a mission, identifies required capabilities,  identifies gaps, assesses risk associated with those gaps, prioritizes  gaps, assesses nonmateriel solutions, and recommends actions for the  department to pursue.
While the department’s review of cyberspace capability gaps and various  studies on cyberspace operations are steps in the right direction, it  remains unclear whether these gaps will be addressed, since DOD has  not conducted the kind of comprehensive capabilities-based assessment  outlined in the Joint Capabilities Integration and Development System or  established an implementation plan to resolve any resulting gaps. For  example, DOD conducted an assessment of computer network defense  and computer network attack capability gaps in 2004 that highlighted the  need for a broader effort to address gaps as part of the Joint Capabilities  Integration and Development System. However, this assessment was  not finalized for action.
DOD has since conducted individual cyber-related studies focused on the  lack of trained cyber personnel and also brought attention to cyber-related  capability gaps listed in the combatant commanders’ fiscal year 2011- 2015 Integrated Priority Lists. In February 2009, the Joint Staff directed  the Force Support Functional Capabilities Board to address future  cyberspace force manning and organization gaps and to develop a  current baseline manpower posture across cyberspace operations and  present a consolidated view of all documented DOD cyberspace  manpower requirements. The Force Support Functional Capabilities  Board put together a Cyberspace Study Team to engage the combatant  commands, services, and agencies in their efforts.
In addition to the cyberspace studies discussed above, and as part of  DOD’s Joint Capabilities Integration and Development System, the Joint  Requirements Oversight Council issued a memorandum in June 2009  (JROCM 113-09) that reviewed and endorsed 85 capability gaps across  DOD from the combatant commands’ reported Integrated Priorities  Lists—4 of which were cyber-related. Throughout the Joint Capabilities  Integration and Development System process, functional capabilities  boards provide oversight and assessment, as appropriate, to ensure  system documents take into account joint capabilities and alternative  approaches to solutions. In this case, the memorandum stated that  Functional Capabilities Boards will track the recommendations related to  the capability gaps.
The Functional Capabilities Boards periodically report on the way ahead  for recommended actions and report recommendations to the Joint  Requirements Oversight Council for decision. The Joint Requirements  Oversight Council’s approval and implementation in a Joint Requirements  Oversight Council Memorandum serves as the analytic underpinning for  many future decisions related to capability gaps. However, capability  gaps are considered “closed” based on the Joint Requirements Oversight  Council’s decisions and the assumption that those decisions will be  implemented. Failure to execute the Joint Requirements Oversight  Council’s decision is not considered a capabilities gap assessment issue,  although it may generate an input for the next capabilities gap  assessment cycle.
DOD has continued to make progress with respect to some of the  individual capability gaps identified from the Integrated Priority Lists for  fiscal year 2011-2015. Also the memorandum requested that U.S.  Strategic Command lead the joint effort to create a concept of operations  to inform future decisions but provided no specific time frame for these  actions in the memorandum.
Joint Staff officials we interviewed recognized that fully addressing the  cyber capability gaps they have thus far identified may take years to  complete. Some cyber capability gaps are relatively new, thus the Joint  Requirements Oversight Council has deferred manpower studies to be  completed first so that informed decisions can be made at a later time.  For example, the Joint Staff officials also noted that some cyber-related  resource requests involving computer network operations from U.S.  Pacific Command could not be addressed immediately because of the  lack of existing doctrine or policy on the appropriate authority to carry out  this specific action.
While the Joint Staff’s action to direct the Functional Capabilities Boards  to track progress toward addressing capability gaps is a step in the right  direction for developing a plan to address capability gaps, it remains  unclear whether or when these gaps will be addressed. For example, as  of December 2009, the Joint Staff listed all the cyber-related capability  gaps noted by Joint Requirements Oversight Council Memorandum 148- 09 as closed; but for several of the gaps, the memorandum only cited the  manpower study discussed above as rationale.
Furthermore, the Joint Staff is also currently reviewing the most recent  Integrated Priority List from the combatant commands for fiscal years  2012-2017, in which some previously-cited cyber capability gaps were  repeated.
Though DOD has previously begun efforts similar to a comprehensive  capabilities-based assessment for cyberspace, it has not completed those  efforts. The studies we discuss and ongoing efforts, such as the individual  Functional Capabilities Board actions, provide much-needed information  to DOD officials about where further action may be needed. But these  efforts lack the scope of a complete capabilities-based assessment and  do not include time frames or a funding strategy for addressing capability  gaps. Further, in prior work, we found that best practices for strategic  planning have shown that effective and efficient operations require  detailed plans outlining major implementation tasks, defined metrics and  timelines to measure progress, a comprehensive and realistic funding  strategy, and communication of key information to decision makers.  Absent such elements as a broad assessment of cyber-related capability  gaps, time frames for assessing and addressing gaps, and a strategy for  funding any required programs, combatant commands are compelled to  report the same capability gaps they had in previous years without an  assurance that they will be addressed; and the military services will be  unable to fully plan for programs to address cyberspace requirements. As  a result, cyber capability gaps across DOD will continue to hinder DOD’s  ability to plan for and conduct effective cyber operations.
section_title: Conclusions
paragraphs: DOD has been characterized as one of the best-prepared federal  agencies to defend against cybersecurity threats, but keeping pace with  the magnitude of cybersecurity threats DOD faces currently and will face  in the future is a daunting prospect. DOD networks and our country’s  critical infrastructure can be disrupted, compromised, or damaged by a  relatively unsophisticated adversary and, as witnessed by the 2008  infections from removable media, this can potentially affect the conduct of  military operations. The U.S. military is dominant in the land domain,  unchallenged in the air, and has few near-peers in the maritime domain.  However, the technical and economic barriers to entry into the cyber  domain are much lower for adversaries and as a result place U.S.  networks at great risk. DOD has taken many important steps to better  organize its cyber efforts with the creation of the U.S. Cyber Command,  but it is too early to tell whether this will provide the necessary leadership  and guidance DOD requires to address cybersecurity threats. Based on  public statements from DOD senior leadership, DOD understands the  severity of the problem. DOD’s actions to reassess its organization for  cyber-related operations, assess and update joint doctrine, assess  command and control relationships, and study cyber-related capability  gaps all take advantage of DOD’s considerable planning and operational  experience. The next step to keep pace or stay ahead of the rapidly- changing environment reflected by  the cyber domain is for DOD to  further its efforts in each of these areas in a more comprehensive manner  and as part of a cohesive policy.
section_title: Recommendations for Executive Action
paragraphs: To strengthen DOD’s cyberspace doctrine and operations to better  address cybersecurity threats, we recommend that the Secretary of  Defense take the following two actions:    direct the Chairman of the Joint Chiefs of Staff in consultation with the  Under Secretary of Defense for Policy and U.S. Strategic Command to  establish a time frame for (1) deciding whether or not to proceed with  a dedicated joint doctrine publication on cyberspace operations and  for (2) updating the existing body of joint doctrine to include complete  cyberspace-related definitions, and    direct the appropriate officials in the Office of the Secretary of  Defense, in coordination with the Under Secretary of Defense for  Policy and the Joint Staff, to clarify DOD guidance on command and  control relationships between U.S. Strategic Command, the services,  and the geographic combatant commands regarding cyberspace  operations, and establish a time frame for issuing the clarified  guidance.
To ensure that DOD takes a more comprehensive approach to its  cyberspace capability needs and that capability gaps are prioritized and  addressed, we make two additional recommendations, that the Secretary  of Defense direct the appropriate Office of the Secretary of Defense  officials, in coordination with the secretaries of the military departments  and the Joint Chiefs of Staff, to    develop a comprehensive capabilities-based assessment of the  departmentwide cyberspace-related mission and a time frame for its  completion, and    develop an implementation plan and funding strategy for addressing  any gaps resulting from the assessment that require new capability  development or modifications to existing programs.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, DOD agreed with our 4  recommendations and discussed some of the steps it is taking and  planning to take to address these recommendations. DOD also provided  technical comments, which we have incorporated into the report where  appropriate.
In response to our recommendation that the Secretary of Defense direct  the Chairman of the Joint Chiefs of Staff in consultation with the Under  Secretary of Defense for Policy and the U.S. Strategic Command to  establish a time frame for deciding whether or not to proceed with a  dedicated joint doctrine publication on cyberspace operations and for  updating the existing body of joint doctrine to include complete  cyberspace-related definitions, DOD agreed and stated that as part of  implementing the National Military Strategy for Cyberspace Operations,  an assessment of joint doctrine is under way and is expected to be  completed by the end of fiscal year 2011. Furthermore, DOD said that this  process will also include related cyber lexicon and definitions. While our  report was in final processing, DOD began to publish some of the  doctrinal updates they had agreed needed to be made. Since the National  Military Strategy for Cyberspace Operations was published in 2006, we  believe the new joint doctrine assessment represents progress that  should help DOD address some of the existing gaps in joint doctrine with  a time frame for completing the effort. We continue to believe that DOD’s  overall assessment should include a decision on whether or not to  proceed with a dedicated joint doctrine publication on cyberspace  operations and a plan for updating the existing body of joint doctrine.
DOD agreed with our recommendation that it clarify roles and  responsibilities, including command and control relationships between the  U.S. Strategic Command, the services, and the geographic combatant  commands regarding cyberspace operations, and establish a time frame  for issuing the clarified guidance. However, DOD stated it had already  satisfied this recommendation by means of the June 23, 2009,  memorandum establishing U.S. Cyber Command and the 2008 Unified  Command Plan. According to DOD, both documents have promulgated  clear guidance for command and control relationships. The Secretary of  Defense memorandum establishing the U.S. Cyber Command does  allude to the U.S. Cyber Command implementation plan, which does  contain some information on command and control relationships, but  does not provide the kind of clear guidance we describe as lacking in our  report. The implementation plan further alludes to a U.S. Cyber  Command Concept of Operations that will be published at a later date,  which may provide further information on command and control guidance.  While the 2008 Unified Command Plan discusses missions and  responsibilities for U.S. Strategic Command in cyberspace operations, we  believe this information is outdated, considering the memo directing the  establishment of U.S. Cyber Command was issued in June 2009.  Although it is early in the establishment process for the new U.S. Cyber  Command, we continue to believe that DOD should take advantage of  opportunities to develop and articulate clear command and control  guidance that will provide a timely and cohesive approach to combating  cyber threats throughout the chain of functional and geographic  combatant commands, the services, and other DOD components in  anticipation of the U.S. Cyber Command reaching full operating capability  in October 2010. Vehicles for conveying this guidance might include the  U.S. Cyber Command Concept of Operations, additional implementation  plans, and revisions to the Unified Command Plan.
DOD agreed with our recommendation that the Secretary of Defense  direct the appropriate Office of the Secretary of Defense officials, in  coordination with the Secretaries of the military departments and the Joint  Chiefs of Staff, to develop a comprehensive capabilities-based  assessment of the departmentwide cyberspace-related mission and a  time frame for its completion. DOD indicated that cyber defense would be  one focus area for risk management decisions as part of the upcoming  budget cycle but provided no further information on how it planned to  implement the steps in the recommendation. We recognize that fully  addressing DOD’s cyber capability gaps will take years; however, we  maintain the importance of establishing an assessment of these gaps and  establishing a time frame to address them.
DOD agreed with our recommendation that the Secretary of Defense  direct the appropriate Office of the Secretary of Defense officials, in  coordination with the Secretaries of the military departments and the Joint  Chiefs of Staff, to develop an implementation plan and funding strategy  for addressing any gaps resulting from the assessment that require new  capability development or modifications to existing programs. DOD stated  that its budget risk management decisions, as well as the development of  a National Defense Strategy for Cyberspace Operations would help the  department identify and mitigate gaps but provided no further information  on how they planned to implement the steps identified in the  recommendation. We continue to believe it is important to develop an  implementation plan and funding strategy for addressing these gaps in  order to avoid combatant commands reporting the same capability gaps  they had in previous years without an assurance that they will be  addressed and that the military services will be unable to fully plan for  programs to address cyberspace requirements. Without this effort, cyber  capability gaps across DOD will continue to hinder its ability to plan for  and conduct effective cyber operations.
DOD’s comments are reproduced in full in appendix V.
We are sending copies of this report to appropriate congressional  committees. We are also sending copies to the Secretary of Defense and  the Chairman, Joint Chiefs of Staff. In addition, the report will be available  at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact Davi M. D’Agostino at (202) 512-5431 or Gregory C. Wilshusen at  (202) 512-6244. We can also be reached by e-mail at  dagostinod@gao.gov or wilshuseng@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: To address our objectives, we focused our work on the Department of  Defense’s (DOD) organizations that are involved in computer network  operations, including computer network defense, exploitation, and  computer network attack. We reviewed a variety of unclassified and  classified documents to understand the organization and challenges the  department faces in addressing cyberspace operations.
subsections: section_title: Offices within the Office of the Secretary of Defense
section_title: Combatant Commands
section_title: Department of the Army
section_title: Department of the Navy
section_title: Department of the Air Force
section_title: DOD Agencies
section_title: Defense Criminal Investigative Organizations
section_title: Federal Agencies and Entities
section_title: Nongovernmental Cybersecurity Organizations
paragraphs:   Sans Institute    Carnegie Mellon CERT CC  We reviewed policies, guidance, and directives involving organizations  related to computer network operations. Also, we reviewed documents  involving the reorganization and development of new organizations within  the Office of the Secretary of Defense, U.S. Strategic Command, Air  Force, and Navy to address cyber threats.
To determine the extent to which DOD has developed an overarching  joint doctrine that addresses cyberspace operations across DOD, we  reviewed and analyzed current joint doctrine publications, such as Joint  Publication 13-3, Information Operations, and other publications involving  computer network operations for key definitions. Also, we reviewed U.S.  Joint Forces Command’s analysis of cyber-related joint doctrine and U.S.  Strategic Command’s current efforts to develop joint doctrine. In addition,  we interviewed Joint Staff, U.S. Strategic Command, and U.S. Joint  Forces Command officials regarding current department efforts to  develop joint doctrine on cyberspace. We compared existing joint doctrine  efforts and plans with the guidance in DOD’s joint doctrine development  process.
To assess the extent to which DOD has assigned command and control  responsibilities, we reviewed the 2008 Unified Command Plan, Standing  Rules of Engagement and other DOD plans, policies and guidance to  determine authorities for functional and geographic combatant  commands, military services, and defense agencies. Additionally, we  reviewed and identified lessons learned from combatant commands  following DOD’s response to malware infections during Operation  Buckshot Yankee in 2008. In addition, we interviewed service and  command officials directly involved with Operation Buckshot Yankee to  discuss their challenges. We also reviewed recommendations on  command and control from the Institute for Defense Analyses and U.S.  Joint Forces Command and met with officials from these organizations to  discuss analysis involving this area.
To determine capability gaps involving computer network operations we  analyzed the fiscal year 2010 and 2011-2015 Integrated Priority Lists to  identify cyberspace capability gaps for the functional and geographic  combatant commands. Also we analyzed the National Intelligence  Estimate regarding The Global Cyber Threat to the U.S. Information  Infrastructure, the Central Intelligence Agency’s Cyber Threat Intelligence  Highlights, and prior GAO reports on cybersecurity to determine the depth  of cyber threats facing the nation and DOD. We also interviewed various  functional and geographic combatant command officials to identify  capability gaps and resources needed to address these gaps. In addition,  we met with Joint Staff officials to discuss their efforts to address  capability gaps listed in the Integrated Priority Lists, including developing  studies on manpower shortages and providing funding to computer  network defense efforts. We reviewed DOD cyber-related capability  assessments and compared them with DOD criteria for capabilities-based  assessments as part of DOD’s Joint Capabilities Integration and  Development System.
We conducted this performance audit from November 2008 through April  2010 in accordance with generally accepted government auditing  standards and worked with DOD from November 2010 to July 2011 to  prepare an unclassified version of this report for public release.  Government auditing standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
section_title: Appendix II: DOD Cyber Organizations
paragraphs: The following are examples of Department of Defense (DOD) offices and  organizations with cyber-related roles and responsibilities.
Table 5 shows certain cyber-related roles and responsibilities for various  offices within the Office of the Secretary of Defense.
Table 6 shows certain cyber-related roles and responsibilities for various  Joint Staff offices.
Table 7 shows certain cyber-related coordination forums.
Table 8 shows certain cyber-related roles and responsibilities of U.S.  Strategic Command.
Table 9 shows certain cyber-related roles and responsibilities of  Combatant Command Theater Network Centers and Theater and Global  Network Operation Centers.
Table 10 shows the cyber-related roles and responsibilities of services’  Network Operations Centers and Computer Emergency/Incident  Response Teams  Table 11 shows the military services’ current cyber organization in  January 2009.
Table 12 shows some of the cyber-related roles and responsibilities of the  intelligence agencies.
Table 13 shows certain cyber-related roles and responsibilities of defense  criminal investigative–related organizations.
The Secretary of Defense directed the office to lead a review of policy  and strategy to develop a comprehensive approach to DOD cyberspace  operations. As a result of this review and a separate review of DOD  cyberspace policy conducted under the National Military Strategy for  Cyberspace Operations Implementation Plan, the Office of the Under  Secretary of Defense for Policy found that DOD required new and  updated cyberspace policies to guide the integration of cyberspace, and  that the existing policies were too focused on the individual pieces of  cyberspace operations.
Table 14 shows how the military services are supporting or plan to  support the U.S. Cyber Command.
section_title: Appendix III: Cyberspace Defensive Measures and Mechanisms Used by DOD
paragraphs: The Department of Defense (DOD) defines computer network defense as  actions taken to protect, monitor, analyze, detect, and respond to  unauthorized activity within DOD information systems and computer  networks. Computer network defense employs information assurance  capabilities to respond to unauthorized activity within DOD information  systems and computer networks in response to a computer network  defense alert or threat information.
Currently, DOD’s cyberspace defensive measures include Intrusion  Detection Systems that alert network operators to the signatures of an  incoming attack or can kill the network traffic. Strong firewall settings  reduce the exposure to the outside world on the NIPR Network as well as  block incoming traffic from origins known to launch attacks. Traffic, both  inbound and outbound, in a symmetric network configuration, can be  examined or prevented, causing most trivial attacks to be stopped at the  NIPR Network borders.
Several metrics are used to measure information assurance performance.  These include documenting the correct certification and accreditation  documentation and compliance with DOD directives, reporting this  information as a part of the Federal Information Systems Management  Act, vulnerability scanning, red and blue team testing, Defense  Information Systems Agency evaluations performed on various networks,  and other efforts.
Below are several examples of policies, programs, and tools that DOD  uses to protect its networks.
subsections: section_title: Computer Network Defense Service Providers
paragraphs: DOD Directive O-8530.1, and its supporting document DOD Instruction  O-8530.2, directed the heads of all DOD components to establish  component-level computer network defense services to coordinate and  direct all componentwide computer network defense and ensure  certification and accreditation in accordance with established DOD  requirements and procedures. Computer network defense service is  provided or subscribed to by owners of DOD information systems or  computer networks, or both, in order to maintain and provide computer  network defense situational awareness, implement computer network  defense protect measures, monitor and analyze in order to detect  unauthorized activity, and implement computer network defense  operational direction. DOD Directive O-8530.1 also required that all  component information systems and computer networks be assigned to a  certified computer network defense service provider. Computer network  defense service providers are those organizations responsible for  delivering protection, detection, and response services to its users.  Computer network defense service providers are commonly a Computer  Emergency or Incident Response Team and may be associated with a  Network Operations and Security Center. The goal for the program is to  improve the security posture of DOD information systems and networks  by ensuring that a baseline set of services are provided by computer  network defense service providers. Under the oversight of the Assistant  Secretary of Defense for Networks and Information Integration and U.S.  Strategic Command, the Defense Information Systems Agency conducts  a certification program of the computer network defense service providers  to ensure they are providing that critical baseline set of services.
section_title: Defense Information Assurance Certification and Accreditation Process Training
paragraphs: The Defense Information Assurance Certification and Accreditation  Process was implemented by the DOD Chief Information Officer in DOD  Instruction 8510.01 on November 28, 2007. According to DOD, the  Defense Information Assurance Certification and Accreditation Process is  the standard DOD process for identifying, implementing, validating,  certifying, and managing information assurance capabilities and services,  expressed as information assurance controls, and authorizing the  operation of DOD information systems, in accordance with Title III of the  E-Government Act, the Federal Information Security Management Act,  DODD 8500.1, DODI 8500.2, and other statutory and regulatory  requirements.
section_title: Federal Information Security Management Act
paragraphs: The Federal Information Security Management Act of 2002 requires  agencies to develop and implement an information security program,  evaluation processes, and annual reporting. The act requires mandated  annual reports by federal agencies and the Office of Management and  Budget. The act also includes a requirement for independent annual  evaluations of the agencies’ information security programs and practices  by the agencies’ inspectors general or independent external auditors.
section_title: Host-Based Security Systems
paragraphs: Host-Based Security Systems are a suite of commercial-off-the-shelf  software that provides a framework and point products to protect against  cyber threats both at the network and host levels, and provide system  baselining to support the Information Operations Condition process. The  system includes, but is not limited to, host firewall, host intrusion  detection, host intrusion prevention, system compliance profiling, rogue  system detection, application blocking, and Information Operations  Condition baselining. DOD expects to provide network administrators and  security personnel with mechanisms to prevent, detect, track, report, and  remediate malicious computer-related activities and incidents across all  DOD networks and information systems. The deployment of Host-Based  Security Systems was initially ordered by Joint Task Force-Global  Network Operations in October 2007, with deployment on unclassified  systems to be completed no later than June 2008. Deployment of Host- Based Security Systems to classified systems was to begin in January  2008. According to U.S. Strategic Command, as of February 2010, DOD  NIPR and SIPR networks were still in the process of implementing Host- Based Security Systems, with 67 percent and 48 percent respectively  implemented.
section_title: Information Assurance Vulnerability Management Program
paragraphs: The Information Assurance Vulnerability Management Program provides  positive control of vulnerability notification, corresponding corrective  action, and Information Assurance Vulnerability Alert status visibility for  DOD network assets. It focuses on the status of DOD networks to  mitigate or eliminate known vulnerabilities. Joint Task Force–Global  Network Operations is responsible for monitoring relevant sources of  information to discover security conditions that may require Information  Assurance Vulnerability Management vulnerability notification and assess  risk and potential operational effect associated with software  vulnerabilities. Once a vulnerability is evaluated and warrants notification,  Joint Task Force–Global Network Operations will publish an Information  Assurance Vulnerability Management vulnerability notification and  amplifying information as one of three products depending on risk level of  the vulnerability: Information Assurance Vulnerability Alert (critical risk),  Information Assurance Vulnerability Bulletin (medium risk), Technical  Advisory (low risk). Response to Alerts is mandatory and combatant  commands, military services, and defense agencies are required to  implement directives, and report back to Joint Task Force–Global  Network Operations on their Information Assurance Vulnerability Alert  compliance.
section_title: Command Cyber Readiness Inspection
paragraphs: These inspections, formerly known as the Enhanced Compliance  Validation visits, are conducted by the Defense Information Systems  Agency at the direction of U.S. Strategic Command in order to provide an  assessment of information assurance and compliance to DOD policies  and configuration requirements of all combatant commands, military  services, and DOD agencies. The Defense Information Systems Agency  also uses these inspections to provide DOD component and local  leadership with actionable recommendations for improving information  assurance readiness. DOD officials considered these visits as risk  assessments.
section_title: Operational Inspections
paragraphs: Inspection teams provide penetration testing and security audits for client  agencies, combatant commands, installations, and military services. The  inspection teams use a holistic approach that evaluates more than  computer hardware and software—such as personnel procedures and  policies, and physical security of equipment and locations.
section_title: Network Scans
paragraphs: According to Defense Information Systems Agency officials, the Defense  Information Systems Agency and Joint Task Force–Global Network  Operations scan DOD networks. Combatant commands, military services,  and defense agencies are also responsible for scanning the local systems  that they administer. The Defense Information Systems Agency scans  systems prior to their connection to DOD networks and at regularly  scheduled intervals thereafter. Additionally, Joint Task Force–Global  Network Operations has directed all combatant commands, military  services, and defense agencies to scan their networked devices on a  regular basis.
section_title: Joint Task Force–Global Network Operations Scorecard
paragraphs: Joint Task Force–Global Network Operations has developed its NetOps  Scorecard as a process for displaying NetOps compliance and readiness  status for the entire DOD community. This quarterly review has been in  effect for the military services since August 2007, and was expanded to  cover all combatant commands, military services, and DOD agencies in  February 2009. The Scorecard measures compliance to NetOps  directives (such as communications tasking orders, Information  Operations Conditions, and fragmentary orders), authority to operate,  Information Assurance Vulnerability Alert compliance, and the status of  inspections.
section_title: U.S. European Command Cyber Defense Playbook
paragraphs: U.S. European Command has developed its own Cyber Defense  Playbook intended to standardize theater policy, tactics, and procedures  related to computer network defense efforts and improve command and  control relationships to ensure and maintain cyber/network readiness and  coordinated responses to computer network defense events. The  Playbook was developed by a working group from across the theater with  participation from U.S. European Command, U.S. Army Europe, U.S. Air  Force Europe, Special Operations Command Europe, U.S. Navy Europe,  and the Defense Information Systems Agency. It incorporates information  and best practices from the agencies listed above as well as from the  Joint Functional Component Command for Network Warfare and Joint  Staff guidance. It includes baseline computer network defense triggers,  reporting and response timelines, checklists, tactics, techniques, and  procedures for computer network defense related events, and basic  computer network defense reference materials. The Playbook also  includes contingency options for personnel to use should their  recommended computer network defense tools be unavailable.
section_title: Defense Industrial Base Collaborative Information Sharing Environment
paragraphs: According to officials from the DOD Cyber Crime Center, the Defense  Industrial Base Collaborative Information Sharing Environment is an  Office of the Secretary of Defense–initiated effort to generate more  transparency about and share network security information among DOD’s  private sector contractors. The Defense Industrial Base Collaborative  Information Sharing Environment is run by the DOD Cyber Crime Center,  and 28 Defense Industrial Base partners have voluntarily agreed to share  information through the program as of March 2009. The 28 Defense  Industrial Base partners are all major contractors and are responsible for  approximately 90 percent of the information across the Defense Industrial  Base. The information shared in Defense Industrial Base Collaborative  Information Sharing Environment is anonymous because the Defense  Industrial Base partners are concerned about public disclosure. They feel  that if their shareholders and competitors learn that a Defense Industrial  Base partner’s networks have been attacked, it could affect earning and  the ability to win contracts in the future.
section_title: National Cyber Range
paragraphs: The Defense Advanced Research Projects Agency is in the process of  developing a National Cyber Range that will provide a test bed to produce  qualitative and quantitative assessments of the security of various cyber  technologies and scenarios. This effort is expected to provide a safe,  instrumented environment for national cyber security research  organizations to test the security of information systems. Several private,  commercial, and academic institutions will develop the initial phase of the  National Cyber Range. At the conclusion of the initial phase, the Defense  Advanced Research Projects Agency will make decisions regarding future  plans, which notionally could include a second phase with a critical design  review, and a third phase to develop the full-scale National Cyber Range  and start conducting tests.
section_title: DOD Security Technical Implementation Guides (STIG)
paragraphs: According to DOD officials, DOD mandates specific configuration settings  for all prevalent technologies in the Global Information Grid through the  use of Security Technical Implementation Guides and associated  checklists. These Security Technical Implementation Guides are  developed by the Defense Information Systems Agency in full  collaboration with military services, agencies and selected combatant  commands. According to DOD officials, the Security Technical  Implementation Guides are updated periodically keeping pace with  documented emerging threats and changes to technology. These  Security Technical Implementation Guides are a basis for system  administrators to securely maintain their systems and for certifiers and  reviewers to evaluate those systems.
section_title: Appendix IV: Audit Community Work in Information Security
paragraphs: In prior reports, we and various agency inspector general offices have  made hundreds of recommendations to agencies for actions necessary to  resolve prior significant control deficiencies and information security  program shortfalls. For example, we recommended that federal  agencies correct specific information-security deficiencies related to user  identification and authentication, authorization, boundary protections,  cryptography, audit and monitoring, physical security, configuration  management, segregation of duties, and continuity of operations  planning. We have also recommended that agencies fully implement  comprehensive, agencywide information-security programs by correcting  weaknesses in risk assessments, information-security policies and  procedures, security planning, security training, system tests and  evaluations, and remedial actions.
In the past, we have also reviewed the Department of Defense’s (DOD)  information-security weaknesses in various reports. For example, in 1991,  we reported on foreign hackers penetrating DOD computer systems  between April 1990 and May 1991, as a result of inadequate attention to  computer security, such as password management and the lack of  technical expertise on the part of some system administrators. In May  1996, we reported that unknown and unauthorized individuals were  increasingly attacking and gaining access to highly sensitive unclassified  information on DOD’s computer systems. We reported that external  attacks on DOD computer systems were a serious and growing threat.  According to DOD officials, attackers had stolen, modified, and destroyed  both data and software. They had installed “back doors” that  circumvented normal system protection and allowed attackers  unauthorized future access. They had shut down and crashed entire  systems and networks. In September 1996, we issued a report, based on  detailed analyses and testing of general computer controls, that identified  pervasive vulnerabilities in DOD information systems. We had found that  authorized users could also exploit the same vulnerabilities that made  external attacks possible to commit fraud or other improper or malicious  acts. In fact, knowledgeable insiders with malicious intentions could pose  a more serious threat than outsiders, since they could be more aware of  system weaknesses and how to disguise inappropriate actions. Our  report highlighted the lack of a comprehensive information security  program and made numerous recommendations for corrective actions. In  August 1999, we reported that DOD had made limited progress in  correcting the general control weaknesses we reported in 1996. We also  found that serious weaknesses in DOD information security continued to  provide both hackers and hundreds of thousands of authorized users  opportunities to modify, steal, inappropriately disclose, and destroy  sensitive DOD data. As a result, numerous defense functions, including  weapons and supercomputer research, logistics, finance, procurement,  personnel management, military health, and payroll, have already been  adversely affected by system attacks or fraud. In 2003, we reported that  DOD faced many risks in its use of globally networked computer systems  to perform operational missions—such as identifying and tracking enemy  targets—and daily management functions, such as paying soldiers and  managing supplies. Weaknesses in these systems, if present, could give  hackers and other unauthorized users the opportunity to modify, steal,  inappropriately disclose, and destroy sensitive military data.
In addition, the Department of Defense Inspector General has completed  annual reviews under the Federal Information Security Management Act  involving a wide range of information assurance weaknesses that persist  throughout DOD systems and networks. These reports have compiled  information assurance vulnerabilities based on reports from Army Audit  Agency, Naval Audit Service, Air Force Audit Agency, and GAO since  1991. From August 1, 2008, to July 31, 2009, the most frequently cited  weaknesses were in the following information assurance areas: security  policies and procedures/management oversight; access controls;  configuration management; and plans of action and milestones to identify,  assess, prioritize, and monitor the progress of corrective efforts for  security weaknesses found in programs and systems. According to the  DOD Inspector General, persistent weaknesses in information-security  policies and practices continue to threaten the confidentiality, integrity,  and availability of critical information and information systems used to  support operations, assets, and personnel. The report also noted that  without effective management oversight, DOD cannot be assured that  systems are accurately reported and maintained, information systems  contain reliable data, and personnel are properly trained in security  policies and procedures.
section_title: Appendix V: Comments from the Department of Defense
section_title: Appendix VI: GAO Contacts and Staff Acknowledgments
paragraphs: ! No text of specified style in document.
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Lorelei St. James, Joseph  Kirschbaum, Nelsie Alcoser, Neil Feldman, David Holt, Jamilah Moon,  Grace Coleman, Joanne Landesman, and Gregory Marchand made key  contributions to this report.