Internet of Things: Enhanced Assessments and Guidance Are Needed to Address Security Risks in DOD
Released: 2017-07-27T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Congress included provisions in reports associated with two separate statutes for GAO to assess the IoT-associated security challenges faced by DOD. This report (1) addresses the extent to which DOD has identified and assessed security risks related to IoT devices, (2) assesses the extent to which DOD has developed policies and guidance related to IoT devices, and (3) describes other actions DOD has taken to address security risks related to IoT devices.

GAO reviewed reports and interviewed DOD officials to identify risks and threats of IoT devices faced by DOD. GAO also interviewed DOD officials to identify risk assessments that may address IoT devices and examined their focus areas. GAO further reviewed current policies and guidance DOD uses for IoT devices and interviewed officials to identify any gaps in policies and guidance where security risks may not be addressed.

section_title: What GAO Found
paragraphs: The Internet of Things (IoT) is the set of Internet-capable devices, such as wearable fitness devices and smartphones, that interact with the physical environment and typically contain elements for sensing, communicating, processing, and actuating. Even as the IoT creates many benefits, it is important to acknowledge its emerging security implications. The Department of Defense (DOD) has identified numerous security risks with IoT devices and conducted some assessments that examined such security risks, such as infrastructure-related and intelligence assessments. Risks with IoT devices can generally be divided into risks with the devices themselves and risks with how they are used. For example, risks with the devices include limited encryption and a limited ability to patch or upgrade devices. Risks with how they are used—operational risks—include insider threats and unauthorized communication of information to third parties. DOD has developed IoT threat scenarios involving intelligence collection and the endangerment of senior DOD leadership—scenarios that incorporate IoT security risks (see figure). Although DOD has begun to examine security risks of IoT devices through its infrastructure-related and intelligence assessments, the department has not conducted required assessments related to the security of its operations.

DOD has issued policies and guidance for IoT devices, including personal wearable fitness devices, portable electronic devices, smartphones, and infrastructure devices associated with industrial control systems. However, GAO found that these policies and guidance do not clearly address some security risks relating to IoT devices. First, current DOD policies and guidance are insufficient for certain DOD-acquired IoT devices, such as smart televisions in unsecure areas, and IOT device applications. Secondly, DOD policies and guidance on cybersecurity, operations security, information security, and physical security do not address IoT devices. Lastly, DOD does not have a policy directing its components to implement existing security procedures on industrial control systems—including IoT devices. Updates to DOD policies and guidance would likely enhance the safeguarding and securing of DOD information from IoT devices.

This is an unclassified version of a sensitive report GAO issued in June 2017.

section_title: What GAO Recommends
paragraphs: GAO recommends that DOD (1) conduct operations security surveys that could address IoT security risks or address operations security risks posed by IoT devices through other DOD risk assessments; and (2) review and assess its security policies and guidance affecting IoT devices and identify areas, if any, where new DOD policies may be needed or where guidance should be updated. DOD reviewed a draft of this report and concurs with GAO's recommendations.

section_title: Letter
paragraphs: According to a Defense Science Board study, the Internet of Things (IoT)  is the set of Internet Protocol-addressable devices that interact with the  physical environment and typically contain elements for sensing,  communicating, processing, and actuating. With such capabilities— including personal smart devices acquired and used by Department of  Defense (DOD) employees (e.g., wearable fitness devices), smart  devices that DOD acquires (e.g., smartphones), and smart devices that  DOD vendors may acquire and install on DOD installations (e.g., devices  within industrial and utility control systems)—being given Internet access  and thus becoming part of the IoT, DOD has stated that it is entering a  rapidly deepening pool of vulnerability. The IoT has the potential to affect  economies and societies throughout the world, from consumer products  to industrial processes and public services. Even as the IoT creates  many benefits, it is important to acknowledge the many security  implications that may arise. Although DOD has been using automated  sensors and controls for more than a century and has been connecting  them to computers for decades, the department is now in the midst of  enormous technological change. While there have always been risks to  DOD sensors and controls, their proprietary nature and isolation  previously limited the possibility of attack, according to a DOD document  about the IoT.

According to the Director of National Intelligence, IoT devices are  designed and fielded with minimal security requirements and testing, and  an ever-increasing complexity of networks could lead to widespread  vulnerabilities in civilian infrastructures and U.S. government          systems. For example, in October 2016, one security incident involving  IoT devices received national attention. A distributed denial of service  attack, which appears to have used hundreds of thousands of IoT  devices—such as Internet-connected cameras and baby monitors— without the users’ knowledge, targeted a company that manages Internet  infrastructure. The attack reportedly rendered several major websites  unavailable throughout the day. Although several DOD components  have security responsibilities relating to IoT, no single lead office or  organization in DOD is responsible for IoT security, according to DOD  officials.

House Report 114-537, accompanying a bill for the National Defense  Authorization Act of Fiscal Year 2017, and House Report 114-573,  accompanying a bill for the Intelligence Authorization Act of Fiscal Year  2017, included provisions that we assess the security challenges DOD  faces that are associated with the IoT. This report (1) addresses the  extent to which DOD has identified and assessed security risks related to  IoT devices, (2) assesses the extent to which DOD has developed  policies and guidance related to IoT devices, and (3) describes other  actions that DOD has taken to address security risks related to IoT  devices. The scope of this review includes a range of IoT devices, to  include wearable fitness devices, portable electronic devices,  smartphones, and infrastructure devices, but it excludes weapon  systems—such as airplanes and tanks—and intelligence, surveillance,  and reconnaissance networks, which could be described as an example  of the IoT. In addition, we assessed IoT devices and their related  security challenges, and we excluded from our review the back-end  processing and analytic infrastructure, such as cloud computing services,  that can store and process IoT device data. This is an unclassified  version of a sensitive report that we issued in June 2017. This report does  not identify specific details of DOD assessments and other actions DOD  is taking to address security risks related to IoT devices—information that  DOD deemed to be sensitive. Although the information provided in this  report is less detailed, it addresses the same objectives as our sensitive  report. Also, the overall methodology used for both reports is the same.

To address the extent to which DOD has identified and assessed security  risks related to IoT devices, we obtained documentary and testimonial  evidence from DOD reports and officials identifying risks and threats  related to IoT devices, including infrastructure devices and smartphones.  We examined DOD notional threat scenarios that depict potential  consequences of compromised IoT devices. Officials in the Office of the  Secretary of Defense, the Navy, Joint Force Headquarters-DOD  Information Networks, and the Defense Information Systems Agency  developed these scenarios. We interviewed DOD officials, including those  from the Office of the Secretary of Defense, the military services, the  Defense Information Systems Agency, the National Security Agency, and  the Defense Advanced Research Projects Agency, and we identified  various types of risk assessments that may address IoT devices. We  examined the focus areas of these assessments and determined whether  they examined IoT devices. We compared these assessments with DOD  criteria on mission assurance and operations security, including  cybersecurity operations best practices for IoT devices and the  requirement to conduct surveys every 3 years, respectively.

To assess the extent to which DOD has developed policies and guidance  related to IoT devices, we reviewed policies and guidance that DOD  currently uses for IoT devices. We interviewed officials from the Office of  the Secretary of Defense, the Joint Staff, the military services, the  Defense Information Systems Agency, U.S. Cyber Command, the  Defense Intelligence Agency, the National Security Agency, and the  Defense Logistics Agency to identify types of IoT devices that are  covered by policy and guidance, as well as any gaps in policies and  guidance where security risks may not be addressed. Federal internal  control standards require that management evaluate security threats to  information technology and periodically review policies and procedures  for continued effectiveness in addressing related risks; accordingly, we  asked officials whether the department was addressing risks related to  IoT devices. We also looked at areas where departmental policies and  guidance may not yet be adopted by DOD components.

To describe other actions that DOD has taken to address security risks  related to IoT devices, we reviewed documentary and testimonial  evidence gathered from DOD and military service officials to describe  other ongoing efforts to address and mitigate security risks related to IoT  devices.

We conducted this performance audit from June 2016 to July 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Definition of the IoT
paragraphs: While DOD does not have a standard, department-wide definition of the  IoT, the department has identified a number of existing definitions of it. As  noted previously, a 2016 Defense Science Board study defined the IoT as  the set of Internet Protocol-addressable devices that interact with the  physical environment, noting that “IoT devices typically contain elements  for sensing, communications, computational processing, and actuation.”  The study identified that IoT devices span a range of complexity and size,  including thermostats, traffic lights, televisions, mini-drones, and full-size  vehicles. A 2016 DOD Chief Information Officer policy paper on the IoT  cited a definition from a non-DOD organization. According to this  definition, the IoT consists of two foundational things: 1) the Internet itself,  and 2) semi-autonomous devices (the “things”) that leverage inexpensive  computing, networking, sensing, and actuating capabilities in uniquely  identified implementations to sense the physical world and act on it. Such  devices have the capability to connect to the Internet, being Internet  Protocol-based, but may also be deployed in stand-alone Internet  Protocol networks. These DOD IoT definitions describe devices having  the characteristics of sensing, communicating (or networking), computing  (or processing), and actuating, and all leveraging the Internet Protocol.

Figure 1 depicts typical data flows from a range of IoT devices— smartphones, smart watches, cars, buildings, and televisions—where  data are collected, transmitted, and analyzed before leading to  commands back to the devices or inputs to decision makers. Consumers  and senior leaders in industry or public-sector organizations, such as  DOD, can potentially act on IoT device data.

section_title: Prior GAO Reports Addressing IoT Security Challenges
paragraphs: In a 2016 report, we provided a primer on the IoT that highlighted key  benefits of IoT devices, categories of devices, a future outlook for IoT,  and security challenges posed by the devices. We reported that security  vulnerabilities in many IoT devices can arise for several reasons,  including (1) a lack of security standards addressing unique IoT needs;  (2) a lack of better incentives for developing secure devices; and (3) the  decreasing size of such devices—which limits the computational power  that is currently available to implement security protections. The primer  cites reports of wireless medical devices being taken over and controlled;  of a widespread wireless standard for IoT devices used in smart energy  being compromised; and of gas stations’ tank-monitoring systems having  no passwords, thereby potentially exposing the pumps to a risk of being  shut down. These security challenges could potentially impact DOD  hospitals and facility energy and fuel systems where managers may  consider using or deploying IoT devices.

In May 2017, we issued a technology assessment on the IoT that defined  the concept of the IoT, described its uses, highlighted its benefits, and  discussed its potential implications, including security challenges. We  reported that adoption of the IoT across the different sectors has  amplified the challenge of designing and implementing effective security  controls by bringing the potential effects of poor security into homes,  factories, and communities. In addition, the technology assessment noted  a security risk whereby unauthorized individuals or organizations might  gain access to these devices and use them for potentially malicious  purposes, including fraud or sabotage. The lack of attention to security in  designing IoT devices and the predominant use of cloud computing to  provide connectivity with these devices pose unique security challenges.  These challenges have direct implications for DOD as the department  considers how to develop and deploy these devices. As cyber threats  grow increasingly sophisticated, the need to manage and bolster the  cybersecurity of IoT products and services is increasingly critical,  according to our technology assessment. According to the assessment,  while many industry-specific standards and best practices address  information security, standards and best practices that are specific to IoT  technologies are either still in development or not widely adopted. Any  device that is connected to the Internet is at risk of being compromised if  it does not have adequate access controls.

section_title: DOD Responsibilities Relating to the IoT
paragraphs: According to DOD officials, no one specific DOD office or entity is  responsible for IoT security. Instead, various DOD organizations have  roles and responsibilities related to IoT security risks. For example,

Office of the DOD Chief Information Officer is charged with developing  the department’s cybersecurity policy and guidance, as well as policy  regarding the continuous monitoring of DOD information technology.  The DOD Chief Information Officer has issued instructions on  cybersecurity, a risk management framework for DOD information  technology, and the use of Internet-based capabilities to collect, store,  and disseminate information.

Within the Office of the Under Secretary of Defense for Acquisition,  Technology, and Logistics, the Office of the Assistant Secretary of  Defense for Energy, Installations, and Environment oversees the  cybersecurity of industrial control systems on DOD’s facilities— systems that contain IoT devices—and establishes design criteria for  these systems that include cybersecurity requirements.

Office of the Under Secretary of Defense for Intelligence establishes  and oversees the implementation of policies and procedures for the  conduct of DOD operations security, physical security, and  information security. The office has established policy calling for all  DOD missions, programs, functions, and activities to be protected by  an operations security program.

Office of the Principal Cyber Advisor to the Secretary of Defense is  responsible for overall supervision of cyber activities related to,  among other things, defense of DOD networks, including oversight of  policy and operational considerations.

Joint Staff provides guidance on mission assurance assessments— installation-level assessments that integrate information on asset  criticality, area-specific hazards and threats, and vulnerabilities to be  exploited—and consolidates reporting. The assessments should  include benchmarks for the cybersecurity of wireless and portable  electronic devices.

Military services and DOD agencies are to conduct assessments and  surveys of their operations security. Additionally, military services and  DOD agencies are to delegate responsibilities for mission assurance  assessments and to ensure that information technology under their  authority complies with the department’s risk management framework.

Defense Information Systems Agency provides security guidance for  DOD-owned smartphones and wireless systems. Command Cyber  Readiness Inspection teams conduct oversight and assess  implementation of this guidance, according to DOD officials.

section_title: DOD Has Identified Security Risks with IoT Devices and Begun to Examine Them in Its Assessments, but Operations Security Surveys Are Not Being Conducted
subsections: section_title: DOD Has Identified Security Risks with IoT Devices and Developed Notional Threat Scenarios
paragraphs: DOD documents and officials identified numerous security risks with IoT  devices—as highlighted in table 1—that can generally be divided into  risks with the devices themselves and risks with the devices’ operational  implications.

IoT devices pose numerous risks by how they are designed,  manufactured, and configured. According to DOD officials, there is little  incentive for manufacturers to design security functions into the software  or hardware of their products, resulting in little thought or effort given to  security. A DOD Chief Information Officer policy paper also states that  IoT devices may be subverted during their manufacture and distribution at  various points in the supply chain—thereby rendering the cyber attacker’s  job easier. With respect to IoT configuration, a DOD report in 2016  notes that IoT devices are often sold with old and unpatched software that  can lead to the device being exploited as soon as it is taken out of the  box. Poor password management is another cybersecurity risk.  According to the DOD report, a majority of IoT cloud services allow the  user to choose weak passwords—such as “1234”—and, in some cases,  prevent the user from using strong passwords.

Given their functionality and capabilities, IoT devices also pose security  risks with their operational implications. DOD officials told us that rogue  wireless devices in secure areas could provide a pathway for adversaries  to collect classified or sensitive information. For example, a cell phone  could be concealed and “pocket dialed” such that ambient conversations  are recorded or transmitted. Similar to rogue wireless devices, rogue  applications also pose risks. According to a DOD report, in 2016 a  smartphone gaming application was released that makes use of the  global positioning system and the camera of the device on which it is  installed. The report cautions that installing the game may lead to the  application gaining full access to a user’s email account. Whether on  personal or DOD-issued devices, the potential of such applications to  collect location and photographic data on DOD personnel or units and  communicate this data to third parties has raised DOD operations security  risks. DOD’s 2016 DOD Policy Recommendations for the Internet of  Things (IoT) also laid out operations security implications of IoT devices,  particularly with the expanded aggregation of information. Specifically, it  discussed how information collected through various IoT devices and  then aggregated could inform adversaries about DOD capabilities or  deployments. For example, an adversary could gather information related  to which people were present or which organizations were working  overtime.

The department has also identified notional threat scenarios that  exemplify how these security risks could adversely impact DOD  operations, equipment, or personnel. DOD documents and officials from a  number of organizations—including the Office of the Secretary of  Defense, Joint Force Headquarters-DOD Information Networks, and the  Navy—discussed with us a number of notional threat scenarios. Figure 2  highlights a few examples of these scenarios.

The first notional IoT scenario, the “sabotage of mission,” illustrates a few  security risks that could adversely impact DOD operations. The increase  of IoT devices used to monitor and control DOD infrastructure could  increase the number of attack points through which a network or system  could be attacked. Many of these devices are insecure because of a  limited ability to patch and upgrade devices, or due to poor security  design. As a result, the successful penetration of a smart electrical meter  could lead to cascading effects that negatively impact an industrial control  system and degrade an ongoing mission. In the second notional IoT  scenario, “sabotage of equipment,” the combination of poor password  management and an insider threat could lead to unauthorized access to a  utility system, such as a water system in a dry dock. The insider threat  could then manipulate the water control system to flood the dry dock and  damage the ship, according to Navy officials. The third notional IoT  scenario, “operations security and intelligence collection,” illustrates the  adverse impacts on operations security that can emerge from smart  televisions. The scenario involves a television with limited cybersecurity  controls being targeted by commercial providers or adversaries to collect  information for malicious purposes. The fourth notional IoT scenario, the  “endangerment of leadership,” depicts how an adversary could exploit a  car equipped with IoT capabilities. Here, an adversary—for example  exploiting poor security in the car’s devices—could hack a senior DOD  official’s car to monitor conversations, take control of car functions, or  endanger the lives of senior DOD leaders in the car.

section_title: Mission Assurance and Intelligence Community Assessments Have Examined Security Risks with IoT Devices, but Operations Security Surveys Are Not Being Conducted
paragraphs: While DOD has conducted some assessments to examine security risks  with IoT devices, threat-based comprehensive operations security  surveys (hereinafter referred to as “operations security surveys”) that  could examine such risks are not being conducted. DOD requires  different types of assessments to protect DOD information residing on  and outside the department’s networks. Some of these assessments can  be used to identify and examine security risks related to IoT devices.  Such assessments include mission assurance assessments, specific  threat assessments from the intelligence community—such as the  Defense Intelligence Agency’s April 2016 Threats via the Internet of  Things—and operations security surveys.
subsections: section_title: Mission Assurance Assessments Have Been Conducted
paragraphs: According to DOD Directive 3020.40, Mission Assurance, DOD  component heads are responsible for implementing the mission  assurance process and developing assessments. Mission assurance  assessments are installation-level assessments that integrate information  on asset criticality, area-specific threats, and vulnerabilities. According  to the concept of operations, the mission assurance assessments should  examine, among other things, security risks related to infrastructure  devices. The 2015 DOD Mission Assurance Assessment Benchmarks  lays out specific cybersecurity operations benchmarks, or best practices,  that mission assurance assessment teams can use to examine and  address security risks related to IoT devices. Some of these  benchmarks include: (1) implementing security policies and configurations  to ensure secure wireless access into the networks, and taking measures  to prevent unauthorized wireless access; (2) conducting vulnerability  scans; (3) determining the extent to which remote access is allowed or  necessary; and (4) checking on the current configuration information for  all industrial control system components.

To date, DOD has conducted a number of mission assurance  assessments. Three of the four military services—the Army, Navy, and  Marine Corps—conducted these assessments and identified  cybersecurity risks related to IoT devices on critical infrastructure. While  the Air Force did not conduct any assessments in 2016, the service plans  to conduct mission assurance assessments in 2017, according to service  officials. These officials noted that their assessments will have a limited  focus on devices. A 2015 assessment conducted on an Army facility  detected cybersecurity vulnerabilities with its IoT devices. The  assessment identified how an adversary could hack into industrial control  systems’ wireless devices, leading to cascading effects and mission  degradation. Additionally, the cybersecurity vulnerabilities of IoT devices  in this mission assurance assessment were linked to the benchmarks.  Navy and Marine Corps mission assurance assessments also contained  recommendations to address IoT cybersecurity vulnerabilities, such as  unauthorized communication of information to third parties, rogue  wireless devices, and poor security design in the devices. Regarding the  unauthorized communication of information to third parties, Marine Corps  officials expressed concern over the potential capture of electronic data  from a base and transmission of the data to unknown individuals or  entities. Some mission assurance assessments recommended  discontinuing remote access to systems where possible, implementing  wireless intrusion detection systems to detect unauthorized devices,  implementing a configuration management process, and conducting  vulnerability scans.

section_title: Intelligence Community Assessments Have Been Conducted
paragraphs: Assessments from the intelligence community have also identified  cybersecurity risks related to IoT devices. For example, officials from the  Office of the Director of National Intelligence published an essay on  challenges with IoT in which they noted that IoT devices present a rich  target for attackers and pose a range of potential risks, including  eavesdropping and unauthorized access.

section_title: Operations Security Surveys Have Not Been Conducted
paragraphs: According to DOD Directive 5205.02E, DOD Operations Security  Program, DOD components must conduct operations security surveys, at  a minimum, every 3 years. Also, DOD’s Operations Security Program  Manual 5205.02-M requires a threat analysis that includes identifying  potential adversaries and their associated capabilities to collect, analyze,  and exploit critical information as an essential step in the operations  security process. This could potentially include information collected by  IoT devices. The Under Secretary of Defense for Intelligence is also  required to report annually to the Secretary of Defense on the status of  the DOD operations security program. According to DOD officials, IoT  devices pose significant risks to operations security. Officials cited the  geolocation capability of some IoT devices as a particular concern— specifically, how the location of troops or personnel could be revealed.  Another concern is the ability to use IoT devices to clandestinely record  conversations. Military service and agency officials cited smart televisions  as an example of an IoT device that could secretly record conversations  of DOD personnel.

section_title: DOD Has Policies and Guidance for IoT Devices, but Gaps Remain
paragraphs: DOD has a number of policies as well as guidance for IoT devices,  including wearable devices, portable electronic devices, smartphones,  and infrastructure devices. Some gaps remain, however, with respect to  how DOD addresses security risks associated with IoT in its policies and  guidance.
subsections: section_title: DOD Has Policies and Guidance for IoT Devices
paragraphs: DOD has issued a number of policies and guidance for IoT devices,  including personal wearable fitness devices, portable electronic devices,  smartphones, and infrastructure devices associated with industrial control  systems. Generally, these policies and guidance apply across the  department’s components. Additionally, many of DOD’s policies and  guidance address IoT devices based on areas where classified  information is processed, and where it is not. Some military services and  agencies have issued additional policy and guidance, such as on  personal wearable fitness devices and portable electronic devices.

Figure 3 highlights examples of existing DOD policies and guidance for  different types of IoT devices. The figure also lists the DOD sponsor of  the policy or guidance, the owner of the device, and the type of device for  which the policy or guidance applies. This list may not include all  department-wide or component policies and guidance on IoT devices but  is intended to show a range of policies and guidance on IoT devices.

The DOD Chief Information Officer issued a DOD-wide policy on personal  wearable fitness devices (e.g., step counting, heart rate monitoring).  Other DOD components—including at least two military services and the  National Security Agency—have issued similar guidance on these  personal devices. The DOD Chief Information Officer policy addresses  the use of personally owned (or government-furnished) devices that meet  certain requirements in areas where classified information is stored,  processed, or transmitted—authorizing these devices in DOD facilities up  to the “top secret” level. The policy prohibits devices with photographic,  video recording, or microphone or audio recording capabilities, and  requires that wireless or connectivity capabilities be disabled.
subsections: section_title: Portable Electronic Devices
paragraphs: The DOD Chief Information Officer issued a DOD instruction on portable  electronic devices able to connect to DOD unclassified and classified  wireless local area networks. This instruction identifies a minimum set of  security measures, such as antivirus software, encryption, and personal  firewalls that must be present in unclassified wireless local area network- enabled portable electronic devices. Several DOD components— including the Defense Information Systems Agency, the Defense  Intelligence Agency, and the Department of the Navy—have also issued  policies and guidance on these devices. For example, Defense  Intelligence Agency employees and visitors must not use video, wireless,  photographic, or other recording capabilities of any personally owned  portable electronic devices within any agency spaces unless approved in  advance for special events (e.g., promotion ceremonies conducted in  common areas). Generally, personally owned portable electronic  devices with photographic, video recording, audio recording, or wireless  transmission capabilities are prohibited in areas where classified  information is processed and in other restricted areas.

section_title: Smartphones
paragraphs: The Defense Information Systems Agency has issued a number of  policies as well as guidance that apply to DOD-owned smartphones,  including mobile Security Requirements Guides and Security Technical  Implementation Guides for specific smartphones (e.g., Apple, Blackberry,  and Samsung). For example, the Security Technical Implementation  Guides state that department personnel should disable their phones from:  1) data transfers with the Bluetooth capability on DOD’s Blackberry  phones; 2) data storage in the iCloud on DOD’s Apple phones; and 3)  voice dialing on DOD’s Apple phones.

section_title: Infrastructure Devices
paragraphs: DOD has department-wide policy and guidance that addresses  infrastructure devices (e.g., smart electric meters) within industrial control  systems. The Unified Facilities Criteria: Cybersecurity of Facility-Related  Control Systems lays out criteria for the inclusion of cybersecurity in the  design of control systems down to the device level. For example, at the  IoT device level, some of these cybersecurity controls include (a) the  avoidance of wireless communications to the greatest extent possible; (b)  the implementation of authentication between devices, if possible; and (c)  the avoidance of mobile code—i.e., code that is downloaded and  executed without explicit user action. Additionally, the Advanced Cyber  Industrial Control System Tactics, Techniques, and Procedures (ACI  TTP) for Department of Defense (DOD) Industrial Control Systems (ICS)  offers guidance and identifies procedures that include infrastructure  devices. This guidance identifies device anomalies that could indicate a  cyber incident, specific detection procedures to assess the anomaly, and  procedures to recover electronic devices, including removing and  replacing the device.

section_title: Existing DOD Policies and Guidance Do Not Clearly Address Some IoT Risks
paragraphs: DOD policies highlight the importance of protecting and securing DOD  information from any potential adversaries. DOD Directive 8000.01,  Management of the Department of Defense Information Enterprise, states  that information is considered a strategic asset to DOD and must be  safeguarded, appropriately secured and shared, and made available to  authorized personnel to the maximum extent allowed by law, policy, and  mission requirements. Similarly, DOD Directive 5205.02E, DOD  Operations Security (OPSEC) Program, directs that DOD personnel  maintain essential secrecy of information that would be useful to  adversaries, and that countermeasures are employed to deny adversaries  any potential indicators that reveal critical information about DOD  missions. Federal internal control standards also require that  management evaluate security threats to information technology, which  can come from both internal and external sources, and periodically review  policies and procedures for continued relevance and effectiveness in  addressing related risks. For example, the federal standards note that  external threats are particularly important for entities dependent on  telecommunications networks and the Internet, and that continual effort is  required to address these risks.
subsections: section_title: Policies and Guidance Do Not Address Certain DOD-acquired IoT Devices and Applications
paragraphs: DOD officials told us that existing DOD policies and guidance do not  clearly address security risks relating to smart televisions, and particularly  smart televisions in unsecure areas. Officials from military services and  other DOD components described smart televisions as a risk to  operations security due, in part, to the ability of commercial providers to  access the devices remotely—potentially eavesdropping on  conversations or sending recordings of these conversations to third  parties. Although they acknowledged the need for them, Navy and  Marine Corps officials stated that they do not have service-wide policies  addressing cybersecurity controls for smart televisions. Officials from  Joint Force Headquarters-DOD Information Networks highlighted the  potential to “hop” (i.e., gain access) from smart televisions to personal  smartphones in close proximity and thereby possibly gain access to non- DOD networks—potentially leading to the collection of data on DOD  personnel.

Additionally, DOD officials affirmed that existing DOD policies and  guidance do not clearly address security risks of applications installed on  DOD-issued mobile devices. These risks include rogue applications and  the unauthorized communication of data to third parties. For example,  these officials highlighted the need for policies that could lead to the  automatic removal of unauthorized applications from DOD mobile devices  or restrictions on the number of parties to whom data are transmitted from  an application. DOD officials confirmed that one gaming application—an  example of a rogue application—was downloaded on some unclassified  DOD-issued phones. Similarly, a DOD report further identifies the  dangers of downloading certain applications and unwittingly granting third  parties access to a host of personal information on one’s own phone.  According to a Defense Information Systems Agency official, other mobile  applications will likely be downloaded with similar security implications  unless the policy recommendations noted above are implemented.

section_title: Core Security Policies Do Not Address IoT Devices
paragraphs: Core DOD security policies and guidance on cybersecurity, operations  security, information security, and physical security do not address IoT  devices. First, DOD Instruction 8500.01, Cybersecurity, and DOD  Instruction 8510.01, Risk Management Framework (RMF) for DOD  Information Technology (IT)—core DOD policies on cybersecurity—do not  provide policy and guidance for IoT devices. Although these instructions  may apply to IoT devices that are part of a larger system, they neither  focus on these devices nor clearly address security risks specific to these  devices. DOD officials acknowledged that these instructions do not focus  on IoT devices. Similarly, DOD Chief Information Officer’s DOD Policy  Recommendations for the Internet of Things (IoT) also recommends a  number of policy tenets to inform changes to DOD’s cybersecurity  policies, including encryption of IoT data, monitoring of IoT networks for  anomalous traffic, and active management of supply chains for IoT  devices.

Second, core DOD policies and guidance on operations security do not  address IoT devices. As noted earlier, adverse impacts on operations  security is a key security risk that DOD identified with IoT devices.  Although these core operations security policy documents refer to  Internet-based capabilities and the data collection capabilities of potential  adversaries, they do not offer guidance to mitigate the risks to operations  security associated with these devices. Additionally, a key DOD official  with department-wide oversight over operations security agreed that DOD  policy on operations security could be enhanced by providing guidance  and focusing on IoT devices, including a taxonomy for such devices.

Third, core DOD policies and guidance we reviewed on information  security relating to unclassified DOD information do not address IoT  devices. In a 2017 report, we noted that the rapid adoption of IoT  devices, the lack of attention to security in the design phase, and the  predominant use of cloud computing to provide connectivity with these  devices pose unique information security challenges—challenges that  could be mitigated in part with DOD guidance on information security.  Lastly, core DOD policies and guidance on physical security do not  address IoT devices. For example, in one DOD threat scenario, a  malicious actor compromises an Internet-connected car of a DOD senior  leader and unlocks the doors to abduct the passengers.

Table 2 below summarizes core DOD security policies and guidance we  reviewed that do not address security risks related to IoT devices.

DOD has developed guidance and detailed procedures for defending  industrial control systems against cyber attacks. As noted previously,  DOD’s Advanced Cyber Industrial Control System Tactics, Techniques,  and Procedures (ACI TTP) for Department of Defense (DOD) Industrial  Control Systems (ICS) offers guidance to DOD components and identifies  procedures for infrastructure devices, including procedures to assess  device anomalies and to recover devices that may have been targeted in  cyber attacks. According to U.S. Cyber Command officials, the  procedures were tested and validated over the course of 2 years, and  U.S. Cyber Command also trained and tested the procedures with Navy  personnel over a 2-week period to assess their effectiveness. Although  the procedures were found to be effective, DOD does not have a policy  that directs the implementation of these procedures throughout the  department, according to DOD officials. For example, a DOD installations  official cited the need to modify existing and future contracts with vendors  of utility services to ensure that these cybersecurity procedures would be  put in place. Further, Navy and Air Force officials stated that their  services do not have a defined plan in place to implement the advanced  cyber industrial control system tactics, techniques, and procedures. Navy  officials expressed their intent to fully adopt these procedures; however,  they cited a current lack of resources and the strain on system  operators—who are more focused on non-security issues—as reasons for  not yet having implemented the procedures.

section_title: DOD Has Taken Other Actions to Address Security Risks Related to IoT Devices
paragraphs: In addition to the assessments, policies, and guidance discussed above,  DOD has taken other actions to address IoT-related security risks. These  ongoing efforts include an inventory of systems that incorporate IoT  devices, the establishment of forums to discuss DOD IoT policies, and the  research of IoT security issues.

Inventory of industrial control systems effort: In March 2016, the  Office of the Assistant Secretary of Defense (Energy, Installations,  and Environment) directed the military departments and certain other  DOD components to develop plans to implement cyber security  controls on their facility industrial control systems, including devices  and sensors. All of the military departments drafted and submitted  implementation plans or a strategy to the Office of the Assistant  Secretary of Defense (Energy, Installations, and Environment) by  February 2017. After the initial inventory phase, DOD components are  to make their control systems resilient to cyber threats and to  implement a continuous monitoring process to respond to emerging  threats. The department’s goal is to implement cybersecurity controls  on the most critical control systems by the end of fiscal year 2019.  These actions would be consistent with the National Defense  Authorization Act for Fiscal Year 2017 and our recommendation in a  prior report, which also requires DOD to take actions on the  cybersecurity of its industrial control systems.

IoT Forum: According to officials in the Office of the DOD Chief  Information Officer, the office has established an informal IoT working  group for DOD officials working on IoT issues. The group has  attended IoT workshops and developed a paper on the IoT. The group  authored and published the policy paper DOD Policy  Recommendations for the Internet of Things (IoT) in December 2016  to raise awareness of IoT issues. As noted previously, the report  discusses the definition of the IoT, the benefits and cybersecurity risks  of IoT devices, potential IoT threat scenarios, and DOD policy tenets  for addressing the IoT. According to an official in the Office of the  DOD Chief Information Officer, their next steps are to establish an IoT  community of interest and to produce another IoT report that focuses  on DOD component responsibilities and more detailed policy analysis.

Research and testing efforts: The Defense Advanced Research  Projects Agency has a few ongoing research programs that relate to  IoT security issues. The Leveraging the Analog Domain for Security  program seeks to develop new cyber techniques in digital devices by  monitoring their analog emissions (e.g., radio waves, sound waves,  micro-power changes) and is projected to continue through December  2019. By studying analog signals radiating from IoT devices, they  intend to better monitor IoT devices and detect deviations from normal  device behavior to provide protection for DOD networks. Additionally,  the Vetting Commodity Information Technology Software and  Firmware program aims to develop checks for broad classes of  malicious features and dangerous flaws in software and firmware. The  program includes the IoT and other devices and is projected to  continue through September 2017. The program seeks to address the  department’s need to ensure that the devices and equipment it  procures—much of it produced overseas—do not contain hidden code  or malware; this could help address the supply chain risk noted  previously.

section_title: Conclusions
paragraphs: The IoT and IoT devices represent the wave of the future for the global  economy, from infrastructure to public services to consumer use. DOD  will likely be involved in using these devices for the foreseeable future.  However, IoT devices pose numerous security challenges that need to be  addressed, both in specific instances and as part of a holistic approach to  risk management in the information age. DOD has made some progress  in addressing the security challenges we identify in this report, including:  (1) identifying a number of IoT security risks and notional threat  scenarios; (2) examining security risks of IoT devices by conducting  assessments on critical infrastructure; (3) developing policies and  guidance for IoT devices; and (4) establishing ongoing efforts, such as  research programs, to mitigate the security risks with these devices. DOD  could capitalize on this progress by further addressing challenges we  found in the following areas: the lack of operations security surveys that  could identify and mitigate security risks of IoT; insufficient DOD policies  and guidance for specific IoT devices and applications of concern (e.g.,  smart televisions and smartphone applications); and the need for DOD  core security policies (e.g., cybersecurity, operations security, physical  security, information security) that provide clear guidance on the IoT or  IoT devices. By addressing these challenges, DOD could better ensure  that it is identifying security issues with IoT devices and more effectively  safeguarding and maintaining the security of DOD information.

section_title: Recommendations for Executive Action
paragraphs: The Under Secretary of Defense for Intelligence, in coordination with the  DOD Chief Information Officer, the Under Secretaries of Defense for  Policy; Acquisition, Technology, and Logistics; and Personnel and  Readiness; and with military service and agency stakeholders, should  conduct operations security surveys that identify IoT security risks and  protect DOD information and operations, in accordance with DOD  guidance, or address operations security risks posed by IoT devices  through other DOD risk assessments.

The Principal Cyber Advisor, in coordination with the DOD Chief  Information Officer; the Under Secretaries of Defense for Policy;  Intelligence; Acquisition, Technology, and Logistics; and Personnel and  Readiness; and with military service and agency stakeholders, should

Review and assess existing departmental security policies and  guidance—on cybersecurity, operations security, physical security,  and information security—that may affect IoT devices; and  Identify areas where new DOD policies and guidance may be  needed—including for specific IoT devices, applications, or  procedures—and where existing security policies and guidance can  be updated to address IoT security concerns.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOD and the Office of the Director of  National Intelligence. DOD provided written comments, in which it  concurred with our two recommendations. DOD’s written comments are  reprinted in their entirety in appendix II. DOD also provided technical  comments, which we incorporated into the report where appropriate. The  Office of the Director of National Intelligence did not provide technical  comments.

DOD concurred with our recommendation to conduct operations security  surveys that identify IoT security risks and protect DOD information and  operations, in accordance with DOD guidance, or address operations  security risks posed by IoT devices through other DOD risk assessments.  The department stated that it will take action in accordance with its  existing policies for operations security.

DOD concurred with our recommendation to review and assess existing  departmental security policies and guidance—on cybersecurity,  operations security, physical security, and information security—that may  affect IoT devices; and to identify areas where new DOD policies and  guidance may be needed—including for specific IoT devices,  applications, or procedures—and where existing security policies and  guidance can be updated to address IoT security concerns. The  department stated that it has already begun work in this area and should  complete a review of its policies and guidance affected by loT by the end  of the fourth quarter, fiscal year 2017. DOD also stated that updates to  address IoT will be done as part of the department’s policy update  process.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, the Under Secretary of Defense  for Intelligence, DOD’s Principal Cyber Advisor, the Under Secretaries of  Defense for Policy; Acquisition, Technology, and Logistics; and Personnel  and Readiness; DOD’s Chief Information Officer, and the Director of  National Intelligence.  In addition, the report is available at no charge on  the GAO website http://www.gao.gov.

If you or your staff has any questions about this report, please contact me  at (202) 512-9971 or kirschbaumj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report were to (1) address the extent to which  Department of Defense (DOD) has identified and assessed security risks  related to Internet of Things (IoT) devices; (2) assess the extent to which  DOD has developed policies and guidance related to IoT devices; and (3)  describe other actions DOD has taken to address security risks related to  IoT devices.

The scope of this review includes a range of IoT devices, to include  wearable fitness devices, portable electronic devices, smartphones, and  infrastructure devices, but it excludes weapon systems—such as  airplanes and tanks—and intelligence, surveillance, and reconnaissance  networks, which could be described as an example of the IoT. In addition,  we assessed IoT devices and their related security challenges, and we  excluded from our review the back-end computing and analytic  infrastructure, such as computer servers, that can store and process IoT  device data.

To address the extent to which DOD has identified and assessed security  risks related to IoT devices, we reviewed DOD reports on IoT, including  reports from the Defense Science Board, the Office of the DOD Chief  Information Officer, the Defense Intelligence Agency, and Joint Staff, that  identified broad security risks with IoT devices. We also interviewed  officials from a number of organizations—including the Office of the  Secretary of Defense, Joint Force Headquarters-DOD Information  Networks, the military services, the Defense Information Systems  Agency, the National Security Agency, the Defense Intelligence Agency,  and the Defense Advanced Research Projects Agency—to identify key  security risks associated with IoT devices. After these interviews and  reviews, we grouped identified risks into common categories. We  examined DOD notional threat scenarios that depict consequences  ensuing from compromised IoT devices. Officials in the Office of the  Secretary of Defense, the Navy, the Defense Information Systems  Agency, and Joint Force Headquarters-DOD Information Networks  developed these scenarios. Through our interviews with organization  officials, we identified various types of risk assessments that may address  security risks related to IoT devices. We reviewed the focus areas of  these assessments and identified whether they examined IoT  devices. We compared these assessments against DOD criteria. We  collected and analyzed a non-generalizable sample of these assessments  to review. For the mission assurance assessments, we requested and  received a sample of documents from the services to review. From our  request, we received and reviewed a total of 11 mission assurance  assessments—2 from the Army, 2 from the Navy, and 7 from the Marine  Corps. With respect to intelligence assessments, we requested and  received 1 assessment from the Defense Intelligence Agency and 1 from  the Office of the Director of National Intelligence—documenting the  challenges related to the IoT.

To assess the extent to which DOD has developed policies and guidance  related to IoT devices, we interviewed officials from the Office of the  Secretary of Defense, the Joint Staff, the military services, the Defense  Information Systems Agency, U.S. Cyber Command, the Defense  Intelligence Agency, the National Security Agency, and the Defense  Logistics Agency to identify current policies and guidance applying to a  range of IoT devices, including wearable fitness devices, portable  electronic devices, smartphones, and infrastructure devices. We reviewed  these policies and guidance—including the DOD Chief Information  Officer’s DOD Policy Recommendations for the Internet of Things (IoT)— and identified their general characteristics, applicability, and focus areas.  When we interviewed officials from the organizations noted above, we  also asked them whether there are any gaps in policies and guidance for  IoT devices, applications, or procedures. We compiled their responses to  identify a few commonly cited policy and guidance gaps where security  risks may not be addressed. Additionally, we reviewed core DOD security  policy documents on cybersecurity, operations security, physical security,  and information security (see table 2 in the report) to assess whether  these documents addressed IoT devices or security risks associated with  IoT devices. We used relevant search terms such as “device,”  “capabilities,” and “threat” to make these assessments. Federal internal  control standards require that management evaluate security threats to  information technology and periodically review policies and procedures  for continued effectiveness in addressing related risks, so we asked  officials whether the department was addressing risks related to IoT  devices.

To describe other actions DOD has taken to address security risks related  to IoT devices, we interviewed officials from a number of organizations— including the Office of the Under Secretary of Defense for Acquisition,  Technology, and Logistics; Office of the DOD Chief Information Officer;  the National Security Agency; the Defense Advanced Research Projects  Agency; the Defense Intelligence Agency; and the military services—and  collected documents to identify and describe ongoing efforts and actions  to address and mitigate security risks relating to IoT devices. We grouped  ongoing efforts they identified into categories, such as research, inventory  tasks, forums, and the development of use cases. Due to the limited  number of ongoing efforts directly tied to IoT we could identify, we  developed a small number of categories—which captured all of these  efforts—by distinguishing among the primary focuses of these efforts.  These focuses included long-term knowledge building, information  collection on assets, intra-departmental collaboration, and the  development of threat scenarios or environments.

To address our reporting objectives, we reviewed relevant documents  and interviewed knowledgeable officials from the following DOD  organizations and offices as identified in table 3.

We also interviewed officials from three non-DOD organizations, including  the Office of the Director of National Intelligence, the Internet Society, and  the National Institute of Standards and Technology. We interviewed the  Office of the Director of National Intelligence to gain a non-DOD  intelligence community perspective of cyber issues related to IoT devices.  We also interviewed the Internet Society to collect insights on IoT issues  from a non-governmental organization. Lastly, we interviewed the  National Institute of Standards and Technology as they have issued a  number of cybersecurity documents, including those that apply to IoT  devices.

We conducted this performance audit from June 2016 to July 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: Comments from the Department of Defense

section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, key contributors to this report  were Tommy Baril (Assistant Director), Ivelisse Aviles, Tracy Barnes,  John Beauchamp, Jennifer Beddor, Robert Breitbeil, Jennifer Cheung,  Amie Lesser, and Cheryl Weissman.

section_title: Related GAO Products
paragraphs: GAO, Technology Assessment: Internet of Things: Status and  Implications of an Increasingly Connected World, GAO-17-75  (Washington, D.C.: May 15, 2017).

GAO, Data and Analytics Innovation: Emerging Opportunities and  Challenges, GAO-16-659SP (Washington, D.C.: Sep. 20, 2016).

GAO, Defense Infrastructure: Improvements in DOD Reporting and  Cybersecurity Implementation Needed to Enhance Utility Resilience  Planning, GAO-15-749 (Washington, D.C.: July 23, 2015)

GAO, Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way,  but DOT Needs to Define Its Role in Responding to a Real-world Attack,  GAO-16-350 (Washington, D.C.: Mar. 24, 2016).


Question-summary annotations: questions: question: What is the IoT?
answer: The Internet of Things (IoT) is the set of Internet-capable devices, such as wearable fitness devices and smartphones, that interact with the physical environment and typically contain elements for sensing, communicating, processing, and actuating.

question: What are security risks of IoT devices?
answer: Even as the IoT creates many benefits, it is important to acknowledge its emerging security implications. The Department of Defense (DOD) has identified numerous security risks with IoT devices and conducted some assessments that examined such security risks, such as infrastructure-related and intelligence assessments.
child_questions: question: How can these risks be catagorized?
answer: Risks with IoT devices can generally be divided into risks with the devices themselves and risks with how they are used. For example, risks with the devices include limited encryption and a limited ability to patch or upgrade devices. Risks with how they are used—operational risks—include insider threats and unauthorized communication of information to third parties.

question: How has the DOD planned for IoT security threats?
answer: DOD has developed IoT threat scenarios involving intelligence collection and the endangerment of senior DOD leadership—scenarios that incorporate IoT security risks (see figure).
child_questions: question: To what extent has the DOD adequately assessed the risks of IoT devices?
answer: Although DOD has begun to examine security risks of IoT devices through its infrastructure-related and intelligence assessments, the department has not conducted required assessments related to the security of its operations.

questions: question: How has the DOD regulated its IoT devices?
answer: DOD has issued policies and guidance for IoT devices, including personal wearable fitness devices, portable electronic devices, smartphones, and infrastructure devices associated with industrial control systems.
child_questions: question: To what extent do these policies address security risks?
answer: However, GAO found that these policies and guidance do not clearly address some security risks relating to IoT devices.

question: To what extent do these policies address all DOD IoT devices?
answer: First, current DOD policies and guidance are insufficient for certain DOD-acquired IoT devices, such as smart televisions in unsecure areas, and IOT device applications.

question: To what extent have general security policies been applied to IoT devices?
answer: Secondly, DOD policies and guidance on cybersecurity, operations security, information security, and physical security do not address IoT devices. Lastly, DOD does not have a policy directing its components to implement existing security procedures on industrial control systems—including IoT devices.
child_questions: question: How can DOD IoT device security be improved?
answer: Updates to DOD policies and guidance would likely enhance the safeguarding and securing of DOD information from IoT devices.

questions: question: How did GAO source their data for this report?
answer: GAO reviewed reports and interviewed DOD officials to identify risks and threats of IoT devices faced by DOD.
child_questions: question: How did GAO identify risk assessments that might address IoT devices?
answer: GAO also interviewed DOD officials to identify risk assessments that may address IoT devices and examined their focus areas.

question: How did GAO make use of DOD policies and guidance?
answer: GAO further reviewed current policies and guidance DOD uses for IoT devices and interviewed officials to identify any gaps in policies and guidance where security risks may not be addressed.