Internet of Things: Enhanced Assessments and Guidance Are Needed to Address Security Risks in DOD
Released: 2017-07-27T00:00:00

Letter

Background

Definition of the IoT

While DOD does not have a standard, department-wide definition of the IoT, the department has identified a number of existing definitions of it. As noted previously, a 2016 Defense Science Board study defined the IoT as the set of Internet Protocol-addressable devices that interact with the physical environment, noting that “IoT devices typically contain elements for sensing, communications, computational processing, and actuation.” The study identified that IoT devices span a range of complexity and size, including thermostats, traffic lights, televisions, mini-drones, and full-size vehicles. A 2016 DOD Chief Information Officer policy paper on the IoT cited a definition from a non-DOD organization. According to this definition, the IoT consists of two foundational things: 1) the Internet itself, and 2) semi-autonomous devices (the “things”) that leverage inexpensive computing, networking, sensing, and actuating capabilities in uniquely identified implementations to sense the physical world and act on it. Such devices have the capability to connect to the Internet, being Internet Protocol-based, but may also be deployed in stand-alone Internet Protocol networks. These DOD IoT definitions describe devices having the characteristics of sensing, communicating (or networking), computing (or processing), and actuating, and all leveraging the Internet Protocol.

Figure 1 depicts typical data flows from a range of IoT devices— smartphones, smart watches, cars, buildings, and televisions—where data are collected, transmitted, and analyzed before leading to commands back to the devices or inputs to decision makers. Consumers and senior leaders in industry or public-sector organizations, such as DOD, can potentially act on IoT device data.

Prior GAO Reports Addressing IoT Security Challenges

In a 2016 report, we provided a primer on the IoT that highlighted key benefits of IoT devices, categories of devices, a future outlook for IoT, and security challenges posed by the devices. We reported that security vulnerabilities in many IoT devices can arise for several reasons, including (1) a lack of security standards addressing unique IoT needs; (2) a lack of better incentives for developing secure devices; and (3) the decreasing size of such devices—which limits the computational power that is currently available to implement security protections. The primer cites reports of wireless medical devices being taken over and controlled; of a widespread wireless standard for IoT devices used in smart energy being compromised; and of gas stations’ tank-monitoring systems having no passwords, thereby potentially exposing the pumps to a risk of being shut down. These security challenges could potentially impact DOD hospitals and facility energy and fuel systems where managers may consider using or deploying IoT devices.

In May 2017, we issued a technology assessment on the IoT that defined the concept of the IoT, described its uses, highlighted its benefits, and discussed its potential implications, including security challenges. We reported that adoption of the IoT across the different sectors has amplified the challenge of designing and implementing effective security controls by bringing the potential effects of poor security into homes, factories, and communities. In addition, the technology assessment noted a security risk whereby unauthorized individuals or organizations might gain access to these devices and use them for potentially malicious purposes, including fraud or sabotage. The lack of attention to security in designing IoT devices and the predominant use of cloud computing to provide connectivity with these devices pose unique security challenges. These challenges have direct implications for DOD as the department considers how to develop and deploy these devices. As cyber threats grow increasingly sophisticated, the need to manage and bolster the cybersecurity of IoT products and services is increasingly critical, according to our technology assessment. According to the assessment, while many industry-specific standards and best practices address information security, standards and best practices that are specific to IoT technologies are either still in development or not widely adopted. Any device that is connected to the Internet is at risk of being compromised if it does not have adequate access controls.

DOD Responsibilities Relating to the IoT

According to DOD officials, no one specific DOD office or entity is responsible for IoT security. Instead, various DOD organizations have roles and responsibilities related to IoT security risks. For example,

Office of the DOD Chief Information Officer is charged with developing the department’s cybersecurity policy and guidance, as well as policy regarding the continuous monitoring of DOD information technology. The DOD Chief Information Officer has issued instructions on cybersecurity, a risk management framework for DOD information technology, and the use of Internet-based capabilities to collect, store, and disseminate information.

Within the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, the Office of the Assistant Secretary of Defense for Energy, Installations, and Environment oversees the cybersecurity of industrial control systems on DOD’s facilities— systems that contain IoT devices—and establishes design criteria for these systems that include cybersecurity requirements.

Office of the Under Secretary of Defense for Intelligence establishes and oversees the implementation of policies and procedures for the conduct of DOD operations security, physical security, and information security. The office has established policy calling for all DOD missions, programs, functions, and activities to be protected by an operations security program.

Office of the Principal Cyber Advisor to the Secretary of Defense is responsible for overall supervision of cyber activities related to, among other things, defense of DOD networks, including oversight of policy and operational considerations.

Joint Staff provides guidance on mission assurance assessments— installation-level assessments that integrate information on asset criticality, area-specific hazards and threats, and vulnerabilities to be exploited—and consolidates reporting. The assessments should include benchmarks for the cybersecurity of wireless and portable electronic devices.

Military services and DOD agencies are to conduct assessments and surveys of their operations security. Additionally, military services and DOD agencies are to delegate responsibilities for mission assurance assessments and to ensure that information technology under their authority complies with the department’s risk management framework.

Defense Information Systems Agency provides security guidance for DOD-owned smartphones and wireless systems. Command Cyber Readiness Inspection teams conduct oversight and assess implementation of this guidance, according to DOD officials.

DOD Has Identified Security Risks with IoT Devices and Begun to Examine Them in Its Assessments, but Operations Security Surveys Are Not Being Conducted

DOD Has Identified Security Risks with IoT Devices and Developed Notional Threat Scenarios

DOD documents and officials identified numerous security risks with IoT devices—as highlighted in table 1—that can generally be divided into risks with the devices themselves and risks with the devices’ operational implications.

IoT devices pose numerous risks by how they are designed, manufactured, and configured. According to DOD officials, there is little incentive for manufacturers to design security functions into the software or hardware of their products, resulting in little thought or effort given to security. A DOD Chief Information Officer policy paper also states that IoT devices may be subverted during their manufacture and distribution at various points in the supply chain—thereby rendering the cyber attacker’s job easier. With respect to IoT configuration, a DOD report in 2016 notes that IoT devices are often sold with old and unpatched software that can lead to the device being exploited as soon as it is taken out of the box. Poor password management is another cybersecurity risk. According to the DOD report, a majority of IoT cloud services allow the user to choose weak passwords—such as “1234”—and, in some cases, prevent the user from using strong passwords.

Given their functionality and capabilities, IoT devices also pose security risks with their operational implications. DOD officials told us that rogue wireless devices in secure areas could provide a pathway for adversaries to collect classified or sensitive information. For example, a cell phone could be concealed and “pocket dialed” such that ambient conversations are recorded or transmitted. Similar to rogue wireless devices, rogue applications also pose risks. According to a DOD report, in 2016 a smartphone gaming application was released that makes use of the global positioning system and the camera of the device on which it is installed. The report cautions that installing the game may lead to the application gaining full access to a user’s email account. Whether on personal or DOD-issued devices, the potential of such applications to collect location and photographic data on DOD personnel or units and communicate this data to third parties has raised DOD operations security risks. DOD’s 2016 DOD Policy Recommendations for the Internet of Things (IoT) also laid out operations security implications of IoT devices, particularly with the expanded aggregation of information. Specifically, it discussed how information collected through various IoT devices and then aggregated could inform adversaries about DOD capabilities or deployments. For example, an adversary could gather information related to which people were present or which organizations were working overtime.

The department has also identified notional threat scenarios that exemplify how these security risks could adversely impact DOD operations, equipment, or personnel. DOD documents and officials from a number of organizations—including the Office of the Secretary of Defense, Joint Force Headquarters-DOD Information Networks, and the Navy—discussed with us a number of notional threat scenarios. Figure 2 highlights a few examples of these scenarios.

The first notional IoT scenario, the “sabotage of mission,” illustrates a few security risks that could adversely impact DOD operations. The increase of IoT devices used to monitor and control DOD infrastructure could increase the number of attack points through which a network or system could be attacked. Many of these devices are insecure because of a limited ability to patch and upgrade devices, or due to poor security design. As a result, the successful penetration of a smart electrical meter could lead to cascading effects that negatively impact an industrial control system and degrade an ongoing mission. In the second notional IoT scenario, “sabotage of equipment,” the combination of poor password management and an insider threat could lead to unauthorized access to a utility system, such as a water system in a dry dock. The insider threat could then manipulate the water control system to flood the dry dock and damage the ship, according to Navy officials. The third notional IoT scenario, “operations security and intelligence collection,” illustrates the adverse impacts on operations security that can emerge from smart televisions. The scenario involves a television with limited cybersecurity controls being targeted by commercial providers or adversaries to collect information for malicious purposes. The fourth notional IoT scenario, the “endangerment of leadership,” depicts how an adversary could exploit a car equipped with IoT capabilities. Here, an adversary—for example exploiting poor security in the car’s devices—could hack a senior DOD official’s car to monitor conversations, take control of car functions, or endanger the lives of senior DOD leaders in the car.

Mission Assurance and Intelligence Community Assessments Have Examined Security Risks with IoT Devices, but Operations Security Surveys Are Not Being Conducted

While DOD has conducted some assessments to examine security risks with IoT devices, threat-based comprehensive operations security surveys (hereinafter referred to as “operations security surveys”) that could examine such risks are not being conducted. DOD requires different types of assessments to protect DOD information residing on and outside the department’s networks. Some of these assessments can be used to identify and examine security risks related to IoT devices. Such assessments include mission assurance assessments, specific threat assessments from the intelligence community—such as the Defense Intelligence Agency’s April 2016 Threats via the Internet of Things—and operations security surveys.

Mission Assurance Assessments Have Been Conducted

According to DOD Directive 3020.40, Mission Assurance, DOD component heads are responsible for implementing the mission assurance process and developing assessments. Mission assurance assessments are installation-level assessments that integrate information on asset criticality, area-specific threats, and vulnerabilities. According to the concept of operations, the mission assurance assessments should examine, among other things, security risks related to infrastructure devices. The 2015 DOD Mission Assurance Assessment Benchmarks lays out specific cybersecurity operations benchmarks, or best practices, that mission assurance assessment teams can use to examine and address security risks related to IoT devices. Some of these benchmarks include: (1) implementing security policies and configurations to ensure secure wireless access into the networks, and taking measures to prevent unauthorized wireless access; (2) conducting vulnerability scans; (3) determining the extent to which remote access is allowed or necessary; and (4) checking on the current configuration information for all industrial control system components.

To date, DOD has conducted a number of mission assurance assessments. Three of the four military services—the Army, Navy, and Marine Corps—conducted these assessments and identified cybersecurity risks related to IoT devices on critical infrastructure. While the Air Force did not conduct any assessments in 2016, the service plans to conduct mission assurance assessments in 2017, according to service officials. These officials noted that their assessments will have a limited focus on devices. A 2015 assessment conducted on an Army facility detected cybersecurity vulnerabilities with its IoT devices. The assessment identified how an adversary could hack into industrial control systems’ wireless devices, leading to cascading effects and mission degradation. Additionally, the cybersecurity vulnerabilities of IoT devices in this mission assurance assessment were linked to the benchmarks. Navy and Marine Corps mission assurance assessments also contained recommendations to address IoT cybersecurity vulnerabilities, such as unauthorized communication of information to third parties, rogue wireless devices, and poor security design in the devices. Regarding the unauthorized communication of information to third parties, Marine Corps officials expressed concern over the potential capture of electronic data from a base and transmission of the data to unknown individuals or entities. Some mission assurance assessments recommended discontinuing remote access to systems where possible, implementing wireless intrusion detection systems to detect unauthorized devices, implementing a configuration management process, and conducting vulnerability scans.

Intelligence Community Assessments Have Been Conducted

Assessments from the intelligence community have also identified cybersecurity risks related to IoT devices. For example, officials from the Office of the Director of National Intelligence published an essay on challenges with IoT in which they noted that IoT devices present a rich target for attackers and pose a range of potential risks, including eavesdropping and unauthorized access.

Operations Security Surveys Have Not Been Conducted

According to DOD Directive 5205.02E, DOD Operations Security Program, DOD components must conduct operations security surveys, at a minimum, every 3 years. Also, DOD’s Operations Security Program Manual 5205.02-M requires a threat analysis that includes identifying potential adversaries and their associated capabilities to collect, analyze, and exploit critical information as an essential step in the operations security process. This could potentially include information collected by IoT devices. The Under Secretary of Defense for Intelligence is also required to report annually to the Secretary of Defense on the status of the DOD operations security program. According to DOD officials, IoT devices pose significant risks to operations security. Officials cited the geolocation capability of some IoT devices as a particular concern— specifically, how the location of troops or personnel could be revealed. Another concern is the ability to use IoT devices to clandestinely record conversations. Military service and agency officials cited smart televisions as an example of an IoT device that could secretly record conversations of DOD personnel.

DOD Has Policies and Guidance for IoT Devices, but Gaps Remain

DOD has a number of policies as well as guidance for IoT devices, including wearable devices, portable electronic devices, smartphones, and infrastructure devices. Some gaps remain, however, with respect to how DOD addresses security risks associated with IoT in its policies and guidance.

DOD Has Policies and Guidance for IoT Devices

DOD has issued a number of policies and guidance for IoT devices, including personal wearable fitness devices, portable electronic devices, smartphones, and infrastructure devices associated with industrial control systems. Generally, these policies and guidance apply across the department’s components. Additionally, many of DOD’s policies and guidance address IoT devices based on areas where classified information is processed, and where it is not. Some military services and agencies have issued additional policy and guidance, such as on personal wearable fitness devices and portable electronic devices.

Figure 3 highlights examples of existing DOD policies and guidance for different types of IoT devices. The figure also lists the DOD sponsor of the policy or guidance, the owner of the device, and the type of device for which the policy or guidance applies. This list may not include all department-wide or component policies and guidance on IoT devices but is intended to show a range of policies and guidance on IoT devices.

The DOD Chief Information Officer issued a DOD-wide policy on personal wearable fitness devices (e.g., step counting, heart rate monitoring). Other DOD components—including at least two military services and the National Security Agency—have issued similar guidance on these personal devices. The DOD Chief Information Officer policy addresses the use of personally owned (or government-furnished) devices that meet certain requirements in areas where classified information is stored, processed, or transmitted—authorizing these devices in DOD facilities up to the “top secret” level. The policy prohibits devices with photographic, video recording, or microphone or audio recording capabilities, and requires that wireless or connectivity capabilities be disabled.

Portable Electronic Devices

The DOD Chief Information Officer issued a DOD instruction on portable electronic devices able to connect to DOD unclassified and classified wireless local area networks. This instruction identifies a minimum set of security measures, such as antivirus software, encryption, and personal firewalls that must be present in unclassified wireless local area network- enabled portable electronic devices. Several DOD components— including the Defense Information Systems Agency, the Defense Intelligence Agency, and the Department of the Navy—have also issued policies and guidance on these devices. For example, Defense Intelligence Agency employees and visitors must not use video, wireless, photographic, or other recording capabilities of any personally owned portable electronic devices within any agency spaces unless approved in advance for special events (e.g., promotion ceremonies conducted in common areas). Generally, personally owned portable electronic devices with photographic, video recording, audio recording, or wireless transmission capabilities are prohibited in areas where classified information is processed and in other restricted areas.

Smartphones

The Defense Information Systems Agency has issued a number of policies as well as guidance that apply to DOD-owned smartphones, including mobile Security Requirements Guides and Security Technical Implementation Guides for specific smartphones (e.g., Apple, Blackberry, and Samsung). For example, the Security Technical Implementation Guides state that department personnel should disable their phones from: 1) data transfers with the Bluetooth capability on DOD’s Blackberry phones; 2) data storage in the iCloud on DOD’s Apple phones; and 3) voice dialing on DOD’s Apple phones.

Infrastructure Devices

DOD has department-wide policy and guidance that addresses infrastructure devices (e.g., smart electric meters) within industrial control systems. The Unified Facilities Criteria: Cybersecurity of Facility-Related Control Systems lays out criteria for the inclusion of cybersecurity in the design of control systems down to the device level. For example, at the IoT device level, some of these cybersecurity controls include (a) the avoidance of wireless communications to the greatest extent possible; (b) the implementation of authentication between devices, if possible; and (c) the avoidance of mobile code—i.e., code that is downloaded and executed without explicit user action. Additionally, the Advanced Cyber Industrial Control System Tactics, Techniques, and Procedures (ACI TTP) for Department of Defense (DOD) Industrial Control Systems (ICS) offers guidance and identifies procedures that include infrastructure devices. This guidance identifies device anomalies that could indicate a cyber incident, specific detection procedures to assess the anomaly, and procedures to recover electronic devices, including removing and replacing the device.

Existing DOD Policies and Guidance Do Not Clearly Address Some IoT Risks

DOD policies highlight the importance of protecting and securing DOD information from any potential adversaries. DOD Directive 8000.01, Management of the Department of Defense Information Enterprise, states that information is considered a strategic asset to DOD and must be safeguarded, appropriately secured and shared, and made available to authorized personnel to the maximum extent allowed by law, policy, and mission requirements. Similarly, DOD Directive 5205.02E, DOD Operations Security (OPSEC) Program, directs that DOD personnel maintain essential secrecy of information that would be useful to adversaries, and that countermeasures are employed to deny adversaries any potential indicators that reveal critical information about DOD missions. Federal internal control standards also require that management evaluate security threats to information technology, which can come from both internal and external sources, and periodically review policies and procedures for continued relevance and effectiveness in addressing related risks. For example, the federal standards note that external threats are particularly important for entities dependent on telecommunications networks and the Internet, and that continual effort is required to address these risks.

Policies and Guidance Do Not Address Certain DOD-acquired IoT Devices and Applications

DOD officials told us that existing DOD policies and guidance do not clearly address security risks relating to smart televisions, and particularly smart televisions in unsecure areas. Officials from military services and other DOD components described smart televisions as a risk to operations security due, in part, to the ability of commercial providers to access the devices remotely—potentially eavesdropping on conversations or sending recordings of these conversations to third parties. Although they acknowledged the need for them, Navy and Marine Corps officials stated that they do not have service-wide policies addressing cybersecurity controls for smart televisions. Officials from Joint Force Headquarters-DOD Information Networks highlighted the potential to “hop” (i.e., gain access) from smart televisions to personal smartphones in close proximity and thereby possibly gain access to non- DOD networks—potentially leading to the collection of data on DOD personnel.

Additionally, DOD officials affirmed that existing DOD policies and guidance do not clearly address security risks of applications installed on DOD-issued mobile devices. These risks include rogue applications and the unauthorized communication of data to third parties. For example, these officials highlighted the need for policies that could lead to the automatic removal of unauthorized applications from DOD mobile devices or restrictions on the number of parties to whom data are transmitted from an application. DOD officials confirmed that one gaming application—an example of a rogue application—was downloaded on some unclassified DOD-issued phones. Similarly, a DOD report further identifies the dangers of downloading certain applications and unwittingly granting third parties access to a host of personal information on one’s own phone. According to a Defense Information Systems Agency official, other mobile applications will likely be downloaded with similar security implications unless the policy recommendations noted above are implemented.

Core Security Policies Do Not Address IoT Devices

Core DOD security policies and guidance on cybersecurity, operations security, information security, and physical security do not address IoT devices. First, DOD Instruction 8500.01, Cybersecurity, and DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT)—core DOD policies on cybersecurity—do not provide policy and guidance for IoT devices. Although these instructions may apply to IoT devices that are part of a larger system, they neither focus on these devices nor clearly address security risks specific to these devices. DOD officials acknowledged that these instructions do not focus on IoT devices. Similarly, DOD Chief Information Officer’s DOD Policy Recommendations for the Internet of Things (IoT) also recommends a number of policy tenets to inform changes to DOD’s cybersecurity policies, including encryption of IoT data, monitoring of IoT networks for anomalous traffic, and active management of supply chains for IoT devices.

Second, core DOD policies and guidance on operations security do not address IoT devices. As noted earlier, adverse impacts on operations security is a key security risk that DOD identified with IoT devices. Although these core operations security policy documents refer to Internet-based capabilities and the data collection capabilities of potential adversaries, they do not offer guidance to mitigate the risks to operations security associated with these devices. Additionally, a key DOD official with department-wide oversight over operations security agreed that DOD policy on operations security could be enhanced by providing guidance and focusing on IoT devices, including a taxonomy for such devices.

Third, core DOD policies and guidance we reviewed on information security relating to unclassified DOD information do not address IoT devices. In a 2017 report, we noted that the rapid adoption of IoT devices, the lack of attention to security in the design phase, and the predominant use of cloud computing to provide connectivity with these devices pose unique information security challenges—challenges that could be mitigated in part with DOD guidance on information security. Lastly, core DOD policies and guidance on physical security do not address IoT devices. For example, in one DOD threat scenario, a malicious actor compromises an Internet-connected car of a DOD senior leader and unlocks the doors to abduct the passengers.

Table 2 below summarizes core DOD security policies and guidance we reviewed that do not address security risks related to IoT devices.

DOD has developed guidance and detailed procedures for defending industrial control systems against cyber attacks. As noted previously, DOD’s Advanced Cyber Industrial Control System Tactics, Techniques, and Procedures (ACI TTP) for Department of Defense (DOD) Industrial Control Systems (ICS) offers guidance to DOD components and identifies procedures for infrastructure devices, including procedures to assess device anomalies and to recover devices that may have been targeted in cyber attacks. According to U.S. Cyber Command officials, the procedures were tested and validated over the course of 2 years, and U.S. Cyber Command also trained and tested the procedures with Navy personnel over a 2-week period to assess their effectiveness. Although the procedures were found to be effective, DOD does not have a policy that directs the implementation of these procedures throughout the department, according to DOD officials. For example, a DOD installations official cited the need to modify existing and future contracts with vendors of utility services to ensure that these cybersecurity procedures would be put in place. Further, Navy and Air Force officials stated that their services do not have a defined plan in place to implement the advanced cyber industrial control system tactics, techniques, and procedures. Navy officials expressed their intent to fully adopt these procedures; however, they cited a current lack of resources and the strain on system operators—who are more focused on non-security issues—as reasons for not yet having implemented the procedures.

DOD Has Taken Other Actions to Address Security Risks Related to IoT Devices

In addition to the assessments, policies, and guidance discussed above, DOD has taken other actions to address IoT-related security risks. These ongoing efforts include an inventory of systems that incorporate IoT devices, the establishment of forums to discuss DOD IoT policies, and the research of IoT security issues.

Inventory of industrial control systems effort: In March 2016, the Office of the Assistant Secretary of Defense (Energy, Installations, and Environment) directed the military departments and certain other DOD components to develop plans to implement cyber security controls on their facility industrial control systems, including devices and sensors. All of the military departments drafted and submitted implementation plans or a strategy to the Office of the Assistant Secretary of Defense (Energy, Installations, and Environment) by February 2017. After the initial inventory phase, DOD components are to make their control systems resilient to cyber threats and to implement a continuous monitoring process to respond to emerging threats. The department’s goal is to implement cybersecurity controls on the most critical control systems by the end of fiscal year 2019. These actions would be consistent with the National Defense Authorization Act for Fiscal Year 2017 and our recommendation in a prior report, which also requires DOD to take actions on the cybersecurity of its industrial control systems.

IoT Forum: According to officials in the Office of the DOD Chief Information Officer, the office has established an informal IoT working group for DOD officials working on IoT issues. The group has attended IoT workshops and developed a paper on the IoT. The group authored and published the policy paper DOD Policy Recommendations for the Internet of Things (IoT) in December 2016 to raise awareness of IoT issues. As noted previously, the report discusses the definition of the IoT, the benefits and cybersecurity risks of IoT devices, potential IoT threat scenarios, and DOD policy tenets for addressing the IoT. According to an official in the Office of the DOD Chief Information Officer, their next steps are to establish an IoT community of interest and to produce another IoT report that focuses on DOD component responsibilities and more detailed policy analysis.

Research and testing efforts: The Defense Advanced Research Projects Agency has a few ongoing research programs that relate to IoT security issues. The Leveraging the Analog Domain for Security program seeks to develop new cyber techniques in digital devices by monitoring their analog emissions (e.g., radio waves, sound waves, micro-power changes) and is projected to continue through December 2019. By studying analog signals radiating from IoT devices, they intend to better monitor IoT devices and detect deviations from normal device behavior to provide protection for DOD networks. Additionally, the Vetting Commodity Information Technology Software and Firmware program aims to develop checks for broad classes of malicious features and dangerous flaws in software and firmware. The program includes the IoT and other devices and is projected to continue through September 2017. The program seeks to address the department’s need to ensure that the devices and equipment it procures—much of it produced overseas—do not contain hidden code or malware; this could help address the supply chain risk noted previously.

Conclusions

The IoT and IoT devices represent the wave of the future for the global economy, from infrastructure to public services to consumer use. DOD will likely be involved in using these devices for the foreseeable future. However, IoT devices pose numerous security challenges that need to be addressed, both in specific instances and as part of a holistic approach to risk management in the information age. DOD has made some progress in addressing the security challenges we identify in this report, including: (1) identifying a number of IoT security risks and notional threat scenarios; (2) examining security risks of IoT devices by conducting assessments on critical infrastructure; (3) developing policies and guidance for IoT devices; and (4) establishing ongoing efforts, such as research programs, to mitigate the security risks with these devices. DOD could capitalize on this progress by further addressing challenges we found in the following areas: the lack of operations security surveys that could identify and mitigate security risks of IoT; insufficient DOD policies and guidance for specific IoT devices and applications of concern (e.g., smart televisions and smartphone applications); and the need for DOD core security policies (e.g., cybersecurity, operations security, physical security, information security) that provide clear guidance on the IoT or IoT devices. By addressing these challenges, DOD could better ensure that it is identifying security issues with IoT devices and more effectively safeguarding and maintaining the security of DOD information.

Recommendations for Executive Action

The Under Secretary of Defense for Intelligence, in coordination with the DOD Chief Information Officer, the Under Secretaries of Defense for Policy; Acquisition, Technology, and Logistics; and Personnel and Readiness; and with military service and agency stakeholders, should conduct operations security surveys that identify IoT security risks and protect DOD information and operations, in accordance with DOD guidance, or address operations security risks posed by IoT devices through other DOD risk assessments.

The Principal Cyber Advisor, in coordination with the DOD Chief Information Officer; the Under Secretaries of Defense for Policy; Intelligence; Acquisition, Technology, and Logistics; and Personnel and Readiness; and with military service and agency stakeholders, should

Review and assess existing departmental security policies and guidance—on cybersecurity, operations security, physical security, and information security—that may affect IoT devices; and Identify areas where new DOD policies and guidance may be needed—including for specific IoT devices, applications, or procedures—and where existing security policies and guidance can be updated to address IoT security concerns.

Agency Comments and Our Evaluation

We provided a draft of this report to DOD and the Office of the Director of National Intelligence. DOD provided written comments, in which it concurred with our two recommendations. DOD’s written comments are reprinted in their entirety in appendix II. DOD also provided technical comments, which we incorporated into the report where appropriate. The Office of the Director of National Intelligence did not provide technical comments.

DOD concurred with our recommendation to conduct operations security surveys that identify IoT security risks and protect DOD information and operations, in accordance with DOD guidance, or address operations security risks posed by IoT devices through other DOD risk assessments. The department stated that it will take action in accordance with its existing policies for operations security.

DOD concurred with our recommendation to review and assess existing departmental security policies and guidance—on cybersecurity, operations security, physical security, and information security—that may affect IoT devices; and to identify areas where new DOD policies and guidance may be needed—including for specific IoT devices, applications, or procedures—and where existing security policies and guidance can be updated to address IoT security concerns. The department stated that it has already begun work in this area and should complete a review of its policies and guidance affected by loT by the end of the fourth quarter, fiscal year 2017. DOD also stated that updates to address IoT will be done as part of the department’s policy update process.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Under Secretary of Defense for Intelligence, DOD’s Principal Cyber Advisor, the Under Secretaries of Defense for Policy; Acquisition, Technology, and Logistics; and Personnel and Readiness; DOD’s Chief Information Officer, and the Director of National Intelligence. In addition, the report is available at no charge on the GAO website http://www.gao.gov.

If you or your staff has any questions about this report, please contact me at (202) 512-9971 or kirschbaumj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to (1) address the extent to which Department of Defense (DOD) has identified and assessed security risks related to Internet of Things (IoT) devices; (2) assess the extent to which DOD has developed policies and guidance related to IoT devices; and (3) describe other actions DOD has taken to address security risks related to IoT devices.

The scope of this review includes a range of IoT devices, to include wearable fitness devices, portable electronic devices, smartphones, and infrastructure devices, but it excludes weapon systems—such as airplanes and tanks—and intelligence, surveillance, and reconnaissance networks, which could be described as an example of the IoT. In addition, we assessed IoT devices and their related security challenges, and we excluded from our review the back-end computing and analytic infrastructure, such as computer servers, that can store and process IoT device data.

To address the extent to which DOD has identified and assessed security risks related to IoT devices, we reviewed DOD reports on IoT, including reports from the Defense Science Board, the Office of the DOD Chief Information Officer, the Defense Intelligence Agency, and Joint Staff, that identified broad security risks with IoT devices. We also interviewed officials from a number of organizations—including the Office of the Secretary of Defense, Joint Force Headquarters-DOD Information Networks, the military services, the Defense Information Systems Agency, the National Security Agency, the Defense Intelligence Agency, and the Defense Advanced Research Projects Agency—to identify key security risks associated with IoT devices. After these interviews and reviews, we grouped identified risks into common categories. We examined DOD notional threat scenarios that depict consequences ensuing from compromised IoT devices. Officials in the Office of the Secretary of Defense, the Navy, the Defense Information Systems Agency, and Joint Force Headquarters-DOD Information Networks developed these scenarios. Through our interviews with organization officials, we identified various types of risk assessments that may address security risks related to IoT devices. We reviewed the focus areas of these assessments and identified whether they examined IoT devices. We compared these assessments against DOD criteria. We collected and analyzed a non-generalizable sample of these assessments to review. For the mission assurance assessments, we requested and received a sample of documents from the services to review. From our request, we received and reviewed a total of 11 mission assurance assessments—2 from the Army, 2 from the Navy, and 7 from the Marine Corps. With respect to intelligence assessments, we requested and received 1 assessment from the Defense Intelligence Agency and 1 from the Office of the Director of National Intelligence—documenting the challenges related to the IoT.

To assess the extent to which DOD has developed policies and guidance related to IoT devices, we interviewed officials from the Office of the Secretary of Defense, the Joint Staff, the military services, the Defense Information Systems Agency, U.S. Cyber Command, the Defense Intelligence Agency, the National Security Agency, and the Defense Logistics Agency to identify current policies and guidance applying to a range of IoT devices, including wearable fitness devices, portable electronic devices, smartphones, and infrastructure devices. We reviewed these policies and guidance—including the DOD Chief Information Officer’s DOD Policy Recommendations for the Internet of Things (IoT)— and identified their general characteristics, applicability, and focus areas. When we interviewed officials from the organizations noted above, we also asked them whether there are any gaps in policies and guidance for IoT devices, applications, or procedures. We compiled their responses to identify a few commonly cited policy and guidance gaps where security risks may not be addressed. Additionally, we reviewed core DOD security policy documents on cybersecurity, operations security, physical security, and information security (see table 2 in the report) to assess whether these documents addressed IoT devices or security risks associated with IoT devices. We used relevant search terms such as “device,” “capabilities,” and “threat” to make these assessments. Federal internal control standards require that management evaluate security threats to information technology and periodically review policies and procedures for continued effectiveness in addressing related risks, so we asked officials whether the department was addressing risks related to IoT devices.

To describe other actions DOD has taken to address security risks related to IoT devices, we interviewed officials from a number of organizations— including the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics; Office of the DOD Chief Information Officer; the National Security Agency; the Defense Advanced Research Projects Agency; the Defense Intelligence Agency; and the military services—and collected documents to identify and describe ongoing efforts and actions to address and mitigate security risks relating to IoT devices. We grouped ongoing efforts they identified into categories, such as research, inventory tasks, forums, and the development of use cases. Due to the limited number of ongoing efforts directly tied to IoT we could identify, we developed a small number of categories—which captured all of these efforts—by distinguishing among the primary focuses of these efforts. These focuses included long-term knowledge building, information collection on assets, intra-departmental collaboration, and the development of threat scenarios or environments.

To address our reporting objectives, we reviewed relevant documents and interviewed knowledgeable officials from the following DOD organizations and offices as identified in table 3.

We also interviewed officials from three non-DOD organizations, including the Office of the Director of National Intelligence, the Internet Society, and the National Institute of Standards and Technology. We interviewed the Office of the Director of National Intelligence to gain a non-DOD intelligence community perspective of cyber issues related to IoT devices. We also interviewed the Internet Society to collect insights on IoT issues from a non-governmental organization. Lastly, we interviewed the National Institute of Standards and Technology as they have issued a number of cybersecurity documents, including those that apply to IoT devices.

We conducted this performance audit from June 2016 to July 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, key contributors to this report were Tommy Baril (Assistant Director), Ivelisse Aviles, Tracy Barnes, John Beauchamp, Jennifer Beddor, Robert Breitbeil, Jennifer Cheung, Amie Lesser, and Cheryl Weissman.

Related GAO Products

GAO, Technology Assessment: Internet of Things: Status and Implications of an Increasingly Connected World, GAO-17-75 (Washington, D.C.: May 15, 2017).

GAO, Data and Analytics Innovation: Emerging Opportunities and Challenges, GAO-16-659SP (Washington, D.C.: Sep. 20, 2016).

GAO, Defense Infrastructure: Improvements in DOD Reporting and Cybersecurity Implementation Needed to Enhance Utility Resilience Planning, GAO-15-749 (Washington, D.C.: July 23, 2015)

GAO, Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack, GAO-16-350 (Washington, D.C.: Mar. 24, 2016).