Cybersecurity issues can vary widely across different types of systems, so weapon systems cybersecurity challenges may be very different than those of some IT systems. Despite variation across systems, cybersecurity can be described using common terminology, such as the key terms below used by the National Research Council. Key Concept Security Controls are safeguards or countermeasures to protect the confidentiality, integrity, and availability of a system and its information. For example, a firewall is a common control to allow or block traffic based on a set of rules. Because it is impossible to define a rule for every scenario, attackers look for ways to access a system that are not covered by the rules. For example, a firewall may block traffic from a specific country, but attackers may make it appear that they are in a country that is not blocked. They may use tools to avoid the firewall, such as embedding malicious software in an e-mail and waiting for a user to open it and inadvertently install the code. A cyber vulnerability is a weakness in a system that could be exploited to gain access or otherwise affect the system’s confidentiality, integrity, and availability. A cybersecurity threat is anything that can exploit a vulnerability to harm a system, either intentionally or by accident. Cybersecurity risk is a function of the threat (intent and capabilities), vulnerabilities (inherent or introduced), and consequences (fixable or fatal). Although some weapon systems are purely IT systems, most—such as aircraft, missiles, and ships—are what the National Institute of Standards and Technology (NIST) and sometimes DOD refer to as “cyber-physical systems.” NIST defines these systems as “co-engineered interacting networks of physical and computational components.” These cyber systems can affect the physical world so the consequences of a cyber attack may be greater than those of attacks on other types of systems. For example, an attack on a weapon system could have physical consequences that may even result in loss of life. Nevertheless, weapon systems share many of the same cyber vulnerabilities as other types of automated information systems. Weapon systems are large, complex, systems of systems that have a wide variety of shapes and sizes, with varying functionality. Despite obvious differences in form, function, and complexity, weapon systems and other types of systems are similar in some important, if not obvious, ways. For example, DOD reports state that many weapon systems rely on commercial and open source software and are subject to any cyber vulnerabilities that come with them. Weapon systems also rely on firewalls and other common security controls to prevent cyberattacks. Weapon system security controls can also be exploited or bypassed if the system is not properly configured. Finally, weapon systems are operated by people—a significant source of cybersecurity vulnerability for any system. One common way to discuss cybersecurity is through the activities necessary to defend (or attack) a system. System developers and operators take steps to protect the system from cyber attacks, while attackers attempt to defeat those protections as depicted in figure 1. The cyber attack sequence is also referred to as a cyber kill chain or cyber attack lifecycle. There are multiple models for understanding cyber attacks, each with their own terminology and sequence of steps. The attack sequence below is simpler, but generally consistent with existing cybersecurity models. We identified the defend sequence below based on the steps included in cybersecurity test reports that we reviewed. Example: Importance of Patching in a Timely Manner In the 2017 Equifax cyber attack, personal data for over 145 million people were exposed. Attackers took advantage of a vulnerability in a commonly used web application to access Equifax’s credit reporting system. A patch for the vulnerability was available in March, but Equifax had not applied it by the time of the attack—in mid- May. A cyber attacker looks for ways to get around security controls in order to obtain full or partial control of the system. An attacker typically starts by learning as much as possible about the system—potentially through cyber reconnaissance—to identify vulnerabilities in the system. The more attackers know about the system, the more options they have when designing an attack. An attacker may identify a previously unknown vulnerability that the system owner is unaware of. Or the attacker could look for system components that had not applied known security updates—also called “patches.” Developers of commercial components usually publicly announce any security patches and, ironically, provide a roadmap for an attacker to attack a system or component. An attack may not happen all at once—an attacker may find the easiest way to gain initial access and then look for ways to expand their access until they reach their ultimate goal. Even once they achieve full access to a system, an attacker may wait for an opportune time to attack the confidentiality, integrity, or availability of a system. Types of attacks are described in appendix II. The system owner wants to prevent, or at least limit, attempts to adversely affect the confidentiality, integrity, or availability of the system. The owner implements security controls such as firewalls, role-based access controls, and encryption to reduce the number of potential attack points. Many controls need to be designed into the system early in the development cycle. Ideally, the controls are designed to work together and there may be layers of controls that an attacker would have to defeat in order to gain control of the system—referred to as “defense in depth.” Key Concepts Role-based access entails allowing users to only access information and features necessary to carry out their job. Encryption is a way of transforming information so that only authorized users are able to read it. Protecting a system also includes administrative processes, such as requiring users to regularly change their passwords and applying patches on a regular schedule—referred to as cyber hygiene. However, no system can be completely secure, so system owners must also constantly monitor their systems for suspicious activity. Logging is a common system feature that automatically records system activity. Unusual patterns such as numerous failed log-in attempts from a remote location could indicate that an unauthorized person is trying to gain access to the system. Once such a cyber activity is detected, the system owner needs to take steps to end the attack and restore any system capabilities that were degraded as a result of the attacker’s actions. We reported in 2015 that federal and contractor systems face an evolving array of cyber-based threats, including criminals, hackers, adversarial nations, and terrorists. Threats can range from relatively unskilled “script kiddies” who only use existing computer scripts or code to hack into computers, to well-resourced and highly skilled advanced threats who not only have sophisticated hacking skills, but also normally gather detailed knowledge of the systems they attack. Table 1 provides brief descriptions of the terminology DOD uses to categorize threats. Weapons systems are developed, acquired, and deployed within the defense acquisition system, a system of statutes and regulations. Subject to control of the DOD, the Army, Air Force, Navy, and Marine Corps by law have authority to “organize, train, and equip” their services. Their decisions regarding what to develop and how best to do so are informed by documents and deliberations under DOD’s requirements and acquisition processes respectively. Early in the acquisition lifecycle, the requirements process identifies what capabilities are needed and evaluates options to best meet those needs. The acquisition process is a gated review process that assesses programs against established review criteria, such as the program’s cost, schedule, performance, and whether the weapon system is ready to move forward in the acquisition process. Numerous military-service entities are involved in these processes. Key enterprise-level organizations include the Joint Staff and Office of the Secretary of Defense organizations, such as the Office of the Under Secretary of Defense (Acquisition and Sustainment), Office of the Under Secretary of Defense (Research and Engineering), and the Director of Operational Test and Evaluation (DOT&E). Example: Increased Reliance on Software In the 2015 JEEP Cherokee cyber attack, researchers remotely took physical control of a JEEP, including shutting off the engine and controlling the brakes. In 2016, we reported that electronic systems control multiple passenger vehicle functions and that vehicles include multiple interfaces that leave them vulnerable to cyber attacks. Researchers studied a JEEP to understand its systems, including the characteristics of its software code and its "CAN Bus," which connects to units that control core vehicle functions. They remotely accessed an Internet-connected component and used it as an initial entry point to access the vehicle's CAN Bus, which then allowed them to control many of the JEEP’s functions. Just as many DOD organizations are responsible for weapon systems acquisitions, many have responsibilities related to cybersecurity during the acquisition process. For example, program offices are responsible for planning and implementing cybersecurity measures for the system under development. Authorizing officials are responsible for overseeing programs’ adherence to security controls and for authorizing a system’s entry into operations based on the system having an acceptable level of cyber risk. At key decision points, the Office of the Under Secretary of Defense (Research and Engineering) is responsible for advising the Secretary of Defense and providing independent technical risk assessments that address a variety of topics, including the system’s cybersecurity posture. Military test organizations conduct cybersecurity assessments of weapon systems. DOT&E oversees those tests and is funding research on the cybersecurity of some weapon system components that pose particular cybersecurity challenges. Organizations that are traditionally associated with cybersecurity, such as NSA and Cyber Command, support some aspects of weapon systems cybersecurity. However, they are not responsible for reviewing the designs of most weapon systems to identify potential vulnerabilities, although NSA officials said that they will provide advice to acquisition programs if asked to do so. More information about these roles and responsibilities is included in appendix III. Multiple factors contribute to the current state of DOD weapon systems cybersecurity, including: the increasingly computerized and networked nature of DOD weapons, DOD’s past failure to prioritize weapon systems cybersecurity, and DOD’s nascent understanding of how best to develop more cyber secure weapon systems. Specifically, DOD weapon systems are more software and IT dependent and more networked than ever before. This has transformed weapon capabilities and is a fundamental enabler of the United States’ modern military capabilities. Yet this change has come at a cost. More weapon components can now be attacked using cyber capabilities. Furthermore, networks can be used as a pathway to attack other systems. We and others have warned of these risks for decades. Nevertheless, until recently, DOD did not prioritize cybersecurity in weapon systems acquisitions. In part because DOD historically focused on the cybersecurity of its networks but not weapon systems themselves, DOD is in the early stage of trying to understand how to apply cybersecurity to weapon systems. Several DOD officials explained that it will take some time, and possibly some missteps, for the department to learn what works and does not work with respect to weapon systems cybersecurity. DOD’s weapon systems are increasingly dependent on software and IT to achieve their intended performance. The amount of software in today’s weapon systems is growing exponentially and is embedded in numerous technologically complex subsystems, which include hardware and a variety of IT components, as depicted in figure 2. Nearly all weapon system functions are enabled by computers—ranging from basic life support functions, such as maintaining stable oxygen levels in aircraft, to intercepting incoming missiles. DOD has actively sought ways to introduce this automation into weapon systems. For example, we have reported that for decades, the Navy has sought to reduce ship crew size based, in part, on the assumption that some manual tasks could be automated and fewer people would be needed to operate a ship. Yet this growing dependence on software and IT comes at a price. It significantly expands weapons’ attack surfaces. According to DOT&E, any exchange of information is a potential access point for an adversary. Even “air gapped” systems that do not directly connect to the Internet for security reasons could potentially be accessed by other means, such as USB devices and compact discs. Weapon systems have a wide variety of interfaces, some of which are not obvious, that could be used as pathways for adversaries to access the systems, as is shown in figure 3. DOD systems are also more connected than ever before, which can introduce vulnerabilities and make systems more difficult to defend. According to the DSB, nearly every conceivable component in DOD is networked. Weapon systems connect to DOD’s extensive set of networks—called the DOD Information Network—and sometimes to external networks, such as those of defense contractors. Technology systems, logistics, personnel, and other business-related systems sometimes connect to the same networks as weapon systems. Furthermore, some weapon systems may not connect directly to a network, but connect to other systems, such as electrical systems, that may connect directly to the public Internet, as is depicted in figure 4. These connections help facilitate information exchanges that benefit weapon systems and their operators in many ways—such as command and control of the weapons, communications, and battlespace awareness. If attackers can access one of those systems, they may be able to reach any of the others through the connecting networks. Many officials we met with stated that including weapon systems on the same networks with less protected systems puts those weapon systems at risk. Furthermore, the networks themselves are vulnerable. DOT&E found that some networks were not survivable in a cyber-contested environment and the DSB reported in 2013 that “the adversary is in our networks.” Further complicating matters, weapon systems are dependent on external systems, such as positioning and navigation systems and command and control systems in order to carry out their missions—and their missions can be compromised by attacks on those other systems. A successful attack on one of the systems the weapon depends on can potentially limit the weapon’s effectiveness, prevent it from achieving its mission, or even cause physical damage and loss of life. We and other organizations have identified risks associated with increased reliance on software and networking since at least the early 1990s, as is shown in table 2. Nevertheless, DOD has only recently begun prioritizing weapon systems cybersecurity. Instead, for many years, DOD focused cybersecurity efforts on protecting networks and traditional IT systems, such as accounting systems, rather than weapons. Experts we interviewed as well as officials from program offices, the Office of the Secretary of Defense, and some military test organizations explained that, until around 2014, there was a general lack of emphasis on cybersecurity throughout the weapon systems acquisition process. Others have reported similar findings. For example, the DSB reported in 2013 that although DOD had taken great care to secure the use and operation of the hardware of its weapon systems, it had not devoted the same level of resources and attention to IT systems that support and operate those weapons and critical IT capabilities embedded within the weapon systems. The National Research Council reported in 2014 that much broader and more systematic attention to cybersecurity was needed in the acquisition process and that the Navy was in the “crawl” stage of a “crawl-walk-run” journey. Similarly, the Navy reported in 2015 that there was a lack of attention to cybersecurity in the acquisition process and platform IT systems were not engineered with cybersecurity as a key component. In the past, consideration of cybersecurity was not a focus of the key processes governing the development of weapon systems. It was not a focus of key acquisition and requirements policies nor was it a focus of key documents that inform decision-making. For example, until a few years ago, DOD’s main requirements policy did not call for programs to factor cyber survivability into their key performance parameters. Key performance parameters are the most important system capabilities, called “requirements,” that must be met when developing weapon systems. They are established early on in an acquisition program and drive system design decisions. They are also used as a benchmark to measure program performance and are reviewed during acquisition decisions and other oversight processes. Because cybersecurity key performance parameters were not required, Joint Staff officials and some program officials said that many current weapon systems had no high- level cybersecurity requirements when they began, which in turn limited emphasis on cybersecurity during weapon system design, development, and oversight. In addition, Joint Staff officials said that, historically, cybersecurity was not a factor in analyses of alternatives. This analysis is an important early step in acquiring a new weapon system and informs decisions about the relative effectiveness, costs, and risks of potential systems that could be developed. By not considering cybersecurity in these analyses, decisions about which system to develop were made without consideration of whether one proposed system might be more inherently vulnerable from a cyber perspective than others. Programs’ lack of cybersecurity requirements may have also contributed to challenges with incorporating cybersecurity into weapon systems testing. Specifically, DOT&E and service test agencies said that prior to around 2014, program offices tried to avoid undergoing cybersecurity assessments because they did not have cybersecurity requirements and therefore thought they should not be evaluated. Furthermore, test officials said that many within DOD did not believe cybersecurity applied to weapon systems. As a result, fewer cybersecurity assessments were conducted at that time in comparison to recent years. By not incorporating cybersecurity into key aspects of the requirements and acquisition processes, DOD missed an opportunity to give cybersecurity a more prominent role in key acquisition decisions. Numerous officials we met with said that this failure to address weapon systems cybersecurity sooner will have long-lasting effects on the department. Due to this lack of focus on weapon systems cybersecurity, DOD likely has an entire generation of systems that were designed and built without adequately considering cybersecurity. Bolting on cybersecurity late in the development cycle or after a system has been deployed is more difficult and costly than designing it in from the beginning. Not only is the security of those systems and their missions at risk, the older systems may put newer systems in jeopardy. Specifically, if DOD is able to make its newer systems more secure, but connects them to older systems, this puts the newer systems at risk. Furthermore, even if they are not connected, if the newer systems depend on the older systems to help fulfill their missions, those missions may be at risk. DOD is still determining how best to address weapon systems cybersecurity given weapon systems’ different and particularly challenging cybersecurity needs. Although there are similarities between weapon systems and traditional IT systems, DOD has acknowledged that it may not be appropriate to apply the same cybersecurity approach to weapon systems as traditional IT systems. RAND reported and several program officials we met with stated that DOD’s security controls were developed with IT systems, and not weapon systems, in mind. DOD policies and guidance acknowledge that tailoring may be warranted, but they do not yet specify how the approaches to the security controls should differ. Key Concept Industrial control system is a general term that encompasses several types of control systems including supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers. Industrial control systems monitor or control other systems and processes and may be used to automate tasks such as opening and closing valves. DOD is still in the process of determining how to make weapon system components with particular cyber vulnerabilities as secure as possible. For example, many weapon systems use industrial control systems to monitor and control equipment, and like computers, they include software. Many weapon systems use such systems to carry out essential functions. For example, a ship may use industrial control systems to control engines and fire suppression systems. According to NIST, industrial control systems were originally designed for use in trusted environments, so many did not incorporate security controls. Government and industry reports state that attacks on these systems are increasing. However, DOD officials said that program offices may not know which industrial control systems are embedded in their weapons or what the security implications of using them are. Over the past few years, DOD has begun funding work to improve its understanding of how to best secure these systems. In addition, Office of the Secretary of Defense officials informed us that, in response to section 1650 of the National Defense Authorization Act for Fiscal Year 2017, they are working to better understand the dependency of industrial control systems on mission impact, including other key infrastructure nodes that could be vulnerable to a cyber attack and have significant impact to mission accomplishment. Key Concept Vulnerability chaining is when attackers take advantage of multiple vulnerabilities— which could be low or moderate risk in isolation—to perform a more significant attack on a system. Several weapon system-specific factors make it important to tailor cybersecurity approaches, but also make cybersecurity difficult. Because weapon systems can be very large, complex, systems of systems with many interdependencies, updating one component of a system can impact other components. A patch or software enhancement that causes problems in an email system is inconvenient, whereas one that affects an aircraft or missile system could be catastrophic. Officials from one program we met with said they are supposed to apply patches within 21 days of when they are released, but fully testing a patch can take months due to the complexity of the system. Even when patches have been tested, applying the patches may take additional time. Further, weapon systems are often dispersed or deployed throughout the world. Some deployed systems may only be patched or receive software enhancements when they return to specific locations. Although there are valid reasons for delaying or forgoing weapon systems patches, this means some weapon systems are operating, possibly for extended periods, with known vulnerabilities. Exacerbating matters, some program offices may also not yet have a solid understanding of the cybersecurity implications of their systems’ designs, including their systems’ connectivity. This situation makes it difficult to secure the system. Experts and officials from some test organizations we met with stated that programs have generally not understood the multitude of ways that information flows in and out of their systems, although this may be improving. Several program officials we met with felt that weapon systems were more secure than other types of systems and noted that they typically did not have direct connections to the Internet. In fact, weapon systems have more potential avenues of attack than may be apparent, such as radio communications receivers and radar receivers. Furthermore, the National Research Council reported in 2014 that individual warfare domains do not fully grasp risks within their own domain, let alone those that can be introduced through other domains. For example, if a space system is connected to a land system—even indirectly—an attacker may be able to move from one to the other or limit the operations of one by attacking the other. We found that from 2012 to 2017, DOD testers routinely found mission- critical cyber vulnerabilities in nearly all weapon systems that were under development. Using relatively simple tools and techniques, testers were able to take control of these systems and largely operate undetected. In some cases, system operators were unable to effectively respond to the hacks. Furthermore, DOD does not know the full scale of its weapon system vulnerabilities because, for a number of reasons, tests were limited in scope and sophistication. Nearly all major acquisition programs that were operationally tested between 2012 and 2017 had mission-critical cyber vulnerabilities that adversaries could compromise. DOT&E’s 2017 annual report stated that tests consistently discovered mission-critical vulnerabilities in acquisition programs, echoing a similar finding by the DSB in 2013 about DOD IT systems and networks. Cybersecurity test reports that we reviewed showed that test teams were able to gain unauthorized access and take full or partial control of these weapon systems in a short amount of time using relatively simple tools and techniques. We saw widespread examples of weaknesses in each of the four security objectives that cybersecurity tests normally examine: protect, detect, respond, and recover. Key Concepts An insider is a user who is authorized to use a system (e.g., has a username and password) and has physical access to all or parts of a system. A near-sider is an unauthorized user who has physical access to all or part of a system. For example, someone taking a tour of a Navy ship would be a near-sider. A remote user is not authorized to use the system and does not have physical access to the system. Test teams were able to defeat weapon systems cybersecurity controls meant to keep adversaries from gaining unauthorized access to the systems. In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing. Some programs fared better than others. For example, one assessment found that the weapon system satisfactorily prevented unauthorized access by remote users, but not insiders and near-siders. Once they gained initial access, test teams were often able to move throughout a system, escalating their privileges until they had taken full or partial control of a system. In one case, the test team took control of the operators’ terminals. They could see, in real-time, what the operators were seeing on their screens and could manipulate the system. They were able to disrupt the system and observe how the operators responded. Another test team reported that they caused a pop-up message to appear on users’ terminals instructing them to insert two quarters to continue operating. Multiple test teams reported that they were able to copy, change, or delete system data including one team that downloaded 100 gigabytes, approximately 142 compact discs, of data. Example: Poor Password Management The 2016 cyber attack on Dyn, a company that serves as a key intermediary in directing Internet traffic, disabled websites, such as Twitter, Netflix, and CNN and brought down the Internet in some regions. The attack used malware to search the Internet for unsecured devices, such as those that used factory- default usernames and passwords, and then used those devices to send junk traffic to online targets until they could not function. The test reports indicated that test teams used nascent to moderate tools and techniques to disrupt or access and take control of weapon systems. For example, in some cases, simply scanning a system caused parts of the system to shut down. One test had to be stopped due to safety concerns after the test team scanned the system. This is a basic technique that most attackers would use and requires little knowledge or expertise. Poor password management was a common problem in the test reports we reviewed. One test report indicated that the test team was able to guess an administrator password in nine seconds. Multiple weapon systems used commercial or open source software, but did not change the default password when the software was installed, which allowed test teams to look up the password on the Internet and gain administrator privileges for that software. Multiple test teams reported using free, publicly available information or software downloaded from the Internet to avoid or defeat weapon system security controls. Test reports we reviewed make it clear that simply having cybersecurity controls does not mean a system is secure. How the controls are implemented can significantly affect cybersecurity. For example, one test report we reviewed indicated that the system had implemented role- based access control, but internal system communications were unencrypted. Because the system’s internal communications were unencrypted, a regular user could read an administrator’s username and password and use those credentials to gain greater access to the system and the ability to affect the confidentiality, integrity, or availability of the system. Programs Had Not Addressed Some Previously Identified Vulnerabilities Program offices were aware of some of the weapon system vulnerabilities that test teams exploited because they had been identified in previous cybersecurity assessments. For example, one test report indicated that only 1 of 20 cyber vulnerabilities identified in a previous assessment had been corrected. The test team exploited the same vulnerabilities to gain control of the system. When asked why vulnerabilities had not been addressed, program officials said they had identified a solution, but for some reason it had not been implemented. They attributed it to contractor error. Another test report indicated that the test team exploited 10 vulnerabilities that had been identified in previous assessments. Example: Poor Detection In the 2014 Office of Personnel Management (OPM) cyber attack, attackers exfiltrated personnel files of 4.2 million government employees, security clearance background information on 21 million individuals, and fingerprint data of 5.6 million of these individuals. Attackers used a contractor’s OPM credentials to log into the OPM system, installed malware, and created a backdoor to the network. These attackers were in OPM’s networks for at least 14 months. Over 2,000 pieces of malware were later identified on OPM devices. detection. One test team emulated a denial of service attack by rebooting the system, ensuring the system could not carry out its mission for a short period of time. Operators reported that they did not suspect a cyber attack because unexplained crashes were normal for the system. Another test report indicated that the intrusion detection system correctly identified test team activity, but did not improve users’ awareness of test team activities because it was always “red.” Warnings were so common that operators were desensitized to them. A common way to detect cyber activity is to review logs of system activity looking for unusual occurrences. Multiple test reports indicated that test team activity was documented in system logs, but operators did not review them. One test report noted that the system had no documented procedures for reviewing logs. Multiple test reports indicated that operators did not effectively respond to test team activities. In multiple tests, operators did not respond because, as noted above, they were simply unaware of the test team activities. In some cases, however, operators were unable to effectively respond even when they identified or were notified that the test team had carried out an attack. One test report indicated that operators identified test team intrusion attempts and took steps to block the test team from accessing the system. However, the test team was able to easily circumvent the steps the operators took. In another case, the test team was able to compromise a weapon system and the operators needed outside assistance to restore the system. DOD does not know the full extent of its weapon systems cyber vulnerabilities due to limitations on tests that have been conducted. Cybersecurity assessments do not identify all vulnerabilities of the systems that are tested. This is, in part, because cybersecurity assessments do not reflect the full range of threats that weapon systems may face in operation. Test teams reported that they portray realistic threats and environments. However, the nature of tests imposes limitations on testers that do not apply to potential adversaries. For example, DOD officials said that most cybersecurity assessments are conducted over a few days to a few weeks. One test report indicated that the cybersecurity assessment was cut short due to external factors so the test team only had 41 hours to work with the system. In contrast, DOD officials we spoke to said that a determined adversary could spend months or years targeting our systems. Further, because test teams have a limited amount of time with a system, they look for the easiest or most effective way to gain access, according to DOD officials we met with and test reports we reviewed. They do not identify all of the vulnerabilities that an adversary could exploit. DOT&E noted that longer-term tests generally identify more cyber vulnerabilities than shorter tests. DOD officials we spoke to said that the department has increased the amount of long-term assessments it conducts in recent years. Weapon systems cybersecurity assessments may also be limited in the types of attacks that are portrayed so entire categories of vulnerabilities are not currently addressed in some cyber assessments. The test reports we reviewed tended to portray nascent to moderate threats and generally did not target special components like industrial control systems and non-Internet enabled devices which our adversaries could target. Similarly, counterfeit parts pose cybersecurity risks to weapon systems, but were not within the scope of the cybersecurity tests that we reviewed. System-specific limitations can also affect test results. Officials from one service test agency noted that in at least one case, they could not fully assess a system’s cybersecurity because portions of the system’s networks and data were proprietary. The system utilized the contractor’s corporate networks, which the test team was not allowed to attack. In several tests, a weapon system’s connections to external systems were either limited or had to be simulated. One test report we reviewed noted that the test team was not allowed to use classified networks to attack a weapon system due to security concerns. Another test was conducted in a lab environment so the test team had to simulate external communications. Although there are practical reasons for limiting the duration and scope of cybersecurity assessments, these limitations mean that DOD may not fully understand the extent of weapon system cyber vulnerabilities, as is reflected in figure 5. Many program officials we met with indicated that their systems were secure, including some with programs that had not had a cybersecurity assessment. Some systems have not yet undergone testing either because they are not far enough along in the acquisition process, because they were fielded prior to DOD’s emphasis on penetration testing, or out of concern that cybersecurity tests would interfere with operations. Systems that have not been tested are not necessarily more or less secure than systems that have been assessed. DOD does not know the extent to which these systems have cyber vulnerabilities. Program officials cited the security controls they applied as the basis for their belief that their systems were secure. For example, officials from a DOD agency we met with expressed confidence in the cybersecurity of their systems, but could not point to test results to support their beliefs. Instead, they identified a list of security controls they had implemented. However, security controls must be properly designed and implemented in order to be effective. As we noted earlier, test teams routinely found and defeated poorly implemented security controls. Officials we spoke to stated that controls are necessary, but not sufficient, and penetration test results—rather than compliance documentation—are better indicators of a system’s security. For programs that have had cybersecurity assessments, some program officials we met with questioned the validity of the results because of concerns about the realism of the assessments. For example, officials from one program noted that the testers were given more system information and access than an adversary would have. Officials from another program noted that testers asked for detailed information about the system’s design. These officials stated that cyber assessments were unrealistic if they relied on the program office to identify problem areas for the test team. However, test organizations and NSA officials we met with dismissed these observations, noting that adversaries are not subject to the types of limitations imposed on test teams, such as time constraints and limited funding—and this information and access are granted to testers to more closely simulate moderate to advanced threats. Over the past few years, DOD has taken several major steps to improve weapon systems cybersecurity. DOD issued and updated numerous policies and guidance to improve the department’s development of cyber resilient systems. These include improvements such as specifying that cybersecurity policies apply to weapon systems and requiring more focus on cybersecurity throughout a weapon system’s acquisition life cycle. DOD and Congress have also begun promising initiatives to help DOD improve its understanding of its weapon systems cyber vulnerabilities and take steps to mitigate their risks. However, DOD faces barriers that may limit its ability to achieve desired improvements. For example, DOD is struggling to hire and retain cybersecurity personnel, who are essential to implementing these changes. In addition, DOD faces barriers to information sharing, which hinder its ability to share vulnerability and threat information within and across programs. To improve the state of weapon systems cybersecurity, it is essential that DOD sustain its momentum in developing and implementing key initiatives. Since 2014, DOD has issued or updated at least 15 department-wide policies, guidance documents, and memorandums intended to promote more cyber secure weapon systems, some of which are highlighted in table 3. One of the more significant changes is that DOD’s existing cybersecurity policies now explicitly apply to weapon systems. DOD officials said the department has had cybersecurity policies in place for decades, but applied them to weapon systems only in the past few years. For example, DOD’s Risk Management Framework (RMF) is similar to its predecessor—DOD’s Information Assurance Certification and Accreditation Process—which called for application of an extensive series of controls to protect DOD networks and information systems. However, RMF applies these controls more widely to weapon systems cybersecurity. Another important change is that, in recognition that systems cannot be 100 percent secure, DOD has begun to emphasize cyber resiliency in some of its policies. The idea behind cyber resiliency is to identify and protect key elements of a system to ensure that they can continue to operate, possibly with limited capabilities, during a cyber attack. This entails designing in features such as durability, redundancy, and added protections for certain components. Lastly, key policies that govern the requirements and acquisition processes now address cybersecurity. These changes have the potential to bring greater attention to cybersecurity in weapon systems acquisitions. Rather than being treated as distinct from the acquisition process, cybersecurity is to be integrated into key acquisition activities, such as requirements development, technology maturation, and testing. Examples of this, as called for in various policies, include the following: Requirements. Identify cybersecurity requirements and how the information flows into, out of, and through the systems. This helps identify the system’s attack surface and informs the system’s design and cybersecurity controls. Cybersecurity should become part of the requirements trade space. Technology maturation. Focus early prototyping in part on buying down cybersecurity risks prior to system development. Cybersecurity controls should be applied and assessed during prototyping to evaluate cyber risks and inform down-selection and adjustment of requirements. Department of Defense, DOD Program Manager’s Guidebook for Cybersecurity (Sept. 2015). Developmental testing. Test the cybersecurity of weapon systems as they are developed, including integration of larger subsystems and, ultimately, the entire system. Perform cybersecurity assessments in representative operating environments during developmental testing. Operational testing. Conduct operational cybersecurity testing of weapon systems to include other systems that exchange information with the system under test (system-of-systems to include the network environment), end users, administrators, and cyber defenders. Reflect representative cyber threats. These extensive changes to policies and guidance, which adopt a similar risk-based framework to that already generally in place government-wide, appear to be a step in the right direction to increase the department’s emphasis on weapon systems cybersecurity. However, they are also relatively new for DOD, so it is too early to assess whether they are resulting in improved weapon systems cybersecurity. For example, changes to the requirements process apply primarily to new programs so it could be many years before systems that have gone through the new process undergo operational testing and are fielded. Section 1647 of the National Defense Authorization Act for Fiscal Year 2016 requires the Secretary of Defense to evaluate the cyber vulnerabilities of each DOD weapon system by the end of 2019 and develop strategies to mitigate risks stemming from those vulnerabilities. In response to this direction and The DOD Cyber Strategy, which also calls for DOD to assess and initiate improvements to the cybersecurity of current and future weapons systems, DOD is taking steps to improve its understanding of its weapon systems’ vulnerabilities, determine how to mitigate risks from those vulnerabilities, and inform future development of more secure systems. The Office of the Under Secretary of Defense (Acquisition and Sustainment) is leading this initiative in collaboration with military test organizations. DOD is compiling existing vulnerability information and conducting some new tests to provide information about the cybersecurity posture of individual systems, concentrating mostly on fielded systems. These assessments are important, in part because some of those systems did not undergo cybersecurity testing prior to fielding and DOD does not have a permanent process in place to periodically assess the cybersecurity of fielded systems. Furthermore, vulnerabilities and risks can change after fielding as system software becomes obsolete. As part of this initiative, for two mission areas, the Office of the Under Secretary of Defense (Acquisition and Sustainment) has been trying to incorporate cybersecurity into large scale military exercises to take a more integrated look at impacts of vulnerabilities across systems. The goal is to understand how vulnerabilities in some systems may affect DOD’s ability to achieve its mission and to identify what other options are available to complete a mission if certain capabilities were disabled or degraded. This work is also important, but for different reasons. DOD’s developmental and operational tests focus primarily on vulnerabilities in individual systems rather than across broader mission areas. However, as previously discussed, attackers do not necessarily limit themselves to one system and may move from one system to others. Furthermore, DOD has not previously had a process in place to examine how cyber attacks on one system could affect entire missions. Taken together, the system-specific and mission-focused activities could help DOD develop a more comprehensive understanding of its cybersecurity posture—the overall strength of its cybersecurity. Officials working on these assessments plan to use what they learn to help inform the acquisition of future weapon systems. Specifically, they plan to share lessons with DOD test organizations, the Office of the Chief Information Officer, Office of the Under Secretary of Defense (Research and Engineering), and others in the Office of the Under Secretary of Defense (Acquisition and Sustainment). Similarly, the military services have established weapon system cybersecurity-focused offices to improve their cybersecurity posture, which are described briefly in table 4. Although all of these activities promise to help DOD improve its cybersecurity posture over time, they are also relatively new for DOD. They will need sustained momentum to achieve changes over the lifecycle of acquisition programs, so it is too early to tell if they will be successful over the long term. According to multiple agency officials and our analysis of policy and guidance changes since 2014, DOD leadership has become more aware of cybersecurity issues over the past several years and has driven many of these cybersecurity activities. However, our prior work has found sustained leadership support of DOD initiatives to be key to maintaining their momentum. We also reported that there is risk that DOD will not fully implement some tasks it has begun to improve weapon systems cybersecurity if leadership does not continue to monitor their progress. For example, we reported in 2017 that DOD’s Principal Cyber Advisor closed out the task on assessing weapon systems called for under The DOD Cyber Strategy. We recommended that the Cyber Advisor modify criteria for closing tasks to reflect whether tasks have been implemented and re-evaluate tasks that have been previously determined to be completed. DOD faces barriers that will challenge its ability to develop more cyber resilient weapon systems and make it more difficult for DOD’s recent policy changes and new initiatives to be as effective as possible. DOD struggles to hire and retain cybersecurity personnel, particularly those with weapon systems cybersecurity expertise. Our prior work has shown that maintaining a cybersecurity workforce is a challenge government-wide and that this issue has been a high-priority across the government for years. Program officials from a majority of the programs and test organizations we met with said they have difficulty hiring and retaining people with the right expertise, due to issues such as a shortage of qualified personnel and private sector competition. Test officials said that once their staff members have gained experience in DOD, they tend to leave for the private sector, where they can command much higher salaries. According to a 2014 RAND study, personnel at the high end of the capability scale, who are able to detect the presence of advanced threats, or finding the hidden vulnerabilities in software and systems, can be compensated above $200,000 to $250,000 a year, which greatly exceeds DOD’s pay scale. Even when cybersecurity positions are filled, it may not necessarily be with the right expertise. Officials from some program offices said that general cybersecurity expertise is not the same as weapon systems cybersecurity expertise. For example, officials said that professional IT certifications are not the same as systems security engineering expertise, which is essential to designing cyber-resilient systems. According to various program officials, weapon systems cybersecurity is a specialized area. Cybersecurity subject matter experts require knowledge of (1) DOD’s acquisition process; (2) technical knowledge of the specific weapon system—such as radar or aircraft, and (3) cybersecurity knowledge. However, it is difficult to hire and maintain a workforce with the needed knowledge due to its highly specialized nature. Without this expertise, it will be difficult for programs to effectively implement cybersecurity policies and guidance. For example, the RMF allows programs to determine which controls are most appropriate to apply, but a knowledgeable workforce is necessary for making such decisions. DOD has various efforts underway to recruit and develop the skills of DOD’s cybersecurity workforce, according to several DOD officials. For example, the services are aiming to recruit cybersecurity analysts by using internships and engaging in partnerships with secondary schools and universities. In addition, the services are developing and offering courses to grow expertise within their existing acquisition workforce. DOD is determining how to share specialized expertise related to weapon systems cybersecurity. Specific efforts related to this include the Cyber Developmental Test Cross Service Working Group that meets quarterly and invites industry expertise to present cutting edge techniques as well as a “capture the flag” competition, which will now be offered to other services as well. In addition, Navy Systems Commands employees participate in periodic regional cyber competitions to hone knowledge learned in classroom environments and use training funds to pursue additional or higher degrees and cyber certificate programs. Officials from many of the offices we interviewed, as well as the National Research Council, DSB, and RAND have expressed concerns about barriers to information sharing. It is difficult to find the correct balance between protecting information, so that it is not accessible to potential adversaries, and sharing it, so that DOD has an informed workforce. For example, classification is important because it protects information about vulnerabilities, and in some cases, intelligence methods. Access to information about vulnerabilities makes it easier for potential adversaries to attack DOD systems. Similarly, limiting the distribution of classified information to those who have the need to know is likewise important because it reduces the likelihood that internal and external threats will access it. Although DOD officials explained that there is no DOD-wide cybersecurity classification guidance, Air Force guidance and DOD officials indicated that vulnerabilities in fielded systems are typically classified as at least Top Secret or Top Secret/Sensitive Compartmented Information, and details of threats are more restricted. This high level of classification for weapon systems cyber vulnerabilities and threats helps protect sensitive information, but it makes it difficult for DOD to share information about aspects of weapon systems cybersecurity with cybersecurity personnel across DOD. For example, some experts told us that flawed designs can still be found in new systems if their designers were not aware that they resulted in vulnerabilities in other systems. More generally, because they are not sharing vulnerability and threat information across programs, programs are unaware of their full risk exposure and DOD may have less insight into vulnerabilities across its weapon systems portfolio. Officials from most organizations we spoke to, including NSA, acknowledged challenges with sharing information across all levels within DOD. Examples of these challenges are listed in table 5. Although limitations to information sharing can lead to inefficiencies and other challenges, DOD has so far opted to favor protection of information—perhaps because the stakes are so high if it does not. As we mentioned previously, one of the reasons potential adversaries collect information on weapon systems is because the better they understand a weapon system, and especially what vulnerabilities it may have, the more options they have to attack it. Reports over the years about cyber espionage attacks on defense contractors show that concerns about protecting sensitive information are warranted. We provided a draft of this report to DOD for review and comment. DOD provided technical comments, which we incorporated where appropriate. We are sending copies of this report to the appropriate congressional committees; the Secretary of Defense; and the Secretaries of the Army, Navy, and Air Force. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at 202-512-4841 or chaplainc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To identify factors that contribute to the current state of Department of Defense (DOD) weapon systems cybersecurity, we reviewed reports published from 1991 to the present on software, information technology, networking, and weapon systems from the National Research Council, the Defense Science Board, GAO, DOD’s Director of Operational Test and Evaluation, DOD’s Joint Chiefs of Staff, and the RAND Corporation. To inform our discussion of networking, we also reviewed concepts of operations for selected systems of systems. To determine the extent to which DOD focused on cybersecurity in weapon system acquisitions, we analyzed selected information assurance, acquisition, requirements, and testing policies and guidance. For this and all other objectives, we conducted interviews with or obtained written responses from the following organizations: Office of the Secretary of Defense organizations: Office of the Director, Operational Test and Evaluation; Office of the Deputy Assistant Secretary of Defense for Developmental Test and Evaluation; Office of the Chief Information Officer including the Defense Information Systems Agency; Office of the Chairman of the Joint Chiefs of Staff; Office of the Under Secretary of Defense (Acquisition and Sustainment); and Office of the Under Secretary of Defense (Research and Engineering). Military service test organizations: Air Force Operational Test and Evaluation Center, Army Operational Test and Evaluation Command, Navy’s Commander Operational Test and Evaluation Force, and Marine Corps Operational Test and Evaluation Activity. Selected program offices reflecting a purposeful sample of nine major defense acquisition program offices. We identified a variety of program offices to represent each service, multiple domains, and programs that are extensively connected to other weapons systems. We are not listing the names of these offices for sensitivity reasons. Other key DOD organizations with cybersecurity responsibilities: the National Security Agency, Defense Information Systems Agency, and U.S. Cyber Command. Selected organizations with cybersecurity expertise, referred to as “experts” in the report: Carnegie Melon’s Software Engineering Institute, the MITRE Corporation, the RAND Corporation, Pacific Northwest National Laboratory, Sandia National Laboratory, and Renaissance Strategic Advisors. We selected these based on their research or roles advising DOD on weapon systems cybersecurity- related topics. To identify vulnerabilities in weapon systems under development, we reviewed cyber assessment reports of selected weapon systems conducted between 2012 and 2017. We selected at least one program from each service as well as different types of weapon systems (e.g., aircraft vs ships vs communication systems). To gain further insights into assessment findings and understand their limitations, we interviewed officials from the Office of the Secretary of Defense and military test service organizations. We discussed the cybersecurity of individual programs, implementation of controls, and assessment findings with program offices. We also interviewed officials from several organizations with cybersecurity expertise to discuss weapon system vulnerabilities and test limitations. Vulnerabilities for specific weapon systems are classified, so we have not identified the programs covered in these test reports. The examples we cite are unique to each weapon system and are not applicable to all weapon systems. Furthermore, cybersecurity assessment findings are as of a specific date so vulnerabilities identified during system development may no longer exist when the system is fielded. To determine the steps DOD is taking to develop more cyber resilient weapon systems, we analyzed key DOD information assurance/cybersecurity, acquisition, requirements, and testing policies and guidance that have been updated since 2014 to better address weapon systems cybersecurity. We selected 2014 because DOD began revising several policies at that time. These include DOD’s Risk Management Framework, Department of Defense Instruction 8500.01, Cybersecurity; the Department of Defense Instruction 5000.2, Operation of the Defense Acquisition System; DOD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework into the System Acquisition Lifecycle; the Joint Capabilities Integration and Development System Manual; the Cyber Survivability Endorsement Implementation Guide; and the DOD Cybersecurity Test and Evaluation Guidebook. To identify barriers DOD faces in developing cyber resilient systems and implementing updated cybersecurity policies and guidance, we interviewed Office of the Secretary of Defense, military service test organizations, selected program offices, other DOD organizations, experts, and operators. We took additional precautions to avoid revealing sensitive information. We illustrated some concepts using notional depictions. In some cases, we were deliberately vague and excluded details from examples to avoid identifying specific weapon systems. We also presented examples of publicly known attacks in sidebars to illustrate how poor cybersecurity can enable cyber attacks. DOD conducted a security review of the report and approved it for public release. The Department of Defense (DOD) is responsible for defending the U.S. homeland and interests from attack, including those that occur in cyberspace and has developed capabilities for cyber operations. In order to achieve this objective, the department must be able to defend its own networks, systems, and information from cyber attack. To establish a cybersecurity program to protect and defend DOD information and information technology, DOD has assigned some of its components and senior officials with a variety of cybersecurity responsibilities, some of which are described below. Cristina T. Chaplain (202) 512-4841 or chaplainc@gao.gov. In addition to the contact named above, Raj Chitikila (Assistant Director), Brandon Booth, Laura Greifner, L.T. Holliday, Katherine Pfeiffer, James Tallon, Jacqueline Wade, and Robin Wilson made key contributions to this report. Assistance was also provided by Tommy Baril, Nabajyoti Barkakati, Mark Canter, Virginia Chanley, Kurt Gurka, Joseph Kirschbaum, Jeff Knott, Duc Ngo, and Gregory Wilshusen.

Summary: DOD plans to spend about $1.66 trillion to develop its current portfolio of major weapon systems. Potential adversaries have developed advanced cyber-espionage and cyber-attack capabilities that target DOD systems. Cybersecurity—the process of protecting information and information systems—can reduce the likelihood that attackers are able to access our systems and limit the damage if they do. GAO was asked to review the state of DOD weapon systems cybersecurity. This report addresses (1) factors that contribute to the current state of DOD weapon systems' cybersecurity, (2) vulnerabilities in weapons that are under development, and (3) steps DOD is taking to develop more cyber resilient weapon systems. To do this work, GAO analyzed weapon systems cybersecurity test reports, policies, and guidance. GAO interviewed officials from key defense organizations with weapon systems cybersecurity responsibilities as well as program officials from a non-generalizable sample of nine major defense acquisition program offices. The Department of Defense (DOD) faces mounting challenges in protecting its weapon systems from increasingly sophisticated cyber threats. This state is due to the computerized nature of weapon systems; DOD's late start in prioritizing weapon systems cybersecurity; and DOD's nascent understanding of how to develop more secure weapon systems. DOD weapon systems are more software dependent and more networked than ever before (see figure). Automation and connectivity are fundamental enablers of DOD's modern military capabilities. However, they make weapon systems more vulnerable to cyber attacks. Although GAO and others have warned of cyber risks for decades, until recently, DOD did not prioritize weapon systems cybersecurity. Finally, DOD is still determining how best to address weapon systems cybersecurity. In operational testing, DOD routinely found mission-critical cyber vulnerabilities in systems that were under development, yet program officials GAO met with believed their systems were secure and discounted some test results as unrealistic. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications. In addition, vulnerabilities that DOD is aware of likely represent a fraction of total vulnerabilities due to testing limitations. For example, not all programs have been tested and tests do not reflect the full range of threats. DOD has recently taken several steps to improve weapon systems cybersecurity, including issuing and revising policies and guidance to better incorporate cybersecurity considerations. DOD, as directed by Congress, has also begun initiatives to better understand and address cyber vulnerabilities. However, DOD faces barriers that could limit the effectiveness of these steps, such as cybersecurity workforce challenges and difficulties sharing information and lessons about vulnerabilities. To address these challenges and improve the state of weapon systems cybersecurity, it is essential that DOD sustain its momentum in developing and implementing key initiatives. GAO plans to continue evaluating key aspects of DOD's weapon systems cybersecurity efforts. GAO is not making any recommendations at this time. GAO will continue to evaluate this issue.