The notice to Congress repurposing of $100 million to go towards testing and evaluating cyber vulnerabilities in weapon systems, sent from the Defense Department comptroller’s office is described by many as a good first step toward better security. One top DoD official described this as potentially the first step toward building harder and more secure systems in the future.
“The reason why I was calling attention to this and why I think this is so important is as we start to take a look at these weapons systems and understand to what extent they are vulnerable and laying out mitigation strategies, there’s a net benefit that this content and knowledge will float forward in the future designs and developments of the next generation systems, which will be inherently more hard from a cyber vantage point than they are today,” Richard Pino, acting deputy assistant secretary for Defense for C3, Cyber and Business Systems, said during a keynote presentation at an AFCEA NOVA event September 1.
Pino noted that Congress has mandated this effort in recent legislation, particularly section 1647 of the fiscal 2016 National Defense Authorization Act. “Those dollars are going directly to the services for the purposes of doing platform assessments and mission assessments,” he told C4ISRNET following his presentation.
Free Download: DoD Faces RiskDuring his remarks, Pino, said DoD will submit a plan back to Congress detailing its process for testing weapons systems for vulnerabilities. “We’ve developed a strategy, we have funding profiles, we’ve allocated resources to the services to do this,” he said.
The effort is critically important, Pino said, because those operating these weapons systems are interested in knowing the vulnerabilities of what they’re using. Moreover, DoD wants to make it harder for adversaries to penetrate the designs of future systems, and easier to mitigate damage if a penetration does succeed.
“The more complex a system, the higher the likelihood that a vulnerability may go unnoticed,” Monzy Merza, chief security evangelist at Splunk, told C4ISRNET in an email. “Contemporary hardware and software systems often contain both original code and code inherited from existing libraries. Once a system is deployed the vulnerabilities in the system may persist for a very long period of time – impacting the performance and effectiveness of the system.”
Merza added that the decision to identify vulnerabilities is a step in the right direction and demonstrates a “sustained focus beyond the recent bug bounty program.”
Pino described the newly repurposed funds as R&D going to “towards understanding to what extent there are risks associated with all the platforms that we’re currently using.”
“You’re not buying or you’re not doing new development but there’s tremendous learning associated with what those designs are capable of doing, what adversaries are possibly capable of doing and the mitigations that will be identified and I think it’s going to allow for us as we look forward to future design development work to make those designs more robust,” he told C4ISRNET.
Pino said DoD hopes to get all of the assessments completed over the next three years.
