U.S. weapon systems cybersecurity failing, GAO report says

Expert reactions

Experts such as Edgard Capdevielle, CEO of industrial cybersecurity vendor Nozomi Networks, were disturbed by the ease with which GAO testers were able to hack DoD weapons systems.

"The recent report from the government watchdog shows that attackers could have exploited these weaknesses quite easily -- and wouldn't have needed sophisticated tools to do so. This is a reality that we're seeing more and more of -- that attackers nowadays no longer need the resources or skill of a nation-state in order to pull off a successful attack," Capdevielle wrote via email. "The current threat landscape is quickly expanding as attackers with various levels of sophistication are more easily finding the tools and tactics needed to be successful and government organizations need to sit up and take action."

Mike Riemer, chief security architect at Pulse Secure, said the military has a more complicated challenge with weapon systems cybersecurity because it has the "added wrinkle of protecting access to assets on the battlefield."

"We see similar issues in other industries, such as utilities and transportation, which are also critical to our nation and now vulnerable as the internet of things becomes pervasive. But unlike commercial network environments, military systems operate in fluid environments where security must protect the weapons system, but also adapt to changing groups, roles, geography, command relationships and other access determinants," Riemer wrote via email. "That goes beyond commercial multifactor authentication, requiring additional authentication and protected connection mechanisms where testing the management and scale of conditional access policy under a zero-trust model is required."

Pravin Kothari, CEO of CipherCloud, noted that the military setting of these systems may actually mean basic cybersecurity is better in some ways compared to enterprise settings.

"Many of these weapons systems are absolutely not online to external networks. This is intentional. Many of these specialized weapons systems do not use a standard TCP/IP protocol, but instead may use proprietary, highly specialized network communications protocols and encryption techniques specifically designed for that weapons system program," Kothari wrote via email. "And the most important to your health -- if you do try to get in close proximity to a classified weapons system, it won't be more than a few seconds before a highly motivated marine interrupts your activities. Let's get real here. If there were real actionable deficiencies to classified weapons systems, they're getting worked on furiously right now. Rest assured the vulnerabilities would not be detailed as a how-to manual for hostile nation-states in a GAO non-classified report."

Experts also said that although the findings of the GAO report painted a bad picture of weapon systems cybersecurity, there is reason to be optimistic simply because this report was created.

Bob Taylor, former principal deputy general counsel for the DoD and current senior counsel at Hogan Lovells, based in Washington, D.C., said it was "heartening to see such a frank and brutal assessment of shortcomings because being aware of and facing those shortcomings create the conditions necessary for their correction."

"Fixing the problems revealed in the report will require personnel up and down the chain of command to be aware of the current failings, and to be committed, really committed, to addressing them," Taylor wrote via email. "It is, first and foremost, a matter of leadership and commitment."

Jason Haward-Grau, CISO at PAS in Houston, agreed that it was good news that "these issues have been identified now, so they can be addressed."

"Knowing where you are and where your vulnerabilities lie is the first step to being able to address it. Cybersecurity is now very much front and center in most organizations and the concepts of getting and keeping your house in order are gaining traction," Haward-Grau wrote via email. "It is also now recognized that the exploitation of any system will happen and there is a significant focus on ensuring that when it happens the detection is fast, the response is effective, and ultimately, the risk to operations is minimized. This is even more critical in an industry where kinetic weapon platforms are in play."

However, not all experts were so optimistic. Sherban Naum, senior vice president of corporate strategy and technology at Bromium, noted that a DoD weapon systems cybersecurity vulnerability being exposed "is so much costlier than at the enterprise level."

"We can replace credit card records or restore customer loyalty. We can't undo a rival nation-state potentially roaming undetected inside weapons systems because there were insufficient security investments in modular, run-time security," Naum wrote via email. "It's time for the federal government to make cybersecurity a national priority, and ensure it is treated as such during the development of systems outlined in the GAO report."