U.S. Cybersecurity Status Weak, Reports Charge

The Department of Defense is "not prepared" to defend against sophisticated international cyber attacks, and government-wide, agencies have failed to meet some White House cybersecurity targets, according to two new reports.

Although the reports differ in tone and structure -- one demands urgent action by the military and the other is a straightforward compliance report -- together they underscore the hard work the government still has ahead of it as it faces an onslaught of increasingly sophisticated cyber attacks.

The report on the military, a study by the Defense Science Board, a civilian committee providing solicited scientific and technical advice to DOD leadership, finds that the Department of Defense is woefully unprepared to fight in cyberspace due to "inherently insecure architectures," fragmented efforts, "inadequate" intelligence and the sheer limits of today's technology.

[ Will the finger pointing only get worse? Read China Targets U.S. In Hacking Blame Game. ]

"Without an urgently implemented and comprehensive strategy to offset the cyber security threat, U.S. national objectives will be nearly impossible to achieve in times of crisis," said the report on the military. "Additionally, the long term loss of so much intellectual property and capability will result in a serious competitive disadvantage to the U.S. economy."

The report warns of cyber attacks that could disrupt military actions by turning U.S. weapons against its own troops, and of civilian attacks that could disrupt food and medical distribution systems and make transportation systems "useless."

Despite the committee's concerns, however, the Defense Science Board says it thinks the challenges manageable. "The Department can effectively manage the risks presented by the cyber threat," the report notes.

In order to meet the challenges, the report prescribes a set of actions the military must take, from more aggressive pursuit of cyber intelligence to the use of deterrence to improved cyber defenses, to the adoption of metrics to measure performance against the military's cyber goals.

The report calls on the military to develop offensive cyber capabilities, including the development of a formal career path for both civilian and military workers involved in offensive cyber "actions"; strengthen the "cyber resiliency" of military vehicles and weaponry from submarines to bombers; and establish an enterprise security architecture.

The report also encourages the DOD's CIO to work with the military branches to create an "enterprise security architecture" that includes minimum standards to ensure a "reasonable" level of defensibility, and to increase the probability that attacks are detected. The report recommends these standards be integrated as requirements in new acquisitions and that existing systems be audited to ensure that the architecture is in place.

Putting the report's recommendations into place will not come cheaply. The report estimates that just providing the resources necessary to secure the U.S. nuclear arsenal will cost more than $500 million annually. Implementing these changes will also take time. The report predicts that it will take "years" for the military to execute an "effective" multi-part response to cyber threats.

The White House report, meanwhile, says agencies have seen a drop in compliance with White House goals over the last year, although the report notes that this is "associated with adjustments and improvements to measurement methodology" as opposed to any actual weakening of the government's cybersecurity readiness.

The recalibration should help improve agencies' cybersecurity stances, but the need for recalibration itself shows that the White House has been operating with a less-than-complete picture of agencies' cybersecurity.

Regardless of the reason behind the decrease in agencies' compliance scores, the metrics aren't all rosy. Only half of the agencies measured reached the fiscal 2013 goal for automated asset management, and a third of agencies reported actual decreases in automated vulnerability management, for example.

The report also tracks compliance with a requirement that employees and contractors use Personal Identity Verification (PIV) cards to access federal IT systems. Most agencies fall short of this requirement. The DOD and General Services Administration are heavy users of PIV cards, but at half of the agencies surveyed, only 2% of employees were using the cards to access agency IT systems.

The White House report said that the Office of Management and Budget and the White House's National Security Staff will work with agencies that appear to risk failing to meet White House cybersecurity performance standards, either through metrics-heavy CyberStat meetings with top agency IT staff or by "other appropriate action."

Overall, the picture appears mixed for federal agencies. For example, agencies appear to be meeting or close to meeting minimum targets on continuous monitoring, strong authentication and the Trusted Internet Connections network connection consolidation effort. The White House projects that agencies will far outstrip initial goals by early next in fiscal 2014.

The government in recent years has been aggressively pushing to improve cybersecurity and to make sure that the military is ready for disruptive cyber attacks. Although the White House and DOD reports indicate less-than-complete progress toward those goals, they also by their very nature inch the government closer to meeting those goals.

Still, the reports show that much work is left to be done to bring agencies fully into line with White House goals, and perhaps more work is left to ensure that the military is able to adequately defend the nation in cyberspace.