For Years, the Pentagon Hooked Everything To The Internet. Now It’s a ‘Big, Big Problem’

A staff member checks a news site at the NATO Computer Incident Response Capability (NCIRC) technical center, at NATO's military headquarters SHAPE in Mons, southwestern Belgium, Tuesday, Dec. 10, 2013.

AP / YVES LOGGHE

AA Font size + Print

A staff member checks a news site at the NATO Computer Incident Response Capability (NCIRC) technical center, at NATO's military headquarters SHAPE in Mons, southwestern Belgium, Tuesday, Dec. 10, 2013.

The Internet of Things is supposed to make life easier. For the Pentagon, the quintessential early adopter, it has made life much harder.

Once upon a time, very smart people in the Pentagon believed that connecting sensitive networks, expensive equipment, and powerful weapons to the open Internet was a swell idea. This ubiquitous connectivity among devices and objects — what we now call the Internet of Things — would allow them to collect performance data to help design new weapons, monitor equipment remotely, and realize myriad other benefits. The risks were less assiduously catalogued.

That strategy has spread huge vulnerabilities across the Defense Department, its networks, and much of what the defense industry has spent the last several decades creating.

“We are trying to overcome decades of a thought process…where we assumed that the development of our weapon systems that external interfaces, if you will, with the outside world were not something to be overly concerned with,” Adm. Michael Rogers, the commander of Cyber Command, told the Senate Armed Services Committee today. “They represented opportunity for us to remotely monitor activity, to generate data as to how aircraft, for example, or ships’ hulls were doing in different sea states around the world. [These are] all positives if you’re trying to develop the next generation of cruiser [or] destroyer for the Navy.”

But in a world where such public interfaces are points of vulnerability, Rogers said, adversaries develop strategies based on stealing Pentagon data, and then fashion copycat weapons like China’s J-31 fighter, which many call a cheaper cousin to the F-35.

“That’s where we find ourselves now. So one of the things I try to remind people is: it took us decades to get here. We are not going to fix this set of problems in a few years,” Rogers told the senators. “We have to prioritize it, figure out where is the greatest vulnerability.”

The 2014 National Defense Authorization Act requires the services to discover and report to the Senate about the cyber vulnerabilities of their weapons and communications systems. That report is overdue, according to Sen. Jeff Sessions, R-Ala.

 At the hearing, Deputy Defense Secretary Robert Work said that Frank Kendall, the Pentagon’s top weapons buyer, is going through virtually the entire U.S. arsenal to understand how hackable is each weapon.

“I expect this work to be done very soon,” Work said.

Such vulnerabilities constitute  “a big, big problem,“ for Work. He added “Most of the weapons systems that we have today were not built to withstand a concerted cyber threat.”

The Defense Department has only recently begun to attack its problems in this area, but it is making an honest effort. Cybersecurity is now listed as a key performance parameter, along with survivability, for every new weapon. Work also described efforts to reduce the number of exploitable attack surfaces within the military — in other words, to shrink the Internet of Things just a bit.

“We’re going from 15,000 enclaves to less than 500,” he said, referring to smaller computing networks governed by a central authority. “We’re going from 1,000 defendable firewalls to less than 200, somewhere between 50 and 200.”

Considering that more than 50 billion interconnected devices will populate the world by the year 2020, by most estimates, the Pentagon’s limited, early-adopter experience of the Internet of Things is enough to give even the most optimistic futurist some serious pause.

Close [ x ] More from DefenseOne
 
 

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

    Download
  • Military Readiness: Ensuring Readiness with Analytic Insight

    To determine military readiness, decision makers in defense organizations must develop an understanding of complex inter-relationships among readiness variables. For example, how will an anticipated change in a readiness input really impact readiness at the unit level and, equally important, how will it impact readiness outside of the unit? Learn how to form a more sophisticated and accurate understanding of readiness and make decisions in a timely and cost-effective manner.

    Download
  • Cyber Risk Report: Cybercrime Trends from 2016

    In our first half 2016 cyber trends report, SurfWatch Labs threat intelligence analysts noted one key theme – the interconnected nature of cybercrime – and the second half of the year saw organizations continuing to struggle with that reality. The number of potential cyber threats, the pool of already compromised information, and the ease of finding increasingly sophisticated cybercriminal tools continued to snowball throughout the year.

    Download
  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

    Download
  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.

    Download

When you download a report, your information may be shared with the underwriters of that document.