The Department of Defense is behind on several internal cybersecurity initiatives, years after some were expected to be completed, Congress\u2019 watchdog agency has found.<\/p>\n\n\n\n
An April 13 report from Government Accountability Office report, titled “DOD Needs to Take Decisive Actions to Improve Cyber Hygiene,\u201d warned that the Pentagon faces increased cybersecurity risk because the department hasn\u2019t implemented basic cybersecurity practices.<\/p>\n\n\n\n
\u201cOverall, until DOD completes its cyber hygiene initiatives and ensures that cyber practices are implemented, the department will face an enhanced risk of successful attack,” GAO officials wrote.<\/p>\n\n\n\n
The watchdog evaluated three Pentagon initiatives: DOD Cybersecurity Culture and Compliance Initiative (DC3I), Cybersecurity Discipline Implementation Plan (CDIP), and cyber awareness training.<\/p>\n\n\n\n
The DC3I initiative, which is aimed at boosting cyber training and integrating cyber into operational exercises, included 11 tasks that were expected to be implemented at the end of fiscal 2016. However, the GAO found that seven of those tasks are not yet complete. For example, as of October, some defense organizations haven\u2019t received two cybersecurity training briefs created by U.S. Cyber Command for leadership training that would\u2019ve provided important cybersecurity information, according to the report,<\/p>\n\n\n\n
If these documents had been provided, \u201cthey may have learned, among other things, how to understand, assess, and interpret cyber-reportable events and incidents and how they affect military operations,\u201d the GAO wrote.<\/p>\n\n\n\n
The report also found that the seven remaining DC3I initiatives weren\u2019t completed because the DoD\u2019s Chief Information Officer\u2019s office didn\u2019t take steps to ensure their implementation. Leaders from the Pentagon\u2019s CIO office told the GAO that they weren\u2019t aware of this responsibility, although it has been tasked with the duty since December 2016.<\/p>\n\n\n\n
\u201cIf DOD CIO does not take appropriate steps to ensure that the DC3I tasks are implemented, the department risks compromising the confidentiality, integrity, and availability of mission-critical information as a result of human error by users on the department\u2019s networks,\u201d GAO officials wrote.<\/p>\n\n\n\n
Details about the status of several pieces of the DoD\u2019s Cybersecurity Discipline Implementation Plan, an initiative with 17 tasks focused on eliminating preventable vulnerabilities from Pentagon networks, are murky. Four of the 10 tasks led by the CIO\u2019s office remain incomplete. However, the status of seven others are unknown because \u201cno DOD entity has been designated to report on the progress,\u201d the report said.<\/p>\n\n\n\n
Some tasks that lack a lead for implementation include basic cybersecurity hygiene capabilities include disabling links in emails and ensuring cyber incident response plans are documented and properly exercised. As for the four tasks the DoD CIO office didn\u2019t complete, officials told the GAO the tasks are difficult to implement because of the old IT system used by DoD components.<\/p>\n\n\n\n
The Defense Department also hasn\u2019t fully adopted its 2018 Cyber Awareness Challenge Training, a program meant to teach the DoD workforce best cybersecurity practices, the report said. However, the DoD found that several components across the department didn\u2019t collect information on the completion rate of the training.<\/p>\n\n\n\n
For example, the Army couldn\u2019t provide data on the number of users who had completed the training. Meanwhile, six components, including the Navy, Air Force, Marine Corps and European Command, didn\u2019t collect information on who hadn\u2019t completed the training. Navy officials told GAO that they didn\u2019t see the value in collecting and reporting data to its headquarters.<\/p>\n\n\n\n
The GAO also wrote that eight of 16 components evaluated didn\u2019t know how many users had their network access revoked because they hadn\u2019t completed the training.<\/p>\n\n\n\n
\u201cIf the DOD component heads do not ensure that their respective components accurately monitor and report information on the extent that users have completed the Cyber Awareness Challenge training\u2014as well as have access revoked for not completing the training\u2014the components may be unable to ensure that DOD users are trained in the steps needed to address cybersecurity threats to the department,\u201d GAO wrote.<\/p>\n\n\n\n
The department has also identified the 177 cyberattack techniques used by adversaries, prioritized them by level of risk and released cyber hygiene practices to mitigate the most frequent attacks. However, the department doesn\u2019t know the extent to which they are used.<\/p>\n\n\n\n
\u201cNo component or office within the department has complete visibility of the department\u2019s efforts to implement these protective practices across the department,\u201d the GAO found.<\/p>\n\n\n\n
The GAO made seven recommendations to the department, ranging from ensuring that the three cybersecurity initiatives are completed to accurate monitoring and tracking of implementation of different aspects of cyber hygiene.<\/p>\n\n\n\n
The department fully agreed with just one recommendation \u2013 that all components be required to take the Cyber Awareness Challenge training. <\/p>\n","protected":false},"excerpt":{"rendered":"
It’s unclear who’s in charge of what cybersecurity tasks across the Defense Department.<\/p>\n","protected":false},"author":7,"featured_media":45845,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["watchdogs","federal-oversight","it-networks","home","daily-brief","newsletters","it-cloud-report"],"primary_category":"watchdogs"},"10":{"categories":["pentagon","daily-news-roundup","newsletters","ebb"],"primary_category":"pentagon"}}},"categories":[106,29,32],"tags":[],"coauthors":[3252],"class_list":["post-15615","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"4IL473OXLFA63MF6P3S4HB7XH4","arc_canonical_url":"\/dod\/2020\/04\/13\/watchdog-finds-the-pentagon-is-behind-on-several-cybersecurity-initiatives\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n