{"id":18971,"date":"2020-03-17T16:47:14","date_gmt":"2020-03-17T16:47:14","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2020\/03\/17\/the-pentagon-is-handling-cyber-vulnerabilities-inconsistently\/"},"modified":"2026-08-08T18:00:03","modified_gmt":"2026-08-08T18:00:03","slug":"the-pentagon-is-handling-cyber-vulnerabilities-inconsistently","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/cyber\/2020\/03\/17\/the-pentagon-is-handling-cyber-vulnerabilities-inconsistently\/","title":{"rendered":"The Pentagon is handling cyber vulnerabilities inconsistently"},"content":{"rendered":"\n

The Department of Defense has not consistently mitigated cyber vulnerabilities identified in a 2012 report, according to the department\u2019s inspector general.<\/p>\n\n\n\n

The DoD IG issued a follow-on report to its 2012 report, issued March 13 and made public March 17<\/a>, that determined cyber red teams didn\u2019t report the results of assessments to organizations and components didn\u2019t effectively correct or mitigate the identified vulnerabilities.<\/p>\n\n\n\n

The new report discovered that components didn\u2019t consistently mitigate or include unmitigated vulnerabilities identified in the prior audit and during this audit by red teams during combatant command exercises, operational testing assessments and agency-specific assessments in plans of action and milestones.<\/p>\n\n\n\n

\u201cEnsuring DoD Components mitigate vulnerabilities is essential to achieve a better return on investment,\u201d the report stated. \u201cIn addition, we determined that the DoD did not establish a unified approach to support and prioritize DoD Cyber Red Team missions. Instead, the DoD Components implemented Component-specific approaches to staff, train and develop tools for DoD Cyber Red Teams, and prioritize DoD Cyber Red Team missions.\u201d<\/p>\n\n\n\n

The report found that DoD didn\u2019t establish a unified approach because it didn\u2019t assign an organization with responsibility to oversee and synchronize red team activity based on priorities, it didn\u2019t assess the resources needed for each red team and identify requirements to train them to meet priorities and it didn\u2019t develop baseline tools to perform assessments.<\/p>\n\n\n\n

\u201cWithout an enterprisewide solution to staff, train and develop tools for DoD Cyber Red Teams and prioritize their missions, DoD Cyber Red Teams have not met current mission requests and will not meet future requests because of the increased demands for DoD Cyber Red Team services,\u201d the report said. \u201cUntil the DoD assigns an organization to assess DoD Cyber Red Team resources, it will be unable to determine the number of DoD Cyber Red Teams and staffing of each team to support mission needs, which will impact the Do D\u2019s ability to identify vulnerabilities and take corrective actions that limit malicious actors from compromising DoD operations.\u201d<\/p>\n\n\n\n

The DoD IG issued seven recommendations the secretary of defense assign an organization responsibility for. They include:<\/p>\n\n\n\n