{"id":26333,"date":"2018-12-11T20:27:12","date_gmt":"2018-12-11T20:27:12","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2018\/12\/11\/the-pentagons-plan-to-secure-sensitive-systems\/"},"modified":"2026-08-08T18:17:36","modified_gmt":"2026-08-08T18:17:36","slug":"the-pentagons-plan-to-secure-sensitive-systems","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/cyber\/2018\/12\/11\/the-pentagons-plan-to-secure-sensitive-systems\/","title":{"rendered":"The Pentagon\u2019s plan to secure sensitive systems"},"content":{"rendered":"\n

The Pentagon is looking to overcome a resource-constrained environment by certifying commercial companies to conduct cybersecurity assessments of Department of Defense systems under a program directed by Congress.<\/p>\n\n\n\n

The Strategic Cybersecurity Program was part of the fiscal 2018 annual defense policy bill, which meant it was signed in 2017. It directs the Pentagon to establish a program and assign personnel to improve the cybersecurity of offensive cyber systems, long-range strike systems, nuclear deterrent systems, national security systems and critical infrastructure of DoD.<\/p>\n\n\n\n

However, there are just too many systems and too little resources available.<\/p>\n\n\n\n

The program\u2019s director, Patrick Arvidson, special assistant to the Office of the National Manager for National Security Systems at the National Security Agency, asserted there are likely over 4,500 systems and only nine certified NSA red teams across the various combatant commands.<\/p>\n\n\n\n

\u201cThere\u2019s no way that I can do an assessment of that many systems and I don\u2019t even know what that term means yet,\u201d he told an audience of mostly contractors Dec. 6 at the Charleston Defense Contractors Association Defense Summit.<\/p>\n\n\n\n

When asked by the deputy secretary of defense what his plan is, Arvidson replied that he would certify commercial companies, acknowledging that he still has some work to do to figure out what exactly how to do it.<\/p>\n\n\n\n

This approach has the added benefit, he said, of inspecting the defense industrial base. The 2018 DoD cyber strategy asserts that DoD assets must be prepared to defend non-DoD-owned defense critical infrastructure and defense industrial base networks and systems, somewhat of a departure from years past.<\/p>\n\n\n\t