Despite conventional wisdom that may suggest otherwise, the Department of Defense is willing to pay extra for security measures in defense systems bought from contractors, Pentagon officials said at the Professional Services Council Federal Acquisition Conference June 13.<\/p>\n\n\n\n
\u201cSecurity is an allowable cost,\u201d said Katie Arrington, special assistant to the assistant secretary of defense for acquisition for cyber. She emphasized that philosophy had the backing of her boss, Kevin Fahey, assistant secretary of defense for acquisition.<\/p>\n\n\n\n
Fahey criticized those who say security should be a trade-off in an acquisition, which places the criteria on the same plane as cost, schedule and performance.<\/p>\n\n\n\n
\u201cThat\u2019s stupid as shit,\u201d Fahey said. He added, \u201cin our contracts in the future, cyber is going to be a requirement.\u201d<\/p>\n\n\n\n
The federal acquisition process is primarily driven by the need to meet cost, performance and scheduling goals, an emphasis that poses a major security risk, according to a 2019 report from the MITRE Corporation, a non-profit organization that does government research. Instead, the report said, the Defense Department needs to focus on security measures.<\/p>\n\n\n\n
\u201cDefense acquisition only will function in a secure environment,\u201d Arrington said. \u201cOnly. So cost, schedule and performance cannot be traded for security.\u201d<\/p>\n\n\n\n
Under the current system, Arrington said, it\u2019s like someone bought a Maserati, installed a high-tech security system, put up a fence around it, but then left the gate open, the keys on the dashboard and the doors open. Now, she said the government and industry must think critically about security.<\/p>\n\n\n\n
\u201cIt\u2019s not the new widget and software, it\u2019s the process you have to think about in security,\u201d Arrington said.<\/p>\n\n\n\n
Because so many contractors have access to Defense Department data, Arrington stressed that the department and contractors must work together on the security issues.<\/p>\n\n\n\n
Intellectual property theft from adversaries, such as China, is a primary threat faced by Defense Department and its contractors. China accounted for more than 90 percent of Justice Department\u2019s economic espionage cases and two-thirds of its trade secrets cases from 2011-2018, according to a Congressional Research Service report.<\/p>\n\n\n\n
\u201cWe should be infuriated as a nation about what\u2019s happened to our data,\u201d Arrington said.<\/p>\n\n\n\n
The MITRE report noted that the Defense Department\u2019s financial influence – and its $700 billion budget – can impose the security changes needed on thousands of businesses. And Pentagon leaders appear to be willing to flex those muscles with its newly announced Cybersecurity Maturity Model Certification, an effort to create one unified cybersecurity standard. The DoD is working with Johns Hopkins University and Carnegie Mellon University to develop that criteria.<\/p>\n\n\n\n
\u201cWe all know that what we\u2019ve been doing isn\u2019t working so we have to come up with a different solution,\u201d Fahey said.<\/p>\n\n\n\n
The new model will include third party cybersecurity certifiers to \u201cconduct audits, collect metrics, and inform risk mitigation for the entire supply chain,\u201d Arrington\u2019s presentation said.<\/p>\n\n\n\n
\u201cEvery contract that goes out will have a requirement and every vendor on that contract will have to get certified,\u201d Arrington said. \u201cSecurity is an allowable cost.\u201d<\/p>\n\n\n\n
How security will be measured is another challenge faced by government agencies as they work to implement tighter security requirements on their systems. Arrington and Joyce Corell, assistant director of supply chain and cyber directorate at the Office of the Director of National Intelligence, said their agencies need to move away from compliance checklists to assess security.<\/p>\n\n\n\n
\u201cIt has to be something more than a compliance checklist that we can measure,\u201d Corell said.<\/p>\n\n\n\n
The new DoD standard will not allow contractors to self-attest because \u201cwhen you look in the mirror, it\u2019s really hard to find flaw,\u201d Arrington said.<\/p>\n\n\n\n
\u201cIf we were all honestly doing all of the \u2026 requirements, there wouldn\u2019t be a plane flying around from China that looks suspiciously like the F-35,\u201d she said. \u201cI can\u2019t say it any clearer than that, ladies and gentlemen. If we were all doing it right, that wouldn\u2019t be happening.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Department of Defense leaders said they are willing to pay more for security measures in defense systems bought from contractors.<\/p>\n","protected":false},"author":7,"featured_media":29179,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":19,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[160,36,19],"tags":[],"coauthors":[3340],"class_list":["post-25699","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-news-roundup","category-newsletters","category-pentagon"],"acf":{"subheadline":"","legacy_arc_id":"2DR4UDF75RDXRO2NPZ3WAGRLIQ","arc_canonical_url":"\/dod\/2019\/06\/13\/the-new-way-security-factors-into-acquisitions\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n