Many in U.S. industry \u2014 even some among key defense suppliers \u2014 do not grasp the extent to which our defense posture has suffered from unauthorized extraction of technical information.\u00a0This is a persistent and evolving threat \u2014 and one where there is ample evidence that nation-state rivals and commercial competitors have “feasted” at our expense by employing network-directed cyberattacks to steal and then exploit valuable information.<\/p>\n\n\n\n
The Department of Defense’s DoD\u2019s “<\/span>Better Buying Power 3.0“<\/span> states plainly that compromise of unclassified, controlled, technical information “can significantly degrade U.S. technological superiority by saving an adversary time and effort in developing similar capabilities or countermeasures.”\u00a0Where contractor information systems host sensitive DoD technical information that is vulnerable to extraction, it is likely that company proprietary information and trade secrets are similarly exposed.\u00a0<\/p>\n\n\n\n DoD has wielded its acquisition authority to obligate contractors to improve protection of technical information through the\u00a0“Unclassified Controlled Technical Information” (UCTI)\u00a0<\/span>Defense Federal Acquisition Regulation Supplement, and more recently, by the “Network Penetration” DFARS, which includes National Institute of Standards and Technology’s SP 800-171 \u2014 new safeguards specifically intended for commercial organizations.\u00a0First in 2013, through the “Unclassified Controlled Technical Information” (UCTI) Defense Federal Acquisition Regulation Supplement, and more recently, in 2015, by the “Network Penetration” DFARS, DoD has wielded its acquisition authority to obligate contractors to improve protection of technical information.\u00a0On Dec. 30, 2015, by an amendment to the “Network Penetration” Interim Rule, DoD decided to postpone, until Dec. 31, 2017, obligations to fully comply with the National Institute of Standards and Technology SP 800-171 \u2014 the new safeguards specifically intended for commercial organizations. This decision was regrettable, because the extraction threat is immediate and continuing, but necessary for practical reasons.\u00a0Some in the defense industrial base were uncertain how to comply and many companies were surprised by and unprepared for the new DFARS requirements.\u00a0They needed the time to assess the state of existing cyber measures and to implement improvements, as necessary to fill gaps and\u00a0to satisfy the 109 controls stated in SP 800-171.<\/span><\/p>\n\n\n\n Under the “Network Penetration” DFARS, new DoD contracts are subject to DFARS 252.204\u20137012 (“Safeguarding Covered Defense Information and Cyber Incident Reporting”).\u00a0This \u2018S<\/span>safeguarding“<\/span> clause imposes a direct and immediate security obligation on defense contractors. It states:\u00a0<\/p>\n\n\n\n “The Contractor shall provide adequate security for all covered defense information [CDI] on all covered contractor information systems that support the performance of work under this contract.”<\/p><\/p>\n\n\n\n For contractor information systems, the “S<\/span>safeguarding“<\/span> clause requires implementation, “at a minimum,” the security requirements of SP 800-171, and this must be done “as soon as practical, but not later than Dec.ember<\/span> 31, 2017.” Some in the defense industrial base were\u00a0uncertain how to comply with\u00a0and many companies were\u00a0surprised by\u00a0and unprepared for<\/span>\u00a0the new DFARS requirements. They also needed time to assess the state of existing cyber measures and to implement improvements, as necessary to fill gaps and<\/span>\u00a0to satisfy the 109 controls stated in SP 800-171.\u00a0<\/p>\n\n\n\n Flowdown of the “S<\/span>safeguarding“<\/span> clause is required \u2014 “without alteration” \u2014 to subcontractors who receive or host CDI.<\/p>\n\n\n\n DoD\u2019s largest contractors are likely to have in place already systems to protect CDI that meet or exceed the requirements of SP 800-171.\u00a0As to medium-sized and smaller businesses, the risks increase.\u00a0Adversaries recognize that valuable, technical information is accessible not just through at the <\/span>“tier 1” contractors, where we can expect relatively good cyber measures, but also “<\/span>down“<\/span> the supply chain, where protection is less assured<\/span>.<\/p>\n\n\n\n There is some anecdotal evidence that medium-sized companies are approaching the cyber obligations of the “Network Penetration” rules cautiously, and that smaller companies are doing little while they wait to see how compliance can be achieved affordably and without business disruption.\u00a0Some companies may contemplate leaving the defense supply chain out of concern over the burdens and costs of the new cyber requirements.\u00a0This is not in DoD’s interest \u2014 and could deprive higher tier contractors of essential and trusted specialty suppliers.<\/p>\n\n\n\n DoD needs to help solve this problem\u00a0and should do so with the active cooperation of the larger primes.\u00a0DoD may need to make funding available to assist its industrial base in compliance with new cyber protection demands.\u00a0Added protection comes at a cost to those who implement it and thus at a price to DoD.\u00a0At a more technical level, DoD needs to work with NIST to develop ways that authorize smaller businesses to employ third-party, cloud-based resources to handle the access, authentication and security requirements imposed when these companies receive CDI. And these developments Ways <\/span>need to be promoted to protect this information without costly obligations to reconfigure enterprise–<\/span>wide information systems.<\/p>\n\n\n\n The approach of NIST SP 800-171 focuses upon protectingion<\/span> of<\/span> information systems, but as the means <\/span>to protect the information hosted on those systems<\/span>.\u00a0<\/span>W<\/span>we might take a lesson from several of the notorious security breaches of recent years.\u00a0Protection of the information system,<\/span> as if it were a “citadel,” or <\/span>a “<\/span>castle“<\/span> with barriers (e.g., firewalls) constituting a veritable “moat,” <\/span>has not worked well when where <\/span>massive amounts of information, once extracted from the information system<\/span>, are unprotected and freely transferable. Technical measures are available to encrypt and otherwise control or, even<\/span> deny,<\/span> access and rights to sensitive but unclassified information.\u00a0Digital rights management, as can be cloud-enabled or premises-based,<\/span> provides a means to retain control over access to and use\u00a0rights in <\/span>sensitive information even after initial transfer to an intended and<\/span> authorized recipient or and even <\/span>in the event of a successful but unauthorized extraction.\u00a0Future governmental cyber initiatives should encourage and, where necessary, enable the use of these methods.<\/p>\n\n\n\n (I’ll return to the Internet of Things and cyber\/physical threats in future Federal Times<\/em> blogs.)<\/p>\n\n\n\n Robert Metzger is a shareholder at law firm Rogers Joseph O’Donnell PC, where he’s a member of the Government Contracts Practice Group and head of the Washington, D.C., office.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" The Defense Department must work with the industrial base to protect technical information from cyberattacks.<\/p>\n","protected":false},"author":7,"featured_media":37618,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":26,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[15,26],"tags":[],"coauthors":[2744],"class_list":["post-22009","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-management","category-opinions"],"acf":{"subheadline":"","legacy_arc_id":"CBFWWOGKNRG5BL6X62VZ2WECAI","arc_canonical_url":"\/opinions\/2016\/04\/26\/secure-networks-critical-to-maintaining-dod-tech-edge\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n