What GAO Found 
 
 The Department of Defense (DOD) faces mounting challenges in protecting its weapon systems from increasingly sophisticated cyber threats. This state is due to the computerized nature of weapon systems; DOD's late start in prioritizing weapon systems cybersecurity; and DOD's nascent understanding of how to develop more secure weapon systems. DOD weapon systems are more software dependent and more networked than ever before (see figure). 
 
 Embedded Software and Information Technology Systems Are Pervasive in Weapon Systems (Represented via Fictitious Weapon System for Classification Reasons) 
 
 Automation and connectivity are fundamental enablers of DOD's modern military capabilities. However, they make weapon systems more vulnerable to cyber attacks. Although GAO and others have warned of cyber risks for decades, until recently, DOD did not prioritize weapon systems cybersecurity. Finally, DOD is still determining how best to address weapon systems cybersecurity. 
 
 In operational testing, DOD routinely found mission-critical cyber vulnerabilities in systems that were under development, yet program officials GAO met with believed their systems were secure and discounted some test results as unrealistic. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications. In addition, vulnerabilities that DOD is aware of likely represent a fraction of total vulnerabilities due to testing limitations. For example, not all programs have been tested and tests do not reflect the full range of threats. 
 
 DOD has recently taken several steps to improve weapon systems cybersecurity, including issuing and revising policies and guidance to better incorporate cybersecurity considerations. DOD, as directed by Congress, has also begun initiatives to better understand and address cyber vulnerabilities. However, DOD faces barriers that could limit the effectiveness of these steps, such as cybersecurity workforce challenges and difficulties sharing information and lessons about vulnerabilities. To address these challenges and improve the state of weapon systems cybersecurity, it is essential that DOD sustain its momentum in developing and implementing key initiatives. GAO plans to continue evaluating key aspects of DOD's weapon systems cybersecurity efforts. 
 
 Why GAO Did This Study 
 
 DOD plans to spend about $1.66 trillion to develop its current portfolio of major weapon systems. Potential adversaries have developed advanced cyber-espionage and cyber-attack capabilities that target DOD systems. Cybersecurity—the process of protecting information and information systems—can reduce the likelihood that attackers are able to access our systems and limit the damage if they do. 
 
 GAO was asked to review the state of DOD weapon systems cybersecurity. This report addresses (1) factors that contribute to the current state of DOD weapon systems' cybersecurity, (2) vulnerabilities in weapons that are under development, and (3) steps DOD is taking to develop more cyber resilient weapon systems. 
 
 To do this work, GAO analyzed weapon systems cybersecurity test reports, policies, and guidance. GAO interviewed officials from key defense organizations with weapon systems cybersecurity responsibilities as well as program officials from a non-generalizable sample of nine major defense acquisition program offices. 
 
 What GAO Recommends 
 
 GAO is not making any recommendations at this time. GAO will continue to evaluate this issue. 
 
 For more information, contact Cristina Chaplain, 202-512-4841, or chaplainc@gao.gov. ||||| This crawl of online resources of the 115th US Congress was performed on behalf of The United States National Archives & Records
– A new report out of the Government Accountability Office says the Department of Defense is "just beginning to grapple" with vulnerabilities in most of its new weapons systems. The upshot of the 50-page GAO analysis, per NPR: that, based on five years' worth of tests, "nearly all" of its latest weapons systems are a cybersecurity nightmare, with easy-to-guess passwords and known vulnerabilities that were never remedied, among other issues. Just as concerning is that the DOD doesn't even know "the full scale of its weapon system vulnerabilities" as the tests that were carried out "were limited in scope and sophistication," the GAO notes. The tests, conducted from 2012 to 2017, were initially prompted by a request from the Senate Armed Services Committee to look into just how secure the Pentagon was able to keep its weapons systems. The GAO notes the "widespread examples of weakness" fell under the umbrella of four cybersecurity categories: "protect, detect, respond, and recover." The results weren't great: In one case, for example, a test hacker guessed an admin password in nine seconds; in another, two testers needed just an hour to gain initial access to a weapons system. And, "once they gained initial access, test teams were often able to move throughout a system, escalating their privileges until they had taken full or partial control of a system." To make matters worse, when vulnerabilities were found, they were often neglected: One test report showed just one vulnerability remedied out of 20 identified. Staffing issues contribute to the problem, as the salaries that cybersecurity aces can command in the private sector far exceed those that the government can pay. Full eye-opening report from the GAO here.