As  noted previously, a 2016 Defense Science Board study defined the IoT as  the set of Internet Protocol-addressable devices that interact with the  physical environment, noting that “IoT devices typically contain elements  for sensing, communications, computational processing, and actuation.”  The study identified that IoT devices span a range of complexity and size,  including thermostats, traffic lights, televisions, mini-drones, and full-size  vehicles. DOD Has Identified Security Risks with IoT Devices and Begun to Examine Them in Its Assessments, but Operations Security Surveys Are Not Being Conducted

		DOD Has Identified Security Risks with IoT Devices and Developed Notional Threat Scenarios

DOD documents and officials identified numerous security risks with IoT  devices—as highlighted in table 1—that can generally be divided into  risks with the devices themselves and risks with the devices’ operational  implications. Many of these devices are insecure because of a  limited ability to patch and upgrade devices, or due to poor security  design. Some of these assessments can  be used to identify and examine security risks related to IoT devices. This could potentially include information collected by  IoT devices. DOD Has Policies and Guidance for IoT Devices

DOD has issued a number of policies and guidance for IoT devices,  including personal wearable fitness devices, portable electronic devices,  smartphones, and infrastructure devices associated with industrial control  systems. Policies and Guidance Do Not Address Certain DOD-acquired IoT Devices and Applications

DOD officials told us that existing DOD policies and guidance do not  clearly address security risks relating to smart televisions, and particularly  smart televisions in unsecure areas. These risks include rogue applications and  the unauthorized communication of data to third parties. Although  the procedures were found to be effective, DOD does not have a policy  that directs the implementation of these procedures throughout the  department, according to DOD officials. DOD has made some progress  in addressing the security challenges we identify in this report, including:  (1) identifying a number of IoT security risks and notional threat  scenarios; (2) examining security risks of IoT devices by conducting  assessments on critical infrastructure; (3) developing policies and  guidance for IoT devices; and (4) establishing ongoing efforts, such as  research programs, to mitigate the security risks with these devices. The Principal Cyber Advisor, in coordination with the DOD Chief  Information Officer; the Under Secretaries of Defense for Policy;  Intelligence; Acquisition, Technology, and Logistics; and Personnel and  Readiness; and with military service and agency stakeholders, should
Review and assess existing departmental security policies and  guidance—on cybersecurity, operations security, physical security,  and information security—that may affect IoT devices; and  Identify areas where new DOD policies and guidance may be  needed—including for specific IoT devices, applications, or  procedures—and where existing security policies and guidance can  be updated to address IoT security concerns. DOD concurred with our recommendation to conduct operations security  surveys that identify IoT security risks and protect DOD information and  operations, in accordance with DOD guidance, or address operations  security risks posed by IoT devices through other DOD risk assessments. Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to (1) address the extent to which  Department of Defense (DOD) has identified and assessed security risks  related to Internet of Things (IoT) devices; (2) assess the extent to which  DOD has developed policies and guidance related to IoT devices; and (3)  describe other actions DOD has taken to address security risks related to  IoT devices.
Why GAO Did This Study

Congress included provisions in reports associated with two separate statutes for GAO to assess the IoT-associated security challenges faced by DOD. This report (1) addresses the extent to which DOD has identified and assessed security risks related to IoT devices, (2) assesses the extent to which DOD has developed policies and guidance related to IoT devices, and (3) describes other actions DOD has taken to address security risks related to IoT devices.
GAO reviewed reports and interviewed DOD officials to identify risks and threats of IoT devices faced by DOD. GAO also interviewed DOD officials to identify risk assessments that may address IoT devices and examined their focus areas. GAO further reviewed current policies and guidance DOD uses for IoT devices and interviewed officials to identify any gaps in policies and guidance where security risks may not be addressed.

What GAO Found

The Internet of Things (IoT) is the set of Internet-capable devices, such as wearable fitness devices and smartphones, that interact with the physical environment and typically contain elements for sensing, communicating, processing, and actuating. Even as the IoT creates many benefits, it is important to acknowledge its emerging security implications. The Department of Defense (DOD) has identified numerous security risks with IoT devices and conducted some assessments that examined such security risks, such as infrastructure-related and intelligence assessments. Risks with IoT devices can generally be divided into risks with the devices themselves and risks with how they are used. For example, risks with the devices include limited encryption and a limited ability to patch or upgrade devices. Risks with how they are used—operational risks—include insider threats and unauthorized communication of information to third parties. DOD has developed IoT threat scenarios involving intelligence collection and the endangerment of senior DOD leadership—scenarios that incorporate IoT security risks (see figure). Although DOD has begun to examine security risks of IoT devices through its infrastructure-related and intelligence assessments, the department has not conducted required assessments related to the security of its operations.
DOD has issued policies and guidance for IoT devices, including personal wearable fitness devices, portable electronic devices, smartphones, and infrastructure devices associated with industrial control systems. However, GAO found that these policies and guidance do not clearly address some security risks relating to IoT devices. First, current DOD policies and guidance are insufficient for certain DOD-acquired IoT devices, such as smart televisions in unsecure areas, and IOT device applications. Secondly, DOD policies and guidance on cybersecurity, operations security, information security, and physical security do not address IoT devices. Lastly, DOD does not have a policy directing its components to implement existing security procedures on industrial control systems—including IoT devices. Updates to DOD policies and guidance would likely enhance the safeguarding and securing of DOD information from IoT devices.
This is an unclassified version of a sensitive report GAO issued in June 2017.

What GAO Recommends

GAO recommends that DOD (1) conduct operations security surveys that could address IoT security risks or address operations security risks posed by IoT devices through other DOD risk assessments; and (2) review and assess its security policies and guidance affecting IoT devices and identify areas, if any, where new DOD policies may be needed or where guidance should be updated. DOD reviewed a draft of this report and concurs with GAO's recommendations.