Organizations that are traditionally associated with cybersecurity, such as  NSA and Cyber Command, support some aspects of weapon systems  cybersecurity. Multiple Factors Make Weapon Systems Cybersecurity Increasingly Difficult, but DOD Is Just Beginning to Grapple with the Challenge

Multiple factors contribute to the current state of DOD weapon systems  cybersecurity, including: the increasingly computerized and networked  nature of DOD weapons, DOD’s past failure to prioritize weapon systems  cybersecurity, and DOD’s nascent understanding of how best to develop  more cyber secure weapon systems. Specifically, DOD weapon systems  are more software and IT dependent and more networked than ever  before. This has transformed weapon capabilities and is a fundamental  enabler of the United States’ modern military capabilities. We and others have warned of these  risks for decades. Nevertheless, until recently, DOD did not prioritize  cybersecurity in weapon systems acquisitions. Tests Revealed that Most Weapon Systems Under Development Have Major Vulnerabilities, and DOD Likely Does Not Know the Full Extent of the Problems

We found that from 2012 to 2017, DOD testers routinely found mission- critical cyber vulnerabilities in nearly all weapon systems that were under  development. Using relatively simple tools and techniques, testers were  able to take control of these systems and largely operate undetected. Poor password management was a common problem in the  test reports we reviewed. This is, in part, because cybersecurity  assessments do not reflect the full range of threats that weapon systems  may face in operation. System-specific limitations can also affect test results. To improve the state of  weapon systems cybersecurity, it is essential that DOD sustain its  momentum in developing and implementing key initiatives. Reflect  representative cyber threats. In response to this direction and The DOD Cyber Strategy, which also  calls for DOD to assess and initiate improvements to the cybersecurity of  current and future weapons systems, DOD is taking steps to improve its  understanding of its weapon systems’ vulnerabilities, determine how to  mitigate risks from those vulnerabilities, and inform future development of  more secure systems. DOD Faces Systemic Barriers to Improving Weapon Systems Cybersecurity

DOD faces barriers that will challenge its ability to develop more cyber  resilient weapon systems and make it more difficult for DOD’s recent  policy changes and new initiatives to be as effective as possible. Access to  information about vulnerabilities makes it easier for potential adversaries  to attack DOD systems. Appendix I: Scope and Methodology

To identify factors that contribute to the current state of Department of  Defense (DOD) weapon systems cybersecurity, we reviewed reports  published from 1991 to the present on software, information technology,  networking, and weapon systems from the National Research Council,  the Defense Science Board, GAO, DOD’s Director of Operational Test  and Evaluation, DOD’s Joint Chiefs of Staff, and the RAND Corporation. Selected program offices reflecting a purposeful sample of nine major  defense acquisition program offices. To determine the steps DOD is taking to develop more cyber resilient  weapon systems, we analyzed key DOD information  assurance/cybersecurity, acquisition, requirements, and testing policies  and guidance that have been updated since 2014 to better address  weapon systems cybersecurity.
Why GAO Did This Study

DOD plans to spend about $1.66 trillion to develop its current portfolio of major weapon systems. Potential adversaries have developed advanced cyber-espionage and cyber-attack capabilities that target DOD systems. Cybersecurity—the process of protecting information and information systems—can reduce the likelihood that attackers are able to access our systems and limit the damage if they do.
GAO was asked to review the state of DOD weapon systems cybersecurity. This report addresses (1) factors that contribute to the current state of DOD weapon systems' cybersecurity, (2) vulnerabilities in weapons that are under development, and (3) steps DOD is taking to develop more cyber resilient weapon systems.
To do this work, GAO analyzed weapon systems cybersecurity test reports, policies, and guidance. GAO interviewed officials from key defense organizations with weapon systems cybersecurity responsibilities as well as program officials from a non-generalizable sample of nine major defense acquisition program offices.

What GAO Found

The Department of Defense (DOD) faces mounting challenges in protecting its weapon systems from increasingly sophisticated cyber threats. This state is due to the computerized nature of weapon systems; DOD's late start in prioritizing weapon systems cybersecurity; and DOD's nascent understanding of how to develop more secure weapon systems. DOD weapon systems are more software dependent and more networked than ever before (see figure).
Automation and connectivity are fundamental enablers of DOD's modern military capabilities. However, they make weapon systems more vulnerable to cyber attacks. Although GAO and others have warned of cyber risks for decades, until recently, DOD did not prioritize weapon systems cybersecurity. Finally, DOD is still determining how best to address weapon systems cybersecurity.
In operational testing, DOD routinely found mission-critical cyber vulnerabilities in systems that were under development, yet program officials GAO met with believed their systems were secure and discounted some test results as unrealistic. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications. In addition, vulnerabilities that DOD is aware of likely represent a fraction of total vulnerabilities due to testing limitations. For example, not all programs have been tested and tests do not reflect the full range of threats.
DOD has recently taken several steps to improve weapon systems cybersecurity, including issuing and revising policies and guidance to better incorporate cybersecurity considerations. DOD, as directed by Congress, has also begun initiatives to better understand and address cyber vulnerabilities. However, DOD faces barriers that could limit the effectiveness of these steps, such as cybersecurity workforce challenges and difficulties sharing information and lessons about vulnerabilities. To address these challenges and improve the state of weapon systems cybersecurity, it is essential that DOD sustain its momentum in developing and implementing key initiatives. GAO plans to continue evaluating key aspects of DOD's weapon systems cybersecurity efforts.

What GAO Recommends

GAO is not making any recommendations at this time. GAO will continue to evaluate this issue.