Back to news

December 19, 2018 | International, C4ISR

DoD IG: Military networks are exposed to ‘unnecessary’ cyber risks

By:

The military services are exposing networks to “unnecessary cybersecurity risks” thanks in part to a lack of visibility over software application inventories, according to a Department of Defense Inspector General report.

The IG investigated whether DoD components rationalized their software applications by identifying and eliminating any duplicative or obsolete applications. Rationalizing software applications seeks to improve enterprise IT by identifying all software applications on the network; determining if existing applications are needed, duplicative or obsolete; and determining if applications already existing within the network prior to purchasing new ones.

The audit — which focused on Marine Corps, Navy and Air Force commands and divisions — found that the groups examined did not consistently perform this rationalization process. By not having visibility into software application inventories, these organizations were unable to identify the extent of existing vulnerabilities within their applications, the report found.

Moreover, such a process could lead to cost savings associated with eliminating duplicative and obsolete applications.

Fleet Forces Command was the only command the IG reviewed that had a process in place for eliminating duplicative or obsolete applications. The Air Force did not have a process in place to prevent duplication when purchasing new applications.

The report placed blame on the DoD chief information officer for not implementing a solution for software rationalization in response to Federal Information Technology Acquisition Reform Act requirements.

The IG made three recommendations for the CIO, who did not provide a response to draft recommendations:

  • Develop an enterprisewide process for conduction software application rationalization throughout DoD;
  • Establish guidance requiring DoD components to conduct rationalization and require DoD component CIOs to develop implementation guidance outlining responsibilities for rationalization. Such a policy should also require components on at least an annual basis to validate the accuracy of their owned and in use software applications inventory; and
  • Conduct periodic review to ensure components are regularly validating the accuracy of their inventory and they are eliminating duplicative and obsolete applications.

https://www.fifthdomain.com/dod/2018/12/18/dod-ig-military-networks-are-exposed-to-unnecessary-cyber-risks

On the same subject

  • House passes defense spending bill amid F-35, submarine purchase spats

    June 30, 2024 | International, Naval

    House passes defense spending bill amid F-35, submarine purchase spats

    The legislation overrides an authorization bill from the Armed Services Committee that moves in a different direction on attack-submarine and F-35 buys.

  • Second Round Of F-35 Maintenance Work Contracted

    February 14, 2019 | International, Aerospace

    Second Round Of F-35 Maintenance Work Contracted

    Tony Osborne | Aerospace Daily & Defense Report LONDON—Industry in Denmark, Israel, Italy, the Netherlands, Norway, and the UK have secured component repair work for the F-35 Joint Strike Fighter. Work assignments for the maintenance, repair and overhaul work on some 400 repairable items including avionics, life support systems, landing gear, pumps and power systems for the aircraft was issued by the F-35 Joint Program Office (JPO) on Feb. 12. Under current plans, the F-35 enterprise is awarding contracts for more than 770 repairable items on the aircraft. The first batch of 65 of these contracts was issued in late 2016 for so-called high-value electrical components, fuel, mechanical and hydraulic systems, and ejection seats. Having secured the lion's share of the first round of contracts, British industry has also grabbed a significant proportion of work in the second, British government officials have confirmed. This will lead to the creation of additional jobs at Sealand Support Services Limited (SSSL), the joint venture established between BAE Systems Northrop Grummanand the Defense Electronics and Components Agency (DECA). It will carry out the component repair work at its facility in Sealand, Wales, to support European operators of the aircraft. Full article: http://aviationweek.com/defense/second-round-f-35-maintenance-work-contracted

  • DARPA: With Insights from Integration Exercise, SubT Challenge Competitors Prepare for Tunnel Circuit

    April 30, 2019 | International, Land

    DARPA: With Insights from Integration Exercise, SubT Challenge Competitors Prepare for Tunnel Circuit

    Nine teams hailing from four continents gathered in Idaho Springs, Colorado, the week of April 5-11, 2019, to test autonomous air and ground systems for navigating the dark, dangerous, dirty, and unpredictable underground domain. The SubT Integration Exercise, known as STIX, took place at the Colorado School of Mines' Edgar Experimental Mine. The event provided a shakeout opportunity for competitors in advance of the Tunnel Circuit in August, the first of three subdomains that teams will tackle in DARPA's Subterranean Challenge. The teams were divided into three groups. Each group had one day to experiment with their various systems during multiple runs in the mine, followed by a second day in which each team attempted a one-hour mock, scored run. Teams could earn points by accurately locating, identifying, and reporting artifacts placed within the tunnels. Artifacts included thermal manikins, backpacks, fire extinguishers, cell phones, and cordless drills – all inspired by objects an end user such as a warfighter or first responder might encounter. The mine environment presented teams with low light, high dust, metal rails, and irregular terrain. The DARPA team added to the complexity with a theatrical smoke machine, which mimicked real smoke a warfighter or first responder could contend with in an emergency response scenario, for example. “It was amazing to see the progression from day one into day two for each team as they explored the tunnels of the mine and began to understand just how complex and unknown these underground environments can be,” said Timothy Chung, program manager for the Subterranean Challenge in DARPA's Tactical Technology Office. “It's not just about testing whether there's enough light or if robots can drive a few meters. It's about how all that has to come together in a difficult environment and the teams are experiencing the challenge of integration in addition to technology development.” The competitors at STIX included a mix of DARPA-funded and self-funded teams: CERBERUS University of Nevada, Reno ETH Zurich, Switzerland Sierra Nevada Corporation University of California, Berkeley Flyability, Switzerland CoStar: Collaborative SubTerranean Autonomous Resilient Robots Jet Propulsion Laboratory California Institute of Technology Massachusetts Institute of Technology KAIST, South Korea CRETISE: Collaborative Robot Exploration and Teaming In Subterranean Environments Endeavor Robotics Neya Systems CSIRO Data 61 Commonwealth Scientific and Industrial Research Organisation, Australia Emesent, Australia Georgia Institute of Technology CTU-CRAS Czech Technical University in Prague, Czech Republic Université Laval, Canada Explorer Carnegie Mellon University Oregon State University MARBLE: Multi-agent Autonomy with Radar-Based Localization for Exploration University of Colorado, Boulder University of Colorado, Denver Scientific Systems Company, Inc. PLUTO: Pennsylvania Laboratory for Underground Tunnel Operations University of Pennsylvania Exyn Technologies Ghost Robotics Robotika Robotika.cz, Czech Republic Czech University of Life Science, Czech Republic Following the Tunnel Circuit, teams will compete in the Urban Circuit, which will focus on underground urban environments such as mass transit and municipal infrastructure; and the Cave Circuit, which will focus on naturally occurring cave networks. Locations for the circuit events have not been announced. Qualification is ongoing for the circuit events. Requirements can be found in the SubT Qualification Guide available on the Resources Page. Teams interested in joining either the virtual or systems tracks can still register and are encouraged to join the SubT Community Forum to exchange ideas, explore teaming opportunities, and receive updates on the Challenge. For additional information on the DARPA Subterranean Challenge, please visit www.subtchallenge.com. Please email questions to SubTChallenge@darpa.mil. https://www.darpa.mil/news-events/2019-04-29

All news