Retour aux nouvelles

17 décembre 2018 | International, C4ISR

Audit finds cyber vulnerabilities in US missile defense system

By:

The Army, Navy and Missile Defense Agency are failing to take basic cybersecurity steps to ensure that information on America's ballistic missile defense system won't fall into nefarious hands, according to a Defense Department Inspector General audit released Friday.

Investigators visited five sites that manage ballistic missile defense elements and technical information, but the names of the commands were redacted in the publicly released report.

“The Army, Navy and MDA did not protect networks and systems that process, store, and transmit (missile defense) technical information from unauthorized access and use,” the declassified report states.

Such inadequacies “may allow U.S. adversaries to circumvent (missile defense) capabilities, leaving the United States vulnerable to missile attacks,” the report states.

They found officials failed to employ safeguards familiar to most people online in 2018, the latest development to raise questions about the U.S. military's cybersecurity vulnerabilities.

Among the shortcomings: Administrators for classified networks had no intrusion detection and prevention systems in place to watch for cyberattacks, much less stop them, according to the report.

At one site, officials said they had requested to purchase those cyber safeguards in December 2017 but nine months later it still hadn't been approved.

“Without intrusion detection and prevention capabilities, (the site) cannot detect malicious attempts to access its networks and prevent cyberattacks designed to obtain unauthorized access and exfiltrate sensitive (missile defense) technical information,” the report states.

Officials also failed to patch system flaws after receiving vulnerability alerts, one of which had first been identified in 1990 and had still not been fixed by April.

Another vulnerability that could be exploited by an attacker was first identified in 2013 but also was never pathced, according to the report.

“Countless cyber incident reports show that the overwhelming majority of incidents are preventable by implementing basic cyber hygiene and data safeguards, which include regularly patching known vulnerabilities,” the IG report states. “(Missile defense) technical information that is critical to national security could be compromised through cyberattacks that are designed to exploit these weaknesses.”

Some facilities failed to force employees to use common access cards, or CAC, when accessing the classified system, a basic cybersecurity practice known as multi-factor identification.

Instead, officials were able to access the sensitive information using just a username and password, the report states.

Hackers use phishing and other tactics to exploit passwords and gain access to such systems.

New hires are supposed to be allowed network access without a card for only their first two weeks on the job. But IG investigators found users on the systems without CAC cards for up to seven years.

At one site, a domain administrator never configured the network to allow only CAC holder access.

“Allowing users to access networks using single factor authentication increases the potential that cyber attackers could exploit passwords and gain access to sensitive (missile defense) technical information,” the report states.

Investigators also found unlocked server racks at some locations, another key vulnerability to insider snoopers.

“The insider threat risk necessitates that organizations implement controls...to reduce the risk of malicious personnel manipulating a server's ability to function as intended and compromising sensitive and classified data,” the report states.

External storage devices held unencrypted data and some sites failed to track who was accessing data, and why. Other administrators told investigators that they lacked the ability to record or monitor data downloaded from the network onto these devices.

Unless these officials enforce the encryption of such removed data and monitor its downloading and transferring, “they will be at increased risk of not protecting sensitive and classified (missile defense) technical information from malicious users,” the report states.

Investigators also found that some supposedly secure sites were failing to even lock their doors. One location had a security door that hadn't worked for years.

“Although security officials were aware of the problem, they did not take appropriate actions to prevent unauthorized personnel from gaining unauthorized access to the facility,” the report states.

Other sites featured no security cameras to monitor personnel movement and security officers failed to conduct badge checks.

While the report makes recommendations to fix the documented problems, officials for the inspected agencies offered no comments on the non-classified draft report of the audit.

Friday's scathing IG audit marked the latest in a string of reports detailing shoddy cybersecurity throughout the armed forces and defense contractors.

During the same week, the Wall St. Journal reported that Chinese hackers are targeting military systems and those of defense contractors working on Navy projects.

Beijing-linked cyber raids have attempted to steal everything from missile plans to ship-maintenance data in a series of hacks over the past 18 months, the Journal reports.

As a result, Navy Secretary Richard Spencer has ordered a “comprehensive cybersecurity review” to assess if the Navy's cyber efforts “are optimally focused, organized, and resourced to prevent serious breaches,” spokesman Capt. Greg Hicks said.

The review will also look at authorities, accountability and if the efforts reflect and incorporate government and industry best practices, he said.

“Secretary Spencer's decision to direct a review reflects the serious to which the DoN prioritizes cybersecurity in this era of renewed great power competition,” Hicks said.

https://www.navytimes.com/news/your-navy/2018/12/14/audit-finds-cyber-vulnerabilities-in-us-missile-defense-system

Sur le même sujet

  • DARPA: Teams Will Test Concepts for Exploring Underground in SubT Integration Exercise

    23 janvier 2019 | International, Terrestre

    DARPA: Teams Will Test Concepts for Exploring Underground in SubT Integration Exercise

    In early April, nine qualified teams will attempt to remotely navigate the dark and dirty corridors of Edgar Experimental Mine in Idaho Springs, Colorado, in preparation for the Circuits Stage of the DARPA Subterranean (SubT) Challenge later this year. The SubT Integration Exercise, known as STIX, offers teams an opportunity to try out their technologies, including robotics, sensors, and communications solutions, in a representative environment. The locations for the Circuits Stage events have not been announced. The Subterranean Challenge seeks to revolutionize how first responders and warfighters operate in human-made tunnel systems, urban underground settings, and natural cave networks that are too dangerous, dark, deep, and unknown to risk human lives. Teams are competing to develop breakthrough technologies that rapidly and remotely map, navigate, and search subterranean environments. To qualify for STIX, teams were required to demonstrate baseline performance capabilities and appropriate safety measures. The participating teams and members are as follows: CERBERUS: CollaborativE walking & flying RoBots for autonomous ExploRation in Underground Settings University of Nevada, Reno ETH Zurich, Switzerland Sierra Nevada Corporation University of California, Berkeley Flyability, Switzerland CoSTAR: Collaborative SubTerranean Autonomous Resilient Robots Jet Propulsion Laboratory California Institute of Technology Massachusetts Institute of Technology KAIST, South Korea CRAS: Center for Robotics and Autonomous Systems Czech Technological University, Czech Republic Université Laval, Canada CRETISE: Collaborative Robot Exploration and Teaming In Subterranean Environments Endeavor Robotics Neya Systems CSIRO Data61 Commonwealth Scientific and Industrial Research Organisation, Australia Emesent, Australia Georgia Institute of Technology Explorer Carnegie Mellon University Oregon State University MARBLE: Multi-agent Autonomy with Radar-Based Localization for Exploration University of Colorado, Boulder University of Colorado, Denver Scientific Systems Company, Inc. PLUTO: Pennsylvania Laboratory for Underground Tunnel Operations University of Pennsylvania Exyn Technologies Ghost Robotics Robotika.cz Robotika.cz, Czech Republic Czech University of Life Science, Czech Republic The SubT Challenge comprises two competitions – the Systems Competition, where teams will develop novel hardware solutions to compete in physical underground environments, and the Virtual Competition, where teams will develop software-based solutions to test in simulated scenarios. Teams will compete in three preliminary Circuit events and a Final event pursuing high-risk and high-reward approaches. The Final event, planned for 2021, will put teams to the test with courses that incorporate diverse challenges from all three environments. Teams in the Systems track will compete for up to $2 million in the Systems Final event, with up to $200,000 in additional prizes available for self-funded teams in each of the Systems Circuit events. Teams in the Virtual track will compete for up to $1.5 million in the Virtual Final event, with additional prizes of up to $500,000 for self-funded teams in each of the Virtual Circuit events. Other teams interested in participating in the SubT Challenge may submit their qualification materials to be eligible for future events. The next qualification deadline is April 22, 2019, to establish eligibility for the Tunnel Circuit in August. Requirements can be found in the SubT Qualification Guide available on the Resources Page. Interested teams are also encouraged to join the SubT Community Forum, where they can engage with other participants and ask any questions. For additional information on the DARPA Subterranean Challenge, please visit www.subtchallenge.com. Please email questions to SubTChallenge@darpa.mil. https://www.darpa.mil/news-events/2019-01-22

  • Air Force Hires Startup To Build Up MDO’s Unified Data Library

    1 novembre 2019 | International, Aérospatial

    Air Force Hires Startup To Build Up MDO’s Unified Data Library

    By THERESA HITCHENS WASHINGTON: The Air Force is expanding a key data tool, the cloud-based Unified Data Library (UDL), that may underpin the service's ambitious Multi-Domain Operations push. Air Force leaders (including acquisition chief Will Roper) believe the UDL will be able to mesh data from all types of sensors to provide space situational awareness (SSA) and command and control (C2) for most Air Force missions. The small $37 million contract, awarded Tuesday to Bluestaq LLC, will “expand the Advanced Command and Control Enterprise Systems and Software (ACCESS) project for the Air Force Research Laboratory (AFRL), the Air Force Space and Missile Systems Center (SMC) Data Program Management Office and the Directorate of Special Programs, Space Situational Awareness Division.” ACCESS will feed the UDL, integrating data “from a wide range of sources spanning commercial, foreign, Department of Defense (DoD) and the Intelligence Community (IC),” according to a company press release. The contract, awarded under the Small Business Innovation Research (SBIR) program, appears to fulfill exactly what Roper and other Air Force acquisition officials are pressing for: drawing in small and innovative companies that can move fast to help the service get inside the speed of Moore's Law instead of taking years or decades to develop new software systems. “We can't specify all specific data sets over the next three years because prioritization is dynamic, but the goal is to eventually integrate all of AFSPC data there along with other sources such as commercial space (already there but more coming), multi-domain data from such as air, land, sea, data from other agencies, and even academia,” an Air Force Space Command spokesperson told Breaking D yesterday. The spokesperson noted that the expansion will support Space Command's National Space Defense Center, designed to run future combat operations in space and to integrate Intelligence Community data with that of the military. It also will support the Combine Space Operations Center (CSPOC), that shares space domain awareness information with allies, the spokesperson said, as well as administrative functions. UDL is the brain child of Maj. Gen. Kim Crider, Air Force Space Command's (AFSPC) data integration guru. Crider is charged with developing AFSPC's classified Enterprise Data Strategy and Roadmap to underpin multi-domain command and control (MDC2) operations. “The Unified Data Library consumes, processes, and distributes millions of unique data products daily originating from dozens of commercial, academic, and government organizations across the world to a diverse user base spanning 25 countries,” according to Bluestaq. “The Unified Data Library storefront provides a robust interactive online API to assist users or developers with education and discovery of available dashboards, data streams, services, structures, and formats. The Air Force plans to expand the Unified Data Library to allow different security classification user access levels and fuse data from all types of sensors to provide command and control for most Air Force missions.” Indeed, AFSPC said in its email, “UDL data is available to any partner organization today, depending on clearance, authorization of the data provider, and classification of the data in question.” The UDL also is being tested by the Commerce Department as it readies itself to take over the mission of providing space situational awareness (SSA) information to commercial and foreign satellite operators. To get some idea of how different the culture is at this company note this comment by Andy Hofle, Bluestaq chief engineer and co-founder: “It has been exciting to see the growing community interest in the data management platform over the last 18 months, and our team has had a tremendous amount of fun playing a role in the development of the project.” https://breakingdefense.com/2019/10/air-force-hires-startup-to-build-up-mdos-unified-data-library

  • Contracts for September 21, 2021

    22 septembre 2021 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité

    Contracts for September 21, 2021

    Today

Toutes les nouvelles