Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/16/2010
03:40 PM
50%
50%

DoD To Issue Stronger Security Guidelines To Defense Vendors

Threat looms with a wide variety of military information residing on external systems

The Department of Defense has signaled its intention to develop new policies requiring its vendors to meet increased standards for cybersecurity for unclassified military information residing on or being carried over private sector systems and networks.

In a memo issued in late January, Department of Defense chief information officer Cheryl Roby laid out a number of leadership responsibilities and strategic guidance on the development of stronger cybersecurity plans.

"It is DoD policy to establish a comprehensive approach for protecting unclassified DoD information transiting or residing on unclassified [Defense industrial base] systems and networks and create a timely, coordinated, and effective partnership with the [Defense industrial base]," Roby wrote.

Hackers have increasingly been targeting and probing the Defense industrial base, sometimes successfully. For example, last year, it was revealed that hackers infiltrated the networks of government contractors and stole sensitive specs on the Pentagon's F-35 Joint Strike Fighter project. This poses a significant challenge, as a wide variety of military information resides on external systems, and a wide variety of defense IT work is outsourced.

The Department of Defense has in recent years been increasing the amount of work it does to secure its cyber supply chain, including taking such extreme measures as procuring chips for sensitive systems only from a limited number of "trusted foundries" in the United States. This effort may put a bit more DoD-wide rigor into similar exercises.

The memo lays out a number of responsibilities for top staff. For example, the DoD CIO will chair a Defense industrial board cybersecurity executive committee and coordinate oversight of industry cybersecurity activities with the DoD's inspector general. The directors of the National Security Agency and Defense Intelligence Agency will provide support and cyber intrusion damage assessment analysis in the case of attack.

Other roles include the under secretary of defense for acquisition, technology, and logistics, who's tasked with developing and injecting new cybersecurity policies into DoD's acquisition processes; the DoD's CFO, who will be required to monitor budgets related to these activities to make sure they're adequately resourced; and the director of the DoD's Cyber Crime Center, who will "serve as the focal point for threat information sharing."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13545
PUBLISHED: 2019-10-18
In Horner Automation Cscape 9.90 and prior, improper validation of data may cause the system to write outside the intended buffer area, which may allow arbitrary code execution.
CVE-2019-13541
PUBLISHED: 2019-10-18
In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code.
CVE-2019-17367
PUBLISHED: 2019-10-18
OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/.
CVE-2019-17393
PUBLISHED: 2019-10-18
The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and pa...
CVE-2019-17526
PUBLISHED: 2019-10-18
** DISPUTED ** An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an __import__('os').pop...