Background Weapon Systems Are  Unique In Many Ways, but  Face Common Cyber  Vulnerabilities Cybersecurity issues can vary widely across different types of systems,  so weapon systems cybersecurity challenges may be very different than  those of some IT systems. Despite variation across systems,  cybersecurity can be described using common terminology, such as the  key terms below used by the National Research Council. Key Concept  Security Controls are safeguards or  countermeasures to protect the confidentiality,  integrity, and availability of a system and its  information.   For example, a firewall is a common control  to allow or block traffic based on a set of  rules. Because it is impossible to define a rule  for every scenario, attackers look for ways to  access a system that are not covered by the  rules. For example, a firewall may block traffic  from a specific country, but attackers may  make it appear that they are in a country that  is not blocked. They may use tools to avoid  the firewall, such as embedding malicious  software in an e-mail and waiting for a user to  open it and inadvertently install the code. A cyber vulnerability is a weakness in a system that could be  exploited to gain access or otherwise affect the system’s  confidentiality, integrity, and availability. A cybersecurity threat is anything that can exploit a vulnerability to  harm a system, either intentionally or by accident. Cybersecurity risk is a function of the threat (intent and capabilities),  vulnerabilities (inherent or introduced), and consequences (fixable or  fatal). Although some weapon systems are purely IT systems, most—such as  aircraft, missiles, and ships—are what the National Institute of Standards  and Technology (NIST) and sometimes DOD refer to as “cyber-physical  systems.” NIST defines these systems as “co-engineered interacting  networks of physical and computational components.” These cyber  systems can affect the physical world so the consequences of a cyber  attack may be greater than those of attacks on other types of systems.  For example, an attack on a weapon system could have physical  consequences that may even result in loss of life. Nevertheless, weapon systems share many of the same cyber  vulnerabilities as other types of automated information systems. Weapon  systems are large, complex, systems of systems that have a wide variety  of shapes and sizes, with varying functionality. Despite obvious  differences in form, function, and complexity, weapon systems and other  types of systems are similar in some important, if not obvious, ways. For  example, DOD reports state that many weapon systems rely on  commercial and open source software and are subject to any cyber  vulnerabilities that come with them. Weapon systems also rely on  firewalls and other common security controls to prevent cyberattacks.  Weapon system security controls can also be exploited or bypassed if the  system is not properly configured. Finally, weapon systems are operated  by people—a significant source of cybersecurity vulnerability for any  system. Anatomy of a Cyber Attack One common way to discuss cybersecurity is through the activities  necessary to defend (or attack) a system. System developers and  operators take steps to protect the system from cyber attacks, while  attackers attempt to defeat those protections as depicted in figure 1. The  cyber attack sequence is also referred to as a cyber kill chain or cyber  attack lifecycle. There are multiple models for understanding cyber  attacks, each with their own terminology and sequence of steps. The  attack sequence below is simpler, but generally consistent with existing  cybersecurity models. We identified the defend sequence below based  on the steps included in cybersecurity test reports that we reviewed. Attack Sequence:  Discover  Implement   Exploit Example: Importance of Patching in a  Timely Manner  In the 2017 Equifax cyber attack, personal  data for over 145 million people were  exposed. Attackers took advantage of a  vulnerability in a commonly used web  application to access Equifax’s credit  reporting system. A patch for the vulnerability  was available in March, but Equifax had not  applied it by the time of the attack—in mid- May. A cyber attacker looks for ways to get around security controls in order to  obtain full or partial control of the system. An attacker typically starts by  learning as much as possible about the system—potentially through cyber  reconnaissance—to identify vulnerabilities in the system. The more  attackers know about the system, the more options they have when  designing an attack. An attacker may identify a previously unknown  vulnerability that the system owner is unaware of. Or the attacker could  look for system components that had not applied known security  updates—also called “patches.” Developers of commercial components  usually publicly announce any security patches and, ironically, provide a  roadmap for an attacker to attack a system or component. An attack may not happen all at once—an attacker may find the easiest  way to gain initial access and then look for ways to expand their access  until they reach their ultimate goal. Even once they achieve full access to  a system, an attacker may wait for an opportune time to attack the  confidentiality, integrity, or availability of a system. Types of attacks are  described in appendix II. Security Goals: Protect   Detect   Respond/Recover The system owner wants to prevent, or at least limit, attempts to  adversely affect the confidentiality, integrity, or availability of the system.  The owner implements security controls such as firewalls, role-based  access controls, and encryption to reduce the number of potential attack  points. Many controls need to be designed into the system early in the  development cycle. Ideally, the controls are designed to work together  and there may be layers of controls that an attacker would have to defeat  in order to gain control of the system—referred to as “defense in depth.” Key Concepts   Role-based access entails allowing users to  only access information and features  necessary to carry out their job.  Encryption is a way of transforming  information so that only authorized users are  able to read it. Protecting a system also includes administrative processes, such as  requiring users to regularly change their passwords and applying patches  on a regular schedule—referred to as cyber hygiene. However, no system  can be completely secure, so system owners must also constantly  monitor their systems for suspicious activity. Logging is a common  system feature that automatically records system activity. Unusual  patterns such as numerous failed log-in attempts from a remote location  could indicate that an unauthorized person is trying to gain access to the  system. Once such a cyber activity is detected, the system owner needs  to take steps to end the attack and restore any system capabilities that  were degraded as a result of the attacker’s actions. Attack Sophistication  Levels We reported in 2015 that federal and contractor systems face an evolving  array of cyber-based threats, including criminals, hackers, adversarial  nations, and terrorists. Threats can range from relatively unskilled “script  kiddies” who only use existing computer scripts or code to hack into  computers, to well-resourced and highly skilled advanced threats who not  only have sophisticated hacking skills, but also normally gather detailed  knowledge of the systems they attack. Table 1 provides brief descriptions  of the terminology DOD uses to categorize threats. DOD Weapon Systems  Requirements and  Acquisition Processes Weapons systems are developed, acquired, and deployed within the  defense acquisition system, a system of statutes and regulations. Subject  to control of the DOD, the Army, Air Force, Navy, and Marine Corps by  law have authority to “organize, train, and equip” their services. Their  decisions regarding what to develop and how best to do so are informed  by documents and deliberations under DOD’s requirements and  acquisition processes respectively. Early in the acquisition lifecycle, the  requirements process identifies what capabilities are needed and  evaluates options to best meet those needs. The acquisition process is  a gated review process that assesses programs against established  review criteria, such as the program’s cost, schedule, performance, and  whether the weapon system is ready to move forward in the acquisition  process. Numerous military-service entities are involved in these  processes. Key enterprise-level organizations include the Joint Staff and  Office of the Secretary of Defense organizations, such as the Office of the  Under Secretary of Defense (Acquisition and Sustainment), Office of the  Under Secretary of Defense (Research and Engineering), and the  Director of Operational Test and Evaluation (DOT&E). Organizations  Responsible for Weapon  Systems Cybersecurity Example: Increased Reliance on Software  In the 2015 JEEP Cherokee cyber attack,  researchers remotely took physical control of  a JEEP, including shutting off the engine and  controlling the brakes. In 2016, we reported  that electronic systems control multiple  passenger vehicle functions and that vehicles  include multiple interfaces that leave them  vulnerable to cyber attacks.   Researchers studied a JEEP to understand its  systems, including the characteristics of its  software code and its "CAN Bus," which  connects to units that control core vehicle  functions. They remotely accessed an  Internet-connected component and used it as  an initial entry point to access the vehicle's  CAN Bus, which then allowed them to control  many of the JEEP’s functions. Just as many DOD organizations are responsible for weapon systems  acquisitions, many have responsibilities related to cybersecurity during  the acquisition process. For example, program offices are responsible  for planning and implementing cybersecurity measures for the system  under development. Authorizing officials are responsible for overseeing  programs’ adherence to security controls and for authorizing a system’s  entry into operations based on the system having an acceptable level of  cyber risk. At key decision points, the Office of the Under Secretary of  Defense (Research and Engineering) is responsible for advising the  Secretary of Defense and providing independent technical risk  assessments that address a variety of topics, including the system’s  cybersecurity posture. Military test organizations conduct cybersecurity  assessments of weapon systems. DOT&E oversees those tests and is  funding research on the cybersecurity of some weapon system  components that pose particular cybersecurity challenges. Organizations that are traditionally associated with cybersecurity, such as  NSA and Cyber Command, support some aspects of weapon systems  cybersecurity. However, they are not responsible for reviewing the  designs of most weapon systems to identify potential vulnerabilities,  although NSA officials said that they will provide advice to acquisition  programs if asked to do so. More information about these roles and  responsibilities is included in appendix III. Multiple Factors Make  Weapon Systems  Cybersecurity  Increasingly Difficult,  but DOD Is Just  Beginning to Grapple  with the Challenge Multiple factors contribute to the current state of DOD weapon systems  cybersecurity, including: the increasingly computerized and networked  nature of DOD weapons, DOD’s past failure to prioritize weapon systems  cybersecurity, and DOD’s nascent understanding of how best to develop  more cyber secure weapon systems. Specifically, DOD weapon systems  are more software and IT dependent and more networked than ever  before. This has transformed weapon capabilities and is a fundamental  enabler of the United States’ modern military capabilities. Yet this change  has come at a cost. More weapon components can now be attacked  using cyber capabilities. Furthermore, networks can be used as a  pathway to attack other systems. We and others have warned of these  risks for decades. Nevertheless, until recently, DOD did not prioritize  cybersecurity in weapon systems acquisitions. In part because DOD  historically focused on the cybersecurity of its networks but not weapon  systems themselves, DOD is in the early stage of trying to understand  how to apply cybersecurity to weapon systems. Several DOD officials  explained that it will take some time, and possibly some missteps, for the  department to learn what works and does not work with respect to  weapon systems cybersecurity. DOD Weapon Systems  Are Increasingly Complex  and Networked, Increasing  Cyber Vulnerabilities DOD’s weapon systems are increasingly dependent on software and IT to  achieve their intended performance. The amount of software in today’s  weapon systems is growing exponentially and is embedded in numerous  technologically complex subsystems, which include hardware and a  variety of IT components, as depicted in figure 2. Nearly all weapon system functions are enabled by computers—ranging  from basic life support functions, such as maintaining stable oxygen  levels in aircraft, to intercepting incoming missiles. DOD has actively  sought ways to introduce this automation into weapon systems. For  example, we have reported that for decades, the Navy has sought to  reduce ship crew size based, in part, on the assumption that some  manual tasks could be automated and fewer people would be needed to  operate a ship. Yet this growing dependence on software and IT comes at a price. It  significantly expands weapons’ attack surfaces. According to DOT&E,  any exchange of information is a potential access point for an adversary.  Even “air gapped” systems that do not directly connect to the Internet for  security reasons could potentially be accessed by other means, such as  USB devices and compact discs. Weapon systems have a wide variety of  interfaces, some of which are not obvious, that could be used as  pathways for adversaries to access the systems, as is shown in figure 3. DOD systems are also more connected than ever before, which can  introduce vulnerabilities and make systems more difficult to defend.  According to the DSB, nearly every conceivable component in DOD is  networked. Weapon systems connect to DOD’s extensive set of  networks—called the DOD Information Network—and sometimes to  external networks, such as those of defense contractors. Technology  systems, logistics, personnel, and other business-related systems  sometimes connect to the same networks as weapon systems.  Furthermore, some weapon systems may not connect directly to a  network, but connect to other systems, such as electrical systems, that  may connect directly to the public Internet, as is depicted in figure 4. These connections help facilitate information exchanges that benefit  weapon systems and their operators in many ways—such as command  and control of the weapons, communications, and battlespace  awareness. If attackers can access one of those systems, they may be  able to reach any of the others through the connecting networks. Many  officials we met with stated that including weapon systems on the same  networks with less protected systems puts those weapon systems at risk.  Furthermore, the networks themselves are vulnerable. DOT&E found that  some networks were not survivable in a cyber-contested environment and  the DSB reported in 2013 that “the adversary is in our networks.” Further complicating matters, weapon systems are dependent on external  systems, such as positioning and navigation systems and command and  control systems in order to carry out their missions—and their missions  can be compromised by attacks on those other systems. A successful  attack on one of the systems the weapon depends on can potentially limit  the weapon’s effectiveness, prevent it from achieving its mission, or even  cause physical damage and loss of life. Despite Warnings,  Cybersecurity Has Not  Been a Focus of Weapon  Systems Acquisitions We and other organizations have identified risks associated with  increased reliance on software and networking since at least the early  1990s, as is shown in table 2. Nevertheless, DOD has only recently begun prioritizing weapon systems  cybersecurity. Instead, for many years, DOD focused cybersecurity efforts  on protecting networks and traditional IT systems, such as accounting  systems, rather than weapons. Experts we interviewed as well as officials  from program offices, the Office of the Secretary of Defense, and some  military test organizations explained that, until around 2014, there was a  general lack of emphasis on cybersecurity throughout the weapon  systems acquisition process. Others have reported similar findings. For  example, the DSB reported in 2013 that although DOD had taken great  care to secure the use and operation of the hardware of its weapon  systems, it had not devoted the same level of resources and attention to  IT systems that support and operate those weapons and critical IT  capabilities embedded within the weapon systems. The National  Research Council reported in 2014 that much broader and more  systematic attention to cybersecurity was needed in the acquisition  process and that the Navy was in the “crawl” stage of a “crawl-walk-run”  journey. Similarly, the Navy reported in 2015 that there was a lack of  attention to cybersecurity in the acquisition process and platform IT  systems were not engineered with cybersecurity as a key component. In the past, consideration of cybersecurity was not a focus of the key  processes governing the development of weapon systems. It was not a  focus of key acquisition and requirements policies nor was it a focus of  key documents that inform decision-making. For example, until a few  years ago, DOD’s main requirements policy did not call for programs to  factor cyber survivability into their key performance parameters. Key  performance parameters are the most important system capabilities,  called “requirements,” that must be met when developing weapon  systems. They are established early on in an acquisition program and  drive system design decisions. They are also used as a benchmark to  measure program performance and are reviewed during acquisition  decisions and other oversight processes. Because cybersecurity key  performance parameters were not required, Joint Staff officials and some  program officials said that many current weapon systems had no high- level cybersecurity requirements when they began, which in turn limited  emphasis on cybersecurity during weapon system design, development,  and oversight. In addition, Joint Staff officials said that, historically,  cybersecurity was not a factor in analyses of alternatives. This analysis is  an important early step in acquiring a new weapon system and informs  decisions about the relative effectiveness, costs, and risks of potential  systems that could be developed. By not considering cybersecurity in  these analyses, decisions about which system to develop were made  without consideration of whether one proposed system might be more  inherently vulnerable from a cyber perspective than others. Programs’ lack of cybersecurity requirements may have also contributed  to challenges with incorporating cybersecurity into weapon systems  testing. Specifically, DOT&E and service test agencies said that prior to  around 2014, program offices tried to avoid undergoing cybersecurity  assessments because they did not have cybersecurity requirements and  therefore thought they should not be evaluated. Furthermore, test officials  said that many within DOD did not believe cybersecurity applied to  weapon systems. As a result, fewer cybersecurity assessments were  conducted at that time in comparison to recent years. By not incorporating cybersecurity into key aspects of the requirements  and acquisition processes, DOD missed an opportunity to give  cybersecurity a more prominent role in key acquisition decisions.  Numerous officials we met with said that this failure to address weapon  systems cybersecurity sooner will have long-lasting effects on the  department. Due to this lack of focus on weapon systems cybersecurity,  DOD likely has an entire generation of systems that were designed and  built without adequately considering cybersecurity. Bolting on  cybersecurity late in the development cycle or after a system has been  deployed is more difficult and costly than designing it in from the  beginning. Not only is the security of those systems and their missions at  risk, the older systems may put newer systems in jeopardy. Specifically, if  DOD is able to make its newer systems more secure, but connects them  to older systems, this puts the newer systems at risk. Furthermore, even if  they are not connected, if the newer systems depend on the older  systems to help fulfill their missions, those missions may be at risk. DOD Is Still Learning How  to Address Weapon  Systems Cybersecurity DOD is still determining how best to address weapon systems  cybersecurity given weapon systems’ different and particularly  challenging cybersecurity needs. Although there are similarities between  weapon systems and traditional IT systems, DOD has acknowledged that  it may not be appropriate to apply the same cybersecurity approach to  weapon systems as traditional IT systems. RAND reported and several  program officials we met with stated that DOD’s security controls were  developed with IT systems, and not weapon systems, in mind. DOD  policies and guidance acknowledge that tailoring may be warranted, but  they do not yet specify how the approaches to the security controls  should differ. Key Concept  Industrial control system is a general term  that encompasses several types of control  systems including supervisory control and  data acquisition systems, distributed control  systems, and programmable logic controllers.  Industrial control systems monitor or control  other systems and processes and may be  used to automate tasks such as opening and  closing valves. DOD is still in the process of determining how to make weapon system  components with particular cyber vulnerabilities as secure as possible.  For example, many weapon systems use industrial control systems to  monitor and control equipment, and like computers, they include software.  Many weapon systems use such systems to carry out essential functions.  For example, a ship may use industrial control systems to control engines  and fire suppression systems. According to NIST, industrial control  systems were originally designed for use in trusted environments, so  many did not incorporate security controls. Government and industry  reports state that attacks on these systems are increasing. However,  DOD officials said that program offices may not know which industrial  control systems are embedded in their weapons or what the security  implications of using them are. Over the past few years, DOD has begun  funding work to improve its understanding of how to best secure these  systems. In addition, Office of the Secretary of Defense officials informed  us that, in response to section 1650 of the National Defense Authorization  Act for Fiscal Year 2017, they are working to better understand the  dependency of industrial control systems on mission impact, including  other key infrastructure nodes that could be vulnerable to a cyber attack  and have significant impact to mission accomplishment. Key Concept  Vulnerability chaining is when attackers  take advantage of multiple vulnerabilities— which could be low or moderate risk in  isolation—to perform a more significant attack  on a system. Several weapon system-specific factors make it important to tailor  cybersecurity approaches, but also make cybersecurity difficult. Because  weapon systems can be very large, complex, systems of systems with  many interdependencies, updating one component of a system can  impact other components. A patch or software enhancement that causes  problems in an email system is inconvenient, whereas one that affects an  aircraft or missile system could be catastrophic. Officials from one  program we met with said they are supposed to apply patches within 21  days of when they are released, but fully testing a patch can take months  due to the complexity of the system. Even when patches have been  tested, applying the patches may take additional time. Further, weapon  systems are often dispersed or deployed throughout the world. Some  deployed systems may only be patched or receive software  enhancements when they return to specific locations. Although there are  valid reasons for delaying or forgoing weapon systems patches, this  means some weapon systems are operating, possibly for extended  periods, with known vulnerabilities. Exacerbating matters, some program offices may also not yet have a  solid understanding of the cybersecurity implications of their systems’  designs, including their systems’ connectivity. This situation makes it  difficult to secure the system. Experts and officials from some test  organizations we met with stated that programs have generally not  understood the multitude of ways that information flows in and out of their  systems, although this may be improving. Several program officials we  met with felt that weapon systems were more secure than other types of  systems and noted that they typically did not have direct connections to  the Internet. In fact, weapon systems have more potential avenues of  attack than may be apparent, such as radio communications receivers  and radar receivers. Furthermore, the National Research Council  reported in 2014 that individual warfare domains do not fully grasp risks  within their own domain, let alone those that can be introduced through  other domains. For example, if a space system is connected to a land  system—even indirectly—an attacker may be able to move from one to  the other or limit the operations of one by attacking the other. Tests Revealed that  Most Weapon  Systems Under  Development Have  Major Vulnerabilities,  and DOD Likely Does  Not Know the Full  Extent of the  Problems We found that from 2012 to 2017, DOD testers routinely found mission- critical cyber vulnerabilities in nearly all weapon systems that were under  development. Using relatively simple tools and techniques, testers were  able to take control of these systems and largely operate undetected. In  some cases, system operators were unable to effectively respond to the  hacks. Furthermore, DOD does not know the full scale of its weapon  system vulnerabilities because, for a number of reasons, tests were  limited in scope and sophistication. Weapon Systems  Cybersecurity  Assessments Identified  Mission-Critical  Vulnerabilities Nearly all major acquisition programs that were operationally tested  between 2012 and 2017 had mission-critical cyber vulnerabilities that  adversaries could compromise. DOT&E’s 2017 annual report stated that  tests consistently discovered mission-critical vulnerabilities in acquisition  programs, echoing a similar finding by the DSB in 2013 about DOD IT  systems and networks. Cybersecurity test reports that we reviewed  showed that test teams were able to gain unauthorized access and take  full or partial control of these weapon systems in a short amount of time  using relatively simple tools and techniques. We saw widespread  examples of weaknesses in each of the four security objectives that  cybersecurity tests normally examine: protect, detect, respond, and  recover. Protect Key Concepts  An insider is a user who is authorized to use  a system (e.g., has a username and  password) and has physical access to all or  parts of a system.  A near-sider is an unauthorized user who has  physical access to all or part of a system. For  example, someone taking a tour of a Navy  ship would be a near-sider.  A remote user is not authorized to use the  system and does not have physical access to  the system. Test teams were able to defeat weapon systems cybersecurity controls  meant to keep adversaries from gaining unauthorized access to the  systems. In one case, it took a two-person test team just one hour to gain  initial access to a weapon system and one day to gain full control of the  system they were testing. Some programs fared better than others. For  example, one assessment found that the weapon system satisfactorily  prevented unauthorized access by remote users, but not insiders and  near-siders. Once they gained initial access, test teams were often able  to move throughout a system, escalating their privileges until they had  taken full or partial control of a system. In one case, the test team took  control of the operators’ terminals. They could see, in real-time, what the  operators were seeing on their screens and could manipulate the system.  They were able to disrupt the system and observe how the operators  responded. Another test team reported that they caused a pop-up  message to appear on users’ terminals instructing them to insert two  quarters to continue operating. Multiple test teams reported that they  were able to copy, change, or delete system data including one team that  downloaded 100 gigabytes, approximately 142 compact discs, of data. Example: Poor Password Management  The 2016 cyber attack on Dyn, a company  that serves as a key intermediary in directing  Internet traffic, disabled websites, such as  Twitter, Netflix, and CNN and brought down  the Internet in some regions. The attack used  malware to search the Internet for unsecured  devices, such as those that used factory- default usernames and passwords, and then  used those devices to send junk traffic to  online targets until they could not function. The test reports indicated that test teams used nascent to moderate tools  and techniques to disrupt or access and take control of weapon systems.  For example, in some cases, simply scanning a system caused parts of  the system to shut down. One test had to be stopped due to safety  concerns after the test team scanned the system. This is a basic  technique that most attackers would use and requires little knowledge or  expertise. Poor password management was a common problem in the  test reports we reviewed. One test report indicated that the test team was  able to guess an administrator password in nine seconds. Multiple  weapon systems used commercial or open source software, but did not  change the default password when the software was installed, which  allowed test teams to look up the password on the Internet and gain  administrator privileges for that software. Multiple test teams reported  using free, publicly available information or software downloaded from the  Internet to avoid or defeat weapon system security controls. Test reports we reviewed make it clear that simply having cybersecurity  controls does not mean a system is secure. How the controls are  implemented can significantly affect cybersecurity. For example, one test  report we reviewed indicated that the system had implemented role- based access control, but internal system communications were  unencrypted. Because the system’s internal communications were  unencrypted, a regular user could read an administrator’s username and  password and use those credentials to gain greater access to the system  and the ability to affect the confidentiality, integrity, or availability of the  system. Programs Had Not Addressed Some Previously Identified  Vulnerabilities  Program offices were aware of some of the weapon system vulnerabilities  that test teams exploited because they had been identified in previous  cybersecurity assessments. For example, one test report indicated that  only 1 of 20 cyber vulnerabilities identified in a previous assessment had  been corrected. The test team exploited the same vulnerabilities to gain  control of the system. When asked why vulnerabilities had not been  addressed, program officials said they had identified a solution, but for  some reason it had not been implemented. They attributed it to contractor  error. Another test report indicated that the test team exploited 10  vulnerabilities that had been identified in previous assessments. Detect Example: Poor Detection  In the 2014 Office of Personnel  Management (OPM) cyber attack, attackers  exfiltrated personnel files of 4.2 million  government employees, security clearance  background information on 21 million  individuals, and fingerprint data of 5.6 million  of these individuals. Attackers used a  contractor’s OPM credentials to log into the  OPM system, installed malware, and created  a backdoor to the network. These attackers  were in OPM’s networks for at least 14  months. Over 2,000 pieces of malware were  later identified on OPM devices. detection. One test team emulated a denial of service attack by  rebooting the system, ensuring the system could not carry out its mission  for a short period of time. Operators reported that they did not suspect a  cyber attack because unexplained crashes were normal for the system.  Another test report indicated that the intrusion detection system correctly  identified test team activity, but did not improve users’ awareness of test  team activities because it was always “red.” Warnings were so common  that operators were desensitized to them. A common way to detect cyber activity is to review logs of system activity  looking for unusual occurrences. Multiple test reports indicated that test  team activity was documented in system logs, but operators did not  review them. One test report noted that the system had no documented  procedures for reviewing logs. Respond/Recover Multiple test reports indicated that operators did not effectively respond to  test team activities. In multiple tests, operators did not respond because,  as noted above, they were simply unaware of the test team activities. In  some cases, however, operators were unable to effectively respond even  when they identified or were notified that the test team had carried out an  attack. One test report indicated that operators identified test team  intrusion attempts and took steps to block the test team from accessing  the system. However, the test team was able to easily circumvent the  steps the operators took. In another case, the test team was able to  compromise a weapon system and the operators needed outside  assistance to restore the system. DOD Has Limited Insight  into Weapon Systems  Cybersecurity DOD does not know the full extent of its weapon systems cyber  vulnerabilities due to limitations on tests that have been conducted.  Cybersecurity assessments do not identify all vulnerabilities of the  systems that are tested. This is, in part, because cybersecurity  assessments do not reflect the full range of threats that weapon systems  may face in operation. Test teams reported that they portray realistic  threats and environments. However, the nature of tests imposes  limitations on testers that do not apply to potential adversaries. For  example, DOD officials said that most cybersecurity assessments are  conducted over a few days to a few weeks. One test report indicated that  the cybersecurity assessment was cut short due to external factors so the  test team only had 41 hours to work with the system. In contrast, DOD  officials we spoke to said that a determined adversary could spend  months or years targeting our systems. Further, because test teams have a limited amount of time with a system,  they look for the easiest or most effective way to gain access, according  to DOD officials we met with and test reports we reviewed. They do not  identify all of the vulnerabilities that an adversary could exploit. DOT&E  noted that longer-term tests generally identify more cyber vulnerabilities  than shorter tests. DOD officials we spoke to said that the department has  increased the amount of long-term assessments it conducts in recent  years. Weapon systems cybersecurity assessments may also be limited  in the types of attacks that are portrayed so entire categories of  vulnerabilities are not currently addressed in some cyber assessments.  The test reports we reviewed tended to portray nascent to moderate  threats and generally did not target special components like industrial  control systems and non-Internet enabled devices which our adversaries  could target. Similarly, counterfeit parts pose cybersecurity risks to  weapon systems, but were not within the scope of the cybersecurity tests  that we reviewed. System-specific limitations can also affect test results. Officials from one  service test agency noted that in at least one case, they could not fully  assess a system’s cybersecurity because portions of the system’s  networks and data were proprietary. The system utilized the contractor’s  corporate networks, which the test team was not allowed to attack. In  several tests, a weapon system’s connections to external systems were  either limited or had to be simulated. One test report we reviewed noted  that the test team was not allowed to use classified networks to attack a  weapon system due to security concerns. Another test was conducted in  a lab environment so the test team had to simulate external  communications. Although there are practical reasons for limiting the  duration and scope of cybersecurity assessments, these limitations mean  that DOD may not fully understand the extent of weapon system cyber  vulnerabilities, as is reflected in figure 5. Many program officials we met with indicated that their systems were  secure, including some with programs that had not had a cybersecurity  assessment. Some systems have not yet undergone testing either  because they are not far enough along in the acquisition process,  because they were fielded prior to DOD’s emphasis on penetration  testing, or out of concern that cybersecurity tests would interfere with  operations. Systems that have not been tested are not necessarily more  or less secure than systems that have been assessed. DOD does not  know the extent to which these systems have cyber vulnerabilities. Program officials cited the security controls they applied as the basis for  their belief that their systems were secure. For example, officials from a  DOD agency we met with expressed confidence in the cybersecurity of  their systems, but could not point to test results to support their beliefs.  Instead, they identified a list of security controls they had implemented.  However, security controls must be properly designed and implemented  in order to be effective. As we noted earlier, test teams routinely found  and defeated poorly implemented security controls. Officials we spoke to  stated that controls are necessary, but not sufficient, and penetration test  results—rather than compliance documentation—are better indicators of  a system’s security. For programs that have had cybersecurity assessments, some program  officials we met with questioned the validity of the results because of  concerns about the realism of the assessments. For example, officials  from one program noted that the testers were given more system  information and access than an adversary would have. Officials from  another program noted that testers asked for detailed information about  the system’s design. These officials stated that cyber assessments were  unrealistic if they relied on the program office to identify problem areas for  the test team. However, test organizations and NSA officials we met with  dismissed these observations, noting that adversaries are not subject to  the types of limitations imposed on test teams, such as time constraints  and limited funding—and this information and access are granted to  testers to more closely simulate moderate to advanced threats. DOD Has Begun  Taking Steps to  Improve Weapon  Systems  Cybersecurity Over the past few years, DOD has taken several major steps to improve  weapon systems cybersecurity. DOD issued and updated numerous  policies and guidance to improve the department’s development of cyber  resilient systems. These include improvements such as specifying that  cybersecurity policies apply to weapon systems and requiring more focus  on cybersecurity throughout a weapon system’s acquisition life cycle.  DOD and Congress have also begun promising initiatives to help DOD  improve its understanding of its weapon systems cyber vulnerabilities and  take steps to mitigate their risks. However, DOD faces barriers that may  limit its ability to achieve desired improvements. For example, DOD is  struggling to hire and retain cybersecurity personnel, who are essential to  implementing these changes. In addition, DOD faces barriers to  information sharing, which hinder its ability to share vulnerability and  threat information within and across programs. To improve the state of  weapon systems cybersecurity, it is essential that DOD sustain its  momentum in developing and implementing key initiatives. DOD Has Issued and  Updated Policies and  Guidance Since 2014, DOD has issued or updated at least 15 department-wide  policies, guidance documents, and memorandums intended to promote  more cyber secure weapon systems, some of which are highlighted in  table 3. One of the more significant changes is that DOD’s existing cybersecurity  policies now explicitly apply to weapon systems. DOD officials said the  department has had cybersecurity policies in place for decades, but  applied them to weapon systems only in the past few years. For example,  DOD’s Risk Management Framework (RMF) is similar to its  predecessor—DOD’s Information Assurance Certification and  Accreditation Process—which called for application of an extensive series  of controls to protect DOD networks and information systems. However,  RMF applies these controls more widely to weapon systems  cybersecurity. Another important change is that, in recognition that  systems cannot be 100 percent secure, DOD has begun to emphasize  cyber resiliency in some of its policies. The idea behind cyber resiliency is  to identify and protect key elements of a system to ensure that they can  continue to operate, possibly with limited capabilities, during a cyber  attack. This entails designing in features such as durability, redundancy,  and added protections for certain components. Lastly, key policies that govern the requirements and acquisition  processes now address cybersecurity. These changes have the potential  to bring greater attention to cybersecurity in weapon systems  acquisitions. Rather than being treated as distinct from the acquisition  process, cybersecurity is to be integrated into key acquisition activities,  such as requirements development, technology maturation, and testing.  Examples of this, as called for in various policies, include the following: Requirements. Identify cybersecurity requirements and how the  information flows into, out of, and through the systems. This helps  identify the system’s attack surface and informs the system’s design  and cybersecurity controls. Cybersecurity should become part of the  requirements trade space. Technology maturation. Focus early prototyping in part on buying  down cybersecurity risks prior to system development. Cybersecurity  controls should be applied and assessed during prototyping to  evaluate cyber risks and inform down-selection and adjustment of  requirements. Department of Defense, DOD Program Manager’s Guidebook for Cybersecurity (Sept.  2015). Developmental testing. Test the cybersecurity of weapon systems  as they are developed, including integration of larger subsystems and,  ultimately, the entire system. Perform cybersecurity assessments in  representative operating environments during developmental testing. Operational testing. Conduct operational cybersecurity testing of  weapon systems to include other systems that exchange information  with the system under test (system-of-systems to include the network  environment), end users, administrators, and cyber defenders. Reflect  representative cyber threats. These extensive changes to policies and guidance, which adopt a similar  risk-based framework to that already generally in place government-wide,  appear to be a step in the right direction to increase the department’s  emphasis on weapon systems cybersecurity. However, they are also  relatively new for DOD, so it is too early to assess whether they are  resulting in improved weapon systems cybersecurity. For example,  changes to the requirements process apply primarily to new programs so  it could be many years before systems that have gone through the new  process undergo operational testing and are fielded. DOD Has Undertaken  Initiatives, in Part Directed  by Congress, to Help  Understand and Address  Weapon Systems’ Cyber  Vulnerabilities Section 1647 of the National Defense Authorization Act for Fiscal Year  2016 requires the Secretary of Defense to evaluate the cyber  vulnerabilities of each DOD weapon system by the end of 2019 and  develop strategies to mitigate risks stemming from those vulnerabilities.  In response to this direction and The DOD Cyber Strategy, which also  calls for DOD to assess and initiate improvements to the cybersecurity of  current and future weapons systems, DOD is taking steps to improve its  understanding of its weapon systems’ vulnerabilities, determine how to  mitigate risks from those vulnerabilities, and inform future development of  more secure systems. The Office of the Under Secretary of Defense  (Acquisition and Sustainment) is leading this initiative in collaboration with  military test organizations. DOD is compiling existing vulnerability  information and conducting some new tests to provide information about  the cybersecurity posture of individual systems, concentrating mostly on  fielded systems. These assessments are important, in part because some  of those systems did not undergo cybersecurity testing prior to fielding  and DOD does not have a permanent process in place to periodically  assess the cybersecurity of fielded systems. Furthermore, vulnerabilities  and risks can change after fielding as system software becomes obsolete. As part of this initiative, for two mission areas, the Office of the Under  Secretary of Defense (Acquisition and Sustainment) has been trying to  incorporate cybersecurity into large scale military exercises to take a  more integrated look at impacts of vulnerabilities across systems. The  goal is to understand how vulnerabilities in some systems may affect  DOD’s ability to achieve its mission and to identify what other options are  available to complete a mission if certain capabilities were disabled or  degraded. This work is also important, but for different reasons. DOD’s  developmental and operational tests focus primarily on vulnerabilities in  individual systems rather than across broader mission areas. However,  as previously discussed, attackers do not necessarily limit themselves to  one system and may move from one system to others. Furthermore, DOD  has not previously had a process in place to examine how cyber attacks  on one system could affect entire missions. Taken together, the system-specific and mission-focused activities could  help DOD develop a more comprehensive understanding of its  cybersecurity posture—the overall strength of its cybersecurity. Officials  working on these assessments plan to use what they learn to help inform  the acquisition of future weapon systems. Specifically, they plan to share  lessons with DOD test organizations, the Office of the Chief Information  Officer, Office of the Under Secretary of Defense (Research and  Engineering), and others in the Office of the Under Secretary of Defense  (Acquisition and Sustainment). Similarly, the military services have established weapon system  cybersecurity-focused offices to improve their cybersecurity posture,  which are described briefly in table 4. Although all of these activities promise to help DOD improve its  cybersecurity posture over time, they are also relatively new for DOD.  They will need sustained momentum to achieve changes over the  lifecycle of acquisition programs, so it is too early to tell if they will be  successful over the long term. According to multiple agency officials and  our analysis of policy and guidance changes since 2014, DOD leadership  has become more aware of cybersecurity issues over the past several  years and has driven many of these cybersecurity activities. However, our  prior work has found sustained leadership support of DOD initiatives to be  key to maintaining their momentum. We also reported that there is risk  that DOD will not fully implement some tasks it has begun to improve  weapon systems cybersecurity if leadership does not continue to monitor  their progress. For example, we reported in 2017 that DOD’s Principal  Cyber Advisor closed out the task on assessing weapon systems called  for under The DOD Cyber Strategy. We recommended that the Cyber Advisor modify criteria for closing tasks to reflect whether tasks have  been implemented and re-evaluate tasks that have been previously  determined to be completed. DOD Faces Systemic  Barriers to Improving  Weapon Systems  Cybersecurity DOD faces barriers that will challenge its ability to develop more cyber  resilient weapon systems and make it more difficult for DOD’s recent  policy changes and new initiatives to be as effective as possible. Cybersecurity Workforce  Challenges DOD struggles to hire and retain cybersecurity personnel, particularly  those with weapon systems cybersecurity expertise. Our prior work has  shown that maintaining a cybersecurity workforce is a challenge  government-wide and that this issue has been a high-priority across the  government for years. Program officials from a majority of the programs  and test organizations we met with said they have difficulty hiring and  retaining people with the right expertise, due to issues such as a shortage  of qualified personnel and private sector competition. Test officials said  that once their staff members have gained experience in DOD, they tend  to leave for the private sector, where they can command much higher  salaries. According to a 2014 RAND study, personnel at the high end of  the capability scale, who are able to detect the presence of advanced  threats, or finding the hidden vulnerabilities in software and systems, can  be compensated above $200,000 to $250,000 a year, which greatly  exceeds DOD’s pay scale. Even when cybersecurity positions are filled, it may not necessarily be  with the right expertise. Officials from some program offices said that  general cybersecurity expertise is not the same as weapon systems  cybersecurity expertise. For example, officials said that professional IT  certifications are not the same as systems security engineering expertise,  which is essential to designing cyber-resilient systems. According to  various program officials, weapon systems cybersecurity is a specialized  area. Cybersecurity subject matter experts require knowledge of (1)  DOD’s acquisition process; (2) technical knowledge of the specific  weapon system—such as radar or aircraft, and (3) cybersecurity  knowledge. However, it is difficult to hire and maintain a workforce with  the needed knowledge due to its highly specialized nature. Without this  expertise, it will be difficult for programs to effectively implement  cybersecurity policies and guidance. For example, the RMF allows  programs to determine which controls are most appropriate to apply, but  a knowledgeable workforce is necessary for making such decisions. DOD has various efforts underway to recruit and develop the skills of  DOD’s cybersecurity workforce, according to several DOD officials. For  example, the services are aiming to recruit cybersecurity analysts by  using internships and engaging in partnerships with secondary schools  and universities. In addition, the services are developing and offering  courses to grow expertise within their existing acquisition workforce. DOD  is determining how to share specialized expertise related to weapon  systems cybersecurity. Specific efforts related to this include the Cyber  Developmental Test Cross Service Working Group that meets quarterly  and invites industry expertise to present cutting edge techniques as well  as a “capture the flag” competition, which will now be offered to other  services as well. In addition, Navy Systems Commands employees  participate in periodic regional cyber competitions to hone knowledge  learned in classroom environments and use training funds to pursue  additional or higher degrees and cyber certificate programs. Officials from many of the offices we interviewed, as well as the National  Research Council, DSB, and RAND have expressed concerns about  barriers to information sharing. It is difficult to find the correct balance  between protecting information, so that it is not accessible to potential  adversaries, and sharing it, so that DOD has an informed workforce. For  example, classification is important because it protects information about  vulnerabilities, and in some cases, intelligence methods. Access to  information about vulnerabilities makes it easier for potential adversaries  to attack DOD systems. Similarly, limiting the distribution of classified  information to those who have the need to know is likewise important  because it reduces the likelihood that internal and external threats will  access it. Although DOD officials explained that there is no DOD-wide  cybersecurity classification guidance, Air Force guidance and DOD  officials indicated that vulnerabilities in fielded systems are typically  classified as at least Top Secret or Top Secret/Sensitive Compartmented  Information, and details of threats are more restricted. This high level of  classification for weapon systems cyber vulnerabilities and threats helps  protect sensitive information, but it makes it difficult for DOD to share  information about aspects of weapon systems cybersecurity with  cybersecurity personnel across DOD. For example, some experts told us  that flawed designs can still be found in new systems if their designers  were not aware that they resulted in vulnerabilities in other systems. More  generally, because they are not sharing vulnerability and threat  information across programs, programs are unaware of their full risk  exposure and DOD may have less insight into vulnerabilities across its  weapon systems portfolio. Officials from most organizations we spoke to,  including NSA, acknowledged challenges with sharing information across  all levels within DOD. Examples of these challenges are listed in table 5. Although limitations to information sharing can lead to inefficiencies and  other challenges, DOD has so far opted to favor protection of  information—perhaps because the stakes are so high if it does not. As we  mentioned previously, one of the reasons potential adversaries collect  information on weapon systems is because the better they understand a  weapon system, and especially what vulnerabilities it may have, the more  options they have to attack it. Reports over the years about cyber  espionage attacks on defense contractors show that concerns about  protecting sensitive information are warranted. Agency Comments We provided a draft of this report to DOD for review and comment. DOD  provided technical comments, which we incorporated where appropriate. We are sending copies of this report to the appropriate congressional  committees; the Secretary of Defense; and the Secretaries of the Army,  Navy, and Air Force. In addition, the report will be available at no charge  on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact  me at 202-512-4841 or chaplainc@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV. Appendix I: Scope and Methodology To identify factors that contribute to the current state of Department of  Defense (DOD) weapon systems cybersecurity, we reviewed reports  published from 1991 to the present on software, information technology,  networking, and weapon systems from the National Research Council,  the Defense Science Board, GAO, DOD’s Director of Operational Test  and Evaluation, DOD’s Joint Chiefs of Staff, and the RAND Corporation.  To inform our discussion of networking, we also reviewed concepts of  operations for selected systems of systems. To determine the extent to  which DOD focused on cybersecurity in weapon system acquisitions, we  analyzed selected information assurance, acquisition, requirements, and  testing policies and guidance. For this and all other objectives, we  conducted interviews with or obtained written responses from the  following organizations: Office of the Secretary of Defense organizations: Office of the  Director, Operational Test and Evaluation; Office of the Deputy  Assistant Secretary of Defense for Developmental Test and  Evaluation; Office of the Chief Information Officer including the  Defense Information Systems Agency; Office of the Chairman of the  Joint Chiefs of Staff; Office of the Under Secretary of Defense  (Acquisition and Sustainment); and Office of the Under Secretary of  Defense (Research and Engineering). Military service test organizations: Air Force Operational Test and  Evaluation Center, Army Operational Test and Evaluation Command,  Navy’s Commander Operational Test and Evaluation Force, and  Marine Corps Operational Test and Evaluation Activity. Selected program offices reflecting a purposeful sample of nine major  defense acquisition program offices. We identified a variety of  program offices to represent each service, multiple domains, and  programs that are extensively connected to other weapons systems.  We are not listing the names of these offices for sensitivity reasons. Other key DOD organizations with cybersecurity responsibilities: the  National Security Agency, Defense Information Systems Agency, and  U.S. Cyber Command. Selected organizations with cybersecurity expertise, referred to as  “experts” in the report: Carnegie Melon’s Software Engineering  Institute, the MITRE Corporation, the RAND Corporation, Pacific  Northwest National Laboratory, Sandia National Laboratory, and  Renaissance Strategic Advisors. We selected these based on their  research or roles advising DOD on weapon systems cybersecurity- related topics. To identify vulnerabilities in weapon systems under development, we  reviewed cyber assessment reports of selected weapon systems  conducted between 2012 and 2017. We selected at least one program  from each service as well as different types of weapon systems (e.g.,  aircraft vs ships vs communication systems). To gain further insights into  assessment findings and understand their limitations, we interviewed  officials from the Office of the Secretary of Defense and military test  service organizations. We discussed the cybersecurity of individual  programs, implementation of controls, and assessment findings with  program offices. We also interviewed officials from several organizations  with cybersecurity expertise to discuss weapon system vulnerabilities and  test limitations. Vulnerabilities for specific weapon systems are classified,  so we have not identified the programs covered in these test reports. The  examples we cite are unique to each weapon system and are not  applicable to all weapon systems. Furthermore, cybersecurity  assessment findings are as of a specific date so vulnerabilities identified  during system development may no longer exist when the system is  fielded. To determine the steps DOD is taking to develop more cyber resilient  weapon systems, we analyzed key DOD information  assurance/cybersecurity, acquisition, requirements, and testing policies  and guidance that have been updated since 2014 to better address  weapon systems cybersecurity. We selected 2014 because DOD began  revising several policies at that time. These include DOD’s Risk  Management Framework, Department of Defense Instruction 8500.01,  Cybersecurity; the Department of Defense Instruction 5000.2, Operation  of the Defense Acquisition System; DOD Program Manager’s Guidebook  for Integrating the Cybersecurity Risk Management Framework into the  System Acquisition Lifecycle; the Joint Capabilities Integration and  Development System Manual; the Cyber Survivability Endorsement  Implementation Guide; and the DOD Cybersecurity Test and Evaluation  Guidebook. To identify barriers DOD faces in developing cyber resilient  systems and implementing updated cybersecurity policies and guidance,  we interviewed Office of the Secretary of Defense, military service test  organizations, selected program offices, other DOD organizations,  experts, and operators. We took additional precautions to avoid revealing sensitive information.  We illustrated some concepts using notional depictions. In some cases,  we were deliberately vague and excluded details from examples to avoid  identifying specific weapon systems. We also presented examples of  publicly known attacks in sidebars to illustrate how poor cybersecurity can  enable cyber attacks. DOD conducted a security review of the report and  approved it for public release. Appendix II: Examples of Types of Cyber  Attacks Appendix III: Roles and Responsibilities for  Cybersecurity in the Department of Defense Cybersecurity Roles and  Responsibilities The Department of Defense (DOD) is responsible for defending the U.S.  homeland and interests from attack, including those that occur in  cyberspace and has developed capabilities for cyber operations. In order  to achieve this objective, the department must be able to defend its own  networks, systems, and information from cyber attack. To establish a  cybersecurity program to protect and defend DOD information and  information technology, DOD has assigned some of its components and  senior officials with a variety of cybersecurity responsibilities, some of  which are described below. Appendix IV: GAO Contact and Staff  Acknowledgments GAO Contact Cristina T. Chaplain (202) 512-4841 or chaplainc@gao.gov. Staff  Acknowledgements In addition to the contact named above, Raj Chitikila (Assistant Director),  Brandon Booth, Laura Greifner, L.T. Holliday, Katherine Pfeiffer, James  Tallon, Jacqueline Wade, and Robin Wilson made key contributions to  this report. Assistance was also provided by Tommy Baril, Nabajyoti  Barkakati, Mark Canter, Virginia Chanley, Kurt Gurka, Joseph  Kirschbaum, Jeff Knott, Duc Ngo, and Gregory Wilshusen.
DOD plans to spend about $1.66 trillion to develop its current portfolio of major weapon systems. Potential adversaries have developed advanced cyber-espionage and cyber-attack capabilities that target DOD systems. Cybersecurity—the process of protecting information and information systems—can reduce the likelihood that attackers are able to access our systems and limit the damage if they do. GAO was asked to review the state of DOD weapon systems cybersecurity. This report addresses (1) factors that contribute to the current state of DOD weapon systems' cybersecurity, (2) vulnerabilities in weapons that are under development, and (3) steps DOD is taking to develop more cyber resilient weapon systems. To do this work, GAO analyzed weapon systems cybersecurity test reports, policies, and guidance. GAO interviewed officials from key defense organizations with weapon systems cybersecurity responsibilities as well as program officials from a non-generalizable sample of nine major defense acquisition program offices. The Department of Defense (DOD) faces mounting challenges in protecting its weapon systems from increasingly sophisticated cyber threats. This state is due to the computerized nature of weapon systems; DOD's late start in prioritizing weapon systems cybersecurity; and DOD's nascent understanding of how to develop more secure weapon systems. DOD weapon systems are more software dependent and more networked than ever before (see figure). Automation and connectivity are fundamental enablers of DOD's modern military capabilities. However, they make weapon systems more vulnerable to cyber attacks. Although GAO and others have warned of cyber risks for decades, until recently, DOD did not prioritize weapon systems cybersecurity. Finally, DOD is still determining how best to address weapon systems cybersecurity. In operational testing, DOD routinely found mission-critical cyber vulnerabilities in systems that were under development, yet program officials GAO met with believed their systems were secure and discounted some test results as unrealistic. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications. In addition, vulnerabilities that DOD is aware of likely represent a fraction of total vulnerabilities due to testing limitations. For example, not all programs have been tested and tests do not reflect the full range of threats. DOD has recently taken several steps to improve weapon systems cybersecurity, including issuing and revising policies and guidance to better incorporate cybersecurity considerations. DOD, as directed by Congress, has also begun initiatives to better understand and address cyber vulnerabilities. However, DOD faces barriers that could limit the effectiveness of these steps, such as cybersecurity workforce challenges and difficulties sharing information and lessons about vulnerabilities. To address these challenges and improve the state of weapon systems cybersecurity, it is essential that DOD sustain its momentum in developing and implementing key initiatives. GAO plans to continue evaluating key aspects of DOD's weapon systems cybersecurity efforts.