Perspectives on Defense Cyber Issues Joseph W. Kirschbaum Director, Defense Capabilities and Management U.S. Government Accountability Office 12 October 2018

Defense Cyber Challenges It’s not just a technical thing Risk management is essential Assessing effectiveness is crucial to progress

http://www.gao.gov/products/GAO-17-668 http://www.gao.gov/products/GAO-15-544 https://www.gao.gov/products/GAO-17-512

How DOD Treats IoT Devices DOD Device DODIN Interface; IT Security Standards Secure Personal Device No DODIN Interface Secure ?

Internet of Things-Unwitting Insider Threat

What Are Insider Threats? The threat that an insider will use her or his authorized access, wittingly or unwittingly, to do harm to the security of the United States. --DOD Definition Pose a danger to facilities, resources, information, and people

Information and Cyber Systems Complex Problem Information and Cyber Systems

Collaboration is Key Ensure cross-function coordination Develop, disseminate, and incorporate best practices and lessons learned. Share information as appropriate Establish formal and informal agreements

DOD Gaps Policies and guidance are insufficient for specific types or classes of device. Core DOD security policies and guidance does not incorporate IoT: Cybersecurity Operations security Information security Physical security.

DOD Gaps, continued Services are not conducting threat-based operations security assessments--as required by DOD’s operations security program. DOD is not effectively assessing effectiveness of actions taken to implement cyber strategy. DOD-wide risk management

Contact Information Joseph W. Kirschbaum Director Defense Capabilities and Management US Government Accountability Office 202-512-9971 kirschbaumj@gao.gov