1. Perspectives on Defense Cyber Issues
Joseph W. Kirschbaum
Director, Defense Capabilities and Management
U.S. Government Accountability Office
12 October 2018

2. Defense Cyber Challenges
It’s not just a technical thing
Risk management is essential
Assessing effectiveness is crucial to progress

4. How DOD Treats IoT Devices
DOD Device
DODIN Interface; IT Security Standards
Secure
Personal Device
No DODIN Interface
Secure ?

5. Internet of Things-Unwitting Insider Threat

6. What Are Insider Threats?
The threat that an insider will use her or his authorized access, wittingly or unwittingly, to do harm to the security of the United States.
--DOD Definition
Pose a danger to facilities, resources, information, and people

7. Information and Cyber Systems
Complex Problem
Information and Cyber Systems

9. Collaboration is Key Ensure cross-function coordination
Develop, disseminate, and incorporate best practices and lessons learned.
Share information as appropriate
Establish formal and informal agreements

10. DOD Gaps
Policies and guidance are insufficient for specific types or classes of device.
Core DOD security policies and guidance does not incorporate IoT:
Cybersecurity
Operations security
Information security
Physical security.

11. DOD Gaps, continued
Services are not conducting threat-based operations security assessments--as required by DOD’s operations security program.
DOD is not effectively assessing effectiveness of actions taken to implement cyber strategy.
DOD-wide risk management

12. Contact Information
Joseph W. Kirschbaum
Director
Defense Capabilities and Management
US Government Accountability Office