Cybersecurity: DOD Needs to Take Decisive Actions to Improve Cyber Hygiene

DOD has become increasingly reliant on information technology (IT) and risks have increased as cybersecurity threats evolve. Cybersecurity experts estimate that 90 percent of cyberattacks could be defeated by implementing basic cyber hygiene and sharing best practices, according to DOD's Principal Cyber Advisor.

Senate Report 115-262 includes a provision that GAO review DOD cyber hygiene. This report evaluates the extent to which 1) DOD has implemented key cyber hygiene initiatives and practices to protect DOD networks from key cyberattack techniques and 2) senior DOD leaders received information on the department's efforts to address these initiatives and cyber hygiene practices.

GAO reviewed documentation of DOD actions taken to implement three cyber hygiene initiatives and reviewed recurring reports provided to senior DOD leaders.

The Department of Defense (DOD) has not fully implemented three of its key initiatives and practices aimed at improving cyber hygiene. Carnegie-Mellon University defines cyber hygiene as a set of practices for managing the most common and pervasive cybersecurity risks. In discussions with GAO, DOD officials identified three department-wide cyber hygiene initiatives: the 2015 DOD Cybersecurity Culture and Compliance Initiative, the 2015 DOD Cyber Discipline Implementation Plan, and DOD's Cyber Awareness Challenge training.

The Culture and Compliance Initiative set forth 11 overall tasks expected to be completed in fiscal year 2016. It includes cyber education and training, integration of cyber into operational exercises, and needed recommendations on changes to cyber capabilities and authorities. However, seven of these tasks have not been fully implemented.

The Cyber Discipline plan has 17 tasks focused on removing preventable vulnerabilities from DOD's networks that could otherwise enable adversaries to compromise information and systems. Of these 17, the DOD Chief Information Officer is responsible for overseeing implementation of 10 tasks. While the Deputy Secretary set a goal of achieving 90 percent implementation of the 10 CIO tasks by the end of fiscal year 2018, four of the tasks have not been implemented. Further, the completion of the other seven tasks was unknown because no DOD entity has been designated to report on the progress.

The Cyber Awareness training is intended to help the DOD workforce maintain awareness of known and emerging cyber threats, and reinforce best practices to keep information and systems secure. However, selected components in the department do not know the extent to which users of its systems have completed this required training. GAO's review of 16 selected components identified six without information on system users that had not completed the required training, and eight without information on users whose network access had been revoked for not completing training.

Beyond the initiatives above, DOD has (1) developed lists of the techniques that adversaries use most frequently and pose significant risk to the department, and (2) identified practices to protect DOD networks and systems against these techniques. However, the department does not know the extent to which these practices have been implemented. The absence of this knowledge is due in part to no DOD component monitoring implementation, according to DOD officials. Overall, until DOD completes its cyber hygiene initiatives and ensures that cyber practices are implemented, the department will face an enhanced risk of successful attack.

While two recurring reports have provided updates to senior DOD leaders on cyber information on the Cyber Discipline plan implementation, department leadership has not regularly received information on the other two initiatives and on the extent to which cyber hygiene practices are being implemented. Such information would better position leaders to be aware of the cyber risks facing DOD and make more effective decisions to manage such risks.

GAO is making seven recommendations to DOD, including that cyber hygiene initiatives be fully implemented, entities are designated to monitor component completion of tasks and cyber hygiene practices, and senior DOD leaders receive information on cyber hygiene initiatives and practices. Of the seven recommendations, DOD concurred with one, partially concurred with four, and did not concur with two. GAO continues to believe that all recommendations are warranted.

The Department of Defense (DOD) has become increasingly reliant on  information technology (IT) systems and networks to conduct military  operations and perform critical functions, such as logistics and budgeting.  The security of these systems and data is vital to national security.

The risks to IT systems supporting DOD are increasing as cybersecurity  threats continue to evolve and become more sophisticated. In particular,  some foreign nations—where adversaries may possess sophisticated  levels of expertise and significant resources to pursue their objectives— pose a significant threat. For example, according to the former Director of  National Intelligence’s 2019 Worldwide Threat Assessment of the U.S.  Intelligence Community, China presents a growing attack threat to our  core military systems and Russia is staging cyberattack assets to allow it  to disrupt or damage U.S. military infrastructure.

Compounding these threats, IT systems are often riddled with  cybersecurity vulnerabilities—both known and unknown. Cybersecurity  vulnerabilities—particularly when combined with human error—can  facilitate cyberattacks that disrupt critical operations, lead to inappropriate  access to and modification of sensitive information, and threaten national  security. Most of these cyberattacks can be attributed to human error— either through improperly configured IT systems or non-compliance with  existing cybersecurity policy. For example, the Defense Information  Systems Agency network was breached between May and July 2019  potentially compromising personal information, including Social Security  numbers. Also, in July 2015, a phishing attack on the Joint Chiefs of Staff  unclassified email servers resulted in the system being shut down for 11  days while cyber experts rebuilt the network, affecting the work of roughly  4,000 military and civilian personnel. DOD has taken steps to address  cybersecurity vulnerabilities, such as by establishing the Joint Force  Headquarters DOD Information Network (JFHQ-DODIN) to serve as the  DOD organization responsible for coordinating DOD defensive  cybersecurity operations.

However, according to the department’s Principal Cyber Advisor,  cybersecurity experts estimate that about 90 percent of cyberattacks  could be defeated by implementing basic “cyber hygiene and sharing best  practices.” According to DOD officials, there is not a commonly-used  definition for cyber hygiene in DOD doctrine, but Carnegie Mellon  University’s Software Engineering Institute defines cyber hygiene as a set  of practices for managing the most common and pervasive cybersecurity  risks faced by organizations today.

We discussed the definition of cyber hygiene with DOD officials to identify  departmental initiatives aimed at improving cyber hygiene. DOD officials  identified three departmental cyber hygiene initiatives: (1) the 2015 DOD  Cybersecurity Culture and Compliance Initiative (DC3I), (2) the 2015  Cybersecurity Discipline Implementation Plan (CDIP), and (3) DOD’s  Cyber Awareness Challenge training. In addition, we identified  departmental practices to protect its networks from cyberattack  techniques that adversaries may use. These practices include protective  security controls and configurations.

Senate Report 115-262 accompanying a bill for the National Defense  Authorization Act for Fiscal Year 2019 includes a provision that GAO  assess policies governing DOD cyber hygiene and review threats to DOD  from weaknesses in its cyber hygiene. This report evaluates the extent to  which (1) DOD has implemented key cyber hygiene initiatives and  practices to protect DOD networks from key cyberattack techniques and  (2) senior DOD leaders received complete information on the  department’s efforts to address the key cyber hygiene initiatives and key  cyber hygiene practices.

To address our first objective, we reviewed the requirements in each of  the three key cyber hygiene initiatives—the DC3I, CDIP, and DOD’s  Cyber Awareness Challenge. For the DC3I, we reviewed documentation  from U.S. Cyber Command, the Office of the DOD Chief Information  Officer (CIO), and the Joint Staff to identify and assess the specific  actions these components had taken in response to the 11 tasks that  were required by the Secretary of Defense and the Chairman of the Joint  Chiefs of Staff.

For the CDIP, we reviewed documentation and interviewed officials from  the Office of the DOD CIO to identify and assess the extent to which the  department had taken action to implement the 17 tasks that were required  by the Deputy Secretary of Defense. For the Cyber Awareness  Challenge training, we obtained and analyzed information from the DOD  CIO and a sample of 16 DOD components to determine the extent that DOD personnel had taken the fiscal year 2018 Cyber Awareness  Challenge training. These 16 components included the four military  services, Joint Staff, three combatant commands, five defense agencies,  two DOD field activities, and one component from the Office of the  Secretary of Defense. Further, we interviewed officials from Defense  Information Systems Agency (DISA) and JFHQ-DODIN to determine the  extent to which the department has implemented cyber hygiene practices  to protect its networks from cyberattack techniques that adversaries may  use.

To address our second objective, we defined senior leaders as the  Secretary of Defense, the Deputy Secretary of Defense, and DOD  component heads. In addition, we analyzed the contents of two recurring  reports that senior leaders receive that describe efforts that the  department is taking to improve the department’s cybersecurity posture:  the Cyber Hygiene Scorecard and the Cyber Landscape Report. In  particular, we analyzed these reports to determine if they included  information about DOD’s implementation of key cyber hygiene initiatives  that we discuss in the first objective. We describe our scope and  methodology in more detail in appendix I.

We conducted this performance audit from January 2019 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

DOD officials identified three key department-wide initiatives that include  a number of cybersecurity practices aimed at improving cyber hygiene:  the DC3I, the CDIP, and the Cyber Awareness Challenge training. These  efforts recognize the importance of command leadership, best practices  for DOD network users, and technical countermeasures against  cybersecurity threats.

DC3I. In September 2015, the Secretary of Defense and the  Chairman of the Joint Chiefs of Staff signed the DC3I in an effort to  transform DOD cybersecurity culture by enabling and reshaping  leaders, cyber providers, personnel who perform cyberspace  operations, and general users to improve individual human  performance and accountability on DOD’s network. The DC3I  memorandum identifies 11 tasks assigned to various DOD  components to respond to and implement across the department— such as the development of cybersecurity training briefs for DOD  leadership, integration of cybersecurity into operational training and  exercises, and the development of a resourcing plan to support  scheduled inspections of units conducting cyberspace operations.  From September 2015 to December 2016, U.S. Cyber Command was  initially responsible for ensuring that relevant components  implemented the DC3I. In December 2016, the Deputy Secretary of  Defense assigned the DOD CIO as the official responsible for  ensuring that components implemented the initiative because, in part,  the DOD CIO has DOD-wide oversight authority.

CDIP. The CDIP is one of seven actions identified in DOD’s  Cybersecurity Campaign to prompt commanders and senior leaders  to enforce full cybersecurity compliance and accountability across the  department. In October 2015, the Deputy Secretary of Defense signed  the CDIP to reinforce basic cybersecurity technical requirements  identified in policies, directives, and orders as a means to defend  DOD information networks, secure DOD data, and mitigate risks to  DOD missions. The CDIP memorandum identifies 17 tasks for all  commanders and supervisors to implement across the department.  These tasks include removing operating system software that no  longer receives security updates from vendors, configuring servers  consistent with DOD guidance on secure configurations, and  addressing vulnerabilities for servers and network infrastructure in a  timely manner.

Cyber Awareness Challenge Training. This training is intended to  help the DOD workforce (including service members, civilians, and  contractors) to maintain awareness of known and emerging  cybersecurity threats, reinforce best practices to keep information and  information systems secure, and ensure that network users stay  abreast of changes in DOD cybersecurity policies. DISA develops the  training content and periodically updates the training. In addition, the  Cyber Workforce Advisory Group that includes officials from the DOD  CIO, DISA, and DOD components, solicit input about ways to improve  the training and meets annually to approve updates to the Cyber  Awareness Challenge.

Increasing Cybersecurity Awareness and Accountability at Leadership Levels

Federal law and a DOD initiative and strategy highlight the important role  of leadership in improving cybersecurity culture and performance across  the department. For example, the Federal Information Security  Modernization Act of 2014 (FISMA) requires agency heads—including the  Secretary of Defense—to ensure that senior agency officials provide  security for the information and information systems that support the  operations and assets under their control. Additionally, the DC3I states  that leaders will be held accountable by the chain of command for the  cybersecurity performance of their organization and the individuals who  comprise it, and for the role cybersecurity performance plays in  accomplishing assigned missions. It also states that leaders will set an  example and help individuals master appropriate cyber behavior, will take  action against those who commit gross negligence or errors of  commission, and may use all available means, both legal and  administrative, as they deem appropriate.

Further, the 2018 DOD Cyber Strategy states that reducing the  department’s network attack surface (i.e., the different points in a network  where attackers can try to enter or extract information) requires an  increase in cybersecurity awareness and accountability across the  department. The strategy also states that the department would hold  DOD personnel accountable for their cybersecurity practices and choices.  The 2019 Cybersecurity Readiness Review, directed by the Secretary of  the Navy, describes best practices for effective cybersecurity  leadership. These best practices, according to the readiness review,  require Navy leaders to be informed on cybersecurity issues facing their  organization, engaged in ensuring cybersecurity issues are addressed,  and hold their organization accountable for cybersecurity performance.

Key Cybersecurity Roles and Responsibilities

A number of DOD officials and components have key roles and  responsibilities for cybersecurity, including the three key cyber hygiene  initiatives. For example:

Secretary and Deputy Secretary of Defense. FISMA makes the  Secretary of Defense responsible for providing information security  protections commensurate with the risk and magnitude of harm facing  the department. In addition, Executive Order 13800, issued in May  2017, aligns with FISMA by holding agency heads accountable for  implementing risk management measures commensurate with the risk  and magnitude of the harm that would result from unauthorized  access, use, disclosure, disruption, modification, or destruction of IT  and data.

DOD Chief Information Officer. FISMA requires DOD to develop,  document, and implement a program to provide security for  information and information systems (commonly referred to as a  cybersecurity program) and directs the Secretary of Defense to  delegate to the DOD CIO (and military department CIOs) authority to  ensure compliance with the law. In addition, the DOD CIO is  responsible for overseeing implementation of the three key cyber  hygiene initiatives.

DOD Component heads. DOD component heads are responsible for  ensuring that IT under their purview complies with DOD Instruction  8500.01. In addition, component heads are responsible for ensuring  that their network users complete annual security awareness training.

DOD Component CIOs. DOD component CIOs are responsible for  developing, implementing, maintaining, and enforcing a component  cybersecurity program on behalf of their respective component  heads. In doing so, component CIOs are responsible for ensuring  that their components implement the CDIP tasks.

Chairman of the Joint Chiefs of Staff. The Chairman of the Joint  Chiefs of Staff is responsible for advising the President and Secretary  of Defense on operational policies, responsibilities, and programs.  The Chairman also assists the Secretary of Defense in implementing  operational responses to cyber threats and ensures cyberspace plans  and operations are compatible with other military plans and  operations. The staff members who support the Chairman of the  Joint Chiefs of Staff are referred to as the Joint Staff, which is  comprised of members from all of the military services.

U.S. Cyber Command. The Commander of U.S. Cyber Command  has the mission to direct, synchronize, and coordinate cyberspace  planning and operations to defend and advance national interests in  collaboration with domestic and international partners. In addition, the  Commander is responsible for, among other things, issuing orders  and directives to all DOD components for the execution of global  operations aimed at securing and defending the department’s  networks.

Defense Information Systems Agency. The Director of DISA is  responsible for developing, implementing, and managing  cybersecurity for the department’s network and works with other  components to secure DOD systems. For example, the Director is  responsible for developing cybersecurity awareness training for all  users on DOD’s network.

JFHQ-DODIN. The Commander of JFHQ-DODIN is responsible for,  among other things, commanding, controlling, planning, directing,  coordinating, integrating, and synchronizing DOD defensive  cybersecurity operations. JFHQ-DODIN also performs two types of  cyber readiness inspections to ensure DOD units comply with  requirements related to network security and to evaluate the ability of  units to accurately detect and mitigate vulnerabilities and anomalous  activity on DOD’s network.

The security of federal cyber assets has been on our High-Risk List since  1997. In September 2018, we issued an update to this high-risk area that  identified actions needed to address cybersecurity challenges facing the  nation—including improving implementation of government-wide  cybersecurity initiatives aimed at securing federal systems and  information. We also have identified ensuring the cybersecurity of the  nation as one of nine high-risk areas that need especially focused  executive and congressional attention.

In August 2017, we reported on DOD’s progress in implementing the  department’s cyber strategies. We found that DOD had implemented the  cybersecurity elements of the DOD Cloud Computing Strategy and had  made progress in implementing the 2015 DOD Cyber Strategy and DOD  Cybersecurity Campaign, which was comprised of multiple initiatives  including the CDIP. However, DOD’s process for monitoring  implementation of the DOD Cyber Strategy resulted in the closure of  tasks before they were fully implemented. We also found that DOD lacked  a timeframe and process for monitoring implementation of the DOD  Cybersecurity Campaign objective to transition to commander-driven  operational risk assessments for cybersecurity readiness. We  recommended that DOD (1) modify criteria for closing tasks as  implemented and reevaluate tasks previously determined to be completed  to ensure they meet modified criteria and (2) establish a timeframe and  monitor implementation of the DOD Cybersecurity Campaign objective to  develop cybersecurity readiness assessments to help ensure  accountability. DOD partially concurred with both recommendations. As of  January 2020, neither recommendation had been implemented.

DOD Has Not Fully Implemented Key Cyber Hygiene Initiatives and Does Not Know the Extent of Protection

DOD has not fully implemented its three cyber hygiene initiatives.  Specifically, (1) the DOD CIO and DOD components have not  implemented seven of the 11 DC3I tasks due in fiscal year 2016; (2) DOD  has implemented six of 10 CDIP tasks that the DOD CIO oversees and  does not know the extent that seven other CDIP tasks are implemented;  and (3) DOD did not know the extent to which users for selected  components completed the Cyber Awareness Challenge training in 2018  and one component did not use the required training. In addition, the  department does not know the extent that cyber hygiene practices to  protect its networks from key cyberattack techniques have been  implemented.

DOD Has Not Implemented Seven of the 11 DC3I Tasks Due in Fiscal Year 2016

DOD has not implemented seven of the 11 DC3I tasks despite fiscal year  2016 deadlines for each of the tasks being established by the  department. In particular, DOD components have implemented four  DC3I tasks and have not implemented the seven remaining tasks, as  shown in figure 1.

As shown above, DOD has implemented four DC3I tasks. For example,  DOD CIO implemented a task that requires that office to assess the effect  of cyber workforce shortfalls on DOD’s mission and provide  recommendations to address these shortfalls (task 10 in figure 1 above).  Specifically, in April 2019, DOD CIO provided a plan to the Office of  Personnel Management to address cyber workforce shortages by filling  vacant positions, enhancing outreach and recruitment, and expanding on  hiring authorities.

However, DOD has not implemented the remaining seven DC3I tasks.  For example:

DOD has not fully implemented leadership cybersecurity training  briefs (task 1). In April 2016, U.S. Cyber Command developed two  training briefs to be used in leadership training. However, as of  October 2019, DOD components have not received either training  brief, according to DOD officials. In September 2016, U.S. Cyber  Command provided the Deputy Secretary of Defense a DC3I status  report and informed him that two products were developed to address  this task and that they would be disseminated to DOD components.  However, as of October 2019, neither U.S. Cyber Command nor the  Office of the DOD CIO had disseminated these leadership training  briefs across the department, according to DOD officials. In  reviewing the training briefs, we found that, if they had been  incorporated into DOD leadership training, leaders would have been  better positioned to address cybersecurity risks. For example, they  may have learned, among other things, how to understand, assess,  and interpret cyber-reportable events and incidents and how they  affect military operations.

DOD has not developed cyber-provider training (task 2). In  February 2019, the office of the DOD CIO completed a review of all  military and civilian IT positions to identify the work roles of all cyber  providers in the department. However, the office has not developed  educational and training requirements for cyber providers. DOD CIO  officials told us that, consistent with task 2, they are drafting a DOD  Manual, Cyber Workforce Qualification and Management Program,  which would document educational and training requirements for the  work roles for each cyber provider. DOD CIO officials expect to  complete the manual around April 2020.

DOD has not fully implemented criteria for assessing  cybersecurity in operational training and exercises (task 5). In  March 2016, the Joint Staff developed criteria for assessing military  service and combatant command efforts to integrate cybersecurity  into operational training and exercises. For example, the Joint Staff  developed a checklist of cybersecurity elements that should be  included in cyberspace-related training objectives and assessed  during training events. In May 2016, the Vice Chairman of the Joint  Chiefs of Staff required that the criteria be used to assess military  service and combatant command efforts to integrate cybersecurity  into operational training and exercises. In May 2019, Joint Chiefs of  Staff officials told us the criteria was not incorporated into the  Chairman’s annual training guidance, citing personnel turnover, and  that they do not have plans to incorporate the criteria. According to  the DC3I, operational and tactical commanders and leaders need to  interpret the effect that cyber insecurity may have on the mission and  integrate cyber effects into mission planning. If Joint Staff had  updated the Chairman of the Joint Chiefs of Staff guidance for  operational training, DOD commanders would have had criteria they  could use to assess the effect that cyber insecurity may have on  military missions.

The lack of progress in implementing the tasks occurred, in part, because  the DOD CIO did not take steps to ensure that the DC3I tasks were  implemented. DOD CIO officials told us they were not aware of their  responsibility to oversee implementation of the DC3I. Initially, U.S. Cyber  Command was assigned as the entity responsible for overseeing  implementation of the DC3I; however, in December 2016, the Deputy  Secretary of Defense approved the transition of the DC3I mission lead to  the department’s CIO. According to this transition memorandum, the  CIO was to leverage existing authorities and departmental efforts to lead  and provide oversight of cybersecurity culture and compliance  transformation. Additionally, DOD CIO officials told us that the office is  focusing its resources on other CIO initiatives, such as implementing the  cyber landscape initiative. However, the DC3I included a task (task 11  in figure 1 above) that required an assessment of the resources needed  to ensure that DOD implemented the DC3I and this task had not been  completed at the time of our review. If DOD CIO does not take  appropriate steps to ensure that the DC3I tasks are implemented, the  department risks compromising the confidentiality, integrity, and  availability of mission-critical information as a result of human error by  users on the department’s networks.

DOD Has Implemented Six of 10 CDIP Tasks That the DOD CIO Oversees and Does Not Know the Extent That Seven Other CDIP Tasks Have Been Implemented

DOD Has Implemented Six of 10 CDIP Tasks That the DOD CIO Oversees

Since 2015, DOD has implemented six of 10 CDIP tasks that the DOD  CIO is to oversee, but has not achieved desired performance targets for  the remaining four tasks even though there is a requirement to implement  all 10 by the end of fiscal year 2018. In the 2015 CDIP memorandum,  the Deputy Secretary of Defense directed DOD components to implement  all 17 CDIP tasks for all system users, IT hardware, and IT software to  remove preventable vulnerabilities from DOD’s network that could allow  adversaries to compromise information and information systems.  According to a March 2019 memorandum, the Deputy Secretary of  Defense challenged the department to achieve 90 percent  implementation of the 10 CDIP tasks overseen by DOD CIO by the end of  fiscal year 2018. In table 1, we list the 17 tasks and indicate the 10 tasks  that the department’s CIO oversees.

The department has achieved its performance targets for six of the 10  CDIP tasks that the DOD CIO oversees. For example, in October 2018  DOD achieved its performance target for one task that requires the  department to move all of DOD’s web servers into a DOD “demilitarized  zone,” or DMZ, according to DOD’s fiscal year 2018 Federal Information  Security Modernization Act report to the director of the Office of  Management and Budget. Placing these web servers in a DMZ directs  web traffic intended for those servers—including malicious traffic—to  systems within perimeter firewalls that screen the traffic before allowing  access to organizations networks. By implementing the task and moving  11,000 web servers into the DMZ, DOD has reduced the risk that  malicious traffic can reach its web servers.

However, the department has not achieved the department-wide goal for  the four remaining CDIP tasks overseen by DOD CIO. For example,  DOD did not achieve its performance target for a task that required  components to ensure they were compliant with endpoint security  guidance. DOD CIO officials told us that the remaining four CDIP tasks  are challenging for the department to achieve the 90 percent performance  target because some DOD components use aging information technology  systems and these older systems may not be equipped to implement all  CDIP tasks. We have previously reported that legacy systems have  operated with known cybersecurity vulnerabilities that are either  technically difficult or prohibitively expensive to address. In light of the  security risks posed by DOD component legacy systems, we stated that it  is imperative that agencies carefully plan for their successful  modernization.

DOD did not achieve the 90 percent goal for four of the 10 CDIP tasks by  the end of fiscal year 2018 due in part to DOD components not  developing plans with scheduled completion dates to implement these  four tasks, according to DOD officials. DOD CIO officials told us that they  had not required DOD components to develop plans with scheduled  completion dates for the remaining four CDIP tasks. CIO officials believed  that the DOD components would implement the CDIP memorandum  since it was signed by the Deputy Secretary of Defense and it required  them to report on their progress in implementing the CDIP tasks. While  the Deputy Secretary of Defense did require DOD components to  implement these four tasks and report on their progress, components  have not achieved performance targets. If DOD components do not  develop plans with scheduled completion dates to implement the  remaining four CDIP tasks, the department may fail to remove  preventable, well-known vulnerabilities from its network and may allow  adversaries to compromise the confidentiality, integrity, or availability of  sensitive information and information systems.

DOD Does Not Know the Extent that Seven CDIP Tasks Have Been Implemented

DOD does not know the extent to which components have implemented  the seven CDIP tasks that the CIO does not oversee because the  responsible components have not reported on their progress, according  to DOD officials. For example, DOD has not reported on the extent to  which components have disabled hyperlinks to websites that users  receive in email messages. Disabling hyperlinks in email messages can  help to prevent phishing attacks. DISA officials told us that the agency  implemented a security protocol that disables these hyperlinks in DISA’s  email server. Consequently, DOD components that use DISA’s email  service are compliant with this task’s requirement; however, not all DOD  components use DISA’s email service and the extent to which other email  services comply with this task is unknown.

The CDIP memorandum signed by the Deputy Secretary of Defense  stated that the department’s progress in implementing all CDIP tasks  would be reported. However, the department has not reported on the  progress it has made implementing the seven CDIP tasks that the CIO  does not oversee in part because the Deputy Secretary of Defense did  not identify, in the CDIP memorandum, a component to oversee the  implementation of these tasks and report on their progress.

According to DOD CIO officials, some of these seven tasks are more  tactical and may be more appropriately tracked at echelons below the  office of the DOD CIO. For example, one of these seven tasks requires  that commanders ensure the physical security of their network  infrastructure devices. We agree that lower echelons may more  effectively track the progress of some tasks; however, information about  the progress that components make implementing these tasks is not  reported to the CIO or any other DOD component, according to DOD  officials. In addition, DOD CIO officials told us that JFHQ-DODIN collects  some information from inspections it performs to verify the extent that  inspected units implement technical guidance documents, some of which  relate to these seven CDIP tasks. However, according to DOD officials,  JFHQ-DODIN does not report this information to the CIO or any other  DOD component. In addition, JFHQ-DODIN inspects a sample of DOD  units and therefore does not have information about the status of these  tasks across the department. For those units that are inspected, no DOD  component is aggregating data from these inspections to identify the  extent to which these seven tasks are implemented.

If the Deputy Secretary of Defense does not identify a DOD component to  oversee the implementation of the seven CDIP tasks that DOD CIO does  not oversee and report on progress implementing them, the department  will have less assurance that cybersecurity vulnerabilities are being  addressed in a timely manner and systems are being securely configured.

DOD Has Not Fully Implemented Its Cyber Awareness Challenge Training Initiative

Selected DOD Components Did Not Know the Extent to Which Their Users Implemented the 2018 Cyber Awareness Challenge Training

The 16 selected components we included in our sample did not always  collect information on the number of users (1) that completed the fiscal  year 2018 Cyber Awareness Challenge training, (2) that did not complete  the training, and (3) whose network access was revoked for not  completing the cyber awareness training. Specifically:

Unknown number of users that completed the cyber awareness  training. Two of the 16 did not collect information on the number of  users that completed the fiscal year 2018 Cyber Awareness  Challenge training. In particular, the Army and the Defense Finance  and Accounting Service could not provide data on the extent that  users had taken the required training in fiscal year 2018.

Unknown number of users that did not complete the cyber  awareness training. Six of the 16 components did not collect  information on the number of users that did not complete the cyber  awareness training. In particular, the Navy, Air Force, Marine Corps,  U.S. European Command, and the Defense Media Activity did not  collect information on the users who did not complete the training in  fiscal year 2018. In addition, the Army’s training compliance system  did not have records for all Army users in 2018, which limited the  Army’s ability to determine if all of its users completed the fiscal year  2018 Cyber Awareness Challenge training.

Unknown number of users whose network access had been  revoked for not completing the required training. Eight of the 16  components that we contacted did not collect data on the number of  users whose network access had been revoked for not completing the  required training, as implied by DOD policy.

Selected DOD components did not know the extent to which their network  users implemented the 2018 Cyber Awareness Challenge training by  completing it because the DOD component heads did not ensure that  their respective components were accurately monitoring and reporting the  necessary information. Navy officials told us that they believed it was not  DOD or the military service’s policy for the service headquarters to track  whether their network users had completed the training. According to  Navy officials, there is also no value for large organizations like the Navy,  with over 600,000 users, to track and report these data at the  headquarters level.

However, DOD policy requires all network users to take the Cyber  Awareness Challenge training annually. In addition, DOD policy states  that all individuals with network access must complete this training to  retain access. NIST also advises that agencies capture training  compliance data at an agency level, so data can be used to conduct  agency-wide analysis and reporting.

Multiple DOD policy and guidance documents—including DOD Manual  8570.01-M, and Chairman of the Joint Chiefs of Staff Instruction  6510.01F—state that the DOD component heads are responsible for  ensuring that users complete the Cyber Awareness Challenge training  and two of these documents require recording training compliance. For  example, according to DOD Manual 8570.01-M, Information Assurance  (IA) Workforce Improvement Program, components must document and  maintain the status of awareness compliance for each user.

Further, service policy and guidance places the responsibility on the DOD  component heads or senior-level leaders at the headquarters’ level for  ensuring that cybersecurity training is completed and documented. For  example, Secretary of Navy Instruction 5239.3C, Department of Navy  Cybersecurity Policy (May 2, 2016), states that the Chief of Naval  Operations and the Commandant of the U.S. Marine Corps shall ensure  all authorized users of Department of Navy information systems and  networks receive initial cybersecurity awareness orientation as a  condition of access and, thereafter, complete annual refresher training,  monitor and report workforce cybersecurity training and maintain  supporting records. Similarly, Army Regulation 25-2, Army Cybersecurity  (Apr. 4, 2019), states that the Deputy Chief of Staff, G3/5/7 is responsible  for ensuring that cybersecurity training is integrated and conducted  throughout the Army.

If the DOD component heads do not ensure that their respective  components accurately monitor and report information on the extent that  users have completed the Cyber Awareness Challenge training—as well  as have access revoked for not completing the training—the components  may be unable to ensure that DOD users are trained in the steps needed  to address cybersecurity threats to the department.

DARPA Has Not Required its Users to Take DOD’s Cyber Awareness Challenge Training

One of the 16 selected components in our review—DARPA—did not  require its users to take DOD’s Cyber Awareness Challenge training,  according to DARPA officials, even though it is required by policy.  Instead, DARPA has required its users to take cybersecurity training that  it developed. While DARPA developed its own training program, we found  that this training program did not address all of the requirements identified  in a DOD staff manual or the cybersecurity training topics identified by the  Cyber Workforce Advisory Group. DARPA officials recognized that its  cybersecurity training was not equivalent to the DOD’s Cyber Awareness  Challenge training program, which according to DOD CIO officials,  addressed the training topics identified by the DOD Cyber Workforce  Advisory Group. They explained that DARPA designs its courses to be  concise to allow their personnel to focus on accomplishing the agency’s  mission and that users can obtain additional information from references  cited in the course materials. In addition, these officials told us that they  were unaware their users were required to take the Cyber Awareness  Challenge training that DISA developed.

The DOD CIO is responsible for overseeing the implementation of the  Cyber Awareness Challenge training, according to DOD CIO officials.  However, DOD CIO officials told us they were not aware that DARPA has  not required its users to take the Cyber Awareness Challenge training  that DISA developed and they did not assess the extent that components  complied with the requirement for components to use the DISA- developed training. If the DOD CIO does not ensure that DARPA and any  other DOD components take the Cyber Awareness Challenge training  developed by DISA, users in these components may take actions that  lead to or enable exploitations of DOD information systems.

DOD Does Not Know the Extent that Cyber Hygiene Practices Have Been Implemented to Protect DOD Networks from Key Cyberattack Techniques

DOD identified key techniques that adversaries use most frequently and  that pose significant risk to the department’s networks and identified  cyber hygiene practices to protect the department’s networks from these  techniques. Specifically, JFHQ-DODIN has identified the cyberattack  techniques that the agency observes adversaries using most frequently to  attack the department’s networks. In addition, the National Security  Agency, the Defense Information Systems Agency, and the DOD CIO  identified 177 cyberattack techniques and prioritized the techniques  according to the level of risk each posed to the department’s networks.  The agencies prioritized the techniques using various criteria including  the prevalence of the technique and whether the department could detect  the use of the technique. Further, the department has established cyber  hygiene practices to mitigate most of the frequently occurring techniques  and those that the department identified as the highest priority, according  to DISA and JFHQ-DODIN officials.

However, the department does not know the extent that these cyber  hygiene practices have been implemented across the department to  protect its networks from these key cyberattack techniques.  Components have visibility of the extent that they have implemented  practices within their component, according to DOD officials. For  example, DISA officials told us that they require their component to  implement cyber hygiene practices to protect DOD networks from key  cyberattack techniques and are able to determine the extent that those  practices are implemented within DISA. However, no component or office  within the department has complete visibility of the department’s efforts to  implement these protective practices across the department, according to  DOD officials.

FISMA states that agency heads shall be responsible for, among other  things, providing information security protections commensurate with the  risk and magnitude of harm that could result from unauthorized access,  use, disclosure, disruption, modification or destruction of such information  systems. Executive Order 13800 states that agency heads will be held  accountable for managing cybersecurity risk to their enterprises. The  order requires agency heads to use the NIST’s Framework for Improving  Critical Infrastructure Cybersecurity (commonly referred to as the NIST  Cybersecurity Framework) to manage their agency’s cybersecurity risk.  The Cybersecurity Framework calls for senior executives to monitor  cybersecurity risk in the same context as financial risk and other  organizational risks. In doing so, the Cybersecurity Framework calls for  agencies to, among other things, assess cybersecurity risks (including  threats), prioritize cybersecurity outcomes and requirements based on  that risk, and establish processes to assess and monitor the  implementation of the cybersecurity outcomes and requirements.

The department does not know the extent that practices to protect DOD  networks from key cyberattack techniques have been implemented  across the department in part because no DOD component monitors the  extent to which such practices are implemented, according to DOD  officials. Officials from JFHQ-DODIN told us that they are able to detect  when adversaries are using techniques to attack the department’s  networks. However, detecting an attack after it has commenced may still  enable an adversary to inflict harm on the department’s networks and the  information therein. If the Secretary of Defense does not direct a  component to monitor the extent to which practices to protect its network  are implemented, gaps in protection could go undetected. These gaps  can jeopardize military operations, performance of critical functions, and  protection of information within DOD systems and networks.

Senior DOD Leaders Have Not Received Information on Two Cyber Hygiene Initiatives or Cyber Hygiene Practices

DOD requirements and best practices recognize that senior DOD leaders  need key information to make risk-based decisions. Specifically, the DC3I  memorandum requires the commander of U.S. Cyber Command, in  coordination with the DOD CIO, to provide quarterly updates to the  Deputy Secretary of Defense and the Vice Chairman of the Joint Chiefs of  Staff on the progress in implementing the DC3I. Further, the CDIP  memorandum requires the department to report progress implementing  the CDIP tasks. In addition, NIST Special Publication 800-50, Building an  Information Technology Security Awareness and Training Program,  states that the CIO should ensure that agency heads and senior  managers are informed of the progress of the security awareness and  training program’s implementation.

Senior DOD leaders receive two recurring reports on the department’s  cybersecurity posture that include information on one cyber hygiene  initiative. Specifically, the Cyber Hygiene Scorecard (Scorecard) is a  report measuring compliance with DOD cybersecurity policies,  procedures, standards and guidelines. The Scorecard provides  information to the Secretary of Defense, the Deputy Secretary of  Defense, and DOD component heads about the extent that the 10 CDIP  tasks overseen by the DOD CIO are implemented. In addition, the Cyber  Landscape Report is a quarterly report that includes information  highlighting cybersecurity risks to DOD networks, U.S. critical  infrastructure, DOD weapon systems, the cloud, and DOD’s cyber  workforce. Based on our analysis, the Cyber Landscape Report also  includes some information from the CDIP initiative.

However, senior DOD leaders have not received information on the other  two cyber hygiene initiatives or cyber hygiene practices to protect DOD  networks from key cyberattack techniques in these recurring reports.  Specifically, neither the Scorecard nor the Cyber Landscape Report  includes information on the extent that the DC3I and the Cyber  Awareness Challenge training have been implemented. In addition,  neither of these recurring reports identifies key cyberattack techniques  the department faces nor do they include information on the extent that  the department has implemented cyber hygiene practices to protect DOD  networks from these techniques, according to DOD officials.

Senior DOD leaders are not receiving complete information in part  because the DOD CIO has not assessed the extent that the missing  information could improve senior leaders’ ability to make risk-based  decisions. According to DOD officials, DOD CIO has not revised the  recurring reports or developed a new report in response to such an  assessment. DOD CIO officials told us that they do not believe that senior  DOD leaders need to be made aware of all cyber hygiene topics we  describe here—and in some cases that information could be managed at  lower echelons within the organization. While some cyber hygiene  information could be managed by lower-echelon DOD leaders, the DC3I  memorandum requires information about its progress to be reported to  senior leaders. The NIST guidance calls for similar reporting.

Additionally, a DOD official told us that the department uses the Cyber  Hygiene Scorecard to respond to the department’s requirement to  annually report progress on implementing its information security program  to the Office of Management and Budget under FISMA. Further, these  officials told us that the Scorecard was not originally designed to include  the information from our analysis such as information about the DC3I.  They told us that this Scorecard was designed to provide an oversight  tool to monitor the progress components made implementing the CDIP  tasks overseen by DOD CIO.

However, while DOD uses the Scorecard with the intention to meet the  FISMA annual reporting requirement, the Scorecard does not provide  information about 53 of the 69 risk-management FISMA indicators that  are called for by the Office of Management and Budget. In addition,  DOD CIO is not precluded from revising the Scorecard to include  additional information. As one of two recurring reports sent to senior DOD  leaders, the Cyber Hygiene Scorecard may be well positioned to provide  additional information reflecting progress made implementing cyber  hygiene initiatives and associated cybersecurity practices, including the  DC3I and efforts to protect DOD networks from the key cyberattack  techniques used by adversaries.

Further, a DOD CIO official told us that its officials did not include  information about the DC3I in the Cyber Hygiene Scorecard because they  believed it would be challenging to measure the culture-related objectives  in the DC3I. While the DC3I’s culture-related objectives may be difficult to  measure, the extent to which assigned DOD components have taken  actions to implement the DC3I tasks is measurable. If the DOD CIO does  not assess the extent that the missing information could improve senior  leaders’ ability to make risk-based decisions—and does not follow up to  revise the recurring reports or develop a new report—senior DOD leaders  will not be positioned well to make effective and risk-based decisions and  manage cybersecurity risks.

As DOD has become increasingly reliant on IT systems and networks to  conduct military operations and perform critical functions, risks to these  systems and networks have also increased because IT systems are often  riddled with cybersecurity vulnerabilities—both known and unknown.  These vulnerabilities and human error can facilitate security incidents and  cyberattacks that disrupt critical operations; lead to inappropriate access  to and disclosure, modification, or destruction of sensitive information;  and threaten national security.

DOD has taken actions to address cyber vulnerabilities in the department  through establishing the DC3I, the CDIP, the Cyber Awareness Challenge  training, and cyber hygiene practices to protect its networks from  cyberattack techniques that adversaries may use. However, the  department faces challenges implementing the DC3I and CDIP because  the DOD CIO has not taken appropriate steps to ensure that the DC3I  tasks are implemented, DOD components have not developed plans with  scheduled completion dates to implement the remaining four CDIP tasks  overseen by DOD CIO, and the Deputy Secretary of Defense has not  identified a DOD component to oversee the implementation of the seven  other CDIP tasks and report on progress implementing them. By  improving oversight through implementing the DC3I tasks, DOD  components developing plans with scheduled completion dates to  implement the remaining four CDIP tasks that the DOD CIO oversees,  and identifying a DOD component to oversee implementation of the  seven other CDIP tasks and report on progress implementing them, the  department can be better positioned to safeguard DOD’s network by  removing preventable, well-known vulnerabilities.

If the components address gaps we identified in the extent that they   account for whether their users completed the 2018 Cyber Awareness  Challenge training will help the department gain assurance that its  workforce is prepared to identify and appropriately respond to  cybersecurity risks. Additionally, by ensuring that DARPA, and any other  similar DOD components, requires its users to take the required DISA- developed training, DOD users may be more aware of threats and  vulnerabilities to the department’s networks and may be better equipped  to prevent exploitations of DOD information systems.

The department does not know the extent that cyber hygiene practices  have been implemented to protect DOD networks from key cyberattack  techniques. By directing a component to monitor the extent to which  practices to protect DOD’s networks are implemented, DOD would be  better positioned to ensure that its networks are secure and decrease  potential risks to military operations, critical functions, and information  assurance.

Finally, the lack of information on two cyber hygiene initiatives and cyber  hygiene practices in recurring reports provided to senior DOD leaders is  concerning because of the need for those leaders to have a complete  picture of the state of the department’s cybersecurity posture. By directing  DOD CIO to assess the extent that the missing information could improve  senior leaders’ ability to make risk-based decisions and revise the  recurring reports or develop a new report, DOD leaders would then be  better positioned to make effective decisions and manage cybersecurity  risks.

We are making seven recommendations to the Department of Defense.

The Secretary of Defense should ensure that the DOD CIO takes  appropriate steps to ensure implementation of the DC3I tasks.  (Recommendation 1)

The Secretary of Defense should ensure that DOD components develop  plans with scheduled completion dates to implement the four remaining  CDIP tasks overseen by DOD CIO. (Recommendation 2)

The Secretary of Defense should ensure that the Deputy Secretary of  Defense identifies a DOD component to oversee the implementation of  the seven CDIP tasks not overseen by DOD CIO and report on progress  implementing them. (Recommendation 3)

The Secretary of Defense should ensure that DOD components  accurately monitor and report information on the extent that users have  completed the Cyber Awareness Challenge training as well as the  number of users whose access to the network was revoked because they  have not completed the training. (Recommendation 4)

The Secretary of Defense should ensure that the DOD CIO ensures all  DOD components, including DARPA, require their users to take the Cyber  Awareness Challenge training developed by DISA. (Recommendation 5)

The Secretary of Defense should direct a component to monitor the  extent to which practices are implemented to protect the department’s  network from key cyberattack techniques. (Recommendation 6)

The Secretary of Defense should ensure that the DOD CIO assesses the  extent to which senior leaders’ have more complete information to make  risk-based decisions—and revise the recurring reports (or develop a new  report) accordingly. Such information could include DOD’s progress on  implementing (a) cybersecurity practices identified in cyber hygiene  initiatives and (b) cyber hygiene practices to protect DOD networks from  key cyberattack techniques. (Recommendation 7)

We provided a draft of this report to the department for review and  comment. In written comments, reprinted in appendix III, DOD concurred  with one of our seven recommendations, partially concurred with four,  and did not concur with the remaining two. DOD separately provided  technical comments, which we incorporated as appropriate.

The department concurred with our recommendation (Recommendation  5) that the DOD CIO ensure all components, including DARPA, require  their users to take the Cyber Awareness Challenge training developed by  DISA.

The department partially concurred with four of our recommendations.

The department partially concurred with our recommendation that the  DOD CIO take steps to ensure that DC3I tasks are implemented. The  department concurred that tasks two and six in the DC3I should be  implemented and stated that these two tasks are the only two still  actively being pursued. The department stated that the remaining five  tasks were either implemented or have been overcome by events.  However, the department did not provide evidence that the other five  tasks were implemented or demonstrate how these tasks were  overcome by events during the audit or in its comments on a draft or  our report. In addition, JFHQ-DODIN officials stated that the principles  outlined in the DC3I are important for the department to achieve its  cybersecurity goals. For example, several of these five tasks were  focused on improving cybersecurity awareness and training at all  levels within the department. Therefore, it is unclear why DOD  believes that these cyber hygiene tasks have been overcome by  events; DOD did not elaborate. Implementing all seven DC3I tasks  that have not been implemented can better position the department to  achieve the goals of the DC3I to (1) mitigate the risks of  compromising the confidentiality, integrity, and availability of mission- critical information as a result of human error by users on the  department’s networks; and (2) transform DOD cybersecurity culture  by enabling and reshaping leaders, cyber providers, personnel who  perform cyberspace operations, and general users to improve  individual human performance and accountability on DOD’s network.

The department partially concurred with our recommendation that  DOD components develop plans with scheduled completion dates to  implement the four remaining CDIP tasks overseen by DOD CIO.  DOD provided classified comments on this recommendation. Thus,  we cannot respond in detail to their comments. We plan to respond to  DOD’s comments in a classified version of this report, which we plan  to issue later in 2020. Developing plans that would facilitate  implementation of these four CDIP tasks would better position DOD to  meet the Deputy Secretary of Defense’s goal of removing preventable  vulnerabilities from DOD’s network that could allow adversaries to  compromise information and information systems.

The department partially concurred with our recommendation that  components accurately monitor and report information on the extent  that users have completed the Cyber Awareness Challenge training  and information on the number who have been denied access to the  network for not completing the training. The department concurred  that it should ensure components accurately report the number of  users who have completed the training. However, it did not concur  that components should report the number of users who have been  denied access to the network because they have not completed the  training. The department stated that a statistic showing this  information would not be meaningful and would be burdensome to  collect. We disagree that such a measure would not be meaningful  because it would help leaders hold network users accountable and  better position DOD components to comply with DOD policy.  Recognizing that trained and aware users are the first and most vital  line of defense, DOD components should document and maintain the  status of awareness compliance for each user. In its current  approach, DOD is unable to confirm whether all of its network users  have completed the cybersecurity training, as required. For example,  as stated above, 8 of the 16 (50 percent) of the DOD components we  requested training information from told us they did not monitor  whether users who did not complete the annual training were blocked  from DOD networks and systems. If the Secretary of Defense does  not ensure that DOD components accurately monitor and report  information on the number of users whose access to the network was  revoked because they have not completed the training, the  components will jeopardize the department’s ability to ensure that  DOD users are trained in steps needed to address cybersecurity  threats to the department.

In responding to this recommendation, DOD also stated that the Navy  indicated that it provided us data on the number of its users who  completed the training and the total number of its users. The department  stated that we could compute the number of Navy users who had not  completed the training by computing the difference between the total  number of users and the number of users who completed the training. We  updated our assessment of the Navy in our report. We now indicate that  the Navy was able to identify the number of users who had completed the  training in fiscal year 2018. However, we disagree that the difference  between the total number of users and the number of users who  completed the training equates to the number of users who did not take  the training. DOD CIO officials told us during our audit that computing the  number of users using this method is not reliable because there are  multiple explanations for the difference between the total number of users  and the number of users who took the training. For example, officials told  us that some military users leave the service before they complete the  annually required training and are included in the service’s total number  of users but are not included in the number of users who took the training.

The department partially concurred with our recommendation that the  CIO assess the extent to which senior leaders have information to  make risk-based decisions and then revise accordingly the recurring  reports. The department stated that it will revise the recurring reports  by merging the Cyber Hygiene Scorecard and a scorecard related to  the Cyber Landscape to assist senior leaders’ decision-making.  However, the department stated that it did not fully agree with the  recommendation because, as written in the draft report, the  department believed the recommendation was stating that DOD  should have “complete” information. Based on DOD’s comment, we  clarified the recommendation to state that senior DOD leaders should  have more complete information to make risk-based decisions. We  believe this is critical because the cyber hygiene tasks and practices  highlighted in the report were identified by the most senior leaders in  the department—including the Secretary of Defense, Deputy  Secretary of Defense, and Chairman of the Joint Chiefs of Staff—as  being the tasks and practices that were essential to protecting DOD  information, systems, and networks from the most common and  pervasive cybersecurity risks faced by the department. The  department also stated that risk is a function of multiple variables, that  are continually evolving. We agree that risk is a function of multiple  variables—including threats and vulnerabilities—that are continually  evolving. As such, we think that information, such as the extent to  which cyber hygiene practices have been implemented across the  department to protect its networks from evolving key cyberattack  techniques, will position senior leaders to make more effective and  risk-based decisions and manage cybersecurity risks.

The department did not concur with two recommendations. In particular:

DOD did not concur with our recommendation that the Deputy  Secretary of Defense identify a component to oversee the  implementation of the seven CDIP tasks that the CIO does not  oversee and report on progress implementing those tasks. The  department stated that, since the CDIP’s approval in 2015, the  department has issued new or updated versions of a number of cyber- related strategies, including the DOD Cyber Strategy. The department  also stated that the Deputy Secretary of Defense directed DOD to  develop a classified top 10 list of cybersecurity critical-risk areas and  an associated scorecard that provides the Deputy Secretary a  quarterly assessment of the department’s progress in reducing the  risk for each of these areas. The department also stated that the  cyber landscape is constantly evolving with changes in technology,  threats, and vulnerabilities, and that this requires DOD to reassess its  cybersecurity priorities. The department stated that implementing our  recommendation would override these recent efforts and focus the  department’s efforts on monitoring areas with lower levels of risk.

We disagree that implementing our recommendation would override the  department’s recent efforts. In fact, implementing the seven tasks would  align with one of the 2018 DOD Cyber Strategy’s objectives to “secure  DOD information and systems against malicious cyber activity.” We agree  with DOD that the department should reassess cybersecurity priorities in  light of changes in technologies, threats, and vulnerabilities. However,  DOD did not provide evidence during the audit or in responding to the  draft report that the department had assessed the CDIP tasks required by  the Deputy Secretary of Defense in 2015. Specifically, the department  has not determined whether they remain valid or aligned with the current  cybersecurity threat environment, that the vulnerabilities associated with  these seven tasks were mitigated or addressed, and that a senior-level  DOD official provided written direction canceling the Deputy Secretary of  Defense’ CDIP taskings. More importantly, our analysis of the seven  tasks that DOD is not currently tracking progress on are consistent with  basic cybersecurity standards established by DOD guidance and NIST— and which DOD is planning to apply to certain defense contractors in  future contract awards to protect DOD information that is stored or  transits through their networks as a part of the Cybersecurity Maturity  Model Certification framework. For example,

Task 14 requires commanders and supervisors to ensure physical  security of their network infrastructure devices. This task aligns with  general NIST guidance regarding physical access protections. NIST  guidance states that organizations should manage and protect  physical access to assets and facilities where information systems  reside.

Task 15 requires commanders and supervisors to report all  commercially provided internet connections to DOD’s unclassified  network. This task aligns with general NIST guidance regarding the  use of external networks. NIST guidance states that organizations  should catalogue all external information systems.

Task 16 requires commanders and supervisors to ensure alignment to  a Computer Network Defense Service Provider. This task is  consistent with DOD requirements on cybersecurity activities to  protect the DOD Information Network. The requirements state that  DOD IT must be aligned to DOD network operations and security  centers, which provide any required cybersecurity services.

Task 17 requires commanders and supervisors with Computer  Network Defense Service Provider responsibility to ensure the cyber  incident response plan(s) are properly exercised and documented.  This task aligns with general NIST guidance regarding incident  response. NIST guidance states that organizations should provide  incident response handling training and implement incident handling  capabilities, as well as a process to ensure that response processes  and procedures are executed, and maintained ensuring response to  detected cybersecurity incidents.

If the Deputy Secretary of Defense does not implement this  recommendation, the department will have less assurance that  cybersecurity vulnerabilities are being addressed in a timely manner and  systems are being securely configured.

The department did not concur with our recommendation that a  component monitor the extent of implementation of practices to  protect the department's network from key cyberattack techniques.  The department determined that the information in its response to this  recommendation included sensitive information. Therefore, we are  redacting the department’s response to this recommendation from  DOD’s written comments that we are reprinting in Appendix III.  However, we still believe the recommendation is valid. As stated in  our report, no component or office within the department has  complete visibility of the department’s efforts to implement these  protective practices across the department, according to DOD  officials. Taking action to implement the intent of this recommendation  would help address that gap.

We are sending copies of this report to the appropriate congressional  committees; the Secretary of Defense; DOD’s Chief Information Officer;  the Secretaries of the Army, Navy, and Air Force; the Commandant of the  Marine Corps; the Chairman of the Joint Chiefs of Staff; the Commanding  Generals of U.S. Strategic Command, U.S. European Command, U.S.  Southern Command, and U.S. Cyber Command; and the Directors of  DISA, the National Security Agency, DARPA, the Defense Commissary  Agency, the Defense Contract Management Agency, the Defense  Finance and Accounting Service, the Defense Media Activity, and the  Defense Technology Security Administration. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  us: Joseph Kirschbaum at (202) 512-9971 or kirschbaumj@gao.gov, or  Nick Marinos at (202) 512-9342 or marinosn@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Key contributors to this report are listed in  appendix III.

For the purposes of this review, we adapted a definition of cyber hygiene  developed by Carnegie Mellon University’s Software Engineering  Institute. The institute defines cyber hygiene as a set of practices for  managing the most common and pervasive cybersecurity risks faced by  organizations today.

We discussed the definition of cyber hygiene with Department of Defense  (DOD) officials to identify DOD initiatives aimed at improving cyber  hygiene. DOD officials identified the Cyber Discipline Implementation  Plan (CDIP) as DOD’s main cyber hygiene initiative aimed at  implementing technical improvements to DOD networks. In addition, DOD  officials identified the DOD Cybersecurity Culture and Compliance  Initiative (DC3I) and DOD’s Cyber Awareness Challenge training as two  initiatives designed to establish best practices for DOD network users  including military personnel, civilians, and contractors.

To determine the extent to which DOD has implemented its three cyber  hygiene initiatives and practices to protect its networks from cyberattack  techniques that adversaries may use, we conducted analyses for each  initiative.

To determine the extent to which DOD implemented the DC3I, we  reviewed the 11 tasks that require components to take actions that  are specified in the DC3I memorandum that the Secretary of Defense  and the Chairman of the Joint Chiefs of Staff issued in September  2015. We analyzed documentation we collected from U.S. Cyber  Command, the office of the DOD Chief Information Officer (CIO), and  the Joint Staff that demonstrate actions these components took in  response to each of the 11 DC3I tasks and determined the extent to  which each task was implemented.

To determine the extent to which DOD implemented the CDIP, we  reviewed the 17 tasks that require components to take actions  specified in a memorandum that the Deputy Secretary of Defense  issued in October 2015. We interviewed officials from the office of the  DOD CIO about the extent to which DOD components implemented  the CDIP tasks, the reasons the components had not fully  implemented all of the tasks, and to determine the extent that the  DOD CIO knew if DOD components had implemented the remaining  seven CDIP tasks. We also reviewed documentation on the extent  that DOD components implemented the tasks overseen by DOD CIO  by analyzing data included in the Cyber Hygiene Scorecard. We also  assessed the reliability of the data in the Scorecard by reviewing the  methods the DOD CIO uses to ensure the data reported to the  Scorecard are accurate and interviewing cognizant officials. We  determined the data are sufficiently reliable for our purposes.

To determine the extent that DOD implemented the Cyber Awareness  Challenge training, we analyzed the extent that the DOD CIO and the  DOD component CIOs ensured that personnel they oversee  completed the fiscal year 2018 Cyber Awareness Challenge training.  To carry out this analysis, we collected and analyzed information from  the DOD CIO and a sample of 16 DOD components.

We selected this sample of components by identifying important  groupings of components and selecting from these groups to ensure that  our sample represented a significant number of DOD personnel as well  as a variety of types of components. These groups were: the military  services and the Joint Staff, combatant commands, agencies and field  activities, and the Office of the Secretary of Defense.

Military services and Joint Staff. We selected the four military  services because they are the components within DOD with the most  personnel. We also included the Joint Staff because this component  reflects the strategic perspective for the department as a whole.

Combatant commands. We randomly selected three combatant  commands from the group of 11 combatant commands—including  geographic (e.g., U.S. Central Command) and functional (e.g., U.S.  Transportation Command). We selected three of the 11 combatant  commands to include the perspectives of multiple combatant  commands in our sample. We selected these combatant commands:  U.S. European Command, U.S. Southern Command, and U.S.  Strategic Command.

Agencies and Field Activities. We assembled a list of non-service  and non-combatant command components organized by the types of  functions that each component performs. We then organized these  components by functional groupings. Specifically, we created  functional groupings for the components that fall under each of the six  Under Secretaries of Defense because these officials oversee  components with similar functions. We also included a seventh  functional group of miscellaneous components that are not overseen  by any of the Under Secretaries of Defense. We then accounted for  the size of the components on this list by identifying the larger  agencies and the smaller field activities. From this list, we randomly  selected one component from each of the seven groups. In doing so,  we selected five of the 20 agencies and two of the eight field activities.  We chose this ratio of agencies to field activities to reflect the ratio of  agencies to field activities in DOD. That is, DOD agencies are about  71 percent of DOD’s non-service and non-combatant command  components and about 71 percent of our sample.

We selected these five agencies: Defense Advanced Research  Projects Agency, Defense Commissary Agency, Defense Contract  Management Agency, Defense Finance and Accounting Service and  the National Security Agency. We selected these two field activities:  Defense Media Activity and Defense Technology Security  Administration.

The Office of the Secretary of Defense. We also randomly selected  one of 16 components from the Office of the Secretary of Defense.  This group included the offices that support the six Under Secretaries  we discussed above such as the Under Secretary of Defense for  Policy as well as other offices including the Office of Cost Assessment  and Program Evaluation and the Office of the DOD Chief  Management Officer. We selected one component from this group to  ensure we reflected the perspective of components at the DOD  headquarters level. We selected the Office of the DOD Chief  Information Officer.

To collect information from this sample of 16 components, we developed  a standard set of questions we provided to each component on topics  related to both objectives. In particular, we asked DOD components to  provide the number of network users that completed the fiscal year 2018  Cyber Awareness Challenge training, the number of network users that  did not complete the training, and the number of network users who had  their access to the network removed as a result of not taking the training.  We also asked other questions including a question about the information  that senior leaders are provided regarding cyber hygiene practices.

Each component provided written responses to our questions and in  some cases provided documentation corroborating their responses. We  conducted a content analysis of the components’ responses and the  documentation they provided. To complete this content analysis, two  analysts assessed the components’ responses, compared and discussed  their separate analyses, and reached agreement on their conclusions  about their analysis. We compared the information we collected from  these components to a provision in NIST Special Publication 800-50,  Building an Information Technology Security Awareness and Training  Program, which advises agencies to capture training compliance data at  an agency level.

Further, we interviewed officials from Defense Information Systems  Agency and JFHQ-DODIN to determine the extent to which DOD had  implemented cyber hygiene practices that the department has  implemented to protect its networks from key cyberattack techniques that  adversaries may use.

To determine the extent to which senior DOD leaders receive information  on the department’s efforts to address cyber hygiene initiatives and  practices, we first defined senior DOD leaders as the Secretary of  Defense, the Deputy Secretary of Defense, and DOD component heads.  To identify the information that could be included in reports that senior  DOD leaders receive about DOD efforts to mitigate cyberattack  techniques, we identified techniques that are most likely to be used by  adversaries against DOD’s networks or that could cause severe adverse  effects on DOD’s operations. In particular, we identified 22 key  cyberattack techniques from two sources:  Joint Force Headquarters DOD Information Network (JFHQ-DODIN)  provided a list of eight cyberattack techniques that the agency  observed adversaries using most frequently in January 2019. JFHQ- DODIN officials also determined that these data are representative of  the cyberattack techniques that they have recently observed.

We identified 14 cyberattack techniques by analyzing a review  conducted in 2016 by the National Security Agency, the Defense  Information Systems Agency, and the DOD CIO. In the review, the  agencies identified 177 cyberattack techniques and ranked the  techniques according to the level of risk the techniques posed to  DOD’s unclassified and Secret-level networks. The agencies used a  number of different criteria to rank these techniques, including the  prevalence of the technique, visibility of the technique, and whether  other, closely associated alternative techniques exist. We selected the  14 cyberattack techniques that the agencies identified as the highest  priority.

Next, we analyzed the contents of two recurring reports that senior  leaders receive on the department’s cybersecurity posture: the Cyber  Hygiene Scorecard and the Cyber Landscape Report. In particular, we  analyzed these reports to determine if they included information about  DOD’s implementation of key cyber hygiene initiatives that we describe in  the first objective. We also analyzed the reports to determine if they  included the lists of key cyberattack techniques and information about the  extent that the department had implemented cyber hygiene practices to  protect DOD networks from these cyberattack techniques.

We conducted this performance audit from January 2019 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: DOD Cybersecurity Culture and Compliance Initiative Tasks

The Department of Defense (DOD) Chief Information Officer (CIO) and  other relevant DOD components implemented four of the 11 tasks  required in the Cybersecurity Culture and Compliance Initiative (DC3I)  and the remaining seven tasks were not fully implemented as of October  2019. Table 2 provides additional information of actions taken to address  and implement all 11 DC3I tasks.

Appendix III: Comments from the Department of Defense

Appendix IV: GAO Contacts and Staff Acknowledgments

In addition to the individuals named above, Tommy Baril (Assistant  Director), Kaelin Kuhn (Assistant Director), James P. Klein (Analyst-in- Charge), Tracy Barnes, Amy Bush, Peter Casey, Amie Lesser, Carlo  Mozo, Richard Powelson, Michael Silver, Andrew Stavisky, and Walter  Vance made significant contributions to this report. Kiana Beshir, Chris  Businsky, Shaun Byrnes, and Richard Sayoc also contributed to the  report.

“Cyber hygiene” is a set of practices for managing the most common and pervasive cybersecurity risks. The Department of Defense’s cyber hygiene is critical as threats to its information and networks increase.

DOD has had 3 cyber hygiene initiatives underway. These efforts are incomplete—or their status is unknown because no one is in charge of reporting on progress.

DOD has also developed lists of its adversaries’ most frequently used techniques, and practices to combat them. Yet, DOD doesn’t know the extent to which it’s using these practices.

We made 7 recommendations that would have DOD fully implement cyber hygiene practices.