DoD beefing up missile systems’ cyber defenses

Source Link

By: Meredith Rutland Bauer 

A tenant of the internet of things industry is that anything connected to the internet is connected to hackers. But when you’re talking about a trillion-dollar ballistic missile system, that possibility is unacceptable.

As network-connected devices are increasingly incorporated into military operations, defense experts understand that cybersecurity is a key concern. If missiles become vulnerable to cyber infiltration, that could hand enemy soldiers a live weapon that could be rendered useless against a threat or turned against the U.S.

“As technology evolves, it is critical that we protect our systems from a wide array of threats, including cyber threats, to ensure our systems remain ready when needed,” Missile Defense Agency Director Lt. Gen. Sam Greaves told Fifth Domain in an email.

Toward that end, the DoD allocated an additional $431 million for the purpose of shoring up cyber defenses on defensive ballistic missiles, according to the DoD’s December Selected Acquisition Reports released on July 18. The extra money comes to meet the DoD’s requirements as a part of the Cyber Security Discipline Plan.

The purpose of the Ballistic Missile Defense System (BMDS) is to shoot enemy missiles out the sky to defend “the United States, its deployed forces, allies, and friends” from ballistic missiles. The Missile Defense Agency (MDA), the agency that runs the BMDS, notes Iran and North Korea are of particular concern when it comes to a physical attack, but the identity of cyberattackers are harder to pin down.

Extra defensive measures are becoming more important, as shown in a report from a U.S. cybersecurity firm this spring that stated China attempted to use a hack to gain access to a missile defense system, the company told CNN.

According to FireEye, Chinese hackers attempted to get into an organization in South Korea that controls the U.S.-made Terminal High Altitude Area Defense (THAAD). THAAD handles defense against short- and medium-ranged ballistic missiles both inside and outside the atmosphere, according to Lockheed Martin. However, experts said systems like BMDS and THAAD are intrinsically different, so their vulnerabilities to cyberattacks would also differ.

Herb Lin, a cyber policy and security researcher at Stanford University’s Hoover Institution, said having proper cybersecurity on every computerized level of missile defense is critical.

When a defensive weapon is launched, several layers of information play into that decision. Computers tell service members that enemy missiles have been launched, when, and how fast they’re going so they can launch missiles to intercept. If any incoming information has been tampered with due to malware — or if malware or another malicious cyberattack change the resulting commands — missiles might not launch or might miss their target, Lin said.

In a particular worst-case-scenario, fake information could be inserted into a missile defense system alerting service members that an attack is ongoing but prove to be a false alarm, Lin said. In a misinformation attack, the first line of defense would be trained personnel’s ability to recognize false alarms — of the accidental and malicious variety.

“It’s all a matter of deception,” he said. “If someone takes over your computer, I’ve hacked the human being.”

The BMDS received an additional $3.2 billion from the DoD in total to comply with agreements with Israel under the Missile and Rocket Defense Cooperative Programs, to “accelerate Multi-Object Kill Vehicle risk reduction,” and other enhancements.

The Cyber Security Discipline Plan lays out cybersecurity practices across the DoD and include strong authentication to prevent hackers from getting inside U.S. systems, device hardening to reduce entry points for hackers, reducing attack surface and alignment to cybersecurity and computer network defense service providers to improve how quickly the DoD can find and respond to attacks.