The DoD has released a new cybersecurity strategy for the DIB, focusing on governance, posture, resiliency, and collaboration.
Cybersecurity has become a larger concern on a national level, with many conflicts today including cyberattacks on critical infrastructure alongside physical attacks. In its war on Ukraine, Russia (with the help of other non-democratic countries) conducted cyber operations on Europe’s electric grid, and Volt Typhoon, a cyber group sponsored by the People’s Republic of China, was able to gain access to the US Department of Energy, the Environmental Protection Agency, and the Transportation Security Administration. Kathleen Hicks, Deputy Secretary of Defense said such attacks “threaten the U.S. and the rules-based order on which the global economy relies.”
In response, the Department of Defense (DoD) is prioritizing cybersecurity. The Joint Force Headquarters - Department of Defense Information Network (JFHQ - DODIN) has transformed the previous Defense Department Command Cyber Readiness Inspection program into the Cyber Operational Readiness Assessment (CORA), which will "help strengthen the posture and resiliency of the DODIN." This switch was only one of the efforts to improve defense cybersecurity in March 2024.
On March 28, 2024, the Defense Industrial Base (DIB), a group of industries that work together to create, develop, design, build, deliver, and maintain weapons and equipment for the U.S. military, released its first-ever cybersecurity strategy for fiscal year 2024 through fiscal year 2027. The strategy serves as a set of requirements that industry suppliers hoping to work with the DoD will have to meet. Though new to the Defense Industrial Base, the strategy aligns with previously established cybersecurity plans, like the 2023 National Cybersecurity Strategy, the 2023 DoD Cyber Strategy, and the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF).
The strategy focuses on four main goals:
- Strengthen the DoD governance structure for DIB cybersecurity: The DoD plans to do this by improving interagency collaboration between government stakeholders that are internal and external to the Department. The DoD will also build up and evaluate agency-specific cybersecurity requirements for the DIB using the Defense Federal Acquisition Regulation Supplement (DFARS), focusing on protecting defense information and rules for Cyber Incident Reporting as well as the NIST’s DoD Assessment Requirements.
- Enhance the cybersecurity posture of the DIB: First, the DoD will check the DIB’s compliance with the DoD’s cybersecurity requirements. The distribution of cyber-related intelligence will be refined - first with the public-private DoD DIB Cybersecurity Program, then the relaunch of DIBNet Portal (for sharing information about cyber threats). A DoD framework for data sharing for cyber-CI investigations is also under development. Other parts of their plan to enhance cybersecurity posture include finding vulnerabilities in DIB information technology (IT) cybersecurity ecosystems and setting up recovery operations to follow the detection of malicious cyber activity. Finally, the DoD will assess the effectiveness of these policies and adjust as necessary.
- Preserve the resiliency of critical DIB capabilities in a cyber-contested environment: The DoD will assess and prioritize vulnerable production capabilities in the DIB, which requires collaboration across the Department, as well as with the U.S. Government, to segment and focus resources on protecting critical production capabilities. The second part of this goal is establishing policies that reflect the priority focus on cybersecurity for critical suppliers and facilities.
- Improve cybersecurity collaboration on the DIB: The Defense Department will work with Internet, cloud, and cybersecurity service providers to enhance DIB cyber threat awareness. The DIB Sector Coordinating Council (SCC) will analyze anonymized cyber incident trends and share the information with the DoD. Lastly, the DoD wants to improve bidirectional communication with the DIB and develop better collaboration between the public and private cybersecurity sectors.
This strategy for the DIB exemplifies the important cybersecurity progress the Defense Department is making. Just last month, their Cyber Crime Center’s (DC3) Vulnerability Disclosure program reached a milestone of 50,000 reports processed. By zooming on in cybersecurity, the Department of Defense, and now, the Defense Industrial Base, are establishing crucial protections for the United States.