Biblio

We need risk management solutions to assess, measure, and mitigate risk in real-time across multi-tier partner and supplier networks to achieve our goal of cost, schedule and performance, as they are only effective in a secure environment.

Modern weapons systems have depended on microelectronics since the inception of integrated circuits over fifty years ago. Today, most electronics contain programmable components of ever increasing complexity. At the same time, the Department of Defense (DoD) has become a far less influential buyer in a vast, globalized supplier base. Consequently, assuring that defense electronics are free from vulnerabilities is a daunting task.

Because system configurations typically remain unchanged for very long periods of time, compromising microelectronics can create persistent vulnerabilities. Exploitation of vulnerabilities in microelectronics and embedded software can cause mission failure in modern weapons systems. Such exploitations are especially pernicious because they can be difficult to distinguish from electrical or mechanical failures and because effects can run the gamut from system degradation to system failure to system subversion.

Cyber supply chain vulnerabilities may be inserted or discovered throughout the lifecycle of a system. Of particular concern are the weapons the nation depends upon today; almost all were developed, acquired, and fielded without formal protection plans.

This is GAO’s 18th annual assessment of DOD acquisition programs. GAO’s prior assessments covered major defense acquisition programs. This year’s assessment expands to include selected major IT systems and rapid prototyping and rapid fielding programs, in response to a provision in the National Defense Authorization Act for Fiscal Year 2019.

This report (1) summarizes the characteristics of 121 weapon and IT programs, (2) examines cost and schedule measures and other topics for these same programs, and (3) summarizes selected organizational and legislative changes. GAO identified the 121 programs for review based on their cost and acquisition status. GAO selected organizational and legislative changes that it determined related to the execution and oversight of the 121 programs.

GAO reviewed relevant legislation and DOD reports, collected data from program offices through a questionnaire, and interviewed DOD officials.
Additional analyses and assessments of major IT programs are included in a companion report to be issued later this year.

The Department of Defense (DOD) currently plans to invest over $1.8 trillion to acquire new major weapon systems such as aircraft, ships, and satellites. At the same time, the department is investing billions more in information technology (IT) systems and capabilities that it expects to either prototype or field rapidly through a new middle-tier acquisition pathway. (See table.)

Deception has always been a key strategy in war, politics, and commerce, but now this technique is being utilized in the battle of cybersecurity. Cybercriminals have applied this technique through the development and launch of cyberattacks such as phishing. Deception technology is now emerging as a security defense method for enterprises.  The implementation of this technology could help lure hackers away from sensitive assets once they have successfully infiltrated an organization's network.