The Defense Department relies on the entrepreneurial companies and their innovative, hard-working employees in the defense industrial base, or DIB, to create capabilities for warfighters.
Through procurements from private-sector sources, the department leverages the best technologies and innovations to give service members the battlefield advantages they need to win decisively, Deputy Defense Secretary Kathleen H. Hicks said.
“DIB cybersecurity is and will remain an expanding priority for the U.S. Department of Defense. More than 220,000 companies provide value to the department’s force development, and the DIB is now facing increasingly sophisticated and well-resourced cyber-attacks that must be stopped,” she said, referring to the defense industrial base.
These cyber-attacks threaten the U.S. and the rules-based order on which the global economy relies, Hicks said. Markets cannot function effectively in an environment where adversarial countries are leveraging their national power to steal intellectual property, to sabotage commercial activity, and to threaten supply chains.
Recent examples of malicious cyber activity, such as the Colonial Pipeline ransomware attack and the SolarWinds espionage campaign, have shown that adversaries continue evolving their exploitation of cyberspace to steal sensitive information and disrupt systems, she said.
DOD has made protecting the defense industrial base from these threats a priority, David McKeown, deputy chief information officer for cybersecurity said.
Addressing the DIB, McKeown said that ”whether your company bends metal, develops capabilities, provides services or whatever its relationship with DOD, you should remain vigilant and prepare your company to defend and recover from cyber events.”
Ensuring a company can defend itself against cyberattacks starts by implementing essential cybersecurity practices, he said. ”The following 10 cybersecurity practices can go a long way to making your company cyber resilient:”
- Keep up-to-date architecture diagrams with inventories of all hardware and software to be able to respond to threats quickly.
- Patch and configure security settings on all devices and software.
- Employ active defenses for known attack vectors and stay ahead of attackers with the latest intelligence and response actions.
- Monitor network and device activity logs and look for anomalous behaviors.
- Employ multi-factor authentication because username and passwords are easily hacked.
- Employ email and browser defenses and prevention for two of the most prevalent attack vectors.
- Employ malware protection on the networks.\
- Encrypt data at rest and in transit.
- Train staff to avoid and respond to suspicious events.
Have contingency plans and exercise them. Employ backup and recovery, alternative services, emergency response/notification and other similar processes to ensure the organization can successfully respond to a cyber event.
“No two companies are alike or operate in the same way. However, these essential cybersecurity practices are a great start for any company to strengthen its cybersecurity posture,” McKeown said.
All DIB companies will be required to complete a Cybersecurity Maturity Model Certification (CMMC) (https://www.acq.osd.mil/cmmc/) which aligns with the cybersecurity requirements defined in NIST 800-171.
DOD has voluntary programs that the defense industrial base can leverage to bolster their cybersecurity posture with more rollouts planned in the future.
