‘It’s going to be painful’: Pentagon official urges contractors to improve cybersecurity

A politician-turned-defense official is trying to shake up the acquisition bureaucracy.

A politician-turned-defense official who is trying to shake up the acquisition bureaucracy in the U.S. Department of Defense told contractors they need to better prioritize security in order to do business with the Pentagon, and stifle foreign theft of defense secrets.

“This is a change of culture,” Katie Arrington, chief information security officer of the Pentagon’s acquisition policy office, said Wednesday. “It’s going to take time, it’s going to be painful, and it’s going to cost money.”

Arrington, who joined the Office of the Undersecretary of Defense for Acquisition and Sustainment in January, is spearheading the development of new cybersecurity standards for contractors. Last month, defense officials unveiled a draft of the guidelines, known as the Cybersecurity Maturity Model Certification.

The standards will require contractors of all sizes to have a baseline level of cybersecurity practices in order to, for example, prevent adversaries from exfiltrating their intellectual property. Companies holding more sensitive defense data will need to demonstrate more advanced security practices. An updated draft is coming next month, and defense agencies’ requests for information will start using the standards next year.

Arrington, at an event hosted by the Consortium for Information & Software Quality, warned contractors that if they fail to better secure their information, the consequences could be serious.

“If industry doesn’t think that they’re not going to start getting slapped on this, there’s another thing coming,” Arrington said, citing the government’s ability to fine companies for selling insecure products.

Pentagon officials for years have struggled to institute stronger security practices at contractors, where intellectual property is a high-value target for state-sponsored hackers. This past March, the Department of the Navy released a scathing assessment of the service’s approach to cybersecurity, lamenting that hackers have operated relatively unimpeded. A 2014 Senate report criticized the Transportation Command for being largely unaware that Chinese hackers had breached its contractors 20 times over the course of the year.

“As a small business, when an adversary gets into your network, they’re not just going to take your [controlled unclassified information], they’re going to take your IP, they’re going to take your [personally identifiable information], they’re going to take your payroll information,” Arrington said Wednesday. “They’re going to take it all.”

Later, during her speech, she instructed the audience to repeat the phrase, “We all are going to get breached.”

Cybersecurity practices in the defense industrial base are “not something that changes by the day,” Arrington said, citing years-long contracts and procurement policies. And the general lack of awareness among defense companies that they’ve been breached is still a problem, she acknowledged.

A former defense contractor with Booz Allen Hamilton, Arrington has dabbled in politics in recent years. She won a seat in the South Carolina House of Representatives in 2016 before losing a bid last year to represent the state in Congress. During her primary with fellow Republican Mark Sanford, she accused the former South Carolina governor of not showing enough support for President Donald Trump.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure