Audit warns of poor planning on vast Pentagon IT plan

The Pentagon's huge plan to rationalize the U.S. military's sprawling and multifarious IT infrastructure into a single Joint Information Environment is at risk of failure because of poor scheduling and budgeting, inadequate workforce planning and a failure to properly lay out the scope and objectives of the massive undertaking, a new audit says.

The Pentagon’s huge plan to rationalize the U.S. military’s sprawling and multifarious IT infrastructure into a single Joint Information Environment is at risk of failure because of poor scheduling and budgeting, inadequate workforce planning and a failure to properly lay out the scope and objectives of the massive undertaking, a new audit says.

The Department of Defense ‘has not adequately defined the effort’s scope or expected cost,’ write auditors from the Government accountability Office in a report out this week.

For example, auditors state, the 2013 JIE implementation strategy includes software application rationalization and desktop virtualization as part of the project. But ‘briefings provided to congressional staff and to us in 2015 did not specifically include this element.’

‘In addition, DOD has not established a reliable schedule or sufficiently developed workforce and security assessment plans,’ they add.

The huge scale of the JIE undertaking incorporates the U.S. military’s 65,000 servers, and 7 million endpoints — all connected to 15,000 different networks — used by DOD’s 1.3 million military active duty and 742,000 civilian personnel, who are based at more than 555,000 facilities scattered across the globe.

‘As a result of the program’s management and planning weaknesses, DOD decision makers and congressional stakeholders lack reliable information needed to make informed decisions about progress and needed changes,’ the report’s authors state.

In fact, the report says, DOD officials do not even consider JIE to be a program of record. Instead, it is ‘a construct for managing improvement and modernization of DOD’s IT infrastructure and the associated operational concepts, and does not have a discrete beginning or ending such as would be expected with a program.’

Officials are paying for JIE through ‘existing DOD component programs, initiatives, technical refresh plans, acquisition processes, and funding,’ auditors say. Partly as a result, the department has no estimate of how much JIE will eventually cost.

However, officials have costed out a single element of the JIE, the Joint Regional Security Stacks, or JRSS.

According to the audit, ‘JRSS is intended to enhance network command and control, increase bandwidth, and synchronize networks. It is to be used to screen network traffic to and from DOD installations, control traffic flows, identify and block unauthorized traffic, and isolate intrusions.’

To do this, the JRSS’s will replace about 1,000 nonstandardized network security stacks, currently scattered around the world, with 48 of the new standardized stacks at 25 locations, ‘reducing the number of avenues for cyber attack.’

The Pentagon, which started spending on the JRSS in fiscal year 2013, estimates it will have spent over $900 million by the end of the current fiscal year on Sept. 30; and will spend approximately $1.6 billion more in fiscal years 2017 through 2021.

‘Until DOD determines how it will document the costs of its JIE effort and officials and congressional committees are provided accurate information about expected costs, they are limited in their ability to provide oversight for performance and make effective resource decisions,’ the audit concludes.

The pressing threat of Chinese-made drones flying above U.S. critical infrastructure 

Drones from China's DJI contain high-res cameras, advanced sensors and wireless access, opening the door for espionage and sabotage.

Biden set to approve expansive authorities for Pentagon to carry out cyber operations

The Pentagon may require vendors certify their software is free of known flaws. Experts are split.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure