IoT poses security risks for DOD
Connecting state and local government leaders
A new GAO report called for the Pentagon to strengthen its policies and guidance for connected devices.
The Department of Defense is vulnerable to the security risks posed by a growing array of Internet of Things devices, and must adjust its policies to adapt, a new Government Accountability Office report argues. The report notes that while DOD has identified many IoT-related security risks and developed policies and threat scenarios, current rules do not adequately address these challenges. GAO recommends a range of updates to keep military information secure from threats posed by IoT devices.
The IoT risks previously identified by DOD are categorized into "operational risks," which come with using and operating a device, and "device risks," which come with the device itself. "Rogue" mobile applications used for malicious purposes and devices that can geotag are considered "operational," while issues such as unpatched software, limited encryption and supply chain threats represent "device" risks.
While DOD has already identified the risks and has provided guidance for many portable connected devices, , the report concludes, "GAO found that these policies and guidance do not clearly address some security risks relating to IoT devices."
For one thing, DOD currently lacks updated policies and guidance for certain IoT devices that it has acquired. Smart televisions and mobile applications, for example, present security risks that still need to be addressed, according to GAO. Additionally, the report observes that current policies and guidance on a host of security issues from cybersecurity, information security to physical security fail to take IoT devices into account. The report also notes there is no single DOD office for IoT security. Rather, the responsibility is shared among different organizations in the department.
In reply comments, acting DOD CIO John Zangardi indicated that an ongoing review of the relevant policies will be finished by the end of the current fiscal year.
This article first appeared on FCW, a sister site to GCN.
NEXT STORY: Why everyone still falls for fake emails