An Experiment Showed that the Military Must Change Its Cybersecurity Approach

[rangerrebew]

An Experiment Showed that the Military Must Change Its Cybersecurity Approach
The Defense Department’s current “checklist” approach can’t keep its networks safe.
PATRICK TUCKER | AUGUST 16, 2022
CYBER NAVY JADC2
   
Two years ago, a pair of Navy information leaders decided to attack their own networks—and not just once or twice a year during scheduled exercises, but far more frequently, and unannounced. Now they’re trying to get the rest of the Navy—and the Pentagon—to follow suit.

Their experiment showed that frequent, automated red-teaming reveals which vulnerabilities are the most dangerous, the easiest for an attacker to exploit with the highest impact—information they wouldn’t have otherwise, said Aaron Weis, the Navy’s chief information officer, or CIO, and Scott Bischoff, the command information officer at the Naval Postgraduate School.

And it’s far more effective than the way the Defense Department currently handles cybersecurity: with checklists of steps taken, patches implemented, and so on.

https://www.defenseone.com/technology/2022/08/experiment-showed-military-must-change-its-cybersecurity-approach/375925/

[Kamaji]

It's call pen testing (penetration testing) and companies that are really interested in actual security, rather than virtue-signalling, hire pen testing teams to do precisely this.  It's a little surprising that the military doesn't.

[rangerrebew]

   It's a little surprising that the military doesn't.

Might the name Milley enter here?

[EdinVA]

This whole cyber security thing just strikes me much the same way climate junk does....
Putting a 100% lock and internet access is impossible.  Last I read there are 10's of millions of serious hackers and 30,000 web sites are hacked per day.
A "lock" only keeps honest people honest, if a crook wants in, they will get in.  You can detect the intrusion and somewhat track it but prevention is nothing but a hole in the water to pour money into.

The only real security is to get sensitive information away from the web...