With defense contractors in the crosshairs, NIST rolls out new cyber guidelines

It's no secret that foreign nations have recognized that one of the best pathways to hacking and stealing U.S. government technology is by targeting its industrial base. Foreign countries are targeting and compromising U.S. contractors so frequently that the Department of Defense asked the National Institute of Standards and Technology to develop custom security guidance to address the problem.

A draft version of that new guidance publicly released June 19 lays out 31 new recommendations for contractors to harden their defenses and protect unclassified (but still sensitive) government data that resides on their networks from advanced persistent threats (APT) or government-sponsored hackers. Such data can range from Social Security numbers and other personally identifying information to critical defense program details.

The recommendations include processes like implementing dual-authorization access controls for critical or sensitive operations, employing network segmentation where appropriate, deploying deception technologies and establishing or employing threat-hunting teams and a security operations center to continuously monitor system and network activity.

NIST already has basic security guidelines in place for protecting unclassified information on contractor systems, but Ron Ross, a computer scientist at NIST and co-author of the new draft publication, said a series of attacks on the unclassified networks of the defense industrial base in the last 18 months has given China and other nations a windfall of military secrets and technology that has forced DOD officials to re-examine contractor cybersecurity requirements to specifically address the threat from foreign governments.

In addition to the NIST guidelines, DOD has also taken steps to beef up participation in information sharing programs and rolled out new cybersecurity certification standards for its contractor base in recent months. 

"This information becomes a very valuable target for adversaries, and we absolutely have to be able to stop these cyberattacks on these critical programs or we're going to lose our competitive advantage, we'll lose our military advantage," said Ross.

The recommendations were also crafted under the assumption that such APT hacking groups -- as their label infers -- are quite persistent and resourceful, able to adapt and find alternate pathways into a targeted network no matter what protections are put in place. The guidance was designed to further three interlocking goals: create penetration resistant architecture, facilitate damage limiting operations and create resiliency and survivability in the likely event that such groups are eventually successful.

"We wanted to be able to say what happens when the APT does penetrate our initial defenses," Ross said. "How do we respond to that once they're in the system, how do we limit the damage they can do?"

The Department of Defense incorporates the more basic NIST security guidelines in its Defense Federal Acquisition Regulation System supplement, making them mandatory for approximately 65,000 primary and subcontractors who work with DOD. However, the new enhanced guidance is expected to have a narrower impact, as it's designed to be applied on a case-by-case basis to a small fraction of defense contractor systems and programs that have high-value assets or hold critical defense program information.

Fulfilling such requirements can be costly, and low cybersecurity literacy has also contributed to poor compliance rates by industry.  

In a 2018 survey of small and mid-sized defense contractors, 45% said they hadn't read NIST's basic guidance on securing controlled unclassified information systems, despite the fact that DOD made following such requirements mandatory in 2016. Many of the respondents reported that the NIST document was difficult to understand and had concerns about the costs associated with compliance, sometimes underestimating the price of implementing such protections by as much as a factor of 10.

Implementing all the new enhanced protections against APT threats can be "a heavy lift" financially, but they are still necessary, said Ross.

"The problem is that when you want to stop an adversary throwing their A game at you, you've got to come with you're A-plus game, and that's not easy to do," he said. "It's not cheap, it's not inexpensive to protect these assets, but the downside is losing this critical data, which is priceless in many cases."

The guidance does account for this reality, noting that "nonfederal organizations may not have the necessary organizational structure or resources to satisfy every requirement and may implement alternative, but equally effective security measures to compensate."

Overseers in Congress have paid increasing attention to the issue. The Senate Armed Services Committee's version of the National Defense Authorization Act includes a provision that would require DOD to develop a new framework to improve cybersecurity practices among its contractor base and brief Congress on the plan by March 2020. It would also force military leaders to pay more attention to smaller vendors and conduct regular audits to ensure that primary contractors actually do have security visibility throughout their supply chain.

"The committee is concerned that prime contractors are not overseeing their subcontractors' compliance with these cybersecurity requirements through the entire supply chain and that the Department lacks access to information about its contractors' subcontractors," the committee wrote in a report on the bill.

The new NIST guidance will go through a public comment and revision period. While a typical NIST publication takes up to a year to finalize and publish, Ross said this particular topic is such a high priority for DOD and other agencies that they're hoping to cut that timeline in half and publish a final version within the next six months.