Pentagon’s $2 Billion Cybersecurity Project Slowed by Flaws

(Bloomberg) -- The Defense Department has halted deployment on its classified networks of a $2 billion cybersecurity project intended to detect intrusions and prevent attacks because of poor test results, according to the Pentagon’s testing office.

The effort to consolidate hundreds of U.S.-based and global systems continues to be fielded to non-classified networks even though test assessments since 2016 have continually shown it’s “unable to help network defenders protect DoD component networks against operationally realistic cyber attacks,” testing chief Robert Behler wrote in his latest criticism of the project known as the Joint Regional Security Stack.

Behler’s report, obtained by Bloomberg News in advance of its release, was written before the Defense Department acknowledged that it was among government agencies hit by a massive intrusion attributed to Russian hackers. Although the Pentagon said there’s no evidence that data or systems were compromised, the attack raised new questions about protecting defense systems.

The cybersecurity project is already more than a year late. In 2015, the Pentagon directed that the system of network routers, firewalls and switches be fully implemented by 2019 across the military’s information technology infrastructure. It’s intended to provide continuous network security capabilities, including intrusion detection, attack prevention and a reduction to the number of access points to the military’s information network.

A classified February 2020 evaluation of the new program’s capabilities “resulted in poor cybersecurity findings that contributed to” the decision to shut down expansion into classified systems for now, Behler said in his latest annual report evaluating weapons.

The poor test results prompted Pentagon officials to reduce planned fiscal 2022 spending for expanding into the secret-level network, effectively deferring the effort until fiscal 2023, Behler wrote.

The Pentagon inspector general estimated last year in a separate critical review that the system could cost more than $2 billion to develop and deploy.

Behler recommended that the Pentagon’s chief information officer “continue developing more effective alternatives” to the Joint Regional Security Stack and that it discontinue its rollout to the unclassified network “until the system demonstrates that it is capable of helping network defenders to detect and respond to operationally realistic cyber attacks.”

Pentagon spokesman Russell Goemaere said in a statement that transition of the program to the classified network “has been postponed” to provide “additional time to refine the operational requirements, mature joint tactics, techniques and procedures for mid-point security, implement configuration changes to installed equipment,” and integrate results from an alternate system under development by the U.S. Cyber Command.

Deployment of the system on the unclassified network hasn’t been paused, he said.