The Implications of COTS Vulnerabilities for the DoD and Critical U.S. Infrastructures

There is a growing reliance on commercial off-the-shelf (COTS) products within critical systems on which the security and safety of the United States depend. Next-generation command and control systems within DoD depend heavily on COTS hardware and software. Typical COTS software products are large and complex, often comprising millions of lines of source code. This complexity precludes complete, unambiguous analysis of the code for "trap doors," "logic bombs," and other malevolent code possibly buried within it. In addition, increasing amounts of such code are developed by non-U.S. citizens and offshore workers with uncertain loyalties to the United States. Market forces favor functionality over security and reliability, so the problem is unlikely to disappear. In addition, DoD and the U.S. government lack sufficient market strength to compel greater security in COTS products. There are two basic approaches to "managing" this problem: making COTS used by the DoD more secure; and learning to live with insecure COTS. There are initiatives that can be undertaken in both of these areas. The authors have identified a number of candidate elements supporting each of these approaches. Those specific elements can support a variety of overall solution strategies. An outline of a possible research agenda addressing this problem is presented.