Cover: Enhancing Cybersecurity and Cyber Resiliency of Weapon Systems

Enhancing Cybersecurity and Cyber Resiliency of Weapon Systems

Expanded Roles Across a System's Life Cycle

Published Mar 28, 2024

by Don Snyder, Chad Heitzenrater

Download eBook for Free

Full Document

FormatFile SizeNotes
PDF file 0.4 MB

Use Adobe Acrobat Reader version 10 or higher for the best experience.

Research Summary

FormatFile SizeNotes
PDF file 0.1 MB

Use Adobe Acrobat Reader version 10 or higher for the best experience.

Research Questions

  1. How does the DAF manage cybersecurity and cyber resiliency of weapon systems, and who is responsible?
  2. How can the roles of systems engineering and sustaining engineering be enhanced to ensure cybersecurity and cyber resiliency of weapon systems throughout their life cycles?

Weapon systems must be secure in a cyber contested environment, or they will not be able to carry out the missions that they are designed to support. How can engineering managed by program offices enhance the cybersecurity and cyber resiliency of weapon systems?

This report lays the foundation for managing cybersecurity and cyber resiliency of weapon systems throughout their life cycles; it also outlines the overall activities to ensure that a weapon system meets all needs to operate in a cyber contested environment. The authors survey policy and relevant academic literature and use personal assessments of cybersecurity and cyber resiliency efforts in the Department of the Air Force (DAF) to identify gaps in the use of engineering for cybersecurity and cyber resiliency and to propose mitigations.

Key Findings

  • Systems security engineering has recently become the policy within the U.S. Department of Defense (DoD), but it has not yet become the general practice in the DAF.
  • The DAF relies on the Risk Management Framework for security; however, this process is largely carried out after systems engineering and design.
  • Wing-level organizations perform much of the day-to-day security monitoring of weapon systems; however, these organizations are not provided with authorized tools tailored to their weapon systems, and the tools that they have cannot comprehensively monitor or defend their weapon systems.
  • Cybersecurity and cyber resiliency are not central parts of current sustaining engineering or life cycle sustainment plans at the DAF.

Recommendations

  • The DAF should develop and maintain an integrated engineering-based plan for the cybersecurity and cyber resiliency of each weapon system throughout its life cycle.
  • To enhance systems security engineering, DoD should place into the program plan and contract language: (1) standards for designing systems with adequate cyber separability and (2) methods to assess cyber resiliency of designs.
  • After ample research, a military standard for cyber separability should be issued. In addition, the DAF should issue instruction for systems security engineering and a manual for implementing systems security engineering.

Research conducted by

This research was prepared for the Department of the Air Force and conducted within the Force Modernization and Employment Program of RAND Project AIR FORCE.

This report is part of the RAND research report series. RAND reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.