Defense contractors face a long road on cybersecurity
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Shoshana Gordon/Axios
Most defense contractors believe they're too small and inconsequential for nation-state hackers to target them, a National Security Agency official told Axios.
Why it matters: China, in particular, has been laser-focused on targeting key American critical infrastructure, officials have warned.
- That includes defense contractors — even the small ones that are responsible for making just one component of a military weapon.
The big picture: At least 70% of the defense industrial base are small businesses, and they're facing many of the same cyber threats as the typical small business, Bailey Bickley, chief of DIB defense at the NSA Cybersecurity Collaboration Center, said in an interview at the RSA Conference last week.
- But many small defense contractors believe their work isn't consequential enough to catch the eyes of adversarial hackers, she adds.
- That's even despite very public warnings over the last year from top U.S. cyber officials about increasing Chinese government cyber threats.
What they're saying: "These companies are truly a target of nation-state activity, and we need them to understand that and know how to defend against it," Bickley told Axios.
- "The fact is, our adversaries, particularly the People's Republic of China, [have] an incredible amount of resources to do mass scanning of the internet, mass exploitation and mass data exfil."
Threat level: Defense contractors are rich targets for nation-state hackers looking to steal military secrets and ransomware hackers targeting small businesses, Bickley said.
Between the lines: One of the biggest hurdles for defense contractors is a lack of technical expertise and money needed to invest in cybersecurity.
- "When you engage with these companies, they are so good at what they do, and it's not cybersecurity," Bickley said. "They're really just grappling with.... 'What do I do? Where do I start?'"
The intrigue: The NSA is well-known for its own espionage, surveillance and hacking operations, but the agency is also key in overseeing defense contractors' cybersecurity needs.
- The agency provides several free cybersecurity tools to defense contractors, including DNS filters, threat intelligence information-sharing programs and vulnerability scans.
- Most nation-states and ransomware actors are just conducting basic scans of internet-facing systems to see which ones are vulnerable to attacks, and the free tools are aimed at closing those flaws before hackers find them, Bickley said.
- The NSA will also go directly to a contractor to help it best approach the vulnerabilities it's grappling with.
Yes, but: These tools don't completely eradicate the threats posed by Volt Typhoon — the Chinese hacking group targeting American infrastructure — since they can't remove hackers who are already lurking inside a system.
- "It's just challenging to find, so there might be maybe a false sense of security," Bickley said. "Companies look and they don't see anything."
- Part of the challenge with Volt Typhoon is the group's persistence: Its hackers are known to stealthily linger on a system, and not all companies have access to activity logs that date back far enough to spot the initial intrusion.
- Bickley and her team haven't seen products on the market yet that could boot Volt Typhoon from a system once it's inside.
What we're watching: Bickley's office is always looking for new, low-cost, scalable and easy to maintain cybersecurity tools it could pilot and make available to defense contractors.
