DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

Re:DOD Just Beginning to Grapple with Scale of Weapon System... by closeparen on Tuesday October 09, 2018 @02:36PM (#18178623)

Aren’t there reams of security standards and thousands of man-years of security compliance bureaucracy for even the most basic DOD IT projects? And they still have trivial vulnerabilities like this? Is the process really that useless?

[ Parent | on HN ]

Re:DOD Just Beginning to Grapple with Scale of Weapon System... by pjc50 on Tuesday October 09, 2018 @03:34PM (#18179134)

Bureaucracy not only does not discourage vulnerabilities unless they're on a very short list, it actively encourages them by driving away the kind of imaginitive thinking you need to think of them.

[ Parent | on HN ]

Re:DOD Just Beginning to Grapple with Scale of Weapon System... by 0xffff2 on Tuesday October 09, 2018 @02:43PM (#18178696)

I think the difference is between "DoD IT projects" and DoD projects that have networked computer systems. My hunch is that most of these vulnerabilities are in systems that are not labeled as "IT projects".

[ Parent | on HN ]

Re:DOD Just Beginning to Grapple with Scale of Weapon System... by thrower123 on Tuesday October 09, 2018 @02:50PM (#18178751)

Maybe? I somewhat doubt it, since I work for a company that has a couple of DOD IT products that are in fairly widespread use, and I don't know that we have done any security compliance to speak of over the past seven or eight years. In that time period we haven't done a ton of work, but we have had to make some changes to move from a really ancient JRE version to a slightly less ancient one.

[ Parent | on HN ]