Search results

The challenges associated with securing U.S. Department of Defense (DoD) information systems have grown as the department's information infrastructure has become more complex and interconnected. At the same time, the potential negative consequences associated with cyber intrusions have become more severe. Are current information assurance (IA) policies and procedures sufficient to address this growing threat, and are they able to address vulnerability issues associated with highly networked information systems? The current IA certification and accreditation (C&A) process focuses on individual, discrete systems or components of larger, aggregated information systems and networks that are colocated or operate on the same platform (such as a Navy ship). An examination of current policy shows that a new approach is needed to effectively extend the IA C&A process to aggregations of information systems and improve the security of DoD information systems. A number of recommendations are put forth to improve current IA policy and to enable the IA C&A of aggregations of DoD information systems that reside on a common platform

How much data regarding U.S. anti- and counterterrorism systems, countermeasures, and defenses is publicly available and how easily could it be found by individuals seeking to harm U.S. domestic interests? The authors developed a framework to guide assessments of the availability of such information for planning attacks on the U.S. air, rail, and sea transportation infrastructure, and applied the framework in an information-gathering exercise that used several attack scenarios. Overall, the framework was useful for assessing what kind of information would be easy or hard for potential attacker

This description of the application of the RAND Corporation's PortMan portfolio analysis and management method and Delphi consensus-building method for the National Security Agency (NSA) Information Sharing Services (ISS) division highlights how these methods enable the data-driven analysis of project portfolios and the allocation of research and development (R&D) and operations and maintenance (O&M) resources according to value, risk, and cost.