Army’s $15M TMF award bolsters new strategy for securing operational technology

The Army runs 23 depots, arsenals and plants where networked systems control the machinery that churn out explosives, ammunition, weaponry and other industrial materials critical to the ground service’s warfighting operations.

But officials are concerned the so-called “operational technology” at those facilities and other critical infrastructure locations could be susceptible to digital hacks, tampering and other cyber incidents.

The Army is now moving forward with $15 million from the Technology Modernization Fund, awarded just last week, aimed at plugging digital holes at those industrial sites and monitoring the networks for potential cyber intrusions.

Army Chief Information Officer Raj Iyer said some of the Army’s “organic industrial base” facilities are especially critical because they are the only place in the world where the service produces certain materials and equipment.

“Yet this machinery is controlled by control systems that today, we don’t protect so well,” Iyer said during an Oct. 11 roundtable with reporters at the Association of the United States Army conference in Washington. “And so you can see from a readiness perspective how our adversaries can go after some of these assets.”

The TMF funding for the “Army Critical Infrastructure Cyber Protection Project” will help mitigate and remediate cyber vulnerabilities at the facilities. There are an estimated 500,000 devices across Army industrial facilities, according to the TMF award description.

“Any network compromise would disrupt production and could potentially destroy equipment, injure workers, and impact coordination with multiple partner agencies,” it states. “Any insecurities in the systems that support these OIBs could pose grave national security risks.”

The Army says it will also use the funding to pay for “Security Operations Center as-a-Service” at the manufacturing sites. Such services involve third-party vendors actively monitoring networks for potential cyber threats.

New Army cyber strategy

The Army developed its first cybersecurity strategy for operational technology this year, Iyer said, to help address concerns about digital threats to the service’s infrastructure. The strategy is classified, but Iyer said the Army may release an unclassified version.

“If you look at the Corps of Engineers and all the dams that they operate, you look at a lot of the critical infrastructure that the Army owns in the civilian space, it was very clear that yes, the manufacturing base is one key stakeholder, but across the Army, we had other gaps,” he said. “If you look at our ports that we operate, where we are actually shipping all the stuff that’s going out to Europe right now, every one of those things are contested.”

While the service is starting out by addressing Army Materiel Command’s industrial base facilities, Iyer said the intent is for the critical infrastructure cyber protection program to go farther.

“There’s the Internet of Things, all the sensors that go into a multitude of systems that we don’t understand the supply chain behind them,” Iyer said. “This is a much broader need. We’re going to start at AMC and the industrial base. And then we’re going to expand that.”

The cash infusion from the TMF comes amid broader concerns about the cybersecurity of critical infrastructure, and a corresponding push from the Biden administration to set higher cyber standards for those systems.

“The reason why we worked with the White House on this, and actually they approached us and they thought this was a great idea, is because this is actually a federal government-wide problem,” Iyer said.

He said partners on the project include the Cybersecurity and Infrastructure Security Agency and the departments of Energy and State.

“We can see we can share lessons learned, we can see what they’re seeing from their perspective, and really work together,” Iyer said.

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.