Cyber defense effort is mixed, study finds

A Pentagon pilot program that uses classified National Security Agency data to protect the computer networks of defense contractors has had some success but also has failed to meet some expectations, according to a study commissioned by the Defense Department.

The program showed that Internet carriers could be trusted to handle the NSA data, that direct government monitoring of private networks could be avoided and that the measures could be of particular benefit to companies with less mature cyber defense capabilities, according to the Carnegie Mellon University study. Although researchers said the pilot had demonstrated the concept of information sharing, they also cited deficiencies in the way it was implemented. The test program, which began last May, relied on NSA “signatures” or fingerprints of malicious computer code that in initial stages were “stale when deployed” and in many cases did not prevent intrusions that the companies could not have blocked themselves, according to the report, which was not publicly released by the Pentagon but was shared with Congress this week. The study underscores the operational, legal and policy challenges in building a robust defense of critical U.S. computer networks as foreign rivals and other adversaries seek to penetrate systems, steal data and perhaps lay the groundwork for a destructive attack.