U.S. adversaries and competitors are exploiting social media, information technology and other elements of the information environment to undermine the country’s national security capabilities, according to a new report from the Government Accountability Office.

The government watchdog agency conducted a study on how the Department of Defense uses the information environment and its strategies to enhance cognitive security.

GAO data came from questionnaires given to 25 DOD agencies, interviews with department officials and subject matter experts, and reviews of 35 policy and strategy documents from the department and other federal agencies.

Results showed that the DOD’s most important deficiencies in protecting the information environment are in personnel, training, funding, organization and new technologies.

Respondents identified artificial intelligence and machine learning, bots, quantum computing, social media platforms as emerging tools that could be used as either a shield or a threat to the DoD’s missions.

The office recognized the Pentagon’s efforts to refine the concept of information in defense operations. Aside from its ongoing revision of doctrine publications, the DOD must boost organization and training in defense against social engineering, the report noted.

The National Security Agency and the Cybersecurity and Infrastructure Security Agency have released an advisory outlining the steps cyberthreat actors use to plan and carry out compromises against operational technology and industrial control system assets.

NSA said Thursday the cybersecurity advisory builds on guidance previously issued by the two agencies to mitigate OT exposure and stop malicious actors from targeting ICS.

“Owners and operators of these systems need to fully understand the threats coming from state-sponsored actors and cybercriminals to best defend against them,” said Michael Dransfield, control systems defense expert at NSA.

According to the advisory, the steps malicious actors follow to compromise ICS and OT assets are establishing the intended effect and selecting a target; collecting intelligence about the target system; developing techniques and tools to navigate and manipulate the system; gaining initial access to the system; and executing techniques and tools to create the intended effect.

“We’re exposing the malicious actors’ playbook so that we can harden our systems and prevent their next attempt,” added Dransfield.

The document also offers recommendations to help OT and ICS operators and owners to defend their systems from such threat actors.

These include limiting exposure of system information, identifying and securing remote access points, restricting tools and scripts and conducting regular security audits.

Sens. Gary Peters, D-Mich., and Rob Portman, R-Ohio, have proposed a bill with the intent to strengthen the U.S. government’s security defenses against open source software vulnerabilities.

The introduction of the Securing Open Source Software Act was prompted by the discovery of vulnerability in the Log4j logging platform, which exposed federal systems and critical infrastructure to remotely executable malicious attacks, the Senate Homeland Security and Governmental Affairs Committee said Thursday.

The legislation would direct the Cybersecurity and Infrastructure Security Agency to establish a risk framework that could be voluntarily utilized by government entities and critical infrastructure owners and operators that use open source systems.

Under the bill, CISA would commission a team of IT experts to facilitate a collaborative response between the government and community in cases such as the Log4j vulnerability. 

It will be the first legislation to codify open source software as public infrastructure, said Trey Herr, director of the Atlantic Council’s Cyber Statecraft Initiative under the Digital Forensic Research Laboratory. “If signed into law, it would serve as a historic step for wider federal support for the health and security of open source software,” he added.

Peters is chairman and Portman a ranking member of the committee, which convened a hearing in February on the Log4j incident. It was deemed as one of the most severe and widespread cybersecurity risks to date.