WASHINGTON, March 16 (UPI) -- The U.S. Department of Defense is launching "Tiger Teams" to test the security foreign-developed software it uses.
Kristen Baldwin, deputy director for software engineering and systems assurance for the Pentagon's undersecretary of defense for acquisition, technology, and logistics, told a joint Defense-Homeland Security forum about the teams last week.
"Success means they understand where their focus needs to be and how to prioritize their efforts," Government Computer News reported her as saying about the teams.
The newsletter said she told the software assurance forum, in Fairfax, Va., that the teams "understand the supply-chain impact on systems engineering, and are ready to move forward in an effort to mitigate assurance risk."
Experts have long seen software coding for the computers the U.S. military uses as a potential vulnerability. Even when buying products from U.S. suppliers, global outsourcing means that much code is written overseas.
Because complex software requires millions of lines of code, hackers can easily hide small sub-programs in the code if they can get access to it. Analyzing so much code is a huge task, so commercial software developers use so-called Tiger Teams of "white hat" hackers to attack the program looking for security flaws.
DOD strategy calls for using "all-source information to characterize supplier threat," Baldwin added.
