Cybersecurity across the defense industry ecosystem should be elevated to a core national security priority in response to growing state-backed cyber threats, a state-run think tank said Friday.
According to the Korea Institute for Defense Analyses, Kim Young-bong, a research fellow at its Defense AI Policy Research Office, made the recommendation in a report titled “US Defense Industrial Base Cybersecurity Strategy and Policy Implications.”
“Awareness of the importance of cybersecurity in the defense industry needs to be raised to the strategic level,” Kim said in the report.
According to the Korean National Police Agency’s National Office of Investigation, more than 10 out of 83 domestic defense firms were targeted in cyberattacks in 2024. Authorities said the attacks were carried out by North Korea-linked hacking groups — including Lazarus, Andariel and Kimsuky — in a coordinated effort to steal South Korean defense technologies.
Kim analyzed how the US Department of Defense manages its so-called Defense Industrial Base — encompassing a broad network of domestic and foreign firms and organizations involved in research, design, production, delivery and maintenance of defense systems.
The DIB includes not only major contractors such as Boeing and Lockheed Martin, but also small and medium-sized suppliers providing components, materials and software.
He noted that the Pentagon’s DIB Cybersecurity Strategy 2024 explicitly places the cybersecurity of the defense industrial base on par with the protection of its own information environment.
“The US Department of Defense has made clear that cybersecurity within the DIB is as critical as safeguarding its internal systems, underscoring that both the government and the industrial base jointly contribute to national defense,” Kim said.
Kim added that a similar shift is urgently needed in South Korea, citing ongoing cyberattacks targeting local defense firms.
“Threat actors such as North Korea are already actively conducting cyber operations against South Korean defense companies,” he said.
“Given that cyber incidents in the defense industry could lead to gaps in military capability, they must be recognized as national security risks.”
He stressed that defense cybersecurity should be redefined not merely as a requirement for maintaining economic performance, but as a strategic task essential to safeguarding national security.
The report also called for expanding the scope of oversight beyond firms formally designated as defense contractors to include all companies participating in defense projects.
Kim further urged policymakers to broaden the scope of security measures to cover not only the protection of technical data but also companies’ operational resilience and product integrity.
He added that existing cybersecurity assessment frameworks remain insufficient to address increasingly sophisticated threats, calling for institutional improvements as well as governance reforms that encompass the entire defense industrial ecosystem.
flylikekite@heraldcorp.com
