US ballistic missile systems have very poor cyber-security

At my previous security consulting firm, the leadership team kicked off a massive hiring effort of DoD veterans, driven by the idea that "cyber warfare is similar to real warfare, so veterans are a natural fit for cybersecurity jobs". Blech.

Based on my experience working with those ex-DoD folks, I echo your sentiment. Anyone who was known to be a part of the veteran hiring initiative became a black sheep among the other rank-and-file at my company, because everyone knew that the DoD folks could hardly do anything more complex than a follow a 5-step "how to install metasploit" guide without having their hand held (and even then...). They also had very little familiarity with basic security tools like MFA, IDS, IDM softwares (which makes sense after reading the article).

The worst part still was that they were very cocky about their abilities. I heard way too many times about how "I have experience with 'real war' at the pentagon, I know what I'm talking about", when in reality they certainly did not. If the actual DoD is anything like their ex-infosec employees that I worked with, I can only imagine that this article is just the tip of the iceberg.

But what's the solution to this? At the end of the day the Fed Gov has become an incredibly successful jobs program for vets. (see vets preference and all sorts of affirmative action there) Obviously, one can make the argument that perhaps the skill-set and drive that encourages one to join the military is probably, in a majority of cases, orthogonal to what makes someone good at cybersecurity.

But who would ever argue that? It's political suicide, "how dare you hate the troops", etc. It's fun to see how toxic it can get -- I'd recommend looking at a few of the USAJobs message boards that have advice on how to get hired. Every now and then you'll see a thread about how the veteran preference is unfair, and, well, I won't spoil it. :)

It won't change until it has to change.

More like Lackadaisically Uncertain Disarray.

The pwnocalypse will cause the apocalypse.

"...the vulnerability was initially identified in 1990..."

STIG scans are automated and the basis for identifying a finding is sometimes a lot different from the name. You have to decode the scanners script and compare the description with the code. In this case it is likely a "medium" finding that an email service is running and may be a risk. "May" and not "is". It requires a manual evaluation to confirm.

My favorite is the vulnerability identified as [redacted] which merely identifies the operating system as Windows. It is a High severity.

Nukes are a different beast entirely. Quite a few of their safety systems are physical and non-networked. The only danger are hacking delivery systems such as subs and bombers. But that would only prevent the delivery of a nuke, and not set them off.