He sees some indications that the DoD may finally be getting serious about cyberdefense, however. For example, the strategy stipulates that speeding up the DoD's information technology acquisition process is critical. "DoD's acquisition processes and regulations must match the technology development life cycle. With information technology, this means cycles of 12 to 36 months, not seven or eight years," according to the policy.

Mogull hasn't heard much in the past about the agency trying to speed up technology acquisition. "Traditionally, that's been a big problem," Mogull said, noting that the DoD's massive size has historically meant it has moved very slowly.

Also, recent attacks have probably served as enough of a wake-up call that the government realizes it has to take cybersecurity seriously, he said. While there have been attacks for years, there have been a few notable ones in the past year or two, he said.

In his speech, Lynn revealed that in March, 24,000 files were stolen in a single intrusion at a defense company. He did not reveal more details about the breach but said that generally speaking, while some data that gets stolen is mundane, some involves sensitive systems such as aircraft avionics, surveillance technologies and satellite communications.

The policy is a good first start, said Congressman Jim Langevin, a Democrat from Rhode Island, in a statement. But he pointed out a few issues that still need answers. For example, he'd like to know what are the acceptable "red lines" that justify action in cyberspace. He wonders whether data theft can trigger warfare or if the U.S. would have to wait for a physical event, such as an attack on the country's power grid, before responding militarily.