CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for 2010

Archives for 2010

The Devil is in the Details: Seven Tests to Apply to any Cyber Conflict Concept

In September 1997 the US Naval Institute ran an article I wrote titled “The Devil is in the Details: Information War in the Field and Fleet.” Now 13 years later there are a few things I wrote in that article I wish I could take back! But for the most part I believe it still offers some cautionary notes relevant to the still emerging field of cyber conflict.

In its day, the article was one of the first to signal that it is ok to write about the emperor having no clothes when it comes to new information warfare concepts. There was already great promise in cyberconflict concepts then, but plenty of snake oil salesmen too, and I proposed seven tests that officers in the field and fleet could use to help them vet and form personal opinions on the relevance of a concept to their mission.

The article was cited a few military journals and military academia, and then was cited by a source I would not have predicted. I was the 7th citation in a book written by two Chinese Colonels (Qiao Liang and Wang Xiangsui) in their widely read “Unrestricted Warfare.”

I thought of this old article after reading news of a computer trojan on ground systems being implicated in the crash of a civilian airliner.  A trojan contributing to a crash is exactly the kind of thing my old article would have said was not possible. If I had been told that was possible in 1997, or even in 2010, I would have almost certainly accused the briefer of exaggeration. Today I work hard to stay up with the capabilities of the threat and I know cyber threats are very serious and are costing us $Billions in real value and probably $Trillions in opportunity cost. But contributing to the crash of an airliner?

But now there is a new fact to examine in the progression of the cyber threat, and one that should cause us all to rethink the path we are on regarding our information systems. I’ll write more on that soon.

And some additional thoughts/questions: Aren’t you glad we have a Cyber Command to help ensure we reduce the chances of this type of threat to our military aircraft?  Don’t you wish we had an organization able to help reduce the chances of this type of threat impacting civilian aircraft?  Do you think we should all be moving at warp speed towards a new FAA designed Next Generation Air Traffic Control System?  Will it be safer than the old one? If you think so, what makes you think so?  Can you help improve on concepts like “Enhancing Computer Security by Two Orders of Magnitude.”

The September 1997 article is posted below.

============================================

The Devil is in the Details: Information War in the Field and Fleet

(Second honorable mention, USNI Colin Powell Joint Warfighting Essay Contest)

Published September 1997 USNI Proceedings

LCDR Robert D. Gourley, USN

Some of the nation’s brightest minds are now shaping our approach to information warfare. They are setting up special schools, writing papers and books, debating strategies and codifying joint information warfare doctrine. The JCS and military services are establishing new information warfare commands and orchestrating organizational changes at national, theater, and operational levels. Modern information warfare has the potential of doing for today’s military what ULTRA and MAGIC did for our forces during World War II. Those programs provided insights into enemy intentions and formed the basis of our successful deception plans. Now invigorated with powerful computer and communications systems, information warfare will soon represent an integral part of the American way of war.

But the Department of Defense has moved so fast to embrace information warfare concepts that mid-level officers of all services have had little time to catch their breath. We will soon have to implement concepts that we hardly understand. There is also a growing body of evidence that suggests some information warfare concepts will not work in the field or fleet.

This article is not a primer on information warfare. Such articles abound in professional journals and the open press. It does, however, seek to widen the debate by encouraging constructive criticism on information warfare. It does so by providing seven tests for evaluating information warfare briefings, point papers, articles or books. Applying these tests to a quality information warfare plan will prove its relevance. But these tests will unravel flawed concepts. Testing concepts that fall somewhere between the ends of this failure/success spectrum will provide insight on how to make good plans better.

These seven tests are:
– A test for an over reliance on metaphors.
– A test for plans that overestimate the threat.
– A test for plans that overestimate our own capabilities.
– A test for historical relevance and accuracy.
– A test for extraordinary attempts to avoid criticism.
– A test for unsupported assumptions.
– A test for nonstandard definitions.

#1: Test for an over reliance on metaphors. Metaphors are an important part of our language. They are especially important in explaining new concepts or ideas. Unfortunately, the metaphor is sometimes mistaken for reality. Test any concept explained by a metaphor to ensure the metaphor does not become the concept.

Some metaphors lead to restrictive thinking. For example, a popular metaphor in information warfare is that of “The five pillars of C2W.” Its advocates draw images of five columns labeled OPSEC, PSYOPS, EW, DECEPTION and PHYSICAL DESTRUCTION that rest on a solid foundation labeled INTELLIGENCE. The pillars hold up a rooftop labeled THE MISSION. While useful to introduce the idea, the metaphor does not reflect how C2W should work in the field or fleet. C2W planners may contribute to plans for use of military functions other than the five in the metaphor. The pillars also imply separation. C2W should not consist of stovepiped functions developed separately from each other or the mission. Support to the mission requires planning and executing each function together with other functions and planning efforts. Perhaps a better metaphor in this case is that of strands of a rope– individually they may be strong, but bound together their strength is stronger still– and adding more strands will make the rope even stronger.

Expansive metaphors can also result in misleading interpretations. For example, another common information warfare metaphor is that of “Cyberspace,” the imaginary world behind the screen of your computer. Fantasy novels and the popular press have made the term a household word. Military versions include the “Cyberbattlespace.” The metaphor has reached the point where people talk of “fighting in cyberspace” and of creating teams of “cyberwarriors” to lead those fights. What actually is behind a computer screen is the inner workings of a display device. Like the rest of the computer and every computer network, it is a physical construct of matter that moves energy according to the laws of physics. Strictly speaking, we cannot “fight” in cyberspace any more than we can “walk” inside a Picasso painting.

#2: Test for an overestimation of the threat. There is a serious threat to our nation’s information systems. Hackers attack private and government computer systems on a daily basis. Our economy loses billions of dollars a year to computer crime. The General Accounting Office estimates that hackers conducted up to 250,000 attacks on federal computers last year alone.i Many of these were embarrassing breaches involving DoD information.

The threat is serious, but fortunately our most sensitive networks are well protected, and new technology is making them even more secure. Leaders in government and industry recognize the problems of computer security and are devoting resources to protect them. The Department of Defense and the military services are implementing comprehensive defensive measures. The FBI has computer investigation squads. The Justice Department has doubled its funding for computer crime prosecution. The Secret Service has a computer crime section. The CIA is opening an information warfare technology center. State and local law enforcement officials around the country are following suit.ii Industry’s defensive efforts are even greater than those of the government. Information is industry’s life blood, and they are devoting time, money and brain power to protect it. In an attempt to coordinate the efforts of industry and government, the President has formed a Commission on Critical Infrastructure Protection, which is now conducting public hearings on the issue.iii

Many information warfare experts describe threats from computer literate opponents linking into systems to reroute trains, crash stock markets, open drawbridges, cause midair collisions, reroute HOV lanes and destroy birth records. Some experts paint a threat of computer terrorists crippling our nation by attacks on banking, business communications, power generation, law enforcement and air-traffic control computers. Threat characterizations like those may be neglecting the high investment both government and industry are already making in defensive information warfare. Incorrect threat estimates can result in a waste of resources that should be applied to our real weaknesses. If you suspect an information warfare concept was built to counter an unrealistic threat, you should probably inquire about the details of the threat assessment it is based upon.

#3: Test for an overestimation of our own capabilities. The military can and should expand its capabilities to attack enemy computers. Since computers do so many things that few ever predicted, some people fall into the trap of thinking that we can build computers that can do anything. This is not quite true.

How can you tell if a briefer or a particular reading is guilty of overestimating our capabilities? It is easier to understand the realm of possibilities with a background in quantum mechanics and computer science. But even if you are not conversant in these areas you can still make informed judgments. All you need is a good foundation in the performance of current C4I systems, coupled with an ability to ask probing questions. For example, if you were told that we could degrade an enemy’s oil producing capability by injecting a virus into a computer, your first question should be “How?.” If you are told that the same computer the enemy uses for oil production has been penetrated in labs, ask how the virus will be delivered in hostile territory. If the answer is by space or aircraft, our capability is probably being overestimated. If the answer is by a spy, you should ask if he is in place now or if we need to mount an operation to get him in place. Keep in mind that networks of agents take years to establish. Like many other military operations, the devil is in the details of information warfare plans.

#4: Test for historical relevance and accuracy. Information warfare theorists frequently frame their ideas with historical references. This search for supporting historical tidbits sometimes results in erroneous interpretations. These errors can become so widespread that they begin to be accepted as fact. For example, some information age strategists quote General von Motlke’s vision for reorganizing the German General Staff to make optimum use of telegraph systems. Historians tell us there is no record of von Moltke ever saying any such thing. These fictitious quotes are being used to bolster arguments for organizational change today.iv

Many information war strategists draw parallels between the concept they support and concepts of the past. History can teach us the relevance of these parallels, many of which are right on the mark. For example, Major General Grange and Colonel Kelly highlight the information warfare strategies of Genghis Khan to remind their readers that Òarmies have conducted information operations throughout history.v This is certainly true.

Other information warfare advocates draw parallels that may be less relevant. For example, many try to build support for their ideas by referencing the German Blitzkrieg. They describe Blitzkrieg as a revolutionary concept that allowed the Germans to take French forces with similar technologies by surprise. They point out that there were some in Germany who opposed Guderian’s new ideas. The point of the analogy is usually that we must accept the new information warfare idea being advocated or we will fail in war.

Unfortunately, history also shows us that all new ideas are not great ideas. The Maginot line was a new idea, designed to convince the Germans that war would be untenable. The complex appeasement plan negotiated by Prime Minister Chamberlain prior to World War II was considered by many a new idea that would avoid war. Both of these new ideas failed completely. Concepts should never be condoned just because they are new.

Some information warfare concepts use historical models to explain the history of man and then predict the future. Testing these models to see how well they apply to the past can help you determine if they are too simplistic to allow for reliable predictions of the future. For example, one popular model in information warfare concepts is the “Three Waves” theory proposed by Alvin and Heidi Toffler. This model proposes that the way nations make war is tied to the way they make wealth, and that society has changed its economic and military systems in three waves. From 10,000 years ago till the 19th century, society and war were agriculturally based. When an industrial wave swept through the world the dominate war form became based on mass production. Now that we are riding the crest of an informational wave, knowledge will be central to our way of war.vi

Although this is a good summary of the history of civilization, it is not surprising to learn that there are many historical exceptions that do not fit this model.vii It is also not surprising that this type of model is just too general for short term predictions. For developments over the next ten years, simple trend analysis will provide a better assessment of the future security environment.

#5: Test the concept for extraordinary attempts to avoid criticism. This may actually be a signal that the idea deserves more of your scrutiny. Avoiding criticism may come in the form of calling attention to the wisdom of the developers of the idea. A briefer may say that “a group of certified geniuses including a Nobel prize winner developed this idea.” If you hear one like that, keep in mind that educated people are not immune from generating foolish ideas, especially if the subject is outside their area of expertise. For example, two noted PhD criminologists recently published an article on information warfare threats that included references to computer viruses that in reality did not exist. They had read some common computer jokes, and believed the jokes to be true. The jokes had made up names of viruses such as “the Gingrich virus” (the joke says the virus makes you sign a contract with your computer).viii

You might also be told that the concept’s supporters include some of the highest ranking officers in our military, perhaps even a service chief or the Chairman of the JCS. This does not mean the idea no longer deserves your scrutiny. Based on the attention given to joint and service professional military education, our seniors encourage independent thought on national security issues and would welcome professional dialog on information warfare.

Criticism avoidance may also take the form of a briefer skimming over key parts of a concept while explaining that “You wouldn’t understand this part, so I’ll skip it.” I’ve heard phrases like that in briefs to mid-grade military officers. There are certainly some complex information warfare issues to sort out, but there are few whose salient aspects cannot be described to today’s well-educated military officers. If someone resorts to avoiding complicated material and says it is because you would not understand, it is a good indication that you are dealing with a modern day snake-oil salesman. As a rejoinder you could make it clear that you expect plain language explanations on the concept. Perhaps you can remind the briefer that Carl Sagan could satisfactorily explain the entire cosmos to the average American using nothing but plain English.

You may encounter a briefer who answers simple questions with “I can’t get into that… it is classified.” If so, you may want to reply with a general question like “is there anything about it you can describe at our current classification?” If the answer is still no, you may wish to contact a member of the individual’s parent command or a co-worker who may be cleared to higher levels. Keep in mind that your objective should never be to gain access to information that you are not cleared for. Classification can (and sometimes should) be used as a trump card that will not let you give some concepts your full scrutiny.

#6: Test for unsupported assumptions. These can creep into arguments on any controversial subject. However, the only information warfare assumptions officers in the field or fleet should accept are those defended by good arguments. For example, a common assumption in information warfare is that it “will in and of itself relegate other more traditional forms of warfare to the sidelines.”ix There is no evidence that this is the case at all. In fact, the new JCS Joint Vision 2010 provides the assessment that solving future crises will always require an ability to put “boots on ground.”x

Another common assumption is that we must reorganize to use information warfare strategies. Many of our organizations can and should change, but information warfare strategies need not affect every organization. Efficient staffs have long been able to implement new ideas with current structures. Most Unified CINC staffs and many of their subordinate staffs are now grappling with how to best reorganize to take advantage of information warfare. Often, they may find that they need no substantial changes.

#7: Test for nonstandard definitions. Almost every organization dealing with information warfare (including those in academia and industry) defines information warfare concepts differently. There are those that say we shouldn’t haggle about such a minor point. However, words and how they are defined can have a significant impact on how we transform concepts into reality. Fortunately there is a “no haggle” solution to this issue. We in the military should insist on using the definition JCS promulgates to us as doctrine. This means the best source (at this writing) is DoD’s Joint Pub 3-13. “Joint Doctrine for C2W.” It defines information warfare as “actions taken to achieve information superiority by affecting adversary information, information-based processes, information systems, and computer-based networks while defending one’s own.”xi

CONCLUSIONS:
The U.S. military must continue to develop strategic theories of information warfare. Such theories will, in turn, drive joint doctrine, technologies, organizations, and procedures designed for use by operators in the field and fleet. Currently, those with little military experience and senior officers removed from day to day operations are leading the debate on information warfare. But the nation’s real information warfare experts are officers in the field and fleet skilled in making assessments in a data rich environment. By taking a more active role in this debate and applying the tests presented above to current concepts, operators can better the information warfare plans we will be expected to implement in crisis or war.
END NOTES

i. GAO Report. Information Security: Computer Attacks at Department of Defense. (GAO/AIMD-96-84. May 1996).

ii. Shannon Buggs, Court-martial to begin in computer spying case. THE RALEIGH NEWS & OBSERVER (Raleigh, N.C. December 9, 1996).

iii. John Schwartz, Retired General’s Mission: Making Cyberspace Secure. WASHINGTON POST (Washington, D.C., January 31, 1997). A19.

iv. R. L. DiNardo and Daniel J. Hughes, Some Cautionary Thoughts on Information Warfare. AIRPOWER JOURNAL (Winter 1995).

v. Major General David Grange, Colonel James Kelly, Victory through Information Dominance. ARMY (Association of the U.S. Army, March 1997). 33.

vi. Alvin and Heidi Toffler, WAR AND ANTI WAR: Survival at the Dawn of the 21st Century. (New York, Little, Brown and Co., 1993).

vii. For a critique of this model see Robert J. Bunker’s The Tofflerian Paradox. MILITARY REVIEW (May-June 1995). 7.

viii. David Carter, PhD. , and Andra Katz, PhD, “Computer Crime: An Emerging Challenge for Law Enforcement.” LAW AND ENFORCEMENT BULLETIN (FBI Academy, Quantico VA, December 1996).

ix. Steve Kish, Do We Need an Information Warrior? MARINE CORPS GAZETTE (Quantico VA, January 1997). 20.

x. Chairman of the Joint Chiefs of Staff, Joint Vision 2010. (Pentagon, Washington, D.C., 1997). 18.

xi. Joint Pub 3-13.1 Joint Doctrine for Command and Control Warfare (C2W). (Pentagon, Washington, D.C., February 7 1996).

Apple iPad for the Travelling Executive

Having used the iPad for three months and on extensive travel, I thought it might be appropriate to provide some thoughts on how it works as a travel device.

Device design – There is something about the design that just works.  The device has an excellent form factor that I find easy to use in a multitude of scenarios including reclined, sitting at a table, on a jet plane, or lying in bed.

Battery life is probably one of the most impressive aspects of the device.  It is a true workhorse lasting a full day of heavy use.    As I write this review, I’m on the second leg of a 16 hour plane trip:  I’ve checked my mail, played games, watched a two hour video and listened to hours of audio content.  My battery currently has 67% capacity left.  One of the most frustrating things as a traveler is finding access to power.  With the iPad, I don’t feel like I am constantly looking for my next power outlet.

The applications are comparable to what we’ve come to expect on the iOS platform.  Any application that works on an iPhone will work on the iPad, but the best applications are those that have been natively compiled for the iPad’s screen resolution.

Having used the new iOS 4 for a couple of weeks now, it is discouraging to go back to the iPad and not have multi-tasking or application folders.  It certainly makes it seem like the iPad (which is 90 days) old is already outdated.  As far as I am concerned, Apple can’t get iOS 4 on this device soon enough.

I originally bought the wifi version of the device, but sold it when the 3G came out.  I decided that I wanted to have reliable and convenient internet access on the device and tired of waiting for the MiFi to boot and also those frequent instances where my iPad had 7 hours of battery life left, but the MiFi was dead.  Since I use this device on the road and out and about, having that consistent access is critical.  One critical complaint is the inaccessibility of reasonable international data plans.  If you plan to use GSM data on your iPad while you travel overseas, it is going to be very expensive.  Unreasonably expensive in my opinion, which makes the iPad a WiFi only device internationally for me.

I find myself taking the iPad with me on business trips and to business meetings.  It gives me a quick way to take notes, check my email, or add something to my calendar or ToDo list.  I keep it docked next to my monitor during the day and on my nightstand at night.  During the day for meetings, I often leave my laptop behind and just bring the iPad.  It has become a fully integrated part of my technology universe after just a few months.

The Essential Applications:

I regularly use a variety of applications on a daily basis.  Here are some of my favorite work, educational, and entertainment picks.

Mail – this is my most used application on the device, but already I long for iOS4 features like a unified inbox and the ability to sync with more than one exchange account.  While the iPad does support MS Exchange, it limits you to ONE Exhange account on the device.  With the migration to IOS4 on the iPad, users should be able to sync with an unlimited number of Exchange servers.

Calendar – I sync this application with my Google calendar  and with MS Exchange (which in turn sync with my desktop and laptop computers).

Reeder – an incredibly fast syncing RSS reader with an interface that is straight out of Minority Report.  I find that the iPad has become my preferred device for reading RSS feeds because I enjoy this application so much.

FlipBoard – another great content consumption device.  I use Flipboard as my preferred way to browse Twitter and Facebook on my iPad.  In addition, Flipboard aggregates the social conversation around links in your social stream, which makes it easy to track what your network is saying about the topic.   While most Twitter and Facebook apps just give you stream as a series of links (most of them in URL shortened format) FlipBoard actually pulls down allowed segments of the actual content and presents it in a visually appealing way.

Dropbox – as an avid user of Dropbox on the desktop, the iPad support ensures that I always have my documents with me to edit or mail.  Unfortunately, there is no easy way to get documents back in your Dropbox once you’ve edited them on your device.

Office applications – I’m torn on recommending a specific application, because I use them all right now and have not picked a favorite yet.  That said, I’ve yet to encounter a document format that I haven’t been able to open and work with on the iPad.  One feature I really like with Apple’s office suite is the ability to mail the document as a PDF to a contact.  Since PDF is my preferred way of sending documents, that works well into my workflow.

Kindle – My Kindle books are always with me and syncing via whispernet means I’m always on the right page.

Netflix – Netflix streaming content on the go.  I just realized yesterday that I’ve had the same Netfix DVDs out for six months.  Streaming has changed the way I interact with the service.

Evernote – Used to take notes in meetings that sync in the cloud.

SkyGrid – Streaming news updates that shows the current social zeitgeist.

iSSH  and LogmeIn – Remote management of my server and workstation computers anywhere I can get a cell phone signal

ToDo – My to do list manager of choice.

Flight Control HD – this game is fun and addicting while giving you a better appreciation for air traffic controllers.

Financial Times – Great implication of a newspaper on the iPad

Wired Magazine – This is really the future of magazine content.  I have no doubt that I’ll consume 100% of my magazine content this way within 5 years.

SIP Softphone – Coupled with Callcentric pay as you go service, this gives me a great VOIP capability for about $1.00 per month.  The same application and account is also used on my iPhone, so I can make calls from whatever device is most convenient.

YouMail – delivers my voicemail transcribed to my iPad or iPhone and allows me to respond via email.

1Password – One of my most essential utilities across all my platforms.

Korg iElectribe – I have the hardware version of this device that cost several hundred dollars.  The version for my iPad cost $10.

TWiTpad – watch the TWiT network live.

Speak it! – Text to speech application for the iPad.

RackSpace – create and manage cloud servers on the fly and access your files stored on the cloud.

Related Posts:

OODA Produces A Traveling Executive’s Guide to Cybersecurity

An iPad Review: No matter what the app, it just works well

The Twilight of Network-Centric Warfare

Highly respected writer and industry analyst Loren B. Thompson has just penned an opinion piece on recent changes in the Pentagon related to how DoD does IT.  The piece, titled “The Twilight of Network-Centric Warfare” is worth a full read by anyone in the IT business, in or out of government.

Dr. Thompson argues that the recent directive by secretary of defense Gates spelling out his intention to reorganize and eliminate the senior staff overseeing department networks and information integration (ASD NII) and moves at the same time to eliminate J6’s marked the end of the network centric era.

The meat of Thompson’s article reads:

When a Defense Business Board task force recommended last month that the Office of the Secretary of Defense (OSD) eliminate its networking and information integration secretariat, it signaled just how far from grace the notion of network-centric warfare has fallen. The secretariat was established at the tail-end of the dot.com boom to coordinate the joint force’s migration from industrial-age warfare into the era of information warfare. Proponents of network-centric warfare believed new information technologies were so powerful that they could overthrow traditional warfighting concepts if backed up with appropriate military doctrine and organizations. OSD’s office of networks and information integration — NII for short — was supposed to shepherd this vision into reality by overseeing a raft of multi-billion-dollar investment projects.

A decade later, nobody talks about military transformation anymore, and joint initiatives begun under its banner such as the Transformational Communications Satellite and Future Combat System are fading memories. Service-level projects like the Navy’s Next-Generation Enterprise Network increasingly look like wasteful efforts to re-invent the wheel — efforts that are doomed to be canceled as Washington turns to deficit reduction and military budgets shrink. So what went wrong? How is it possible for every policymaker in the five-sided building to embrace a common vision of information-age warfare at the beginning of a decade, and for it all to be forgotten by decade’s end?

The first thing that went wrong was that threats evolved differently than military planners expected. The authors of network-centric warfare thought that the joint force was in the midst of a prolonged “strategic pause” when the decade began, after which some new peer or near-peer adversary would emerge. That pause ended unexpectedly on 9-11, and America suddenly found itself facing a very different kind of danger. Networks and information technology have certainly proven useful in dealing with elusive new adversaries, but so far they haven’t proven to be the winning weapon that visionaries expected. It turns out that all those networks the Pentagon was planning are just conduits, and that what matters more for victory is the accuracy and completeness of the information moving through the networks.

The second problem that proponents did not see coming was that the new technology itself might become a source of weakness. Planners implicitly assumed that if the Pentagon invested heavily enough in cutting-edge networks and information applications, it could leverage the warfighting potential of the new technology while staying comfortably ahead of other countries with similar ideas. Well, it hasn’t worked out that way. We now know that everybody from the Taliban to Mexican drug cartels can benefit from the reach and richness of wideband networks. Even worse, they can tap into our own networks, as China proves on a daily basis. So the military has had to launch a crash program to prevent its gee-whiz networks from being used against it (incidentally, the Navy is inexplicably trying to replace the one big network that so far has proven largely immune to hostile penetrations, in order to implement a more “advanced” architecture).

I think I should add some commentary from a CTO perspective.

  • As far as I can tell, this reorganization is not because a concept fell from grace.  The reorganization seems to be designed to save money by reducing staff overhead.  Although I personally don’t agree that this is a smart move, the functions are being organized into other places (both at OSD and DISA) and there are high expectations that IT will continue to be enhanced and modernized in the department.

  • Very few believed that new IT programs would give us an ability so powerful that IT would overthrow traditional militaries.  There has always been a “lunatic fringe” of folks who thought like that, but the mainstream always saw IT as a critical enabler. The folks I know who see the benefit of new operational constructs leveraging network-centric-warfare still know that real war is still a very bloody, boots-on-the-ground activity.

  • Although the title “NII” was born out of a reorganziation.  Its functions existed before as ASD C3I.  Its functions will continue in the future in the new organization.  This is an important point.

  • It is certainly true that network-centric concepts made significant contributions to success in conflict.  The functions of NII helped that occur.  Those functions will still enhance the use of IT in the department in the future, just in a different organization.  But it is true that threats evolved differently than military planners expected.  Can you tell me what is new about that?  We have to continue planning, of course, but should not be surprised when we are surprised (how is that for some deep national security guidance?)

  • It is not accurate to say that proponents of net centric warfare did not see that IT itself could be a weakness.  This accusation is just unfounded.  But the fact is IT is changing the military and will continue to do so, even though it has weaknesses.

Those are just some thoughts.

By the way, I’m not sure I support this move, I worry that it will be harder to continue the efficient and effective continuous improvement of IT in the Services and Joint world because of this.  But as an outsider and a fan of big enterprise IT folks, I’ll be pulling for the folks who have the mission and I really hope this works out well.

For more on this topic see our reporting on National Security and Technology and at:

Pros and Cons: Cyber Command

Even before the U.S. Cyber Command stood up there was wide-ranging speculation about what the command would do, the authorities it would be granted, and the powers it would wield. No amount of insight from those with knowledge of the command will be enough to assuage the concerns of those who feel such an organization – and more specifically its intimate links with an intelligence agency – is a threat to liberty online and in general. Two of the early players in the cyber security and intelligence world – Bob Gourley and Mike Tanji – square off over the value – or lack thereof – of the Cyber Command and its impact on national security.

Pro

Cyber Command is destined for success. It will achieve its intended primary purpose, which is making a significant positive impact on Department of Defense IT security (from the mission statement: “…direct the operations and defense of specified Department of Defense information networks.” It will also contribute to our nation’s ability to conduct offensive cyber conflict (from the mission statement: “… prepare to, and when directed, conduct full-spectrum military cyberspace operations in order to enable actions in all domains.”

These are not simple tasks but you only need look at what existed before Cyber Command to see the positive benefits which the organization makes now. Prior to Cyber Command, ambiguity of command in cyber decision-making was the norm. An almost uncountable number of organizations asserted leading roles in the domain, including USSTRATCOM, elements of the Office of the Secretary of Defense, every military Service, the National Security Agency (including both the defensive and SIGINT components playing different roles), and other elements of the IC. Every COCOM also has a role in cyber conflict and each consider cyber defense an important capability (but each has challenges understanding their own posture due to ambiguity in service chain of command for cyber). These many players still have incredibly important missions and roles in cyber conflict, but they now have a guidon to follow.

Cyber Command is led by a staff of experienced military professionals with a deep understanding of the wide-spectrum of DoD missions and the impact IT and security posture can have on missions. And they are supported by a deep bench of technical experts and an experienced cadre of threat analysts.

The military leadership of Cyber Command will include many technology professionals, but more importantly it will include uniformed military officers with significant experience in making decisions in stressful operational environments. The cyber domain is different from the physical one in many ways, however, success in traditional military operations can lay a foundation for success in Cyber Conflict. When appropriately applied, for example, the often studied principles of combat from the United States Army Field Manual[1] that provide sound basis for training, strategy development and in many traditional kinetic engagements, operations, are directly applicable to cyberspace. Consider:

  • Objective (clearly defined, decisive, and attainable)
  • Offensive (Seize, retain, and exploit the initiative)
  • Mass (Concentrate combat power at the decisive place and time)
  • Economy of Force (minimum essential combat power to secondary efforts)
  • Maneuver (Place the enemy in a disadvantageous position)
  • Unity of Command (Ensure unity of effort under one responsible commander)
  • Security (Never permit the enemy to acquire an unexpected advantage)
  • Surprise (Strike the enemy in a manner for which he is unprepared)
  • Simplicity (Prepare clear, uncomplicated plans and clear, concise orders to ensure thorough understanding)

When planned in context of deep understanding of how technology works and an understanding of authorities for operating in privately held systems, these principles provide a tremendous foundation for further examination of the cyber environment. This points to a clear benefit of cyber command, an ability to leverage DoD strengths to defend DoD network.

All indications are that the nation will face many cyber challenges in the future, and not every battle will be won. But we stand a far better chance of victory now that this capability is in place.

Con

Cyber Command is unlikely to have any significant impact on the security of military networks in the near- to mid-term, which for the purposes of this post will mean sooner than 2015: an epoch in Internet time. The reasons are diverse and plentiful.

Talent for Cyber Command is most likely going to be drawn from the NSA and other existing cyber security organizations within the government. To be clear: the government is full of gifted computer and information security professionals, but most of them won’t end up at Cyber Command. This has nothing to do with Cyber Command itself; it is simply standard bureaucratic practice. No government manager let’s their best people leave; they send “those who can be spared.” Is the worst of the NSA still better than the best of our adversaries? Only if you believe the other side has little to no dead-weight in their ranks.

Cyber Command is led by a smart, talented General Officer who in his previous job presided over technical and managerial efforts like Groundbreaker and Trailblazer. As best as anyone on the outside can determine, these are cures that are worse than the disease they were meant to defeat. And who would have thought that an agency that lived and died by its computer systems would need trivial things like electrical power? How exactly is adding to his already expansive and diverse responsibilities supposed to instill confidence in this new endeavor?

Service-specific “cyber” commands have been in existence – if not in name, in practice – for years, yet there has been no discernible improvement in the security of military networks in all that time. Memos, warnings and orders from these elements (including the JTF-CND, where your author’s first worked together) are regularly ignored or waived for operational need. Absent the ability to commandeer or switch off the discrete networks and/or segments that make up military cyber space, edicts from Cyber Command are just memos from another bureaucracy that will be dealt with accordingly. It will never exercise sufficiently granular authority over the operational requirements of combat units. One need only look at the PFC Manning disaster to realize just how slipshod security gets the farther away from Fort Meade you sit. No security officer – cyber, physical or otherwise – ever won an argument with a combat commander.

On a much more fundamental level however, Cyber Command will fail to live up to the promise because it operates under a set of assumptions and theories that have yet to be proven as valid. Military metaphors are popular with those who comment about the hazards of and in cyberspace, but if fighting (or preparing to fight) in cyberspace, then what is the analog to “territory?” To adapt a phrase from the Infantry: “If they (your troops) are not there, you don’t own (have dominion over) it.” Shoehorning digital problems into familiar military constructs only make the discussion easier; it may have little to do when it comes down to solving real, practical problems associated with conflict in the virtual world. In fact, it could be hampering our ability to move forward towards developing an environment that is both effective and safe.

And of what use is a “cyber” command if the physical underpinnings upon which it is premised are damaged or destroyed? Let’s not forget that the predominant nature of war is still putting steel on target (issues of form and scale notwithstanding). We may find that we’ve invested billions of dollars in an organization and capability that are rendered useless through the application of a kinetic solution that may have cost a few thousand dollars. Where is the corresponding investment in ensuring the physical security and technical resilience of the systems and networks we feel so compelled to “command?”

We don’t need a Cyber Command as much as we need a DOD Cyber Security Think Tank that could draw upon the knowledge and experience of existing scholars and practitioners – in and out of the government – to produce new, practical and effective solutions for operating securely online and dealing with threats in the information age. Such an entity could promulgate its guidance down through the existing command structure from the Office of the Secretary of Defense (the one DOD organization that can indeed grab people by the throat to make them comply). Harnessing and coordinating the power and output of the best minds available on pertinent topics, and in particular the peculiarities of using and securing information technology in the military, will yield better results that simply complicating an already confusing morass and perpetrating moat, wall, FLOT, FEBA, and “dominance” –type thinking that fails us today.

This We Agree On

The current state of affairs with regards to computer and information security in the DOD is unacceptable. Smart policy, secure-yet-functional procedures attuned to military operations, and strong authorities are essential if we are to ensure that information technology is a meaningful adjunct and force multiplier to physical military power. It would be a wonderful thing if Cyber Command were able to accomplish that mission, but if it does not, we should not hesitate to learn from our mistakes and quickly move on to a new construct or approach. Our adversaries in cyber space follow this model with great effect; why mess with something that works?

[1] “Active_FM – Army Doctrine and Training Publications.”

 

Related Reading

Leader Of U.S. Intelligence Community Delivers Clear and Unambiguous Warning of Cyber Threat

The Need for a Framework for Resilient Cybersecurity

National Security and Technology

Cyber Command Achieves Full Operational Capability

The Devil is in the Details: Seven Tests to Apply to any Cyber Conflict Concept

 

Gourley: Intelligence Community Should Provide Unclassified Cyber Threat Assessments Annually – The New New Internet

Gourley provides context for the New New Internet:

For that be effective, Gourley writes that the Department must choose the a capable and intelligence technology leader to head the NCCC. “The nation must choose wisely and put a very smart technology leader in this position,” he writes. “Someone who can enforce the right standards and give direction when required but can back off and let agency IT leaders run things when required and that person must be smart enough to know when and how to decide what to decide about.”

Gourley also praises the movement towards a system of continuous monitoring rather than the current FISMA structure. “Updating FISMA is long overdue,” he writes. “Moving towards real-time monitoring is GREAT!”

Additionally, making NCCC the central coordination point across the federal government is “a solid move.” The proposed effort to create secured supply chains, remove any impediments to sharing information and factoring in the human side of cybersecurity are also important, Gourley writes.

In addition to his praise for the bill, Gourley has one additional piece he would like to see added to the bill.

“I want to suggest that the U.S. Intelligence Community be tasked with providing a detailed yearly cyber intelligence threat assessment  for unclassified dissemination,” he writes. “The IC does a good job of providing some counterintelligence assessments and frequently mentions cyber in open fora like Congressional Testimony, but I believe this issue deserves a focused, NIE-like report dedicated to this topic.  Of course the IC should also be tasked with support to the NCCC.”

via Gourley: Intelligence Community Should Provide Unclassified Cyber Threat Assessments Annually – The New New Internet.

Related Reading

CTO Perspectives on Cyber Security Bill

On June 10, 2010, the US Senate Homeland Security and Governmental Affairs Committee (HSGAC) unveiled a major cybersecurity bill designed to modernize, strengthen, and coordinate US Cyber defenses.

Senators Collins, Carper and Lieberman introduced this bill with the clear articulation to defend not just federal networks but the Internet itself.

The bill itself is named the “Protecting Cyberspace as a National Asset Act of 2010.”

It creates an Office of Cyber Policy in the White House with a director accountable to the public to lead all federal cyberspace efforts and devise national cyberspace strategy.  A National Center for Cybersecurity and Communications within the Department of Homeland Security, also led by a director accountable to the public, to enforce cybersecurity policies through the government and even the private sector.

Some key aspects of this Bill, from the site of the HSGAC:

  1. Creation of an Office of Cyberspace Policy in the Executive Office of the President run by a Senate-confirmed Director, who will advise the President on all cybersecurity matters. The Director will lead and harmonize federal efforts to secure cyberspace and will develop a national strategy that incorporates all elements of cyberspace policy, including military, law enforcement, intelligence, and diplomatic.  The Director will oversee all related federal cyberspace activities to ensure efficiency and coordination.
  2. Creation of a National Center for Cybersecurity and Communications (NCCC) at the Department of Homeland Security (DHS) to elevate and strengthen the Department’s cyber security capabilities and authorities. The Director will regularly advise the President on efforts to secure federal networks.  The NCCC will be led by a Senate-confirmed Director, who will report to the Secretary. The NCCC will include the United States Computer Emergency Response Team (US-CERT), and will lead federal efforts to protect public and private sector cyber and communications networks.
  3. Updates the Federal Information Security Management Act (FISMA) to modernize federal agencies practices of protecting their internal networks and systems. With strong leadership from DHS, these reforms will allow agencies to move away from the system of after-the-fact paperwork compliance to real-time monitoring to secure critical systems.
  4. Requiring the NCCC to work with the private sector to establish risk-based security requirements that strengthen cyber security for the nation’s most critical infrastructure that, if disrupted, would result in a national or regional catastrophe.
  5. Requiring covered critical infrastructure to report significant breaches to the NCCC to ensure the federal government has a complete picture of the security of these sensitive networks.  The NCCC must share information, including threat analysis, with owners and operators regarding risks to their networks. The Act will provide specified liability protections to owners/operators that comply with the new risk-based security requirements.Creation of a responsible framework, developed in coordination with the private sector, for the President to authorize emergency measures to protect the nation’s most critical infrastructure if a cyber vulnerability is being exploited or is about to be exploited. The President must notify Congress in advance before exercising these emergency powers. Any emergency measures imposed must be the least disruptive necessary to respond to the threat and will expire after 30 days unless the President extends them.  The bill authorizes no new surveillance authorities and does not authorize the government to “take over” private networks.
  6. Development of a comprehensive supply chain risk management strategy to address risks and threats to the information technology products and services the federal government relies upon. This strategy will allow agencies to make informed decisions when purchasing IT products and services.
  7. Requiring the Office of Personnel Management to reform the way cyber security personnel are recruited, hired, and trained to ensure that the federal government has the talent necessary to lead the national cyber security effort and protect its own networks.

Now some analysis:

  1. By ensuring the White House will have a Senate-confirmed Director, it will help underscore for the executive branch that this issue should be taken a bit more serious.  Sounds like a prudent thing for the Congress to do.
  2. Creating a National Center for Cybersecurity and Communications (NCCC) in DHS with a leader also confirmed by the Senate sends a similar message, but it also empowers an individual and group to do something that no one has been authorized to do before (at least no one under the rank of President). This office will have authority to lead across government.  As a CTO with enterprise experience I respect this kind of position.  I am convinced you cannot defend large enterprises without the smart application of both central authority and decentralized action.  If you try with either of those missing you fail.  I am not worried about too much technical authority being drawn into one location, there are too many forces at play to keep that power from being abused and, if the person and staff are picked carefully, they will avoid making decisions that impact missions in a negative way.  Notice I have caveated my opinion here.  The nation must choose wisely and put a very smart technology leader in this position.  Someone who can enforce the right standards and give direction when required but can back off and let agency IT leaders run things when required and that person must be smart enough to know when and how to decide what to decide about.
  3. Updating FISMA is long overdue.  Moving towards real-time monitoring is GREAT!  It is the only way I know of to move towards enhancing both security and functionality at the same time.
  4. Naming the NCCC as the focal point for coordination with the federal sector is also a solid move.  It goes without saying, but the NCCC should be staffed and led by very savvy, very social, very action-oriented people.  Without social leaders with high emotional intelligence we stand the risk of getting what we have always gotten here.
  5. As a CTO, I applaud the measures this Bill describes for removing artificial impediments to information sharing.  Government and industry need trust-based relationships and unfortunately too many laws and behaviors that flow from those laws, like FOIA, have damaged those relationships.  Addressing them head on is the right thing to do.  Technologically there are few issues here.  Issues are in policy and the Bill seems to do a good job at addressing some big ones.
  6. Development of a comprehensive supply chain management strategy is another great goal I am glad to see.  There has been a great deal of action lately in establishing coordination mechanisms with senior IT leadership in the country and I believe this will serve as a good foundation for development of a strategy like this.
  7. The human side of technology is one that also needs significant attention and it is good seeing the Bill address this head-on by requiring OPM to reform the way the government leads cyber security personnel.

Some concluding thoughts:

  • I wish I would have raised another issue with the staffers.  I feel bad about this, but I have something I would like to add to the Bill.  I guess I’m too late, but maybe I can get my input to the SSCI or HPSCI instead.  I want to suggest that the US Intelligence Community be tasked with providing a detailed yearly cyber intelligence threat assessment  for unclassified dissemination. The IC does a good job of providing some counterintelligence assessments and frequently mentions cyber in open fora like Congressional Testimony, but I believe this issue deserves a focused, NIE-like report dedicated to this topic.  Of course the IC should also be tasked with support to the NCCC.
  • I found the Bill was full of smart information coordination and information sharing language and constructs.
  • The great work of folks at NSA, Cyber Command (including legacy organizations like JTF-GNO and JFCC-NW), STRATCOM, DHS, NCICC, US CERT, FBI, DC3 and many others must continue and I believe the language in this bill is very respectful of the great work that these groups have been doing.
  • I wonder who the first CTO of the NCCC will be?  That is going to be one cool job!

For more see:

Some humor for the CTO: Dakota Wisdom meets the enterprise

An enterprise technologist from government gave me this piece of humor and I wanted to share it here.  We can all use a laugh in these trying times, right?

I first saw a similar piece when serving in the Pentagon in the summer of 1997.  I heard a version repeated again by retired General Clapper at an intelligence community function. But like many other pieces of wisdom it keeps coming back around.  It has an enduring quality to it.

So here goes:  The CTO’s version of Dakota Wisdom

The tribal wisdom of the Dakota Indians, passed on from generation to generation, says that,

“When you discover that you are riding a dead horse, the best strategy is to dismount.”

However, in the world of the CTO, a whole range of far more advanced strategies are often employed, such as:  When you discover that you are riding a dead horse, the best strategy is to:

1. Buy a stronger whip.

2. Change riders.

3. Threaten the horse with termination.

4. Appoint a committee to study the horse.

5. Arrange to visit other countries to see how others ride dead horses.

6. Lower the standards so that dead horses can be included.

7. Reclassify the dead horse as “living impaired”.

8. Hire outside contractors to ride the dead horse.

9. Harness several dead horses together to increase the speed.

10. Provide additional funding and/or training to increase the dead horse’s performance.

11. Do a productivity study to see if lighter riders would improve the dead horse’s performance.

12. Declare that as the dead horse does not have to be fed, it is less costly, carries lower overhead and therefore contributes substantially more to the bottom line of the economy than do some other horses.

13. Rewrite the expected performance requirements for all horses.

14. Promote the dead horse to a supervisory position.

15. Establish a new CMMI and ITIL activity to optimize the dead horse.

16.  Roll out designs for a new customer-focused Service Oriented Architecture (SOA) leveraging the dead horse.

17.  Declare the dead horse to be part of your cloud computing strategy.

 

 

For more tech see:

Cyber And Physical Security: The discussion continues

Seven years ago I authored a short piece published in Government Security on the tending convergence of cyber and physical security. The piece, titled “Cyber and Physical Security Unite,” is still online at http://govtsecurity.com/mag/cyber_physical_security and still gets periodic attention.

I’ve been asked by some government friends to update my thoughts on the old article I mentioned, and am noodling over how to do that now. If you have any advice/comments/suggestions for me on that I would appreciate it. I’ve reprinted it below.

QUOTE:

Cyber And Physical Security Unite

May 1, 2003 12:00 PM, Bob Gourley

The passion is coming back to the on-again/off-again romance between cyber-security and physical security. Three drivers are putting the excitement back in the relationship: technology, policy and economics.

TECHNOLOGY — Increasingly physical security devices are being computer-enabled. They are also being networked together to provide automated results of physical security status to centralized databases for analysis. Often these devices communicate with each other via wireless circuits. All of this physical security information must be protected, forcing an integration of the cyber- and physical security disciplines. Computers and networks must be protected from both cyber- and physical compromise, of course, which reinforces the connection.

POLICY — In some situations, IT security is run by one organization, personnel security by another, physical security by another, and network operations by another. Each may have its own budget, priorities and processes. This results in seams that adversaries can exploit. Patching these seams requires policies that reinforce coordination and cooperation.

ECONOMICS — Managing the two together can result in more efficient use of budgets and staff time. Integrating physical and cyber security is not without challenges. The disciplines have always been related, but both require different expertise.

No organization should force its physical security guard force to be the computer network response team (or vice versa). Trying to do so is a recipe for failure for both missions. How, then, can organizations find the right balance in integrating physical and cyber security? Here are five suggestions:

  • Respect the expertise requirements and training needs of both disciplines.
  • Allow leaders in both disciplines to have insights into and input to each other’s emergency reaction plans.
  • Ensure coordination prior to acquisition of physical or cyber security devices.
  • Ensure senior management is well versed in the needs of both disciplines.
  • Periodically exercise the entire security force using multiple, realistic scenarios.

UNQUOTE

In thinking about how to update that short piece I thought about what has changed since 2003.  Changes include:

  • We are now more dependent than ever on IT
  • Threats to our cyber structures have been growing
  • There is now more linkage than ever between physical and cyber threats (bad people who operate in cyberspace usually are doing bad things in the real world too, for example, and bad people plotting attacks frequently use cyber to help their malicious purposes).
  • Technology for cyber security has continued to advance and almost everything in the physical world is connected to IP-based communications.
  • There has been a real shift towards all citizens (including fed workers) using social media, resulting in significant information opportunities for the bad guys.
  • There is a more refined national structure for coordinating across critical infrastructure sectors.  There has also been changes in how cyber security coordination occurs.

But many things have remained the same, including:

  • Human nature, including the tendency of humans to focus on the mission they are assigned and, for many reasons, to not focus so much on the mission others are assigned.
  • Bureaucratic politics, much of which flows from human nature, and much of which serves to reduce collaboration and coordination.
  • Pressure on budgets.  There is always a need to watch how money is spent.
  • The importance of both physical security and cyber security is another critical constant.  Both must get done to a level where our country can thrive in tough times. This is an enduring need.
  • And, unfortunately, we are still facing many challenges in optimizing our defenses against both physical and cyber attacks.

Because of all that, how should I update that little article?  I think the give key points I made are still pretty close, but they need to be fleshed out and informed by the many new cyber and physical structures and processes we have in place in enterprises big and small.

The article is definitely in need of an update to be relevant.  If you have any suggestions for me on how to do that please let me know.

Related Reading

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]