CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

NSA and 60 Minutes: If You Want To Know The Culture of NSA This May Be Your Best Source

If you are a national security professional we most highly recommend pausing to watch the video  at this link and embedded below. It is the video of a 60 minutes examination of NSA which includes interviews of General Alexander, Rick Ledgett and several NSA analysts. It also includes first ever public footage of key NSA watchfloors and analytical workspaces.

Our view: The only way to get at the truth is to listen directly to what professionals at NSA say. They are not perfect but are honest and focused on doing right. Few of us in the national security community think Snowden did anything good, his actions should be answered for in court, and the reason he did what he did was not out of any sense of informing the public or defending us from surveillance. He did what he did for his own glory and fame. It was his own narcissism that drove him to do what he did, and because of that real damage has occurred.

Additional damage was caused to the community by scare-mongers who spin every item they can. They do that for their own reasons which sometimes is a desire to get more readers or to further an agenda. Others accidently do harm by just piling on and believing things they have no reason to believe. It is hard to be mad at these people, they are human and there is something about people that makes them want to believe what they see in movies is true.

What is the truth? If you really want to know you will watch this 60 minutes report. You can also find the truth other places, but this is a great way to digest some really complex material.

Another very informative piece is a “behind the scenes” clip that captures the views of the producers of the video. It is pasted below:

Reference to Cyber Security “Wake-Up Calls”

Chart

 

We have previously discussed research and analysis we did for the Cyber Conflict Studies Association on the many “Wake-Up Calls” the nation’s policy makers have declared themselves to have had regarding cyber security. If history is any predictor of the past, we will still be getting these wake-up calls long into the future.

We want to change the future, of course. Doing that will require that we address the problems with Cyber Threat Amnesia our institutions suffer from.

As an aid to changing the future, please review this list of cyber security “wake-up calls” and consider ways we can collectively learn to stop repeating the same mistakes. I would love to get your feedback on this list.

This is not all major events, just those widely reported to be “wake up calls” for the nation.

  • 1970 and 1971 – The Defense Science Board publishes what will be known as the “Ware Report” highlighting the potential dangers to department information in the coming age of connected computing. This report was widely seen as a “wake up call” for computer security and caused changes at institutions like the National Security Agency to enhance the departments security posture.
  • Nov 1988 – The Morris Worm was released and propagated throughout internetworked systems including those of the federal government. This “wake up call” resulted in establishment of computer response organizations throughout DoD and also resulted in increased funding for computer security research being provided to academic organizations and institutions. The CERT/CC at Carnegie Mellon University was funded.
  • 1995 – The President’s Commission on Critical Infrastructure Protection (PCCIP) was widely regarded as a “wake up call” for the entire federal government and since it was extensively coordinated with industry and academia was also seen as a way forward in cybersecurity for the entire nation.
  • 1997 – Deputy Secretary of Defense John Hamre was quoted as saying “Solar Sunrise was a wake up call for DoD.” This activity resulted in increased funding to cyber defense organizations and the creation of a new joint activity called DoD’s “Joint Task Force Computer Network Defense” or JTF-CND (Gourley was first Director of Intelligence (J2) there).
  • 1998 Assistant Secretary of Defense Art Money was quoted as saying “Moonlight Maze was a wake up call for DoD.”  This activity resulted in enhanced counterintelligence resources and more information sharing across the DoD law enforcement and counterintelligence.
  • 2009 Director of National Intelligence Admiral Blair testified that “Buckshot Yankee was a wake up call” for the government. This activity resulted in more awareness and more funding for cyber security throughout the federal government.
  • 2010 Deputy Secretary of Defense Lynn writes that “Google’s Aurora attacks were a wake up call for us all.”  This wake up call resulted in stronger, deeper coordination across the federal space and underscored need for a DoD strategy.
  • 2011 Deputy Assistant Secretary of Defense Bob Butler says “Wikileaks was a wake up call for DoD.”   This wake up call resulted in significant activities and planning across the federal space aimed at enhancing security of information from disclosure.
  • 2012 Sep, In one of the most destructive attacks against computers noted against any company to date, Saudi state-owned ole company ARAMCO had data destroyed on over 3/4 of their companies computers. The NY Times reports this as a “wake up call” and attributes intelligence officials with that assessment.
  • 2012 Sep, Department of Energy issues a report on internal cybersecurity practices. This report by their internal inspector general was reportedly seen as a “wake up call” for the agency’s cyber security group.
  • 2012 Oct, South Carolina Gov Nikki Haley announced a massive hack into state websites. The Gov offered the excuse that these attacks are increasingly common. Reporters suggested this be her “wake up call”. (Nov 2013 update, her political opponents are now using this against her, saying it was a wake up call for them all).
  • 2012 Oct, Secretary of Defense Pannetta issues what he said is a “clarion call” for American’s to “wake up” to the growing cyber threat.
  • 2012 Nov, Former Director of National Intelligence provides “wake up call” warning of a potential 9/11 type attack via cyber.
  • 2013 Jan, New York Times acknowledges hacks into its papers by Chinese sources. This was widely reported as a “wake up call” for security experts in media.
  • 2013 Jan, Twitter was hit by a major hack in what security experts called a “wake up call” for the ecommerce and social media community.
  • 2013 Jan, Attacks on US banks called a “wake up call” for the industry by cyber security professionals.
  • 2013 Feb, Anonymous attacks against Federal Reserve investigated by FBI. Compromise, called a “wake up call” compromised data from the Fed’s Emergency Communications System.
  • 2013 Feb, Chairman of the House Intelligence Committee expressed confidence that the hackers recently targeting newspapers and other companies would soon “wake up” Washington on cybersecurity.
  • 2013 Feb, Mandiant releases a report exposing one of China’s Cyber Espionage Groups. This report, widely considered one of the best articulations of the threat, resulted in significant positive awareness on the seriousness of the threat and was widely called a wake up call. We believe this is one of the best pieces of cybersecurity research ever produced by an independent company, and we know it is making positive, virtuous change. We hope this goes a long way to really being the wake up call we all need.
  • 2013 July, Sowden insider attacks declared a “wake-up call” in Bloomberg report.
  • 2013 Nov, Australian newspaper cites Melissa Hathaway stating “We haven’t had our big wake-up call yet and I’m hoping that we’ll address the problems before we have a wake-up call.”

Of course the reason to publish this list is not to make fun of people for using the term “wake up call.”  The reason to publish the list is to get your brain deeper into the game. Maybe there is something you can do to prevent Cyber Threat Amnesia.  Maybe you can suggest action to current community or government or business leaders? Or maybe you can find ways to educate policy makers or Congress or the American public? Or maybe you have other ideas for stopping this madness of forgetting about the threat.

 

 

CNBC Features CTOvision’s Bob Gourley On Advanced Cyber Threat Reporting

CNBC’s Scott Cohn produced a segment focused on US Military cyber security which aired 11 October 2013 we believe will be of broad interest to our readers.

This segment, embedded below, focused on the increasing risk DoD networks face due to the government shutdown, but also provided a review of what CNBC assesses are the top five most significant attacks against DoD.

 

 

From the report:

“Military systems are growing more complex and more intertwined daily, making them more vulnerable and on top of that, we have these ongoing issues with budgets. There was first the sequester, which cut deep into IT modernization accounts, and now there is the government shutdown,” said Bob Gourley, the editor of CTOVision.com. Gourley has analyzed the U.S. military’s security.

The full economic impact may not be known for months, but according to Gourley, the Pentagon’s cybernetworks are vulnerable, which could lead to larger problems in the future.

It is interesting that when CNBC asked DoD for input on this situation they replied that all is well. DoD told CNBC that they are able to respond just fine and that:

“While the shutdown has been disruptive to our mission and many civilians remain furloughed, personnel who support key missions and activities remain on duty. These missions include sustaining critical IT capabilities and maintaining our network defenses.”

They also said:

“We have full confidence in the integrity of the department’s networks and systems upon which we conduct critical operations. Recent reports about cyber intrusions does not change that assessment.”

I hate to argue, but it is pretty clear the person responding to CNBC questions has not read the DSB study of Jan 2013, and it is also very likely they have not spoken to anyone responsible for operating or defending networks in the Pentagon.

For more from CNBC, see: Defense networks vulnerable to cyberattack: expert 

 

DNSSEC: An interview with Joe Klein on why DNSSEC matters, how it works, and how you can use it

The video below is an interview of Joe Klein, highly regarded IPv6 expert and cybersecurity architect and DNSSEC expert.  The InternetSociety.org’s Dan York interviews Joe and the result is a very easy to understand overview of key DNSSEC concepts. Please check it out at: http://ctolink.us/18kzIwU

More reading:

The Use of Recorded Future for Cyber Security Professionals

The Mobile Internet: You won’t believe how vastly, hugely, mind-bogglingly big it is

The Late Henrietta Lacks: A legacy that has touched you and your loved ones in ways that may surprise you

A Great Engineering School Just Got Event Better: Fred Chang joins SMU, will focus on cyber security

How Can We Retain The Jedi Masters Of Federal IT In Government Service? Yodas Require Big Missions To Serve

The Hard Thing About Hard Things: building a business when there are no easy answers

A Great Engineering School Just Got Event Better: Fred Chang joins SMU, will focus on cyber security

We have just received word that Dr. Fred Chang has joined SMU. This is good news for the students, faculty, research teams and entrepreneurs around SMU. It is also good news strategically for the cyber security community. Fred is one of the heroes in this domain.

Here is more from the press release:

NATIONAL EXPERT TO LEAD BROAD CYBER SECURITY

INITIATIVE AT SMU LYLE SCHOOL OF ENGINEERING

Frederick R. Chang joins SMU as Bobby B. Lyle Endowed Centennial Distinguished Chair

in Cyber Security,computer science professor, Tower Center Senior Fellow

DALLAS (SMU) – Frederick R. Chang, a recognized national expert in cyber security, has joined SMU to develop a multidisciplinary program aimed at tackling the most pressing cyber challenges facing individuals, business and government today.

Chang, whose impressive career includes leadership positions in academia, business, and in government at the National Security Agency, is the new Bobby B. Lyle Endowed Centennial Distinguished Chair in Cyber Security.  The position is made possible by a financial commitment from SMU trustee and longtime benefactor Bobby B. Lyle, for whom SMU’s engineering school is named.

SMU’s first Centennial Distinguished Chair provides a faculty position endowed at $2.5 million, plus start-up funding of $1 million for the first five years to provide immediate support for the position and related research. The establishment of a Centennial endowment is available only to donors during the SMU Centennial commemoration, March 1, 2011, through Dec. 31, 2015.

In addition to holding the Lyle Chair, Chang also will be a professor of computer science in the Bobby B. Lyle School of Engineering and a senior fellow in the John Goodwin Tower Center for Political Studies in Dedman College of Humanities and Sciences.  His appointments to positions in both the Lyle School and Dedman College reflect the interdisciplinary approach he believes is key to effective cyber research.

“Economic and national security are bedrock issues for our country,” said SMU President R. Gerald Turner. “Dr. Chang is prepared to take advantage of the University’s commitment to education, research and dialogue to deal with these critical issues, and will bring to the table students and faculty in all disciplines to find solutions.  We are delighted to welcome him to SMU, where our students fully expect to be world changers.”

Chang has aggressive objectives to:

  • Conduct broad programs of research aimed both at creating a science of cyber security and addressing national cyber security priorities.
  • Apply an interdisciplinary approach to challenging problems, incorporating elements from disciplines not traditionally associated with cyber security such as law, business and the social sciences.
  • Help close the skills gap in cyber security by educating and tapping the innovation capabilities of SMU students to meet the demand for trained cyber professionals.

“Prof. Chang arrives at SMU Lyle at an important moment,” said Lyle School Dean Marc Christensen. “The impact of cyber crime and cyber terrorism cannot be overstated. As Prof. Chang joins SMU Lyle to lead our already strong cyber security researchers, he is poised to make a notable difference in this arena.  We will be educating a generation of SMU graduates who understand the complexities of cyber-related issues whether their degree is in computer science or philosophy.  These students will be better suited to live, work, and play in the modern interconnected world.”

Chang served as the director of research at the National Security Agency (NSA)in 2005-2006, where he was awarded the NSA Director’s Distinguished Service Medal.  In addition, he has held several senior executive positions at SBC Communications, prestigious positions at both the University Texas at Austin and the University of Texas at San Antonio, and was most recently president and chief operating officer of 21CT Inc., an advanced intelligence analytics solutions company in Austin.  Find more about Chang’s background here.

“Dr. Chang’s experience at the highest levels of government, industry, and academia has given him a unique perspective on the cyber security landscape,” said Paul Ludden, SMU provost and vice president for academic affairs.   “He has influenced the national dialogue and policies on cyber security through his work at the NSA, his testimony before congressional committees, and his presence on academic and industrial advisory boards as well as his peer journal editorial board work.  He will continue that influence at SMU.”

Joining the Lyle School puts Chang in the company of faculty already making their mark in innovative teaching and research.  The Lyle School is home to the Caruth Institute for Engineering and Education, the Hunter and Stephanie Hunt Institute for Engineering and Humanity and the Hart Center for Engineering Leadership, as well as STEM outreach programs such as Visioneering and the Infinity Project.  The engineering school also is a partner in the annual production of TEDxSMU and TEDxKids @SMU, where Chang will be a featured speaker in October.

“Dr. Chang is committed to teaching excellence, and I am delighted he is coming to SMU, “ said Bobby Lyle.  “Research will be significant under his leadership, but he also intends to teach courses that make information about cyber science and security accessible to students of all disciplines.  That’s a tremendous gift, as understanding the rules in cyberspace becomes more important in our daily lives. “

The founder of Lyco Energy Corporation in 1981, Lyle has been a leader in theoil and natural gas industry for more than 30 years, exploring throughout the United States. After selling Lyco Energy in 2005, he established Lyco Holdings Incorporated, a private investment firm.

Lyle graduated from Louisiana Tech University with a degree in mechanical engineering, received a graduate degree in engineering administration from SMU and earned a doctorate from the University of Massachusetts at Amherst. He served as a professor and administrator in what is now the Edwin L. Cox School of Business, ultimately serving as dean ad interim and executive dean.

On Oct. 17, 2008, the SMU community celebrated the naming of the Bobby B. Lyle School of Engineering and evidence of his philanthropy may be seen throughout SMU. Lyle has cumulative service of more than 25 years as an SMU trustee and is a member of the executive boards of both the Lyle School of Engineering and the Cox School of Business.   Lyle is vice chair of the MaguireEnergy Institute and vice chair of the Maguire Center for Ethics and Public Responsibility.

Chang says he enjoys the sense of working toward something bigger than himself – a philosophy that carries over from his tenure at the NSA, and that he intends to share with SMU students. “There are some very difficult problems that the nation faces in cyber security,” Chang said. “Adding to the enduring problems are new, emerging challenges. I am confident that SMU, working with different partners, can make a difference at the national level.

“My particular area of expertise is in information assurance – defending and protecting critical systems,” he said. “In that context, I’m looking forward to working with my colleagues at SMU and beyond on a wide range of topics such as software assurance, social sciences and security, insider threat and hardware security.”

Chang said he sees outstanding interdisciplinary cyber security research taking place within the Lyle School’s Computer Science and Engineering Department today, such as the work that faculty members Suku Nair, Mitch Thornton and Tyler Moore are doing in network security, formal methods, and economics and security.  “What is required today is cyber security research that incorporates innovative thinking with consideration of people, processes and technology,” Chang said.

He said he is eager to work with colleagues across the campus, including law and business faculty, as well as to use the resources of the Maguire Center for Ethics and Public Responsibility in addition to those of the Tower Center.

“It is an honor and a privilege for me to have the opportunity to join SMU at this crucial time in the evolution of cyber security,” Chang said.  “From the Lyle School of Engineering, to the Tower Center for Political Studies and across campus, I feel a tremendous sense of chemistry and collegiality here.  There is also a sense of urgency, purpose and mission that is especially appealing.  To be part of this is tremendously exciting to me.”

###

SMU is a nationally ranked private university in Dallas founded 100 years ago. Today, SMU enrolls nearly 11,000 students who benefit from the academic opportunities and international reach of seven degree-granting schools.

SMU’s Bobby Lyle School of Engineering, founded in 1925, is one of the oldest engineering schools in the Southwest. The school offers eight undergraduate and 29 graduate programs, including masters and doctoral degrees.

More reading:

The Use of Recorded Future for Cyber Security Professionals

The Mobile Internet: You won’t believe how vastly, hugely, mind-bogglingly big it is

The Late Henrietta Lacks: A legacy that has touched you and your loved ones in ways that may surprise you

DNSSEC: An interview with Joe Klein on why DNSSEC matters, how it works, and how you can use it

How Can We Retain The Jedi Masters Of Federal IT In Government Service? Yodas Require Big Missions To Serve

The Hard Thing About Hard Things: building a business when there are no easy answers

 

Bogons: Do not let them in or through your networks

With this post we will dive a bit deeper into bogosity in networks, paying particular attention to the fundamental element of bogosity, the Bogon. We will then articulate a use case for the Centripetal Networks RuleGate which can ensure bogons never get to your enterprise.

As a prelude let me first say there is a very high likelihood that your ISP is sending bogons your way right now, using the bandwidth you paid for to do so. Bogons are bad for several reasons. Here is a bit more on why:

“Bogon” is an informal term used to describe IP packets on the public Internet that claim to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or any of the Regional Internet Registries (RIR). Private IP addresses are also considered bogons because they are not supposed to be found on the public Internet. Many ISPs and end-user firewalls seek to block bogons, because they have no legitimate use (more details on how successful they can be at this are below). The only reason you will see a bogon is if someone either accidentally misconfigured something or intentionally is creating them for malicious purposes.

Bogon packets are useful to cybercriminals because the packets cannot be attributed to an actual host (since the source IP is bogus). Routers don’t examine the source IP address of a packet, all they care about is the destination IP address, so routers will happily forward bogon packets to their destination.

A bogon packet cannot be used to initiate and set up a TCP connection (setting up a TCP connection requires a 3-way handshake between two endpoints). So bogon packets cannot be used to, for example, send spam e-mails or to send HTTP/web traffic. But bogon’s can be used to launch TCP SYN attacks and are used in about 10% of DDoS attacks on the net. Stopping bogons can not only help your enterprise but those you connect to. Bogons can also be used to covertly move information.

Vogon's are not bogons, but look like them.
Vogon’s are not bogons, but look like them.

Enterprises have been filtering bogons for years. Some did it better than others. Those that did it well could reduce the amount of malicious traffic heading their way. Historically, when ISPs or enterprises say they filter bogons, they are likely only referring to private IP addresses, not the full bogon address space. Filtering private IP addresses requires only a few rules. But filtering the full bogon list requires about 5000 rules for IPv4 and about 70,000 rules for IPv6. Double those numbers numbers if you want to filter in both directions. Given that 5000 rules will cause performance degradation in firewalls and router ACLs, it is likely that few, if any, ISPs and enterprises are filtering the full bogon list.

Some other very important notes for context:

  • Bogon addresses are not static. Addresses get assigned and unassigned and changed. So while the core of a bogon list may remain the same for long periods of time the list is dynamic enough to need to be frequently updated if you want to use it to block. Automated systems like the Centripetal Networks RuleGate can take dynamic feeds of bogons and block them, automatically.

  • It is worth mentioning that there is only one device on the market capable of processing enough rules to block bogons, including in both directions, and that is the RuleGate.

  • Additionally, IPv4 networks are not safe from an IPv6 bogon bandwidth flooding attack. Most ISPs and many enterprises use dual-mode equipment which can route both IPv4 and IPv6 and have IPv6 routing tables in place and have pre-allocated IPv6 to their subscriber’s networks.

  • The dual-mode, IPv6 capable systems in your network can also enable malicious actors to do other things, like exfil their data using IPv6 without you knowing it. Although this is not the precise definition of a bogon, this unauthorized use of your network is bogus and bad and should also be stopped.

I hope this discussion on bogons has got you thinking. Part of the reason there has not been much discussion of bogons is till now there were no automated systems that could really stop them. Now there is and it is worth having the conversation.

By the way, an absolutely great reference to this topic is “The Bogon Reference” by Team Cymru, a community focused team of cyber defenders who are great at tracking the complexities of these issues, including updated bogon lists.

More CTOvision Reporting:

The 20 Security Controls: Smartly Enhancing Enterprise Security

We have written before about SANS and the  virtuous collaborative work they encourage in the community. They work so well with others and have for so long that a community of trust has arose around them. The collegial project that produced the “20 security controls” referenced here includes a wide range of experienced organizations with knowledge of real attacks and insight into what really works in stopping them (for more on the history of these controls and list of participants who maintain them see SANS).  

So, if you are looking to quickly get up to speed on what really works when thwarting attacks, a great source is the community coordinated 20 Critical Security Controls for Effective Cyber Defense.

Here is more from SANS on what these are:

To secure against cyber attacks, organizations must vigorously defend their networks and systems from a variety of internal and external threats. They must also be prepared to detect and thwart damaging follow-on attack activities inside a network that has already been compromised. Two guiding principles are: “Prevention is ideal but detection is a must” and “Offense informs defense.”

The goal of the Critical Controls is to protect critical assets, infrastructure, and information by strengthening your organization’s defensive posture through continuous, automated protection and monitoring of your sensitive information technology infrastructure to reduce compromises, minimize the need for recovery efforts, and lower associated costs.

And now the full list of the 20 controls, with links to the SANS hosted site explaining each:

20 Critical Security Controls – Version 4.1

  • Critical Control 1: Inventory of Authorized and Unauthorized Devices
  • Critical Control 2: Inventory of Authorized and Unauthorized Software
  • Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
  • Critical Control 4: Continuous Vulnerability Assessment and Remediation
  • Critical Control 5: Malware Defenses
  • Critical Control 6: Application Software Security
  • Critical Control 7: Wireless Device Control
  • Critical Control 8: Data Recovery Capability
  • Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps
  • Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
  • Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services
  • Critical Control 12: Controlled Use of Administrative Privileges
  • Critical Control 13: Boundary Defense
  • Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs
  • Critical Control 15: Controlled Access Based on the Need to Know
  • Critical Control 16: Account Monitoring and Control
  • Critical Control 17: Data Loss Prevention
  • Critical Control 18: Incident Response and Management
  • Critical Control 19: Secure Network Engineering
  • Critical Control 20: Penetration Tests and Red Team Exercises

DSB Report on Resilient Military Systems and the Cyber Threat

Bottom Line Up Front: After reviewing all available evidence and rigorously weighing threat information, a Task Force of the Defense Science Board (DSB) concludes that:

The United States cannot be confident that our critical Information Technology (IT) systems will work under attack from a sophisticated and well-resourced opponent. 

How does that make you feel? You know yourself what adversaries are doing when it comes to intellectual property theft. Now read on for more about what the DSB sees as the threat to military systems.

Here are more details: 

The Defense Science Board (DSB) provides advice, assessments and reports as chartered by DoD leadership. It has studied cyber security and related topics for years and has been instrumental in providing new ideas and perspectives for action by DoD leadership.

The DSB was recently chartered to look at an interesting and somewhat intellectually stimulating topic, that of how US military systems could withstand cyber attack and remain able to execute their mission.  The chartered group, a task force on Resilient Military Systems, produced a report with a set of recommendations designed to improve DoD’s ability to accomplish its missions. The overarching strategy recommended by the DSB is one that enhanced the department’s defenses in the face of attacks, decreases the effectiveness of adversaries, increases the cost to adversaries, and deters the most significant adversaries by ensuring the US maintains the ability to deliver desired mission capabilities in the face of catastrophic cyber attack.

The task force also identified a framework to implement metrics collection systems and then develop appropriate performance metrics that can be used to shape DoD’s investment decisions. The report approved by DSB chairman Paul Kaminsky is at DSB Report

Here is more from the forwarding letter to the report:

The final report of the DSB Task Force on Resilient Military Systems is attached. This report is based on the perspective of 24 Task Force members who received more than 50 briefings from practitioners and senior officials throughout the Department of Defense (DoD), Intelligence Community (IC), commercial sector, academia, national laboratories, and policymakers. This Task Force was asked to review and make recommendations to improve the resilience of DoD systems to cyber attacks, and to develop a set of metrics that the Department could use to track progress and shape investment priorities.

After conducting an 18-month study, this Task Force concluded that the cyber threat is serious and that the United States cannot be confident that our critical Information Technology (IT) systems will work under attack from a sophisticated and well-resourced opponent utilizing cyber capabilities in combination with all of their military and intelligence capabilities (a “full spectrum” adversary). While this is also true for others (e.g. Allies, rivals, and public/private networks), this Task Force strongly believes the DoD needs to take the lead and build an effective response to measurably increase confidence in the IT systems we depend on (public and private) and at the same time decrease a would-be attacker’s confidence in the effectiveness of their capabilities to compromise DoD systems. This conclusion was developed upon several factors, including the success adversaries have had penetrating our networks; the relative ease that our Red Teams have in disrupting, or completely beating, our forces in exercises using exploits available on the Internet; and the weak cyber hygiene position of DoD networks and systems. The Task Force believes that the recommendations of this report create the basis for a strategy to address this broad and pervasive threat.

Nearly every conceivable component within DoD is networked. These networked systems and components are inextricably linked to the Department’s ability to project military force and the associated mission assurance. Yet, DoD’s networks are built on inherently insecure architectures that are composed of, and increasingly using, foreign parts. While DoD takes great care to secure the use and operation of the “hardware” of its weapon systems, the same level of resource and attention is not spent on the complex network of information technology (IT) systems that are used to support and operate those weapons or critical IT capabilities embedded within them.

DoD’s dependence on this vulnerable technology is a magnet to U.S. opponents. In fact, DoD and its contractor base have already sustained staggering losses of system design information incorporating decades of combat knowledge and experience that provide adversaries insight to technical designs and system use. Despite numerous DoD actions, efforts are fragmented, and the Department is not currently prepared to mitigate the threat.

That forwarding letter was signed by the task force co-chairs, Mr. Lewis Von Thaer and Mr. James R. Gosler, two of the most professional, well thought out leaders I have ever worked with.

Please dive deep into the full document now. You will find some information you already know, but I promise some surprises as well.

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]