CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Government

Government

An Assessment on the Cyber Threat

How would you describe the threat to the US information infrastructure? If you are a technologist or a national security expert or both I hope you would use your background and experience and expertise and produced a fused-all source assessment based on facts. But it is also ok to cite the masters, folks who really know what they are talking about and are paid to produce the most accurate possible reports. Below is an assessment I extracted from a source I know to be reliable, but to most of you technologists and national security professionals I hope this list will be seen as intuitive statements that ring true to your experience. Please look it over and let me know what you think (I’ll inject some thoughts at the end):

Judgements:

“The fact is that we are currently building an information infrastructure — the most complex systems the world has ever known — on an insecure foundation. We have ignored the need to build trust into our systems. Simply hoping that someday we can add the needed security before it is too late is not a strategy.”

Additionally:

  • We are growing increasingly dependent on information systems for commercial and government activities.
  • Our adversaries recognize this dependence and are developing tools to attack our information systems.
  • Protecting our systems will require an unprecedented level of cooperation between government and the private sector.
  • Protecting our critical information systems and the data on them will be key to our survival as the world’s leading economic power and as the world’s leader in information technology.
  • Our heavy and growing societal and strategic dependence on information technologies and information systems has created vulnerabilities — vulnerabilities to our economic institutions, to the systems that support public needs, to our privacy, and to our military capabilities.
  • The number of known potential adversaries conducting research on information attacks is increasing rapidly and includes intelligence services, military organizations and non-state entities such as terrorism groups.
    Technology will increase the sophistication of their capabilities and will continue to reduce the cost of attack and the risk if security remains where it is today.
  • And the attackers have enormous incentives.Trillions of dollars in financial transactions and commerce moving over a medium that has minimal protection and sporadic law enforcement. Increasing quantities of intellectual property residing on networked systems. And the opportunity to disrupt military effectiveness and public safety, with elements of surprise and anonymity.
  • The state sponsored terrorists and military Information Warfare people pose the greatest risk to our critical infrastructure because they have the greatest knowledge and resources.
  • Foreign governments and their military services are paying increasing attention to the concept of ”Information Warfare”. Foreign military writings discuss the importance of disrupting the flow of information in combat. The battlespace of the future also will extend to our domestic information infrastructure, such as our electric power grids and our telecommunications networks – in short, the very foundations of our economy.
  • We cannot keep building new capabilities on a poor foundation of security. We cannot ignore the need to build trust into our information systems any longer.
  • It is folly to hope that someday we can add needed elements before it’s too late. The longer we wait, the more our country is exposed, and the costlier it will be to address the problem.If we are going to lead the world in information technology we must recreate the trust that existed between our government and our industry that allowed us to lead the free world for over forty years. We still have the power to lead by our example, and we still have the time to do what is right.

I think the information and assessments and powerful thoughts above are right on and should be considered by anyone in the national security and technology space.

The source?  1998 speeches and testimony by then Director of Central Intelligence George Tenet.  I think he pretty much nailed what would happen with the assessment above (read more online at: https://www.cia.gov/news-information/speeches-testimony/1998/dci_speech_040698.html and https://www.cia.gov/news-information/speeches-testimony/1998/dci_testimony_062498.html

In fact, seems like he provided clear an unambiguous warning.

Since then, it seems like very leader in the national security, DoD and Intelligence Space that comes into office seems to muddle on oblivious to the cyber threat till some incident hits them, like Moonlight Maze or the series of intrusions into DoD and other nets over 2007 or the attacks vs Estonia or the attacks vs. Georgia or the attacks vs. Google.  And in each time you get folks saying something like “oh well that was a wake up call.”

Any thoughts on that?

Is there anything that can be done so 12 years from now we are not asking ourselves why people in key positions are still saying things like “oh that was a wake-up call!”?

For more on this topic see the even older warning by CIA Director John Deutch at: Leader Of U.S. Intelligence Community Delivers Clear and Unambiguous Warning of Cyber Threat

Related Posts:

Enhancing IT Support to the Counter Terror Effort: Design Criteria

This is the concluding post on enhancing IT innovation in support of the Counter Terror effort.  The first part focused on the challenge and importance context relevant to design criteria.  This post focuses on design criteria and proposes next steps.

Transforming the Challenge Into Design Criteria:

The legacy IT environment of the counter-terror community is complex.  Changes to the environment must be done by design or they may cause unintended consequences that result in more harm to the system than good. To enable good design, the challenges previously articulated can be captured in explicit goals that the counter-terror IT enterprise must achieve.   Primary Design Criteria are those that must be met in a successful design.  Secondary Design Criteria are those that are highly desirable but not absolutely essential.

Primary Design Criteria.  The counter-terror IT enterprise will possess the following features:

  • Data streams are the feeds of data normally moving across IP-based networks from sensors, databases, command centers and other generators of message traffic and events.
    • Data stream design features supporting humans include the need to provide access to and insight into data streams in a way conducive to immediate understanding of importance.  Alerts on what is occurring in data streams should be provided.  Visualizations of data streams should be provided.  Since humans are the only component of the system which can assess relevance they must be able to inject their assessments of relevance into the data stream. Therefore, analysts/watchstanders/other approved users will be given an ability to rapidly tag information in stream as desired. Data streams must be designed to support humans with many other analytical capabilities including an ability to understand how the enterprise is functioning (data ingest rates, networks/nodes available, bottlenecks, what is nominal performance etc).
    • Data stream design features supporting computer to computer processing will include design of systems to evaluate data streams to produce alerts to users and to evaluate new data in the context of all legacy data (through pattern matching, correlation and database search).  This evaluation step may generate additional alerts.
    • A key note: the counter-terror mission requires data stream’s from from a wide community including communities operating at many different classification levels.  The engineering of solutions that bring these streams together seems to be a very straightforward task but the very high data rates and need for security make this a challenge. There are ways to use software to create cross domain data repositories and that may be the way ahead here. And an enduring challenge is in finding rapid ways to bring on new streams of data from other organizations.  This also requires focused engineering.
  • Databases are holders of and operators on data.
    • Database design features supporting humans include the need to provide enhanced means of accessing, discovering and working with data at rest. People need systems that automatically discover relationships in the data.  Users must also be given ways to assess the relevance of data at rest and then inject assessments of their judgment (users get to give the “so what” of the information).  Humans must be enabled with guided navigation and discovery engines, especially discovery engines that will enable discovery of all variations/spellings of names and locations.
    • Database design features focused on automation include design of a means to evaluate every update to a database in context of previous information in the enterprise. Every update to a database must be evaluated by automated routines to understand how the update related to existing information stores from throughout the enterprise.  When data is found that relates to other data, users must be notified so evaluations can be made on its relevance.  When databases are queried and when discovery engines are run against databases misspellings must not be an issue (modern discovery capabilities return all related results including all potential misspellings).  Multi-lingual search/correlation and other language support tools and information extraction capabilities are also required.

The primary design criteria are summarized in the following matrix:

Secondary Design Criteria.  If at all possible, the counter-terror IT enterprise will possess the following additional features:

  • Designs in this environment should accommodate change.  Open standards and open architecture are a must. Collaborative development environments which enable secure code development and application development lifecycle management are also a must.
  • The mission here places a very high premium on IT security and the protection of privacy.  The legacy architecture and objective design will both continue to emphasize protection of data and privacy.  Additionally, the objective design will work with an existing network and ride on top of existing infrastructure.  This means the objective design will accommodate multiple domains of classification and security policy.
  • A key shortfall in our capabilities (human and machie) is name spellings, however, we don’t do well in challenging people to validate their name entries.  There is a need for a “do you mean…?” feature when people are enterirng data.  Auto-fills driven by data from hundeeds of indexes and databases could help drive this feature.
  • Production of intelligence in living/fluid/dynamic ways is in need of focused attention.  Little engineering needs to be done to accomplish this, but upgrading IT can at times be a good excuse to get the attention of business process owners and can help in improving business processes (we have all seen what IT can do to a bad process, it can automate the bad process and make it far worse).
  • The most significant situations confronting members of the intelligence community are those that require our best thinkers to collaborate together across many systems.  The need to enhance collaboration is a continuing, enduring requirement that should be a consideration in all designs.


Concluding Thoughts:

Redesign and modernization of current systems and the enterprise IT environment supporting counter terror work is a complex task involving far more than just the intelligence community.  It involves a large community of IC providers, IC users, law enforcement, homeland security and IT professionals.  Throughout the redesign of IT for this large community we should ensure computers support humans in ways where humans do what humans do best and computers do what computers do best.

Next Steps:

A useful next step will be to closely examine the entire framework of counter terror systems with the framework above.  This review can inform strategic decisions regarding future design work.

The framework above can also be used in developing requirements and in evaluating commercial technologies which can be relevant to meeting mission needs.  New design criteria do not always need to result in totally new systems.  Frequently existing systems can be improved by configuration changes and CONOP improvements and the design criteria above can aid in discussing those.

A closing note:  This paper addresses a framework for considering key design criteria.  It is the opinion of the author that governance must be addressed in conjunction with systems design.  Technology can help mitigate threats to the nation, but only if the right decisions are made regarding how data flows and that generally requires clear, non-ambiguous community-wide governance structures.

A CTO Analysis of Secretary of State Hillary Clinton’s Speech on Internet Freedom

On 21 January 2010 Secretary of State Clinton delivered a speech on the topic of Internet Freedom.

This is a very good presentation of policy worth a complete read by all, but I looked through it for statements indicating what we technologists should focus on.  I tried to find the phrases indicating what the Secretary was saying the US should or will do, since that should drive many other government actions and should help technologists think through what we may be asked to do/support.

Key points of this speech include:

  • “We stand for a single internet where all of humanity has equal access to knowledge and ideas.”
  • “We believe it’s critical that its users are assured certain basic freedoms. Freedom of expression is first among them. This freedom is no longer defined solely by whether citizens can go into the town square and criticize their government without fear of retribution. Blogs, emails, social networks, and text messages have opened up new forums for exchanging ideas, and created new targets for censorship. “
  • “We do not tolerate those who incite others to violence.”
  • “Those who use the internet to recruit terrorists or distribute stolen intellectual property cannot divorce their online actions from their real world identities.”
  • “These challenges must not become an excuse for governments to systematically violate the rights and privacy of those who use the internet for peaceful political purposes.”
  • “We must work to advance the freedom of worship online just as we do in other areas of life.”
  • “States, terrorists, and those who would act as their proxies must know that the United States will protect our networks. “
  • “Countries or individuals that engage in cyber attacks should face consequences and international condemnation.”
  • “The freedom to connect – the idea that governments should not prevent people from connecting to the internet, to websites, or to each other. “

My first general thought upon reviewing those compelling actions is- “I’m on board!” It is good getting policy guidance from the Secretary of State on this.  It is fine, of course, for academics and citizens to scrutinize those and offer opinions and thoughts and argue.  That is just the nature of democracy.  But we lack so much official vision in the cyber domain I’m going to default towards following the leader here, at least for now.  My hope is we can all pull behind the Secretary of State and others and execute on these goals (but hey give me time and I may decide to mount some arguments for change… just for now I think it is best to salute and follow).

My second general thought is that the Internet was not designed to be a platform to enable any of those actions.  Oh boy, that is going to make it tough.  And since there is huge lock-in on the current standards and design we are not going to be able to simply build a new Internet with new design criteria and then switch everyone to that.  Nope, we are going to have to find ways to change the fabric of the current Internet to make it possible to achieve these objectives.

Some other non-technical thoughts I think relevant to follow-on work:

  • Meeting these goals will require connection to “all of humanity.”  That piece is more achievable than it may sound.  There are already 4B cell phones active in the globe for about 6B people.  So we are two-thirds of the way there.   This will require much more infrastructure work but we can do this.  And in places where ground-based infrastructure is not possible then space-based access is also possible (maybe via Cisco’s IRIS?).
  • We must have ways to protect anonymity of good people, but not allow anonymity of bad people.   This is going to be much harder to do than it is to say.  I believe a structure could be put in place, with massive engineering, where all people are given some means to stay anonymous but when a certain key is applied their cloak can be peeled back.  Hmmm.  Who wants to keep those keys?
  • The US is now on the record saying we will protect our networks.  How, I wonder, will we do that?  This is not the first time this question has been asked.  I know many great thinkers have been noodling over that one for a long lone time and that one is also easier said than done.  I know we can engineer in more security and have heard of some powerful ideas on how to do it.  But we have to move the ideas to action quick.  And we need to do that not just for the federal government but the entire US infrastructure.

Who can make these goals real?

The many technologists who design and field components of the modern Internet come together in multiple forums, many of which are key standards bodies.  Any significant re-design of Internet functionality is going to be done by collegial coordination in standards bodies. A short list of standards bodies is here.

A few standards bodies particularly relevant to designing Security into the Internet fabric are:

  • ANSI – American National Standards Institute
  • IEEE – Institute of Electrical and Electronics Engineers
    IETF     – Internet Engineering Task Force
  • ISO – International Organization for Standardization
  • ITU – The International Telecommunication Union
    • ITU-R – ITU Radiocommunications Sector (formerly known as CCIR)
    • ITU-T – ITU Telecommunications Sector (formerly known as CCITT)
    • ITU-D – ITU Telecom Development (formerly known as BDT)
  • OMA – Open Mobile Alliance

Another key body is ICAAN.

So, what’s next?  I don’t know but I expect to see follow on action to be coordinated across the federal government and expect to see continued action on making these policies real.

Any thoughts on that?

Thoughts for the CTO from 171 BC

I saw an interesting statement reportedly by Lucius Aemilius Paulus Macedonicus (229 BC-160 BC).  This two-time consul of the Roman Republic and noted general during the Third Macedonian War (171 BC – 168 BC) offered guidance prior to his involvement in the war, which may have contributed to his ability to achieve victory in what had previously been a messy stalemated theater.

His guidance on advice and the credible sources of advice follows:

QUOTE:

In every circle, and truly, at every table, there are people who lead armies into Macedonia; who know where the camp ought to be placed; what posts ought to be occupied by troops; when and through what pass that territory should be entered; where magazines should be formed; how provisions should be conveyed by land and sea; and when it is proper to engage the enemy, when to lie quiet and they not only determine what is best to be done, but if any thing is done in any other manner than what they have pointed out, they arraign the consul, as if he were on trial before them. These are great impediments to those who have the management of affairs; for every one cannot encounter injurious reports with the same constancy and firmness of mind as Fabius did, who chose to let his own ability be questioned through the folly of the people, rather than to mismanage the public business with a high reputation.

I am not one of those who think that commanders ought at no time to receive advice; on the contrary, I should deem that man more proud than wise, who regulated every proceeding by the standard of his own single judgment. What then is my opinion? That commanders should be counseled chiefly by persons of known talent, by those who have made the art of war their particular study, and whose knowledge is derived from experience, by those who are present at the scene of action, who see the enemy, who see the advantages that occasions offer, and who, like people embarked in the same ship, are sharers of the danger.

If, therefore, anyone thinks himself qualified to give advice respecting the war which I am to conduct, let him not refuse the assistance to the State, but let him come with me into Macedonia.

He shall be furnished with a ship, a tent, even his traveling charges will be defrayed, but if he thinks this is too much trouble, and prefers the repose of a city life to the toils of war, let him not on land assume the office of a pilot. The city in itself furnishes abundance of topics for conversation. Let it confine its passion for talking to its own precincts and rest assured that we shall pay no attention to any councils but such as shall be framed within our camp. (See LIVY, book 44, chapter 22, Trans. Alfred C. Schlesinger, vol 13, p. 161).

UNQUOTE

What did you think of when you read that? Did you think of strange technical guidance given by a person with no experience in IT that impacted your architecture?  I guess we have all seen that.

I’m also thinking now about the huge amount of kibitzing and complaining and advice from outsiders now being thrust on government IT leaders, especially those in the intelligence community.  It is true there are things that need to change there, but the fact is, it takes someone in the fight to have a real understanding of the complexities of the issues that face the community.

I would certainly like to see more/better mechanisms to get advice and thoughts and help from outsiders to the IT leadership of the intelligence community.  That type of information exchange can always be improved, and lord knows government IT leaders need more help.  But what I would most like to see is a greater number of thought leaders and professionals from industry and academia offering advice founded in a deep understanding of the mission needs and complexities of the IT environment in the intelligence community.

There are many ways to gain that knowledge.  For example, for many the way to learn will be to apply for positions in government and serve directly inside.  Another very close way will be to serve in the defense industrial establishment in a position that gives you exposure to government challenges.  I’ve seen others from the outside, like Tim O’Reilly and Craig Newmark, seek to learn by dedicating time meeting broad swaths of people from all echelons of government.  Others seek to learn by attending government conferences, industry days and related events.  I assume some can also learn a great deal by reading, especially if that reading includes thoughts from a government thought leaders.

Anyway, I thought the Lucius Lucius Aemilius Paulus Macedonicus quote was interesting and worth a read.

For more on these topics:

National Security:

Towards a Cyber Deterrent: Are we getting any closer?

The concept of Cyber Deterrence has been around for a while. In 2008 I pulled together several thoughts on Cyber Deterrence which had come out of years of dialog on the cyber threat.  I wanted to capture some key challenges since in my view many were making foolish assumptions regarding what our nation should do in the domain of cyber.  There is also a great deal of wise thought but this is not a topic we should treat lightly.  In my view the wrong policy of cyber deterrence could be escalatory and have the unintended consequence of being bad for national security.

A great deal has changed over the last year and a half and I think it is time to update the paper.   I’ll be sending it around to friends in the Cyber Conflict Studies Association and asking if they can point me to related research.  I’ll e-mail it to government and national security thought leaders and ask if they have comments/thoughts they can share.  I would also very much appreciate the views of technologists, since so much of this topic must be discussed with a good understanding of the technology foundations of Cyber.

So, I wanted to ask… If you have a few minutes would you please look over the May 2008 version of this paper and give me your thoughts?  It is here:

https://ctovision.com/national-security-and-technology/towards-a-cyber-deterrent/

References:

What If This Is The Most Important Thing The Government Can Do To Enhance Our Cybersecurity and Prepare us for Cyber War?(

What the New U.S. Intelligence Strategy Says About Cyber Threats

You think your business is primed to deal with any cyber threat – but what if it’s an inside job?

National Security and Technology

Discovering and proactively blocking malicious infrastructure

Cyber Security

DHS Opens the National Cybersecurity and Communications Integration Center (NCCIC)

If you are an enterprise CTO I’m hoping you already have the site of the US Computer Emergency Readiness Team (CERT) bookmarked.  It it has been a while since you have seen their site please check it out at http://www.us-cert.gov They provide important resources for any enterprise technologist, not just security professionals.

Organizationally they have a team of strong cyber players that have been honing their craft for years.  The US CERT serves a significant mission– they are there to strengthen the defense of the Federal government’s networks, especially those in the civil executive branch (the “.gov” of the Internet).  In executing that mission they help many others and are a critically important part of our nation’s defensive fabric.   The US CERT is run by the National Cyber Security Division (NCSD) of the Department of Homeland Security (DHS).

Today the US CERT opened its new operations center.  Their facility is called the National Cybersecurity and Communications Integration Center (NCCIC).  It is a “Unified Operations Center” designed to enable the co-location of other key components of the NCSD and DHS, including the National Coordinating Center for Telecommunications (NCC), the National Cyber Security Center (NCSC), and the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).  This new operations center also hosts liaison officers from many other related watch centers which will make it a key information clearing house and a critically important capability for the nation.

I was allowed into the combined watch floor today and was excited to see the tremendous visualizations analysts and watchstanders will be able to leverage as they seek enhanced situational awareness.   Even though all the organizations in this room have different “chains of command” they all share common needs for fast, accurate information and their ability to dialog over visualizations will enhance their ability to jointly figure out what is going on.

On a personal note:  I am very optimistic about this new unified operations center and its ability to make a positive impact– and– although I have seen and believe in the technology they are using, the real reason I’m so positive is the quality of leaders involved.  I’m upbeat because of the folks I know who are driving the right actions.   They include Phil Reitinger , a savvy professional and executive with understanding of the law and technology and mission, RADM Mike Brown, one of of our nation’s greatest military leaders and a key driver of our nation’s cyber posture for over a decade, and a past associate from DIA who had been responsible for ensuring the DoD’s JWICS network survived and thrived and continually enhanced support to the DoD mission.   These folks have many hard tasks ahead and their work is by no means complete but they are some of the best the nation has and deserve our collective support.

Related Reading

 

Cloud Computing vs. SOA: Look for a cross-over in hype

Cloud Computing is one of the many things enterprise CIOs, CTOs and other engineers will master in delivering capability.  I believe in the power of new Cloud Computing technologies and concepts and think we should all continue our focus there.

I have said, and still say, the same thing about design approaches like Service Oriented Architecture (SOA).  The constructs, methods and models of SOA are good practices that result in good designs for enterprises.   It is smart to separate data from application logic and smart to enable agility and mashups the way good SOA design does.

But a key problem with SOA was the hype associated with it.  Everyone started using the term the way they wanted to.  And every IT vendor came out with their definition of SOA.  And every system integrator tried to sell us buckets of their SOA.  And every trade journal ran SOA articles.  And too many CTOs, myself included, said too much to our customer/users about the promise of SOA and that contributed to our users increasing their expectations over what SOA would deliver.   The result of all of that, the over hype on SOA sometimes caused distractions.  The cure: CTOs focused on what SOA meant for their specific organizations.  It is still a great construct and by focus it is delivering value.

There are now clear indications that the hype around Cloud Computing is going to ramp way up.  In fact, a quick search on Google Trends indicates searches on the topic of Cloud Computing, while still lower than searches on the topic of SOA, are rapidly gaining while searches on SOA are declining.  The two are headed for a cross-over.

The graph below reflects this (a live version of this graph is at Google Trends).

Here are my views of the “So What” of this information.  For the Chief Technology Officer or Chief Information Officer or other enterprise technologist who must really deliver, I’d recommend you brace yourself for a flood of hype.  You have probably already seen indications of this.  But if trends continue the amount of views you (and your bosses) will be asked to consider and deal with will accelerate dramatically.  Your defense against this will be the strength of your own position in Cloud Computing.  Therefore, I strongly recommend you personally think through what Cloud Computing means to your enterprise.  Also, think through your definition of cloud computing.  Hopefully the NIST definition will suit your use, since the more people who form up on that the better.

And you may want to think through which Cloud Computing related events you will attend and speak at.

And you may want to think through you who personally believe the strongest IT players are in the Cloud Computing world.  I have my list.  Let me know if you want to compare notes sometime.

Any thoughts?

Related Reading

Technology and Leadership Lessons From Admiral Archie Clemins

SCADA and ME: A Book For Children and Management

CTOvision Named A Top 20 AI and ML Blog

Game Change: Three Reasons Why #SonyHack Will Change Security

CIA IT Leaders Are World Class IT Leaders

Cloud Computing vs. SOA: Look for a cross-over in hype

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]