CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Search for "intelligence community"

Search Results for: intelligence community

Terrorism Research Center Reconstitutes as Non-Profit Organization

I took great pleasure in reading the release below regarding the reconstitution of the Terrorism Research Center. The founders of the Terrorism Research Center (Matthew Devost, Brian Houghton, and Neal Pollard) are all highly regarded national security professionals and thought leaders who bring years of proven past performance to helping the nation think through some very complex issues. I knew them well in 1996 when they established the first TRC and watched first hand as they provided the community with prescient analysis on issues associated with asymmetric warfare, counterintelligence, cyber security, mission assurance and counterterrorism research.

By bringing this activity back as a non-profit I believe the founders have established a new foundation for even greater contributions to the community.

For more see the release below from http://www.terrorism.org/2012/04/trc-2012/

Terrorism Research Center Reconstitutes as Non-Profit Organization

WASHINGTON DC, April 19, 2012 – The original co-founders of the Terrorism Research Center (TRC) are pleased to announce the organization has been re-established as a non-profit entity to continue the mission of raising public awareness on terrorism related issues and establish a knowledge-base of security related research and analysis. The new organization’s website and public knowledge base can be found online at www.terrorism.org.

First established on April 19, 1996, the year anniversary of the Oklahoma City terrorist bombing, the TRC operated for 15 years as a commercial entity providing research, analysis, and training on issues of terrorism and international security.

The three original co-founders, Matthew Devost, Brian Houghton, and Neal Pollard, will reconstitute a new board of directors, comprised of researchers, first responders and academic and professional experts.

“The TRC had an incredible legacy as a commercial company,” says Matthew Devost. “We believe there is still a strong need to continue the research and collaboration on such critical topics in the public’s best interest.”

From 1996 through 2010, the TRC contributed to international counterterrorism and homeland security initiatives such as Project Responder and the Responder Knowledge Base, Terrorism Early Warning Groups, Project Pediatric Preparedness, Global Fusion Center, and the “Mirror Image” training program. These long-standing programs leveraged an international network of specialists from government, industry, and academia. Reconstituting TRC as a non-profit will help establish the next generation of programs, research, and training to combat the emerging international security issues.

“Thousands of researchers utilized the TRC knowledge base on a daily basis, says Brian Houghton. “Our intent is to open the dialog, provide valuable counterterrorism resources, and advance the latest thinking in counterterrorism for the public good.”

“We want to put the 15-year legacy and goodwill of TRC to continuing benefit for the public, rather than focus on a specific business model,” says Neal Pollard. “TRC was founded in the wake of the 1995 Oklahoma City bombing and made its most significant contributions to the nation and the world after the attacks of September 11, 2001. Now that the War on Terrorism has evolved and the United States is entering a new era of transnational threats, the TRC will maintain its familiar role as the vanguard of next-generation research into these emerging threats.”

ABOUT THE TRC

The Terrorism Research Center (TRC) is non-profit think tank focused on investigating and researching global terrorism issues through multi-disciplinary collaboration amongst a group of international experts. Originally founded as a commercial entity in 1996, the TRC was an independent institute dedicated to the research of terrorism, information warfare and security, critical infrastructure protection, homeland security, and other issues of low-intensity political violence and gray-area phenomena. Over the course of 15 years, the TRC conducted research, analysis, and training on a wide range of counterterrorism and homeland security issues.

More Reading:

For more on these topics see the CTOvision Guide to National Security Technology and

Terror and Counterterrorims Related Topics:

Breaking News: Microsoft Partners With World Class Best Cyber Firm Kyrus Tech Inc and Helps Defeat Some Very Bad Criminals

We have previously written about Kyrus Tech Inc and have highlighted their unique capability called Carbon Black. We have worked with the team of experts there in the past and I am very proud to have been professionally associated with Michael Tanji since we were both in government in the mid 1990’s. We have also been privileged to have worked with and learned from cyber teams at Microsoft for years and know many great professionals there.  In part because of that it was especially great to read the press release below that shows how Microsoft and Kyrus Tech have combined their strengths to help reduce a particularly nasty vector of cyber crime. Their collaborative work has helped disrupt the massive Zeus cybercrime operation.

For details on the role of Kyrus see: http://www.kyrus-tech.com/blog/

We also recommend a review of the press release below from: http://www.microsoft.com/Presspass/press/2012/mar12/03-25CybercrimePR.mspx

Microsoft Joins Financial Services Industry to Disrupt Massive Zeus Cybercrime Operation That Fuels Worldwide Fraud and Identity Theft

Microsoft collaborates with financial services industry in unprecedented cross-industry action against notorious cybercrime operation behind online fraud and identity theft.

REDMOND, Wash. — March 25, 2012 — In its most complex effort to disrupt botnets to date, Microsoft Corp., in collaboration with the financial services industry — including the Financial Services – Information Sharing and Analysis Center (FS-ISAC) and NACHA – The Electronic Payments Association — as well as Kyrus Tech Inc., announced it has successfully executed a coordinated global action against some of the most notorious cybercrime operations that fuel online fraud and identity theft. With this legal and technical action, a number of the most harmful botnets using the Zeus family of malware worldwide have been disrupted in an unprecedented, proactive cross-industry action against this cybercriminal organization.

Through an extensive and collaborative investigation into the Zeus threat, Microsoft and its banking, finance and technical partners discovered that once a computer is infected with Zeus, the malware can monitor a victim’s online activity and automatically start keylogging, or recording a person’s every keystroke, when a person types in the name of a financial institution or ecommerce site. With this information, cybercriminals can steal personal information that can be used for identity theft or to fraudulently make purchases or access other private accounts. In fact, since 2007, Microsoft has detected more than 13 million suspected infections of the Zeus malware worldwide, including approximately 3 million computers in the United States alone.

“With this action, we’ve disrupted a critical source of money-making for digital fraudsters and cyberthieves, while gaining important information to help identify those responsible and better protect victims,” said Richard Boscovich, senior attorney for the Microsoft Digital Crimes Unit. “The Microsoft Digital Crimes Unit has long been working to combat cybercrime operations, and today is a particularly important strike against cybercrime that we expect will be felt across the criminal underground for a long time to come.”

This disruption was made possible through a successful pleading before the U.S. District Court for the Eastern District of New York, which allowed Microsoft and its partners to conduct a coordinated seizure of command and control servers running some of the worst known Zeus botnets. Because the botnet operators used Zeus to steal victims’ online banking credentials and transfer stolen funds, FS-ISAC and NACHA joined Microsoft as plaintiffs in the civil suit, and Kyrus Tech Inc. served as a declarant in the case. Other organizations, including F-Secure, also provided supporting information for the case.

As a part of the operation, on March 23, Microsoft and its co-plaintiffs, escorted by the U.S. Marshals, seized command and control servers in two hosting locations, Scranton, Pa., and Lombard, Ill., to seize and preserve valuable data and virtual evidence from the botnets for the case. Microsoft and its partners took down two Internet Protocol addresses behind the Zeus command and control structure, and Microsoft is currently monitoring 800 domains secured in the operation, which are helping identify thousands of computers infected by Zeus.

This is the second time Microsoft has conducted physical seizures in a botnet operation, and it is the first time other organizations have joined Microsoft as plaintiffs in the legal case for a botnet operation. This is also the first operation for Microsoft that involved the simultaneous disruption of multiple operating botnets in a single action and is the first known time the Racketeer Influenced and Corrupt Organizations (RICO) Act has been applied as the legal basis in a consolidated civil case to charge all those responsible in the use of a botnet.

“As crimes against banks and their customers move from stickups to mouse clicks, we’re also using our own mouse clicks — as well as the law — to help protect consumers and businesses,” said Greg Garcia, a spokesperson for the three major financial industry associations that worked with Microsoft on this initiative. “Disrupting the Zeus botnets is just one strike in our long-term commitment to help defend and protect people.”

Because of the complexities of these targets, unlike Microsoft’s previous botnet operations, the goal of this action was not to permanently shut down all impacted Zeus botnets. However, this action is expected to significantly impact the cybercriminals’ operations and infrastructure, advance global efforts to help victims regain control of their infected computers, and also help further investigations against those responsible for the threat. As with its previous botnet operations, Microsoft will now use the intelligence gained from this operation to partner with Internet service providers and Community Emergency Response Teams around the world to help rescue people’s computers from the control of Zeus, helping to reduce the size of the threat that these botnets pose and to help make the Internet safer for consumers and businesses worldwide. Together, these aspects of the operation are expected to undermine the criminal infrastructure that relies on these botnets every day to make money and to help provide new tools for the industry to work together to proactively fight cybercrime.

Michael Tanji, chief security officer of Kyrus Tech Inc., who helped analyze the Zeus malware and determine which botnets were the most dangerous said, “We are proud to have played a part in this groundbreaking effort and hope that others will start working together to combat malicious activity at the same scale as it is being perpetrated.”

There are steps consumers and businesses can take to better help protect themselves from becoming victims of malware, fraud and identity theft. All computer users should exercise safe practices, such as running up-to-date and legitimate computer software, firewall protection, and antivirus or antimalware protection. People should also exercise caution when surfing the Web and clicking on ads or email attachments that may prove to be malicious. For computer owners worried their computers might be infected, Microsoft offers free information and malware cleaning tools athttp://support.microsoft.com/botnets that can help people remove Zeus and other malware from their computers. For businesses looking for more information about corporate account takeover issues, including those due to malicious software, a fraud advisory from FS-ISAC, the FBI and the U.S. Secret Service can be found at http://www.fsisac.com/files/public/db/p265.pdf.

More information about today’s news and the coordinated action against Zeus is available athttp://www.microsoft.com/presspass/presskits/dcu. Legal documentation in the case can be found athttp://www.zeuslegalnotice.com.

About FS-ISAC

The Financial Services Information Sharing and Analysis Center was formed in 1999 and is a non-profit, private financial sector initiative. It was designed and developed and is owned by financial institutions. Its primary function is to share timely, relevant and actionable information of physical and cyber security threat and incident information to help mitigate the risk associated with these threats. [http://www.fsisac.com/]

About NACHA – The Electronic Payments Association

NACHA manages the development, administration, and governance of the ACH Network, the backbone for the electronic movement of money and data. The ACH Network provides a safe, secure, and reliable network for direct account-to-account consumer, business, and government payments. Annually, it facilitates billions of Direct Deposit via ACH and Direct Payment via ACH transactions. Used by all types of financial institutions, the ACH Network is governed by the fair and equitable NACHA Operating Rules, which guide risk management and create payment certainty for all participants. As a not-for-profit association, NACHA represents more than 10,000 financial institutions via 17 regional payments associations and direct membership. Through its industry councils and forums, NACHA brings together payments system stakeholders to foster dialogue and innovation to strengthen the ACH Network. To learn more, please visit www.nacha.org.

AboutKyrus Tech, Inc.

Kyrus is a security innovation company. We have deep expertise in vulnerability research, reverse engineering, computer forensics and custom software development. We apply those skills to conduct research and develop solutions for the business, critical infrastructure and national security communities. We strive to disrupt the status quo. We believe that approaching security problems from diverse perspectives and without preconceptions is the only way for security to become both a valued and a cost-effective capability.

About Microsoft

Founded in 1975, Microsoft (Nasdaq “MSFT”) is the worldwide leader in software, services and solutions that help people and businesses realize their full potential.

Note to editors: For more information, news and perspectives from Microsoft, please visit the Microsoft News Center at http://www.microsoft.com/news. Web links, telephone numbers and titles were correct at time of publication, but may have changed. For additional assistance, journalists and analysts may contact Microsoft’s Rapid Response Team or other appropriate contacts listed athttp://www.microsoft.com/news/contactpr.mspx.

 

Mission Link: A collective of mission-focused providers of virtuous solutions

Mission Link is a Washington DC based collective of business executives and former national security leaders who come together to collaborate and innovate on better ways to serve important national missions.

A 2019 Update: Missionlink has transformed since the post below. If you are interested in networking with the group read below and contact us at OODA and we will get you an update.

From the MissionLinkDC site:

Connecting Decision Makers & Building a Community of Interest for National Security Focused Companies

Founded by a local group of prominent business executives and former national security leaders, MissionLink is an executive level forum designed to foster collaboration and innovation among CEOs, decision makers, critical thinkers and pacesetters from the most promising companies dedicated to the mission of defense, intelligence and national security.

MissionLink provides an opportunity for peer to peer networking, mentorship, and knowledge sharing in an intimate and private setting. Each month member CEOs engage with a panel of experts to discuss current issues facing their companies, exchange ideas, and meet other successful leaders in the field who can help guide them through the process of building great companies. Upon completion of each year’s class, the participants are invited to a formal graduation ceremony, in which participants of MissionLink will explore ways to give back to community and those that support the mission of national security.

For more information see: http://missionlinkdc.org

Quicklook Report: The FedCyber.com Government-Industry Cybersecurity Summit of 28 Sep 2011

The FedCyber.com Government-Industry Cybersecurity Summit was a meeting of cybersecurity practitioners looking for new approaches, new ideas, and new strategies for enhancing cybersecurity in and around government.  The 28 September 2011 gathering at the Newseum saw over 200 people interacting together and with a set of world-class thought leaders  from in and out of government.

Summaries of the event are being prepared and will eventually be posted at http://fedcyber.com  More detailed reports are also being prepared for attendees so we can continue to interact on conclusions. We will also be using the results of the conference to fuel our reporting here at CTOvision.com  So please stay tuned for more.

We are also reducing results of our post-event surveys and will be providing summaries of conclusions of those surveys to attendees and speakers.

Many highly regarded cyber practitioners spoke and/or attended. Speakers included the Honorable James Miller, Deputy Undersecretary of Defense for Policy and Ms. Dawn Meyerriecks, Assistant Director of National Intelligence for Acquisition, Technology & Facilities, Sean Finnegan and John Asante from Microsoft, and Nitin Pradhan, CIO of Department of Transportation.  Other speakers included:

  • Bob Bigman (CIA CISO)
  • Sherri Ramsay (NSA/NTOC)
  • Steven Chabinsky (FBI)
  • Richard Marshall (DHS)
  • Bobby Stempfley (DHS)
  • Michele Iversen (Department of Education)
  • John Topp (Splunk)
  • Bob Gourley
  • Matt Devost
  • Rich Pethia (CMU CERT)
  • Wayne Wheeles (Novii Design)
  • Bob Butler (former OSD Cyber lead)
  • Bill Crowell (Former Deputy Director of NSA)
  • Marc Sachs (Cyber practitioner, former Director for Communication Infrastructure Protection in the White House Office of Cyberspace Security)
  • Rick Forno (Cyber practitioner and professor)
  • Dawn Meyerriecks, ODNI
  • Scott Culp, Microsoft
  • Nitin Pradhan, DoT
  • Bob Flores, Applicology
  • The Honorable Dr. James Miller, DUSDP
  • Tom Parker, FusionX
This event was made possible because of the sponsorship of some great community-minded firms, including: Microsoft, Utica College, FulcrumIT, Mu Dynamics, Invincea, and Splunk.  Thanks to all for the sponsorship!

More on all the above later!

Enhancing IT Support to the Counter Terror Effort: The Challenge

Several specific and new requirements have been given to the national security community as part of the White House review of security and intelligence systems following the attempted terrorist attack on Christmas day. Collection, processing, organization, and dissemination of information is a priority in the new requirements.

This post provides an articulation of some of the technology dimensions of the challenge our nation’s counter terror IT systems must surmount.  It will be followed by a post on ways to transform the challenge into design criteria.

The accompanying post is available at: Enhancing IT Support to the Counter Terror Effort: Design Criteria

The Situation:

The White House review of the Christmas Terror attack concluded that “Our ability to protect the U.S. Homeland against terrorist attacks is only as good as the information and analysis that drives and facilitates disruption efforts.”1 The summary also underscored that the amount of information being analyzed is growing dramatically, and challenges exist in bringing the many disparate pieces of information about individuals, groups and vague plots together to form a clear picture about our adversaries.

The White House summary report also gives a finding that intelligence analysis failed because the counter-terror community did not identify, correlate and fuse into a coherent story all of the discrete pieces of intelligence held by the US Government.  Additionally, shortcomings were seen in the watchlisting system where the counter-terror community failed to identify intelligence in US government holdings that would have potentially prevented an aircraft boarding.

Another key component of the current situation is that technology impediments to information sharing have, for the most part, been addressed.  There are certainly still technology challenges in information sharing, but there has been tremendous progress.

Other key observations:

  • During the weeks prior to this particular event, information was available to analysts, but it was “fragmentary and embedded in a large volume of other data.”
  • The report also indicated that confusing delays and mistakes were made in part because of name misspellings.
  • The report finds that NCTC and CIA personnel responsible for watchlisting did not search all available databases to uncover additional derogatory information that could have been correlated to reach a better awareness of the situation.
  • Information Technology in the counter-terror community was highlighted as a challenge: “Information technology within the counter-terror community did not sufficiently enable the correlation of data that would have enabled analysts to highlight the relevant threat information.”  There is an important nuance to understand here.  The big challenges in IT in the community are not those surrounding information sharing, they are the ones surrounding correlation and information extraction. Information sharing is critical but not sufficient.  The reason to share is the important thing. The community must share in for a variety of reasons including data correlation, better awareness, better analysis or to drive actions (including more focused collections).  This reason for sharing is more important than simply moving data.

The President’s Directive:

On 7 January 2010 the President signed a directive on corrective actions flowing from this review.2 The directive mentions several technology related actions, including:

  • The Department of State is to determine how technology enhancements can strengthen visa-related business processes.
  • The Department of Homeland Security is to aggressively pursue enhanced screening technology.  This does not appear to be limited to just physical screening.  The use of information on passengers during the screening process and IT to support that is a clear option.
  • The Director of National Intelligence is to accelerate information technology enhancements, to include knowledge discovery, database integration, cross-database searches, and the ability to correlate biographic information with terrorism-related intelligence.

The Challenge:

As noted throughout the White House review, the most significant, most crucial element in our nation’s counter terrorism system is the human element. Humans are our only chance at success here.  But we have to address the fact that humans were called out in the review as having failed to search every database.  This sounds intuitively true and is a statement that can likely be made about every event past present and future.  Systems that must rely on people asking every possible question of every possible database cannot scale and will not operate on a time scale required by the counter-terror enterprise. Those systems are asking people to do things they are not good at.

Things humans are good at include assessing relevance and full context of information. Only people can conceptualize the realm of possible threats.  Only humans can imagine and as noted in the 9/11 Commission Report, failures of imagination have been at the core of our failure to anticipate.3 Only humans can act on data.  And only humans can design IT architectures to ensure success.

Computers are far better than people in searching, correlating, moving, storing and disseminating information.  When properly designed, developed and configured, IT serves humans by helping them discover, interact with and create new information.  Computers are also critically important to the widespread and rapid dissemination of newly created content.

When computers are used for things they are not good at and when humans are used for things they are not good at, the entire system becomes sub-optimized.  IT can become part of the problem vice a solution. By providing too much data in the wrong context and by forcing humans to deal with algorithms and applications not scalable to or relevant to the data the entire enterprise human-computer system is weakened.  A key component to solving the challenge, therefore, is to design systems where humans do what humans do best and computers do what computers do best.

Another significant challenge associated with counter terrorism is the requirement to avoid enterprise amnesia.4 This construct examined by data system architect/entrepreneur Jeff Jonas refers to the too common situation in enterprises where one part of the organization does not know what the other part knows or forgets that it ever knew.  To avoid this, systems must be designed in ways that identify when data entering the enterprise relates to something already known. A closely related construct is the temporal version of enterprise amnesia, the situation in an enterprise where it is forgotten that someone asked a question. Systems that are designed with the assumption that the data will show up before the query are flawed, and that seems to be the design of most modern data systems.5 Systems for the counter terror community must include means to ask a question and then if any data ever enters the system that answers that question an alert must be generated.

These many challenges have been articulated for the record by officials in the executive branch and by legislators, including wide-spread recognition on the challenges of information overload and the inability of standard “google-like” search to keep up during the United States Senate Committee on Homeland Security and Government Affairs on 20 January.6 Many simple tools for search exist in the current system and they are not sufficient for mission success.  Something more is required.

The next post will build on the articulation above and propose a novel way to clarify design requirements for enterprise IT support to the counter terror effort.

More Reading:

For more on these topics see the CTOvision Guide to National Security Technology and

Terror and Counterterrorims Related Topics:

Twelve Principles of DoD Cyber Conflict

While rummaging through old files on my hard drive I encountered a piece I wrote in June 2002 which captured in writing something I had been briefing for several years.  I had been briefing “Principles” which I had observed/learned while the J2 of DoD’s JTF-CND and then later J2 of JTF-CNO.   My theory was that just as Admiral Bill Studeman has helped intelligence professionals understand their craft better by articulating principles, I could help build understanding of the new field of cyber conflict by generating dialog on principles.

I can’t take credit for any of these principles.  I really just wrote them down.  Many are things I observed or heard from others in the JTF at that time, like Marc Sachs, John Owens, Jay Healey and Michele Iverson.  There are also many common themes I learned from Rick Forno, Dan Kuehl and Matt Devost and others.

Now about a decade after I started briefing these principles I just reviewed them and think they still meet key requirements you would expect true principles to hold.  They still ring true and they still have insights relevant to operational decision-making, and, although they are definitely general in nature, I believe they still have a role in helping orient people to the missions of computer network defense (CND), computer network exploitation (CNE) and computer network attack (CNA).

Please give these a glance, and if you know a cyber warrior somewhere who you think would appreciate them please route them on.

One of these days I’ll re-write this to update the acronyms and get rid of the reference to the ancient US Space Command. So please let me know if you think I’ve missed something that should be captured as a principle, or if you think I have put any of these in the wrong context.

Twelve Principles of Computer Network Operations
June 2002
Bob Gourley

A growing number of uniformed military and government civilians practice the new military discipline of Computer Network Operations (CNO). CNO in the Department of Defense (DoD) consists of two specific yet complementary mission areas: Computer Network Defense (CND) and Computer Network Attack (CNA).

The CND mission is to protect and defend DoD computer networks, systems and the data that resides in them any unauthorized event whether it be a probe, scan, virus incident, or intrusion.1 The CNA mission is to coordinate, support and conduct, at the direction of the National Command Authority (NCA), computer network attack operations in support of regional and national objectives. CNA operations are designed to disrupt, deny, degrade or destroy adversary information resident in computers and computer networks.2

Operational lead for the DoD’s CNO efforts is USSPACECOM’s Joint Task Force for Computer Network Operations (JTF-CNO). But increasingly, traditional military forces are being called upon to conduct CNO operations by enhancing the defensive posture of networks under their control, by taking action against attacks, or by participating in attack planning or operations.

In most other warfare areas, Commanders can rely on established military doctrine to guide them in implementing and executing their missions. 3 The CNO mission is new, however, and little formal joint doctrine exists in this mission area.

This article provides firsthand observations on twelve key principles of CNO. I believe these observations can provide other CNO practitioners with a critical foundation required for successful CNO. These principles will also be of use to officers who whish to engage in the ongoing national security and policy discussions concerning CNO. After further examination and feedback from the field and the fleet, we expect them to become cornerstones of a new joint doctrine for CNO. Until then, I offer, Twelve Principles of CNO. They are:

#1 The Chain

#2 The Perimeter

#3 Interconnection

#4 The Laundry

#5 Prior Planning Prevents Poor Performance

#6 Know the Enemy

#7 Experience Counts

#8 Users Need Help

#9 Relativity

#10 One Basket?

#11 Unintended Consequences

#12 The Beauty of Attack

A bit more on all of the above is provided below:

#1 The Principle of the Chain. CNO is a chain; it’s only as strong as the weakest link. Like most of the rest of the principles outlined here, this sounds intuitive. But it is very important to stress this concept in the CNO world. Inattention to detail will ruin your CNO plans, whether for defense or offense. Two short illustrations:

– You fortify and protect an enclave by putting firewalls and IDS’s on gateways and hardening workstation software. But there are so many configuration choices for your IDS and firewall, and so many other settings you must make to ensure your enclave is secure. Did you overlook anything? Are your users trained? Do you have a response policy in place? Are you running the most up to date anti-virus software on your mail server? Should it be on individual workstations? These and many other questions must be considered by security professionals or any one could be the link that breaks the security chain.

– The chain for attack will also have weak links. This is easy for military professionals from any discipline to understand. All combat actions in any warfare area have potential weak links that can frustrate your attack or even lead to exploitation of your own forces. In the CNO realm the weak link may be the ability of an adversary to repair a patch in an application or the ability of an adversary to re-boot a router.

How do you protect against the weakest link? Attention to detail.

#2 The Principle of the Perimeter. Defenders must protect against every vulnerability. Attackers must only find one security flaw. A rough analogy is the requirement to continuously defend an Aircraft Carrier Battle Group in a high threat environment where attacks might come from below the sea or from the air or even from land. This principle calls for constant vigilance along every potential avenue of approach. CNO defenses must be robust and mobile.

#3 The Interconnection Principle. CNO is a multi-faceted discipline that includes military, civil, foreign, domestic, offense, defense, technology and human factor issues. It is an observable fact that we are all interconnected in this business. Decisions made in one area frequently have impacts in the other areas. That makes coordination between stakeholders and leaders in those areas an important goal that will result in better community-wide solutions. However, if taken to the extreme, this coordination can be a recipe for paralysis. Sometimes unilateral decisions must be made.

#4 The Principle of the Laundry. CNO is a continual process (like laundry, something always needs cleaning). Vulnerabilities in old software are discovered daily and new software is continually being produced and integrated into our architectures. All indications are that new software is just as buggy and has just as many vulnerabilities as old software, so we can expect the continued stream of vulnerability announcements to continue. Vulnerabilities that must be cleaned up and repaired as they are discovered. This is a never ending process.

#5 The Principle of Prior Planning. CNO must be pre-planned; you don’t just do it at the last minute and expect it to be done well. Too frequently the developers of systems and networks pay too little attention to security when they design their systems. We have found out the hard way that tacking it on the end just doesn’t work. This adage applies to users as well. If an organization does not think through the policies its users must adhere to, and does not train its users to be secure till it is too late, then the result will be poor security. The same thoughts hold true in the offensive sides to CNO. CNA requires extensive planning and coordination in advance.

#6 Know the Enemy. You must know your enemy better than your enemy knows you. This is easy to say but in practice very hard to accomplish, especially in the interconnected world of the Internet, where adversaries can take steps to hide their identify. But steps can be taken that let you make reasonable assumptions about your adversary before you know exactly who it is. These assumptions, combined with a continual study of threat actors will lead to a better ability to prevent, detect, react and defeat adversary activity.

You can and should also take steps to hide key information from your adversaries. All DoD unclassified networks should be under the umbrella of the NIPRNET, which affords some obscurity and protection from enumeration by an adversary. Enclaves should be configured to deny as much information as possible to potential adversaries. There is no reason why we should make the attacker’s job easier.

#7 The Principle of Professional Experience. Inexperienced CNO professionals are not CNO professionals. It is so easy in this business to find pseudo experts who can give a great brief or can market a CNO concept but have no first hand knowledge of how networks work or how to defend them. How do you tell a pseudo expert from a real expert? Be skeptical of anyone in this field till they have proven themselves to you. Ask for credentials, certifications, degrees or what their on the job experience is. Don’t be afraid to quiz them. No matter how polished they look, you want experience in this business.

– An important corollary for Commanders is that like in every other warfighting area, your people are paramount. Commanders must take responsibility to ensure that their CNO operators are trained and ready for the tasks that will face them.

#8 The Principle of User Faith. Users have no good way of comparing the security or vulnerability of systems. How can an individual user really tell that a system is secure? Is PKI secure? Is DMS secure? Who and what should a user trust? The current answer in DoD is that users must trust the systems managers in their organization, and those leaders must in turn trust accrediting authorities and program managers. We hope the corollary to this adage becomes “Trust, but verify.”

#9 The Principle of CNO Relativity. CNO is relative; no system will ever be 100% secure. This truism was realized long ago by the greats of the information security business, and has been witnessed again and again in DoD’s efforts.

– This truism is especially important in DoD, where we face some very sophisticated adversaries. Since no system can ever be 100% secure, if you want to be 100% certain that your information is protected, do not store it in any computer system anywhere. Of course this is unrealistic. But the point is that owners of information should weigh the risks vs. rewards of storing information in a computer system, and should take appropriate steps to protect computers and networks storing sensitive information.

#10 The Principle of the Single Basket. Never rely on technology (or anything else) as your only line of defense. This principle should seem intuitive to any operational military professional. No defender in combat would try to mount a defense with only one type of weapon, tool or technique. This is just as important in the CNO world, where true hackers will never give up, and where more sophisticated adversaries will try attacking through paths we may not have even considered yet.

#11 The Principle of Unintended Consequences. This applies to all aspects of the art of CNO, both offense and defense. Keep in mind that no matter how much you think these things through, there will age some risks of unintended consequences.

#12 The Principle of the Beauty of Attack. Sometimes you must take the fight to the enemy. To the military this frequently means the ability to use force on a battlefield to compel an enemy to do our will. But this principle is meant to bring to mind far more than that. In some cases, the US Government will have an ability to carry the fight to an adversary by attacking their computers. Individuals and individual units cannot do this, of course. This is a response reserved for decision-makers at the highest levels of government. But there are means for individuals and individual units to take action against attackers. Action can be taken by collecting detailed logs of the attacks and contacting law enforcement officials at the earliest possible moment.

The principles presented here are meant to explain the workings of a well-functioning computer network operations effort. They will be of use to any military professional struggling with the best ways to implement successful CNO in their organizations.

Are there other principles of CNO? Almost certainly. The disciplines of Computer Network Defense and Computer Network Attack are still new ones, and as they spread throughout the combat forces of DoD more principles, best practices and even doctrine will arise to help guide us as we prepare for combat. Consider the list above a start. It contains basic generalizations that I hold as true, that I propose to you as a starting point as you reason through your role in this mission.

1 Joint Publication 1-02, “DOD Dictionary of Military and Associated Terms.” Available online at: http://www.dtic.mil/doctrine/jel/doddict/

2 Joint Publication 1-02, “DOD Dictionary of Military and Associated Terms.” Available online at: http://www.dtic.mil/doctrine/jel/doddict/

3 Doctrine is the “Fundamental principles by which the military forces or elements thereof guide their actions in support of national objectives. It is authoritative but requires judgment in application.” Joint Publication 1-02, “DOD Dictionary of Military and Associated Terms.” Available online at: http://www.dtic.mil/doctrine/jel/doddict/

Track the latest on cyber war and conflict at the CTOvision Cyberwar Site. 

And for more on these topics see:

National Security:

Top Cybersecurity Context:

 

For more on these topics see the CTOvision Guide to National Security Technology and

Intel’s Next Generation Chip Architecture

On 21 April 2009 Intel corporation held an “Intelligent Processors” event which highlighted Intel’s next generation chip architecture and the industry leading companies who are incorporating this technology into their products.   The event, pulled together by Nigel Ballard of Intel, included demos by companies like Endeca, Cisco, Cray, Dell, HP, Oracle, VMware, Microsoft and Sun.  Nineteen hardware partners showed off Xeon 5500-based server products at this event.  Clearly Nigel is a man with convening authority.  When he calls, the big guns of the IT community come.

There were two other big draws at this event.  One was the Intel CTO, Justin Rattner.  I’ll be running a separate article on my interview of Justin shortly.  For now I’ll just say it was great having the new Nehalem Microarchitecture placed in context by a CTO of his stature.  He provided a keynote that underscored not only the technology of this smart server processor, but hit on the importance of innovating in a downturn.  His message was very clear and it is one I believe.  Now is the time to transform computing.

Eric Doyle, Intel’s enterprise Marketing Manager, provided a deeper dive into the power of real offerings based on the new chip, especially the Intel Xeon 5500 (I meant to ask Eric if he can shed some light on why the codename for this project was called Nahelem, since he said he lives in Oregon I wonder if he named it?).

The following are a few notes that combine things Justin Rattner and Eric Doyle said:

The Xeon 5500 based on the Nehalem project is  really the next era for computer chips, providing the biggest jump in productivity and efficiency since the Pentium Pro.    The Nehalem is hitting the market right now (you can get one for your house if you buy a MacPro).  The server based on the Nehalem is Xeon 5500.

The design of Nahalem is based on quad core design with two executable threads per core.  The design also provides an added degree of intelligence to how things are done on the chip.  Little processors on the chip oversee and manage the big processors in the chip and that concept allows for some very significant improvements to computing.  For example, energy efficiency is far more adaptable/configurable.  When you don’t need full processing power, less power is drawn.  New virtualization capabilities are also enabled with this approach.

The result is that the Xeon 5500 provides the largest jump in computer performance in Intel’s history.  In fact, this jump is the greatest performance leap in computer history.  This jump is not just because of more transistors on the chip, it is because of a very smart design involving more cores.

This chip also provides features that will enhance trustworthy computing.  I found this especially interesting and the whole discussion left me feeling far more upbeat about the future of IT.   I have no doubt security will still be a constant battle well into the future, but with this new design the ability to run cryptographic algorithms is sped up significantly.  This design enables a 40% improvement in OpenSSL performance and a 50% improvement in RSA2048, for example.  New capabilities will soon be enabled that leverage the chip’s management capabilities to attest to true endpoint state.  This will enable enhanced defenses against rootkits.

A few other bullets on Nehalem, from the Intel website:
Intel® microarchitecture, codenamed Nehalem, offers the latest in processor innovation, including:

  • Dynamic scalability, managed cores, threads, cache, interfaces, and power for energy-efficient performance on-demand.
  • Design and performance scalability for servers, workstations, notebooks, and desktops with support for 2-8+ cores and up to 16+ threads with Intel® Hyper-Threading Technology (Intel® HT Technology), and scalable cache sizes, system interconnects, and integrated memory controllers.
  • Intelligent performance on-demand with Intel® Turbo Boost Technology taking advantage of the processor’s power and thermal headroom. This enables increased performance of both multi-threaded and single-threaded workloads.
  • Increased performance on highly-threaded applications with Intel HT Technology, bringing high-performance applications into mainstream computing with 1-16+ threads optimized for new generation multi-core processor architecture.
  • Scalable shared memory features memory distributed to each processor with integrated memory controllers and Intel QuickPath Technology high-speed point-to-point interconnects to unleash the performance of future versions of next-generation Intel® multi-core processors.
  • Multi-level shared cache improves performance and efficiency by reducing latency to frequently used data.

What is the “so what” of all the above?  Upgrade your old servers now.  It will save energy, it will save space, it will reduce operating cost, it will increase security, and it will enable more advanced applications.

As for the many demos seen at this event, my favorite was the one presented by my friends at Endeca.  Endeca is one of the first companies fielding capabilities that can take maximum advantage of Nehalem.   The speed, scale and scope of the data they can parse and enable interaction with is incredible.  If you are considering an Endeca deployment, consider Xeon 5500.  Ask Endeca for the demo and you will see why.  It just makes total sense.

Soon I’ll post a few more thoughts based on my interview of Justin Rattner.  Say tuned and happy computing!

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]