Risk
8/27/2010
02:42 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Military Official Outlines Pentagon's Cyber Strategy

As cyber threats to government mount, the Department of Defense is developing a comprehensive strategy to deal with them.




Slideshow: Next Generation Defense Technologies
(click for larger image and for full photo gallery)
Saying that cyber attacks have the potential to disrupt the American economy, gain "valuable" intelligence and "impede" the U.S. military, deputy secretary of defense William Lynn this week laid out the key elements of the military's approach to cyberspace.

In an essay in Foreign Affairs, Lynn detailed five principal elements of the military's strategy, including: building an organizational construct for cyber forces, employing layered protections that include "active defenses," supporting the security of critical infrastructure networks, building collective defenses with allies, and investing in research and development.

Several key attributes of the cyber domain that will inform exactly how this strategy is executed, Lynn wrote. For example, cyber conflicts are often asymmetric in nature, where a small number of determined bad actors carrying out an attack often has the upper hand against a potentially much larger victim.

Predicting and responding to attacks is also different. In the cyber world, Lynn wrote, attacks will be difficult to predict, and "traditional Cold War deterrence models" don't work -- for example, difficulty in attribution may make counter-attacks risky. Therefore, he added, deterrence in the cyber arena must be based more on strengthening defenses.

In addition, in the cyber world, threats will not be limited to military targets. While Lynn wrote that more than 100 foreign intelligence services are probing weaknesses in American military and intelligence networks, he also noted risks to critical infrastructure and intellectual property.

At a high level, that means that whatever strategy the U.S. military puts in place must be adaptive and flexible. Among the efforts that should help with that is ongoing work to overhaul IT acquisition processes at the DoD. In his article, Lynn outlined the latest thinking at DoD on acquisition, saying that the DoD was developing new policies to require shorter development cycles, incremental development and testing, further standardization, and improved oversight of IT.

The new acquisition rules also feed into the idea of rapid research and development, one of the main elements of the military's strategy. Lynn wrote that the DoD would be putting significant resources into new research, for example developing a model of the Internet called the National Cyber Range to let the military test cyberdefense capabilities in a sandboxed environment and doing more basic research at the Defense Advanced Research Projects Agency, the organization that's credited with inventing the Internet.

From an operational perspective, Lynn wrote that U.S. Cyber Command, the new military command devoted exclusively to the cyber arena, will be fully operational by October and will work with three missions in mind: leading day-to-day protection of defense networks, marshaling cyber resources from across the military, and working with military, civilian and even private sector partners.

Lynn also noted the importance of layered protection and "active defenses." He disclosed the existence of home-grown NSA systems that sound similar to intrusion prevention systems and can "automatically deploy defenses to counter intrusions in real-time."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.