Risk
8/27/2010
02:42 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Military Official Outlines Pentagon's Cyber Strategy

As cyber threats to government mount, the Department of Defense is developing a comprehensive strategy to deal with them.




Slideshow: Next Generation Defense Technologies
(click for larger image and for full photo gallery)
Saying that cyber attacks have the potential to disrupt the American economy, gain "valuable" intelligence and "impede" the U.S. military, deputy secretary of defense William Lynn this week laid out the key elements of the military's approach to cyberspace.

In an essay in Foreign Affairs, Lynn detailed five principal elements of the military's strategy, including: building an organizational construct for cyber forces, employing layered protections that include "active defenses," supporting the security of critical infrastructure networks, building collective defenses with allies, and investing in research and development.

Several key attributes of the cyber domain that will inform exactly how this strategy is executed, Lynn wrote. For example, cyber conflicts are often asymmetric in nature, where a small number of determined bad actors carrying out an attack often has the upper hand against a potentially much larger victim.

Predicting and responding to attacks is also different. In the cyber world, Lynn wrote, attacks will be difficult to predict, and "traditional Cold War deterrence models" don't work -- for example, difficulty in attribution may make counter-attacks risky. Therefore, he added, deterrence in the cyber arena must be based more on strengthening defenses.

In addition, in the cyber world, threats will not be limited to military targets. While Lynn wrote that more than 100 foreign intelligence services are probing weaknesses in American military and intelligence networks, he also noted risks to critical infrastructure and intellectual property.

At a high level, that means that whatever strategy the U.S. military puts in place must be adaptive and flexible. Among the efforts that should help with that is ongoing work to overhaul IT acquisition processes at the DoD. In his article, Lynn outlined the latest thinking at DoD on acquisition, saying that the DoD was developing new policies to require shorter development cycles, incremental development and testing, further standardization, and improved oversight of IT.

The new acquisition rules also feed into the idea of rapid research and development, one of the main elements of the military's strategy. Lynn wrote that the DoD would be putting significant resources into new research, for example developing a model of the Internet called the National Cyber Range to let the military test cyberdefense capabilities in a sandboxed environment and doing more basic research at the Defense Advanced Research Projects Agency, the organization that's credited with inventing the Internet.

From an operational perspective, Lynn wrote that U.S. Cyber Command, the new military command devoted exclusively to the cyber arena, will be fully operational by October and will work with three missions in mind: leading day-to-day protection of defense networks, marshaling cyber resources from across the military, and working with military, civilian and even private sector partners.

Lynn also noted the importance of layered protection and "active defenses." He disclosed the existence of home-grown NSA systems that sound similar to intrusion prevention systems and can "automatically deploy defenses to counter intrusions in real-time."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7178
Published: 2014-11-28
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

CVE-2014-7850
Published: 2014-11-28
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

CVE-2014-8423
Published: 2014-11-28
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.

CVE-2014-8424
Published: 2014-11-28
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

CVE-2014-8425
Published: 2014-11-28
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?