Risk
8/27/2010
02:42 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Military Official Outlines Pentagon's Cyber Strategy

As cyber threats to government mount, the Department of Defense is developing a comprehensive strategy to deal with them.




Slideshow: Next Generation Defense Technologies
(click for larger image and for full photo gallery)
Saying that cyber attacks have the potential to disrupt the American economy, gain "valuable" intelligence and "impede" the U.S. military, deputy secretary of defense William Lynn this week laid out the key elements of the military's approach to cyberspace.

In an essay in Foreign Affairs, Lynn detailed five principal elements of the military's strategy, including: building an organizational construct for cyber forces, employing layered protections that include "active defenses," supporting the security of critical infrastructure networks, building collective defenses with allies, and investing in research and development.

Several key attributes of the cyber domain that will inform exactly how this strategy is executed, Lynn wrote. For example, cyber conflicts are often asymmetric in nature, where a small number of determined bad actors carrying out an attack often has the upper hand against a potentially much larger victim.

Predicting and responding to attacks is also different. In the cyber world, Lynn wrote, attacks will be difficult to predict, and "traditional Cold War deterrence models" don't work -- for example, difficulty in attribution may make counter-attacks risky. Therefore, he added, deterrence in the cyber arena must be based more on strengthening defenses.

In addition, in the cyber world, threats will not be limited to military targets. While Lynn wrote that more than 100 foreign intelligence services are probing weaknesses in American military and intelligence networks, he also noted risks to critical infrastructure and intellectual property.

At a high level, that means that whatever strategy the U.S. military puts in place must be adaptive and flexible. Among the efforts that should help with that is ongoing work to overhaul IT acquisition processes at the DoD. In his article, Lynn outlined the latest thinking at DoD on acquisition, saying that the DoD was developing new policies to require shorter development cycles, incremental development and testing, further standardization, and improved oversight of IT.

The new acquisition rules also feed into the idea of rapid research and development, one of the main elements of the military's strategy. Lynn wrote that the DoD would be putting significant resources into new research, for example developing a model of the Internet called the National Cyber Range to let the military test cyberdefense capabilities in a sandboxed environment and doing more basic research at the Defense Advanced Research Projects Agency, the organization that's credited with inventing the Internet.

From an operational perspective, Lynn wrote that U.S. Cyber Command, the new military command devoted exclusively to the cyber arena, will be fully operational by October and will work with three missions in mind: leading day-to-day protection of defense networks, marshaling cyber resources from across the military, and working with military, civilian and even private sector partners.

Lynn also noted the importance of layered protection and "active defenses." He disclosed the existence of home-grown NSA systems that sound similar to intrusion prevention systems and can "automatically deploy defenses to counter intrusions in real-time."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Tell the sysadmin that we have a situation.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.