Risk
4/16/2010
11:15 AM
Connect Directly
RSS
E-Mail
50%
50%

NSA Director Tells Senate He Won't Overstep In Role As U.S. Cyber Command Director

'This is not about efforts to militarize cyberspace,' says Lt. Gen. Keith Alexander during his confirmation hearing

The Obama administration's candidate to lead the U.S. effort against cyber warfare assured lawmakers Thursday he can successfully balance the strategic military, technological, and cooperative aspects of the job he hopes to take on.

In his confirmation hearing Thursday before the Senate Armed Services Committee, Lt. Gen. Keith Alexander fielded questions about how he would perform in a position created only last year to perform a task some lawmakers themselves admittedly don't quite understand.

The Cyber Command, part of the U.S. Strategic Command, went into action in September specifically to protect Department of Defense networks and take charge of cyber warfare activities. It's based in Ft. Meade, Md., where the National Security Agency -- which Alexander currently leads -- is also headquartered.

The new command has raised concerns from lawmakers because it will act in the same territory as the NSA and the Department of Homeland Security, which are working as civilian agencies to protect U.S. networks against cyber attacks.

Senators have expressed concerns about the militarization of cybersecurity efforts, and some admitted Thursday during the hearing that they don't fully understand the scope of cyber warfare in the context of a military action.

In his opening comments Thursday, Alexander assured lawmakers that he won't overstep the boundaries of his role if confirmed to lead the Cyber Command.

"This is not about efforts to militarize cyberspace," he said. "Rather it's about safeguarding the integrity of our military system. My goal if confirmed will be to significantly improve the way we defend ourselves in this domain."

However, he said that his role would not merely be a defensive one, and that Cyber Command should mount offensive cyber attacks in the event of a cyber war.

Alexander said he would work alongside the DHS, in particular, to define the scope of his role and to develop strategies. The DHS is the government agency in charge of cybersecurity on U.S. soil.

Indeed, one of the trickiest issues lawmakers have been grappling with is the relationship between Cyber Command and the DHS. The DHS has been working with private companies that own most of that critical infrastructure to forge relationships and share intelligence, and ultimately is responsible for protecting networks at home.

However, Cyber Command would play a key role if there was a major attack from a foreign entity on critical networks, and Alexander was asked by the committee how he would juggle responsibilities.

"Our responsibility is to provide technical support to the DHS to help them build the technology they need to defend [critical] networks," he said. "I think that partnership continues to grow."

The committee posed to Alexander a hypothetical situation that described an attack coming from outside the country but routed through computers in the U.S., which would put it in the domain of the DHS and raise privacy concerns for U.S. citizens.

Alexander said in that case it would be necessary to coordinate efforts very closely with the DHS and the President himself, who would have the ultimate authority in that situation to act.

But this is one area he said that is not clearly defined by policy, which he said is still lacking to help the Cyber Command protect the DoD in the event of a cyber war. "That's one of the things the administration is trying to address," Alexander said.

Indeed, cybersecurity and cyber warfare policy has not evolved nearly as quickly as the threat the Cyber Command, DHS, and NSA are attempting to ward off. The House of Representatives only recently passed a cybersecurity bill while the Senate is currently considering one, but neither have gone into effect yet.

Alexander said the DoD network is hit with hundreds of thousands of probes a day that are attempting to detect vulnerabilities in the network, which is one of the reasons the Cyber Command was created in the first place.

"We have been alarmed by the increase, especially this year," he said. "It's growing rapidly."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.