Risk
4/16/2010
11:15 AM
Connect Directly
RSS
E-Mail
50%
50%

NSA Director Tells Senate He Won't Overstep In Role As U.S. Cyber Command Director

'This is not about efforts to militarize cyberspace,' says Lt. Gen. Keith Alexander during his confirmation hearing

The Obama administration's candidate to lead the U.S. effort against cyber warfare assured lawmakers Thursday he can successfully balance the strategic military, technological, and cooperative aspects of the job he hopes to take on.

In his confirmation hearing Thursday before the Senate Armed Services Committee, Lt. Gen. Keith Alexander fielded questions about how he would perform in a position created only last year to perform a task some lawmakers themselves admittedly don't quite understand.

The Cyber Command, part of the U.S. Strategic Command, went into action in September specifically to protect Department of Defense networks and take charge of cyber warfare activities. It's based in Ft. Meade, Md., where the National Security Agency -- which Alexander currently leads -- is also headquartered.

The new command has raised concerns from lawmakers because it will act in the same territory as the NSA and the Department of Homeland Security, which are working as civilian agencies to protect U.S. networks against cyber attacks.

Senators have expressed concerns about the militarization of cybersecurity efforts, and some admitted Thursday during the hearing that they don't fully understand the scope of cyber warfare in the context of a military action.

In his opening comments Thursday, Alexander assured lawmakers that he won't overstep the boundaries of his role if confirmed to lead the Cyber Command.

"This is not about efforts to militarize cyberspace," he said. "Rather it's about safeguarding the integrity of our military system. My goal if confirmed will be to significantly improve the way we defend ourselves in this domain."

However, he said that his role would not merely be a defensive one, and that Cyber Command should mount offensive cyber attacks in the event of a cyber war.

Alexander said he would work alongside the DHS, in particular, to define the scope of his role and to develop strategies. The DHS is the government agency in charge of cybersecurity on U.S. soil.

Indeed, one of the trickiest issues lawmakers have been grappling with is the relationship between Cyber Command and the DHS. The DHS has been working with private companies that own most of that critical infrastructure to forge relationships and share intelligence, and ultimately is responsible for protecting networks at home.

However, Cyber Command would play a key role if there was a major attack from a foreign entity on critical networks, and Alexander was asked by the committee how he would juggle responsibilities.

"Our responsibility is to provide technical support to the DHS to help them build the technology they need to defend [critical] networks," he said. "I think that partnership continues to grow."

The committee posed to Alexander a hypothetical situation that described an attack coming from outside the country but routed through computers in the U.S., which would put it in the domain of the DHS and raise privacy concerns for U.S. citizens.

Alexander said in that case it would be necessary to coordinate efforts very closely with the DHS and the President himself, who would have the ultimate authority in that situation to act.

But this is one area he said that is not clearly defined by policy, which he said is still lacking to help the Cyber Command protect the DoD in the event of a cyber war. "That's one of the things the administration is trying to address," Alexander said.

Indeed, cybersecurity and cyber warfare policy has not evolved nearly as quickly as the threat the Cyber Command, DHS, and NSA are attempting to ward off. The House of Representatives only recently passed a cybersecurity bill while the Senate is currently considering one, but neither have gone into effect yet.

Alexander said the DoD network is hit with hundreds of thousands of probes a day that are attempting to detect vulnerabilities in the network, which is one of the reasons the Cyber Command was created in the first place.

"We have been alarmed by the increase, especially this year," he said. "It's growing rapidly."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio