Into the Realm of Cyber-Assurance
Written by Robert Lentz
MIT 2009 Volume: 13 Issue: 9 (October)
Reflects On Tenure and Calls For New
Path Focused On Automated Systems.
In the Department of Defense, as is the case in the business world and across the rest of the federal government, mission success relies on access to timely and trustworthy information. This means that the information residing on our networks needs to be protected and defended against the ever-present threat of probes and scans. There are millions of targeted scans on the DoD’s Global Information Grid every single day, and the threat is coming from adversaries and hackers.
Information is at the center of network-centric operations. It is critical to our mission that defense information systems not be brought down by cyber-attack. It is crucial that we have freedom of action in cyberspace. If we can’t trust the information we rely on, it can greatly impact our success on the battlefield.
The issue is so important that John Grimes, then the DoD chief information officer, created the Office of the Deputy Assistant Secretary of Defense for Cyber, Identity and Information Assurance (DASD-CIIA) in 2008 to operationalize informationcentric concepts. This office, which I have headed, was created to increase the profile of our mission, which is to protect our information assets and to give warfighters the ability to access and share information as needed.
Since the stand-up of the DASD-CIIA, we have made many accomplishments in the cybersecurity arena. We have deployed the largest public-key infrastructure in the world. We established the Unified Cross Domain Management Office (UCDMO), a joint office created by the CIOs for DoD and the Office of the Director of National Intelligence to address the inefficiencies and ineffectiveness resulting from years of uncoordinated activities in the cross domain arena. UCDMO’s goal is to push seamless information sharing throughout a diverse user community across a wide variety of security domains that handle both classified and unclassified information.
We have grown the DoD information assurance budget from $1 billion a year to now over $3 billion.
STRONG PARTNERSHIPS
We have also improved IA education and training and have increased our partnerships with the Department of Homeland Security, private industry, and the global defense industrial base (DIB). We established a strong partnership with the DIB to increase network security, as well as put in place a robust model of threat and vulnerability sharing that extends to all critical sectors. We established the intergovernmental Data at Rest Tiger Team (DARTT), which creates policies and acquisition vehicles to secure sensitive government data and personally identifiable information.
The DARTT has developed an unprecedented and rapid acquisition process in support of government requirements, including the competitive awarding of multiple blanket purchase agreements that can be used by all U.S. government agencies (federal, state and local) and NATO. Under the DARTT BPAs, government agencies have saved more than $100 million in encryption licenses since July 2007.
We also launched the Defense Venture Catalyst Initiative, a program that brought cutting-edge technology innovation to the national security community right after September 11, 2001, enabling agencies to solve many hard challenges.
But our work is far from finished. Although we have accomplished a lot, there is much work left to do. If I had to list five of the biggest challenges that remain, my list would be:
• The need to continuously harden the network, in this era of social networking, cloud services, and increased mobile work force and growing global requirements.
• The need to move to multi-factor and attribute-based identity assurance access for people, devices, data and applications.
• The whole area of supply chain risk management. As the threat changes, we need to adjust as well, which includes rolling out technologies that inspect and secure the supply chain.
• Raising awareness across DoD and greater national security community on cyber-resilience, so that commanders are prepared to operate in a contested cyberdomain when communications are degraded—or worse, untrusted. The increased complexity of our technologies, coupled by our even greater dependence on them for mission success, makes this an imperative.
• Continuing to stress the importance and necessity of education, training and workforce manning for critical IT/IA skill sets.
NEW STRATEGY
Since 2004, when DoD issued its first information assurance strategy, much has changed. We have witnessed a stark increase in both the cyberthreat and the sophistication of the enemy to penetrate our mission-critical systems.
To help combat the threat, my office recently implemented a new information strategy that lays out our vision and goals for cyber, identity and information assurance. In short, we must become more agile. Although training and education of our work force is vital, eventually we must begin to take people out of the mix and move toward an automated security system platform where devices can recognize a threat and respond more quickly and efficiently than humans.
We have to improve the time it takes to roll out commercial technologies. We can no longer afford to wait three, four or five years to put capabilities out on the battlefield. The direction we’re headed is to integrate information assurance in the pre- Milestone A design phase of weapons platforms. The bottom line is that we have to emphasize IA in the design phase, or otherwise we will have to pay a tremendous amount of money later on to fix programs. Even worse, we’ll find ourselves more vulnerable to attack.
We must trod a new path, one that focuses on automating security systems that rely less on systems engineers detecting intrusions and installing security patches.
Now that I have retired from my role as the DASD-CIIA and the department’s chief information security officer, I leave both proud of our accomplishments in raising the profile and mission of cybersecurity across the department, and confident that remaining challenges will be addressed to deal with the current cyberthreat.
I like to use the analogy of the automobile back in the 1960s and before. Back then, there was hardly any safety built into cars. But today safety features come standard in vehicles—from seatbelts and shatter-proof glass to anti-lock brakes and airbags.
The automobiles of an earlier era resemble DoD’s information systems prior to all of the security layers. We had no security before. In fact, it was like the Wild West. But with the advent of the Internet, our industry was forced to change. Today, we anticipate scans and attacks and have adjusted our approach more toward keeping our mission-critical systems up and operating in the midst of these attacks. Layered security is enabling us to do this.
Tomorrow, we will rely less on a static, stand-alone information assurance environment and move toward a cyber-information assurance realm. DoD must include time and environmental considerations into its security measures to address the rapid pace of the threat and to topple our adversaries. We simply must be faster, more agile and better prepared. We’re headed in the right direction. ♦
Robert Lentz retired recently as deputy assistant secretary of defense for cyber, identity and information assurance.
