Cyber Defense Review

Recent Articles

1 2 3 4 5 6 7 8

The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography

August 10, 2016 — The Code Book is about the mathematics and science of codes and ciphers throughout history. Singh specifically lists two purposes for this book. The first is to show the evolution of codes and ciphers, and the second is to demonstrate their relevance in today’s society. Throughout the eight chapters, he discusses the elements of complex ciphers and simplifies the mathematical details for a general audience. He enthusiastically presents stories surrounding ciphers such as who created them, who sought to break them, and if and how the codebreakers were successful. We, as student and instructor in a course entitled Networks for Cyber Operations, used this book as one of our texts in the Spring semester of 2016. MORE

Critical Infrastructure Exercise 16.2 – A Transformative Cybersecurity Learning Experience

August 8, 2016 — With an increased national awareness that the critical infrastructure which keeps our country running is surprisingly vulnerable—not just to physical attacks, but also to cyberattacks that can be initiated from anywhere in the world—the State of Indiana executed CRIT-EX 16.2 on the 18th and 19th of May, 2016, at the Muscatatuck Urban Training Center. This cyberattack readiness exercise focused on improving Indiana’s overall security and responsiveness of its critical infrastructure to face advanced cyber disruption of essential water utility services – presenting an extreme public safety threat. Indiana, like the rest of the country, understands it has a short window of opportunity to prepare for a major cybersecurity event that, if successful, could be as devastating as a major earthquake or tornado. In order to effectively prepare for such a scenario, Indiana’s cybersecurity stakeholders realized they had to build high-functioning, collaborative networks that span the public and private sector. By working to collaborate on high-risk cyber issues, organizations throughout Indiana are elevating their response postures, and preparing to ratchet up their ability to confront the threats of tomorrow [1]. MORE

The Number One Vulnerability in the Future of Cyber Security: A Critical Lesson for all Organizations

June 28, 2016 — Since 1958, NASA has been the foremost symbol of American excellence in science and exploration, inspiring generations of engineers around the globe to achieve the impossible through advanced technology. With each of its defining events, NASA pushes humanity further into the future, bringing scientists more information about our universe than ever dreamt possible. But while NASA was reaching for the stars, other forces were secretly at work. In the dark recesses of the agency’s computers and network servers, intruders were lurking. After months of covert access, a hacktivist group called AnonSec obtained 276GB of sensitive data including flight logs, videos, and personal information from thousands of employees (Thalen 2016). This post examines how such an established institution of advanced technology could fall prey to cyber hacking, the glaring warning signs, and the one key lesson all organizations should learn from this historical event. MORE

Maximizing Flexibility: Mitigating Institutionalized Risk in the Cyber Mission Force

June 28, 2016 — Leaders increasingly focus on the growing risk to national security in cyberspace. Today, there is little need to describe the dynamic and unpredictable nature of cyberspace, a wide and growing threat landscape, and rapidly evolving threat capabilities and tactics. Despite tremendous resources dedicated to securing cyberspace, threats always seem to find a way. In corporate board rooms, cybersecurity means accepting this reality and taking internal defensive measures to mitigate material risk.[1] But the private sector is not defenseless: the DoD established US Cyber Command (USCYBERCOM) and its Service components as part of a full Doctrine, Organization, Training, Materiel, Leadership & Education, Personnel, and Facilities (DOTMLPF) solution for full spectrum cyberspace operations. The country deserves nothing less, but the dynamic nature of cyberspace uniquely challenges DOTMLPF development because of its premise on accurately assessing future capabilities requirements – a major challenge for cyberspace! MORE

Division Cyber Operations

May 16, 2016 — Modern adversaries can now integrate cyber operations into military plans. Recent events have shown that rival governments can not only develop cyber-attack plans, but synch them to achieve national goals. The U.S. Department of Defense must begin integrating and normalizing the use of cyber effects. While there are numerous methods to begin that process, the key is choosing a method and beginning the long process of training in its employment. The primary level this training should be performed is at the Army Division level. Often, the division is the first major headquarters that can develop a list of requirements to submit to the Joint Task Force Headquarters or the Combatant Command. With that in mind, training at home station and during operational level exercises is absolutely necessary. Simulation technology will catch up with cyber operations in due course, but this is no reason to not begin training now. As a military, the US faces adversaries that have proven their ability to integrate offensive cyber effects from the tactical up to the strategic level. Though multiple methods exist to request and execute Cyber Operations (CO) at the division level, the bigger and more looming problem is the lack of training in utilizing these effects, and being ready to put these effects to use on the battlefield. For the United States to keep pace with near-peer nations, it must train on and prepare to use these effects in a real-world combat environment. MORE

Indiana Exercising Plans to Combat Cyber Threats: Preparing for CRIT-EX 2016

May 6, 2016 — On the 21st and 22nd of March, 2016, Indiana hosted its inaugural Defense Cyber Summit (DCS), which aimed to advance the state’s cyber readiness and preparations against a cyberwarfare attack. Spurred on by Admiral Michael Rogers, the Commander of the U.S. Cyber Command, who in 2014 called cybersecurity “the ultimate team sport,” Indiana has purposefully adopted a culture of collaboration between government organizations, private firms, non-profits, and academia to improve the state’s response and resiliency to a significant cyber incident. This team approach will counter cyberattacks intent on degrading Indiana’s economic capacity and threating the critical services of its citizens [1]. Under the umbrella of the Applied Research Institute (ARI), organizations such as Purdue University, Indiana University, Crane Naval Surface Warfare Center, the Cyber Leadership Alliance, the Indiana National Guard, and the Indiana Department of Homeland Security have partnered together to address and propose solutions to Indiana’s cyber security challenges. This effort is boosted by the Indianapolis-based Lilly Endowment support of nearly $16.3 million that is funded through a grant from the Central Indiana Corporate Partnership Foundation. The ARI is working to foster collaboration, research, and problem solving on cyber threats to Indiana’s critical infrastructure [2]. MORE

Applied Research in Support of Cyberspace Operations: Difficult, but Critical

May 2, 2016 — Cyber security as a work domain and commercial sector is relatively new, but has been maturing rapidly over the past 20 years. Cyberspace operations, on the other hand, are synchronized military activities to identify, degrade and/or deceive threat actors in cyberspace. Cyberspace operations are inherently dynamic due to changing technology and tactics of malicious actors. Recent increases in the number and scale of cyber incidents have illustrated the need for improved coordination across the Cyber Mission Force as well as improved feedback and accelerated technology transition between operational research, and development communities. This paper presents arguments for improving cyberspace operations with sustained efforts to understand cyber work and the impacts of technologies on the people who perform it. The Cyber Immersion Lab, operated by USCYBERCOM, is an activity that is demonstrating the strengths of this approach. MORE

How Do Cyber Operations Look in 2025?

April 11, 2016 — The United States military has made significant strides to counter the increasing number of worldwide cyber threats. Recently, the U.S. Army created a Cyber Branch as the newest of its basic branches. Now the transition becomes necessary to integrate the Cyber Branch into its important, future everyday role on the battlefield. Currently, most of the cyber force is congregated in certain branch specific areas. This allows for effective command and control of these units, but limits their operational utility. Despite being able to access cyberspace from anywhere in the world, using cyber to its full capability requires adaptation at the tactical level, and on the battlefield. The definition of cyber is “of, relating to, or involving computers or computer networks.”[1] A dedicated cyber force is important for defense and offense alike on the national stage, but what about cyber on the battlefield? With the increase of computers and accompanying networks on the battlefield, a deployable cyber force becomes a necessity. One of the ‘game changers’ on the modern battlefield are the multiple missions conducted by U.S. Special Operations Command (USSOCOM). These highly trained professionals have been rapidly deployed worldwide in support of Operation Enduring Freedom and Operation Iraqi Freedom. Now with US military operations in Afghanistan transitioning, special ops missions will stay constant. With over 66,000 personnel assigned to USSOCOM, and more than a $10B budget, this is one segment of the military that is not decreasing in size.[2] Operations occur worldwide, from the Middle East to South America to Africa. This force is focused on US strategic interests, while operating with a reduced signature to accomplish their mission in sensitive and dangerous environments. But how can this force increase its effectiveness? Integrating cyber operations with the special operations community will enhance this elite fighting force effectiveness by 2025 with the addition of one cyber operations specialist to every tactical Special Operations Forces (SOF) team MORE

Maintaining Massive Networks Through Automation And Management Tools

March 28, 2016 — Computer networks are no longer the isolated, small, and static webs of the 1970s. With the number of devices connected to the internet quickly surpassing the world’s population, the ability to manage massive networks has become increasingly difficult. Additionally, the variety of devices which now access networks has gone from single home computers to include watches, tablets, smart phones, and all types of vehicles. This increase in size and complexity has created a huge burden on network security professionals. The amount of data entering and exiting many networks far exceeds what a network security staff is able to effectively monitor. With the help of automation tools and modern management strategies these challenges can be overcome. Network security professionals need to look to tools such as Splunk and the Meraki Cloud Platform to intelligently filter and focus on critical pieces of data. Additionally, they need to utilize strategies such as the Continuous Diagnostics and Mitigation (CDM) program to make error detection and response fluid and systematic. MORE

Can Intelligence Preparation of the Battlefield/Battlespace Be Used to Attribute a Cyber-Attack to an Actor?

March 22, 2016 — With countless cyber-attacks coming from advanced persistent threats (APTs) attribution for these attacks is increasingly important to calculate the damage and response as well as preventing future attacks. Establishing a framework is a way to increase analytic confidence in attribution, intelligence preparation of the battlefield/battlespace (IPB) combines elements of the battlefield and adversary which fall in line with cyber-attribution. Pulling elements of ‘OAKOC’ and ‘ASCOPE’ as well as components of the adversary the connections between the two disciplines is evident, and is shown in a graph on page 12. The overlap between IPB and cyber-attacks becomes more evident when applying the methodology to two hypothetical cyber-attacks from APTs: Axiom and APT1. As APTs reuse their tactics, techniques, and procedures (TTPs) and toolset patterns and signatures can be detected and identified utilizing cyber-IPB leading to attribution. However, APTs utilize innovative obfuscation techniques which could hamper cyber-IPB attribution. Combined with effective indicator and malware-analysis cyber-IPB provides a framework for cyber-attribution. MORE

1 2 3 4 5 6 7 8

Comment Disclaimer

If you wish to comment on any of the posted articles, please use the comment box provided below the individual article. The Army Cyber Institute (ACI) reserves the right to modify this policy at any time.

This is a moderated forum. This means that all articles are subject to review. In addition, we expect that the participants will treat each other, as well as our agency and our employees, with respect. We will not post and will remove any comments that contain abusive or vulgar language, spam, hate speech, personal attacks, violate EEO policy, are offensive to others or similar content. We will not post and will remove comments that are spam, clearly "off topic", promote services or products, infringe on copyright protected material, or contain any links that don't contribute to the discussion. Comments that make unsupported accusations will not be posted and will be removed. The ACI and the ACI alone will make a determination as to which comments will be posted and/or removed. Any references to commercial entities, products, services, or other non-governmental organizations or individuals that remain on the site are provided solely for the information of the individuals using the Cyber Defense Review site. These references are not intended to reflect the opinion of the ACI, the Army, the Department of Defense (DoD), its officers, or employees concerning the significance, priority, or the importance to be given the referenced entity, product, service, or organization. Such references are not an official or personal endorsement of any product, person, or service, and may not be quoted or reproduced for the purpose of stating or implying ACI, Army, or DoD endorsement or approval of any product, person, or service.

Any comments that report criminal activity including: suicidal behavior or sexual assault will be reported to the appropriate authorities. This forum is not:
- To be used to report criminal activity. If you have information for law enforcement, please contact your local police agency.
- Do not submit unsolicited proposals or other business ideas or inquiries to this forum. This site is not to be used for contracting or commercial business.
- This forum may not be used for the submission of any claim, demand, informal or formal complaint, or any other form of legal and/or administrative notice or process, or for the exhaustion of any legal and/or administrative remedy.

The ACI does not guarantee or warrant that any information posted by individuals on this forum is correct, and disclaims any liability for any loss or damage resulting from reliance on any such information. The ACI may not be able to verify, does not warrant or guarantee, and assumes no liability for anything posted on this website by any other person. The ACI does not endorse, support, or otherwise promote any private or commercial entity or the information, products or services contained on those websites that may be reached through links on the Cyber Defense Review website. 

Members of the media are asked to send questions to the public affairs office through normal channels and to refrain from submitting questions here as comments. Reporter questions will not be posted and may be removed at the discretion of the ACI. We recognize that the web is a 24x7 medium and your comments are welcome at any time. However, given the need to manage federal resources, moderating, posting, and removal of comments will occur during normal business hours Monday through Friday. Comments submitted after hours or on weekends will be reviewed and posted or removed as early as possible; in most cases, this means the next business day.

For the benefit of robust discussion, we ask that comments remain "on-topic". This means that comments will be reviewed and posted only as it related to the topic that is being discussed within the blog post and "off-topic" posts may be removed. The views expressed on the site by non-federal commentators do not necessarily reflect the official views of the ACI, the Department of the Army, the Department of Defense, or the Federal Government.