Sept. 7, 2016

There Is No “Cyber”

At the recent Joint Service Academy (JSA) Cyber Security Summit at West Point (20-21 April, 2016), the word “cyber” was used in multiple different facets. As a noun, cyberspace is the “Domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data…” [COL11]. This is perhaps the broadest definition possible, proposed as the Cyberspace Operations Lexicon by the Joint Chiefs of Staff. While the ambiguity with the meaning of the proper noun “Cyber” provides a difficult framework to focus meaningful actions, our use of the words “Cyber”, “Digital” and their like as adjectives serves only to create artificial divisions among researchers, practitioners, and decision-makers in the area.

Sept. 7, 2016

Cyber Domain: Getting Ourselves Ready for Future Readiness and Conflict

The issue. DoD has been trying to establish its plans, structures, processes, and systems to deal with its cybersecurity and operational issues for several years. These efforts have slowly evolved as DoD has clarified and understood its cyber mission. Given the latest proclamation of the cyber roles assigned to government agencies (in the Presidential Policy Directive 41), it is probably time to put together more definitive plans for the DoD cyber forces and the cyber duties associated with all units, service members, and DoD employees. Another recent document that helps DoD sort out its cyber roles comes from the Joint Operating Environment 2035 (JOE2035), subtitled The Joint Force in a Contested and Disordered World, published in 14 July 2016. Essentially, the President’s document assigns DoD to take care of DoD-related contested military cyber issues. The JOE2035 predicts there will be plenty to do by the cyber forces, and identifies a high-probability, almost continuous, context for future conflict in cyberspace by outlining the struggle to define and protect sovereignty in cyberspace for our military. The cyber domain is a growth area with the specter of continuous, sometimes intense, conflict for a long time. With the US depending heavily on the interdependent networks of information technology (Internet, telecommunications networks, computer systems, embedded processors and controllers) and the data, information, and knowledge that is stored and flows through and between these systems, the cyber domain is the place where a high-stakes competition has, is and will be taking place.

Aug. 21, 2016

Enter the Policy and Legal Void

Soldiers are down range and have suites of tools available to them that they cannot use to their full capability. They are not technically limited, but rather constrained by the authorities and pre-requisite policies established in a pre-digital age. We tell them to go and defeat ISIS, Al al’Qaeda, or pick another future adversary, but they must do so with their hands tied behind their backs. Make no mistake, as a nation we are currently involved in a global conflict. The conflict is not defined by traditional weapons, but by bits and bytes traversing fiber lines and airwaves. This global information war collides with many of the values of Western Democracies, and the societal constraints of authoritarian regimes. The robust constraints on governmental instruments serve a valuable purpose, yet at the same time our Soldiers in the field are struggling to navigate complex legal and policy waters while corporations are drowning in data that might inform or provide context for a variety of mission sets. The volume and velocity of this data is only set to grow as globally the number of Internet enabled devices increases from approximately 17 billion to 50 billion and beyond. At the beginning of the digital age it is imperative that we, as a society, begin discussing the future we are rapidly entering.

Aug. 10, 2016

The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography

The Code Book is about the mathematics and science of codes and ciphers throughout history. Singh specifically lists two purposes for this book. The first is to show the evolution of codes and ciphers, and the second is to demonstrate their relevance in today’s society. Throughout the eight chapters, he discusses the elements of complex ciphers and simplifies the mathematical details for a general audience. He enthusiastically presents stories surrounding ciphers such as who created them, who sought to break them, and if and how the codebreakers were successful. We, as student and instructor in a course entitled Networks for Cyber Operations, used this book as one of our texts in the Spring semester of 2016.

Aug. 8, 2016

Critical Infrastructure Exercise 16.2 – A Transformative Cybersecurity Learning Experience

With an increased national awareness that the critical infrastructure which keeps our country running is surprisingly vulnerable—not just to physical attacks, but also to cyberattacks that can be initiated from anywhere in the world—the State of Indiana executed CRIT-EX 16.2 on the 18th and 19th of May, 2016, at the Muscatatuck Urban Training Center. This cyberattack readiness exercise focused on improving Indiana’s overall security and responsiveness of its critical infrastructure to face advanced cyber disruption of essential water utility services – presenting an extreme public safety threat. Indiana, like the rest of the country, understands it has a short window of opportunity to prepare for a major cybersecurity event that, if successful, could be as devastating as a major earthquake or tornado. In order to effectively prepare for such a scenario, Indiana’s cybersecurity stakeholders realized they had to build high-functioning, collaborative networks that span the public and private sector. By working to collaborate on high-risk cyber issues, organizations throughout Indiana are elevating their response postures, and preparing to ratchet up their ability to confront the threats of tomorrow [1].

June 28, 2016

Maximizing Flexibility: Mitigating Institutionalized Risk in the Cyber Mission Force

Leaders increasingly focus on the growing risk to national security in cyberspace. Today, there is little need to describe the dynamic and unpredictable nature of cyberspace, a wide and growing threat landscape, and rapidly evolving threat capabilities and tactics. Despite tremendous resources dedicated to securing cyberspace, threats always seem to find a way. In corporate board rooms, cybersecurity means accepting this reality and taking internal defensive measures to mitigate material risk.[1] But the private sector is not defenseless: the DoD established US Cyber Command (USCYBERCOM) and its Service components as part of a full Doctrine, Organization, Training, Materiel, Leadership & Education, Personnel, and Facilities (DOTMLPF) solution for full spectrum cyberspace operations. The country deserves nothing less, but the dynamic nature of cyberspace uniquely challenges DOTMLPF development because of its premise on accurately assessing future capabilities requirements – a major challenge for cyberspace!

June 28, 2016

The Number One Vulnerability in the Future of Cyber Security: A Critical Lesson for all Organizations

Since 1958, NASA has been the foremost symbol of American excellence in science and exploration, inspiring generations of engineers around the globe to achieve the impossible through advanced technology. With each of its defining events, NASA pushes humanity further into the future, bringing scientists more information about our universe than ever dreamt possible. But while NASA was reaching for the stars, other forces were secretly at work. In the dark recesses of the agency’s computers and network servers, intruders were lurking. After months of covert access, a hacktivist group called AnonSec obtained 276GB of sensitive data including flight logs, videos, and personal information from thousands of employees (Thalen 2016). This post examines how such an established institution of advanced technology could fall prey to cyber hacking, the glaring warning signs, and the one key lesson all organizations should learn from this historical event.

May 16, 2016

Division Cyber Operations

Modern adversaries can now integrate cyber operations into military plans. Recent events have shown that rival governments can not only develop cyber-attack plans, but synch them to achieve national goals. The U.S. Department of Defense must begin integrating and normalizing the use of cyber effects. While there are numerous methods to begin that process, the key is choosing a method and beginning the long process of training in its employment. The primary level this training should be performed is at the Army Division level. Often, the division is the first major headquarters that can develop a list of requirements to submit to the Joint Task Force Headquarters or the Combatant Command. With that in mind, training at home station and during operational level exercises is absolutely necessary. Simulation technology will catch up with cyber operations in due course, but this is no reason to not begin training now. As a military, the US faces adversaries that have proven their ability to integrate offensive cyber effects from the tactical up to the strategic level. Though multiple methods exist to request and execute Cyber Operations (CO) at the division level, the bigger and more looming problem is the lack of training in utilizing these effects, and being ready to put these effects to use on the battlefield. For the United States to keep pace with near-peer nations, it must train on and prepare to use these effects in a real-world combat environment.

May 6, 2016

Indiana Exercising Plans to Combat Cyber Threats: Preparing for CRIT-EX 2016

On the 21st and 22nd of March, 2016, Indiana hosted its inaugural Defense Cyber Summit (DCS), which aimed to advance the state’s cyber readiness and preparations against a cyberwarfare attack. Spurred on by Admiral Michael Rogers, the Commander of the U.S. Cyber Command, who in 2014 called cybersecurity “the ultimate team sport,” Indiana has purposefully adopted a culture of collaboration between government organizations, private firms, non-profits, and academia to improve the state’s response and resiliency to a significant cyber incident. This team approach will counter cyberattacks intent on degrading Indiana’s economic capacity and threating the critical services of its citizens [1]. Under the umbrella of the Applied Research Institute (ARI), organizations such as Purdue University, Indiana University, Crane Naval Surface Warfare Center, the Cyber Leadership Alliance, the Indiana National Guard, and the Indiana Department of Homeland Security have partnered together to address and propose solutions to Indiana’s cyber security challenges. This effort is boosted by the Indianapolis-based Lilly Endowment support of nearly $16.3 million that is funded through a grant from the Central Indiana Corporate Partnership Foundation. The ARI is working to foster collaboration, research, and problem solving on cyber threats to Indiana’s critical infrastructure [2].

May 2, 2016

Applied Research in Support of Cyberspace Operations: Difficult, but Critical

Cyber security as a work domain and commercial sector is relatively new, but has been maturing rapidly over the past 20 years. Cyberspace operations, on the other hand, are synchronized military activities to identify, degrade and/or deceive threat actors in cyberspace. Cyberspace operations are inherently dynamic due to changing technology and tactics of malicious actors. Recent increases in the number and scale of cyber incidents have illustrated the need for improved coordination across the Cyber Mission Force as well as improved feedback and accelerated technology transition between operational research, and development communities. This paper presents arguments for improving cyberspace operations with sustained efforts to understand cyber work and the impacts of technologies on the people who perform it. The Cyber Immersion Lab, operated by USCYBERCOM, is an activity that is demonstrating the strengths of this approach.