March 9, 2015
War on the Rocks is expanding, and we need your help!
“ … The Department of Defense depends on cyberspace to function. It is difficult to overstate this reliance; DOD operates over 15,000 networks and seven million computing devices across hundreds of installations in dozens of countries around the world … Our reliance on cyberspace stands in stark contrast to the inadequacy of our cybersecurity.” –– DOD Strategy for Operating in Cyberspace
“The United States cannot be confident that our critical IT systems will work under attack from a sophisticated and well-resourced opponent utilizing cyber capabilities in combination with all of their military and intelligence capabilities (a full spectrum adversary.)” –– Resilient Military Systems and the Advanced Cyber Threat
How do our commanders prepare for conflict against a peer adversary in the face of such great uncertainty? For nearly 50 years – since the creation of ARPANET – the U.S. Department of Defense has been focused on maintaining military superiority through the development, testing, and fielding of the most advanced weapon systems and strategies, taking advantage of the latest information technology innovations in microprocessors, software, and networking. Since the end of the Vietnam War, American military victories have depended upon these systems and information technology-based strategies for timely intelligence and integrated operations on the battlefield. These successes have increased demand for utilizing advanced technologies and thereby, deepened our dependence on these capabilities.
Repeated successes on the battlefield have led America’s adversaries and competitors to study our approach in order to best understand how to counter and negate our advantage. As recently noted in two separateDefense Science Board task force reports published in January 2013 and again in a 2014 paper by former Secretary of the Navy Richard Danzig, our adversaries have learned how to turn our information technology strengths and innovations to their advantage, creating the ability to seemingly exploit our information technology systems at will for the purposes of military data theft, mission disruption, and/or system destruction. As noted in the DOD Strategy for Operating in Cyberspace, there is a growing awareness of our warfighting dependency on these information technology advances, but the U.S. government is struggling to “adjust course” because of both system complexity and organizational bureaucracy. The Defense Department has a higher assurance for being able to operate effectively in cyberspace with the creation of a Cyber Command, collocated with NSA and supported by budget and manpower increases. However, DoD’s success is dependent upon civil critical infrastructure that needs great protection, an issue that still needs to be addressed by the White House and Congress.
While beyond the scope of our paper, the relationship between the private sector (infrastructure owners) and the federal government must be re-assessed. To varying degrees, there exists distrust among the citizens, the infrastructure owners, and the government. Because of this distrust, a system of rules, checks/balances, and oversight was developed and has evolved to keep the system in equilibrium. Unfortunately, in the face of a top tier threat, it is not evident that infrastructure owners can effectively protect their domain. They must receive support from the government – technology, intelligence, and operations conducted against the adversary. They will likely need to provide the government insight into their operations, technology, and sensor feeds. Any of these moves has the potential to negatively impact the delicate equilibrium. This challenge is recognized, and efforts are underway to find effective moves (to protect the infrastructure) that result in a new and acceptable equilibrium to all parties.
To sustain the United States’ military advantage against those seeking to do our nation harm, we must develop a new comprehensive strategy and rapidly change course with a keen focus on strengthening the resilience of our military pillars – to include associated critical infrastructure – of our national security mission set. There will be great resistance to many of the needed changes. Foundational to this strategy will be the development of a resilient electric power generation architecture and “game-changing” situational awareness of our cyber readiness and our opponent’s plans, intentions, and capabilities.
Where do we focus?
Keeping America safe requires the ability of our military to compel a potential adversary to align with our national interests, or at least to perceive the cost of opposing U.S. interests so high that it does not pursue harmful actions against the United States. Our military strategy for achieving this end over the last half century has revolved around a resilient nuclear capability and the ability to rapidly project overwhelming conventional force anywhere in the world. In other words, our work in these areas has demonstrably shown an overwhelming warfighting advantage and acted as a credible deterrent to would-be enemies of the United States.
Underlying these pillars – to varying extents – are microprocessors, software, and networks that adversaries aim to exploit, to counter, and, in a conflict scenario with the United States, to defeat. This realization alone should cause us pause. If the systems supporting our national security mission pillars can be neutralized, the outcomes of military engagements could be uncertain, potentially resulting in our reluctance to engage a would-be adversary and thus, deterrence effectively fails. So, what should we do to address this pervasive and strategic national security problem? We should focus on two strategic imperatives for helping to assure military superiority in the future:
In the face of a sophisticated full spectrum nation-state threat, we must rapidly enhance the resilience of the military pillars – to include associated critical infrastructure – of our national security mission set.
Understanding that current information technology will remain vulnerable, we need to build an alternative foundation for protecting our national interests through military capabilities and advancements.
Adaptive Strategies for Resiliency
To reduce the likelihood that adversaries can exploit our critical military mission systems, we need to shift to a multi-faceted resiliency strategy for assuring readiness and sustainability. As described by Harriet Goldmanand Jim Gosler, characteristics of adaptive resiliency would include the following:
Diversity and redundancy: Introducing diverse technology can minimize the impact of technology-specific attacks and raise the bar for adversaries.
Integrity Assurance: Different integrity validation techniques ensure the health and correct functioning of critical components and data within a system.
Separation and Isolation: Separation requirements should implement the principle of least privilege. Strong isolation techniques also help to counter a cascading attack.
Detection and Monitoring: Early detection and monitoring of adversarial actions gives us knowledge of enemy tactics and insights for deploying countermeasures.
Non-persistence: By implementing aperiodic refreshes, we can hinder an attacker’s ability to know when to attack and increase the risk of attack failure.
Distributedness and Moving Target Defense: When distributed processing is paired with dynamic repositioning at different locations, we can limit adversary actions.
Use of Out-of-band Capabilities: Using human/non-cyber capabilities helps reduce dependency on automated systems subject to automated attacks by an adversary.
Randomness, Deception, and Unpredictability: Confusing an attacker or adding the element of surprise can foil an attacker’s attempt, creating uncertainty for the enemy.
Because our principal capability for deterring a determined nuclear capable adversary from using nuclear weapons against the United States or our allies is nuclear strike, the modernization and adaptation of new resiliency measures and strategies for nuclear command and control should top our list. A zero-based review of all other military systems and associated critical infrastructures should be used to establish the boundary conditions for adopting additional resiliency measures.
In an increasingly interconnected world, adaptive resiliency “buys time” and makes an adversary work harder but may not provide an enduring countervailing capability against a determined adversary. The overall strategy and associated infrastructure for mission assurance and military superiority would need to be re-built from the bottom-up as well as the top-down.
Rebuild Electric Power Generation and Develop “Game-Changing” Situational Awareness
The United States needs a “bottom-up” elastic compute and data provisioning architecture of systems that employs all of the adaptive resiliency strategies described above and has the added feature of enabling an overwhelming, resilient offensive capability. Two key elements of an adaptive/resilient architecture are (1) a robust electric power grid and (2) deep real-time insight into the status of our IT infrastructure – both enterprise and embedded systems.
Electric power drives all compute and data enterprises. It is foundational. We would start by addressing our electric power grid structure to build a disaggregated alternative architecture from the base up. We should take advantage of this re-architecting to leverage the dedicated fiber that runs through much of our power transmission lines today. At one level, this dedicated fiber can provide out-of-band management that increases options for both defensive and offensive application. Our electric power generation capability should not be one integrated smart grid, but an architecture of dedicated and common use systems – the latter to help not only with increasing commercial efficiency, but also to provide more resiliency and offensive options in the face of a determined threat.
The United States government needs to dedicate more resources to breakthroughs in advanced computing. At the highest levels, new and powerful computing architectures are required. National priority on maintaining leadership in all information technology – powered by a re-architected energy generation capability for secure, advanced computing – should be foundational to our enduring strategy for “out innovating” and continuously countering an adversary in a world where information is increasing exponentially and where relative expert knowledge can provide significant military and political advantage. We need to adapt faster through advanced computational science.
From a top-down perspective where devices interconnect physical domains of space, air, land, and sea, we need comprehensive and deep-penetrating insight about adversaries. We need to anticipate emerging threats much better than we do today, and we need to be much better prepared to adapt to those we don’t anticipate. The combination of open source data, intelligence sensors at a distance, intelligence sensors embedded in both an opponent’s attack enterprise and our infrastructure, real-time analytics, and an advanced computational base could provide this “God’s eye view.” This in turn would increase our confidence in the resiliency of our critical systems and at the same time decrease the confidence our adversaries would have in their ability to compromise these systems.
Seizing the Technological Advantage Again
As the world becomes increasingly interconnected, the United States is once again at a crossroads in its approach to national security strategy. Over the last half century, the U.S. military has driven and leveraged significant advances in information technology, which has caused our adversaries to take notice and develop means to counter this U.S. national security technology advantage. We must once again seize the advantage through American ingenuity and action. First, we need to rapidly build greater resilience into the military systems of our national security mission set. Secondly, knowing that current information technology is and will remain vulnerable, we need a “bottom-up” and “top-down” strategy to build an alternative systems architecture characterized by assured elasticity of digital energy, advanced computational science, and ubiquitous cross-domain sensors. We must do both in order to deter, dissuade, defeat, and “out innovate” our nation’s enemies.
Bob Butler is the co-founder and managing director or Cyber Strategies LLC and a fellow at the Center for a New American Security. He served as the first Deputy Assistant Secretary of Defense for Cyber Policy and has consulted as a Special Government Expert to DOD and DHS.
Jim Gosler is a Senior Fellow at the Johns Hopkins Applied Physics Laboratory, where he provides strategic advice to the Laboratory’s senior leadership. He also serves on the Defense Science Board, the National Security Agency’s Advisory Panel, and the Naval Studies Board.
No comments:
Post a Comment