http://www.realcleardefense.com/articles/2016/06/07/cyber_warfare_just_how_vulnerable_is_the_us_military_109423.html
June 7, 2016
By Andrew Poulin“During a conflict, the Defense Department assumes that a potential adversary will seek to target U.S. or allied critical infrastructure and military networks to gain a strategic advantage.” Those ominous words are from the 2015 DoD Cyber Strategy. In fact, cyber attacks are not just a future threat but something that the military faces on a daily basis. Cyber crimes like the theft of intellectual property, the probing of government and military networks, attacks against U.S. infrastructure, and the laying of trapdoors and logic bombs within U.S. networks make this an incredibly potent danger.
This threat is further exacerbated by the level of dependence that the military has on the Internet and other vulnerable online networks. In his book Cyber War, Richard Clarke details that, “Logistics, command and control, fleet positioning, everything down to targeting, all rely on software and other Internet-related technologies. And all of it is just as insecure as your home computer, because it is all based on the same flawed underlying technologies and uses the same insecure software and hardware.” This is an astonishing liability underlying the most powerful military in the world.
It is especially troubling because for even a modest investment in cyber technologies, a foreign nation or non-state actor could limit the effectiveness of U.S. military equipment or gain access to supposedly secure systems. For instance, in 2009, insurgents in Iraq used $26 software to hack into and monitor the video feeds from predator drones via an unencrypted communications link. Imagine if the signal that was compromised was jammed instead, thus making the drone ineffective and forcing its return to base before mission completion; the result would have been that a $4 million piece of U.S. equipment was countered by less than $100 of software and a junior cyber hacker. The cyber world is a great force equalizer that will surely be a significant factor in any future large-scale conflict.
Cyberspace Susceptibility
The susceptibility of U.S. satellites is a great concern for any future conflict. In 2011, outerspace contained 947 satellites and “over eighty percent of U.S. government and military satellite communications traveled over commercial satellites.” Of the 175 military satellites circling the Earth at the time, half of them belonged to the U.S. military. In the last five years, hundreds more satellites have been launched and most of them are used for communications or navigation via GPS. Peter W. Singer, Director of the Center for 21st Century Security noted in a poignant example of cyber vulnerability that, “Global Positioning Systems (GPS) satellites are used to direct the movements of 800,000 U.S. military receivers, located on everything from aircraft carriers to individual bombs and artillery shells. A ‛glitch’ in GPS in early 2010 left almost 10,000 of these receivers unable to log in for days, rendering them useless and their systems directionless.”
The “glitch” Singer referred to was caused by the installation of new software that proved to be incompatible. Although there were no casualties from this incident, it effectively demonstrated just how dependent the military is on GPS. If our satellites were targeted or GPS was spoofed and rendered useless during a conflict, it would have severe ramifications for the United States and would greatly hinder the ease of military operations.
The Inherent Vulnerability of the Defense Establishment
The Department of Defense has over 15,000 computer networks among 4,000 worldwide installations, and “approximately ninety-eight percent of U.S. government communications travel over civilian owned and operated networks.” And these networks are vulnerable. One of the conclusions of the 2013 DoD Task Force Report on Resilient Military Systems and the Advanced Cyber Threat noted that, “DoD red teams, using cyber attack tools which can be downloaded from the Internet, are very successful at defeating our systems.” If DoD can get into their own systems using publicly available technology, then bad actors can as well.
An additional facet of this problem is that the military must frequently collaborate with other U.S. government and civilian defense establishment networks that are just as vulnerable as military networks and often even more so. There are efforts underway to hold these different agencies and contractors to higher security standards, and they should be greatly accelerated. These systems get probed for vulnerabilities and are attacked countless times a day, a troubling reality considering that almost one million new malware threats are also released every day.
Two of the most prominent examples of cyber attacks against the government and defense establishment include the June 2015 attack against the U.S. Office of Personnel Management (OPM), and the theft of the design plans for the Joint Strike Fighter (JSF). Episodes like these quickly degrade any advantage the United States has over its competitors and potential adversaries. And these attacks do not only originate in a few countries; it has been documented that more than 100 foreign intelligence organizations have tried to gain access to U.S. networks. As the number of entities attempting to gain access to U.S. systems is unlikely to diminish, it is imperative that the United States develops more stringent protocols and higher security standards for their counterparts in private industry or these types of incidents will continue to occur.
Going forward, DoD finds itself in a challenging juxtaposition; they must share information across agencies and with companies to design and build new weapons systems and to plan for potential conflicts, but at the same time, it is this openness that makes them the most vulnerable. These existing vulnerabilities give foreign intelligence agencies, adversaries, and bad actors opportunities to exploit. The United States must remain vigilant and committed to stopping this threat. The bottom line to U.S. national security is that unless drastic measures are taken to secure these networks, the government, the military, and the nation will remain susceptible to perilous cyber attacks.
Andrew Poulin is a naval officer. The views expressed here are his own and do not necessarily reflect those of the Department of Defense or the Department of the Navy.
June 7, 2016
By Andrew Poulin“During a conflict, the Defense Department assumes that a potential adversary will seek to target U.S. or allied critical infrastructure and military networks to gain a strategic advantage.” Those ominous words are from the 2015 DoD Cyber Strategy. In fact, cyber attacks are not just a future threat but something that the military faces on a daily basis. Cyber crimes like the theft of intellectual property, the probing of government and military networks, attacks against U.S. infrastructure, and the laying of trapdoors and logic bombs within U.S. networks make this an incredibly potent danger.
This threat is further exacerbated by the level of dependence that the military has on the Internet and other vulnerable online networks. In his book Cyber War, Richard Clarke details that, “Logistics, command and control, fleet positioning, everything down to targeting, all rely on software and other Internet-related technologies. And all of it is just as insecure as your home computer, because it is all based on the same flawed underlying technologies and uses the same insecure software and hardware.” This is an astonishing liability underlying the most powerful military in the world.
It is especially troubling because for even a modest investment in cyber technologies, a foreign nation or non-state actor could limit the effectiveness of U.S. military equipment or gain access to supposedly secure systems. For instance, in 2009, insurgents in Iraq used $26 software to hack into and monitor the video feeds from predator drones via an unencrypted communications link. Imagine if the signal that was compromised was jammed instead, thus making the drone ineffective and forcing its return to base before mission completion; the result would have been that a $4 million piece of U.S. equipment was countered by less than $100 of software and a junior cyber hacker. The cyber world is a great force equalizer that will surely be a significant factor in any future large-scale conflict.
Cyberspace Susceptibility
The susceptibility of U.S. satellites is a great concern for any future conflict. In 2011, outerspace contained 947 satellites and “over eighty percent of U.S. government and military satellite communications traveled over commercial satellites.” Of the 175 military satellites circling the Earth at the time, half of them belonged to the U.S. military. In the last five years, hundreds more satellites have been launched and most of them are used for communications or navigation via GPS. Peter W. Singer, Director of the Center for 21st Century Security noted in a poignant example of cyber vulnerability that, “Global Positioning Systems (GPS) satellites are used to direct the movements of 800,000 U.S. military receivers, located on everything from aircraft carriers to individual bombs and artillery shells. A ‛glitch’ in GPS in early 2010 left almost 10,000 of these receivers unable to log in for days, rendering them useless and their systems directionless.”
The “glitch” Singer referred to was caused by the installation of new software that proved to be incompatible. Although there were no casualties from this incident, it effectively demonstrated just how dependent the military is on GPS. If our satellites were targeted or GPS was spoofed and rendered useless during a conflict, it would have severe ramifications for the United States and would greatly hinder the ease of military operations.
The Inherent Vulnerability of the Defense Establishment
The Department of Defense has over 15,000 computer networks among 4,000 worldwide installations, and “approximately ninety-eight percent of U.S. government communications travel over civilian owned and operated networks.” And these networks are vulnerable. One of the conclusions of the 2013 DoD Task Force Report on Resilient Military Systems and the Advanced Cyber Threat noted that, “DoD red teams, using cyber attack tools which can be downloaded from the Internet, are very successful at defeating our systems.” If DoD can get into their own systems using publicly available technology, then bad actors can as well.
An additional facet of this problem is that the military must frequently collaborate with other U.S. government and civilian defense establishment networks that are just as vulnerable as military networks and often even more so. There are efforts underway to hold these different agencies and contractors to higher security standards, and they should be greatly accelerated. These systems get probed for vulnerabilities and are attacked countless times a day, a troubling reality considering that almost one million new malware threats are also released every day.
Two of the most prominent examples of cyber attacks against the government and defense establishment include the June 2015 attack against the U.S. Office of Personnel Management (OPM), and the theft of the design plans for the Joint Strike Fighter (JSF). Episodes like these quickly degrade any advantage the United States has over its competitors and potential adversaries. And these attacks do not only originate in a few countries; it has been documented that more than 100 foreign intelligence organizations have tried to gain access to U.S. networks. As the number of entities attempting to gain access to U.S. systems is unlikely to diminish, it is imperative that the United States develops more stringent protocols and higher security standards for their counterparts in private industry or these types of incidents will continue to occur.
Going forward, DoD finds itself in a challenging juxtaposition; they must share information across agencies and with companies to design and build new weapons systems and to plan for potential conflicts, but at the same time, it is this openness that makes them the most vulnerable. These existing vulnerabilities give foreign intelligence agencies, adversaries, and bad actors opportunities to exploit. The United States must remain vigilant and committed to stopping this threat. The bottom line to U.S. national security is that unless drastic measures are taken to secure these networks, the government, the military, and the nation will remain susceptible to perilous cyber attacks.
Andrew Poulin is a naval officer. The views expressed here are his own and do not necessarily reflect those of the Department of Defense or the Department of the Navy.
No comments:
Post a Comment