Much of the military's weapons systems have the ability to be connected to computers for diagnostic testing, software updates and myriad other functions. A heavy dose of criticism has been levied against the military in recent years for lack of awareness and planning in shoring up the security of these systems. Recently, budgeteers adjusted millions to embark on an effort aimed at identifying all cyber vulnerabilities in weapons systems.
The Air Force has gone as far as to take a systems engineering approach to bolstering the security of its systems and increase understanding of a cyber campaign plan, said Gen. Ellen Pawlikowski, commander of Air Force Materiel Command, at the Air Force Association’s Air, Space and Cyber Conference on Sept. 21.
Within the plan, Pawlikowski explained, there were initially four lines of attack to get at this problem of identifying and solving vulnerabilities, but it soon evolved to seven.
1. Mission thread analysis.
“What we mean by this is we’re really accomplishing in the Air Force … execution of the mission,” she said. “So instead of taking a platform focus to cyber we took a mission focus to it. So let’s look at what needs to be threaded together for us to accomplish a mission, and then along that thread where are the cyber vulnerability surfaces.”
When you look through the mission thread that it takes to conduct a global precision attack, Pawlikowski said, there are cyberthreat surfaces all over the place.
This first line of attack also hones in on and works to identify all vulnerabilities in these chains.
2. Baking in security to future weapons systems.
Pawlikowski said she wants to be able to bake in cybersecurity from the beginning — which includes cyber resiliency and hardening — of weapons systems because “we don’t want to have to scab it on” later.
3. Develop, attract and foster the proper cyber expertise.
The Air Force wants to bring in cybersecurity experts and engineers, Pawlikowski said, adding that the service is standing up training programs to educate all airman to be cyber aware. The educational aspect aims to do away with the notion that it’s just 24th Air Force — the Air Force’s official cyber component — that does cyber, as everyone is linked and responsible for cybersecurity.
4. Making weapons systems more capable and resilient.
One of the key items the team identified, she said, is the ability to be agile and adaptable in weapons systems. Cyberthreats move quickly and the force must be able to respond kind. It is not feasible to take 10 years to change out the GPS or navigation equipment in an airplane if there’s a cyberthreat that has been able to negate the ability to use GPS, she said.
As a result, one of the activities the force is branching off is open mission systems, which will enable a plug-and-play capability that’s not tied to a proprietary solution, but rather taking something developed to one weapons system and applying it to another system at a low cost.
5. Creating a common framework for which to talk about and understand security.
Pawlikowski described how there are a variety of terms and ways of understanding systems, so this line of attack is about establishing a common security environment to create a classification guide so everyone is familiar with a common vocabulary and common understanding to enable the full spectrum of life cycle management of cyber systems in a secure way.
6. Securing older systems still in use.
This line of attack, according to Pawlikowski, is about going back and looking at each of the vulnerabilities identified with a cyberattack surface from line of attack One and figuring out how to close that surface in the current environment with limited resources.
7. Intel.
Intelligence is important because, as Pawlikowski explained, in the past defenses have been based upon an expectation of what the adversary was going to do, leading to pushback to the effect of: “Come on, are they really going to be able do that?”
In cyberspace, intelligence is even more important, she said, adding that there needs to be cyber intelligence as part of this solution to understand where the threat is going to be.
“We’re not going to get it right all the time but ... we can’t try to defend against what our own creativity” says the adversary will do, she added. Related to this effort, the Air Force is working to put analysts and tools in place to get the right information to bake in security, defend what it has, build engineering tools and train, all aimed at supporting the other lines of attack.
No comments:
Post a Comment