Cybercom Commander Calls

02/13/2013 02:00 PM CST             Thu, Feb 14, 2013 at 1:40 AMCybersecurity Order First Step
By Army Sgt. 1st Class Tyrone C. Marshall Jr.
American Forces Press ServiceWASHINGTON, Feb. 13, 2013 - The cyber security policy President Barack Obama announced during his annual State of the Union address is a step toward protecting the nation's critical infrastructure, the commander of U.S. Cyber Command said here today.

Army Gen. Keith B. Alexander, also director of the National Security Agency, joined senior U.S. officials from the White House and the Commerce and Homeland Security departments to discuss strengthening the cybersecurity of the country's critical infrastructure.

"We need a way of sharing information between government and industry -- both for information sharing and hardening our networks," he said. "I think what we're doing in the executive order tackles, perhaps, the most difficult issue facing our country: How do we harden these networks when, across all of industry and government, those networks are in various states of array? We've got to have a way of reaching out with industry and with government to solve that kind of problem."

The general said the new cybersecurity policy is important to strengthening the country's defenses against cyberattacks. "The systems and assets that our nation depends on for our economy, for our government, even for our national defense, are overwhelmingly owned and operated by industry," he explained. "We have pushed hard for information sharing."

Private-sector companies have the information they need to defend their own networks in a timely manner, he said. "However, information sharing alone will not solve this problem," he added. "Our infrastructure is fragile." The executive order Obama signed to put the new cybersecurity policy into effect sets up a process for government and industry to start to address the problem, the general said.

But although the president's new executive order helps to bring about some solutions, Alexander said, it isn't comprehensive.

"This executive order is only a down payment on what we need to address the threat," he said. "This executive order can only move us so far, and it's not a substitute for legislation. We need legislation, and we need it quickly, to defend our nation. Agreeing on the right legislation actions for much-needed cybersecurity standards is challenging."

The executive order is a step forward, though, because it creates a voluntary process for industry and government to establish that framework, Alexander said.

"In particular, with so much of the critical infrastructure owned and operated by the private sector, the government is often unaware of the malicious activity targeting our critical infrastructure," he said. "These blind spots prevent us from being positioned to help the critical infrastructure defend itself, and it prevents us from knowing when we need to defend the nation."

The general noted government can share threat information with the private sector under this executive order and existing laws, but a "real-time" defensive posture for the military's critical networks will require legislation removing barriers to private-to-public sharing of attacks and intrusions into private-sector networks.

"Legislation is also necessary to create incentives for better voluntary cooperation in cyber standards, developments and implementation," he said, "and to update and modernize government authorities to address these new cyber threats."

Alexander warned that potential cyber threats to the United States are very real, pointing to recent examples.

"You only have to look at the distributed denial-of-service attacks that we've seen on Wall Street, the destructive attacks we've seen against Saudi Aramco and RasGas, to see what's coming at our nation," Alexander said. Now is the time for action, he said, and the new executive order takes a step in implementing that action.

In his role as director of the NSA, Alexander said, he is fully committed to the development of the cybersecurity framework.

"We do play a vital role in all of this, and in protecting DOD networks and supporting our combatant commands and defending the nation from cyber-attacks," he said. "But we can't do it all. No one agency here can do it all. It takes a team in the government."

And the government cannot do it by itself, either, he added. "We have to have government and industry working together as a team," he said.

Biographies:
Army Gen. Keith B. Alexander 

Related Sites:
Executive Order: Improving Critical Infrastructure Cybersecurity
Special Report: Cybersecurity 
U.S. Cyber Command 

Panetta Warns Cyber Threat Growing Quickly

02/06/2013 01:46 PM CST                          Thu, Feb 7, 2013 at 1:22 AMThe next Pearl Harbor could be a cyber attack
By Karen Parrish
American Forces Press Service
WASHINGTON, Feb. 6, 2013 - Pentagon officials are concerned about the growing threat of cyber warfare, Defense Secretary Leon E. Panetta told a Georgetown University audience today.

Following a speech on leadership and government this morning, the secretary responded to questions from the audience. All were from Georgetown students, one of whom asked Panetta if "cyber warfare ... will be a viable and important part of future U.S. defense policy?"

"The developments that have taken place in the cyber arena have been incredible over these last 10 years," the secretary responded, noting that 21st-century technology makes cyber attacks a primary threat to U.S. national security.

"There is no question, in my mind, that part and parcel of any attack on this country in the future, by any enemy, is going to include a cyber element," he said.

The secretary, who is expected to retire this month, has warned of cyber attacks' potential "crippling" effect on government, financial and commercial networks with increasing intensity throughout his nearly two-year tenure since leaving his post as CIA director to head the Defense Department.

When the Cybersecurity Act of 2012 stalled in the Senate in November, the Pentagon released a statement expressing Panetta's disappointment.

In that statement Pentagon Press Secretary George Little said, "The U.S. defense strategy calls for greater investments in cybersecurity measures, and we will continue to explore ways to defend the nation against cyber threats."

New legislation would have enhanced those efforts, Little said, adding, "If the Congress neglects to address this security problem urgently, the consequences could be devastating."

In today's remarks, Panetta again urged Congress to act to enhance the department's cyber capabilities. U.S. defense strategy considers cyber potential in planning "how we will go after an enemy," he told today's audience during the question-and-answer period.

"So, yes, we are living in that world," the secretary said. "I believe that it is very possible the next Pearl Harbor could be a cyber attack ... [that] would have one hell of an impact on the United States of America. That is something we have to worry about and protect against."
Biographies:
Leon E. Panetta

Related Articles:
Panetta 'Disappointed' as Cyber Legislation Stalls
Air Force Space Command to Bolster Cyber Force 
Officials: Cyber Research Needs Innovation, Talent 

-----------------------

DOD Reviews Cyberspace Rules of Engagement

Dangers are not something new in cyberspace 

By Cheryl Pellerin American Forces Press Service WASHINGTON, March 20, 2012 - Whether by land, sea or air, Defense Department leaders have long crafted rules of engagement to determine how, where and when they can attack the enemy. They expect soon to complete the same for their newest domain: cyberspace, the assistant secretary of defense for global strategic affairs said today. "We are working closely with the Joint Staff on the implementation of a transitional command-and-control model for cyberspace operations" while reviewing existing rules of engagement, Madelyn R. Creedon told the House Armed Services Committee's subcommittee on emerging threats and capabilities. Teresa M. Takai, DOD's chief information officer, and Army Gen. Keith Alexander, commander of U.S. Cyber Command, joined Creedon at the hearing. "This interim framework," Creedon told the panel, "will standardize existing organizational structures and command relationships across the department for the application of the full spectrum of cyberspace capabilities." Describing DOD's strategies for operating in cyberspace, Creedon said the department maintains more than 15,000 network enclaves and 7 million computing devices in installations around the globe. "DOD continues to develop effective strategies for ensuring the United States is prepared for all cyber contingencies along the entire spectrum," she added, "from peace to crisis to war." In times of fiscal constraint, Creedon said, DOD also is taking advantage of efficiencies provided by information technology advances. "The department has been working around the clock, often in close cooperation with the Department of Homeland Security and other agencies," she said, to protect the nation from cyber threats that include the theft of intellectual property, as well as damage to the defense industrial base, the economy and national security. The department hit a "significant milestone" last July with the release of its first strategy for operating in cyberspace, Creedon said. The document builds on President Barack Obama's International Strategy for Cyberspace and the DOD Quadrennial Defense Review, and guides the department's military, business and intelligence activities in cyberspace in support of national interests, she said. The DOD works closely with colleagues in the departments of Homeland Security, Justice, State, Treasury, Commerce and other agencies, she added, and pursues bilateral and multilateral engagements to enhance security and develop norms of behavior in cyberspace. Takai told the panel that DOD's $37 billion information technology budget request for fiscal year 2013 includes a range of IT investments, including $3.4 billion for cyber security efforts to protect information, information systems and networks against known cyber vulnerabilities. It also includes $182 million for Cyber Command for cyber network defense, cryptographic systems, communications security, network resiliency, workforce development, and development of cyber security standards and technologies department-wide. Among efforts to improve effectiveness and efficiency, Takai explained, "is consolidation of the department's IT infrastructure, networks, computing services, data centers, application and data services, while simultaneously improving the ability to defend that infrastructure against growing cyber threats." Her office is leading the implementation of the initiatives, the chief information officer added, "but it is important that we work closely with the services, Joint Staff and U.S. Cyber Command to more aggressively modernize our overall information systems." A pillar of that modernization is a move to a single, joint network architecture, Takai said, allowing DOD and Cyber Command better visibility into network activity and better defense against cyber attacks. Individually, she said, the services and agencies have taken action to better position the information enterprise and security posture. The department has made significant progress in several areas, Takai said. One effort involved deploying a modular system called a host-based security system that enhances situational awareness of the network and improves the ability to detect, diagnose and react to cyber intrusions. "We've also taken the lead in assessing the risk of the global supply chain to our critical information and communications technology," Takai added, and has instituted a successful defense industrial base cyber security and information assurance program. Alexander said cyber defense requires contributions not only from DOD, but from Homeland Security, the FBI, and the Defense Information Systems Agency -- "all key partners in helping us do our cyber mission." Cyber space is becoming more dangerous, he added. "The intelligence community's worldwide threat brief to Congress in January raised cyber threats to just behind terrorism and [nuclear] proliferation in its list of the biggest challenges facing the nation." The task of assuring cyberspace access, the general said, "has drawn the attention of our nation's most senior leaders over the last year and their decisions have helped to clarify what we can and must do about developments that greatly concern us." Cyber Command is specifically charged with directing the security, operation and defense of DOD's information systems, he added, "but our work and actions are affected by threats well outside DOD networks ... threats the nation cannot afford to ignore." Dangers are not something new in cyberspace. "Nation-state actors in cyberspace are riding a tide of criminality," the general said. "Several nations have turned their resources and power against us and foreign businesses and enterprises, even those that manage critical infrastructure in this country, and others." For the panel, Alexander described five key areas Cyber Command is working on: -- Building the enterprise and training the force; --Developing a defensible architecture; --Getting authorities needed to operate in cyberspace; --Setting the teamwork properly across U.S. government agencies; and --Creating a concept of operations for operating in cyberspace. "I think we're making progress," Alexander said, "but ... the risks that face our country are growing faster than our progress and we have to work hard on that."

Biographies: Army Gen. Keith Alexander Madelyn R. Creedon Teresa M. Takai Related Sites: Special Report: Cyber Security