Lessons from the Military

Jay Heiser is a smart guy, but I don't know why he became so anti-military when he wrote Military mindset no longer applicable in our line of work last year. He wrote in part:

The business world should stop looking to the defense community for direction on information security.

I used to believe that the practice of information security owed a huge debt to the military. I couldn't have been more wrong...

The business world doesn't need the defense community to help it develop secure technology, and, whenever it accepts military ideas, it winds up with the wrong agenda...

It's time our profession stops playing war games and gets in touch with its business roots.

I found two responses, Opinion: Military security legacy is one of innovation, integrity and Opinion: The importance of a military mindset, countering Mr. Heiser. I also found poll results showing 77% of respondents answered "absolutely critical" or "somewhat important" when reading the question "How important is a military mindset when planning and executing an enterprise security strategy?"

Well, it's Friday night and you know what that means in the Bejtlich household. That's right, time to watch a new episode of Dogfights. I don't have any insights based on the episode I just watched, but it reminded me of training I received my first summer at Camp USAFA.

One of the exercises we ran involved Air Base Ground Defense. We learned some basic principles and then acted first as attackers and then defenders. It occurred to me that ABGD is in some ways similar to defending digital assets, although we digital security people are not armed. This denies us the capability of truly deterring and incapacitating threats. Attribution is also easier when the enemy is physically present.

Still, I'd like to do my part showing Mr. Heiser what business can learn from the military. Much of corporate America (and Germany, and Japan) seems to be having its lunch eaten by the Chinese dragon, so it's time to take some lessons from people who do security for a living when lives are at stake.

I decided to take a look at DoD Joint Publications and found Joint Tactics, Techniques, and Procedures for Base Defense. Just skimming it I found several very interesting sections. For example, the executive summary includes this:

The general characteristics of defensive operations are:

1. to understand the enemy;


2. see the battlefield;


3. use the defenders’ advantages;


4. concentrate at critical times and places;


5. conduct counterreconnaissance and counterattacks;


6. coordinate critical defense assets;


7. balance base security with political and legal constraints;


8. and know the law of war and rules of engagement.

I think digital non-military, non-police forces can do all of these except the counterattack portion of number 5. For that we need the military and police to act, or to have them deputize us. Notice numbers 1 and 2 imply monitoring, and number 4 implies being able to recognize critical times and places via digital situational awareness.

These items are displayed in the following graphic, which expands on number 3:



The document continues:

The primary mission of the base is to support joint force objectives.

In other words, the base does not exist to provide security. The base exists to perform "business functions."

Essential actions of the defense force are to detect, warn, deny, destroy, and delay. Every intelligence and counterintelligence resource available to the base commander should be used to determine enemy capabilities and intentions. The base commander must make the best use of the terrain within the commander’s AO [area of operation].

Again, we cannot destroy the enemy, but police and military can.

This final graphic displays some physical perimeter defense measures.



This graphic nicely displays principles like defense in depth. Notice also the "intrusion detection" system (labeled "sensor") and the "network forensics" system (labeled "video camera"). Visibility is provided by lighting. If you're a Jericho Forum fan, imagine these defenses collapsed around the host or even data.

I plan to take a closer look at this document and the Air Force version, AFI 31-301, Air Base Defense.