Lessons from the Military

Jay Heiser is a smart guy, but I don't know why he became so anti-military when he wrote Military mindset no longer applicable in our line of work last year. He wrote in part:

The business world should stop looking to the defense community for direction on information security.

I used to believe that the practice of information security owed a huge debt to the military. I couldn't have been more wrong...

The business world doesn't need the defense community to help it develop secure technology, and, whenever it accepts military ideas, it winds up with the wrong agenda...

It's time our profession stops playing war games and gets in touch with its business roots.

I found two responses, Opinion: Military security legacy is one of innovation, integrity and Opinion: The importance of a military mindset, countering Mr. Heiser. I also found poll results showing 77% of respondents answered "absolutely critical" or "somewhat important" when reading the question "How important is a military mindset when planning and executing an enterprise security strategy?"

Well, it's Friday night and you know what that means in the Bejtlich household. That's right, time to watch a new episode of Dogfights. I don't have any insights based on the episode I just watched, but it reminded me of training I received my first summer at Camp USAFA.

One of the exercises we ran involved Air Base Ground Defense. We learned some basic principles and then acted first as attackers and then defenders. It occurred to me that ABGD is in some ways similar to defending digital assets, although we digital security people are not armed. This denies us the capability of truly deterring and incapacitating threats. Attribution is also easier when the enemy is physically present.

Still, I'd like to do my part showing Mr. Heiser what business can learn from the military. Much of corporate America (and Germany, and Japan) seems to be having its lunch eaten by the Chinese dragon, so it's time to take some lessons from people who do security for a living when lives are at stake.

I decided to take a look at DoD Joint Publications and found Joint Tactics, Techniques, and Procedures for Base Defense. Just skimming it I found several very interesting sections. For example, the executive summary includes this:

The general characteristics of defensive operations are:

1. to understand the enemy;


2. see the battlefield;


3. use the defenders’ advantages;


4. concentrate at critical times and places;


5. conduct counterreconnaissance and counterattacks;


6. coordinate critical defense assets;


7. balance base security with political and legal constraints;


8. and know the law of war and rules of engagement.

I think digital non-military, non-police forces can do all of these except the counterattack portion of number 5. For that we need the military and police to act, or to have them deputize us. Notice numbers 1 and 2 imply monitoring, and number 4 implies being able to recognize critical times and places via digital situational awareness.

These items are displayed in the following graphic, which expands on number 3:



The document continues:

The primary mission of the base is to support joint force objectives.

In other words, the base does not exist to provide security. The base exists to perform "business functions."

Essential actions of the defense force are to detect, warn, deny, destroy, and delay. Every intelligence and counterintelligence resource available to the base commander should be used to determine enemy capabilities and intentions. The base commander must make the best use of the terrain within the commander’s AO [area of operation].

Again, we cannot destroy the enemy, but police and military can.

This final graphic displays some physical perimeter defense measures.



This graphic nicely displays principles like defense in depth. Notice also the "intrusion detection" system (labeled "sensor") and the "network forensics" system (labeled "video camera"). Visibility is provided by lighting. If you're a Jericho Forum fan, imagine these defenses collapsed around the host or even data.

I plan to take a closer look at this document and the Air Force version, AFI 31-301, Air Base Defense.

Read More

DoD Digital Security Spending

I found the article Is IT security getting short shrift? to be a good reference for other large organizations contemplating digital security spending. In addition to the chart above, this text is illuminating:

Despite the growing number of attacks on military networks, securing enough money for information assurance programs is still a hard sell at the Defense Department, former Pentagon officials say.

“It’s been the source of enormous frustration,” Linton Wells said in a recent interview in which he recounted some of the difficulties he faced during his four-year tenure as principal deputy assistant secretary of Defense for networks and information integration...

[C]onvincing senior budget officials from the military services to spend money in that area is a continuing challenge, Wells said.

“What they say is, ‘Look, we’re all short on money for things we want to buy — ships, planes, tanks, whatever. Show me how this $2 million you want to put on this today is going to turn cell C17 from red to yellow to green in 2011,’” Wells said. “And that’s often a hard thing to do in information assurance.”

Wells said officials in charge of putting together the information technology security budget for DOD’s networks need better metrics for measuring return on investment for information assurance programs.

“We have not done a good job of making the case that a dollar spent here is going to lead to a quantifiable increase there,” he said. (emphasis added)

I saw Dr. Wells speak at Black Hat Federal 2006.

I have three brief points.

First, I think the bold text is the problem. If I'm being asked to spend money to turn a spreadsheet cell different colors, of course I'm going to debate the value of that spending. The problem is that the metrics used in these situations largely don't matter.

Second, I would be interested in knowing how much of the DoD budget funds counter-intelligence activities. The majority of the serious problems DoD faces have a counter-intelligence function. The intent of the adversary's activities are no different now than they were in pre-Internet days. How much has historically been spent on stopping spies?

Third, it is sad to continue to see security treated as a separate function that has to justify its own existence in financial terms. Security does not make any money so it cannot possibly compete against business projects which do. This is not strictly the case in DoD because none of the military makes money, but it is certainly true of civilian industries.

Read More

Who Needs CISSP for Ethics?

Last year I discussed the value of the CISSP with respect to its code of ethics. Today while renewing my ISSA membership, I was presented with the following:

The primary goal of the Information Systems Security Association, Inc. (ISSA) is to promote practices that will ensure the confidentiality, integrity, and availability of organizational information resources. To achieve this goal, members of the Association must reflect the highest standards of ethical conduct. Therefore, ISSA has established the following Code of Ethics and requires its observance as a prerequisite for continued membership and affiliation with the Association.

As an applicant for membership and as a member of ISSA, I have in the past and will in the future:

* Perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles;
* Promote generally accepted information security current best practices and standards;
* Maintain appropriate confidentiality of proprietary or otherwise sensitive information encountered in the course of professional activities;
* Discharge professional responsibilities with diligence and honesty;
* Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association; and
* Not intentionally injure or impugn the professional reputation of practice of colleagues, clients, or employers.

Please check the box indicating you have read the above statement and agree to its principles:

It looks to me like ISSA has the ethics bases covered. If I agree to that statement, I get as much value as being a CISSP as far as ethics goes.

Unfortunately, misdirected efforts like DoD 8570.1 attach significance to the CISSP out of all proportion to its worth.

Read More

Air Force Cyberspace Command

According to Air Force Link, 8th Air Force will become the new Air Force Cyberspace Command. This appears to be the next step following the creation of a Air Force Network Operations Command structure in August. That came on the heels of the Air Force Information Warfare Center being redesignated as the Air Force Information Operations Center. That was a result of the Air Force Tactical Fighter Weapons Center being redesignated as the Air Force Warfare Center. In a related move, the former 67th Information Operations Wing is now the 67th Network Warfare Wing. Follow all that?

It also appears the Air Force is centralizing control of network operations and security centers, according to this article:

All Air Force network operations security centers, which were previously decentralized among the major commands, will consolidate under the 67th with the stand-up of two integrated network operations and security centers, or I-NOSCs, located at Langley AFB, Va., and at Peterson AFB, Colo.

Apparently the former AFCERT, now the Air Force Network Operations and Security Center Network Security Division (AFNOSC NSD) in San Antonio, TX, is adding 191 MacAulay-Brown contractors.

For some higher level insights into these changes, the latest version of AFI 33-115v1: Network Operations (.pdf) might be interesting.

Returning to the creation of the new Cyberspace Command -- remember the Air Force was once part of the United States Army. I see no reason why the United States should maintain independent services that fight on land, sea, air, and space, but have cyber forces scattered throughout the other services. (You might make the counter-argument that each service maintains its own "air forces," but these support their parent service.)

I think within my lifetime we will see an independent Cyber Force to centralize information warfare capabilities alongside the Army, Navy, Air Force, and Marines. If it happens within the next 10 years, I think Col Greg Rattray might be in charge. (Yes, I'm assuming he continues to be promoted!) Before that happens, I'd like to see the new Cyberspace Command sponsor a new Air Force Specialty Code (AFSC) for information warriors. The current Intel or Comm paradigm isn't suitable.

Read More

Thoughts from IATF Meeting

I try to attend meetings of the Information Assurance Technical Forum once a year. I last visited in 2003 and 2005. The following are some thoughts from the meeting I attended two weeks ago. They are not an attempt to authoritatively summarize or describe years of net-centric thought and work by the US Department of Defense. These are just a few thoughts based on the presentations I saw in an unclassified environment.



Prior to seeing this diagram I had heard a lot about "net-centric warfare" but I had no real grasp of the underlying. It seemed more of a buzzword. Now I understand the idea of getting information from any source to the people who need it, instead of, say Air Force sensors sending data to Air Force decision-makers who feed Air Force assets.



Given the net-centric model, DoD needs to move away from a "System High" model of security to a "Transactional" model. In the System High world, you essentially define a perimeter by classification (e.g., "Secret"), build a network for that classification (e.g., SIPRNET), and let anyone with a Secret clearance see anything on SIPRNET. This is procedure-based security at its best (actually, it's worst).



This figure shows how DoD wants to transition from the existing model to the new model. It's moving away from the current "baseline" in "increments," starting with Increment 1. Completion of Increment 1 is expected with the conclusion of the next five-year DoD plan, lasting 2008-2013 (!).

DoD's experience with coalition warfare in Iraq and Afghanistan is driving these changes. One example involved the need to establish a separate network for every coalition partner. In one so-called "coalition village," DoD had to build 14 separate networks (US-UK, US-Poland, US-Italy, etc.). This is obviously costly and time-consuming. In the new model, these coalition partners will share one network but have access regulated by the transactional security model. Virtualization and Digital Rights Management are going to be key for implementing these ideas.



This figure explains the layers present in the Enterprise Sensor Grid, and the idea that DoD is moving away from a strictly perimeter-based monitoring model to one that reaches all the way to end hosts.

One of the briefers offered a set of metrics that I found interesting.

• % of Red Team simulated attacks that are successful


• % of remote access to DoD information systems and DoD access to the Internet regulated by positive technical controls such as proxy services and screened subnets
  (DMZs)


• % of DoD systems and applications that conform to the DoD Ports, Protocols, and Service Policy


• % of standardized and approved IA and IA enabled COTS products available to protect DoD sensitive and classified data (vs. GOTS)


• % of NIPRNet Traffic that is encrypted

I found the first metric to be especially interesting because the DoD uses it to measure the number of attacks they are missing. In other words, DoD (wisely) understands that it doesn't detect all attacks. They use Red Team exercises to estimate the number of attacks they don't detect. This is exactly the sort of metric I believe to be useful. DoD also measures (and wants to vastly decrease) the amount of time needed to detect and respond to intrusions. Again, they base their metrics on Red Team exercises.

I left the conference with a few concerns. First, I heard an emphasis on "pushing systems to DMZs." The idea is to remove systems accessible to the public or coalition partners out of internal networks and into DMZs. While I agree that security zones are important, I wondering if DoD is fighting the last war again. Server-side attacks were the predominant model of the 1990s, bleeding somewhat into this decade. For the last three or four years, however, client-side attacks have been all the rage. DoD is moving to persistent and then pervasive monitoring (which includes end hosts), but I hope they don't ignore client-side vulnerabilities. On the other hand, the rise of Web Services might reinvigorate DMZ-focused security.

After hearing one briefer joke about not understanding so-called "honey" technologies (honeypots, etc.) I worried that some of these decision-makers don't understand the attacks facing DoD networks. They of course understand the threat, because those groups change but not as quickly as the tools and techniques they employ. Keeping up with the vulnerabilities and ways to exploit them is extremely challenging, and does not map at all to five-year plans.

A second problem involves the so-called "black core." This is an encrypted network which will eventually dominant the DoD enterprise security model. This is similar to Microsoft's reported internal use of IPSec everywhere.

The black core emphasizes confidentiality, and to a certain degree integrity. It seems to sacrifice visibility. An IATF attendee made this point in a question. If just about everything is encrypted, what's the point of network-based monitoring? One of the speakers replied that flow-based monitoring (i.e., analyzing session data) will still be helpful, but sessions only take you so far. I wonder if DoD might implement some "visibility taps" that decrypt-inspect-encrypt at various points in the black core?

Speaking of encryption, crypto appeared to be a major factor in DoD plans. This isn't surprising, given the IATF's sponsor. Still, most security incidents don't happen because of failed crypto. Intrusions are often the result of improper configuration and operation. I didn't hear much about addressing those problems, yet I heard that DoD is cutting IA personnel and funding!

Third, IPv6 wasn't formally mentioned in any of the presentations. An attendee had to ask about it specifically. An audience member from the Office of the Secretary of Defense said IPv6 would work with DoD's plans, but I think the audience was skeptical.

Finally, DoD is relying heavily on vendors to build the equipment and technology needed to implement its vision. Ideas of "protecting data in transit" (PDIT) and "protecting data at rest" (PDAR) are great concepts, but implementation questions remain. DoD also seemed not interested in data stored outside of its own systems. An attendee questioned how DoD is going to handle that concern, but it appears to have been largely ignored. This is a growing issue as we approach the end of this decade, and I predict it will be a major issue in the next decade.

Incidentally, while driving to the IATF meeting I listened to a story on NPR about Boeing's plans for border security. One of the engineers in the story talked about the false positive problems caused by tumbleweed! Maybe I should consider investigating cross-discipline intrusion detection problems (i.e., digital, financial, homeland security, and so on)?

References

• Net-Centric Environment Joint Functional Concept (.pdf)


• IA Component of the GIG Version 1.1 (.ppt)


• Enterprise Sensor Grid (.ppt)

Read More

DoD Certification Program Update

I've had a chance to read issues of Federal Computer Weekly delivered while I was on vacation. I like reading FCW because it gives me some insight into the madness found inside the Beltway.

I enjoyed reading Wanted: Information assurance-savvy people, which discussed DoD's plans for certifying IT staff. I've examined this issue before. Here's a quote by someone who understands the problems with DoD's plan:

Alan Paller, director of research at the SANS Institute, said DOD should have no problem meeting its initial target of 80,000-plus employees trained and accredited in information assurance. But he doesn’t think the baseline certification that DOD requires will produce a workforce capable of securing the military’s systems.

“The problem is that the bulk of the certifications don’t teach people how to do security,” Paller said. “Certified people will be able to talk about security, but they won’t know how to do it — to actually encrypt data and do the necessary work.”

Instead, DOD needs a way to evaluate actual information assurance work, Paller said. That requires hand-on training and scenario-based testing, he added.

Alan is absolutely right. A DoD certification program which accepts the CISSP as the top technical certification indicates the program designers are absolutely clueless.

Speaking of clueless:

Robert Lentz, DOD’s director of information assurance, said he respects Paller’s opinion but is not worried that the program is headed in the wrong direction. The important thing is to get baseline certifications awarded and then work from there, Lentz said.

Assuming the reported depicted Mr. Lentz's words accurately, I am extremely disappointed by this opinion. This attitude sounds to me like the following: "Who cares if our program is wrong? Let's just get it started." That is a recipe for failure, especially considering this quote from the article:

DOD’s success with IA training and certification could have wider implications, said Jim Flyzik, president of the Flyzik Group, a consulting firm. If successful, DOD’s approach would probably be adopted in other areas of government, he said.

Great. DoD starts down the wrong path, and the rest of the government follows? Ouch.

Read More

FCW Reports DoD to Hold Security Stand-Down

I read that DoD plans to hold a security stand-down on 29 November "to focus on information assurance and network security." Apparently United States Strategic Command, one of nine Unified Commands, issued the order. The news came from Air Force Lt. Gen. Charlie Croom, director of the Defense Information Systems Agency and commander of the Joint Task Force - Global Network Operations (JTF-GNO).

FCW says "some DOD officials are concerned about the amount of hardware and software manufactured overseas and whether they might incorporate malicious code. [Croom] said one way to fight the problem is to require companies to assure DOD that their products are safe and for the military to monitor them closely." (emphasis added)

I like the fact Lt Gen Croom understands the importance of monitoring.

A separate article conveys this story, indicating Lt Gen Croom is a fair guy:

"The first time Croom showed up for a meeting at DISA, someone announced his presence and everyone in the room snapped to attention, as they did with previous DISA commanders, a headquarters employee said.

Croom told everyone at the meeting that that was the first and last time anyone was to announce him and have everyone stand at attention."

That's amazing. I have seen commanders institute similar policies on operations floors, but generally you're expected to stand when the commander enters a meeting room.

The FCW article did not say much about what constitutes a network "stand-down," other than "changing passwords" and "conduct[ing] certain activities to strengthen and become more aware of network security." Can anyone elaborate on this? A department-wide password change sounds like an immense incident response action. I believe we instituted a similar action once when I was still in uniform.

Typically stand-downs are held in the flying community when an aircraft crashes due to a mechanical problem. The rest of the community wants to verify that their aircraft are not also afflicted. I believe the Titan Rain intrusions may be the "crash" that prompted this stand-down. FCW reports "Croom said DOD networks are being intruded on. 'The enemy is among us,' he said."

Read More