Cyber (PDF) by xiuliliaofz

VIEWS: 10 PAGES: 6

									FEATURE




         Hacktivists,Worms
         and Cyber Attacks
         Preparing Officers for Cyber Warfare
12   SHIPMATE
                                                    It is happening every day, every hour, every minute, every
                                              “
                                              second,” said Rear Admiral Michael A. Brown ’80, USN, director
                                              of Cybersecurity Coordination in the National Protection and
                                              Programs Directorate for the Department of Homeland Security.
                                              “There are multiple things that occur against our government
                                              networks and against our private sector networks that are
                                              malicious in intent.They can range from a small event to major
                                              events that consume an enormous amount of time and significant
                                              resources.The amount of criminal activity is phenomenal.”
                                                   Admiral Brown said the recent creation of the Center for
                                              Cyber Security Studies (CSSS) at the Naval Academy is critical
                                              not only for the Navy but for the country as a whole.
                                                   “Cyber security is a critical component to the fabric of our
                                              economic and national security.What we need are individuals
                                              who are technically competent and understand the environment
                                              in which we live day in and day out. And we need leaders.
                                              Obviously that’s what the Naval Academy delivers, not just for
                                              the Navy but for the nation,” he said. “The creation of the
                                              center is a recognition of how important this mission is and
                                              the type of leaders that we need.The Academy is a great place
                                              to locate a Center for Cyber Security Studies and to develop
                                              future leaders with the technical skills and the operational
                                              understanding of the environment we live in.”
                                                   The center’s inaugural director, Captain Steven Simon,
                                              former commander of the Naval Communications Material
                                              Security System at Andrews Air Force Base, came on board
                                              over the summer to gear up for an introductory cyber security
                                              course that became mandatory for Plebes this past fall.
                                              A junior-level cyber course will be taught beginning in the
                                              2013-14 academic year.
                                                   “When I say the Center for Cyber Security Studies is key,
                                              it is frankly the first step for our future naval officers in a long
                                              process of being exposed to education and training that they
                                              need to have throughout their careers,” Admiral Brown said.
                                                   He said a building to house the CCSS envisioned
By Kimberly Link-Wills                        between Rickover Hall and Nimitz Library would be the
                                              first of its kind among the service academies. But, Admiral
RIGHT NOW SOMEONE SOMEWHERE IN THE            Brown noted, all U.S. service academies are developing cyber
                                              education strategies.
WORLD IS TRYING TO INFECT A COMPUTER IN
                                                   “My particular role as the director of cyber security
THE UNITED STATES WITH MALICIOUS SOFTWARE.    coordination is to work hand-in-hand with the Department of
IT IS ONE OF AN ESTIMATED 600,000 ATTEMPTED   Homeland Security and the Department of Defense,” Admiral
                                              Brown said. “We are not going to be successful as a nation
CYBER INTRUSIONS OCCURRING EVERY MONTH
                                              unless we bring to bear all the capabilities that we have and all
IN THIS COUNTRY.                              the authorities that we have.”



                                                                              January-February 2012           13
FEATURE

    According to Admiral Brown, the scope of cooperation             ranged from the New York Stock Exchange to the Church of
increased significantly with the multi-prong Comprehensive           Scientology, from the FBI to PBS.
National Cyber Security Initiative announced in December                 Intrusion detection techniques are vital weapons against
2007 and the Cyberspace Policy Review released by President          cyber threats from hacktivists, criminals and nation-states.
Barack Obama in May 2009. “That not only mandated a                      In 2010, Stuxnet, a computer worm that bored through
closer working relationship among departments and agencies,          Microsoft Windows, posed a significant threat to industrial
it highlighted the threat and the need to not only cooperate         control systems around the globe. Admiral Brown said when
but to operate together,” he said.                                   Stuxnet, which Wired magazine called “the most menacing
    Admiral Brown outlined the three major types of cyber            malware in history,” was detected, mitigation tools that included
threats. “A nation-state for whatever reason may be looking to       software patches were distributed to protect industrial control
conduct operations against our economic or national security.        systems from further infiltration.
The second is criminal activity. That can have different motives.        “That’s an example of where we identified the specific
Then the third comes from the ‘hacktivists.’ It used to be that we   threat, identified the industrial control systems that were
were concerned with single individuals who were on a particular      vulnerable to that threat and then disseminated the mitigation
bent.What the world has seen over the last year is the grouping      techniques needed to not only reduce but prevent the activity
of these hacktivists together into organizations that are focused    from occurring,” Admiral Brown said.
on specific things, like disruption, and that’s become a major           U.S. cyber forces also are concerned with “spearfishing,”
threat and consumer of our cyber security efforts.”                  one of the threat vectors used by adversaries that can catch
    Notorious hacktivist groups include Anonymous and                consumers in their nets.
LulzSec, Admiral Brown said.Their reported targets have
      “You’re receiving an email from me and it’s got an
attachment, except I didn’t send you an email.When you open
it, the attachment is full of malicious software.That malicious
software allows the sender to take control of your banking
account,” Admiral Brown said. “Then you’ve got folks sending
emails that are asking for help or offering the best deal you can    Land, Sea, Air, Space and Beyond
possibly get on a 60-inch TV. If you click on that link, you         In the complex world of 21st century warfare that Naval Academy
download some malicious software and before you know it              graduates will face as junior officers, cyber security has emerged
bad things have happened.We put out from a DHS perspective           as a required professional expertise, and one that will require
regular warnings and best practices on what to do to prevent         additional undergraduate preparation for midshipmen at the
yourself from becoming a victim.                                     Academy. Private gifts made through the Naval Academy
      “Part of what we’re trying to do is make all the citizens of   Foundation have provided the Academy the flexibility to start up
the U.S. better consumers of the technology that’s available,”       ambitious new curriculum initiatives in this academic discipline.
he said. “We have a campaign called ‘Stop.Think. Connect.’              The Center for Cyber Security Studies (CCSS), now under the
                                                                     direction of Captain Steven J. “Doc” Simon, USN, was established
An example I give is: I love Lady Gaga. I love her music. If
                                                                     in December 2009. The CCSS leads curriculum development in
Lady Gaga were to send me an email, I’m going to stop. She
                                                                     information assurance and cyber security, coordinates cyber-related
doesn’t know who I am. She doesn’t have my email address.
                                                                     faculty research and midshipmen internships, and hosts
I’m going to stop, then I’m going to think about it.This is          conferences and a speaker series with prominent cyber security
probably someone who is trying to do something to me. So             experts. In the fall 2011 semester, 600 fourth class midshipmen
before I connect, I’m going to make that decision. In this case,     began taking the first cyber security course offered at the Naval
I’m not going to connect. Now if my mother sends me an               Academy. This core course, required for all plebes, equips
email that’s about Lady Gaga, first I might be a little concerned    midshipmen to recognize and respond to elementary cyber
that she knows who Lady Gaga is.Then I’m probably going to           threats and teaches basic technical skills. A second core course
connect because she knows that I like Lady Gaga.”                    now under development and scheduled to be required in second
      But it isn’t Lady Gaga’s music that keeps Admiral Brown        class year will have a stronger electrical engineering emphasis
awake at night.                                                      and explore offensive as well as defensive cyber operations.
                                                                        Although there is wide consensus in the Department of
      “What keeps me up are the ever-changing techniques and
                                                                     Defense and the Navy regarding the criticality of cyber security, it
tactics that are used and our ability to stay ahead of them,” he
                                                                     will nevertheless be several years before significant appropriated
said. “You need to understand how pervasive and advanced the
                                                                     funding can be applied to this initiative. Private gifts, from individuals
threat is. But you also have to recognize that we have the ability   and from corporate and foundation sources, will provide important
to reduce that risk and take action to protect our intellectual      resources to fill this gap. As well, gift funds will afford the Center
property, our national security. That’s what keeps me up because     the ability to offer educational opportunities in this important
it’s a tall order.There are lots of moving parts.We need to make     area beyond what will be possible with federal funding alone.
sure that those parts are always oiled and working together.”        Significant philanthropic support for the Center has already been
      Those parts include the DHS, DoD, Navy and the Naval                                                  .
                                                                     received from Commander David T Leighton ’46, USNR (Ret.), and
Academy. Admiral Brown said it is vital that every midshipman        SAIC. Two Academy classes, ’85 and ’94, have already embarked
has a foundation in cyber security and understands the technology    on fundraising projects that will support the CCSS, and several
to help defend the country, its corporations and its citizens.       other classes are considering similar projects. The scope of the
      Rear Admiral Margaret “Peg” Klein ’81, USN, said the           cyber curriculum at the Academy will significantly exceed the
                                                                     physical space now available for the program. Exploratory design
Navy is investing heavily in cyber security. She is the chief of
                                                                     studies for a new building that would house the Center are under
staff for U.S. Cyber Command, established in June 2009 and
                                                                     way, and it is likely that a construction project of this magnitude
stood up at Fort Meade 11 months later.
                                                                     will require both public (appropriated) and private funding.
      “The Department of Defense invested a significant amount          Evolving the Center into a world-class leader in undergraduate
of resources in cyber security and the U.S. Cyber Command            cyber security education is one of the highest priority strategic
standing up in May of 2010 was a good example of that.The            initiatives included in the recently updated Naval Academy
cyber cadre didn’t just come in off the street.The command           strategic plan. Private support provided by alumni, parents and
was established at Fort Meade and General Keith Alexander as         friends of the Academy will be critical to fulfilling that vision.
                                                                                                    January-February 2012              15
the new commander of the unit was promoted to his fourth
star,” Admiral Klein said.
     The Navy component of U.S. Cyber Command is the
10th Fleet, which was disbanded at the close of World War II
and reactivated in January 2010 as U.S. Fleet Cyber Command.
     “At Cyber Command our mission is fourfold.We operate
and defend DoD networks; we coordinate military cyberspace
efforts; we are prepared to conduct full-spectrum cyber
operations; and we operate within the laws and policies that
protect civil liberties.We’re a little over 700 people, civilian
and uniformed from across all the services, and we take a
whole-of-government approach to operating and defending in
cyberspace.There’s the Second Army, 24th Air Force and of
course the Navy’s 10th Fleet,” she said.
     Admiral Klein said USCYBERCOM needs service academy
graduates prepared to defend the country on the cyber front.
     “Anytime that we can provide foundational knowledge to
our midshipmen, we are way ahead of the game. It wasn’t until
I was in the Navy for 20 years that I learned networks.Today’s
midshipmen, our future leaders, are going to have this from
their very first year. It will be tremendously valuable,” she said.
     “When I was at the Academy as a midshipman, we walked
around with very low-powered calculators, a little bit better
than an abacus but not much,” Admiral Klein said. “Today the
computing power that’s available to all midshipmen gives them
access to the best research in the world.We used to have to go
over to the library to do our research. It’s such a rich education
as a result because they have all this information and research
available to them.”
     Admiral Klein granted that the United States’ cyber
adversaries also are very capable.
     “One of our most significant focuses is to build up our
defenses across the dot-mil environment, the DoD network.
We also want to make sure that the networks for our defense
industrial base are improved as quickly and hardened as quickly
as they possibly can be because our economy, our society, all of
us have become directly or indirectly dependent on access to
and freedom of movement in cyberspace. Our military is
equally dependent on that access, so we have to move forward.
We have to be pushing to ensure that we are as capable as we
can be.That’s our job at CYBERCOM,” she said.
     “We want to make sure that we are building a cyber force.
We want to make sure that we are growing the standards and
certifications that are required by our cyber work force.
We want to expand our capability to be able to have visibility
into all our networks.We want to make sure that we’re able to
“...our vision was to create a center of excellence here at the
Naval Academy that would ensure the Academy was serving
the Navy’s needs for cyber warfare.”
                                                                                    —Captain Robert Brennan ’82, USN
                                                                     Director of the Mathematics and Science Division


respond quickly with the right policies and authorities,”                 having visibility into our networks, having the right policy and
Admiral Klein said. “There’s lots of work to be done in all               authorities, those are things that will help us operate and
four of those areas.”                                                     defend the DoD networks and coordinate cyberspace efforts.
     She said even small players can cause major problems.                    We want to make sure that we are synchronized in our
     “We watch with concern the growing capabilities of                   efforts.We want to make sure that all the services are working
non-state actors because the threat they bring to bear is                 in the right direction—and in the same direction—so we are
asymmetric.They can cause effects that are on a level with                making the most of every person that is trained and certified as
state-sponsored actors, so a small and inexpensive operation              well as making the best use of every dollar that is invested in
can divert our resources just like those of a nation-state. Either        cyber security.”
way our job involves spotting or diagnosing a problem and                     The career path for Ken Kurz ’99, brought him back
then neutralizing the problem,” Admiral Klein said. “Then we              to Annapolis in April after more than seven years at the
have to go in and patch the exploit and bring the systems back            National Security Agency.The former chief of the National
online that were exploited. So any individual with computer               Cryptographic Solutions Management Office today is the
skills can learn or can develop into somebody who can launch              director of information services at the Naval Academy Alumni
an attack. Even a lone actor with a laptop and a motive can               Association and Foundation.
execute such an attack.”                                                      “There’s a huge problem within the U.S. as far as the loss
     Cyber terrorists also are becoming more sophisticated,               of intellectual property,” Kurz said. “I think the education part
Admiral Klein said.                                                       is understanding the extent of the problem and the near-, mid-
     “We see those terrorists growing more proficient in using            and long-term impacts if that problem is not addressed. All the
the Internet as a medium for recruitment, coordination and                money that we spend developing technology can be gone in a
other activities,” she said. “Cyber criminals, on the other hand,         millisecond when somebody downloads files and uses them for
seem to be more interested in theft and the exploitation of               some other purpose.”
sensitive data that can bring them a profit through fraud or                  The CCSS will help the Navy’s future leaders detect and
identity theft or indirectly through pirating of intellectual capital.”   defend against such security breaches, Kurz said.
     Captain Pete Nardi ’84, USN, director of the Academy’s                   “When I came as a mid—in ’95 as a plebe—the only
Division of Engineering and Weapons, has said today’s world is            IT-related major was computer science and it was heavy into
flat and the horizon stretches to infinity.                               programming,” he said. “Now there’s an IT major focusing on
     “In cyber there are no boundaries.There are no hills and             technology as it applies to systems of computers and networks.
valleys.There are no roadblocks like there used to be in the old          Adding to that, the Academy is participating with NSA in the
type of analysis of warfare and campaign analysis. It’s a new             cyber defense exercise every year in partnership with other
world order,” Captain Nardi said. “We need people who are                 service academies and postgraduate schools.”
smart enough to live and operate and work in that environment.”               The opening of a CCSS structure on the yard could be a
     Cyber battles could certainly be a component of future               decade off, but Kurz believes the need is immediate.
warfare, Admiral Klein said.Whether the cyber battlefield                     “That building was really needed yesterday. Seven years in a
changes the face of war as we know it remains to be seen.                 cyber world is an eternity.What the Academy is able to do
     “No one knows really how a cyber war would play out,”                between now and whenever that building is built is absolutely
she said. “Even the most capable state actors seem to recognize           critical.The faster that they can get that done the better
that it is in no one’s interest to find out the hard way.”                off the Naval Academy, the Navy and the country will be,”
     Still, a prepared military is essential, Admiral Klein said.         he said.
“Growing a capable force that can respond instantaneously,

                                                                                                         January-February 2012         17

								
To top