5 key challenges to DOD's cybersecurity

Of all the areas under my purview these past nine years as the Defense Department’s information assurance lead -- from network and cyber defense to supply-chain risk management -- one of the most daunting challenges has been in the area of identity management.

The good news is identity is a key element of President Obama's new Cyber Security Strategy. The bad news is that identity protection and management is hard stuff. But, there is no greater priority because it is the underpinning of every other aspect of information security.

Cybersecurity hinges on authentication. We must have the capability to discern a person or a device’s identity for our cyber assets to be protected. In the Defense Department, the ability to authenticate to the network is not just a good business process, it could actually save lives.

Warfighters can’t fight battles without trustworthy information. Warfighters need confidence that they are really talking to credible sources. With the escalating cyber threat looming over our networks, it is imperative that we have strong identity-management capabilities in our policies and in our practices to help warfighters perform their missions more effectively.

The business community also needs reliable identity for collaboration especially in a global environment.

To ward against these perpetrators, DOD is strengthening its physical and logical security with the help of the public-key infrastructure Common Access Card for computer access – one of the largest PKI’s in the world. But we still need multi-factor authentication that bakes additional layers of resiliency into our network and helps secure our global supply chain.

It is critical to our mission that defense information systems are not brought down. It is crucial that we have freedom of action in cyberspace. If we can’t trust the information we rely on, it can greatly impact our success and ability to leverage cutting-edge capabilities such as social networking.

We have made significant strides in the cybersecurity domain. We have increased the profile of the deputy assistant secretary of Defense for Cyber, Identity and Information Assurance (DASD-CIIA), the office I head up, and have brought our goals and challenges to the forefront of the department’s focus. We have established the Unified Cross Domain Management Office (UCDMO), a joint office created by the CIOs for DOD and the Office of the Director of National Intelligence (ODNI) to address the inefficiencies and ineffectiveness resulting from years of uncoordinated activities in the cross domain arena. UCDMO’s goal is to push seamless information sharing throughout a diverse user community across a wide variety of security domains that handle both classified and unclassified information.

Additionally, we have improved on IA education and training and have increased our partnerships with the Homeland Security Department, private industry and the global Defense Industrial Base (DIB). We established a strong partnership with DIB to increase network security as well as put in place a robust model of threat and vulnerability sharing that extends to all critical sectors. We established the intergovernmental Data at Rest Tiger Team (DARTT), which creates policies and acquisition vehicles to secure sensitive government data and Personally Identifiable Information (PII). DARTT has developed an unprecedented and rapid acquisition process in support of government requirements – including the competitive awarding of multiple-blanket purchase agreements that can be used by all U.S. government agencies (federal, state and local) and NATO. Under DARTT BPAs, government agencies have saved more than $100 million in encryption licenses since July 2007.

We also launched the Defense Venture Catalyst Initiative (DefVenCI), a program that brought technology innovation to the National Security Community right after Sept. 11, 2001, enabling agencies to solve many hard challenges.

Still, as far as we’ve come, there is much work left to do. If I had to list five of the biggest challenges that remain, my list would include:

• The need to continuously harden the network, in this era of Web 2.0, cloud services, and increased mobile workforce and growing global requirements.
• The whole area of Supply Chain Risk Management. As the threat changes, we need to adjust as well, which includes rolling out technologies that inspect and secure the supply chain.
• Raising awareness across DOD and greater national security community on cyber resilience, so that commanders are prepared to operate in a contested cyber domain when communications are degraded or, worse, untrusted. The increased complexity of our technologies, coupled with our even greater dependence on them for mission success, make this an imperative.
• The necessity of education, training and workforce manning for critical IT/IA skill sets.
• And, again, the need to move to multi-factor and attribute-based identity assurance access for people, devices, data and applications.

Recently my office implemented a new information strategy that lays out our vision and goals for cyber, identity and information assurance. We must become more agile. Although training and education of our workforce is vital, eventually we must begin to take people out of the mix and move towards an automated security-systems platform where devices can recognize a threat and respond quicker and more efficiently than humans. We have to improve the time it takes to roll out commercial technologies. We can no longer afford to wait three, four and five years to put capabilities out on the battlefield. The direction we’re headed is to integrate information assurance in the pre-Milestone A design phase of weapons platforms. The bottom line is we have to emphasize IA in the design phase or we’ll pay a tremendous amount of money later on to fix programs or, even worse, we’ll find ourselves more vulnerable to attack.

We must trod a new path, one that focuses on automating security systems that rely less on systems engineers detecting intrusions and installing security patches.

As I retire from my role as the DASD-CIIA and the department’s chief information security officer, I leave both proud of our accomplishments in raising the profile and mission of cybersecurity across the department and confident that remaining challenges will be addressed to deal with the current cyber threat.

We’re on the right track, although we are struggling to keep up with the aggressive threat and fast-moving technologies. We need to pick up the pace.