DISA revisits strategy for host-based security

The Defense Information Systems Agency is juggling efforts to expand a critical cyber defense system and bolster it with more advanced features that will help the Defense Department better protect its systems from cyber threats.

The Host Based Security System is a security software suite managed by DISA’s Program Executive Office for Mission Assurance and Network Operations (PEO-MA/NetOps), and it is closing in on full deployment across DOD as DISA looks to use the system's infrastructure to support the agency's network operations. But HBSS' contract is due for recompetition in 2011, and DISA is conducting research to find ways to fortify the system’s capabilities.

HBSS is based on commercial intrusion prevention and policy management software from McAfee. But since the initial award of the HBSS contract in 2006, the cybersecurity landscape has changed — both in terms of the threats that DOD networks face and policies that govern information assurance.

In April, the Obama administration issued a new policy that explains how agencies must comply with the cybersecurity requirements in the Federal Information Systems Management Act.

The new policy places a high priority on continuous monitoring, requiring automated reports from security and systems management tools in near real time — a requirement that wasn’t in place when HBSS was initially deployed. But because HBSS includes a policy enforcement engine and other systems management and reporting capabilities, it gives DISA a starting point to help all of DOD comply with the new FISMA regulations.

“DISA is trying to come up with a strategy to use the HBSS as a key part of the continuous monitoring mandate that's coming out with the revised FISMA policy,” said Rick Roach, defense program director at Unisys. “A key part of the continuous monitoring approach is that you have to have strong configuration management. And with the footprint of the HBSS on all of the desktops, all of the hosts, that serves as a linchpin to collect configuration information about their environment. If you have all of that info all in one place, that puts you at a decided advantage as far as tracking changes to your environment and to the architecture.”

Mark Orndorff, director of PEO MA/NetOps, wrote in a recent article that DISA was attempting to transform HBSS into a tool for continuous monitoring of DOD networks. “We’re…building out an enterprise architecture to take what was originally designed to improve the security of end-points but [then] pull information from a system and correlate it to a DOD enterprise level so that commanders operating and defending the network will know the status of their security posture, giving us a readiness report card that’s machine-generated. It will give us the ability to collect and correlate alarms as attacks propagate around the network — essentially letting us know what’s on the network. It will also give us the ability to look for what we call rogue systems.”

However, DISA leaders have recognized the limitations of the existing HBSS architecture. In May, the agency issued a request for information as it investigates a long-term open architectural approach to HBSS. Although HBSS has given DOD networks a common management framework in McAfee’s ePolicy Orchestrator policy orchestration software, “it reduces the freedom of organizations to select 'best-of-breed' security products to address individual requirements for specific host-based agents — decisions instead are based on whether a vendor is integrated into the current management framework or which vendor is best integrated,” DISA’s RFI states.

DISA is looking beyond HBSS for ways to more closely monitor DOD networks. One solution involves network appliances that perform deep packet inspection on data that crosses DISA’s networks. “Those are applications that basically need to inspect all levels of the protocol stack under IP for decoding various application layer and protocol specific characteristics of traffic,” said Bob Wiest, vice president of technical services at Bivio Networks. “For example, that could be pulling an e-mail address out of an e-mail or a URL out of a [Web] request.”

DISA has deployed the Bivio 2000 network sensor at choke points within the Unclassified but Sensitive IP Router Network and Secret IP Router Network to monitor traffic passing through access points, Wiest said. The sensors enable DISA to to have much better control and visibility over their networks, he said.

The Bivio 2000 sensor is a Linux-based appliance designed to allow multiple applications running on a device to perform deep packet inspection on all of the data that crosses the network at wire speed — fast enough so that there is little added network latency. The devices are designed to allow several applications to process network traffic at speeds at least as fast as 10 gigabits /sec.

“What they were looking to do was deploy our system at key Internet access points, so we would effectively be watching the traffic as it's passing through," Wiest said. "And what they're doing is running a number of Linux-based applications, some of them open source, some of them are DISA proprietary, or in some cases may be purchased off-the-shelf software from other commercial vendors. So they've taken the best-of-breed cybersecurity apps that they could muster, and they wrote the code for applications they couldn't find, and they were able to put all of those functionalities on a single sensor.”

That capability allows DISA to move toward its goal of full situational awareness for traffic traveling along the Global Information Grid. The applications that can run on Bivio devices include McAfee’s ePolicy Orchestrator and other elements of HBSS, which gives DISA a way to further automate security reporting and compliance with FIMSA.