DOD's Lynn: Public/private partnership key in cyber warfare

SAN FRANCISCO — The Defense Department, faced with defending not only its own networks but ensuring the security of the privately owned infrastructure on which the military increasingly depends, is expanding its efforts to tap the private-sector expertise that it needs, Deputy Defense Secretary William J. Lynn III said Tuesday.

“The government cannot secure our networks alone,” Lynn said. “It’s going to take a public/private partnership.”

Lynn, speaking at the annual RSA Security Conference, said DOD is investing $500,000 in new research with industry on network security, and will provide seed funding for companies to accelerate the development of needed technology.

Related coverage:

Cyber war dominates the landscape at RSA conference

Public-private effort on cybersecurity needs a push from Congress

But getting new technology into DOD systems also is a challenge. Lynn said that it takes the department an average of 81 months to implement a new IT system, which is completely out of line with the pace of development and introduction in the commercial sector. He noted that the development time for Apple’s iPod was just 24 months. To improve development, he said the department will expand its Technology Exchange Program, now in a pilot phase, in which private-sector employees will work inside DOD, and DOD workers will be loaned to companies.

DOD workers can learn greater efficiency from the private sector, and the companies need to understand the challenges faced by the military in implementing new technologies, Lynn said.

Finally, DOD will make better use of National Guard and reserve personnel, whose primary jobs are in the private sector. More of these units will have a dedicated cybersecurity mission, he said.

The need to cooperate and establish public/private partnerships has been a theme of government speakers at this year’s conference, now in its 20th year and one of the premier venues for the computer security industry to discuss challenges and showcase solutions.

The need for improved cybersecurity was made disturbingly clear in 2008 by the penetration of classified DOD systems by a foreign intelligence agency through malware loaded on a removable thumb drive.

“It was our worst fear,” Lynn said. Since that time, threats have continued to multiply and mature. The latest evolution is the development of malware that can do physical damage. “This development, which marks a strategic shift in cyber threats, is only just emerging,” he said.

He did not mention Stuxnet, the worm that apparently targeted Iranian nuclear facilities, but he said the threats do exist in the wild and it has to be assumed that they will be used. “Few weapons in the history of warfare have not been used,” he said.

Although nation states are most likely to have the resources and expertise to develop serious weapons, they are the least likely to use them because of the threat of retaliation, Lynn said.

“More than 100 intelligence agencies have attempted intrusions on our networks,” but the threat from them of cyberwarfare remains small. “The threat to them is too great; our military strength is too great.”

The more serious threat is from the accidental release of malicious code, or its use by terrorists, he said. They do not appear so far to have access to weaponized malware, but that could change. “We have to assume if they have the means to strike, they will do so.”

A new DOD cyberstrategy, called Cyber 3.0, is in the final stages of review, Lynn said. It will emphasize the use of active defenses, which are being deployed in military networks.

One serious challenge remaining in improving military cybersecurity is the exchange of information and sophisticated defense technologies with the private sector. DOD has a lot of information about threats and is developing defenses to counter them, but is not sharing much of that information, Lynn said.

 “We have the technology and the know-how to deploy it in a civilian context,” he said. What is lacking so far is the will and the policy to do it.