The U.S. Fleet Cyber Command, part of
the U.S. 10th Fleet, is developing a strategy
for modernizing its cyberoperations and
transforming the Navy's network into a
cyberwarfare platform, C4ISRNetworks
reported earlier this month.
The strategy will seek to advance five key
goals:
Operating the Navy network as a
warfighting platform;
Conducting tailored signals
intelligence (SIGINT);
Conducting offensive operations in
cyberspace;
Expanding cybersituational
awareness; and
Launching Navy cyberforces --
essentially teams of cyberexperts who
will conduct cyberwarfare. The Navy
has 40 teams under development.
The need for a stronger cybersecurity
approach has been underlined by the
penetration of U.S. government networks
by hackers, the most recent of which was
an attack on unsecured White House
computers, which the U.S. government has
blamed on Russia.
"I do not think cyberwarfare ... is the best
option," said Richard Blech, CEO and
cofounder of Secure Channels.
It's better to remove the reason for attacks
by making the data unusable, he told
TechNewsWorld.
"Why would a hacker expend time and
resources and risk arrest for data that will
be unusable if the hack is successful?"
Blech asked.
What the Navy Plans
Operating the Navy network as a
warfighting platform requires command-
and-control across all networks, on shore
and at sea, and across different technical
environments, Fleet Cyber Command CIO
Kevin Cooley said.
That would require balancing cost savings
against defense, influencing the
programming, budgeting and acquisition
process.
If the Navy were able to keep a tight hand
on the purse strings, then could it actually
develop the kind of defensive capabilities
needed, especially in a warfighting
context?
"Take out the word 'warfighting,' and this
is the same dilemma that every
organization faces today," observed John
Gunn, vice president, corporate
communications, at Vasco Data Security.
Expanding cybersituational awareness will
require cooperation with the private sector,
which can offer visualization and analytics
technology as well as experience, systems
and data strategies, Cooley pointed out.
Private companies likely would be part of
the DoD's Defense Industrial Base , first
piloted in 2011.
How much defense contractors actually
can contribute is questionable. The
AntiSec hackers' movement in 2011 broke
into Booz Allen Hamilton's servers, and
stole and published 90,000 military
usernames from its servers. It also stole
and published 1 GB of private emails and
documents of Vanguard Defense Industries
senior vice president Richard Garcia.
"Even Mike Tyson got knocked out," noted
Vasco's Gunn.
However, "he was still ... nobody you
wanted to be on the wrong side of," he told
TechNewsWorld.
Crime and Punishment
The notion of cyberwar may not be a bad
thing, as not responding to hacks on
government systems makes the U.S. look
weak.
The Defense Department has been working
on the idea of retaliation for hacks for
some years. Then-deputy secretary of
defense William Lynn in 2011 gave a
speech outlining the DoD's strategy for
operating in cyberspace.
The DoD's approach consists of five
strategic initiatives developed as part of
the Comprehensive National Cybersecurity
Initiative .
Among other things, the CNCI considers
cyberspace an operational domain in land,
sea, air and space.
In line with this, U.S. defense officials
previously have floated the idea of
launching targeted physical attacks in
retaliation for cyberattacks on computer
systems and networks.
"Cyberwarfare can be an effective deterrent
in two ways," Gunn suggested. "It can
make our assets less attractive for fear of
retaliation -- and used in a preemptive
manner, it could potentially be used to
interrupt or detect hacker threats in
process to decrease their effectiveness."
It's difficult to fully rely on a network after
it's been compromised.
"Once an attacker gets into your systems,
it can be difficult to get them out," Tripwire
CTO Dwayne Melancon told
TechNewsWorld, "particularly when your
network and internal security controls
allow the attacker to move around on your
network without being noticed."
