The Department of Defense (DoD) has published a strategy to tackle the issues of operating in cyberspace. This strategy was put due to the increasing number of successful attempts on US cyber-targets.
The Pentagon organizes the document in five strategic initiatives; I’ve simplified and commented on them below.
#1 Treat cyberspace as an operational domain to organize, train, and equip so that DoD can take full advantage of cyberspace’s potential
An important concept was set. The military is now calling cyberspace a domain. Meaning the domains of land, sea, air and space were augmented with the cyber domain.
The document provided what level of attention the cyberspace domain is to receive in the military. By mentioning the following:
- Resources are provided on a scale as if cyberspace were another terrestrial continent; for example, the U.S. Navy’s “10th Fleet” was reactivated in 2010, charged now with looking after cyberspace (rather than anti-submarine operations in the Atlantic, as was its mission from 1943-1945). Of note is that a numbered U.S. fleet historically represents a vast geographic region. Establishing a numbered fleet command automatically carries the weight of a three-star admiral and quite a large staff.
- Cyber red teams will be included in all war games and exercises, anticipating degraded cyberspace operations and disruption in the midst of a mission. Disrupting war games is expensive and even risky; but this seems like a great way to improve our troop readiness across the board.
# 2 Employ new defense operating concepts to protect DoD networks and systems
This includes:
- following cyber hygiene best practices
- focusing on insider threat mitigation
- deploying a better Intrusion Prevention System (IPS)
- a promise to constantly develop new defense operating concepts
I think that these are very basic security housekeeping concepts for any IT organization. The Pentagon here is not telling anything new.
#3 Partner with other U.S. government departments and agencies and the private sector to enable a whole-of-government cybersecurity strategy
I guess that one of the weak points that the Pentagon admits is the dependency on the entire private sector IT hardware and software industry, and the same telecommunications carriers and Internet Service Providers (ISPs) that everyone else uses. So the Pentagon has to promote private sector participation to improve cybersecurity. And this promotion may be of great advantage but may also lead to security leaks.
The Department of Homeland Security (DHS) which emerged after the attacks of September 11 is leading the inter-agency efforts and reporting to DoD.
#4 Build robust relationships with U.S. allies and international partners to strengthen collective cybersecurity
This strategy emerged from the concept that Cyberspace is a network of networks that includes thousands of ISPs across the globe; no single state or organization can maintain effective cyber defenses on its own. The Pentagon seems to be doing considerable advancements in this domain with its global collection of data (cyber events, threat signatures of malicious code, and information about emerging actors and threats…)
#5 Leverage the nation’s ingenuity through an exceptional cyber workforce and rapid technological innovation
The Pentagon has released the National Cyber Range which is a lab where large scale experiments and network simulations are conducted, and knowing that we have such a facility to attract and retain cyber talent is good news. DoD needs to attract talents and skills in this domain (academic or business).
To replicate the dynamism of the private sector and harness the power of emerging computing concepts, DoD’s acquisition processes for information technology will adopt new principles. Speed is a critical priority. DoD’s acquisition processes and regulations must match the technology development life cycle. With information technology, this means cycles of 12 to 36 months, not seven or eight years.
To dowload the full strategy text published July 2011. Click this link DoD Strategy (PDF).
