The increasing frequency and widening attack vector of cyber warfare threats is forcing military officials to adopt a more mission specific approach to defensive operations rather than attempting to defend entire networks.
A greater emphasis on increasing cyber capabilities in the recently passed fiscal year 2018 National Defense Authorization Act (NDAA) conference report and a push for rapid acquisition with the private sector are aimed at meeting more sophisticated adversarial threats to the domain, according to panelists at Nov. 28’s Fifth Domain Cyber Conference.
“When we talk about war, we are constantly being bombarded by threats. Some of those threats are insidious. Some are zero-day threats. The question is what do we do to defend ourselves against our mission threat attacks,” said Frank Konieczny, Office of the Secretary of the Air Force CIO, during a panel on cyber warfare. “We’re focusing down on the particular mission threats, and how we kinetically respond. You can’t defend the entire network. You can’t defend 4,000 applications. That’s why we’re focused on defending at the mission level.”
The widening cyber attack vector is shifting the DoD’s focus to spending resources to address specific characteristics of mission threats and acquiring tools for new defensive mechanisms.
While the DoD has historically implemented the correct tools to best protect traditional computer networks, it must work on improving the posture of its mission platforms with the proliferation of Internet of Things (IoT) devices, according to Daniel Smith, vice president of ManTech’s [MANT] cyber security solutions.
Smith sees the transition to addressing more specific cyber challenges as opportunity for the private sector to deliver its tailored capabilities.
“I think it’s pretty critical to get acquisition set up to rapidly bring new technologies into government. I think we also need to a better job of exchanging ideas and exchanging technology concepts between government and private sector,” said Smith.
Konieczny pointed to the Air Force Research Laboratory as a platform to rapidly test new defensive tools coming from industry.
“We need innovative ideas to help us. We’re trying to figure out the new technologies coming across and then working to introduce them into government,” Konieczny said.
Rep. Elise Stefanik (R-N.Y.), chair of the House Subcommittee on Emerging Threats & Capabilities, believes the recently passed NDAA conference report will help boost cyber capability acquisition for both cyber warfare and information operations.
The NDAA includes a provision for DoD to conduct a cyber posture review aimed at identifying current cyber readiness gaps, and calls for quarterly congressional briefings on cyber operations.
“We need to make sure DoD is able to utilize and acquire tools at the same pace as technology is changing,” Stefanik said during a panel on information warfare. “From my perspective, information warfare is 21st century warfare. Technology and the digital revolution has changed everything in society. It’s our job as policy makers to look five, 10 years down the road in terms of how do we ensure we are making the investments we need when it comes to our national security and our cyber warfare challenges.”
Panelists at the cyber conference pushed for policy discussion that seeks to address information vulnerabilities before further successful attacks are perpetrated against the private sector, not just military systems.
“The state of information warfare is an issue of awareness, an understanding of leaders and operators on how much information is being collected, whose storing it and what are they using it for,” George Trawick, assistant professor at the National Defense University, said. “That lack of awareness introduces vulnerabilities that we don’t even realize yet.”