Bot-nets, internet-zombies, industrial spies, and cyber-mercenaries attack U.S. networks every day in the ongoing 21st century cyber war, said Deputy Defense Secretary William Lynn. Defense networks are probed “thousands” of times a day and the frequency and sophistication of those attacks are increasing exponentially.
“This is not some future threat, the cyber threat is here today,” Lynn said, speaking yesterday at CSIS in Washington. “The cyber threat to DOD represents an unprecedented challenge to our national security by virtue of its source, its speed and its scope.” Defeating cyber enemies will require developing an agile and nimble cyber “maneuver warfare” response, not a “digital version of the Maginot Line.”
The power to disrupt and destroy power grids and other critical infrastructure, once the exclusive province of nation states, is now in the hands of small criminal and terrorist networks and even individuals. Some countries are developing offensive cyber weapons and more than 100 “foreign intelligence organizations” are trying to hack into U.S. networks, he said. Criminal groups infect thousands of computers spread around the world with viruses that give them control of them all in one massive “bot-net,” that they then lease out to the highest bidder to wield against vulnerable networks. Attacks are up against defense contractors, Lynn said, and “major aerospace platforms” have experienced intrusions that have compromised sensitive, but not classified, information.
To counter cyber attacks that can strike in milliseconds, the military must detect and respond to attacks at “network speed,” before networks are compromised, he said. Billions of dollars are spent annually to harden networks against attack, he said, but static firewalls are not enough. To outmaneuver opponents in cyberspace, DOD is building a cadre of cyber experts, and is tripling the number of experts it trains each year to 250 people. DARPA is also building a “national cyber range,” in effect a model of the internet, Lynn said, to permit development and testing of new cyber defenses and weapons.
“We need to end the jousting and jockeying within the department for personnel, for resources, for authority that has often prevented a more coordinated and effective response to the cyber threat.” To that end, the Pentagon is mulling creation of a new “subordinate unified command” under Strategic Command, the lead command for cyber defense. Lynn said that although Gates has yet to make a final decision on the structure of the command, “it would not represent the militarization of cyber space,” he said. The new command would only be responsible for protecting networks in the dot-mil domain, not the private sector.
Lynn said the military is stills struggling with issues such as the “difficulty of attribution,” how to deter cyber attacks when the identity of the attackers in cyberspace is rarely known and massive bot-nets span multiple countries. Some cyber attacks have been traced back to China, he said, but the military has been unable to determine whether it was an individual, a criminal organization or the Chinese government.
Image: Photobucket
