Defending Against Catastrophic Cyberattacks Requires Collaboration, Says Director Of U.S. Cyber Command

Cheryl Pellerin at the American Forces Press Service offers the below piece:

WASHINGTON, Oct. 30, 2013 - Catastrophic cyberattacks loom in the nation's future, and only collaboration among government agencies, Internet service providers and U.S. allies worldwide can help citizens prepare for them, the commander of U.S. Cyber Command said this afternoon.

Army Gen. Keith B. Alexander (seen in the above DoD photo), who also serves as director of the National Security Agency, delivered the keynote address to senior government security officials and industry executives attending a cybersecurity conference.

"Over the last 14 months, we've seen over 350 distributed-denial-of-service attacks on Wall Street, with varying levels of success. In August 2012, the whole world saw a destructive attack on Saudi Aramco's computer systems that ... wiped out the data on over 30,000 systems," Alexander said.

The general asked the audience to imagine if that attack had hit Wall Street and to consider the impact it would have on the nation's finances and the global financial structure.

"Those types of catastrophic attacks are in our future," the general said. "We have to prepare for them. This is something the government cannot do by itself -- this is something government, industry and our allies have to work [on] together."

Alexander said the partnership must start with legislation that allows Internet service providers such as those who have large financial industry clients on Wall Street to tell government law enforcement agencies exactly when a cyberattack is happening so it can be stopped.

"We need a way for industry to tell us when there's an attack going on," he said. "The chances of us seeing it in time to do something about it are very small, especially for a destructive attack."

Alexander likened the way such a process would work to the way the E-ZPass electronic toll collection system scans cars on the highway to collect tolls. In the case of Internet traffic, the Internet service provider would scan network packets to see if they are good or bad, he explained.

If a bad packet is coming into Wall Street, Internet service providers would see that, he said, and could tip off the FBI, the Department of Homeland Security, the National Security Agency or U.S. Cyber Command about the bad packet, including where it's going and where it's coming from, at network speed.

"That's the key," Alexander said. "In order to respond to these types of threats, we need that information at network speed, and we've got to come up with the rules and the operational concepts to actually work at network speed if we're going to stop some of these attacks."

Some questions remain about how the process would work, he added.

"How do we scan traffic to know that it's good to go in such a way that we protect our civil liberties and privacy and insure it's not something that's going to destroy our financial networks?" he asked. Our thoughts are that this is where government and industry can work together.

"We don't need the contents of the packet," he continued. "We don't need to know anything more than it's a bad packet and it came from Point A and it's going to Point B. But for industry to provide us that information, we need legislation."

Five areas are most important to the Cyber Command and NSA missions, the general told the audience. First, and perhaps most important, is to have a trained and ready force, he said.

"If you don't have that and if [the cyber warriors] aren't trained to the right level," Alexander said, "they will never detect the threats that are going on in our networks."

Second is to have operational concepts and command and control, the general said, defining that as Team Cyber, or the integration of NSA and Cyber Command as a team alongside the Department of Homeland Security and the FBI.

"We have a team and a concept that says if an attack is happening on Wall Street, we have to know how we're going to work it," he said. "NSA and Cyber Command do not respond inside the United States; that's the role of the FBI. Outside, we work with our allies; that's where NSA and Cyber Command come in. The operational concept says how we stop an attack and how we tell the right authorities what's coming."

Third is to have a defensible architecture, he said, using the Defense Department's networks to explain the problem.

"Within the Defense Department we have 15,000 enclaves, each with different system administrators, each with their own firewalls, and each presenting a potential vulnerability if they're not patched at the same time," Alexander explained.

Having 15,000 groups of people trying to patch a network at the same time is problematic, he said.

"Somebody's going to make a mistake, and ... in cyberspace that means an adversary has a good probability of getting access to our network," he said. "It's the same thing for industry. How are we going to fix it? This is where the thin virtual cloud comes in."

Such problems must be addressed at network speed "if we're ever going to get out in front of this," he added.

The fourth area is shared situational awareness in cyberspace, or how cyberspace is seen.

"Today, when somebody talks about an attack into your network, ask them to draw you a picture," Alexander said. The issue, he added, is that if someone can't describe what's happening in cyberspace so that every decision maker understands it, how can they respond?

"We need shared situational awareness in cyberspace. We're working that -- we call it the cyber common operational picture -- but we also have to have that shared space with industry," Alexander said. "That's one of the key things that industry and government have to work on together. How do we see the threats?"

Seeing good airplanes and bad airplanes coming in requires that they be sorted out, Alexander said. "We do that for air defense," he added. "How do we do it for cyber defense, and how do we share it with our allies? That's a key issue we have to address in solving some of the problems coming up."

The fifth area is authorities, he said.

"The secretary of defense and the president are the policymakers, and it's their decision on when we act and when we don't act," Alexander said. "But we have to set up some of the authorities -- what we'll call the rules of the road."

From a military perspective, these are the rules of engagement, he said, "and we are actually working that with the Defense Department, the White House and others. ... But those, I think, absolutely should be on the table, and they should be transparent."