Blog     e-Newsletter       Resource Library      Directories      Webinars
AFCEA logo


Cyber and Intelligence Need Each Other

July 30, 2013
By Robert K. Ackerman
AFCEA Global Intelligence Forum Online Show Daily, Day 1

Quote of the Day:

“The more we can talk about cyber and intelligence in the open, the better we will be … the less the demagogues can take it and run with it.”—U.S. Representative Mac Thornberry (R-TX)

Intelligence needs cyber, and cyber needs intelligence. How they can function symbiotically is a less clear-cut issue, with challenges ranging from training to legal policy looming as government officials try to respond to a burgeoning cyber threat.

The cyber threat is growing, and the defense and homeland security communities must strive to keep up with new ways of inflicting damage to governments and businesses. Many experts believe that the cyber threat has supplanted terrorism as the greatest national security issue, and new technologies are only one avenue for blunting the menace. Intelligence must expand its palette to identify and detect cyber threats before they realize their malevolent goals.

Many of these points were discussed in the first day of the two-day AFCEA Global Intelligence Forum, held July 30-31 at the National Press Club in Washington, D.C. Leaders from industry, the military and federal and local government converged in a lively discussion of challenges and their potential resolutions. No single approach reigned supreme among solutions, and the dynamic nature of both the threat and its environment heightened the uncertainty surrounding the future. One prediction that nearly all participants agreed on was that inaction in addressing cyber threats would be catastrophic for the nation as a whole.

Needed Cyber Skill Sets Grow in Number, Complexity

July 30, 2013
By Robert K. Ackerman

Effective cyber experts require an increasing skill set that is putting them out of reach of the government. As threats have become more diverse, so have the abilities needed to defend against them, and the government may need to turn to innovative methods of building its cyberforce.

Rear Adm. Edward Deets, USN (Ret.), director, software solutions division, Software Engineering Institute, Carnegie Mellon, told the audience at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., that the nation has “a geopolitical knowledge gap—not just analysts, but also people doing things in the traditional tradecraft that we do today.” Foreign espionage is increasing as national relationships change and developing countries become players in the global marketplace.

Steven Chabinsky, chief risk officer and senior vice president for legal affairs at CrowdStrike, warned against expecting the incoming generation of professionals to be immediately adept at new technologies without the need for training. “Today’s generation is not that much more skilled than we are,” he stated. “They are familiar with using the technology, but don’t take false comfort in thinking that we won’t have to train them.”

Chabinsky also called for a new approach to training and education. “We have overemphasized college education to the point where people need their master’s degrees,” he charged. “Instead, we need more apprenticeships, and government can take the lead on this.”

Adm. Deets pointed out the need for government support for professional development. “[The Defense Department] must invest in intelligence training and education tracks for people to be integrated into the cyber domain. It’s incredibly expensive,” he said.


Obtaining Cyber Personnel Threatens Effective Defenses

July 30, 2013
By Robert K. Ackerman

Just as an earlier panelist at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., emphasized the importance of the human element in cyber intelligence, a subsequent panel sounded the alarm for acquiring and keeping cyber personnel. Obsolete hiring rules and competition from the private sector loom large as impediments to the government’s ability to hire and retain effective cyber intelligence personnel.

Competition from the private sector is quantifiable. Daniel Scott, Office of the Director of National Intelligence, pointed out that the government is offering less than half the annual salary than the private sector for skilled cyber graduates. These young people need to earn a lot of money in the first 10 years of their careers so they can pay off their college loans, he pointed out. And, the need for these people is immediate.

“We can spend millions and millions on scholarships, but we need to hire people today,” he stated.

Scott also called for comprehensive civil service reform. “It [civil service hiring] was written for the industrial age; it will not work for the skill set we will need in cybersecurity. We need more flexibility to bring people in and retain them,” he declared.

New Capabilities, Though Needed, May Not Be a Panacea for Cybersecurity

July 30, 2013
By Robert K. Ackerman

Information sharing, automated intelligence reporting and all-source analysis capabilities are cited by many experts as being necessary for helping ensure cybersecurity. However, the human element must remain not only present, but also dominant, in any cybersecurity process.

That was one point presented in a panel discussion at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C. Rear Adm. Elizabeth Train, USN, director for intelligence, J-2, the Joint Staff, cited an automated unclassified intelligence reporting system as one capability that is needed but is still a way off.

She added that all-source analysis is still the key to good intelligence. Information sharing is another desirable capability, although achieving it is a challenge across the entire intelligence community, not just in cyber, she noted.

While endorsing the need for new capabilities, Mark Young, former executive director, Directorate for Plans and Policy, U.S. Cyber Command, sounded a cautionary note. “Correlation does not necessarily mean causation—the role of the analyst is even more critical,” he declared. “We use these automated tools to find the needle, but so what?

“We can talk about the pace of technology all we want, but if you have the proper mindset for analysis, the technology doesn’t matter,” Young emphasized.

Young agreed that industry can help with cyber threat intelligence, but it may be elusive. “We need information sharing legislation, but I don’t think it’s going to happen,” he offered.

Defense Information Security Still Fought in the Trenches

July 30, 2013
By Robert K. Ackerman

The military is so busy combating cybermarauders that it has not been able to shape an overall strategic approach to securing cyberspace, said the head of intelligence for the Joint Staff. Rear Adm. Elizabeth Train, USN, director for intelligence, J-2, the Joint Staff, told the audience at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., that the cyberdomain is a multidimensional attack domain that threatens both the military and the private sector.

“We’re doing more tactical blocking and tackling than strategic defense right now,” Adm. Train said.

She called for a stronger two-way relationship between government and industry as a cornerstone of information sharing. While intruders largely target the private sector, they also are targeting the Defense Department. “We’ve experienced an unprecedented number of incidents,” she said of the department.

One of the challenges is that, in an interdisciplinary mission such as cyber, a gap in technology knowledge is present across the work force. The admiral called for a standard lexicon and vocabulary so that participants can understand each other clearly. For example, she noted, some cyber experts are not experts in intelligence tradecraft, which hampers effective communications in the rapidly changing cyber arena.

“The world is introducing digital capabilities at a pace faster than we can understand them,” the admiral stated.

A New Type of Police Officer Taps Cyber Advantages

July 30, 2013
By Robert K. Ackerman

The same challenges facing the military now confront law enforcement as it embraces cyber capabilities. Disciplines ranging from data fusion to security are becoming integral parts of the curriculum for police officers.

Cathy Lanier, chief of the Washington, D.C., Metropolitan Police Department, did not understate the changes technology has wrought as she spoke at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C. “It almost feels like completely reinventing police work,” she said.

With the force using information technology in most aspects of police work, cybersecurity is one of the top priorities for officers. “With all that technology, we have had to re-educate our entire police force and civilians on cybersecurity,” the chief offered. “We’ve had to change the type of employee we go after and teach the current police how to use it.”

Chief Lanier added that training alone is not the only part of the equation. The department must bring its people up to speed on these new technologies, but it also must obtain the policy to go along with it.

Technologies Empower Police but Bring Familiar Threats

July 30, 2013
By Robert K. Ackerman

New information technologies have advanced the state of the art in law enforcement at the local level, but police now find themselves facing challenges brought about these innovative capabilities. Problems of security and adversarial use of cyber have added to traditional problems that police departments have faced for decades.

Cathy Lanier, chief of the Washington, D.C., Metropolitan Police Department, told the audience at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., that she believes the Metropolitan Police Department is the most automated in the country. But, even though that technology is helping law enforcement solve crimes, criminals are using technology to their own advantage.

“Cyber is creating a different breed of criminal,” Chief Lanier said. “It has changed dramatically how criminals operate. Criminals are learning how to use these new tools faster than the old criminal methods—the expertise out there is staggering.

“Street criminals are using technology much more efficiently than we are,” the chief continued. “We’ve had to learn how to infiltrate cyber to fight crimes—even violent crimes.”

Part of this effort includes greater use of the department’s fusion center to process vital data, she noted. The department is able to access a variety of different media to generate information that can help solve a case that would have been unsolvable just a few years ago.

Industry Can, Must Do More to Help FBI Cybersecurity Efforts

July 30, 2013
By Robert K. Ackerman

Companies that are hacked have valuable information that can help prevent future cyber intrusions, said an FBI cyber expert. Rick McFeely, executive assistant director of the FBI’s Criminal, Cyber, Response and Services Branch, told the audience at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., that the bureau is depending on industry to share vital information on cyber attacks.

“A key part of what the FBI does is victim notification,” McFeely said. “But, by calling out methods used to attack one company, we can see if those methods are being used to attack others. We now do that [a great deal].

“We need you to report it immediately,” he said, addressing industry. “If you share malware, we can tell you how others mitigated the same situation.” He added that the FBI is working to develop a tool that identifies malware’s fingerprints.

One problem the bureau has had with industry is that companies often expect to learn the identity of the intruder. That is not always possible given confidential sources of information, and the FBI discourages firms from seeking that data. “We need to get away from the constant need of private industry to know who’s behind the keyboard,” McFeely states. “We need to worry less about positively identifying [intruders] and focus on their intent and capability. We provide intelligence so you can defend your own networks, not so you can identify where an attack comes from.”

FBI Creates New Cyber Information Sharing Portal

July 30, 2013
By Robert K. Ackerman

The FBI has created an information sharing portal for cyber defense modeled on its Guardian counterterrorism portal. Known as iGuardian, the trusted portal represents a new FBI thrust to working more closely with industry on defeating cyberthreats. It is being piloted within the longtime InfraGard portal, according to an FBI cyber expert.


Security Measures Need to Raise the Cost of Operations for Hackers

July 30, 2013
By Robert K. Ackerman

Hackers need to pay a greater price for intrusions if network security is to be effective, said a former director of national intelligence. Adm. Dennis Blair, USN (Ret.), who also is a former commander of the U.S. Pacific Command, told the audience at the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., that the nation needs to raise the cost to the hacker without breaking the bank for the defender.

The admiral emphasized that he is not advocating the legalization of counter-cyber attacks—as much as the concept appeals to him. Instead, he called for legalization of “a myriad of nondestructive counter cyber attacks” that would raise the minimal cost to these hackers.

Some measures might involve empowering cyber operators to take action against hackers. Adm. Blair suggested establishing the cyber equivalent of private surveillance cameras with the ability to turn evidence over to the authorities, and maybe even creating the digital equivalent of a citizen’s arrest.

Other defensive measures could thwart cyber marauders. These might take the form of documents that self destruct when unauthorized users try to open them, for example, and the digital equivalent of indelible ink that is used for marking money.

The former head of the U.S. Pacific Command cited China as an example of a cyber adversary that should be impressed with the need for supporting cybersecurity rules and laws. “We need to put more penalties into the equation instead of relying on Chinese maturing,” he offered. “How many U.S. companies must go out of business, how many billions of dollars must be lost, before the Chinese realize it’s in their best interest to cooperate in cybersecurity?”


Subscribe to RSS - Intelligence