U.S. Marines Creating Island for Network Defense

Sgt. Sean Cain, USMC, with Charlie Company, 1st Battalion, 5th Marine Regiment, performs a radio check during a security patrol in Afghanistan.

The head information technology officer for the Marine Corps, Brig. Gen. Kevin Nally, USMC, is grappling with several projects necessary to keep critical information flowing smoothly and securely. Gen. Nally’s efforts include dramatically streamlining a sprawling information technology infrastructure, overseeing the Defense Department’s information assurance range, protecting information in the era of social networks and WikiLeaks and transitioning from the Navy-Marine Corps Intranet to the Next Generation Enterprise Network.

The general, who took over his current responsibilities in November, is the Marine Corps director of command, control, communications and computers (C⁴), the Navy’s deputy chief information officer for the Marine Corps, and the deputy commander for Marine Corps Cyber Command, but he is commonly referred to as the Marine chief information officer. He officially donned the multiple hats on November 10, the Corps’ 235th birthday.

Among the projects on his to-do list, Gen. Nally will help streamline the Marine Corps’ expansive information technology infrastructure into a tightly integrated, agile, defensible and survivable network capable of supporting distributed battlefield operations as well as an efficient and effective business enterprise. Plans call for a major data center located in Kansas City, Missouri, to be complemented by four regional network operations and security centers and eight information technology support centers. “What we’re creating is an island of defense, so you may be able to cut off part of the network from a cyberattack, but you won’t be able to cut off the entire network,” Gen. Nally says.

The Marine Corps Enterprise Information Technology Services data center in Kansas City will support the data processing requirements for the entire Marine Corps. It will provide application hosting capabilities, enterprise shared services, access to enterprisewide information and collaboration and information sharing across business and warfighter domains. It is designed to deliver an infrastructure that can adapt readily to evolving requirements for software, hardware, data, services and management. The center will clear initial operational capability this summer, according to Gen. Nally, and it will offer several benefits, including program consolidation, efficiency and continuity of operations.

In addition to the Kansas City data center, the Corps’ streamlined architecture will include four regional network operations and security centers and just eight Marine Air-Ground Task Force (MAGTF) Information Technology Support Centers (MITSCs), which constitutes a dramatic reduction. “We’re going from 40 MAGTF support centers to just eight, and they’re going to be regionalized. We’ll also have four network operational support centers. It’s going to increase our effectiveness in supporting the warfighters and will make us more efficient and reduce costs,” Gen. Nally asserts.

The Marines announced in October the opening of a new MITSC at Camp Pendleton, California. The center is known as MITSC West, and it includes a customer support center, network operations facility and multiple status screens with real-time displays monitoring network health. It is designed to foster a proactive approach to network maintenance and responsive customer service. It will serve seven installations in Southern California and Arizona as well as the Marine Corps Recruit Depot in San Diego, California. MITSC West is designed to support the transition from the NMCI to the Navy’s Next Generation Enterprise Network (NGEN), the first step toward achieving the Navy’s vision of a future fully integrated Naval Networking Environment (NNE). That transition is another of Gen. Nally’s top priorities. The Navy has awarded a contract to Hewlett-Packard to continue services provided under the NMCI, which serves more than 700,000 personnel, until the transition to NGEN is complete. The Marines, however, have wasted no time beginning the transition from the commercially operated network to the Defense Department network. The intent is to move more than 1,200 users by the end of this month, which Gen. Nally predicts will be no problem because in January they began using an automated system for moving personnel, rather than doing it manually. “My guess is we’ll be done well before March 31st,” he says.

Gen. Nally says one of the biggest advantages over the NMCI is that NGEN will be government-owned and operated, giving Marines greater control. “The most important thing to me is that we’re going to be able to meet the commander’s requirements in a more timely manner because we’re going to be able to set the priorities in terms of taskings. In the past, the tasking priorities may not have been what the commander really needed, so we as the Marines will be able say what today’s priorities are.”

Rather than one large contract with one vendor, the Navy intends to award five separate contracts—for transport services, end-user hardware, enterprise software licensing, enterprise licensing, and independent security operations oversight and assessment—but the Marines are opting out of the security operations segment of the contract. “The four we’re looking at are transport, hardware, software and the enterprise service model. The Navy’s also looking at information security operations, but that’s the one out of the five that we’re not going to participate in because we operate our own network, and we don’t want to contract that out,” says Gen. Nally.

On another network security front, Gen. Nally reveals that the Marines recently have been named by the Defense Department as the executive agent for the Information Assurance Range. Not to be confused with the Defense Advanced Research Projects Agency’s National Cyber Range research and development program, the current Information Assurance Range offers a closed, Internet-type environment for joint cyber exercises. It includes both malicious and benign websites and can be used for testing information assurance products and for training personnel at all levels. The Marines are working closely with the Defense Information Systems Agency on the project. “We’ll use it as a training and education tool for the information assurance work force, to include cyber forces. We’ll ensure that information assurance is inherent to the system, thus providing superior and transparent threat protection for a wide range of missions,” Gen. Nally says. “We’ll be able to test and evaluate new software products and learn how to look for, find and finish malicious software.”

The general’s office also helped coordinate the recent deployment of the Host Based Security System to Marine Corps units in Afghanistan. The system is a commercial product that prevents, monitors, detects, tracks, reports and counters known cyberthreats to Defense Department networks. It is to be attached to each of the department’s host servers and will be managed by local network administrators and configured to address known exploits using an intrusion prevention system and host firewall.

Also in the information assurance realm, the Marines continue to refine their approach to social networking sites and other websites such as Wikileaks. Gen. Nally discloses that the Marines have an informal agreement with Facebook to remove any pages that violate operational security, reveal personally identifiable information on Marine Corps personnel or impersonate Marine Corps personnel for the purpose of scamming innocent users. The Marine Corps public affairs office monitors Facebook and can, if need be, contact Facebook staff to have a site removed. The Marines have held discussions with other social networking sites, but have not yet reached agreements with them. “We’ve partnered with Facebook so that if there are any operational security incidents that go on a Facebook account, we can contact Facebook headquarters, and they will pull that site immediately,” Gen. Nally says. “Social networking sites provide a morale value for our force, and it’s a great way for our forces to pass information back to their loved ones, but we also possess certain vulnerabilities that they need to be aware of—especially when it comes to operational security and personally identifiable information concerns.”

The Marines also struggle to keep Corps computers disconnected from Wikileaks, the infamous website that has leaked reams of classified data. Wikileaks has been blocked from the secret Internet protocol router network, or SIPRNet, but keeping it blocked remains a challenge. “We’re taking appropriate steps to deny access to it. Most of that guidance comes from components of U.S. Cyber Command and then we draft policies to implement, but they move those Wikileaks sites from one Internet service provider site to another or change the name. The challenge is going out and finding the new site and blocking that as well, but we’re proactively doing that.”

The array of projects and issues he deals with fit into the overall vision for a “knowledge-based force that leverages seamless enterprise capabilities across the spectrum of conflict in order to enhance decision-making, achieve knowledge superiority, and gain tactical, operational, and strategic advantage over our nation’s adversaries.”

The knowledge-based force is more than a catch phrase for Gen. Nally—it is an imperative. “Knowledge is a strategic force enabler. The goal is to have a seamless enterprise capability to enhance decision making—to turn information into knowledge so that it’s in the right format and usable,” Gen. Nally says.

He lists his top priorities as the work force—including Marines, civilians, contractors and especially the warfighters; the continuity of services contract and NGEN; support to MAGTFs and the supporting establishment; amphibious C⁴; chief information office governance and processes; science and technology; information assurance; cyber; and C⁴ information management and C⁴ strategic communications plan. For the work force, he emphasizes the continuing need for training and educating the work force and raising awareness of information assurance issues because, Gen. Nally says, “The best network security is a well-trained Marine.”

WEB RESOURCES
U.S. Marine Corps: www.marines.mil/Pages/Default.aspx
Brig. Gen. Nally bio: www.doncio.navy.mil/ContentView.aspx?ID=2044
Navy Chief Information Office: www.doncio.navy.mil/Main.aspx