Making a strong case for PKI
Connecting state and local government leaders
What does electronic warfare have to do with network security?
What does electronic warfare have to do with network security? George Schu, vice president for public sector business development at VeriSign Inc., believes the two are very similar. In fact, he says, taking out enemy sensors is akin to heading off denial-of-service attacks before they hit your network.Schu arrived at Mountain View, Calif.-based VeriSign from Oracle Corp. VeriSign specializes in infrastructure protection, particularly through a wide range of managed services. The company is one of three public-key infrastructure service providers approved by the Office of Management and Budget.But before joining the private sector, Schu had a career in the Navy, which included intelligence work supporting Operation Desert Storm. His last assignment was commanding a training base in Pensacola, Fla., where he was responsible for training members of all U.S. military services, as well as foreign students, in electronic warfare, cryptology and information assurance.Schu is active on a number of government committees, including the Privacy and Security committee created by the Council for Excellence in Government for the Homeland Security Department. He speaks Italian, Russian and Spanish and is a graduate of the Defense Language Institute and the Industrial College of the Armed Forces. He holds a master's degree from Georgetown University.GCN senior writer William Jackson spoke with Schu by telephone about the information security challenges facing government.SCHU: Electronic warfare is our capability to deal with enemy radars and related sensor systems. They can be on the ground, they can be on aircraft, on ships, on tanks or field artillery. In a combat situation, those radars are a threat to us because they are the eyes of the enemy's weapons systems. So we have to be able to detect what they are radiating. That is passive electronic warfare.When we need to defend ourselves, one of our tactics is to blind them, and that is active electronic warfare. It could be with electromagnetic radiation or with kinetic energy. The first thing we do in a combat situation is go after those sensors.SCHU: I think that people who are responsible for the cybersecurity of a network have to be on their toes constantly, just like an EW operator does, and always watching to see how the threat is changing. That is symptomatic of the threat we are facing today. It is more robust, there are multivector worms and viruses.And the cybersecurity specialist has to take countermeasures, just as in electronic warfare. And the countermeasures are both passive and active. A passive measure would be ensuring good security hygiene inside the enterprise. An active measure might be contacting an ISP associated with a distributed denial-of-service attack and ask[ing] them to shut down the IP address.
GCN: You've had experience training military personnel in electronic warfare. What is electronic warfare?
GCN: Do threats from electronic warfare differ significantly from the day-to-day security issues faced by systems administrators?
GCN: How does your military experience translate to the kind of work you're doing now?
SCHU: There is probably more carry-over than you would think. My experience besides electronic warfare was in cryptology, and that is the essence of a lot of VeriSign's technology. PKI is a commercialized cryptologic function.
We were taught in the military that information security is about procedures and practices more than it is about technology, and I think that is a message people constantly need to be reminded of. You can throw a lot of money at information security in the modern enterprise, but if you don't have sound practices and procedures, it's all going to fall apart.
GCN: Your focus at VeriSign is on the public sector. How do their needs differ from those of the private sector?
SCHU: I think there is a convergence in the needs. Certainly the public sector has its own set of policies and regulations that the commercial sector may not have. But there are things analogous to it, or there are hints that there will be.
For instance, [the] Federal Information Security Management Act calls for strict cybersecurity compliance in the government. There is not quite anything like that in the private sector now. But we had a discussion with Bob Dix [staff director for the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census], who is an authority on FISMA, and he opined that if the commercial world doesn't get its act together, there may be legislative pressure to do that for them. You can read into laws like Sarbanes-Oxley the need to have cybersecurity practices in your corporation.
In some vertical sectors, such as financial services or health care, ... there are regulations in place.
GCN: What demand do you see in government for authentication and access control?
SCHU: I think that next year and the year after that and the year after that are going to be breakthrough years in access control, as a result of the homeland security presidential directive issued in August. HSPD-12 calls for issuance of smart ID cards to all federal employees and contractors working inside federal facilities. It will be a common access control card for physical and logical access. Embedded on those cards will be a digital certificate.
We have been struggling for years with our government customers to find the business case for something like PKI, and HSPD-12 will be the real business driver. It is going to cause companies like VeriSign to collaborate with other companies that have the end-to-end ID management solutions and physical-access control subsystems to come up with repeatable, common solutions. The first milestone in this is the FIPS-201 standard that [the] National Institute of Standards and Technology is going to issue. It will be the standard for the common federal smart card.
GCN: Is the government taking full advantage of technology to enable electronic transactions?
SCHU: We have been working with the Interior Department, which is at the forefront of this. They are going to have the first enterprisewide smart-card deployment. It will be used for physical and logical access, but because it will have a digital certificate on it, it can also be used with secondary applications for digital signatures. This will mean getting serious about getting rid of paperwork in government processes.
Interior already has enabled 400 forms into e-forms, and employees with their smart cards will be able to use their digital certificates to make a digital signature on those forms. The first step is to do that for government-to-government transactions. But they want to migrate that to government-to-business and government-to-citizen kinds of transactions. I think that is a good model we will see replicated.
GCN: What are some examples of current government-to-government applications?
SCHU: A really good example of information sharing is a system we are involved with in Pennsylvania called the Justice Network, or JNet. It's about law enforcement agencies passing sensitive information to each other. They have never done this before, because law enforcement agencies, by their natures, want to hold that information near their chests. All the federal law enforcement agencies that work in Pennsylvania also are subscribers to JNet. They all have certificates to authenticate themselves.
GCN: Government-to-citizen transactions still are pretty young. Is the public taking full advantage of the opportunities that are out there?
SCHU: I don't think they are. I think there will have to be a forcing function. What you are going to see happen is that a state or a couple of states will begin issuing smart driver's licenses, and the citizen will then have a digital certificate that they can use for higher level transactions. There is a good chance that financial institutions will be issuing digital forms of authentication to their customers as a way of combating phishing problems. We think we are at the beginning of a wave of identity theft attacks and we are going to need to have more protection for citizens doing transactions.
GCN: It is interesting that you see state government and companies as the drivers in citizen-level adoption.
SCHU: I think it is really tough for the federal government to take that on. It is very concerned about not being in the position of issuing a national ID card. Our de facto national ID card is our driver's license. And the states have the infrastructure in place for identity proofing, which is really the heavy-lifting part of the authentication process. It is the expensive part. So pushing it back to the DMVs really does make sense to get certificates into the hands of citizens.
George Schu, VeriSign VP and electronic warfare expert
GCN: You've had experience training military personnel in electronic warfare. What is electronic warfare?
GCN: Do threats from electronic warfare differ significantly from the day-to-day security issues faced by systems administrators?
GCN: How does your military experience translate to the kind of work you're doing now?
SCHU: There is probably more carry-over than you would think. My experience besides electronic warfare was in cryptology, and that is the essence of a lot of VeriSign's technology. PKI is a commercialized cryptologic function.
We were taught in the military that information security is about procedures and practices more than it is about technology, and I think that is a message people constantly need to be reminded of. You can throw a lot of money at information security in the modern enterprise, but if you don't have sound practices and procedures, it's all going to fall apart.
GCN: Your focus at VeriSign is on the public sector. How do their needs differ from those of the private sector?
SCHU: I think there is a convergence in the needs. Certainly the public sector has its own set of policies and regulations that the commercial sector may not have. But there are things analogous to it, or there are hints that there will be.
For instance, [the] Federal Information Security Management Act calls for strict cybersecurity compliance in the government. There is not quite anything like that in the private sector now. But we had a discussion with Bob Dix [staff director for the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census], who is an authority on FISMA, and he opined that if the commercial world doesn't get its act together, there may be legislative pressure to do that for them. You can read into laws like Sarbanes-Oxley the need to have cybersecurity practices in your corporation.
In some vertical sectors, such as financial services or health care, ... there are regulations in place.
GCN: What demand do you see in government for authentication and access control?
SCHU: I think that next year and the year after that and the year after that are going to be breakthrough years in access control, as a result of the homeland security presidential directive issued in August. HSPD-12 calls for issuance of smart ID cards to all federal employees and contractors working inside federal facilities. It will be a common access control card for physical and logical access. Embedded on those cards will be a digital certificate.
We have been struggling for years with our government customers to find the business case for something like PKI, and HSPD-12 will be the real business driver. It is going to cause companies like VeriSign to collaborate with other companies that have the end-to-end ID management solutions and physical-access control subsystems to come up with repeatable, common solutions. The first milestone in this is the FIPS-201 standard that [the] National Institute of Standards and Technology is going to issue. It will be the standard for the common federal smart card.
GCN: Is the government taking full advantage of technology to enable electronic transactions?
SCHU: We have been working with the Interior Department, which is at the forefront of this. They are going to have the first enterprisewide smart-card deployment. It will be used for physical and logical access, but because it will have a digital certificate on it, it can also be used with secondary applications for digital signatures. This will mean getting serious about getting rid of paperwork in government processes.
Interior already has enabled 400 forms into e-forms, and employees with their smart cards will be able to use their digital certificates to make a digital signature on those forms. The first step is to do that for government-to-government transactions. But they want to migrate that to government-to-business and government-to-citizen kinds of transactions. I think that is a good model we will see replicated.
GCN: What are some examples of current government-to-government applications?
SCHU: A really good example of information sharing is a system we are involved with in Pennsylvania called the Justice Network, or JNet. It's about law enforcement agencies passing sensitive information to each other. They have never done this before, because law enforcement agencies, by their natures, want to hold that information near their chests. All the federal law enforcement agencies that work in Pennsylvania also are subscribers to JNet. They all have certificates to authenticate themselves.
GCN: Government-to-citizen transactions still are pretty young. Is the public taking full advantage of the opportunities that are out there?
SCHU: I don't think they are. I think there will have to be a forcing function. What you are going to see happen is that a state or a couple of states will begin issuing smart driver's licenses, and the citizen will then have a digital certificate that they can use for higher level transactions. There is a good chance that financial institutions will be issuing digital forms of authentication to their customers as a way of combating phishing problems. We think we are at the beginning of a wave of identity theft attacks and we are going to need to have more protection for citizens doing transactions.
GCN: It is interesting that you see state government and companies as the drivers in citizen-level adoption.
SCHU: I think it is really tough for the federal government to take that on. It is very concerned about not being in the position of issuing a national ID card. Our de facto national ID card is our driver's license. And the states have the infrastructure in place for identity proofing, which is really the heavy-lifting part of the authentication process. It is the expensive part. So pushing it back to the DMVs really does make sense to get certificates into the hands of citizens.