Security fears push PKI to front burner
Connecting state and local government leaders
Defense to accelerate use of encryption, digital signatures to stymie hacker attacks
Ongoing hacker attacks have pushed the Defense Department to do something it hasn't been able to do for five years. By July 31, all the military services and agencies must fully install a public-key infrastructure to help ward off continued network intrusions and information thefts.Air Force Lt. Gen. Charles Croom, commander of the Joint Task Force-Global Network Operations, on Jan. 17 directed DOD to accelerate implementation of PKI and public-key enabling for user authentication, digital signatures and encryption on all of its desktops, servers and laptops. JTF-GNO, which reports to the Strategic Command, is responsible for operating and protecting the Global Information Grid, the heart of network-centric warfare, intelligence and business operations.'Compliance with this [order] will enhance the security of DOD information systems and establish deadlines for training, verification, installation, and progress reporting,' said a JTF-GNO spokesman.According to a JTF-GNO memo issued in December, DOD has revised the schedule for PKI implementation, which will require 100 percent use of smart cards to log on to the Non-Classified IP Router Network by July 31.DOD issued Directive 8520.2 in April 2004, establishing policy, assigning responsibilities and prescribing procedures for developing and implementing a DOD-wide PKI. The directive did not specify when the services had to fully implement the technology.PKI provides strong authentication of users and, when used in conjunction with passwords, significantly improves the security of networks. PKI is one of the uses planned for the military's Common Access Card, a smart card issued to millions of DOD personnel.'The DOD PKI program has been around for a long time,' said Tom Gilbert, chief technology officer for Blue Ridge Networks Inc. of Chantilly, Va., and a strong supporter of PKI. 'It has a checkered past, with some notable failures behind it and many hundreds of millions of dollars spent. [But] we're hopeful it'll be taken seriously and implemented properly.'The security clampdown follows media reports in September that Chinese hackers had successfully penetrated military computer networks and stolen valuable information in a campaign dubbed Titan Rain by federal investigators.Croom said that 60 percent of the cyberthreats in 2002 were of domestic origin. 'Now that's inverted'60 percent are international,' he said recently at a DOD cybercrime conference in Florida.One of Croom's first security actions was to order an 'information assurance stand-down day' across all of DOD on Nov. 28 to review computer security policies.As part of the stand-down, Croom ordered all the services and military agencies to verify their user accounts.'It's a simple thing, but do you know how hard that is to do?' he said. 'DISA alone had 3,000 ex- pired or unauthorized accounts.'Between 10 percent and 20 percent of all DOD accounts were either expired, unauthorized or had higher access than the users qualified for, he said.The stand-down prompted another reaction, Croom said, after DOD users changed their passwords following the refresher course on computer security. Malicious outsiders soon began 'trying to spoof users into giving up their passwords.'In December, John Grimes, Defense CIO and assistant secretary for networks and information integration, released a new manual on information assurance training, certification and workforce management that applies to all DOD components.Croom also ordered that any inbound ports on computers not being used by authorized military networks be closed to shut off Internet prowlers.'It looks to me like they are heading in the right direction,' said one industry consultant with expertise in PKI, who noted that DOD had some early scalability problems. 'And through access control and access management, they are reducing the number of threats.'
Defense to accelerate use of encryption, digital signatures to stymie hacker attacks
NEXT STORY: DHS e-passport pilot project begins