Cyber chief argues for new approaches
Connecting state and local government leaders
STRATCOM commander proposes switch to white listing, more sensors and greater training and accountability in cyber domain.
The military's commander of U.S. Strategic Command in charge of cyberspace, Air Force Gen. Kevin Chilton, warned that the underlying challenges and costs of operating in cyberspace often go unrecognized. And he proposed several measures to improve the security of the military's non-classified networks.'The hardest thing we're challenged to do in cyberspace,' said Chilton, isn't defending against cyberattacks. It is 'operating the net under attack.'Chilton, speaking at the Army LandWarNet conference in Fort Lauderdale, Fla., this week, said cyberspace needs to be viewed as an operating domain equal in scope to air, sea, land and space. 'It's an area that can be operated in, operated through, operated across; that can create effects in other domains, or be supported by operations in other domains,' he said. 'The thing that separates this domain from the others is that it operates at the speed of light.'People talk about defending or exploiting cyberspace, but we don't talk much about operating it if it's under attack,' Chilton said. 'It's not easy work. And it's not work to be taken on by amateurs.'Chilton argued that many of the incidents that are billed as cyberattacks are more accurately just old-fashioned espionage ' people looking for information who don't necessarily represent military threats.At the same time, the 'exfiltration of data is huge' and is cause for concern, he said.More problematic is the cost of dealing with viruses that make their way onto military networks.'Every time we have a problem or a virus is loaded, or someone comes in and takes over systems administration of a computer or a server, we have to take that system offline, scrub it, and sometimes throw it away. Guess what: That ain't free,' said Chilton.'We're trying to get our arms around how much this is costing us every time someone breaks into our NIPRNet [unclassified but sensitive Internet protocol router network]. Some estimates are around $100 million a year; some people think that figure is low,' Chilton said.What worries Chilton more are the risks associated with denial-of-service attacks. 'If you're in combat and have to get an important message through, anything that slows down the network is a real threat,' he said. One of the lessons that emerged from the denial-of-service attacks on the Estonian government last year, Chilton said, was the psychic impact that resulted from the loss of confidence in the reliability of the system. The effects of that lasted well after service was restored, he said. Chilton outlined several measures needed to address those threats. Perhaps the most radical of those ideas was his proposal to reverse 'the way we've elected to fight' on the Internet. 'We blacklist things; we say the following things aren't allowed on the NIPRNet,' he said. Instead, Chilton advocated moving to a whitelist model, where only those sites essential to an operator's work are accessible.Another step, which Chilton detailed with reporters after his presentation, would involve investing more heavily on sensor technology to filter and monitor data traffic. That would not only improve awareness and response times but ease the mounting burden of forensic work, Chilton said.Chilton also proposed making 'the operation and the defense of our network, the commander's business,' arguing for commanders to hold people more accountable when network incidents occur.Looking ahead, Chilton stressed the importance of increasing the number of people who are trained and equipped in the workings of cyberspace to be ready for attacks during a time of war.'Like in any other domain, we need to train like we're going to fight, and we're in the fight every day already,' he said.