CISO Perspectives: The Einstein Program

On Jan. 8, President Bush issued the Cyber Initiative order,
otherwise known as National Security Presidential Directive 54
(HSPD-54)/Homeland Security Presidential Directive 23 (HSPD-23).
The order, issued in response to increasingly complex and
aggressive cyberattacks against U.S. government and civilian
network infrastructures, outlined dramatic measures to improve the
security of government networks.

Among other measures, the order authorized the National Security
Agency to monitor federal computer networks. The joint directive
also required that the government dramatically scale back the

number of points at which federal networks connect to the public
Internet.

Included among the publicly

disclosed components of the Cyber
Initiative is the deployment of Einstein sensors on approved
federal government Internet access points. The Einstein Program,
managed by Homeland Security Department’s National
Preparedness and Policy Directorate, will capture certain segments
of federal network traffic in near real time, in order to perform
analysis and provide federal agencies with situational awareness
concerning the state of Internet traffic across the federal .gov
domain. This passive collection of data needed for analysis will
not interfere with the communications to and from agencies.
Targeted data collection is strictly limited and is determined
based on criteria for anomaly detection and other information
technology risks. This data may include:

• Autonomous System Numbers (ASN). An ASN identifies the
  autonomous system and networks using the same specified routing
  policy and enables the systems to exchange information.

  With the explosive adoption rates of virtualized computing environments due to their promise of less costly data center hardware, quicker provisioning and increased flexibility, federal government chief information security officers are faced with the challenge of effectively securing these virtualized environments while balancing the constant pressure on IT to respond quickly to urgent business needs. The CISO's challenge is further complicated by the fact that there's a marked absence in guidance from the standards bodies, very little from the vendor community and a very serious knowledge gap in the systems administration, security practitioner, and audit communities. This article will explore some of the virtualization security best practices that hold the most promise for government systems.
  

  
  
• Internet Control Message Protocol (ICMP) Type/Code. ICMP is
  used to communicate control messages on the Internet between
  hosts/routers.
  
• Packet Length. A packet is a specially formatted group of bits
  containing data, an Internet Protocol (IP) address and control
  information that is transmitted over a network as a collective
  unit.
  
• Protocol. A protocol is a standardized means of communication
  among machines across a network.
  
• Sensor identification and connection status. Sensor
  identification is the description of where the sensor is located as
  to clearly identify which network, system or agency the data is
  coming from.
  
• Source and Destination IP Address. IP addresses are four octet
  (32-bit) source or destination addresses that uniquely identify
  computers either on a given network or on the Internet.
  
• Source and Destination Port. In the networking world, the term
  “port” is a number that identifies the beginning or
  endpoint of a logical connection.
  
• Transmission Control Protocol (TCP) flag information. Simply
  stated, a TCP flag is information that is added to packets
  traveling between computers that describes the status of the
  connection between the computers.
  
• Timestamp and duration information. A time that is printed to a
  file (such as e-mail) or other location to help keep track of when
  data is added, removed, sent, received, etc.
  
• Payload Information.
  

• Determining the scope and effect of any specific worm across
  the federal government and how it relates to the Internet community
  at large.
  
• Detecting anomalous network behavior or activities against the
  federal government and determining whether it’s a focused
  attack or part of a larger Internet-related activity.
  
• Determining the level of impact and any damage associated with
  cyberattacks against the federal government.
  
• Diagnosing specific federal agency Internet traffic problems as
  they relate to the much larger Internet backbone
  infrastructure.
  
• Pinpointing the apparent source responsible for any
  cyber-related attacks.
  
• Determining the cyber state of the federal government in near
  real-time and its interaction with the global Internet
  community.
  
• Compiling an overall situational awareness of trends and
  traffic patterns for all participating federal agencies.
  
• Detecting early warning and indications of emerging attacks and
  malicious reconnaissance activities and adverse impact on federal
  government agencies.
  
• Correlating system compromises across the federal
  government.
  

The program makes several underlying assumptions about the
pre-existence of a number of key infrastructures within federal
agencies that may not be correct in all cases. Looming large among
these are the assumptions that all targeted agencies have incident
response personnel trained and cleared at the appropriate levels
and with the capabilities to discuss classified detects via phone
(Secure Telephone Equipment) or e-mail (Secret Internet Protocol
Router Network, SIPRNet). There are, of course, wide variances
between departments and agencies because there has been no
requirement for such capability.

The program also makes an implicit assumption regarding the
robustness of the incident response capabilities of federal
agencies. Here too, we find major variances across departments and
agencies with capabilities ranging from fully outsourced cyber
response activities, minimally staffed lights-out operations, to
fully staffed 24x7 operations.

On the more technical front, it still isn’t clear the
degree to which DHS Einstein technology will be capable of true
active mode configuration employing underlying Deep Packet
Inspection to “unwrap and inspect” packets. The ability
to detect attacks is one thing, preventing network-based attacks
and malware at wire speeds is another.

Consequently, the perceived passivity of the Einstein sensor
technology itself becomes another area of concern. The bare-bones
staff at operational incident response centers is already
sufficiently overwhelmed with alerts from enterprise anti-virus,
deployed network and host-based intrusion detection and firewall
and router log analysis. One could argue that adding another
passive data source to include in an already bandwidth-constricted
triage process isn’t helping complete the
prevent-detect-respond triad.

The Einstein Program and its promise to deliver a federal cyber
weather map is greatly needed to improve the cyber early warnings
and indicators across the federal government and to enhance overall
federal cyber situational awareness. The program however, is not
without a number of challenges, which if overlooked by DHS program
directors, could degrade the program’s overall
effectiveness.