Another View: Navy's network services buy pays off
Connecting state and local government leaders
A few years ago, network security meant warding off a few viruses and hackers. In al-Qaida camps in Afghanistan, however, our forces found computers containing information on U.S. water systems. As tensions with Iraq rose, so did the threat of cyberattacks. And in 2002, the Federal Computer Incident Response Center tallied 489,912 security incidents, ranging from reconnaissance to denial of services.
A few years ago, network security meant warding off a few viruses and hackers. In al-Qaida camps in Afghanistan, however, our forces found computers containing information on U.S. water systems. As tensions with Iraq rose, so did the threat of cyberattacks. And in 2002, the Federal Computer Incident Response Center tallied 489,912 security incidents, ranging from reconnaissance to denial of services.Cyberspace is the new battlefield. The more organizations examine their network security, the worse it often looks. For many, it's too complicated to fix, and managing it will be even more complicated tomorrow. A solution may be for services to team with the best of industry. The Navy Department is doing that with the Navy-Marine Corps Intranet.Launched by the Navy in 2000, NMCI is replacing a patchwork of incompatible, shore-based networks with one secure intranet that will eventually deliver video and data to more than 400,000 users. It's also being linked to networked forces at sea, ultimately contributing to a global network. We did this to create efficiencies that many corporations have achieved using enterprisewide networks. It will also make bases ashore more responsive to forces at sea.There was another reason for NMCI: security. When each subordinate command had its own network, many had poor security and some had none. Intruders merely had to find an accessible gateway to affect networks linked to ships at sea. Our networks were getting hammered. In 2001, the Navy counted some 16,000 attempts to access our networks. Of these, 400 gained entry, and 40 traveled the networks.We discovered many weaknesses in our own networks while implementing NMCI. Replacing multiple networks meant eliminating vulnerable gateways. Initially, we thought we had 200 networks and gateways. We have found more than 1,000. The bigger problem was the magnitude of software applications. Most big companies have only a few hundred. We found 100,000. Many were redundant. They impeded information flow and above all created security vulnerabilities.Building shore networks is not a core part of the Navy's mission. Naval leaders therefore decided that NMCI would be built, run and upgraded by industry. Essentially, we buy it as a service.The NMCI initiative, by rooting out vulnerabilities, is raising defenses. It's giving us uniform security standards and training for people before they use the network. It also includes defense-in-depth security. Our network operations centers control intranet traffic, and they can isolate the network if need be.We test NMCI security, and we impose a penalty if it fails. Red teams, independent of the contractor, review network designs for vulnerabilities and periodically conduct simulated attacks. If they breach the network, the contractor could lose as much as $10 million a year.The bottom line is, NMCI is working. It protects naval networks from intrusions. It's stopped 4,000 viruses at the door. NMCI was unaffected by the SQL Slammer worm in January.It also helped us respond to physical losses. In the 9-11 attack on the Pentagon when the Navy lost 70 percent of its office space, the NMCI contract let us reconstitute our computer systems in new space by Sept. 19.Whether we see it or not, our networks are under attack. NMCI is protecting the Navy. Other U.S. networks must be similarly protected. Now is the time for action.
Rear Adm. Charles L. Munns is director of the NMCI Program Office.
Charles L. Munns
Rear Adm. Charles L. Munns is director of the NMCI Program Office.
NEXT STORY: Data headaches