San Diego Business Journal

— Intertwined cyber networks, connectivity and decision-making systems have become essential elements of the U.S. military’s information technology infrastructure and everyday operations. Defense and IT industry leaders are working on creating a robust, flexible and open architecture — one that separates data, applications and hardware — that makes seamless interoperability of all cooperating forces possible.

As the military continues to migrate to more modern IT, such as cloud computing and commercial off-the-shelf software applications, the private sector will become more of a critical component for fending off cyber criminals and state-sponsored attacks, which not only impact the military’s global operations but also homeland security.

“We are still migrating from IT systems like servers and network computers to more integrated systems where you can use any type of device such as smart phones, PDAs (personal digital assistants) and laptops to access servers within a ‘cloud’ these days,” said Terry Simpson, principal deputy for intelligence at San Diego-based Space and Naval Warfare Systems Command.

SPAWAR is the Navy’s multi-billion-dollar IT arm that develops and deploys advanced communications and information capabilities and is the Navy’s chief engineering branch in command, control, communications, computers and intelligence, known as C4I.

“We are looking at advantages or inherent capabilities that these new technologies will allow in terms of security information, access control and identity management,” Simpson said. “The private sector controls more than 85 percent of cyber infrastructure, so we are looking to industry and other government partners to help us drive standards and adopt new capabilities in these areas.”

Simpson says with the escalating cyber threat looming over the military’s networks, it is imperative that the military have strong identity-management capabilities in its cyber policies. The U.S. Department of Defense is focusing its cyber efforts these days more on mission assurance and using an enterprise approach to data management and security and information sharing and collaboration.

“Everything we do touches the cyber world,” he said. “We really have to focus on smart leverage with industry players, academia, as well as state and local governments in terms of working together and sharing information and trying to help foster best practices. Today, we’re looking more toward in-depth security with layered measures where you may have more robust access control, robust ID of users and identity management that is more focused on mission assurance as a whole instead of protecting individual information links.”

Securing Military Networks

One San Diego-based firm helping the U.S. military secure its networks is Sentek Global, which specializes in government and commercial IT security. Under a $20 million, five-year contract, Sentek is leading a team that is performing information assurance and certification services for SPAWAR. Since the military is using more commercial off-the-shelf technology for its cyber infrastructure, the organization could be more vulnerable to the same cyber attacks as personal PCs, says Cameron Matthews, Sentek’s chief technology officer.

“The military also now has to deal with Windows, which means they can have the same viruses that hurt you and me,” Matthews said. “Our job is to help prevent those types of attacks and problems. We are working with the Navy’s engineering teams as they are building the systems to make sure they have patched all the known weaknesses and vulnerabilities in their networks.”

Since the Defense Department is creating and using IT systems that are seamlessly connected, when one command, for example, is attacked, that cyber attack is sure to soon infiltrate another. So says Stan Tyliszczak, senior director of technology integration in the chief technology office of General Dynamics Corp.

“Criminal cyber events are going on every day, and these incidents are being detected literally every second,” Tyliszczak said. “If the Navy in San Diego detects a threat, they may report it to a Department of Defense warfare information center, and so on. They want and need to know if that attack is happening elsewhere. It’s about creating a global community with information sharing. What we do is the integration for that information to coordinate activities across the entire federal government.”

Virginia-based General Dynamics provides the entire spectrum of cybersecurity solutions to the Defense Department, including network defense, such as ensuring networks are protected against any exploitations by terrorists or the casual hacker, as well as those looking to compromise information like intellectual property or financial information.

“One of the biggest trends in cyber crime is an attempt of anonymity,” Tyliszczak said. “Five to 10 years ago, we could trace a crime to somebody using a server in the Ukraine. Today, it could be somebody in Asia who will try to relay their attack through a server in the Ukraine to hide the source of the true attacks.”

Tyliszczak says the revolution of the Internet and Web 2.0, along with advanced collaboration tools, now allow the U.S. military to share cyber information across different geographical locations.

“There is a growing recognition that cybersecurity is part of everything we do,” he said. “We will continue to see more sophisticated technology that will allow us to get greater and greater insight on what’s happening in the networks so we can look at cyber criminal patterns that will not only help the Defense Department but also the war fighter.”

Protecting Health, Family Matters

Other computer networks and infrastructure in the military such as health care-based and family focused programs can also be vulnerable to cyber attacks. That’s why San Diego-based DefenseWeb Technologies Inc. is working with the military to create secure health care management applications and dynamic Web applications for service members and their families.

Systems that DefenseWeb builds for the military go through the Department of Defense Information Assurance Certification and Accreditation Process to ensure that appropriate risk-management practices are applied and security vulnerabilities are mitigated on Department of Defense information systems.

“The Department of Defense has had to embrace a combination of new open source and commercial off-the-shelf technologies, which has changed the dynamics of how they build and operate their cyber infrastructure,” said Chris Fletcher, chief technology officer for DefenseWeb Technologies, which has 175 employees and has been a defense contractor since 1998.

“What has been challenging for us is integrating all of these commercial off-the-shelf technologies like Google Apps and having to ensure the security for these technologies,” Fletcher said. “In the past few years we have seen a lot more integration work for the DoD rather than just building systems from scratch. That represents different challenges. It increases the scope of things you have to secure and you rely more heavily on third-party vendors to provide those security assurances for you as well.”

On Duty Against Cyber Crime

While the Defense Department gets up to speed on today’s new cyber infrastructure and security networks, there are other companies working with a number of governmental agencies at the federal, state and local levels to raise awareness of cyber crime.

Enter ESET LLC, a San Diego-based anti-virus software and IT security firm. ESET has developed strong relationships with the Defense Department, Department of Homeland Security, FBI, U.S. Attorney’s Office, and the state of California to provide cybersecurity training and education. The company also works with a number of defense subcontractors and has an ongoing dialogue with the military and law enforcement regarding cybersecurity issues.

“Probably the biggest vulnerability and largest area of need for cybersecurity education in the military relates to social engineering,” said Randy Abrams, director of technical education for ESET. “Some of the attacks the military has suffered have been because someone was tricked into opening and uploading a document or PDF file. When you have someone who has access to highly classified systems, you want them to be resilient against social engineering attacks. There is a huge need for advanced social engineering training. It really raises the bar in what it takes to thwart cyber crime.”

Andrea Siedsma is a freelance writer for the Business Journal.