Department Of Defense Wants To Enlist Private Sector For Cyber Defense

SAN FRANCISCO — The Defense Department, faced with defending not only its own networks but ensuring the security of the privately owned infrastructure on which the military increasingly depends, is expanding its efforts to tap the private-sector expertise that it needs, Deputy Defense Secretary William J. Lynn III said Tuesday.

“The government cannot secure our networks alone,” Lynn said. “It’s going to take a public/private partnership.”

Lynn, speaking at the annual RSA Security Conference, said DOD is investing $500,000 in new research with industry on network security, and will provide seed funding for companies to accelerate the development of needed technology.

Related coverage:

Cyber war dominates the landscape at RSA conference

Public-private effort on cybersecurity needs a push from Congress

But getting new technology into DOD systems also is a challenge. Lynn said that it takes the department an average of 81 months to implement a new IT system, which is completely out of line with the pace of development and introduction in the commercial sector. He noted that the development time for Apple’s iPod was just 24 months. To improve development, he said the department will expand its Technology Exchange Program, now in a pilot phase, in which private-sector employees will work inside DOD, and DOD workers will be loaned to companies.

DOD workers can learn greater efficiency from the private sector, and the companies need to understand the challenges faced by the military in implementing new technologies, Lynn said.

Finally, DOD will make better use of National Guard and reserve personnel, whose primary jobs are in the private sector. More of these units will have a dedicated cybersecurity mission, he said.

The need to cooperate and establish public/private partnerships has been a theme of government speakers at this year’s conference, now in its 20th year and one of the premier venues for the computer security industry to discuss challenges and showcase solutions.

The need for improved cybersecurity was made disturbingly clear in 2008 by the penetration of classified DOD systems by a foreign intelligence agency through malware loaded on a removable thumb drive.

“It was our worst fear,” Lynn said. Since that time, threats have continued to multiply and mature. The latest evolution is the development of malware that can do physical damage. “This development, which marks a strategic shift in cyber threats, is only just emerging,” he said.

He did not mention Stuxnet, the worm that apparently targeted Iranian nuclear facilities, but he said the threats do exist in the wild and it has to be assumed that they will be used. “Few weapons in the history of warfare have not been used,” he said.

Although nation states are most likely to have the resources and expertise to develop serious weapons, they are the least likely to use them because of the threat of retaliation, Lynn said.

“More than 100 intelligence agencies have attempted intrusions on our networks,” but the threat from them of cyberwarfare remains small. “The threat to them is too great; our military strength is too great.”

The more serious threat is from the accidental release of malicious code, or its use by terrorists, he said. They do not appear so far to have access to weaponized malware, but that could change. “We have to assume if they have the means to strike, they will do so.”

A new DOD cyberstrategy, called Cyber 3.0, is in the final stages of review, Lynn said. It will emphasize the use of active defenses, which are being deployed in military networks.

One serious challenge remaining in improving military cybersecurity is the exchange of information and sophisticated defense technologies with the private sector. DOD has a lot of information about threats and is developing defenses to counter them, but is not sharing much of that information, Lynn said.

 “We have the technology and the know-how to deploy it in a civilian context,” he said. What is lacking so far is the will and the policy to do it.

About the Author

William Jackson is a Maryland-based freelance writer.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3