Department Of Defense Wants To Enlist Private Sector For Cyber Defense

SAN FRANCISCO — The Defense Department, faced with defending not only its own networks but ensuring the security of the privately owned infrastructure on which the military increasingly depends, is expanding its efforts to tap the private-sector expertise that it needs, Deputy Defense Secretary William J. Lynn III said Tuesday.

“The government cannot secure our networks alone,” Lynn said. “It’s going to take a public/private partnership.”

Lynn, speaking at the annual RSA Security Conference, said DOD is investing $500,000 in new research with industry on network security, and will provide seed funding for companies to accelerate the development of needed technology.


Related coverage:

Cyber war dominates the landscape at RSA conference

Public-private effort on cybersecurity needs a push from Congress


But getting new technology into DOD systems also is a challenge. Lynn said that it takes the department an average of 81 months to implement a new IT system, which is completely out of line with the pace of development and introduction in the commercial sector. He noted that the development time for Apple’s iPod was just 24 months. To improve development, he said the department will expand its Technology Exchange Program, now in a pilot phase, in which private-sector employees will work inside DOD, and DOD workers will be loaned to companies.

DOD workers can learn greater efficiency from the private sector, and the companies need to understand the challenges faced by the military in implementing new technologies, Lynn said.

Finally, DOD will make better use of National Guard and reserve personnel, whose primary jobs are in the private sector. More of these units will have a dedicated cybersecurity mission, he said.

The need to cooperate and establish public/private partnerships has been a theme of government speakers at this year’s conference, now in its 20th year and one of the premier venues for the computer security industry to discuss challenges and showcase solutions.

The need for improved cybersecurity was made disturbingly clear in 2008 by the penetration of classified DOD systems by a foreign intelligence agency through malware loaded on a removable thumb drive.

“It was our worst fear,” Lynn said. Since that time, threats have continued to multiply and mature. The latest evolution is the development of malware that can do physical damage. “This development, which marks a strategic shift in cyber threats, is only just emerging,” he said.

He did not mention Stuxnet, the worm that apparently targeted Iranian nuclear facilities, but he said the threats do exist in the wild and it has to be assumed that they will be used. “Few weapons in the history of warfare have not been used,” he said.

Although nation states are most likely to have the resources and expertise to develop serious weapons, they are the least likely to use them because of the threat of retaliation, Lynn said.

“More than 100 intelligence agencies have attempted intrusions on our networks,” but the threat from them of cyberwarfare remains small. “The threat to them is too great; our military strength is too great.”

The more serious threat is from the accidental release of malicious code, or its use by terrorists, he said. They do not appear so far to have access to weaponized malware, but that could change. “We have to assume if they have the means to strike, they will do so.”

A new DOD cyberstrategy, called Cyber 3.0, is in the final stages of review, Lynn said. It will emphasize the use of active defenses, which are being deployed in military networks.

One serious challenge remaining in improving military cybersecurity is the exchange of information and sophisticated defense technologies with the private sector. DOD has a lot of information about threats and is developing defenses to counter them, but is not sharing much of that information, Lynn said.

 “We have the technology and the know-how to deploy it in a civilian context,” he said. What is lacking so far is the will and the policy to do it.

About the Author

William Jackson is a Maryland-based freelance writer.

Featured

  • Survey: Less Than Half of IT Leaders are Confident in their IoT Security Plans

    Viakoo recently released findings from its 2024 IoT Security Crisis: By the Numbers. The survey uncovers insights from IT and security executives, exposes a dramatic surge in enterprise IoT security risks, and highlights a critical missing piece in the IoT security technology stack. The clarion call is clear: IT leaders urgently need to secure their IoT infrastructure one application at a time in an automated and expeditious fashion. Read Now

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3