Department Of Defense Wants To Enlist Private Sector For Cyber Defense

SAN FRANCISCO — The Defense Department, faced with defending not only its own networks but ensuring the security of the privately owned infrastructure on which the military increasingly depends, is expanding its efforts to tap the private-sector expertise that it needs, Deputy Defense Secretary William J. Lynn III said Tuesday.

“The government cannot secure our networks alone,” Lynn said. “It’s going to take a public/private partnership.”

Lynn, speaking at the annual RSA Security Conference, said DOD is investing $500,000 in new research with industry on network security, and will provide seed funding for companies to accelerate the development of needed technology.


Related coverage:

Cyber war dominates the landscape at RSA conference

Public-private effort on cybersecurity needs a push from Congress


But getting new technology into DOD systems also is a challenge. Lynn said that it takes the department an average of 81 months to implement a new IT system, which is completely out of line with the pace of development and introduction in the commercial sector. He noted that the development time for Apple’s iPod was just 24 months. To improve development, he said the department will expand its Technology Exchange Program, now in a pilot phase, in which private-sector employees will work inside DOD, and DOD workers will be loaned to companies.

DOD workers can learn greater efficiency from the private sector, and the companies need to understand the challenges faced by the military in implementing new technologies, Lynn said.

Finally, DOD will make better use of National Guard and reserve personnel, whose primary jobs are in the private sector. More of these units will have a dedicated cybersecurity mission, he said.

The need to cooperate and establish public/private partnerships has been a theme of government speakers at this year’s conference, now in its 20th year and one of the premier venues for the computer security industry to discuss challenges and showcase solutions.

The need for improved cybersecurity was made disturbingly clear in 2008 by the penetration of classified DOD systems by a foreign intelligence agency through malware loaded on a removable thumb drive.

“It was our worst fear,” Lynn said. Since that time, threats have continued to multiply and mature. The latest evolution is the development of malware that can do physical damage. “This development, which marks a strategic shift in cyber threats, is only just emerging,” he said.

He did not mention Stuxnet, the worm that apparently targeted Iranian nuclear facilities, but he said the threats do exist in the wild and it has to be assumed that they will be used. “Few weapons in the history of warfare have not been used,” he said.

Although nation states are most likely to have the resources and expertise to develop serious weapons, they are the least likely to use them because of the threat of retaliation, Lynn said.

“More than 100 intelligence agencies have attempted intrusions on our networks,” but the threat from them of cyberwarfare remains small. “The threat to them is too great; our military strength is too great.”

The more serious threat is from the accidental release of malicious code, or its use by terrorists, he said. They do not appear so far to have access to weaponized malware, but that could change. “We have to assume if they have the means to strike, they will do so.”

A new DOD cyberstrategy, called Cyber 3.0, is in the final stages of review, Lynn said. It will emphasize the use of active defenses, which are being deployed in military networks.

One serious challenge remaining in improving military cybersecurity is the exchange of information and sophisticated defense technologies with the private sector. DOD has a lot of information about threats and is developing defenses to counter them, but is not sharing much of that information, Lynn said.

 “We have the technology and the know-how to deploy it in a civilian context,” he said. What is lacking so far is the will and the policy to do it.

About the Author

William Jackson is a Maryland-based freelance writer.

Featured

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.