March 19, 2019
Category archive


The United States needs a Department of Cybersecurity

in China/Column/computer security/Congress/cyberattack/cybercrime/Cyberwarfare/Delhi/department of defense/Department of Homeland Security/department of justice/executive/Federal Bureau of Investigation/Government/hacking/India/national security/Politics/Russia/San Francisco/Security/spy/United States/Washington by

This week over 40,000 security professionals will attend RSA in San Francisco to see the latest cyber technologies on display and discuss key issues. No topic will be higher on the agenda than the Russian sponsored hack of the American 2016 election with debate about why the country has done so little to respond and what measures should be taken to deter future attempts at subverting our democracy.

For good reason. There is now clear evidence of Russian interference in the election with Special Counsel Mueller’s 37-page indictment of 13 Russians yet the attack on US sovereignty and stability has gone largely unanswered.  The $120 million set aside by Congress to address the Russian attacks remains unspent. We expelled Russian diplomats but only under international pressure after the poisoning of a former Russian spy and his daughter.

Recent sanctions are unlikely to change the behavior of the Putin administration. To put it bluntly, we have done nothing of substance to address our vulnerability to foreign cyberattacks. Meanwhile, our enemies gain in technological capability, sophistication and impact.

Along with the Russians, the Chinese, North Koreans, Iranians and newly derived nation states use cyber techniques on a daily basis to further their efforts to gain advantage on the geopolitical stage. It is a conscious decision by these governments that a proactive cyber program advances their goals while limiting the United States.

Krisztian Bocsi/Bloomberg via Getty Images

We were once dominant in this realm both technically and with our knowledge and skillsets. That playing field has been leveled and we sit idly by without the will or focus to try and regain the advantage. This is unacceptable, untenable and will ultimately lead to potentially dire consequences.

In March of this year, the US CyberCommand released  a vision paper called “Achieve and Maintain Cyberspace Superiority.” It is a call to action to unleash the country’s cyber warriors to fight  for our national security in concert with all other diplomatic and economic powers available to the United States.

It’s a start but a vision statement is not enough.  Without a proper organizational structure, the United States will never achieve operational excellence in its cyber endeavors.  Today we are organized to fail.  Our capabilities are distributed across so many different parts of the government that they are overwhelmed with bureaucracy, inefficiency and dilution of talent.

The Department of Homeland Security is responsible for national protection including prevention, mitigation and recovery from cyber attacks. The FBI, under the umbrella of the Department of Justice,  has lead responsibility for investigation and enforcement. The Department of Defense, including US CyberCommand, is in charge of national defense.  In addition, each of the various military branches  have their own cyber units. No one who wanted to win would organize a critical  capability in such a distributed and disbursed manner.

How could our law makers know what policy to pass? How do we recruit and train the best of the best in an organization, when it might just be a rotation through a military branch? How can we instantly share knowledge that benefits all when these groups don’t even talk to one another? Our current approach does not and cannot work.

Image courtesy of Colin Anderson

What is needed is a sixteenth branch of the Executive — a Department of Cybersecurity — that  would assemble the country’s best talent and resources to operate under a single umbrella and a single coherent policy.  By uniting our cyber efforts we would make the best use of limited resources and ensure seamless communications across all elements dealing in cyberspace. The department would  act on behalf of the government and the private sector to protect against cyberthreats and, when needed, go on offense.

As with physical defense, sometimes that means diplomacy or sanctions, and sometimes it means executing missions to cripple an enemy’s cyber-operations. We  have the technological capabilities, we have the talent, we know what to do but unless all of this firepower is unified and aimed at the enemy we might as well have nothing.

When a Department of Cybersecurity is discussed in Washington, it is usually rejected because of the number of agencies and departments affected. This is code for loss of budget and personnel. We must rise above turf battles if we are to have a shot at waging an effective cyber war. There are some who have raised concerns about coordination on offensive actions but they can be addressed by a clear chain of command with the Defense Department to avoid the potential of a larger conflict.

We must also not be thrown by comparisons to the Department of Homeland Security and conclude a Cybersecurity department would face the same challenges. DHS was 22 different agencies thrust into one. A Department of Cybersecurity would be built around a common set of skills, people and know-how all working on a common issue and goal. Very different.

Strengthening our cyberdefense is as vital as having a powerful standing army to defend ourselves and our allies. Russia, China and others have invested in their cyberwar capabilities to exploit our systems almost at will.

Counterpunching those efforts requires our own national mandate executed with Cabinet level authority. If we don’t bestow this level of importance to the fight and set ourselves up to win, interference in US elections will not only be repeated …  such acts will seem trivial in comparison to what could and is likely to happen.

News Source =

EU defense ministers take part in first cyber war game

in computer security/cyberattack/cybercrime/cyberspace/Cyberwarfare/Delhi/Europe/European Union/Government/hacking/India/national security/Policy/Politics/Security/TC by

European Union defense ministers have been taking part in a simulated cyber attack exercise today for the first time to practice strategic decision making and crisis-management under pressure of a (mock) cyber-attack against the bloc’s military structures.

The two-hour war game exercise, named EU CYBRID 2017, was held in Tallinn, Estonia, where the EU defense ministers are meeting for informal discussions on a range of security issues.

Cyber attacks targeting and damage civilian infrastructure, such as powerplants, was not included in this particular exercise. Although recent malware activity, such as the Wannacry ransomeware attacks, which locked some UK hospitals out of their IT systems and led to operations being canceled, likely contributed to the decision to run the exercise, said a minister of defense spokeswoman.

She said the fictitious scenario focused on threats to military operations in the Mediterranean.

According to Reuters the exercise involved the EU’s naval mission in the Mediterranean being sabotaged by hackers who cripple the mission’s command on land while also launching a campaign on social media to discredit EU operations and provoke protests.

The exercise was generally aimed at giving ministers the chance to practice situational awareness, crisis management and strategic communication between member states — with the overarching goal of moving towards establishing a policy guideline for the European Union to adopt in the event of such a cyber war situation.

Increasing defense ministers’ awareness about the potential scale of risks posed by cyber attacks appears to be an early take-away from the exercise, according to the spokeswoman.

“What we’ve seen is that the ministers were very interested in it, and it gave them an overview of the the threat and what could happen actually because the scenario was built up in such a way that the situation is escalating,” she told us. “In the beginning it might seem like a small thing… It’s pretty hard to assess how big a deal it is. They got an overview that it can escalate to a very, very serious business and that can attack also the military operations.”

“The exercise wasn’t about finding a very concrete, one solution. It was just to get the [understanding] to watch this road,” she added, emphasizing that it’s the first time such an exercise has taken place with defense ministers — and describing it as the “first step” on the road towards a better “common understanding”, which is the necessary base for the EU being able to establish guidelines to respond to (real) cyber attacks against its military structures.

Commenting on the exercise in a statement, Estonia’s minister for defense, Jüri Luik, added: “The cyber world and cyber threats do not recognise national boundaries or the barriers between organisations. It is therefore important to perform joint exercises of this kind, between European Union member states as well as the EU and NATO. We must exchange information and have a common understanding, in order to ensure improved preparedness for dealing with cyber threats.”

Featured Image: Annika Haas / EU2017EE

News Source =

Go to Top