Kevin Coleman


US cyber defenses outmatched by hackers

Cyber threat environment exceeds US ability to defend against it

The cyber threat environment is making many people uncomfortable and nervous — and rightfully so. People in the military, the intelligence community, members of Congress and others are concerned about our country’s ability to anticipate cyberattacks, defend against acts of cyber aggression and respond to such acts in a timely manner. Add to those issues the phone hacking scandal that is rocking Britain, which now has the connected user community on edge, and also has increased the overall concern about cybersecurity for mobile devices.

Clearly, this is a huge challenge.

Although no country is isolated from the threat of cyber aggression, the United States is the most heavily dependent on the Internet, computers and a host of other digital devices.


Cyber espionage game has high stakes

More from the Digital Conflict blog

Although some say the threat is way overblown, others continue to sound the alarm. There are still others that are quick to point out that the United States will not do what is necessary to address this risk until we learn our lesson; that is, experience a substantive event. I asked James Howe, vice president of threats, technology and future requirements at Vision Centric for his view, and he said, “Based on my experience and observations, the current cyber threat environment is rapidly advancing and becoming dramatically more dangerous. This is taking place at a rate that far exceeds our current ability to respond.”

James is not the only one with those concerns. During the past few months, I have been collecting some of the biggest concerns about our ability to address cyber threats. Here are some of those concerns.

  • The bureaucracy that is all too common throughout our government will inhibit timely decision-making because of the dynamics of the cyber threat environment.
  • The traditional military mindset and regimented operational model are too rigid and serve to negate the flexibility, creativity and innovation that are fundamental requirements in several areas and critical to addressing the current and future cyber threat environment.
  • The failure to recognize our critical infrastructure providers in the private sector as a primary consumer of our cyber threat intelligence increases the likelihood of a successful attack.
  • Many in the private sector are looking for our government to fund enhanced defenses for our critical infrastructure given it is a national security issue and also an economic threat.
  • Availability of appropriately skilled resources in the quantity necessary and the funding to support these positions in the government, military and private sector critical infrastructure is highly questionable.

I have to say I share these concerns. However, it is worth noting that the Cyber Command and the vast supporting infrastructure, including the cyber defense industry, was established in what many believe to be record time. But is this fast enough?

The blur between criminal acts in cyberspace, cyber terrorism, cyber espionage and acts of cyber aggression by rogue nations has placed U.S. defense forces in a very precarious position. The complexities associated with attribution of acts of cyber aggression to a specific source, coupled with the use of compromised servers and unknowing and unwilling participants in noncooperative countries as intermediaries in the cyberattacks, all combine to make a rapid, accurate attribution of responsibility for attacks with a high degree of confidence highly unlikely.

There is no question that the United States must rapidly fortify its cyber defenses to avoid a threshold-level-incident that would escalate into a full-blown confrontation. Such a confrontation would undoubtedly occur in cyber and physical domains after highly publicized comments from defense officials. I recently was asked an interesting question:  Will there ever be peace in cyberspace? At this point I would have to say that is highly doubtful.

At this point there are more questions than there are answers. Doctrine needs to be written, technology needs to be developed and international standards need to be established. All this must occur in a very short period of time. As history has shown us, governments do not move quickly. Perhaps the most challenging aspect of addressing this threat will be the continual updating of doctrine, technology and standards at a pace equal to that with which the threat evolves. One thing is for sure, we must not fail for the consequences of failure are far too great.

Reader Comments

Fri, Sep 2, 2011

The saying goes "follow the money". Most of the advocates of "we are doing to little" are those who have the most to gain. The advocates on the Gov't side, its funding and control. The advocates on the contractor side it's a increase in the contracts given out by the Gov't. At the same time some of the contractors are telling the Gov't how insecure their systems are, some of the same companies are trying to sell the Gov't Cloud products which open even more security holes. Mark me down for the threat is overblown!

Wed, Aug 24, 2011

First bullet sums up it all! Hackers vs bureaucracy; who will win?

Mon, Aug 22, 2011

The Defense Science Board report on cyber mentioned specifically that more lines of code is inheritly more insecure. So why does the DoD continue to by systems with more lines of code and complexity? Why does it over pay for these systems when the vast majority of their users never actually use those extra lines of code that increase the attack surface ? Shouldn't the DoD be looking at reducing the attack surface, simplifying security, using open source especially when it comes to operating systems on devices?

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Your Name:(optional)
Your Email:(optional)
Your Location:(optional)
Please type the letters/numbers you see above