U.S. Air Force CIO says cybersecurity federal "Achilles' heel"

Until best practices in information security become pervasive across all aspects of the enterprise, agencies' networks remain at risk, said a top technology chief with the Air Force at a conference Wednesday, calling cybersecurity one of the federal government's most overlooked and critical weaknesses.

"There's too much fighting about cyber -- how big [a concern] it is, who owns it," said Lt. Gen. Michael Peterson, chief information officer at the Air Force, during a keynote at Air Force IT Day, sponsored by the Armed Forces Communications and Electronics Association of Northern Virginia.

"This is our Achilles' heel," he said. "It's not about a denial-of-service attack; it's about the information on the network -- ensuring it's accurate, protected, and available. [But] we're still fighting over what patch to put on."

Despite Russia's cyberwarfare tactics against Estonia and Georgia, Peterson said an all-out cyberwar won't happen; instead, cyberattacks will become one of many combat strategies used by adversaries to bring government to its knees.

"It won't be a pure fight," he said. "It will incorporate all domains … The battle is ongoing and these guys are very good."

To combat cyberattacks, information security needs to become more pervasive across agencies and across government, Peterson said. Too often it is managed separately from other operations, he said, but an enterprisewide approach is necessary to ensure that daily processes that traditionally receive less oversight do not introduce security vulnerabilities. Standards should be engrained across all disciplines, he added.

"Good security practices are not just good security practices," he said. "They're required security practices … This is too important to not [be] embraced in the broadest view possible."

Peterson said the incoming administration is well aware of the threat, noting he plans to brief the transition team about cybersecurity later in the afternoon. President-elect Barack Obama has already met with John Grimes, chief information officer and assistant secretary of networks and information infrastructure at the Defense Department.

The Air Force has changed its strategy for cybersecurity in recent months. In December 2007, former Secretary Michael Wynne signed a directive to stand up the Air Force Cyber Command that would work alongside the space, air combat and other commands. That plan was scrapped after lapses in the security of the nation's nuclear arsenal prompted the reallocation of resources to a Global Strike Command.

In October 2008, the same month the Cyber Command was scheduled to begin operation, the Pentagon announced that cyber operations would instead be organized within the Air Force Space Command and named the 24th Air Force. About 6,000 people are expected to work in the cyber component.

U.S. Air Force Generals Lose One

U.S. Air Force has officially scrapped its planed Cyber Command.

This new organization was supposed to officially begin operating by the end of the year. Instead, many of the personnel that were going to staff the new command are being sent to the new Nuclear Command.

This change was made in response to a growing (over the last few years) problems with the management of air force nuclear weapons. Despite that, for several years now, the air force has been planning to establish the new Cyber War operation and use it to gain overall control for all Department of Defense Cyber War activities.

The other services were not keen on this. That resistance, plus the nuclear weapons problems, have led to the Cyber Command operation being scaled back to being the 24th Air Force. This organization will handle electronic and Internet based warfare.

While the Cyber Command will not become reality, work continues on building a Cyber Control System. This is a hardware and software system that would enable the 24th Air Force to monitor, in real time, the security state of all air force networks. If any of these networks were attacked, the Cyber Control System software would immediately alert 24th Air Force controllers, and recommend a course of action. Think of this as a war room for Cyber War.

Many people, deluged with TV and movie representations of high tech military command centers, believe such a Cyber War center already exists. It doesn't, and the air force is building it. If the Cyber Control System can prove itself, the air force hopes to use it run the show for all Department of Defense networks.

What the air force wanted to do was be in charge of security for the 11 million Internet users, five million PCs and 12,000 networks belonging to the Department of Defense (which is the largest Internet user on the planet). All the services are scrambling to get their Cyber War defenses strengthened, but the air force wants to be in charge. This effort is not appreciated by the other services.

The U.S. Air Force is also advocating more Cyber War attacks. Apparently there has already been some offensive operations, but no one is giving out any details about when, how, and who the target(s) were.

The air force has long been in the lead when it comes to Cyber War operations and security. So far, the other services have not regarded this as a call to compete. Everyone is scrambling to defend their networks, and if the air force can come up with better tools, everyone is eager to make use of them.

The Cyber Control System, however, is different, in that it would be air force generals calling the shots, and determining how a Cyber War should be fought. This might cause some inter-service friction, but if the air force is able to demonstrate some real skill in this area, they will have a better chance of being allowed to run the show.