Track5Session8NetCen tricWarfareC2ISR

Slide1: 

2006 LandWarNet CONFERENCE Session 8 Net-Centric Warfare, C2ISR, and the GIG 24 Aug 1015-1115 Track 5: Enabling the Expeditionary Army Date: 16 Aug 06 UNCLASSIFIED POC: Thomas M. Reardon Version: 2.0 Phone Number: 520-548-6255 Email: thomas.reardon1@us.army.mil

Discussion Topics: 

Discussion Topics A view of Net-centric warfare, C2ISR, and the GIG from a contemporary intelligence perspective (no discussion of “hacking” by teen-aged social misfits, or issues involving law enforcement) The evolution of the threat to the LandWarNet from being a “nuisance” to an issue impacting on successful Army transformation and readiness Understanding “FIGHTING THE NETWORK” and new additions to the battlefield lexicon - protecting the network is commander and leader business Revised insights regarding the “insider threat” Threats posed by the global marketplace – help is on the way to manage the risk

“Drum Line” Concept: 

“Drum Line” Concept “One band… one sound!”

NETCOM Concept: 

NETCOM Concept “One Enterprise… one network!”

Slide5: 

“…A FUTURE FORCE…THAT RELIES MORE HEAVILY ON STEALTH, PRECISION WEAPONRY, AND INFORMA- TION TECHNOLOGIES…” “…EARLY TRANSFORMATION REQUIRES EXPLOITING INFORMATION TECHNOLOGIES…” Transformation Planning Guidance, OSD, Apr 03 “THE DEPARTMENT MUST ALIGN ITSELF WITH THE ON- GOING INFORMATION REVOLUTION…”

ARMY TRANSFORMATION: 

ARMY TRANSFORMATION Military Information Technology (Online Edition), 5May06 “The center of transformation is information technology…” “At the end of the day, it’s about the network…” LTG Steven Boutelle Army CIO/G6 Dr. Francis Harvey Secretary of the Army

C2ISR EXPECTATIONS:USAF PERSPECTIVE: 

C2ISR EXPECTATIONS: USAF PERSPECTIVE

GIG Definition: 

GIG Definition “…the globally interconnected, end-to-end set of information capabilities, associated processes, and personnel for collecting, processing, storing, disseminating, and managing information…”

DoD Expectation of the GIG: 

DoD Expectation of the GIG “…a secure, reliable network to enable users to access and share information at virtually any location and at any time…” “…achieve information superiority over adversaries …much as the Internet has transformed industry and society on a global scale…” “…ensure all systems can connect to the network based on common standards and protocols…(as opposed to) striving for interoperability through efforts to establish direct information exchanges through individual systems…” - GAO 06-211, Jan 06

New Battle Command Lexicon: 

New Battle Command Lexicon Incident Assessed occurrence having actual or potential adverse effects on an information system Category 1 Intrusion (Incident) Unauthorized privileged access (admin or root access) to a DoD system Category 2 Intrusion (Incident) Unauthorized non-privileged access to a DoD system Category 7 Malicious Logic (Incident) Installation of malicious software (e.g., Trojan, backdoor, virus, worm, etc.) (CJCSM 6510.01, Defense in Depth: IA and CND, 26 Jan 06)

New Battle Command Lexicon: 

New Battle Command Lexicon Event Occurrence, not yet assessed, that may affect the performance of an information system Category 5 Non-Complicance Activity (Event) Event caused by non-compliance of a directive to install a security patch, failure to comply with an IAVA, or improperly configuring a system (CJCSM 6510.01, Defense in Depth: IA and CND, 26 Jan 06)

Cat 1 & 2 Incident Scorecard(As of 5 Aug 06) FY 06: 

Cat 1 & 2 Incident Scorecard (As of 5 Aug 06) FY 06 CAT 1 INCIDENTS 30+ CAT 2 INCIDENTS 30+ INSTALLATIONS TARGETED (CONUS) 15+ (Complied from Army CERT Incident Database)

Cat 5 (Event) & Cat 7 (Incident) Scorecard(As of 5 Aug 06) FY 06: 

Cat 5 (Event) & Cat 7 (Incident) Scorecard (As of 5 Aug 06) FY 06 CAT 5 EVENTS 3,400+ CAT 7 INCIDENTS 2,700+ (Complied from Army CERT Incident Database)

What is “Fighting the Network?”: 

What is “Fighting the Network?” Considering Cat 1 and Cat 2 intrusions as “hostile” (engage the G3 and G2 in addition to NETOPS and CND staff - add Cat 1 and Cat 2 intrusions into CCIR) Considering motive of Cat 1 and Cat 2 intrusions to be to eventually enable a foreign adversary to deny DoD the net-centric warfare option Considering the presence of a Cat 5 event to equate to failure to apply a safety Modification Work Order (MWO) to a tactical vehicle – and a potential precursor to a Cat 1 or Cat 2 intrusion Considering Cat 7 incidents as a potential precursor to a Cat 1 or Cat 2 intrusions – review (at command-level) IA and CND TTP, staffing, training, SOPs, etc.

Slide15: 

Global interconnected network environment The seamless sharing of data among users, applications, and platforms Dramatically improved situational awareness and much shorter decision-making cycles (Computer Associates White Paper: Leveraging Technology to Enable Net-Centric Warfare, Mar 05)

Slide16: 

Global interconnected network environment The seamless sharing of data among users, applications, and platforms Dramatically improved situational awareness and much shorter decision-making cycles (Computer Associates White Paper: Leveraging Technology to Enable Net-Centric Warfare, Mar 05) disconnected No degraded longer

QUADRENNIAL DEFENSEREVIEW (QDR): 

QUADRENNIAL DEFENSE REVIEW (QDR) From exposed forces forward to reaching back into CONUS to support expeditionary forces From emphasis on ships, guns, tanks, and planes to focus on information, knowledge, and timely, actionable intelligence From moving the user to the data to moving the data to the user QDR Impacts on the LandWarNet (Source: ARMY Magazine, March 2006)

FUTURE COMBAT SYSTEM : 

FUTURE COMBAT SYSTEM “The Army envisions a new way of fighting that depends on networking the force, which involves linking people, platforms, weapons, and sensors seamlessly together in a system of systems.” - GAO Report 06-367, March 2006 Quality of Firsts See first Understand first Act first Finish decisively - PM, FCS (BCT)

Slide19: 

“The National Security Agency has determined that potential adversaries are developing a body of knowledge about U.S. systems and about methods to attack these systems.” - General Accounting Office (26 Jul 00) Statement of Jack L. Brock, Jr., Director, Governmentwide and Defense Information Systems, Accounting and Information Management Division, GAO, before the Subcommittee on Government Management, Information and Technology, Committee on Government Reform, House of Representatives, 26 Jul 00 (GAO/T-AIMD-00-268)

MORE FROM THE GAO: 

MORE FROM THE GAO Information Security: Emerging Cybersecurity Issues Threaten Federal Information Systems GAO Report 05-231, May 2005 “Federal agencies are facing a set of emerging cyber- security threats that are the result of changing sources of attack, increasing sophisticated social engineering techniques designed to trick the unsuspecting user into divulging sensitive information, new modes of covert compromise, and the blending of once distinct attacks into more complex and damaging exploits.”

Slide21: 

CIA is detecting doctrine and offensive cyberwarfare programs in other countries Foreign nations have begun to include IW in military doctrine and teachings regarding defensive and offensive applications Foreign nations are now aware of the need to disrupt the flow of information that traverses civilian infrastructures that support military strategies (John Serabian, CIA, 23 Feb 00)

Slide22: 

“The attacks are coming from everywhere and they’re getting better…” “They are exploiting weaknesses in our detection tools…” Result of 5 Nov IA stand-down day: “20% of accounts are unauthorized or expired…” LtGen Charles Croom Dir, DISA Cdr, JTF-GNO Jan 06 (NETWORKWORLD.com, 16 Jan06)

Slide23: 

“Insider threat” = misuse of authorized privileges Understands the system Knows what data is available Knows location of data Can access data at opportune times Can introduce malicious programs Can disrupt systems Employees Contractors/Temps All ages (Source: National CI Center, Nov 00)

Slide24: 

“Insider threat” = misuse of power of office to benefit foreign CNO Is a decision-maker regarding vendor selection Determines funding levels for CND and IA Influences organization policy which impacts IA and CND activities Senior Executives Commanders Procurement Officials

“The World is Flat”: 

“The World is Flat” “What flattening of the world means is that we are now connecting all the knowledge centers on the planet together into a single global network, which – if politics and terrorism do not get in the way – could usher in an amazing era of prosperity and innovation”

“The World is Flat” – A MilitaryPerspective: 

GAO Defense Acquisitions: Improved Business Case is Needed for Future Combat Systems’s Successful Outcome March 2006 GAO-06-367 Report to Congressional Committees “The World is Flat” – A Military Perspective “The Army envisions a new way of fighting that depends on networking the force, which involves linking people, platforms, weapons, and sensors seamlessly together in a system of systems.” - GAO Report 06-367, March 2006

Slide28: 

“We should never use a proprietary standard or a military standard…we need to use commercial standards to take advantage of the strides made by industry…let industry make the investments to improve these items and then we buy them off the shelf…” - Senior Army IT official

What is at Risk? : 

What is at Risk? The network-centric warfare option Logistic asset visibility Battle management Moving data to the user Shorter decision-making cycles Assured communications NETOPS situational awareness Friendly force situational awareness

Slide30: 

“Ownership and control of U.S. communi- cations networks could also provide a foreign government with the ability to direct key employees to utilize routine monitoring capability to access… information communicating over the network…” (TESTIMONY OF LARRY R. PARKINSON, THEN-GENERAL COUNSEL, FBI, BEFORE THE U.S. HOUSE OF REPRESENTATIVES, COMMITTEE ON COMMERCE, 7 Sep 00)

Slide31: 

“Network-centric, warfare-enabled warfighting systems are just one part of the overall picture…what goes on behind the scenes is equally important…” (Computer Associates White Paper: Leveraging Technology to Enable Net-Centric Warfare, Mar 05)

Slide32: 

(Computer Associates White Paper: Leveraging Technology to Enable Net-Centric Warfare, Mar 05) Logistics Maintenance Scheduling Accounting Payroll Inventory Control Personnel Management COTS

Slide33: 

“Certified genuine” Rolex! Life-time guarantee! U.S. citizen – based in Manhattan! 30% off – just for you! Immediate delivery – take it with you!

Slide34: 

ACME SOFTWARE, INC. Orlando, Florida Veteran Owned and Operated Successfully tested under NSTISSC Policy #11 On the GSA Schedule 30% cheaper

Slide35: 

ACME SOFTWARE, INC. Orlando, Florida Veteran Owned and Operated IF YOU KNEW… Software development sub-contracted to foreign nation with IW strategy Senior company officer trained by foreign IW entity – suspected ties to a Foreign Intelligence service

A Balanced Approach : 

A Balanced Approach DoD policy does not preclude use of foreign commercial vendors U.S. companies are becoming increasingly multi-national and rely on foreign components and labor for IT products and services Purely domestic (U.S.) IT companies, totally free of foreign influence, may no longer exist Allowing foreign investment in the U.S. defense industry serves the national interest, provided that contractors are protected against improper foreign interest or control

What is at Risk? : 

What is at Risk? The network-centric warfare option Logistic asset visibility Battle management Moving data to the user Shorter decision-making cycles Assured communications NETOPS situational awareness Friendly force situational awareness ????

Slide38: 

COST PERFORMANCE SCHEDULE

Foreign Ownership, Control, and Influence (FOCI) : 

Foreign Ownership, Control, and Influence (FOCI) National Industrial Security Program Operating Manual (NISPOM) (DoD 5220.02-M) Applies only to classified contracting – does not impact unclassified IT contracts associated with the LandWarNet Guides foreign investment consistent with the national security interests of the United States

Foreign Ownership, Control, and Influence (FOCI) : 

Foreign Ownership, Control, and Influence (FOCI) Definition A U.S. company is considered under FOCI whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable through the ownership of a U.S. company’s securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may affect adversely the performance of classified contracts. - NISPOM, para 2-300a NETCOM OBJECTIVE Extend definition to include “…which may result in the unauthorized access to classified information or to the DoD Global Information Grid (GIG)…”

FOCI Risk Management Factors : 

FOCI Risk Management Factors The company The foreign interest The government of the foreign interest Record of economic and government espionage against U.S. targets Record of enforcement and/or engagement in unauthorized technology transfer The type and sensitivity of the information that will be assessed - NISPOM, para 2-301

FOCI Risk Management Factors : 

FOCI Risk Management Factors Majority or substantial minority position in the company (“substantial minority” = >5% of the ownership interests or >10% of the voting interest) Record of compliance with pertinent U.S. laws, regulations, and contracts Ownership or control, in whole or in part, by a foreign government

Emerging Intelligence Communityof Interest: 

Emerging Intelligence Community of Interest Army G2 (DAMI-FIT) G2, ARSTRAT/SMDC Threat Manager, SIGCEN DCSINT, C-E Life Cycle Management Command (C-E LCMC) National Ground Intel Center (NGIC) Army Counterintelligence Center (ACIC) Cyber Intelligence Center (CIC), 1st Information Operations Command An enterprise approach to intelligence support

Summation: 

Summation A view of Net-centric warfare, C2ISR, and the GIG from a contemporary intelligence perspective (no discussion of “hacking” by teen-aged social misfits, or issues involving law enforcement) The evolution of the threat to the LandWarNet from being a “nuisance” to an issue impacting on successful Army transformation and readiness Understanding “FIGHTING THE NETWORK” and new additions to the battlefield lexicon - protecting the network is commander and leader business Revised insights regarding the “insider threat” Threats posed by the global marketplace – help is on the way to manage the risk

The Most Important Summation: 

The Most Important Summation The Ultimate Customer – Soldiers Standing Their Posts “I hear you loud and clear…”

Slide46: 

THOMAS M. REARDON Chief, Intelligence Division ACofS, G2 U.S. Army NETCOM/9th ASC DSN: 879-6255 thomas.reardon@netcom.army.mil

Slide47: 

www.portal.inscom.army.smil.mil/netcomg2 SIPR WEB SITE JWICS WEB SITE www.portal.inscom.ic.gov/netcomg2