stewart

Homeland Security : 

Homeland Security Todd Stewart, Ph.D. Major General, United States Air Force (Retired) Director Program for International and Homeland Security The Ohio State University Ohio State’s Cyber-Security Week Securing Cyberspace

Discussion Points: 

Discussion Points Our Changing National Security Environment The National Response Ohio State’s Involvement

Discussion Points: 

Discussion Points Our Changing National Security Environment The National Response Ohio State’s Involvement

National Security Environment: 

National Security Environment Cold-War Era Post Cold-War Era (“War on Terrorism Era”) 1989 9/11/01 Nation-State Adversaries Focus on Communism Threat of Global Nuclear War Dangerous, but relatively Predictable Forward Defense Short of global war, U.S. homeland perceived as secure from any major threat

National Security Environment: 

National Security Environment Cold-War Era Post Cold-War Era (“War on Terrorism Era”) 1989 9/11/01 Nation-State Adversaries Focus on Communism Threat of Global Nuclear War Dangerous, but relatively Predictable Forward Defense Short of global war, U.S. homeland perceived as secure from any major threat Fewer Nation-State Adversaries No “peer competitor;” U.S. is the only remaining “superpower” Trans-national extremist groups Globalization Development and proliferation of “dual use technologies” … WMD Increase use of tactical terrorism Increasing dependence on cyberspace Homeland is non-secure and at risk

National Security Today: 

National Security Today “Defending our Nation against its enemies is the first and fundamental commitment of the Federal Government. Today that task has changed dramatically. Enemies in the past needed great armies and great industrial capabilities to endanger America. Now, shadowy networks of individuals can bring great chaos and suffering to our shores for less than it costs to purchase a single tank. Terrorists are organized to penetrate open societies and to turn the power of modern technologies against us.”

Threat Trends: 

Threat Trends Nation States Trans-national Groups Extremist/Radical Organizations Iran North Korea Al Qaeda Bad Guys

Bad Guys: 

Bad Guys Types: Nation states (“rogue” states) Non-state groups State-supported Independent Individuals Motivation: Political Ideological / religious Ethnic Racial Economic

Why Terrorism?: 

Why Terrorism? Nothing new – been used as a tactic for thousands of years Often perceived to be the only option, when confronting an adversary with overwhelming conventional forces Doesn’t require large military forces or a large industrial base It works!

Weapons of Mass Destruction: 

Weapons of Mass Destruction Chemical Biological Radiological Nuclear Explosives

Weapons of Mass Destruction: 

Weapons of Mass Destruction Chemical Biological Radiological Nuclear Explosives + Cyber

Threat Trends: 

Threat Trends C B R N E Cyber Nation States Trans-national Groups Extremist/Radical Organizations Weapons of Mass Destruction Iran North Korea Al Qaeda Bad Guys Bad Stuff

Threat Trends: 

Threat Trends Extremist/Radical Organizations Weapons of Mass Destruction Iran North Korea Bad Guys Bad Stuff

Some Targets of Terrorism: 

Some Targets of Terrorism Government activities Prominent, influential people Symbolic people or institutions World Trade Center Pentagon Large concentrations of people Economic processes Critical infrastructure

Homeland Security - The Threat: 

Homeland Security - The Threat America requires solutions to the difficult challenges it faces now, and those it will face in the future, in the areas of international and homeland security Use of terrorism by extremist groups Proliferation of weapons of mass destruction The threat is real, significant and probably enduring

Discussion Points: 

Discussion Points Our Changing National Security Environment The National Response Ohio State’s Involvement

Who’s Responsible?: 

Who’s Responsible? Individual citizens Private-sector organizations Trade associations and professional societies Academia Local governments (including airport authorities) State governments Federal government Executive Branch Department of Homeland Security (22 agencies); Department of Transportation (FAA) and many other departments and agencies Congress - 30+ committees and subcommittees

National Response: 

National Response Following “9/11/01,” President Bush declared a “Global War on Terrorism” Terrorists Supporters of terrorism Primary focus on: Homeland Security Homeland Defense Most of the international community is involved in some way

National Strategy Documents: 

National Strategy Documents National Strategy for Homeland Security (Jul 02) National Security Strategy of the United States (Dec 02) The National Strategy for Combating Terrorism (Dec 02) The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets (Feb 03) National Strategy to Secure Cyberspace (Feb 03)

National Strategy for Homeland Security: 

National Strategy for Homeland Security Critical Mission Areas Intelligence and Warning Border and Transportation Security Domestic Counter-terrorism Protecting Critical Infrastructure and Key Assets Defending Against Catastrophic Threats Emergency Preparedness and Response Foundations Law Science and Technology Information Sharing and Systems International Cooperation

National Security Strategy of the United StatesAmerica’s International Strategy (Dec 02): 

National Security Strategy of the United States America’s International Strategy (Dec 02) “The gravest danger our nation faces lies at the crossroads of radicalism and technology. Our enemies have openly declared that they are seeking weapons of mass destruction, and evidence indicates that they are doing so with determination. The United States will not allow these efforts to succeed. We will build defenses against ballistic missiles and other means of delivery. We will cooperate with other nations to deny, contain and curtail our enemies’ efforts to acquire dangerous technologies. And, as a matter of common sense and self defense, America will act against such emerging threats, before they are fully formed. “

National Strategy to Secure Cyberspace: 

National Strategy to Secure Cyberspace National Priorities: I A National Cyberspace Security Response System II A National Cyberspace Security Threat and Vulnerability Reduction Program III A National Cyberspace Security Awareness and Training Program IV Securing Governments’ Cyberspace V National Security and International Cyberspace Security Cooperation

Department of Homeland Security: 

Department of Homeland Security Homeland Security Act of 2002 Consolidates and integrates all or part of 22 federal agencies 180,000 employees; $40 billion budget Five Major Directorates: Border & Transportation Security Science & Technology Emergency Preparedness & Response Management Information Analysis & Infrastructure Protection Other agencies, e.g., US Coast Guard, Secret Service

Department of Homeland Security: 

Department of Homeland Security Information Analysis & Infrastructure Protection – National Cyber Security Division (NCSD) Unifies and focuses: Critical Infrastructure Assurance Office (currently part of the Department of Commerce) National Infrastructure Protection Center (FBI) United States Computer Emergency Response Team (US-CERT) www.us-cert.gov (National Cyber Alert System)

National Infrastructure Advisory Council: 

National Infrastructure Advisory Council The National Infrastructure Advisory Council (NIAC) provides the President through the Secretary of Homeland Security with advice on the security of information systems for critical infrastructure supporting other sectors of the economy: banking and finance, transportation, energy, manufacturing, and emergency government services. The Council is composed of not more than 30 members appointed by the President who are selected from the private sector, academia, and State and local government.

Strategic Model: 

Strategic Model Deterrence Prediction (Intel. & Warning) Prevention (Preemption) Detection Mitigation Crisis Management Attribution Post-attack Response Terrorist Threats to the United States Recovery and Reconstitution

Strategic Model: 

Strategic Model Deterrence Prediction (Intel. & Warning) Prevention (Preemption) Detection Mitigation Crisis Management Attribution Post-attack Response Attack Method: Chemical Biological Radiological Nuclear Explosives Cyber Recovery and Reconstitution

Strategic Model: 

Strategic Model Deterrence Prediction (Intel. & Warning) Prevention (Preemption) Detection Mitigation Crisis Management Attribution Post-attack Response Recovery and Reconstitution Targets (e.g.): Citizens Symbolic assets Infrastructure Cyber systems

Critical Infrastructure: 

Critical Infrastructure Agriculture Food Water Public Health Emergency Services Government Defense Industrial Base Transportation Energy Banking and Finance Chemical Industry Postal and Shipping Information and Telecommunications

Implications for Computer Systems: 

Implications for Computer Systems Computer systems and networks are targets High-value targets because they impact every other sector of critical infrastructure Computer systems can be used as weapons to attack other targets By the bad guys attacking us By the good guys attacking them

Strategic Model: 

Strategic Model Deterrence Prediction (Intel. & Warning) Prevention (Preemption) Detection Mitigation Crisis Management Attribution Post-attack Response Terrorist Threats to U.S. Cyberspace Recovery and Reconstitution

Strategic Model: 

Strategic Model Deterrence Prediction (Intel. & Warning) Prevention (Preemption) Detection Mitigation Crisis Management Attribution Post-attack Response Cyberterrorism Threats to U.S. Cyberspace Recovery and Reconstitution

Strategic Model: 

Strategic Model Deterrence Prediction (Intel. & Warning) Prevention (Preemption) Detection Mitigation Crisis Management Attribution Post-attack Response Cyberterrorism Threats to University (OSU) Computer Systems Recovery and Reconstitution

“Layered” Defense: 

“Layered” Defense Deter Attack Preempt Attack Defend Attack Recover From Attack

Managing the Risk: 

Managing the Risk Risk to Target A Threat of Attack by Group B Using Mode C Vulnerability of Target A to Attack by Group B Using Mode C Consequences of Attack by Group B on Target A Using Mode C

Managing the Risk: 

Managing the Risk Risk to Target A Threat of Attack by Group B Using Mode C Vulnerability of Target A to Attack by Group B Using Mode C Consequences of Attack by Group B on Target A Using Mode C Threat Reduction Strategies Vulnerability Reduction Strategies Consequence Reduction Strategies

Managing the Risk: 

Managing the Risk Risk to Target A Threat of Attack by Group B Using Mode C Vulnerability of Target A to Attack by Group B Using Mode C Consequences of Attack by Group B on Target A Using Mode C Threat Reduction Strategies Vulnerability Reduction Strategies Consequence Reduction Strategies Cost of Risk Reduction

Managing the Risk: 

Managing the Risk How much risk is acceptable? What risk-reduction alternatives are technically feasible? What risk-reduction strategies are acceptable (legally, socially, politically, economically, etc.)? Impact on personal privacy, civil liberties Impact on commerce How much risk reduction is affordable? Who pays?

Discussion Points: 

Discussion Points Our Changing National Security Environment The National Response Ohio State’s Involvement

Who’s Responsible?: 

Who’s Responsible? Individual citizens Private-sector organizations Trade associations and professional societies Local governments (including airport authorities) State governments Federal government Executive Branch Department of Homeland Security (22 agencies); Department of Transportation (FAA) and many other departments and agencies Congress - 30+ committees and subcommittees Academia

Ohio State’s Involvement: 

Ohio State’s Involvement Potential Target People Infrastructure OSU and OSC systems Source of potentially hazardous materials OSU computers as “weapons” Source of potentially sensitive research information Protection of unclassified, but sensitive info Impact on non-US students and faculty Homeland security research, technology development, education and training

Roles of Academic Institutions: 

Roles of Academic Institutions In my opinion … All academic institutions should consider incorporating homeland security awareness into their programs, to the extent possible and appropriate Public institutions, like Ohio State, have a inherent responsibility to help prepare students to be better-informed citizens, not just to educate and train students for a career Homeland security is a fundamental responsibility of citizenship

Roles and Responsibilities: 

Roles and Responsibilities Deterrence Intelligence & Warning Prevention Mitigation Detection & Characterization Crisis Management Recovery & Reconstitution Attribution Government Private Sector Academia Homeland Security

Roles and Responsibilities: 

Roles and Responsibilities Deterrence Intelligence & Warning Prevention Mitigation Detection & Characterization Crisis Management Recovery & Reconstitution Attribution Government Private Sector Academia Homeland Security Tasks to be Accomplished Strategy Capabilities Required Research & Develop. Education & Training

The Ohio State UniversityProgram for International and Homeland Security: 

The Ohio State University Program for International and Homeland Security Established in April 2002 University-wide program Promote and support security-related: Research and Technology development and transition (commercialization) Education and Training Outreach and service Support responsible government agencies and non-government organizations

Program Focus Groups: 

Program Focus Groups Agri-terrorism/Defense Bio-terrorism/Defense Border Security Business and Economic Issues Critical Infrastructure Protection Cyber-terrorism/Security Domestic Counter-terrorism Education and Training Emergency Preparedness and Response Government & Political Issues Homeland Security – General Information Sharing and Systems Intelligence and Warning International Issues Legal Issues Medical Care Delivery Public Health Science and Technology Sensors and Detection Social and Cultural issues Terrorism – General Transportation Security University Security Weapons of Mass Destruction To facilitate interdisciplinary research and study in this area, a number of focus groups have been established. These groups currently include:

Roles and Responsibilities: 

Roles and Responsibilities Deterrence Intelligence & Warning Prevention Mitigation Detection & Characterization Crisis Management Recovery & Reconstitution Attribution Government Private Sector Academia Cyber Security

Roles and Responsibilities: 

Roles and Responsibilities Deterrence Intelligence & Warning Prevention Mitigation Detection & Characterization Crisis Management Recovery & Reconstitution Attribution Government Private Sector Academia Cyber Security Tasks to be Accomplished Strategy Capabilities Required Research & Develop. Education & Training

Cyber-security Programs: 

Cyber-security Programs Deterrence Intelligence & Warning Prevention Mitigation Detection & Characterization Crisis Management Recovery & Reconstitution Attribution Research & Development Education & Training OSU Computer Systems Cyber Security

Cyber-Security Programs: 

Cyber-Security Programs Education: Include modules, courses and program tracks/majors dealing with computer and network security Consider interdisciplinary approaches Target both new students and practicing professionals Roles of government, the private sector and academia

Centers of Academic ExcellenceInfo Assurance Education: 

Centers of Academic Excellence Info Assurance Education National Security Agency Program (1998) Offer scholarships and grants Currently 50 universities in 26 states Supports Priority III of the National Strategy to Secure Cyberspace: A National Cyberspace Security Awareness and Training Program Department of Homeland Security and the National Security Agency agreed to expand the program (April 22, 2004) Ohio State is not yet part of the program

Federal Cyber Service: 

Federal Cyber Service National Science Foundation (NSF) Scholarship for Service Program (2000) Funds two-year scholarships, in return for two years of federal service after graduation Promotes higher-education courses to increase the number of information assurance professionals Supports Priority III of the National Strategy for Securing Cyberspace Department of Homeland Security agreed to partner with NSF (April 22, 2004) to expand the program

National Academic Consortium for Homeland Security (NACHS): 

National Academic Consortium for Homeland Security (NACHS) Established in March 2003 Promote: Awareness and scholarship in national security Collaboration among academic institutions and individual scholars with research and/or education and training programs related to national security Support to responsible government agencies and non-government organizations Currently, NACHS includes 125 colleges and universities, representing 41 states and the D.C.

Discussion Points - Summary: 

Discussion Points - Summary Our Changing National Security Environment The National Response Ohio State’s Involvement

Discussion Points - Summary: 

Discussion Points - Summary Our Changing National Security Environment The National Response Ohio State’s Involvement

Discussion Points - Summary: 

Discussion Points - Summary Our Changing National Security Environment The National Response Ohio State’s Involvement

Discussion Points - Summary: 

Discussion Points - Summary Our Changing National Security Environment The National Response Ohio State’s Involvement

Slide58: 

Questions and Discussion