Nov 122012
 

Why the Government’s Cybersecurity Plan Will End in Catastrophe

 

Computer World
by Rob Enderle
October 19, 2012

 

 

CIO –

Last week Defense Secretary Leon E. Panetta presented his case for an invasive system to monitor the nation’s private systems in order to better identify and respond to cyber threats.

Panetta correctly points out that the likelihood of a 9/11 scale cyber attack is real-and if something isn’t done, large sections of the U.S. infrastructure could fail. He uses as an example the successful attack on ARAMCO, a Saudi Arabian state owned oil company, which wiped 30,000 computers, causing massive data loss and rendering them temporarily useless.

\

News: Future Cyber Attacks Could Rival 9-11, Cripple US, Warns PanettaGet the latest IT news and analysis from Constantine von Hoffman’s IT Security Hack blog

The proposed remedy is to provide the U.S. government with broad access to private systems so that malware can be quickly identified and removed and other national threats identified and stopped. The problem is that such access creates privacy issues and may itself be a bigger problem than the threat it attempts to eliminate. Not only is the requested change unlikely to happen any time soon, it may increase the potential for either a domestic or foreign cyber attack.

 

Central Network Eliminates Natural Protection

One hidden benefit in the fact that our systems often don’t share information well or have a common security structure is that attacks against infrastructure therefore have to be tightly targeted. This means an attack on one private or public system probably won’t even work on most others, since they run a variety of different security packages, operating systems and applications, all surrounded by different policies.

One of the reasons we haven’t yet had a repeat of 9/11-that is, an attack that reaches catastrophic levels-is because these systems just don’t interoperate very well or share information at a low level. The amount of work to carry out such an attack currently exceeds the resources of the attackers.

Create a central network where systems regularly and automatically share information in real time, though, and you also create a single point of access where such an attack can be perpetrated. You change an impossible problem into one that is just very difficult-and, given both public and private practices to put off spending on security until there is a credible threat or demonstrated damage, attacking this centralized system will likely get easier over time for an outside entity and may be too attractive for a properly placed disgruntled employee to pass up.

 

Commentary: Failure of Senate to Pass Cybersecurity Act Leaves Us All At RiskBlog: Security Pros Blast US Cybersecurity Laws

The government’s recent history with security is a case in point. The death of the U.S. Ambassador to Libya showcased a situation in which the risks were real, and known, yet protections were reduced. After the attack, the political system focused on finding someone to blame, not assuring that the problem wouldn’t recur.

In short, the very system Panetta is suggesting could be the key to causing the thing he is trying to avoid.

 

A Better Short-Term Cybersecurity Solution

I see several things the government could do instead.

  • Strengthen liability laws in order to fast-track the process for compensating companies that suffer damage caused by inadequate protection.
  • Assure that compensation came from the budgets of the government organizations whose systems were targeted, in a manner similar to the way insurance companies pay out settlements. This would force agencies to increase their security budgets and audit the results to ensure they aren’t too exposed.
  • Provide a common, required reporting method to report an identified attack along with a requirement for minimal legal coverage.

 

Analysis: How the U.S Can Avoid a ‘Cyber Cold War’

All this could all be done without connecting the systems or creating a central government body to access them. There would be little additional government cost and few, if any, privacy concerns for anyone not perpetrating or directly connected to an attack. In short, such a plan would promote a higher level of prevention through better-funded protection.

 

‘Cyber 9/11′ Will Only Be Followed By More, Worse Attacks

Panetta’s plan suggests that an attack is unavoidable. The problem with a method that almost assumes an attack will happen, or requires a successful attack in order to be implemented, is that it usually does more harm than good.

After 9/11, poorly planned responses crippled the airlines industry and nearly bankrupted the country-and the integration of government communication systems that could have prevented the event in the first place is still not complete.

The real concern is that we do, in fact, get hit with a 9/11 cyber attack, as the Department of Defense has anticipated, and that the response to the event either creates an even bigger financial or privacy problem or sets the stage for a much larger attack. None of these are mutually exclusive. Unfortunately, we need to anticipate such a dire outcome. If you are driven to interconnect your systems nationally, then doing it quickly, let alone at all, would be a very unwise idea.

 

Direct Link:  http://www.computerworld.com/s/article/9232604/Why_the_Government_39_s_Cybersecurity_Plan_Will_End_in_Catastrophe?taxonomyId=82

Feb 042012
 

U.N. Nuclear Inspectors’ Visit to Iran Is a Failure, West Says

 

 

The New York Times

By ROBERT F. WORTH and DAVID E. SANGER
February 3, 2012

 

 

President Mahmoud Ahmadinejad, third from right, attended prayers led by Ayatollah Ali Khamenei, in an image provided by the ayatollah’s office. (via Agence France-Presse — Getty Images)

 

DUBAI, United Arab Emirates —

American and European officials said Friday that a mission by international nuclear inspectors to Tehran this week had failed to address their key concerns, indicating that Iran’s leaders believe they can resist pressure to open up the nation’s nuclear program.

Worshippers shouted during Friday prayers in Tehran (Reuters)

The assessment came as Iran’s supreme leader lashed out at the United States, vowing to retaliate against oil sanctions and threats of military action and warning that any attack “would be 10 times worse for the interests of the United States” than it would be for Iran.

While the inspectors from the International Atomic Energy Agency, who returned to Vienna after a three-day mission in Tehran, said nothing substantive about their trip and were planning to return to Iran later this month, diplomats briefed on the trip said that Iranian officials had not answered the questions raised in an incriminating report issued by the agency in November.

That report cited documents and evidence of experiments with detonators that strongly suggested Iran might have worked on technologies to turn its nuclear fuel into working weapons and warheads. Tehran has insisted its uranium enrichment activities are peaceful and has dismissed the evidence suggesting otherwise as fabricated or taken out of context, and has refused to engage in substantive discussions or inspections.

Members of the I.A.E.A. delegation were told that they could not have access to Mohsen Fakhrizadeh, an academic who is widely believed to be in charge of important elements of the suspected weaponization program, and that they could not visit a military site where the agency’s report suggested key experiments on weapons technology might have been carried out.

“The agency expressed interest in all the areas of concern,” said a diplomat based in Vienna, who spoke on the condition of anonymity. “The team asked for access in the future to different types of sites and personnel, and that was denied.”

One senior American official described the session between the agency and Iranian nuclear officials as “foot-dragging at best and a disaster at worst.” But a diplomat at the agency’s headquarters in Vienna said “disaster is too strong a word.” He added: “Iran has refused to address the issue for three years now. To be fair, you have to give them credit for at least discussing it. The dialogue is continuing, and that’s a good sign.”

In Tehran, the speech by the supreme leader, Ayatollah Ali Khamenei, made during Friday Prayer and broadcast live to the nation, came amid deepening American concern about a possible military strike on Iran’s nuclear enrichment sites by Israel, whose leaders delivered blunt new warnings on Thursday about what they called the need to stop Iran’s nuclear program. Israel considers a nuclear-armed Iran a threat to its existence.

Israeli leaders have issued mixed signals regarding their intentions, suggesting that they are willing, for a short time at least, to wait and see if increasingly strict sanctions, including a European oil embargo, will force Iran to give in to inspectors’ demands, and to cease the production of at least some of the uranium that outside experts fear could be turned into bomb fuel.

The ayatollah also issued an unusually blunt warning that Iran would support militant groups opposing Israel, an action that some analysts said could be held up by Israel as a casus belli.

Reinforcing the concern, ABC News reported on Friday that Israeli consular officials were warning of possible attacks on Israeli government sites abroad and synagogues and Jewish schools. ABC quoted an internal Israeli document as saying, “We predict that the threat on our sites around the world will increase.”

Without being specific, Ayatollah Khamenei said that Iran “had its own tools” to respond to threats of war and would use them “if necessary,” the Mehr news agency reported.

Ayatollah Khamenei referred to the sanctions as “painful and crippling,” according to Iranian news agencies, acknowledging the effect of recent measures aimed at cutting off Iran’s Central Bank from the international financial system. But he also said the sanctions would ultimately benefit his country. “They will make us more self-reliant,” he said, according to a translation by Iran’s semiofficial Fars news agency.

In recent weeks, senior American and European officials have visited Israel to counsel patience, warning that a military attack could backfire and strengthen what they called Iran’s determination to acquire nuclear weapons.

Two senior Israeli officials, including the head of the Mossad, the intelligence agency believed to be responsible for the assassination of Iranian nuclear scientists, visited Washington over the past week, for what officials described as sometimes contentious meetings. Israeli officials say they are worried that Iran may soon be immune to the threat of airstrikes as its enrichment facilities are moved into deep mountain bunkers.

Israel’s defense minister, Ehud Barak, said at a conference in Israel on Thursday that if sanctions failed to stop Iran’s nuclear program, Israel would need to “consider taking action,” according to the newspaper Haaretz.

Defense Secretary Leon E. Panetta, at the Ramstein Air Base in Germany on Friday, echoed the sentiment.

“My view is that right now the most important thing is to keep the international community unified in keeping that pressure on, to try to convince Iran that they shouldn’t develop a nuclear weapon, that they should join the international family of nations and that they should operate by the rules that we all operate by,” he said. “But I have to tell you, if they don’t, we have all options on the table, and we’ll be prepared to respond if we have to.”

In Washington, there was evidence on Friday that a new Senate bill for tougher sanctions, which could effectively sever Iranian banks from a global financial telecommunications network, was having an effect, even before a full Senate vote.

The network, known as the Society for Worldwide Interbank Financial Telecommunication, or Swift, would face unspecified penalties under the legislation if it failed to sever sanctioned Iranian banks. Swift, based in Belgium, said in a statement on Friday that it “fully understands and appreciates the gravity of the situation,” and was working with banking regulators “to find the right multilateral legal framework which will enable Swift to address the issues.”

Expulsion from Swift could be catastrophic for Iran’s economy by blocking a major conduit for foreign revenue.

 

Robert F. Worth reported from Dubai, and David E. Sanger from Washington. Reporting was contributed by William J. Broad, J. David Goodman and Rick Gladstone from New York, and Elisabeth Bumiller from Ramstein Air Base, Germany.

 

Direct Link:  http://www.nytimes.com/2012/02/04/world/middleeast/irans-supreme-leader-threatens-retaliation-against-attack.html?nl=todaysheadlines&emc=tha22

Jan 032012
 

The Next War

Panetta to Offer Strategy for Cutting Military Budget

The New York Times
By ELISABETH BUMILLER and THOM SHANKER
 January 2, 2012

WASHINGTON —

Defense Secretary Leon E. Panetta is set this week to reveal his strategy that will guide the Pentagon in cutting hundreds of billions of dollars from its budget, and with it the Obama administration’s vision of the military that the United States needs to meet 21st-century threats, according to senior officials.

Air Force, via European Pressphoto Agency
Reductions are expected in the program for the F-35 fighter jet.

The Next War

Balancing Needs and Costs

This is the third article in a series that is examining the American military and the decisions confronting it in a new age of austerity.

 

Andrea Bruce for The New York Times
Kentucky National Guard troops in Baghdad.

In a shift of doctrine driven by fiscal reality and a deal last summer that kept the United States from defaulting on its debts, Mr. Panetta is expected to outline plans for carefully shrinking the military — and in so doing make it clear that the Pentagon will not maintain the ability to fight two sustained ground wars at once.

Instead, he will say that the military will be large enough to fight and win one major conflict, while also being able to “spoil” a second adversary’s ambitions in another part of the world while conducting a number of other smaller operations, like providing disaster relief or enforcing a no-flight zone.

Pentagon officials, in the meantime, are in final deliberations about potential cuts to virtually every important area of military spending: the nuclear arsenal, warships, combat aircraft, salaries, and retirement and health benefits. With the war in Iraq over and the one in Afghanistan winding down, Mr. Panetta is weighing how significantly to shrink America’s ground forces.

There is broad agreement on the left, right and center that $450 billion in cuts over a decade — the amount that the White House and Pentagon agreed to last summer — is acceptable. That is about 8 percent of the Pentagon’s base budget. But there is intense debate about an additional $500 billion in cuts that may have to be made if Congress follows through with deeper reductions.

Mr. Panetta and defense hawks say a reduction of $1 trillion, about 17 percent of the Pentagon’s base budget, would be ruinous to national security. Democrats and a few Republicans say that it would be painful but manageable; they add that there were steeper military cuts after the Cold War and the wars in Korea and Vietnam.

“Even at a trillion dollars, this is a shallower build-down than any of the last three we’ve done,” said Gordon Adams, who oversaw military budgets in the Clinton White House and is now a fellow at the Stimson Center, a nonprofit research group in Washington. “It would still be the world’s most dominant military. We would be in an arms race with ourselves.”

Many who are more worried about cuts, including Mr. Panetta, acknowledge that Pentagon personnel costs are unsustainable and that generous retirement benefits may have to be scaled back to save crucial weapons programs.

“If we allow the current trend to continue,” said Arnold L. Punaro, a consultant on a Pentagon advisory group, the Defense Business Board, who has pushed for changes in the military retirement system, “we’re going to turn the Department of Defense into a benefits company that occasionally kills a terrorist.”

Mr. Panetta will outline the strategy guiding his spending plans at a news conference this week, and the specific cuts — for now, the Pentagon has prepared about $260 billion in cuts for the next five years —  will be detailed in the president’s annual budget submission to Congress, where they will be debated and almost certainly amended before approval. Although the proposals look to budget cuts over a decade, any future president can decide to propose an alternative spending plan to Congress.

The looming cuts inevitably force decisions on the scope and future of the American military. If, say, the Pentagon saves $7 billion over a decade by reducing the number of aircraft carriers to 10 from 11, would there be sufficient forces in the Pacific to counter an increasingly bold China? If the Pentagon saves nearly $150 billion in the next 10 years by shrinking the Army to, say, 483,000 troops from 570,000, would America be prepared for a grinding, lengthy ground war in Asia?

What about saving more than $100 billion in health care cutbacks for working-age military retirees? Would that break a promise to those who risked their lives for the country?

The calculations exclude the costs of the wars in Iraq and Afghanistan, which will go down over the next decade. Even after the winding down of the wars and the potential $1 trillion in cuts over the next decade, the Pentagon’s annual budget, now $530 billion, would shrink to $472 billion in 2013, or about the size of the budget in 2007.

It is also important to remember that Mr. Panetta, a former White House budget chief, understands budget politics like few other defense secretaries. When he sent a dire letter to Capitol Hill late last year that held out the prospect of huge reductions in some of Congress’s favorite weapons programs, analysts saw it as a classic tactic to rouse the Hill to his side.

Kin Cheung/Associated Press
The aircraft carrier Carl Vinson, anchored in Hong Kong.

The Next War

Balancing Needs and Costs

This is the third article in a series that is examining the American military and the decisions confronting it in a new age of austerity.

They noted that Mr. Panetta did not cite the $100 billion that the previous defense secretary, Robert M. Gates, said could be saved by reducing the number of contractors, cutting overhead, consolidating technology and limiting spending in the executive offices of the Pentagon.

“Talking about business practices doesn’t sound the alarm bells,” said Travis Sharp, a defense budget specialist at the Center for a New American Security, a defense policy research institution.

Here is a look at other areas for reductions:

Military benefits and salaries, although politically difficult to cut, are first in the line of sight of many defense budget analysts. Scaling back the Pentagon’s health care and retirement systems and capping raises would yield hundreds of billions of dollars in projected savings over the next decade.

As it stands now, the Pentagon spends $181 billion each year, nearly a third of its base budget, on military personnel costs: $107 billion for salaries and allowances, $50 billion for health care and $24 billion in retirement pay.

One independent analyst, Todd Harrison of the Center for Strategic and Budgetary Assessments, a nonpartisan policy and research group in Washington, has calculated that if military personnel costs continue rising at the rate they have over the past decade, and overall Pentagon spending does not increase, by 2039 the entire defense budget would be consumed by personnel costs.

Most of Washington’s “cut lists” recommend increases in fees for beneficiaries in the Pentagon’s health insurance, Tricare. But the higher fees would affect only working-age retirees and not active-duty personnel, who do not pay for health care.

Other proposals call for capping increases in military salaries, which have had double-digit increases since the Sept. 11 attacks, often because Congress gave the troops raises beyond those requested by the Pentagon.

The chief target for weapons cuts is the F-35 Joint Strike Fighter, one of the most expensive weapons program in history. The Pentagon has plans to spend nearly $400 billion to buy 2,500 of the stealth jets through 2035, but reductions are expected.

The debate centers on how necessary the advanced stealth fighter really is and whether missions could be carried out with the less expensive F-16s. The main advantage of the F-35 is its ability to evade radar systems, making it difficult to shoot down — an attribute that is important only if the United States anticipates a war with another technologically advanced military.

“It would matter some with Iran, it would matter a lot with China,” said Michael E. O’Hanlon, a defense analyst at the Brookings Institution and the author of a recent book, “The Wounded Giant: America’s Armed Forces in an Age of Austerity.”

Nowhere is balancing budget and strategy more challenging than in deciding how large a ground combat force the nation needs and can afford. The Army chief of staff, Gen. Ray Odierno, the former commander in Iraq, points out that the Army had 480,000 people in uniform before the Sept. 11 attacks, and at that number was supposed to be able to fight two wars at once.

But the Army proved to be too small to sustain the wars in Afghanistan and Iraq and was increased to its current size of 570,000. The Army is now set to drop to 520,000 soldiers, beginning in 2015, although few expect that to be the floor. The reality is that the United States may not be able to afford waging two wars at once.

“That said, there are certain risks with falling off the two-war posture,” said Andrew F. Krepinevich Jr., a military expert at the Center for Strategic and Budgetary Assessments. “You may risk losing the confidence of some allies, and you may risk emboldening your adversaries. But at the end of the day, a strategy of bluffing, or asserting that you have a capability that you don’t, is probably the worst posture of all.”

Studies by the Center for a New American Security, the Sustainable Defense Task Force and the Cato Institute, which represent a spectrum of views on defense spending, estimate that the savings from cutting the ground force could range from $41 billion by reducing the Army to 482,400 and the Marine Corps to 175,000 (from its present size of 202,000) all the way up to $387 billion if the Army drops to 360,000 and the Marines to 145,000. The final numbers will make it clear that the United States could not carry out lengthy stability and nation-building efforts, like those ordered for Afghanistan and Iraq, without a huge mobilization of the National Guard and the Reserves.

The size of the military is determined not only to win wars, but also to deter adversaries from starting hostilities. That underpins the American rationale for maintaining a combat presence at overseas bases and for conducting regular air and sea patrols around the globe. With austerity looming, those, too, might be curtailed to save money.

Senator Tom Coburn, Republican of Oklahoma, advocates saving $69.5 billion over 10 years by reducing by one-third the number of American military personnel stationed in Europe and Asia

“This option would leave plenty of military capability by maintaining strategic air bases and naval ports to provide logistics links,” Mr. Coburn wrote in a report on his budget proposals. Many Congressional budget experts also see ways to save billions of dollars by consolidating Defense Department facilities, schools and installations.

One of the largest expenses the Pentagon faces is to replace its aging strategic nuclear forces. While America’s nuclear warheads are relatively inexpensive to maintain on a day-to-day basis, all three legs of the nuclear triad that deliver the punch — submarines, bombers and ground-based missiles — are reaching the end of their service life at just about the same time.

“The world has changed,” said Stephen W. Young, a senior analyst with the Union of Concerned Scientists, a nuclear watchdog group. “The United States can be more than secure with a far smaller arsenal than what we currently have.”

 

Direct Link:  http://www.nytimes.com/2012/01/03/us/pentagon-to-present-vision-of-reduced-military.html?nl=todaysheadlines&emc=tha2