Monthly Archives: April 2017

This report first appeared on CyberScoop.

The man responsible for leading the National Security Agencys defensive mission says his team is fielding more calls than ever from agencies across the government.

Dangerous, highly capable hackers and a desire by agencies to adopt cloud technology have increased the workload forInformation Assurance chief Paul Pitelli and his office, which he says is sort of like the Geek Squad for defense in government.

Pitelli is acareer professionalwho has served in the NSA for more than 20 years as the secretive spy agency transformed into what it is today a highly sophisticated technology behemoth with an array of federal responsibilities, including both signals intelligence and protecting sensitive government systems. With the recent retirement of former Information Assurance Directorate head Curtis Dukes, a renown computer scientist and intelligence community icon, Pitelli took on an increased role in an ever important effort to ensure that the Defense Department and broader government arent hacked.

Well get a wide range of calls from Hey were trying to set up a whole new [information technology] environment and that could be the White House calling, Pitelli said.

A big focus in recents years for Information Assurance, according to Pitelli, has been helping a variety of different federal agencies establish secure cloud data storage processes.

I have never been more busy, Pitelli told CyberScoop in an interview Thursday after he spoke at the McAfee Security Through Innovation Summit.We are getting calls because they all need help. Everyone wants to take advantage of cloud services, thats sort of one thing were getting called for, but its also traditional issues because our nation is being constantly attacked. Were one of the few agencies that get to see when and how the adversary starts operating.

Federal lawmakers have increasingly encouraged agencies in recent years to adopt cloud data storage technologies as a way to both save costs and phase out old on-premise servers.

Because of the economics of cloud services theres so much incentive [for agencies] to migrate many of their capabilities, Pitelli said. A lot of people in government want the NSAs help.

Nobody in government wants to be the next to suffer a hack like the2015 data breach that exposed federal employee information held by theOffice of Personnel Management, he said.

So were getting a lot of calls where its basically, Hey we want to make this move, but how do we do it well? Pitelli said.

Turnoverat the White House also adds to the Information Assurance divisions current workload.

With a change of administration, you know, they typically take a fresh look. And for us thats an opportunity because it allows us to sometimes make an [IT] environment better, Pitelli said. The cyber dimension is adding, on one hand, what you can call issues or events, but I think can be opportunities.

Historically, Fort Meades defensive efforts in cyberspace have been overshadowed by the spy agencys more offensive-centric, intelligence gathering mission set. This is evident from a labor perspective, given that the NSAs Signals Intelligence workforce remains much larger than the Information Assurance unit.

An overwhelming majority of budget dollars are allocated to offense rather than defense, former intelligence officials say, and thats resulted in an agency that is known almost exclusively for digital espionage rather than cyber-defense.

Dukes, former IAD head Debora Plunkett and departing NSA Deputy Director Rick Ledgett recently voiced their concerns that the NSA should be focusing on defense more than it has in the past.

Roughly 90 percent of the U.S. government cybersecurity spending is used to fuel offensive operations, Ledgett told Reuters.

I absolutely think we should be placing significantly more effort on the defense, particularly in light of where we are with exponential growth in threats and capabilities and intentions, Plunkett, who oversaw the NSAs defensive mission from 2010 to 2014, recently told Reuters.

Defense under NSA21

The trios comments come amid an expansive reorganization effort by the NSA, instituted by agency Director Michael Rogers, that works to combine what was once called the Information Assurance Directorate and Signals Intelligence Directorate into a single, joint entity.

Although Rogers plan, known as NSA21, is intended to streamline operations, it has also spurred new concerns that the spy agencys defensive mission will receive even less resources in the future.

When the NSA goes through a change a lot of that discussion goes on because theres a big difference between offense and defense as far as the budget and so that was one of the big concerns that some folks vocalized, said Pitelli, I see a need, a bigger need for cybersecurity not just at NSA but for everybody.

The dual impact of NSA21s rollout and Dukes recent retirement has caused some confusion in government.

I know Curt voiced concerns that as we make this move [towards NSA21] there can be this perception that Oh well who do I call? And if they dont know who to call the question is, Well where did it go? Curt was really one of the great, visible icons of Information Assurance and he retired and so there is that time right now where we are waiting to find out whose going to be given the mantle next, Pitelli said.

Pitelli declined to specifically discuss the NSAs budget but said he would like to see Congress broadly allocate greater resources for cybersecurity writ large, across the entire government.

I will go so far as to say I would hope that the government not just at NSA, but the government really tries to allocate additional funds for the cybersecurity information assurance mission, Pitelli said. Alot of times people have lumped in their information assurance budgets with their IT budgets and the challenge I think youre seeing now is that we havent kept up with the budgets of cybersecurity.

More:
NSA cyber-defense chief: 'I have never been more busy' - FedScoop

For many, many years, Senator Ron Wyden has been directly asking the US intelligence community a fairly straightforward question (in his role as a member of the Senate Intelligence Committee): just how many Americans are having their communications swept up in surveillance activities supposedly being conducted on foreigners under the FISA Amendments Act (FISA being Foreign Intelligence Surveillance Act). Wyden started asking way back in 2011 and got no answers. His continued questioning in 2013 resulted in Director of National Intelligence James Clapper lying to Congress in a public hearing, which Ed Snowden later claimed was a big part of the inspiration to make him leak documents to the press.

Just last month, we noted that Wyden had renewed his request for an accurate depiction of how many Americans have had their communications swept up, this time asked to new Director of National Intelligence, Dan Coats. Unfortunately, for all these years, it's basically felt like Senator Wyden tilting at a seeming windmill, with many others in Congress basically rolling their eyes every time the issue is raised. I've never understood why people in Congress think that these kinds of things can be ignored. There have been a few attempts by others -- notably on the House Judiciary Committee -- to ask similar questions. Almost exactly a year ago, there was a letter from many members of the HJC, and there was a followup in December. But, notably, while there were a number of members from both parties on that letter, the chair of the House Judiciary Committee, Bob Goodlatte, did not sign the letter, meaning that it was unlikely to be taken as seriously.

Suddenly, though, it seems that the ins-and-outs of Section 702, and how the "incidental" information it collects on Americans is used has taken on a much wider interest, following President Trump's misleading suggestion that President Obama tapped his phone lines, and some Trump supporters trying to twist typical 702 surveillance to justify those remarks. Either way, if that leads people to actually look at 702, that may be a good result out of a stupid situation. And, thus, we get to this surprising moment, in which Goodlatte has actually sent a similar letter to Coats (along with ranking member John Conyers) asking about the impact of 702 surveillance on Americans. And since (for reasons that are beyond me) Reuters refuses to link to the actual source materials, you can read the full letter here or embedded below.

The letter demands an answer by April 24th. And, yes, it's notable that Goodlatte has signed on, because Section 702 is up for reauthorization at the end of the year, and if Goodlatte is not on board with reauthorization, then the NSA is going to have some difficulty in getting it through.

You have described reauthorization of Section 702 as your "top legislative priority." Although Congress designed this authority to target non-U.S. persons located outside of the United States, it is clear that Section 702 surveillance programs can and do collect information about U.S. persons, on subjects unrelated to counterterrorism. It is imperative that we understand the size of this impact on U.S. persons as our Committee proceeds with the debate on reauthorization.

The letter then even points to Coats' response to Wyden during Coats' confirmation hearing that he was "going to do everything I can to work with Admiral Rogers in NSA to get you that number." Of course, back in December, it was said that the intelligence community might finally deliver that number... in January. And it's now April. Still, with Goodlatte finally taking an interest in this, it's a sign that the NSA can't just coast by and continue to completely ignore this.

Read the rest here:
Oh, Sure, Now Congress Is Serious About Asking NSA About Surveillance On Americans - Techdirt

American espionage is not only compatible with but essential to democracy, former director of the National Security Agency and the Central Intelligence Agency Michael Hayden told an audience of more than 200 people in Robertson Hall April 6.

Courtesy Central Intelligence Agency, via Wikipedia

As director of the NSA from 1999 to 2005 and CIA director from 2006 to 2009, Hayden was at the forefront of many post-9/11 intelligence programs, including targeted killing and the NSAs Section 215 telephone-metadata program.

Free peoples have always had to decide where they want to tuck their bed, between security on one side and liberty on the other, privacy over here and safety over here, Hayden said, in regard to what he sees as an unavoidable tradeoff between the two values.

Asked about the documents released by former NSA contractor Edward Snowden, Hayden said that whistleblowing is good so long as it reveals an illegal activity. But Hayden said the 215 program that Snowden revealed was not illegal but was approved by two presidents and Congress, and was overseen by two congressional intelligence committees as well as a federal court.

Nonetheless, Hayden said, in response to the American publics increasing distrust of intelligence efforts, federal agencies are attempting to make their activities more translucent.

Translucent means I can see the broad shapes, I can see the outlines of whats going on, but I dont have the fine operational details, he said. This is a massive adjustment that were going to have to make.

The two biggest challenges that currently confront intelligence work, Hayden said, are working with the president and deciding what information to share with the public. He said its often challenging for an intelligence official to compromise with a president, who has his own vision and instincts separate from the facts.

Youve got this inherent gap to close, and you do want to close it and get into the mind of the president, but ultimately you cant become him, Hayden said.

Although American bureaucracy can often be inefficient, Hayden said, the American system of checks and balances is still one of the most robust in the world.

Were all distressed with secrecy and power, and we want to make government more translucent, he said, but keep in mind that if we want more invasive oversight and more checks and balances, the line of departure from which we will be leaving is the already most invasive and comprehensive system of checks and balances in the democratic world.

Hayden also discussed his recently published book, Playing to the Edge: American Intelligence in the Age of Terror, in which he seeks to introduce readers to the inner workings and realities of intelligence agencies.

See the article here:
Former Director of NSA and CIA Speaks on the Importance of ... - Princeton Alumni Weekly

Honolulu-based data encryption app Kapalya call NSA patent a game changer Pacific Business News (Honolulu) With help from the High Technology Development Corp., Kumar's Kapalya signed a collaborative research and development agreement with the NSA earlier this year to jointly develop an existing NSA patent and bring it to commercial market. They said, 'We ...

Read the rest here:
Honolulu-based data encryption app Kapalya call NSA patent a game changer - Pacific Business News (Honolulu)

The choice of Rob Joyce, former head of the National Security Agencys Tailored Access Operations unit as cyber security coordinator puts an experienced offensive cyber operator at the nexus of the nations cyber policy and strategy at a time when nation-state cyber interference is at the forefront of public consciousness.

Joyce succeeds Michael Daniel, who had a public policy, economist and finance background and spent nearly a decade in cyber policy at the Office of Management and Budget and the White House. Joyces background, by contrast, is as an operator in the cyber realm, bringing an intimate understanding of the threat to the forefront of national cyber policy.

As cyber coordinator, Joyce is not the federal chief information security officer (CISO). That post is largely focused on securing the federal enterprise; the cyber coordinator drives policy beyond the federal government. The cyber coordinator is also interested in cybersecurity across the entire digital ecosystem, including private industry, state and local governments and foreign governments, as well. So its a much broader role than what the federal CISO focuses on, says Daniel, who is now president of the Cyber Threat Alliance, a non-profit focused on cyber threat sharing across the industry. There is some degree of overlap and complementarity obviously the cybersecurity coordinator has to care about the security of federal networks but the cybersecurity coordinator has a broader mandate than that.

Little is publicly known about NSAs offensive cyber activities. But in a rare public appearance last August at the USENIX 2016 conference, Joyce described the five steps to a successful cyber intrusion initial exploitation, establish presence, install tools, move laterally and collect/ex-filtrate/exploit and then walked through the weaknesses he and his hackers came across and exploited each day.

If you really want to protect your network, he said then, you really have to know your network. You have to know the devices, the security technologies, and the things inside it. His clear message: His team often knew better than the networks managers. Indeed, while NSA hackers might not understand products and technologies as well as the people who design them, Joyce said they learn to understand the security aspects of those products and technologies better than the people who created them.

You know the technologies you intended to use in that network, he said. We know the technologies that are actually in use in that network. [Theres a] subtle difference. Youd be surprised at the things that are running on a network versus the things you think are supposed to be there.

Penetration-testing is essential, as is follow-up. Joyces OTA regularly conducted Red Team testing against government networks. Well inevitably find things that are misconfigured, things that shouldnt be set up within that network, holes and flaws, he said. The unit reported its findings, telling the network owner what to fix.

Then a few years later, it would be time to test that network again. It is not uncommon for us to find the same security flaws that were in the original report, Joyce said. Inexcusable, inconceivable, but returning a couple of years later, the same vulnerabilities continue to exist. Ive seen it in the corporate sector too. Ive seen it in our targets.

Laziness is a risk factor all its own. People tell you youre vulnerable in a space, close it down and lock it down, Joyce said, reflecting on the fact that network administrators frequently dont take all threats and risks seriously enough. Dont assume a crack is too small to be noted or too small to be exploited. Theres a reason its called advanced persistent threats: Because well poke and well poke and well wait and well wait and well wait, because were looking for that opportunity to [get in and] finish the mission.

As an offensive cyber practitioner, Joyce sought to identify and, when needed, exploit the seams in government and enemy networks. He focused on the sometimes amorphous boundaries where the crack in the security picture might come from getting inside a personal device, an unsecured piece of operational security, such as a security camera or a network-enabled air conditioning system, or even an application in the cloud. Cloud computing is really just another name for somebody elses computer, he said. If you have your data in the cloud, you are trusting your security protocols the physical security and all of the other elements of trust to an outside entity.

Most networks are well protected, at least on the surface. They have high castle walls and a hard crusty shell, he said. But inside theres a soft gooey core.

Figuring out how to protect that core from a national security and policy perspective will be Joyces new focus, and if Daniels experience is any indicator, it will be a challenge.

From his perspective, cybersecurity is only partly about technology. Adversaries tend to get into networks through known, fixable vulnerabilities, Daniel says. So the reason those vulnerabilities still exist is not a technical problem because we know how to fix it its an incentive problem an economics problem. That is, network owners either fail to recognize the full extent of the risks they face or, if they do, may be willing to accept those risks rather than invest in mitigating them.

The challenge, then, is formulating policy in an environment in which the true level of risk is not generally understood. In that sense, Joyces ability to communicate the extent to which hackers can exploit weaknesses could be valuable in elevating cyber awareness throughout the White House.

The NSC is about managing the policy process for the national security issues affecting the US government, Daniel explains. You dont have any direct formal authority over anyone. But you do have the power to convene. You have the power to raise issues to people in the White House. You have the ability to try to persuade and cajole. The background he brings will obviously color what he prioritizes and what he puts his time against. But the role itself will not be dramatically different. understanding how to get decisions keyed up in a way that you can actually get them approved.

Joyces background could affect how this administration views commercial technologies, such as cloud services, mobile technology and other advances that, while ubiquitous in our daily lives, are not yet standard across the federal government.

Trust boundaries now extended to partners, Joyce said a year ago. Personal devices youre trusting those on to the network. So what are you doing to really shore up the trust boundary around the things you absolutely must defend? That for me is what it comes down to: Do you really know what the keys to the kingdom are that you must defend?

National security cyber policy is not just defensive, however, and having a coordinator with a keen insiders understanding of offensive cyber capabilities could have a significant long-term impact on national cyber strategy.

Just as Daniel sees cybersecurity as an incentives, or economics problem, Kevin Mandia, chief executive at the cyber security firm FireEye and founder of Mandiant, its breach-prevention and mitigation arm, sees incentives and disincentives as playing a critical role for cyber criminals and nation-state attackers, alike. Simply put, he says, the risk-reward ratio tilts in their favor, because the consequences of an attack do not inflict enough pain.

Mandia agrees that the first priority for U.S. cyber policy should be self-defense. Every U.S. citizen believes the government has a responsibility to defend itself, he said at the FireEye Government Forum March 15. So first and foremost, our mission security folks must defend our networks. But the second thing the private sector wants is deterrence. We need deterrence for cyber activities.

And in order to develop an effective deterrence policy, he argues, the nation needs fast, reliable attribution the ability to unequivocally identify who is responsible for a cyber attack.

Id take nothing off the table to make sure we have positive attribution on every single cyber attack that happens against U.S. resources, Mandia says. Because you cant deter unless you know who did it. You have to have proportional response alternatives, and you have to know where to direct that proportionate response.

Where Joyce stands on deterrence and attribution is not yet clear, but what is clear is that sealing off the cracks in federal network security is sure to get more intense.

A lot of people think the nation states are running on this engine of zero-days, Joyce said a year ago, referring to unreported, unpatched vulnerabilities. Its not that. Take any large network and I will tell you that persistence and focus will get you in, will achieve that exploitation without the zero days. There are so many more vectors that are easier, less risky and quite often more productive than going down that route.

Closing off those vectors forces threat actors to assume more risk, expose zero-day exploits and operate with less cover. When that happens, the balance of cyber power could finally start to tilt away from the hackers.

Tobias Naegele is the editor in chief of GovTechWorks. He has covered defense, military, and technology issues as an editor and reporter for more than 25 years, most of that time as editor-in-chief at Defense News and Military Times.

See the original post:
What to Expect from the NSA Hacker Turned White House Cyber ... - GovTechWorks

Defense

Strategic Command chief Gen. John Hyten says that Cyber Command needs its own platform ahead of a planned split from NSA.

U.S. Cyber Command needs to be elevated to a full combatant command as soon as possible, but it should remain tied to the National Security Agency until it has its own cyber platform, according to the head of U.S. Strategic Command.

Air Force Gen. John Hyten told the Senate Armed Services Committee that he and Adm. Michael Rogers, head of the NSA and CyberCom, submitted their plan to the Trump administration calling for elevation of CyberCom "sooner rather than later."

He said that needed to happen "just to normalize that command and make sure that we can kind of develop normal command relationships between Cyber Command and all the combatant commanders including Strategic Command."

Later in the hearing, Hyten added that the end of the dual-hat leadership structure of the NSA and CyberCom will have to wait until CyberCom has an independent cyber platform from the NSA.

"There are acquisition programs of record being instituted to build those capabilities," said Hyten. "Once those capabilities are built, I would be supportive of separating the two. But I will not advocate separating the two until we have a separate platform in the services that Cyber Command can operate on."

Senators pressed Hyten on a number of cybersecurity topics, including the ramifications of modernizing the IT architecture that controls the U.S. nuclear arsenal.

Strategic Command currently oversees cyber, space and nuclear capabilities, and Hyten said they are linked in that a cyber threat that could affect command and control capabilities could undermine the U.S. nuclear deterrent, "and we have to make sure we never allow that to happen."

Hyten said Congress needs to demand that as the military services modernize nuclear command and control capabilities that they move from a 20th century architecture and not simply move from eight-and-a-half inch floppy discs to the five-inch variety.

"We will introduce cyber vulnerabilities as we walk into that, but if you work it right from the beginning, you can make sure that that threat is mitigated from the beginning," he said.

When asked whether the U.S. has the capacity to protect nuclear cyber systems, Hyten said in general he was happy with where the Cyber Mission Forces are going right now. But he warned that they do yet not have the capacity to meet all of the requirements the DOD has.

He said that currently cyber forces are specifically assigned to the combatant commands, and that DOD needs to look at cyber forces like special forces -- as a high-demand, low-density asset that needs to be centralized and allocated out based on mission priority.

"The demand signal is going to go nowhere but up and the capacity is not sufficient to meet all of the demand," he said.

Hyten also said the conversation on deterrence in cyberspace must move past the nuclear framework of the past, with its binary analysis.

"I think what's missing is a broader discussion of what 21st century deterrence really means," said Hyten. "That involves the nuclear capabilities as the backstop, but fundamentally space, cyber, conventional, all the other elements as well.""Now it's a multivariable analysis and each of those has to be put in context," he said. "And context has to be the fact that we're actually not deterring cyber, we're not deterring space. We're deterring an adversary that wants to operate and do damage in those domains."

About the Author

Sean Carberry is an FCW staff writer covering defense, cybersecurity and intelligence. Prior to joining FCW, he was Kabul Correspondent for NPR, and also served as an international producer for NPR covering the war in Libya and the Arab Spring. He has reported from more than two-dozen countries including Iraq, Yemen, DRC, and South Sudan. In addition to numerous public radio programs, he has reported for Reuters, PBS NewsHour, The Diplomat, and The Atlantic.

Carberry earned a Master of Public Administration from the Harvard Kennedy School, and has a B.A. in Urban Studies from Lehigh University.

Read more:
General: Cyber Command needs new platform before NSA split - FCW.com