That’s right, it’s time for the annual CyberCon.

Join us on Tuesday, Nov. 28, for the annual gettogether of top federal and military officials and academic thinkers in cyber, from information security to offensive and defensive operations.

This year’s theme ― Beyond Cybersecurity ― reflects the latest thinking in cyber, moving past concentrating on securing data to a wider view of the landscape. To be sure, cybersecurity is an integral part of the puzzle. But to attain true security in cyberspace, the conversation must include all aspects of the cyberthreat and options for deterrence and response.

From its inception, CyberCon has been a venue to discuss the latest in cyber from a holistic standpoint, bringing together civilian and military, government and academia, U.S. and international partners. This year is no different, with an impressive lineup of speakers, including, among others:

• Sen. Sheldon Whitehouse, D-R.I.
  
• Rep. Elise Stefanik, R-N.Y.
  
• Dr. Brian Pierce, Director of DARPA’s Information Innovation Office
  
• Brig. Gen. Timothy Haugh, Director of Intelligence for U.S. Cyber Command
  
• Col. Todd Stratton, Director of AFCYBER Forward
  
• Deborah Pierre-Louis, Director of Policy, Liaison and Training Office at the State Department
  
• Trent Teyema, Cyber Readiness Section Chief in the FBI Cyber Division
  
• Jim Piche, Homeland Sector Director at GSA FEDSIM
  
• Kate Charlet, former acting Deputy Assistant Secretary of Defense for Cyber Policy
  
• Sean Kanuck, former National Intelligence Officer for Cyber Issues
  

Panel topics include taking the cyberwar to terrorists online, battling information warfare in cyberspace, the new critical infrastructure in need of defending and the latest training techniques for our cyber defenders and warriors.

The conference is a unique opportunity for attendees to have face-to-face interaction and dialogue with senior leadership across the branches of government and the military, including high-level policy setters and decision-makers.

Fifth Domain, Federal Times, C4ISRNET and Defense News are proud to present the third annual CyberCon at the Ritz-Carlton in Pentagon City on Nov. 28. We look forward to seeing you there, as well.

Register now to secure your seat.

• What are you trying to do? (No jargon!)
• How does this get done today?
• What is new about your approach?
• If you succeed, what difference do you think it will make?
• How long do you think it will take?
• Can your work transition (to DoD or others)?
• How much will it cost?

Regli warned against confusing the first question and the third.

“The common mistake is to conflate ‘what’s new in your approach’ with ‘what are you trying to do.’ People come with their technique that they want to work on and don’t think about the problem they’re trying to solve, at the right level of abstraction,” he said. “Can I come up with a problem for which your technique provides a new insight?”

Regli suggested responding to specific RFIs rather than cold-calling. DSO does sometimes get unsolicited proposals, but those are rarely, if ever taken up, he said.

The best way to build a successful partnership — i.e., get funding for your ideas — is to partner closely with DSO’s program managers.

“What you want to do is identify program managers who overlap with your interests and get to know them. Figure out what they’re interested in and whether your ideas can help them solve the problems they’re working on,” Regli said.

He also suggested finding the newest program managers to join the office, as they’ll be most interested in building new partnerships and are more likely to be in the early stages of a project, when new proposals are most crucial.

“Let’s see if we can keep fomenting revolutions together by creating a greater community of people who know how to work with DARPA,” he said.

For his part, President-elect Donald Trump was unambiguous about his stance on cybersecurity.

“As a deterrent against attacks on our critical resources, the United States must possess — and has to — the unquestioned capacity to launch crippling cyber counterattacks. And I mean crippling,” Trump told a veterans group on Oct. 3. “America’s dominance in the arena must be unquestioned. Today, it’s totally questioned. People don’t even know if we have the capability that we are supposed to have.”

Along with a more aggressive offensive stance in cyberspace, Trump also called for a cyber review team — made up of military and civilian government experts, as well as from the private sector — to conduct a holistic assessment of the federal government’s cybersecurity posture, presumably with an eye toward bolstering that posture.

Trump “is specifically committed to fixing our cyber capabilities or improving them,” Sen. Jeff Sessions, R-Ala., a leading candidate for secretary of defense, said in an interview with Defense News, a sister publication of Federal Times. “We have got to both have a defensive plan and an offensive plan. You simply can’t allow yourself to be vulnerable all of the time to cyberattacks and not have a response.”

While Trump has pledged to be more aggressive in cyberspace, the realities of building strong defensive and offensive capabilities will be a long haul, according to Greg Garcia, executive vice president at Signal Group and the first Department of Homeland Security assistant secretary for cybersecurity. Moreover, a more aggressive America will lead to more aggressive adversaries, he said.

“The Donald talks tough … but the reality is that cybersecurity policy movement is by its nature incremental,” Garcia said. “Its technological complexity coupled with a wide and disparate network of users, vendors and service providers means that the law of unintended consequences is guaranteed to come into play against any combination of those players with promulgation of aggressive policy or regulatory initiatives.”

“Reacting and calling for security best practices are easy to do,” former National Security Agency computer scientist Ben Johnson, now chief security strategist at Carbon Black, said. “It gets to be a lot harder when we’re talking about doing these things in practice, though.”

The specifics will be the hardest to pin down, according to Johnson.

“[Is] Donald suggesting that we, as a country, make it a policy to hack back? Should individual businesses have the right to retaliate? Who should be conducting attribution? Should we even focus on attribution?” he wondered. “Attribution and retaliation seem to be on everyone’s minds in Washington right now — from policymakers to military leadership to the media to private experts involved in discussions with the former. These are necessary topics, but let’s not forget how poorly our private companies and our government agencies are doing at defense — we need to improve our capabilities in defending our sensitive data, our infrastructure and our digital credentials.”

Outgoing Rep. Randy Forbes, R-Va., a potential candidate for secretary of the Navy, said cyber-watchers could expect to see important changes immediately after Trump is sworn in in January, including de-politicization of the nation’s cybersecurity policy.

“I think that with a President Trump, you’ll see him coming out literally within the first few days saying that we are going to have an international defense strategy that is driven by the Pentagon and not by the political National Security Council,” he said. “That’s a clear game-changer. Because if you look around the globe, over the last eight years, the National Security Council has been writing that. And find one country anywhere that we are better off than we were eight years [ago], you cannot find it.”

“The department will gather information on, among other things, whether voters are subject to different voting qualifications or procedures on the basis of race, color or membership in a language minority group; whether jurisdictions are complying with the minority language provisions of the Voting Rights Act; whether jurisdictions permit voters to receive assistance by a person of his or her choice if the voter is blind, has a disability or is unable to read or write; whether jurisdictions provide polling locations and voting systems allowing voters with disabilities to cast a private and independent ballot; whether jurisdictions comply with the voter registration list requirements of the National Voter Registration Act; and whether jurisdictions comply with the provisional ballot requirements of the Help America Vote Act,” according to a DOJ release.

“The bedrock of our democracy is the right to vote, and the Department of Justice works tirelessly to uphold that right not only on Election Day, but every day,” said Attorney General Loretta Lynch. “As always, our personnel will perform these duties impartially, with one goal in mind: To see to it that every eligible voter can participate in our elections to the full extent that federal law provides.”

To achieve this, the department is sending personnel — including those fluent in Spanish, Asian and Native American languages — to 67 voting districts in 28 states. Those include:

• class=”MsoNormal”>Bethel Census Area, Alaska
• class=”MsoNormal”>Dillingham Census Area, Alaska
• class=”MsoNormal”>Kusilvak Census Area, Alaska
• class=”MsoNormal”>Yukon-Koyukuk Census Area, Alaska
• class=”MsoNormal”>Maricopa County, Arizona
• class=”MsoNormal”>Navajo County, Arizona
• class=”MsoNormal”>Alameda County, California
• class=”MsoNormal”>Napa County, California
• class=”MsoNormal”>Siskiyou County, California
• class=”MsoNormal”>East Hartford, Connecticut
• class=”MsoNormal”>Farmington, Connecticut
• class=”MsoNormal”>Hartford, Connecticut
• class=”MsoNormal”>Middletown, Connecticut
• class=”MsoNormal”>New Britain, Connecticut
• class=”MsoNormal”>Newington, Connecticut
• class=”MsoNormal”>West Hartford, Connecticut
• class=”MsoNormal”>Hillsborough County, Florida
• class=”MsoNormal”>Lee County, Florida
• class=”MsoNormal”>Miami-Dade County, Florida
• class=”MsoNormal”>Orange County, Florida
• class=”MsoNormal”>Palm Beach County, Florida
• class=”MsoNormal”>Fulton County, Georgia
• class=”MsoNormal”>Gwinnett County, Georgia
• class=”MsoNormal”>Hancock County, Georgia
• class=”MsoNormal”>Chicago, Illinois
• class=”MsoNormal”>Cook County, Illinois
• class=”MsoNormal”>Finney County, Kansas
• class=”MsoNormal”>Orleans Parish, Louisiana
• class=”MsoNormal”>Quincy, Massachusetts
• class=”MsoNormal”>Dearborn Heights, Michigan
• class=”MsoNormal”>Detroit, Michigan
• class=”MsoNormal”>Hamtramck, Michigan
• class=”MsoNormal”>St. Louis, Missouri
• class=”MsoNormal”>Douglas County, Nebraska
• class=”MsoNormal”>Mineral County, Nevada
• class=”MsoNormal”>Washoe County, Nevada
• class=”MsoNormal”>Middlesex County, New Jersey
• class=”MsoNormal”>Cibola County, New Mexico
• class=”MsoNormal”>Kings County, New York
• class=”MsoNormal”>Orange County, New York
• class=”MsoNormal”>Queens County, New York
• class=”MsoNormal”>Cumberland County, North Carolina
• class=”MsoNormal”>Forsyth County, North Carolina
• class=”MsoNormal”>Mecklenburg County, North Carolina
• class=”MsoNormal”>Robeson County, North Carolina
• class=”MsoNormal”>Wake County, North Carolina
• class=”MsoNormal”>Benson County, North Dakota
• class=”MsoNormal”>Rolette County, North Dakota
• class=”MsoNormal”>Cuyahoga County, Ohio
• class=”MsoNormal”>Franklin County, Ohio
• class=”MsoNormal”>Hamilton County, Ohio
• class=”MsoNormal”>Allegheny County, Pennsylvania
• class=”MsoNormal”>Lehigh County, Pennsylvania
• class=”MsoNormal”>Philadelphia County, Pennsylvania
• class=”MsoNormal”>Pawtucket, Rhode Island
• class=”MsoNormal”>Providence, Rhode Island
• class=”MsoNormal”>Bennett County, South Dakota
• class=”MsoNormal”>Jackson County, South Dakota
• class=”MsoNormal”>Oglala Lakota County, South Dakota
• class=”MsoNormal”>Shelby County, Tennessee
• class=”MsoNormal”>Dallas County, Texas
• class=”MsoNormal”>Harris County, Texas
• class=”MsoNormal”>Waller County, Texas
• class=”MsoNormal”>San Juan County, Utah
• class=”MsoNormal”>Fairfax County, Virginia
• class=”MsoNormal”>Prince William County, Virginia
• class=”MsoNormal”>Milwaukee, Wisconsin

The leaning of the bill — put forward by Sens. Richard Burr, R-N.C., and Diane Feinstein, D-Calif. — is apparent in its short title: Compliance with Court Orders Act of 2016. Further, the first stipulation of the bill states, “No person or entity is above the law.”

Discussion Draft: Compliance with Court Orders Act (h/t to Wired and Center for Democracy and Technology Chief Technologist Joseph Hall for the document)

At the same time, the text acknowledges the need for “appropriate data security,” though it immediately reiterates that such measures must “still respect the rule of law and comply with all legal requirements and court orders.”

Specifically, the bill requires any entity — a company or other producer or purveyor of encryption tools — to hand over information requested in a warrant or court order “in an intelligible format if such data has been made unintelligible by a feature, product or service owned, controlled, created or provided by the covered entity or by a third party.”

The Burr-Feinstein bill is hardly the first encryption legislation to be put forward but it is the first major push since the “going dark” debate went into full gear in the high-profile fight between the FBI and Apple over an iPhone used by an alleged terrorist.

In such situations, the bill would also force companies to provide technical assistance accessing data on a device, even if that company doesn’t have the means to do so readily at hand.

While privacy advocates would be expected to rail against this draft, technology groups are also coming out against what they perceive to be a blow to strong encryption.

“We are pleased that this legislation is only a draft because it requires more thinking and more work,” said Dean Garfield, president and CEO of the Information Technology Industry Council (ITI). “We share Sens. Burr and Feinstein’s commitment to protecting our country but unfortunately the proposed policy is misguided and will ultimately lead to increased insecurity rather than increased security … This proposal would actually freeze in place the technology we need for protection, leaving all of us extraordinarily vulnerable.”

The text does mention that no part of the bill would restrict a person or company from creating or using strong encryption, just that there must be a means for law enforcement to gain access when required. Opponents say requiring such “backdoors” would give bad actors a way in, just like law enforcement.

White House spokesperson Eric Schultz said the administration has not taken a position on this specific bill yet, though President Barack Obama’s “position on encryption is well-known.”

“The president has said before that there’s no scenario in which we don’t want really strong encryption,” Schultz said in an April 7 conversation with reporters. “Now, at the same time, we do understand we want to make sure that we don’t allow terrorists a safe haven to operate in cyberspace. So that’s why we will continue to engage with the private sector to discuss the national security and public safety challenges we face with the use of encryption.”

As for the Burr-Feinstein bill, “I’m sure we will take a look at what they’re proposing and be in touch,” he said.

On average, feds gave their agencies a C-plus for effort in adopting the Digital Government Strategy outlined by the administration in 2012, which included focus areas to improve digital services offered to the public.

The survey conducted by Acquia and Government Business Council polled 357 federal employees representing 30 agencies and the full spectrum of seniority, with two-thirds identifying as GS/GM-13 or above.

RELATED

Survey: Cybersecurity priorities shift to insider threats

Survey: Feds slow in adopting converged technology, services

Federal employees have nothing to fear but their agencies

Some 35 percent of respondents rated their federal agency as “unsatisfactory” or “poor” in implementing new technologies, with only 11 percent describing their agency as “excellent.”

Maybe more telling, about 42 percent said IT advancement was motivated by compliance, rather than mission-directed innovation. Cost efficiency, productivity and better quality of service for customers were second through fourth on the list.

“Fewer than 12 percent ranked [innovation] as one of the top three factors driving efforts in their agency, the lowest of all potential answer choices,” the report stated.

The areas that received the most focus did so because they were the easiest to track and report progress on, analysts suggested.

“Agency progress in areas managing risk (i.e., security and privacy) or direct cost savings (e.g., consolidating duplicative IT systems) is generally farther along than efforts to provide better customer service or data accessibility,” the report noted, suggesting this is “possibly because of the difficulty of measuring return on investment.”

More heartening, security was a priority focus for almost 90 percent of respondents, while 88 percent said their agency is serious about the privacy of user data.

Other interesting findings:

■56 percent of respondents “agree” or “strongly agree” that their agency attempts to make data open and easily accessible;

■ 40 percent said their agency’s data are publicly searchable;

■ 60 percent “agree” or “strongly agree” that their agency works internally to eliminate duplicative services;

■ Only 42 percent gave the same response for working with other agencies to achieve the same result;

■ 52 percent said their agency uses social media effectively;

■ 56 percent said their agency does not gauge user satisfaction with digital services;

■ 69 percent believed data stored in a cloud was appropriately secure; and

■ 63 percent cited budgets as a major impediment, the single most-identified challenge.

The Tivoli MDM software is on IT Schedule 70 and used by several civilian and defense agencies, including the Federal Communications Commission, National Institutes of Health, Army and Navy.

The vulnerability — coded CV-2014-6140 — allows an attacker to interject seemingly valid cookies that then execute arbitrary code when pushed to the devices managed by the system. The code is run with full administrator privileges, which could significantly compromise a device.

“It is highly likely that a successful attack on the application server can also be leveraged into a full compromise of all devices managed through the product,” German cybersecurity firm RedTeam Pentesting GmbH wrote in an advisory on Dec. 2. “This constitutes a high risk.”

The weakness — discovered by RedTeam during a penetration test earlier this year — was given a vulnerability score of 9.3 on a scale of 10.

IBM released a patch through version 9.0.60100 to remediate the issue, the company said in a security bulletin posted Dec. 4.

RedTeam offered a potential workaround, however it is untested. Like IBM, the firm suggests upgrading to a new version of the software.

The research agency posted a request for proposals for a Transparent Computing program designed to shine a light on malware hiding in the depths of complex computer systems and actively adapt to new threats.

Read the full RFP

Skilled hackers attacking a network often work in the background over a long period of time, slowly infecting the systems with code masked in the normal ins and outs. This type of breach — called an advanced persistent threat (APT) — is difficult to detect and expose, particularly in large, complex networks made up of many entry points.

RELATED

DARPA director thirves on disruptive technology

DARPA launches cyber challenge

For cyber-defense, automation alone is not enough

A Transparent Computing system, if successful, would give security managers a granular view of the network, including detailed information on where data are coming from.

Specifically, DARPA is looking for a program that can:

■ Record and preserve the provenance of all system elements/components (inputs, software modules, processes, etc.);

■ Dynamically track the interactions and causal dependencies among cyber system components;

■ Assemble these dependencies into end-to-end system behaviors; and

■ Reason over these behaviors, both forensically and in real-time.

In practice, the program would identify all incoming connections and active processes, learn which are malicious (or at least arbitrary) and move to remediate.

“By automatically or semi-automatically ‘connecting the dots’ across multiple activities that are individually legitimate but collectively indicate malice or abnormal behavior, TC has the potential to enable the prompt detection of APTs and other cyber threats,” the RFP states.

Per many DARPA initiatives, “It is expected that this prototype will provide a starting point for technology transition,” sparking a new wave of cybersecurity, according to the RFP. Proposers are warned against offering “evolutionary improvements” to current cybersecurity methods.

DARPA is holding a Proposers’ Day at the DARPA Conference Center in Arlington on Dec. 15. The unclassified event will be an opportunity for prospective applicants to get information on Transparent Computing and the solicitation. Attendance at the Proposers’ Day is not required to send a submission later.

Multiple awards are expected across five technical areas. The combined total has a funding ceiling of $60 million.

Proposals are due to DARPA by noon on Feb. 10.

Team Digi7al member Nicholas Paul Knight, 27, of Chantilly, Va., was sentenced Friday after pleading ‘guilty’ in May.

The Naval Criminal Investigative Service (NCIS) began looking into Team Digi7al in 2012 after a breach was detected in the Smart Web Move database, which stores personnel records, including Social Security numbers, dates of birth and other personally identifiable information. Links to the information were posted publicly through the Team Digi7al Twitter account.

In 2013, while serving on the USS Harry S. Truman, Knight was caught up in a NCIS sting operation while attempting to hack into a restricted network.

Knight’s co-defendant Daniel Krueger, 20, of Dix, Ill., received a two-year prison sentence on Oct. 22.

Knight, Krueger and Team Digi7al have also been linked to cyberattacks on the National Geospatial-Intelligence Agency and more than 50 other public and private networks.

“Computer hacking presents a significant risk to national security,” said Danny Williams, U.S. attorney for the Northern District of Oklahoma. “As a service member in the United States Navy, the defendant knowingly breached his oath of enlistment and became an insider threat. We will continue to work with our law enforcement partners to find cyber-criminals and prosecute them to the full extent of the law.”