The addition of six months to the deal accounts for the inclusion of the Secure Internet Protocol Router Network, or SIPRNet, in the zero-trust program and the “complete development, testing and deployment planning for the original unclassified prototype,” DISA said in an announcement July 28.

SIPRNet is a communications network used by the Defense Department to transmit classified information across the world. DISA, the Pentagon’s top IT office, described the framework as “antiquated” and in need of updating.

The agency awarded Booz Allen a $6.8 million contract in January to develop a Thunderdome prototype, its approach to zero-trust cyber protections. Folding in SIPRNet is a significant evolution. The extension lengthens the pilot to a full year, with completion now expected at the start of 2023.

“With this additional time, we can conduct operational and security testing that was not originally planned for in the initial pilot,” Jason Martin, director of DISA’s Digital Capabilities and Security Center, said in a statement. “It will also permit us the necessary time to strategize on the best way to transition current Joint Regional Security Stacks users who will be moving to Thunderdome.”

The Pentagon in 2021 decided to sunset Joint Regional Security Stacks — meant to reduce cyberattack surface and consolidate classified entry points — in favor of the zero-trust Thunderdome approach, C4ISRNET previously reported.

The six-month add-on comes amid Russia’s invasion of Ukraine, which was preceded by cyberattacks that jeopardized command and control and forced offline government websites. Ukrainian networks continue to be buffeted, with hackers often targeting the defense, financial and telecommunications sectors.

Such attacks, DISA said in its announcement, highlight the importance of SIPRNet and the Pentagon’s need for a modernized, classified network with steadfast data protections. Defense Department systems are under constant attack, as is the defense industrial base.

“DISA has made clear that we will not forget that the ‘fight’ is fought on SIPRNet,” said Christopher Barnhurst, the agency’s deputy director. “While we have been working on developing a zero trust prototype for the unclassified network, we realized early on that we must develop one, in tandem, for the classified side. This extension will enable us to produce the necessary prototypes that will get us to a true zero trust concept.”

SIPRNet is already undergoing several other renovations. The secure network was among those accessed by Chelsea Manning, the former U.S. Army intelligence analyst who provided thousands of military and diplomatic documents to WikiLeaks.

Zero trust is an approach to cybersecurity that assumes networks are always at risk and, thus, continuous validation of users and devices is necessary. The model is often likened to “never trust, always verify.”

President Joe Biden last year ordered federal agencies to move toward zero trust and to produce the requisite plans. His executive order included several other cybersecurity provisions, as well. The Biden administration followed up in January with a memorandum focused on improving the cybersecurity of Defense Department and intelligence community systems.

“Thunderdome will be a completely comprehensive and holistic approach to how the network operates,” DISA said, “a major shift from the current architecture.”

“As we look at allies and partners and their cybersecurity and the interest of adversaries in undermining, via cyber, our allies and partners in the context of our commitments and our alliances when we are going to fight together, it’s really important that we think about cybersecurity of our allies and partners and that we think about how to bring that up to speed,” Eoyang said at C4ISRNET’s CyberCon on Nov. 10.

“We’re hearing frequently from our allies and partners” across NATO, in Europe and in the Asia Pacific region “requests for assistance in the cybersecurity arena,” she said.

The Defense Department needs to do “a better job” understanding how it can use the Defense Security Cooperation Agency and other mechanisms to help allied and partner nations improve their own cybersecurity, Eoyang added.

To effectively help other nations, she said, the Pentagon will need industry’s help.

“I would argue that some of the best talent is actually in the private sector because we in the department certainly can’t afford to pay what the private sector pays in many of these circumstances,” Eoyang argued.

The Pentagon has begun discussions with DSCA as well as regional commands and Cyber Command about how to work together to improve cybersecurity for allies.

DoD has offered in-house cybersecurity capacity- and skill-building in the past, “but we’re not the only people who can help with that and so doing a better job of understanding what’s available out there in the private sector, how that might fit for ally and partner needs, we have a lot of work to do here, but we are really interested in moving forward,” Eoyang said.

“It’s certainly a conversation we look forward to having with industry to better understand what are the obstacles to doing that? How can we incentivize that,” she said.

Eoyang stressed not all nations are “equally situated to their understanding of the highly capable threat that we’re all up against.”

Strong cybersecurity among allies and partners, Eoyang said, is key because “when you fight as a coalition, you have to plan together, you have to train together and if those activities are compromised via cyber means where the adversary figures out how to get inside our playbook and inside our huddle, that’s a real problem for our ability to fight and win together.”

Meanwhile, Eoyang’s Pentagon cyber policy shop is currently focused on solving problems within two major areas: securing elections and protecting critical infrastructure from ransomware attacks like the one that shut down the Colonial Pipeline in May and led to fuel shortages in several states.

“I think in the past, a lot of people thought of these things just as crime and nuisance and not rising to the level of a national security threat that would involve the Department of Defense,” she said, “but we see the adversaries’ capabilities rise in this area. Ransomware is very clearly a priority for the Department of Defense and we are actively engaged in the whole-of-government efforts to disrupt and impose consequences on those malicious actors.”

“For a very long time, the Army got comfortable operating with contractors all over the battlefield,” said Lt. Col. Vito Errico, director of the Army Software Factory, at C4ISRNET’s CyberCon event Nov. 10. “It was sort of commonplace in Iraq and Afghanistan to co-locate contractors with servicemembers to do technically oriented things. … That was the way that we were able to fight.”

“But looking ahead, we might not always be able to fight that way. A future enemy might have the ability to deny us the ability to move contractors and civilians around the battlefield, and that burden of technical competence, that last tactical mile of software development or fusing data sets, might fall on the uniformed servicemember,” he explained.

With a relatively informal, less hierarchical structure than a typical military organization, the Army Software Factory’s goal is to grow the number of soldier coders within its ranks. Hosted at Austin Community College in Texas, the first cohort of 25 soldiers launched in January. That cohort will stay at the factory for a three-year rotation, during which time they will take courses and learn software skills.

The nascent software factory operates as a pilot program under Army Futures Command, as the Army assesses whether the factory can be beneficial and whether the service’s approach to software is good enough.

“It’s a nice empirical use case to help inform senior Army officials on where they need to go with policy,” said Errico.

An additional benefit of using soldiers to code is the soldiers are themselves users of the software they’re developing. The factory’s tagline is “By soldiers, for soldiers.”

The approach is already bearing fruit, said Errico. After observing tactical logistics warehouses at Fort Hood, Texas, factory participants were able to develop software that automated some of the ordering processes, giving soldiers time back to spend training on terminals to help reduce waste.

That software gained popularity organically as the various tactical warehouses adopted it. Now it’s being used by the bigger depots, said Errico, and the software is estimated to have saved more than 3,500 soldier hours.

The Marine Expeditionary Force Information Group (MIG) formation was fielded four years ago and has already made progress in training fellow Marines on how to operate amid cyber threats as well as showing MEF commanders how to blend a range of kinetic and non-kinetic options, Col. Brian Russell, who commands the II MEF Information Group, said Nov. 10 during a discussion as part of C4ISRNET’s CyberCon.

But those Marines’ talents could still be further unleashed.

“As our commandant redesigns our force to be a stand-in force, forward-deployed, persistently engaged in the information environment, I think our forces can provide a measure of access to the entire joint force to get into networks and get into systems in support of the combatant commanders’ objectives,” Russell said.

He painted a picture of what those operations could look like, citing a recent essay Commandant Gen. David Berger wrote on his vision of a stand-in force, or one that can live and operate in and around enemy territory and win the daily reconnaissance/counter-reconnaissance battle.

In his essay, published this month in Proceedings magazine, Berger wrote: “In a 21st-century reconnaissance/counter-reconnaissance battle, an adaptive adversary will try to change signatures and adjust sensors to defeat the collection efforts of the United States and its partners, and to overcome their deception efforts.

“Marines on the front lines may have to write computer code to adjust the software on sensors and systems in real time,” he continued. “The examples are many, but the implications are clear. Developing future Marines who will operate as SIF demands as much focused attention as any other aspect of the stand-in concept — perhaps more.”

In combination with the recent talent management plan that emphasizes retaining high-performing Marines over recruiting fresh new ones every four years, creating a more mature and experienced force, Russell said the commandant’s plans are particularly well suited for MIG Marines.

“I have a good number of Marines that love to code in their off time. And so when the commandant comes out in his vision for the stand-in force in [Proceedings] this month and says Marines on the frontline will have to reprogram their software in their systems on the fly to achieve operational outcomes, this is all about how we enable the creative brilliance we already have in the formation,” he said.

“The best thing I can do as a commander in support of retention is to give them mission: let them operate in the cyber domain, let them perform those influence functions, let them do what they came in to do. And that’s the best retention setup we’ve got,” Russell continued.

Russell added that the MIG Marines have come a long way in the last four years in getting comfortable with their non-kinetic mission areas within the force’s portfolio. But he said developing more maturity and experience in the force would only make these MIG Marines more comfortable in taking bold actions to reshape the operating environment to their favor: influencing the local population, taking out an enemy network, disrupting the enemy’s kill chain and more.

“We need a more mature Marine going forward as part of this talent management plan to be able to make those decisions very quickly, the decisions that modify terrain” and help the force win, he said. The ultimate goal is to pair the “more mature, experienced, trained individual” with the right authorities and the right technology to make a difference.

Russell said it’s taken a mindset change to get as far as the Marine Corps has in embracing the warfighting functions resident within the MIG, including communications, intelligence, fires, cyber, psychological operations, communication strategy and more.

“Whether you like it or not, or realize it or not, all of our Marines are involved in this information environment, and we need to prepare them for that reality. We do that through training,” he said. “I have my own cyber force inside the MEF Information Group, very similar to a cyber protection team, that trains against our Marine forces when we are out training, trying to get into our networks we’re using to command and control, just to give that sense to everyone that this is a very real threat we operate against each and every time we deploy.”

He likened some of the cyber training to a Combat Hunter training program ground forces use.

“It teaches Marines how to baseline their environment: if you think, Marines are out on patrol, they’re understanding what’s in the village and what appears out of the normal, and to identify what’s out of the normal and then go investigate it or report it up,” Russell said. “Apply that to just the cybersecurity perspective. How do you know your network is doing what it should be, a baseline? Do you understand what normal looks like? And when something abnormal happens, you better go investigate that, you better report it up.”

In addition to training regular forces on how to operate in the information environment, Russell said the MIG is constantly experimenting with new formations that can help operational commanders understand and employ a blend of kinetic and non-kinetic options on the battlefield. For example, in one event he took a firepower control team and added in communication strategy, psychological operations and electronic warfare Marines to see how they could work together and enable the operational commander’s objectives.

“My cyber Marines, my network administrators, my application developers, they’re all [analogous to] cyber engineers, modifying the terrain to the time of need, just like you have a normal engineer bulldozing terrain to build a road or whatever it is. These information Marines are cyber engineers in some sense, we just need to enable them to modify that terrain to the operational advantage,” Russell said.

That means the U.S. must in turn keep shifting the tools and techniques it uses to counter hackers from nations like China, Russia, Iran and North Korea — and team up with the private sector to do so, David Luber, deputy director for NSA’s cybersecurity directorate, said in a panel during C4ISRNET’s CyberCon.

“Even as we’re on this call right now, the cyberspace domain is changing,” Luber said. “New malware is being released, new vulnerabilities are being discovered, and adversaries will use those vulnerabilities to gain access to our critical … Department of Defense and national security systems.”

As part of its effort to work with the private sector, Luber said NSA’s Cybersecurity Collaboration Center is developing analytics that help it sift through both government signals intelligence collected overseas and what industry analysts have spotted.

“By comparing results, we’re able to better understand the tradecraft of those adversaries, and then develop, jointly, methods to thwart their activities,” Luber said.

The NSA has published more than 50 cybersecurity advisories over the last two years to share threat intelligence with the defense industry and other organizations. Some of those advisories have gone so far as to highlight specific pieces of malware, or tactics, techniques and procedures that Russian or Chinese hackers use to try to get into sensitive networks and infrastructures, and common vulnerabilities they like to exploit.

Hackers from Iran, North Korea or non-state organizations that try to extort money using ransomware are also threats, Luber said.

Rear Adm. Mike Ryan, head of the Coast Guard’s Cyber Command, said during the same panel that while the competition to recruit in-demand cybersecurity professionals is tough, his service’s mission and the enthusiasm it breeds help make it competitive.

“People want to be part of my command,” Ryan said. “I am not going to win on the salary and compensation schemes, but I can definitely be competitive through the selfless service we enjoy from … the incredible opportunities that we allow our people to execute.”

But money never hurts — Ryan noted the Coast Guard is trying to use bonuses to attract talented candidates.

Luber said NSA has partnerships with 340 universities nationwide to encourage students to study cybersecurity. Every summer, he said, about 300 students receive 12-week internships at NSA, and 70% to 85% of those interns go on to work for NSA full-time after graduation.

NSA also is trying to encourage even younger people to consider careers in science, technology, engineering and mathematics through a program called GenCyber, which offers students from kindergarten through high school opportunities to attend summer camps focused on cybersecurity. This past summer, he said, GenCyber offered 146 camps in 46 states, Washington, DC, and Puerto Rico.

“It begins early with partnerships — partnerships at K through 12, partnerships with universities, the professors, the students and the faculty — to build the next generation of cybersecurity experts to bring their talents to the National Security Agency,” Luber said.

David McKeown, DoD’s chief information security officer, said the office will fall under DoD’s chief information officer and be led by a yet-to-be-named senior executive. The move is part of an acceleration to ongoing zero trust implementation spurred by the Russian-orchestrated SolarWinds intrusion of federal systems.

“We’ve redoubled our efforts, we’ve fought for dollars internally to get after this problem faster,” McKeown said at C4ISRNET’s CyberCon event. “We’re standing up a portfolio management office that will … rationalize all network environments out there, prioritize and set each one of them on a path of zero trust over the coming five, six, seven years.”

Zero trust assumes no trust across networks, devices or users, and demands constant, real-time authentication of the users accessing data. It’s a departure from perimeter-based security, through which an intruder can often move freely through a network after penetrating it.

McKeown said that while DoD has adopted some components that are meant to work together to create a “zero trust” environment, it’s not being prescriptive about the products its enclaves choose to adopt, as long as those products work together.

“We’ve got a lot of attention on this now, and we’ve got senior leadership in the department on board and putting their money where their mouth is and helping us to implement this at a very fast pace,” he said.

His comments come nearly six months after the Biden administration’s cybersecurity order to improve protections at government agencies in the wake of the SolarWinds intrusion.

McKeown said the sophisticated attack demonstrates the lengths to which intruders will go and the need for better security. SolarWinds, he noted, was a widely trusted piece of software that nonetheless began “beaconing out” from within networks.

“We have to be able to detect something like that,” McKeown said. “Not only the external compromises but the internal malicious behavior and potential supply chain risks need to be looked at.”

“We feel like zero trust is the only solution out there right now that gives us a fighting chance on detecting these folks that may have a foothold on our network or this anomalous software that we’ve allowed in.”

“The task force that I’m associated with is protecting today in order to ensure that there’s a tomorrow,” said Major General Thomas Murphy, director of the Protecting Critical Technology Task Force. “ It might be a little bit of hyperbole there. But I would tell you that if our weapon systems don’t work the way that they’re intended at a time and place of our choosing, we’re going to have a serious problem.”

Murphy’s remarks came as part of the Fifth Domain Cybercon conference held in Arlington, Virginia, November 12, 2019. The task force is housed in the office of the Secretary of Defense, and was stood up in October 2018. The task force describes its broad mandate as protecting “critical technologies wherever they reside.”

To that end, the force is looking at improving cybersecurity in the companies that make military technology, or the industrial base; protecting military technology R&D, be it at universities or labs; block foreign investment and acquisition of military technologies, largely though not exclusively through export controls; and to deny access to those technologies to adversaries.

Of particular concern is not just the loss of intellectual property, but of existing technology being adapted by rivals or used to find weaknesses in deployed weapons.

“We’ve in effect become the R&D base for our adversary’s capabilities,” said Murphy. “My task force isn’t here to stop stealing because stealing is bad, although it is, it’s to stop it because it’s causing the erosion of the lethality of the Joint Force.”

One approach Murphy outlined for meeting all those security goals is creating a tiered ranking of suppliers based on how critical their technology is. The third-party supplier that makes screws for a prime doesn’t need to know much more than the dimensions of the screws, and provided they aren’t taking in and holding on to more critical information than the screws, that supplier could operate at a lower threshold of security. Once the prime company, or university, or third-party supplier needs to know critical information, then Murphy proposes it be held to a higher standard of cybersecurity practice, or else it will be unable to receive the contract.

In order to hold contractors to those standards, the Pentagon has to first develop the standards, which is part of the big push behind the Cybersecurity Maturity Model Certification (CMMC), with an expectation that those requirements will be part of contracts issued in fall 2020.

In the meantime, Murphy floated a somewhat more radical solution to the discovery and exploitation of critical technology by adversaries. In the name of national security, Congress could legislate a layer of opacity over mandated transparency in military programs, which itself would have an impact on how the press is able to cover new developments.

“I mean, I read an article this morning. I read these every day. We’re giving the adversary a map, and it actually has the X marks the spot on it. We’re telling them what companies to go look at what universities who’s doing research on things,” said Murphy. “And I keep hearing, well, that’s legislation that makes us do that. Well, change legislation. We don’t need to be so open.”

If the adversary is as sophisticated as Murphy describes it, capable of repurposing military research through exfiltrated bits on unsecured computer networks, it is unclear how much obscurity would be needed to mitigate the threat, or if it would even work against such a foe.

But in October, Carter wrote in a lengthy blog post that he was “largely disappointed” by U.S. Cyber Command’s effectiveness against the militant group.

“It never really produced any effective cyber weapons or techniques,” Carter wrote. “When CYBERCOM did produce something useful, the intelligence community tended to delay or try to prevent its use, claiming cyber operations would hinder intelligence collection. This would be understandable if we had been getting a steady stream of actionable intel, but we weren’t.”

Asked about Carter’s comments during Tuesday’s Federal Times CyberCon event, two of the Pentagon’s point people on the cyberwar versus ISIS avoided challenging the former Pentagon head. But reading between the lines, both Air Force Brig. Gen. Timothy Haugh, director of intelligence at CYBERCOM, and Air Force Col. Todd Stratton, director of the AFCYBER Forward group, indicated a belief that the digital fight against ISIS is trending in the right direction.

Click here for the latest coverage from CyberCon!

“When you look back now over the last year, we’ve really made some enormous strides,” Haugh said, highlighting in particular the decision to stand up Joint Task Forces Ares, a group tasked with both creating new digital weapons to fight ISIS and to coordinate that digital front with U.S. Central Command.

“That partnership has continued to evolve through the present, in terms of how we have approached the partnership between Cyber Command and U.S. Central Command, and we certainly have realized the number of lessons as to how to present options in the context of what Central Command’s desired outcomes would be,” Haugh told the audience.

The general also underlined a shift in how CYBERCOM goes after ISIS. Where before it was largely focused on doing cyber-versus-cyber operations, the group is now using what Haugh called the “totality of the U.S. government’s capabilities” against digital efforts from ISIS.

“From our perspective that’s not just a Department of Defense issue. It’s how you partner with the Department of State, with Treasury, with Homeland Security — all of those elements to then present options back to both policymakers and to supportive commanders,” he said.

Stratton, for his part, acknowledged Carter’s complaint about the split between intel and operations, saying the “intel gain-loss discussion has always been there and will always continue to be there. That tension is healthy in a lot of ways.”

“We want to have that discussion because there is a time when you want to determine when you kill the bad guy and when you learn more about the bad guys,” Stratton added.

But on that issue, again Haugh sees improvement from the start of the ISIS operations.

“I think what we have really seen is a maturation of being able to allow that decision to be transparent, and to ensure that as those decisions occur, it’s being done with everybody’s input, which we want a whole of government input into that to make sure we’re making the right decision and right recommendation for the nation that we will be best postured after any one of those military operations as we go forward,” he said.

“Though the exponential expansion of the internet and, of course, cyberspace in general has boosted our productivity to incredible heights, it has also opened up avenues for bad behavior by a spectrum of threats ranging from individuals to nation states,” said Pierce.

“Cyber is not a natural domain like air or sea, but a human creation originally developed to facilitate operations in the other domains. The complexity, though, of cyber has grown to where it has become an operational domain unto itself.”

According to Pierce, DARPA invested in the ability for computers to talk to each other as part of a network back in the late 1960s (the origins of today’s internet). Without that investment, Pierce said, the world would be very different today.

“The empowerment of U.S. cyber deterrence has the potential to enhance U.S. deterrence in all domains,” said Pierce, explaining that his office has been working on a variety of projects to set both the military and private sector ahead in cybersecurity and deterrence.

“We had to create surprise in order to prevent it,” said Pierce. DARPA has had a hand in creating well-known modern technologies such as the GPS, the computer mouse and learning personal assistants on smartphones and other devices.

“It’s evident that DARPA’s technological surprises have certainly disrupted commercial markets as well as military technologies,” Pierce said.

In cyberspace, DARPA is working on projects to strengthen the security of software used by the military, to introduce automation to lower response and patch times, and to analyze big data in search of malicious activity.

“Our high-assurance cyber military systems program, or HACMS program, is working to harden the embedded software in commercial and military systems,” said Pierce, explaining that the program works to ensure that the software is built as specified and to deny adversaries the opening to get onto that software.

“We’re working now with the services to transition the HACMS tool to build software with much greater cyber resilience,” said Pierce. “I think we really should begin now to develop explicit cyber resiliency requirements for the software in, say, programs of record.”

DARPA has also hosted events like the Cyber Grand Challenge, which pitted computer against computer in a capture-the-flag style tournament at the 2016 DEF CON in Las Vegas.

“The automation developed under the Cyber Grand Challenge includes the discovery and patching of software vulnerabilities,” said Pierce, explaining that automated patching can resolve flaws in minutes that could potentially take years to discover manually. “I can’t emphasize how much this automation is a game changer in strengthening cyber resilience.”

According to Pierce, his department is also working on pinpointing singular IP addresses behaving suspiciously within datasets containing millions of network log-ins.

“The analysis of vast amounts of data can provide very useful insights, even minimal data such as net flow containing only the IP addresses of senders and receivers,” said Pierce.

Just as the invention of the internet opened a new avenue for malicious actors to attack through, Pierce said DARPA is operating with consideration of how each new technology could be used against them or even to invade the privacy and security of everyday Americans.

Given the scale and scope of cyber hacks in the last five years, many would argue that there is a global cyberwar afoot.

However, defining the problem is important in order to get to meaningful solutions.

From a military perspective, the Air Force is at war all the time given that adversaries are trying to deliberately affect their missions, Frank Konieczny, the service’s chief technology officer, said at the CyberCon conference in Arlington hosted by Federal Times.

The Air Force, he said, has gone beyond the point of trying to defend the network because defending the entire network is not feasible. The Air Force is now trying to defend missions as opposed to “the network.”

Adversaries are seeking to disrupt missions doing things as simple as disrupting data from sensors, making leaders question the validity of data they are getting. Something as simple as altering the data of air pressure in a tire of a tank could lead officials to take that asset out of battle, which could eventually lead officials to question all data coming in.

Konieczny also noted that the Air Force has shifted to defending what is mission critical and looking at mission levels and cyber operations squadrons. Mission assurance has been the main pillar of Air Force cybersecurity as stated by the previous chief information officer. Trying to develop pinpoints of defense as opposed to defending everything has become the push, Konieczny said.

Others are a bit more careful in using the distinction of “war” to characterize the current cyber environment. “War” is a loaded term, William Carter, deputy director of the Technology Policy Program at the Center for Strategic and International Studies, said during the same panel.

“War” has implications for what is expected in terms of response, he said, adding he would like to use the term “cyberwar” to describe the types of activities in cyberspace that warrant a significant response that have the potential to escalate to a military conflict. The activity below that threshold, and more commonly displayed, could be termed strategic competition in cyberspace, which, he contends, doesn’t require thinking in warlike terms but rather draws attention to the act that everyone is constantly competing and strategic equities are always in play and always at risk in cyberspace.

Moreover, the reason it’s important to make this distinction is because if someone committed an act of war against the U.S. in any other domain, they wouldn’t try to indict them through the Justice Department or draw up sanctions; there would be a military response.

The fact that a large-scale cyberattack causing catastrophic harm, loss of life or property damage hasn’t happened in the U.S. could be considered a win on the deterrence front, he said, given adversaries have that capability but have not exercised it yet.

The area where deterrence frameworks need work are all the areas beneath conflict, he said.

In order to have a more holistic, national defense in this new cyber environment, there is a need to exchange ideas and technologies between the private sector and government to better understand the threat space and vulnerabilities, stressed Daniel Smith, vice president and division manager of Cybersecurity Solutions at ManTech.