NSA's boot camp for cyberdefense
http://news.cnet.com/8301-13772_3-20003203-52.html?tag=mncol;txt
Air Force Capt. Mike Henson Henson explains to CNET what the annual Cyber
Defense Exercise is about and what the military hopes to achieve.
Daniel Terdiman
by Daniel Terdiman April 22, 2010 12:57 PM PDT Follow @GreeterDan
If you're the kind of person who worries about the security of computer
networks, you should know that the National Security Agency is worrying
about it too.
Since Tuesday, the NSA has been conducting its 10th annual Cyber Defense
Exercise, a competition that pits students from a series of military
academies against each other--and against the competition's leaders at
NSA--in a bid to see who has the best cyberdefense skills. The idea? To
"build and defend computer networks against simulated intrusions by the
National Security Agency/Central Security Services Red Team."
The competition will last until Friday when that Red team, or "red cell," as
it's known, will cease its attacks on the students' newly-built networks.
The goal is to help the students learn about the topic of Information
Assurance, and how it is used to protect the most vital information systems
in the United States and Canada. As they work, the students must defend
their networks and offer up consistent reports on what they're doing and on
the attacks they're identifying.
This year, eight academies are competing: the United States Military Academy
(West Point); the United States Naval Academy; the United States Air Force
Academy; the United States Coast Guard Academy; the United States Merchant
Marine Academy; the Naval Postgraduate School; the Air Force Institute of
Technology; and the Royal Military College of Canada.
The exercise is being hosted by Lockheed Martin in Greenbelt, Md., and
during the four days of the competition, NSA and U.S. Department of Defense
personnel are acting as evaluators--even as the NSA's red team challenges
the students with constant network attacks, all of which must be
"publicly-available, well-documented vulnerabilities." The competition takes
place on a closed network that does not access the Internet.
At the Air Force Academy, one of the instructors helping the students learn
how to construct cyberdefenses--and prepare for the NSA's exercise, is Air
Force Capt. Michael Henson. He agreed to answer some questions from CNET
about the competition, which has been won by West Point for the last three
years. However, the Air Force Academy won in 2006, and Henson surely
believes that his charges will take the crown in 2010.
Q: Explain the major elements of the competition?
Henson: The students must build a network with all of the services required
by the NSA's directive--including e-mail, file sharing, network printing, a
Web server, and a bulletin board system. Their mission is to keep those
services running while thwarting attempts to compromise our systems. We
typically start off with a set number of points and lose points for either a
service outage or a successful compromise of our systems. This year, all
teams built their service providing systems from scratch while we received
our workstation virtual machines from the NSA. We have also been directed
not to patch the workstations until we receive approval. It is expected that
the NSA will find their way into some of the systems regardless of how
tightly we attempt to lock them down and this is when our students actually
tend to learn the most. They need to attempt to understand how the attacker
got in and how to mitigate the problem instead of just restoring to a
backup. Hacking back has been forbidden for as long as I've been involved in
the competition, although this year our students will have a few hours on
Friday to go after some flags on a network the NSA has set up.
Students at the U.S. Naval Academy participating in the 2008 NSA Cyber
Defense Exercise.
(Credit: U.S. Naval Academy)
What are the major threats that students must defend against?
Henson: The threats tend to cover the full rage from downloaded attachments
and links taking our users to malicious Web sites to direct scanning,
enumeration, and attempt at exploitation. We have seen, for instance, that
some of our servers have been targeted with buffer overflow attempts,
cross-site scripting on our Web server, and so on. Much of what the NSA uses
against us is also happening out in the commercial Internet today. This
year, we have a new twist in that the NSA has provided us with a gray cell
member to simulate an uneducated user. This has caused us considerable
difficulty since that user is clicking on every link that comes along and
downloading and executing e-mail attachments.
What are the most challenging aspects of the competition?
Henson: Unlike many of the cyberdefense competitions running today, our
students have to design, build, secure, and defend their network against
attackers from the NSA. In many of the other competitions I've seen, people
are given access to a network that has already been designed and told to
secure it the best they can. Those types of competitions certainly provide
value, but adding the design and build components into the competition
requires our students to do a lot more work. It provides them an opportunity
to have to make decisions that aren't that different from some they'll face
when they commission and go on active duty, such as weighing the benefit of
different operating systems with regard to both usability and default
security. The other part of the competition that is really challenging is
that our cadets have never built a network like this from scratch, so they
have to spend plenty of time in trial and error, especially with some of the
more obscure systems they set up.
How does the education the students get prepare them for the competition?
Henson: The education we provide gives our students a broad foundation from
which to make critical decisions whether they are commanding troops or
defending a network. Additionally, many of our cadets are also pursuing the
cyberwarfare track within the computer science degree, which requires that
they take a cryptography, information warfare, and a network security
course. To enable some of the training that's also required for a
competition like this, we have a Cadet Cyber Warfare Club that provides a
sandboxed network where cadets can learn the craft of network defense.
What tends to make one academy's team better than another?
Henson: This is a tough question but I think the answer is the right mixture
of highly motivated students and plenty of faculty support to help when they
get stuck on a particular problem. Our cadets spend many hours and some late
nights in the lab preparing for the competition. There's also a lot to be
said for experience. This is the first year that we have made a concerted
effort to have multi-year participation from cadets.
Can you think of any defense innovations that have come out of the
competition in the past?
Henson: Most of the innovations that have come from great "out of the box"
thinking during the competition are too much of a violation of the
psychological acceptability design principle to really be feasible. For
example, one school decided to run its Web pages off of CD so that they
couldn't be changed. While that worked to stop changes to the Web site, it
probably isn't very practical for most companies that need a more dynamic
option. One thing I would mention here is that there is a capture the flag
event scheduled for Friday, which will be testing out some of the security
guidance provided by an office at the NSA. If our students are successful at
getting in to that network, it may result in some changes to security
guidance.
Talk about how the competition has evolved over the last few years?
Henson: The competition has evolved in several ways since 2001. One of the
most obvious ways is the amount of support and the number of players. The
competition started out between a few of the schools and now we're up to
eight competitors. Also, the number and sophistication of required services
has grown over the years. Scoring for the exercise has also seen some
dramatic improvements from the early days. Currently, there is a Web site
which gives initial indications of the status of all of the important
services. We also have a white cell liaison at each of the locations to help
adjudicate the points. Another positive evolution has been the move toward a
"fighting through" policy instead of that of the "fortress mentality" of
past years. Which means that some of the techniques used to lock systems
down in the past have resulted in minimal if any successful compromises by
the red cell. While this helps a school to win the competition, it's fairly
unrealistic in practice and could lead to students getting the wrong idea
about security. Instead, all of the faculty have agreed that it is important
for the students to be exposed to situations where they can't guarantee a
system is 100 percent locked down and have to react when that system is
inevitably compromised.
How much more sophisticated are the students today than they were a few
years ago?
Henson: This is interesting, since we are often told that the younger
generations are much more capable with computers and being connected in
general. What I tend to find is that many of our students are very adept at
sending e-mail, and using social-networking sites and so on, but don't tend
to have a grasp on what's happening "under the hood."
Can you think of any great anecdotes from the last few competitions?
Henson: We take pride in the fact that our cadets are able to think on their
feet about networks and security. For example, there are exercise "injects"
whereby the students are faced with a brand new task or challenge. Last
year, one of those challenges was an unruly Web crawler that was causing
problems and gathering information on our Web site. NSA commended Air Force
Academy cadets for their quickness in researching and implementing a
solution. It's that type of critical thinking that will be of paramount
importance for these future officers.
==========================================
(F)AIR USE NOTICE: All original content and/or articles and graphics in this
message are copyrighted, unless specifically noted otherwise. All rights to
these copyrighted items are reserved. Articles and graphics have been placed
within for educational and discussion purposes only, in compliance with
"Fair Use" criteria established in Section 107 of the Copyright Act of 1976.
The principle of "Fair Use" was established as law by Section 107 of The
Copyright Act of 1976. "Fair Use" legally eliminates the need to obtain
permission or pay royalties for the use of previously copyrighted materials
if the purposes of display include "criticism, comment, news reporting,
teaching, scholarship, and research." Section 107 establishes four criteria
for determining whether the use of a work in any particular case qualifies
as a "fair use". A work used does not necessarily have to satisfy all four
criteria to qualify as an instance of "fair use". Rather, "fair use" is
determined by the overall extent to which the cited work does or does not
substantially satisfy the criteria in their totality. If you wish to use
copyrighted material for purposes of your own that go beyond 'fair use,' you
must obtain permission from the copyright owner. For more information go to:
http://www.law.cornell.edu/uscode/17/107.shtml
THIS DOCUMENT MAY CONTAIN COPYRIGHTED MATERIAL. COPYING AND DISSEMINATION IS
PROHIBITED WITHOUT PERMISSION OF THE COPYRIGHT OWNERS.
NSA Teams Up With Colleges to Train Students for Secret Cyber-Ops Jobs
http://www.wired.com/threatlevel/2012/05/nsa-college-students/
By Kim Zetter
The National Security Agency is partnering with select universities to train
students in cyber operations for intelligence, military and law enforcement
jobs, work that will remain secret to all but a select group of students and
faculty who pass clearance requirements, according to Reuters.
The cyber-operations curriculum is part of the Obama administration's
national initiative to improve cybersecurity through education, and is
designed to prepare students for jobs with the U.S. Cyber Command, the NSA's
signals intelligence operations, the Federal Bureau of Investigation and
other law enforcement agencies that investigate cyber crimes.
The U.S. Cyber Command's job is, in part, to support the military in
offensive cyber operations against enemy networks, suggesting the students
would be trained in the methods of hackers.
"We're trying to create more of these, and yes they have to know some of the
things that hackers know, they have to know a lot of other things too, which
is why you really want a good university to create these people for you,"
Neal Ziring, technical director at the NSA's Information Assurance
Directorate, told Reuters.
But another NSA official was quick to add that the NSA wasn't looking to
teach students illegal hacking techniques.
"We are not asking them to teach kids how to break into systems, we're not
asking them to teach that. And a lot of them have said they wouldn't teach
that," said Steven LaFountain, a senior NSA official who guides academic
programs told Reuters. "We're just asking them to teach the hardcore
fundamental science that we need students to have when they come to work
here."
Although 20 universities applied to participate in the program, only four
were selected so far: Dakota State University, Naval Postgraduate School,
Northeastern University and University of Tulsa.
Schools applying for the program had to meet 10 criteria, among them was a
requirement that they teach courses in reverse engineering.
Once the students have the basic knowledge needed, they will be eligible to
receive training to work in classified jobs with the NSA.
"In our operational developmental organization, we would spend up to 12
months to give them the secret sauce, the tradecraft, the really deep
technical training so that they could make themselves useful in doing what
we need them to do, and that's with that technical underpinning," Captain
Jill Newton, who leads NSA's cyber training and education programs, told
Reuters.
==========================================
Exclusive: Spy agency seeks cyber-ops curriculum
http://www.reuters.com/article/2012/05/22/us-usa-intelligence-education-idUS
BRE84L12T20120522?feedType=RSS&feedName=domesticNews
By Tabassum Zakaria
FORT MEADE, Maryland | Tue May 22, 2012 4:42pm EDT
(Reuters) - The National Security Agency is trying to expand U.S. cyber
expertise needed for secret intelligence operations against adversaries on
computer networks through a new cyber-ops program at selected universities.
The cyber-ops curriculum is geared to providing the basic education for jobs
in intelligence, military and law enforcement that are so secret they will
only be revealed to some students and faculty, who need to pass security
clearance requirements, during special summer seminars offered by NSA.
It is not easy to find the right people for cyber operations because the
slice of the hacker community that would make a quality cyber operator
inside the government is only a sliver.
The "quality cyber operators" the NSA is looking for are few and far
between, says Neal Ziring, technical director at the agency's Information
Assurance Directorate.
"We're trying to create more of these, and yes they have to know some of the
things that hackers know, they have to know a lot of other things too, which
is why you really want a good university to create these people for you,"
Ziring told Reuters in an interview at NSA's headquarters in Maryland.
NSA has two main missions: to protect U.S. government computer networks and
to collect foreign intelligence through electronic means like satellites and
decode it.
Of 20 universities that applied, only four received this week the new
designation of Centers of Academic Excellence in Cyber Operations: Dakota
State University, Naval Postgraduate School, Northeastern University and
University of Tulsa.
Out of 10 requirements, the two most lacking at many schools were courses on
"reverse engineering" - or how to gain knowledge of a technology or product
to reproduce it - and cellular communications and mobile technologies, NSA
officials said.
"We found a lot of schools weren't emerging with the technology, weren't
keeping up," said Captain Jill Newton, who leads NSA's cyber training and
education programs.
INNER WORKINGS
NSA officials say the program, which is part of President Barack Obama's
national initiative to improve cybersecurity through education, aims to
prepare students for careers at the U.S. Cyber Command, the NSA's signals
intelligence operations and law enforcement agencies investigating cyber
crimes.
U.S. officials from the Obama administration and Congress have been banging
the drums loudly about the need for greater cybersecurity, accusing China
and Russia of hacking U.S. systems for economic gain.
"Right now you hear a lot of talk about foreign countries, China in
particular, coming into our networks. They get in, they look around, they
see what they might want, they send it home, and you don't know what else
they've left behind," Dickie George, a former NSA official, said. "Why
wouldn't we want to do the same thing? It's not a one-way game."
Many universities are now focused on web technologies such as how to write
applications for the iPhone, which is not what is required for cyber
operations to collect intelligence or defend the government's systems, NSA
officials said.
That requires knowing "the guts, the internals of the operating systems,
having to understand how the hardware actually works," said Steven
LaFountain, a senior NSA official who guides academic programs.
Newton said a cyber operation might involve altering computer systems to
work to one's advantage and doing that "without being seen or without it
being obvious that I was changing the inner workings of the operating
system."
"It could be very useful for a defender, so as you see your stuff being
adjusted, corrupted, exploited, messed with, and being able to recognize
when that is happening to you, to be able to better defend against it," she
said.
About 15 years ago, there was a mindset that the computer system being
compromised happened rarely and if the security was hardened that would be
sufficient to secure it, but the security environment has changed, said
Ziring, a computer scientist and the first non-mathematician in his position
at NSA.
"What we've realized these days is that's hokum, that doesn't work any more,
that systems are under attack constantly," Ziring said.
"For many systems, especially those that for mission reasons have to work in
a very exposed space, being under some degree of compromise is sort of their
new normal state."
That requires actively defending the systems by blocking and mitigating
known problems and hunting for the unknown by looking for anomalies, Ziring
said.
ETHICAL ISSUES
One mandatory requirement in the curriculum is covering legal and ethical
issues so students understand the limits.
"We still found a lot of schools are still a little reluctant on how they
characterize what they are teaching," LaFountain said.
"We are not asking them to teach kids how to break into systems, we're not
asking them to teach that. And a lot of them have said they wouldn't teach
that," he said. "We're just asking them to teach the hardcore fundamental
science that we need students to have when they come to work here."
While the open education provides the basic knowledge, it is not until they
arrive at the NSA that newly hired cyber operators get trained in their
secret jobs.
"In our operational developmental organization, we would spend up to 12
months to give them the secret sauce, the tradecraft, the really deep
technical training so that they could make themselves useful in doing what
we need them to do, and that's with that technical underpinning," Newton
said.
Ziring said it was important to figure out the next step in threat evolution
so the technologies can be built to address it.
"The threat actor's action cycle is speeding up and getting shorter. The
defender's cycle has to get shorter. So what technologies can we build that
will help that?"
(Editing by Anthony Boadle)
==========================================
(F)AIR USE NOTICE: All original content and/or articles and graphics in this
message are copyrighted, unless specifically noted otherwise. All rights to
these copyrighted items are reserved. Articles and graphics have been placed
within for educational and discussion purposes only, in compliance with
"Fair Use" criteria established in Section 107 of the Copyright Act of 1976.
The principle of "Fair Use" was established as law by Section 107 of The
Copyright Act of 1976. "Fair Use" legally eliminates the need to obtain
permission or pay royalties for the use of previously copyrighted materials
if the purposes of display include "criticism, comment, news reporting,
teaching, scholarship, and research." Section 107 establishes four criteria
for determining whether the use of a work in any particular case qualifies
as a "fair use". A work used does not necessarily have to satisfy all four
criteria to qualify as an instance of "fair use". Rather, "fair use" is
determined by the overall extent to which the cited work does or does not
substantially satisfy the criteria in their totality. If you wish to use
copyrighted material for purposes of your own that go beyond 'fair use,' you
must obtain permission from the copyright owner. For more information go to:
http://www.law.cornell.edu/uscode/17/107.shtml
THIS DOCUMENT MAY CONTAIN COPYRIGHTED MATERIAL. COPYING AND DISSEMINATION IS
PROHIBITED WITHOUT PERMISSION OF THE COPYRIGHT OWNERS.
|
WordPress.com
