Thinking About Cyber and Networking Resiliency

I’m well over a month late writing about the July 2015 issue of USNI Proceedings. Simply put, it contains three of the finest pieces about operating under cyber-electromagnetic opposition I’ve read in a long time. I’ll be talking about two of them today and the third one later this week.

First up is LCDR Brian Evans’s and Pratik Joshi’s outstanding article “From Readiness to Resiliency.” Evans and Joshi note that past Navy cyberdefense efforts primarily focused on unit-level compliance with information assurance measures such as firewall configurations, network configuration management and behavior monitoring, physical security protections, and regular ‘hygiene’ training for users. While these kinds of measures continue to be critically important in that they deny adversaries ‘cheap and easy’ attack vectors for exploiting Navy networks and systems, the authors observe that no cyberdefense can hope to keep an intelligent, determined, and adequately resourced adversary out forever. According to the authors, last fall the Navy’s nascent Task Force Cyber Awakening concluded (correctly I might add) that the Navy’s systems, networks, and personnel must able to continue operating effectively, albeit with graceful degradation, in the face of cyberattacks. In other words, they must become resilient.

Evans and Joshi essentially outline a concept for shipboard “cyber damage control.” They describe how the longstanding shipboard material readiness conditions X-RAY, YOKE, and ZEBRA can also be applied to shipboard networks: crews can proactively shut down selected internal and external network connections as tactical circumstances warrant, or they can do so reactively if cyber exploitation is suspected. The authors outline how crews will be able to segment networks and isolate mission-critical systems from less-critical systems, or isolate compromised systems from uncompromised systems, much like damaged compartments can be isolated to prevent the spread of fire, smoke, or flooding. The authors go on to discuss how damage isolation must be followed by repair efforts, and how knowledge of a system’s or network segment’s last known good state can be used to recognize what an attacker has exploited and how in order to aid restoration. It stands to reason that affected systems and network segments might additionally be restorable by crews to a known good state, or at least into a “safe state” that trades gracefully degraded non-critical functionality for sustainment of critical functions.

It’s important to keep in mind, though, that resilience requires more than just technological and procedural measures. When I was an Ensign on USS First Ship in 2001, many crewmembers would tell me of the “Refresher Training” at Guantanamo Bay that Atlantic Fleet ships went through up until budget cutbacks ended the program in the mid-1990s or so. At REFTRA, the assessors would put ships through exacting combat drills in which chaotic attacks, major damage, and grievous casualties were simulated in order to expose crews to the most stress possible short of actual battle. According to some of the senior enlisted I served with, it wasn’t unusual for the assessors to “cripple” a ship’s fighting capacity or “kill off” much of a watchteam or a damage control party to see how the “survivors” reacted. Some ships were supposedly tethered to Guantanamo for weeks on end until the assessors were convinced that the crews had demonstrated adequate combat conditioning—and thus a greater potential for combat resilience. This kind of training intensity must be restored, preferably by shipboard leaders themselves, with the 21^st Century addition of exposing their crews to the challenges of fighting through cyberattacks. Perhaps a scenario might involve intensive simulation of system malfunctions as a pierside ship rushes to prepare to sortie during an escalating crisis. Or perhaps it might involve simulated malfunctions at sea as “logic bombs” or an “insider attack” are unleashed. Evans and Joshi allude to the cyber-conditioning angle in the fictional future shipboard training drill they use to close their article. One hopes that Task Force Cyber Awakening is in fact exploring how to develop the psychological aspect of resilience within the fleet.

This leads nicely into the July issue’s other excellent technical article on network resilience, CDR John Dahm’s “Next Exit: Joint Information Environment.” CDR Dahm argues that even if the Defense Department were to successfully consolidate and standardize the services’ information infrastructures within the most hardened of citadels, this Joint Information Environment (JIE) would still only be as combat-effective as the security of the communication pathways connecting that citadel to force in the field. He relates a fictional saga in which a near-peer adversary wins a limited war by severing the U.S. military’s satellite communications pathways as well as the oceanic fiber optic cables connecting Guam and Okinawa to the internet. He correctly notes that the “transmission layer” connecting deployed U.S. forces and theater/national intelligence, surveillance, and reconnaissance assets with the JIE presents the most vulnerable segment of the entire JIE concept. He alludes to the fact that a force that is dependent upon exterior lines of networking is essentially setting itself up for ruin if an adversary lands effective physical, electronic, or cyber attacks against any critical link in the communications chain. He closes by observing that “the communications necessary to support a cloud-based network architecture cannot simply be assumed,” with the implication being that the JIE concept must be expanded to encompass the transmission layer if it is to be successful in a major war.

We know that just as there can never be such a thing as an impregnable “information citadel,” there is no way to make any communications pathway completely secure from disruption, penetration, or exploitation. We can certainly use measures such as highly-directional line-of-sight communications systems and low probability of intercept communications techniques to make it exceedingly difficult for an adversary to detect and exploit our communications pathways. We can also use longstanding measures such as high frequency encoded broadcast as a one-way method of communicating operational orders and critical intelligence from higher-level command echelons to deployed forces. But both reduce the amount of information flowing to those forces to a trickle compared to what they are used to receiving when unopposed, and the latter cuts off the higher echelon commander from knowledge that the information he or she had transmitted has been received, correctly interpreted, and properly implemented. And neither method is unequivocally free from the risk of effective adversary attack. What’s needed, then, is a foundation of resilience built upon a force-wide culture of mission command. That may be outside the JIE concept’s scope, but it will be integral to its success.

The views expressed herein are solely those of the author and are presented in his personal capacity. They do not reflect the official positions of Systems Planning and Analysis, and to the author’s knowledge do not reflect the policies or positions of the U.S. Department of Defense, any U.S. armed service, or any other U.S. Government agency.