The Pentagon’s Cybersecurity Priorities Haven’t Changed in a Decade
warisboring.com
warisboring.com
It's not like the nuclear launch system is accessible over the internet, but for example the procurement and logistical system is because it's the only real way to assure that every contractor and supplier can easily access it, as well as every logistical unit in the armed forces can easily access it from everywhere not just the few bases that would be hard wired to connect to the pentagon.
It's really easy to come and say just air gap things but when you have networks that span not only an entire country but the entire globe that need to be accessible to millions of people from both the military and the public sector you can't just do it.
I'm sure if you are able to design a network spanning the continental US, Hawaii, Alaska, US Territories, US bases around the globe, allowing both military personnel, civilian workers, contractors and suppliers to securely connect to it while being both economical on any order of magnitude close to the current cost and being effectively "air gapped" and secure the pentagon would award you a contract to build it in a heartbeat.
Until then let's all stop being literally arm chair generals and assume that while it surely has allot of room for improvement someone at the pentagon might just know what they are doing and they are doing the best as they can or fairly close to it considering all the constraints they have to operate against.
Military networks are fairly secured, while the article does bring a few interesting anecdotes it's quite hyperbolic.
Also I would like to point out that every big hack today, especially those from state actors used fairly common and even "outdated" attacks and vulnerabilities, they were masterfully executed but it's not like they used some super new exploits and attack vectors that no one heard of before.
Military doctrines take time to develop, even in "cyber warfare", military computer systems also don't tend to be the latest and greatest as far as hardware and software goes but they are often reliable.
Building defenses around what you know and what your attackers are able to do is a good strategy, knowing when and what to airgap and what to protect is also critical because not every military network is secret nor critical. You focus your resources on an effective strategy the 80–20 rule applies even to military and defense networks.
There are ways to balance it and it is a balance, giving users access in one location to air gapped and internet-connected systems for example, but there's a context-switching cost (and risk) there. To keep up with and even ahead of the curve though it's so much easier to do as much as you can without an air gap.
I've worked with people who've spent decades behind an air gap and it can be like working with people from the past. Imagine being a developer in 2016 who doesn't understand how Google, let alone Stackoverflow, can help their work.
A former boss told me about his time in the RAF, they had one machine in their office that could connect to the Internet, it was at one end of the office and hooked up to a big screen, so everyone could see that you weren't I dunno, browsing the Russian Embassy's website or something.
As the physical and virtual worlds blend more and more into one another, as bits become more capable of effecting atoms, we become more like the colonies on the eve of the attack.
Have there been any demonstrations of machine learning to either detect or initiate networked systems breach? All my internet connected servers are probed by automated bots trying to brute force their way in. It will be interesting to see how this develops.
I do know our systems are very fragile and we are incredibly vulnerable. In 2016 computing is just not secure enough for the tasks we are assigning it.
As an example of what you mentioned, most of the TS/SCI dark fiber is at a minimum enclosed in pressurized pipes. When the pressure in any segment of those pipes drops below a threshold, armed goons come see what's going on in a hurry. I know this anecdotally as one of my cousins works on a construction crew near Ft Mead. His company's backhoe punctured one of those pressurized and unmarked pipes and they came in 10 minutes.
9/11 demonstrated that the Pentagon is the field.
Yes, but in a way that still makes the camouflage irrelevant.
When you want to have a rigid chain of command and people who all essentially always follow orders, you need conformity and obedience.
In military they do have to institute obedience (you can get executed on the place for disobedience) and they already has an elaborate system of costumes to wear under different conditions.
To add to these another field/office distinction would
(1) increase cognitive load, (2) will bother those officers who work in the office since they'll be looked at as 'second-class' just from heir looks, and (3) camo isn't unfit for the office which (as sandworm101 have noted) can suddenly turn into a battlefield if they attack the building.
Overall, one less decision to make, and that decision would only benefit those in the field. Which are, by definition, not the highest-ranking.
https://static.securityintelligence.com/uploads/2014/04/2014...
The article is critical of the military for prioritizing service continuity, but that is what large organizations dealing with continual attacks must do. They are not on a war footing, ready to throw down everything for total victory. Cutting off online attacks in wartime is different than in peace. Got a boat with an anchor? The navy does.
Their priorities haven't changed because their conflict space hasn't changed.
[1] http://www.govtech.com/security/US-Cyber-Commands-Launches-1...