CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

Home » CCSA

CCSA

Addressing Cyber Instability Executive Summary

After two years of intensive study and research, the Cyber Conflict Studies Association is preparing to release their book-length monograph on “Addressing Cyber Instability.” Last month, the CCSA released an executive summary previewing the work, which is available for download.

The impetus for “Addressing Cyber Instability” is that, though cyberspace has become indispensable and irreplaceable for people, companies, and nations, it remains insecure due to technical and  policy challenges. On the technical side, the Internet was not designed with security in mind, and as for policy, the new technology evolves faster than the legal, doctrinal, organizational, and conceptual framework around it. As a result, the CCSA concludes that cyberspace in its current form is inherently insecure and needs to be handled accordingly.

The monograph begins by defining its key terms. Though there are many technical definitions of cyberspace, the most accessible is that “cyberspace is all interconnected information technologies.” The CCSA deals primarily with cyber conflict, which it defines as “the conduct of large scale, politically motivated conflict based on the use of offensive and defensive capabilities to disrupt digital systems, networks, and infrastructure, including the use of cyber-based weapons or tools by non-state/transnational actors in conjunction with other forces for political ends.” This is broader than “cyber war” as it includes the likes of nonstate actors, covert action, and espionage, but excludes cyber crime committed strictly for commercial gain with the exception of economic warfare. The executive summary also lays out the focus of the monograph, which will be strategic rather than tactical or technical, and the five research vectors that the CCSA has been pursuing.

The first vector is strategic level issues. Despite predictions to the contrary, there has not yet been any massive cyber attack, suggesting some level of deterrence may be at play in cyberspace. Yet, according to the CCSA, the offense-defense  balance in cyberspace makes deterrence by denial difficult as offense has the clear upper hand. Deterrence by punishment is more feasible but suffers from difficulty in attribution and credibility. It is often difficult to pinpoint an attacker to punish and to establish a credible threat of effective punishment. As a result, the CCSA concludes that deterrence is weak in cyberspace, causing instability.

The second research vector is military and operational. The monograph will explore how military and intelligence doctrine, strategy, and organization has evolved in the United States to deal with cybersecurity challenges. The monograph will also suggest the future direction of this evolution, noting that practitioners and bureaucracies must be agile to adapt to fast-paced threats and that military cyber defense must grow more collaborative and needs sufficient knowledge capture to build on existing lessons and experience.

The third vector will examine nonstate actors in cyberspace. The monograph will explore the role of nonstate actors in cyber conflict and the greater role nonstate actors such as Computer Emergency Readiness Teams and researchers must play in managing future conflicts.  The CCSA concludes that there is a pressing need to develop mechanisms which foster defensive collaboration between a wide range of nonstate actors.

The fourth research vector that the monograph addresses is domestic and international law. The CCSA will first explain the current domestic and international frameworks for cyber operations and the growing consensus on legal issues. Implementing these frameworks is hindered, however, by an immaturity in applying legal constructs to malicious activity in cyberspace and more time is needed for norms and customs for behavior to develop.

The last research vector will deal with approaches for mitigating cyber conflict. The CCSA suggests three models for dealing with cyber instability. The first is based on public health and emphasizes useful norms such as hygiene, with practices such as patching vulnerabilities the equivalent of hand washing. The next model is environmental, focusing on cleaning up the cyber environment through legal regimes like those in place to battle pollution. Lastly, irregular warfare can serve as a model for cyber conflict, thought the CCSA is careful to note that this does not mean we are engaged in irregular warfare in cyberspace, merely that we face assymetric forces and irregular tactics.

The executive summary concludes with an overview of the CCSA’s future research agenda and a call to action. Current studies raise many more questions that the Cyber Conflict Studies Association hopes to explore such as balancing intelligence gain and intelligence loss in cyberspace and how norms surrounding cyber conflict can be developed. Having found cyberspace to be inherently unstable, the CCSA urges focusing on resilience in the face of threats and cleaning up the cyber environment to reduce them.

For more on these topics see the CTOvision Guide to National Security Technology and

Addressing Cyber Instability Panel Discussion

The final portion of the Cyber Statecraft Initiative‘s and the Cyber Conflict Studies Association‘s ”Addressing Cyber Instability” event was a panel discussion and question and answer session. The panel included Greg Rattray, CEO of Delta Risk and former Commander of the Operations Group of the Air Force Information Warfare Center,  Kris Martel, Senior Cybersecurity Architect at Intelligent Decisions, Michael Mulville, Client Solutions Executive at Cisco Systems, and Jason Healey, director of the Cyber Statecraft Initiative, as the moderator.

Martel began by addressing the growing trend of hacktivism. Hacktivism is different from regular cyber crime as the goal is to penetrate governments and organizations to “teach them a lesson” and, with this different motive, can be more difficult to combat as well. As hacktivist groups are ideologically motivated, organizations are afraid to fight them or strike back and incite retribution. Hacktivist groups also tend to be part of a movement rather than an organization and hence do not have leaders to target but you can’t go after everyone in, for example, Anonymous. When asked how governments and organizations can reach out to Hacktivists rather than trying to fight them, he suggested giving them a chance to express themselves in order to bring them over to our side. Martel thought more freedom and creativity would benefit cybersecurity as a whole. For resiliency, he suggested education focusing on the solutions we want tomorrow rather than what we have now, starting young, and giving students the freedom to innovate. Martel also saw the rise of cloud computing as an opportunity to get cybersecurity right by “baking security into the cloud” rather than adding it as an afterthought like we did for the Internet. Another trend Martel noted was significant for security was Bring Your Own Device.

Mulville reiterated one of the themes of the events, that deterrence is essentially void in cyberspace.  Many agencies don’t even know what it is they hope to deter as they are not sure what is happening on their networks until days or weeks later. Achieving deterrence would require a sweeping change of approach as cybersecurity faces organizational, not simply technical, problems. At this point, we’ve been trying to solve the same problems for so long that we’re faced with diminishing returns and need to try new strategies.

Rattray confirmed the sorry state of national cybersecurity. He recalled how two senior Federal Bureau of Investigation officials had told him that the problem only got worse under their watch, He also continued with the theme of the difficulty of deterrence in cyberspace, noting that the risk of losing deterrence by not acting is smaller than the risk of miscalculating a response and hitting an innocent party due to flawed attribution and containment or violating fledgling norms and laws. Rattray also corrected some misconceptions about cyber deterrence. Though cyber weapons are often shrouded in mystery, we do have a fairly good idea of other nations’ capabilities and they understand ours. Also, cyber espionage is not a deterrence problem, it’s an espionage problem like physical spying.

Jay Healey discussed the idea of cyber war. While we are not at cyber war, as that would mean we could take kinetic action to kill attackers, Stuxnet crossed more than one rubicon. Aside from being the first cyber weapon with important kinetic effects, it was also the first truly autonomous weapon as it did not need to check back at any point. Using Stuxnet was a huge decision that required more transparency. It also weakened norms in cyberspace, as it is harder for the United States to say China can’t engage in cyber espionage while we launch cyber attacks. As cyberspace is unstable, there’s an advantage to attacking early, especially as offense has the advantage in cyber. With regards to measures meant to increase stability and security at the price of privacy, Healey noted that most of the currently discussed solutions are the ones that least affect privacy and are the low-hanging fruit of cybersecurity.

We track these and many related issues in our CyberWar site.

For more on these topics see the CTOvision Guide to National Security Technology and

Instability in the Cyber Environment

Continuing where  James Mulvenon left off at the the Cyber Statecraft Initiative’s and the Cyber Conflict Studies Association‘s “Addressing Cyber Instability” event, Greg Rattray, CEO of Delta Risk and former Commander of the Operations Group of the Air Force Information Warfare Center, spoke on “Instability in the Cyber Environment” at the Atlantic Council on July 10.

Rattray began by clarifying that in his view, while not secure, the design of the Internet isn’t flawed. The open, interconnected platform was a highly successful experiment that continues to add to global prosperity immensely in its current form. Now, however, the qualities that made it so successful threaten its security, creating an opportunity for a trade off, sacrificing a little of the Internet’s current open, connected nature to gain much in stability.

Another obstacle to Internet stability and security is the astounding technological rate of change. This does not bode well for security as the technology changes faster than defenders can react and this change will likely to speed up rather than slow down in the future. There is also a significant Internet underground with well resourced actors that can challenge and coerce states. Currently, non-state actors, including criminals, have an advantage in cyberspace and it’s unlikely that there will be any technological change or restructuring any time soon that will fundamentally alter these dynamics.

As technology can’t save us, we must cooperate to add stability to cyberspace. Criminal, terrorist, and hacktivist groups are one area where the United States can work together even with states where we have conflicting interests in cyberspace, such as China.  Another way to help reduce cyber instability is by focusing less on security and more on risk management. Because the Internet today and for the foreseeable future cannot be perfectly secure, the most important choice becomes how we use it. We can avoid most risks by not using the Internet at all, but that’s neither wise nor even feasible anymore.  Other trade offs, such as whether to take the efficiency of online banking along with the risks, are indicative of the sorts of decisions we will increasingly be faced with while trying to adapt to an insecure internet. Since attacks will keep coming and defenses will never be perfect, Rattray also emphasized moving away from a passive model with methods such as network deception.

Rattray concluded that, at the national level, we still want a vibrant internet so we can continue to reap the benefits of its openness and  interconnectedness. To do so, we must make our networks and practices resilient, which will be expensive and require difficult choices and trade offs. And, as we are the nation with the most at stake online, Rattray warned against those living in glass houses like the United States throwing rocks like Stuxnet.

For more on these topics see the CTOvision Guide to National Security Technology and

Stability and Instability in National Security

On Tuesday, July 10, the Atlantic Council’s Cyber Statecraft Initiative and the Cyber Conflict Studies Association held another excellent event on “Addressing Cyber Instability“. The event marked the launch of CCSA’s new capstone report, Addressing Cyber Instability,  which previews and discusses the CCSA’s upcoming monograph on the subject. The first speaker to discuss the topics covered in the report was James Mulvenon, Chairman of the Cyber Conflict Studies Association and Vice President of Defense Group, Inc.

Mulvenon discussed whether recent developments in cyberspace are pushing us into a new age of national security. It’s always hard to tell when you are on the precipice of a new era, and security and technology thinkers have been hypothesizing on the impact of cyber for years now. The “Richard Clarke” type catastrophe some analysts have been predicting still hasn’t happened, suggesting a possible tacit global deterrence in cyberspace has been maintaining the status quo.

Recently, as General Michael Hayden, former head of the NSA, noted, Stuxnet “crossed the rubicon” as a major, physically destructive cyber attack by a state actor. Mulvenon compared Stuxnet to the nuclear bombing of Hiroshima, not by damage done, but as the first use of a weapon ushering in a new era of warfare. Before Hiroshima, nuclear arms were known to be possible, and had even had limited demonstrations, but only when the United States bombed Japan, showing both a willingness to use nuclear arms and their true destructive potential, did a new age of warfare begin.

Deterrence , norms, and international agreements have prevented nuclear war, but those were developed ad hoc basis during the Cold War. The international community is still trying to arrange similar stability in cyberspace.  Mulvenon remarked that cyberspace is naturally unstable and insecure, making this process more difficult. The Internet was built for resilience and convenience, not security, which is therefore not part of the infrastructure. As a result, Mulvenon characterized cyberspace as offensive dominant and with little escalation control in conflict. Information technology also changes rapidly, outpacing the regulatory and legal process. Lastly, there are low barriers to entry, meaning that many non-state actors can become involved in conflict and politics online.

All is not lost, however. Despite claims of a “global commons” and the difficulty of attribution, most of the Internet architecture falls under Westphalian norms. Servers, computers, cables, and networks all have physical locations within a country’s borders. A stable cyberspace is then possible but requires both a national and global cybersecurity strategy based around resilience, as well as an effort to clean up the ecosystem of malicious actors and widespread vulnerabilities. Other speakers and panelists went into more detail as to what that might looks like, which we will cover in later posts about the event and the Cyber Conflict Studies Association monograph.

Stuxnet: An important change in the national security landscape

Siemens provides the SIMATIC PCS 7 with “everything you need to completely and safely automate your entire production process.”

There are some important strategic changes occurring in the national security landscape.

A new kind of cyber attack has been noted, one that involves use of malicious code to attack infrastructure.  There are some important points in this attack that should be understood by national security decision-makers.

With the launch of the code the security community calls Stuxnet, an attack was made against a programmable logic controller (PLC) that runs a physical system.  This is a new degree of bad in cyber attacks.

This code is potentially (probably?) nation-state sponsored.  We might never know which country, but a review of the geo-political situation today can lead to some informed speculation.

Below is some Stuxnet context:

Background: A piece of malicious code called Stuxnet was discovered over the summer.  It was highlighted by security experts like Steve Bellovin in July 2010. Steve pointed out that the use of zero day attacks and the targeting of a SCADA system was of note.

Piece of Stuxnet Code as analyzed by Ralph Langner

Many other security researchers discussed this code but one of the better technical write-ups is captured by Ralph Langner in his report titled “Stuxnet is a directed attack– ‘hack of the century’”

Key points made by Ralph Langner are that:

  • This was a directed attack, aimed at sabotage vice espionage or privacy attacks.
  • The full effect of the package only occurs at places where are targeted piece of equipment is located. This means knowledge of a specific target was used in designing this weapon.
  • Many other features point to heavy insider knowledge.
  • Although smart use of zero day attacks was used, the real expertise was with the specific control system. This was not some hacker or group of hackers. This is a group with knowledge of the target.

Some great analysis also comes from Gary McCraw of in a post at InformIT titled “Software [In]security: How to p0wn a Control System with Stuxnet.”

Gary McGraw makes the points that:

  • Stuxnet seems to be proof of a sophisticated, narrowly targeted collection of malware controlled by a well resourced entity.
  • It was discovered accidently  by anti-virus researchers in June 2010, but may have been in the wild since early 2009.
  • Gary underscores that the delivery means is not what is key here.  An almost infinite number of delivery means could have been used, unfortunately. There is a deep well of zero day attacks waiting to be discovered.  The key thing is the ability of Stuxnet to inject code into a running control system.
  • Gary also clarifies that this attacks is NOT against the SCADA.  It is against the programmable logic controller (PLC) which runs the physical system directly.  This makes this attack much more sinister.

Some analysis and recommendations:

I should mention a disclaimer: I don’t have a clue about how hard it would be to write this code or insert it.  I don’t have any insider knowledge about this or have any idea who did it.  And, although I am certainly a student of technology my personal coding skills are so weak I could not offer any personal opinions that come close to those of McGraw, Bellovin or Langner.  Those guys are masters I hold in high regard, and they and many other experts are convincing me that this is unique.

  • It is possible that the code could have been written by one very smart coder, but it is more likely the result of a team.
  • The smart use of well prepared, unknown exploits makes this sophisticated, but that is just the delivery means.  The key point is the weapon- the piece that changes how a control system operates.
  • This, to me, points to a historical first. I believe, this is the first publicly available evidence of a piece of weaponized code being delivered to have an impact on a SCADA system.
  • This does not seem to have been designed, at all, to provide data out.  It is not built for espionage.  It is built to impact infrastructure.
  • And it is built to impact a very specific infrastructure, not all infrastructure.  It is targeted.
  • We are all put in the awkward position of being tempted to blame Israel for this attack.  If the code does what it seems to do, and if it was targeted against centrifuges at Natanz, then it is logical to assume Israel could benefit from this.  But in the cyber world it can be very hard to prove who is behind an attack. We should all be on guard for reports that claim to know where this came from (scrutinize any reporting so you know what the facts are).
  • If a country sponsors an attack against another country, is it an act of war?  Well, if a country bombs another country’s nuclear weapons program, is that an act of war?  Seems like this is an issue worth additional study.
  • If a country launches a weapon like this, does it mean they are ready for the “blow back” when other country’s launch weapons like that against them?  I don’t know of any country that is protected (or protectable) against these sorts of threats.  So why would any country launch an attack like this?

My recommendations:

  • If you are not already studying cyber issues, seems like now would be a good time to start.  There are many venue available for you to study cyber conflict.  One of my recommended places is the Cyber Conflict Studies Association (CCSA), but there are many other ways to get involved and get up to speed on these many dynamics of cyber conflict.  Depending on your interest and abilities you can join and learn from and advance the cyber conflict thinking at: SANS, AFCEA, INSA, IEEE, ACM, AAFS , CFR, and/or many others.  One thing I’m certain about is that we will need contributions from a wide range of experiences and viewpoints as we move forward into the future, so find your path and dive in.
  • I also recommend that you do what you know you need to do in your own enterprise.  Ensure you are mounting a vigorous defense in depth.
  • Oh, and don’t let anyone in your organization tell you that your SCADA systems are protected because they are not directly connected to the Internet. If they can be reached by any network or USB drive or other media, they are not isolated.

And a closing thought:

I think once again it is an important question for you to ask yourself:  Can you trust your toaster? More later.

We track these and many related issues in our CyberWar site.

Q&A: Bob Gourley on the Cyber Conflict Studies Association – FierceGovernmentIT

Gourley provided context on the Cyber Conflict Studies Association. An except follows:

FGIT: What is the Cyber Conflict Studies Association?

Gourley: It was formed in 2003. We’ve been focused on academia, working with the colleges, and therefore not been seeking a lot of publicity. Our whole purpose of being is to advance the field of knowledge around cyber conflict, and that meant working with institutions like MIT or the Kennedy School of Government or Georgetown or University of Maryland, those kinds of places.

FGIT: What kinds of advances in thinking has CCSA contributed to?

Gourley: This is not just a computer security challenge. This is something that other part of the community needs to study, not just the computer security guys. We need policy makers to be thinking through cyber conflict, and that has possibly been our greatest contribution–getting the policy makers and those who study peace and war engaged in the study of cyber conflict.

via Q&A: Bob Gourley on the Cyber Conflict Studies Association – FierceGovernmentIT.

We track these and many related issues in our CyberWar site.

What is the Cyber Conflict Studies Association?

The Cyber Conflict Studies Association (CCSA) is a non-profit organization formed to promote and lead a diversified research agenda in the field of cyber conflict.  The group was formed as a means to foster dialogue, lead research and develop academic programs focused on the implications of cyber conflict.

To meet these goals, CCSA promotes and leads international intellectual development efforts like workshops and conferences that bring together professionals from industry, academia and government to discuss strategic issues surrounding cyber conflict.

The CCSA also serves as a resource for national security decision-makers.  The CCSA contributes to framing issues promoting national cyber conflict policy.

How do you engage with CCSA?  If you are involved in academic research or studies in the domain, or if you are a policy-maker or thought leader in the community, engaging the CCSA is easy.  The first step is to visit the website at http://cyberconflict.org If you believe you can contribute to or benefit from the dialog please sign up for our low volume e-mail distro list. We use that to announce our workshops and conferences.

Another thing you can do is engage directly with the many writers/thinkers/thought leaders that are helping to move the cyber conflict agenda forward.  How you do that is a matter of personal and professional choice, of course.   But I hope one of the ways to engage with CCSA thought leaders is to read the blogs of CCSA members.  Some to check out:

  • Halt of the Spear: http://www.haftofthespear.com Mike Tanji writes from experience in and out of government and his blog belongs on the reading list of anyone studying cyber conflict.
  • Devost.net: http://www.devost.net/blog Matt Devost provides insights in issues of cyber security, counterterror and modern IT.
  • Selil.com:  http://selil.com This is the site of professors Sam and Sydney Liles. They write on cyber warfare, privacy, computer security and more.
  • CTOvision.com: https://ctovision.com The point and purpose of this blog is more about enterprise technology and disruptive IT, things enterprise CTOs need to track and prepare for. But the background of the blog’s founder and editor causes it to hit on cyber conflict matters as well.

Pulling together that quick list makes me think of another service the CCSA can provide the cyber conflict community.  We should probably ask the CCSA to establish a list of good cyber conflict blogs and twitter feeds.  As a start to that list, can you tell me please what your favorite cyber conflict blogs are?  Do you write a blog on that topic yourself?

We track these and many related issues in our CyberWar site.

For more on these topics see the CTOvision Guide to National Security Technology and

CTO Perspectives on Cyber Security Bill

On June 10, 2010, the US Senate Homeland Security and Governmental Affairs Committee (HSGAC) unveiled a major cybersecurity bill designed to modernize, strengthen, and coordinate US Cyber defenses.

Senators Collins, Carper and Lieberman introduced this bill with the clear articulation to defend not just federal networks but the Internet itself.

The bill itself is named the “Protecting Cyberspace as a National Asset Act of 2010.”

It creates an Office of Cyber Policy in the White House with a director accountable to the public to lead all federal cyberspace efforts and devise national cyberspace strategy.  A National Center for Cybersecurity and Communications within the Department of Homeland Security, also led by a director accountable to the public, to enforce cybersecurity policies through the government and even the private sector.

Some key aspects of this Bill, from the site of the HSGAC:

  1. Creation of an Office of Cyberspace Policy in the Executive Office of the President run by a Senate-confirmed Director, who will advise the President on all cybersecurity matters. The Director will lead and harmonize federal efforts to secure cyberspace and will develop a national strategy that incorporates all elements of cyberspace policy, including military, law enforcement, intelligence, and diplomatic.  The Director will oversee all related federal cyberspace activities to ensure efficiency and coordination.
  2. Creation of a National Center for Cybersecurity and Communications (NCCC) at the Department of Homeland Security (DHS) to elevate and strengthen the Department’s cyber security capabilities and authorities. The Director will regularly advise the President on efforts to secure federal networks.  The NCCC will be led by a Senate-confirmed Director, who will report to the Secretary. The NCCC will include the United States Computer Emergency Response Team (US-CERT), and will lead federal efforts to protect public and private sector cyber and communications networks.
  3. Updates the Federal Information Security Management Act (FISMA) to modernize federal agencies practices of protecting their internal networks and systems. With strong leadership from DHS, these reforms will allow agencies to move away from the system of after-the-fact paperwork compliance to real-time monitoring to secure critical systems.
  4. Requiring the NCCC to work with the private sector to establish risk-based security requirements that strengthen cyber security for the nation’s most critical infrastructure that, if disrupted, would result in a national or regional catastrophe.
  5. Requiring covered critical infrastructure to report significant breaches to the NCCC to ensure the federal government has a complete picture of the security of these sensitive networks.  The NCCC must share information, including threat analysis, with owners and operators regarding risks to their networks. The Act will provide specified liability protections to owners/operators that comply with the new risk-based security requirements.Creation of a responsible framework, developed in coordination with the private sector, for the President to authorize emergency measures to protect the nation’s most critical infrastructure if a cyber vulnerability is being exploited or is about to be exploited. The President must notify Congress in advance before exercising these emergency powers. Any emergency measures imposed must be the least disruptive necessary to respond to the threat and will expire after 30 days unless the President extends them.  The bill authorizes no new surveillance authorities and does not authorize the government to “take over” private networks.
  6. Development of a comprehensive supply chain risk management strategy to address risks and threats to the information technology products and services the federal government relies upon. This strategy will allow agencies to make informed decisions when purchasing IT products and services.
  7. Requiring the Office of Personnel Management to reform the way cyber security personnel are recruited, hired, and trained to ensure that the federal government has the talent necessary to lead the national cyber security effort and protect its own networks.

Now some analysis:

  1. By ensuring the White House will have a Senate-confirmed Director, it will help underscore for the executive branch that this issue should be taken a bit more serious.  Sounds like a prudent thing for the Congress to do.
  2. Creating a National Center for Cybersecurity and Communications (NCCC) in DHS with a leader also confirmed by the Senate sends a similar message, but it also empowers an individual and group to do something that no one has been authorized to do before (at least no one under the rank of President). This office will have authority to lead across government.  As a CTO with enterprise experience I respect this kind of position.  I am convinced you cannot defend large enterprises without the smart application of both central authority and decentralized action.  If you try with either of those missing you fail.  I am not worried about too much technical authority being drawn into one location, there are too many forces at play to keep that power from being abused and, if the person and staff are picked carefully, they will avoid making decisions that impact missions in a negative way.  Notice I have caveated my opinion here.  The nation must choose wisely and put a very smart technology leader in this position.  Someone who can enforce the right standards and give direction when required but can back off and let agency IT leaders run things when required and that person must be smart enough to know when and how to decide what to decide about.
  3. Updating FISMA is long overdue.  Moving towards real-time monitoring is GREAT!  It is the only way I know of to move towards enhancing both security and functionality at the same time.
  4. Naming the NCCC as the focal point for coordination with the federal sector is also a solid move.  It goes without saying, but the NCCC should be staffed and led by very savvy, very social, very action-oriented people.  Without social leaders with high emotional intelligence we stand the risk of getting what we have always gotten here.
  5. As a CTO, I applaud the measures this Bill describes for removing artificial impediments to information sharing.  Government and industry need trust-based relationships and unfortunately too many laws and behaviors that flow from those laws, like FOIA, have damaged those relationships.  Addressing them head on is the right thing to do.  Technologically there are few issues here.  Issues are in policy and the Bill seems to do a good job at addressing some big ones.
  6. Development of a comprehensive supply chain management strategy is another great goal I am glad to see.  There has been a great deal of action lately in establishing coordination mechanisms with senior IT leadership in the country and I believe this will serve as a good foundation for development of a strategy like this.
  7. The human side of technology is one that also needs significant attention and it is good seeing the Bill address this head-on by requiring OPM to reform the way the government leads cyber security personnel.

Some concluding thoughts:

  • I wish I would have raised another issue with the staffers.  I feel bad about this, but I have something I would like to add to the Bill.  I guess I’m too late, but maybe I can get my input to the SSCI or HPSCI instead.  I want to suggest that the US Intelligence Community be tasked with providing a detailed yearly cyber intelligence threat assessment  for unclassified dissemination. The IC does a good job of providing some counterintelligence assessments and frequently mentions cyber in open fora like Congressional Testimony, but I believe this issue deserves a focused, NIE-like report dedicated to this topic.  Of course the IC should also be tasked with support to the NCCC.
  • I found the Bill was full of smart information coordination and information sharing language and constructs.
  • The great work of folks at NSA, Cyber Command (including legacy organizations like JTF-GNO and JFCC-NW), STRATCOM, DHS, NCICC, US CERT, FBI, DC3 and many others must continue and I believe the language in this bill is very respectful of the great work that these groups have been doing.
  • I wonder who the first CTO of the NCCC will be?  That is going to be one cool job!

For more see:

More Content

Cyber War

Optimizing Corporate Intelligence with OODA Loop

This post is part of our Intelligent Enterprise series, which providing insights aimed at corporate strategists seeking competitive advantage through better and more accurate decision-making. The first post provided foundational insights into A Practitioner’s View of Corporate Intelligence. This one dives into actionable recommendation on ways to optimize a corporate intelligence effort. It is based on a career serving large scale analytical efforts in the US Intelligence Community and in applying principles of intelligence in corporate America.

SciFi

Science Fiction Gadgets You Can Get Today

Technology is advancing pretty fast, at times influenced by the exciting world of Science Fiction. This video captures 10 of the tech developments first seen in SciFi that are available now. A key point of this, if you want to know what is in our future, watch more SciFi!  

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]